A transferable adversarial attack method based on adaptive multi-scale degradation

Abstract

The present invention discloses a transferable adversarial attack method based on adaptive multi-scale degradation, which uses corresponding resolution degradation to generate perturbations at different scales so that adversarial samples are less sensitive to small-scale differences between these models. Perturbations of different scales are obtained through a series of copies of the input image with reduced resolution. In order to further utilize perturbations of different scales, the present invention proposes an attack based on adaptive multi-scale degradation, which realizes adaptive multi-scale perturbation fusion and improves the transferability of generated adversarial samples. At the same time, the present invention adopts an adaptive multi-scale perturbation fusion design, and uses noise to perform a preliminary evaluation of the transferability of perturbations of different scales, and then performs adaptive fusion to prevent a specific scale from falling into a local optimum and affecting the overall performance.

Description

Technical Field

[0001] The present invention belongs to the field of counter-attack technology, and more specifically, relates to a transferable counter-attack method based on adaptive multi-scale degradation. Background Art

[0002] Deep neural networks are vulnerable to adversarial attacks, which add small perturbations to the input data to manipulate the model into making incorrect predictions. Under black-box attack conditions, the attacker lacks knowledge of the specific details of the target, so a practical approach is to use a proxy model to generate adversarial samples, which requires that the adversarial samples generated by the attack method have high transferability. Methods to improve transferability are mainly divided into two types, including model enhancement methods based on image transformation (such as translation) and methods based on optimized iterative updates (such as momentum acceleration). The purpose of model enhancement methods based on image transformation is to transform the input data and then simulate different models, thereby increasing the diversity of adversarial samples and fusing the attack results of different transformations to enhance the model and reduce the impact of different model changes. Methods based on optimized iterative updates introduce different optimization strategies to improve the standard gradient-based iterative algorithm, helping the algorithm to escape the local optimum in the gradient direction and improve the transferability of adversarial samples.

[0003] Existing adversarial attack methods to improve transferability usually use gradient-based methods, that is, using pre-trained network gradients to generate adversarial perturbations. This has the following shortcomings: (1) The gradients between different networks are changing and the changes are noisy, that is, they are all small-scale changes. Existing methods find it difficult to overcome such noisy changes, resulting in failure in generating adversarial samples. (2) Existing methods generally use alternative models to generate adversarial perturbations, which can easily fall into the local optimal solution of the model, resulting in poor transferability. (3) The areas of focus between different models are also different in the original image resolution, which makes the adversarial perturbations generated by the alternative models unable to be focused on by the target model.

[0004] Existing methods generally fuse different perturbations with equal weights, which severely limits the flexibility of adversarial sample generation. If a generated perturbation falls into the local optimum of the model, but is still fused with fixed weights, this will seriously affect the overall performance.

[0005] In addition, current adversarial attack generation methods are easily affected by model changes. Using gradients, we can identify the key features that the classification network relies on for prediction, that is, the image information that the model pays more attention to during the prediction process. For example, visualize the gradient graphs of ResNet-50 and DenseNet-161, and the difference between the two, as shown in Figure 2. Figure 1As shown in , we can see that different models focus on different features, and this difference is usually reflected in the small-scale structure, that is, the difference map between the two is noisy. In addition, as Figure 2 As shown in Figure 1, Grad-CAM is used to generate attention maps for ResNet-50 and DenseNet-161 at different scales. This image shows the model's discriminant regions based on gradient visualization. Clearly, at full resolution, the discriminant regions between the models are completely different. However, after resolution degradation, the two regions converge. This indicates that the gradient attention regions of the models become more similar under resolution degradation. Summary of the Invention

[0006] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a transferable adversarial attack method based on adaptive multi-scale degradation to improve the transferability of generated adversarial samples while preventing a specific scale from falling into a local optimum and affecting the overall performance.

[0007] To achieve the above-mentioned object, the present invention provides a transferable anti-attack method based on adaptive multi-scale degradation, which is characterized by comprising the following steps:

[0008] (1) Initialization

[0009] For a given input image x with a resolution of h×w, the input image x is used as the initial image x 0 , that is, x 0 =x, initialize the cumulative gradient g 0 =0, initialize the number of iterations t to 0;

[0010] (2) Multi-scale perturbation generation

[0011] First, for the image x t Use Gaussian blur and downsampling to generate a series of images with different resolution degradation scales Among them, L represents the number of degradation scales, and the image x t As an image at scale 0 This gives us a collection of images The images in the image set X have resolutions ranging from h×w to h·s L-1 ×w·s L-1 A series of gradually degraded images of , where s is the scale factor. Then, the gradient information is used to generate gradient perturbations on the corresponding degraded images, thereby interfering with the image information at that scale. At each degradation scale, the perturbation is generated in the following form:

[0012]

[0013] In formula (1), represents the gradient perturbation on the degenerate scale l, represents the image at the degradation scale l, y represents the true label corresponding to the input image x, θ represents the parameters in the classification network, and J represents the loss function used. Is the loss function relative to the image after resolution degradation gradient;

[0014] (3) Adaptive perturbation fusion

[0015] First, for each degradation scale l, the pre-generated adversarial samples

[0016]

[0017] In formula (2), represents the adversarial sample at the degradation scale l, the symbol ↑ represents the upsampling operation to the resolution of the input image x, that is, h×w, and α is a hyperparameter. Restricted image satisfy:

[0018]

[0019] Satisfaction otherwise ∈ represents the maximum amplitude of the disturbance, sgn represents the sign of the disturbance;

[0020] Next, for the pre-generated adversarial examples Add noise and make predictions to simulate the attack capability of adversarial perturbations in black-box attacks:

[0021]

[0022] In formula (3), Indicates that from the adversarial sample The predicted label obtained in, f represents the classification network, the predicted label Evaluate the transferability of the degradation scale l and calculate the predicted label Prediction result y with input image x real , that is, y real = KL divergence between f(x;θ), and get the adaptive fusion weight of gradient perturbation under degradation scale l

[0023]

[0024] In formula (4), KL represents KL divergence calculation;

[0025] Finally, the multi-degenerate scale perturbation is fused with its weight to obtain the perturbation of the t+1th iteration

[0026]

[0027] (4) Update the momentum g t g t+1 :

[0028]

[0029] Where μ is the attenuation factor, Indicates disturbance 1-norm of ;

[0030] (5) The image x t For image x t+1 :

[0031] x t+1 =x t +α·sign(g t+1 )

[0032] (6) Update the number of iterations t = t + 1, and determine whether the number of iterations t is equal to the iteration threshold T. If so, output the adversarial sample. Otherwise, return to step (2).

[0033] The object of the present invention is achieved in this way.

[0034] The present invention's transferable adversarial attack method based on adaptive multi-scale degradation uses corresponding resolution degradation to generate perturbations at different scales, so that adversarial samples are less sensitive to small-scale differences between these models. Perturbations of different scales are obtained through a series of copies of the input image with reduced resolution. In order to further utilize perturbations of different scales, the present invention proposes an attack based on adaptive multi-scale degradation, which realizes adaptive multi-scale perturbation fusion and improves the transferability of generated adversarial samples. At the same time, the present invention adopts an adaptive multi-scale perturbation fusion design, and uses noise to perform a preliminary evaluation of the transferability of perturbations of different scales, and then performs adaptive fusion to prevent a specific scale from falling into a local optimum and affecting the overall performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is an example of visualizing the gradient map of ResNet-50 and DenseNet-161;

[0036] Figure 2 It uses Grad-CAM to generate attention maps of ResNet-50 and DenseNet-161 at different scales;

[0037] Figure 3 This is a flowchart of a specific implementation of the transferable anti-attack method based on adaptive multi-scale degradation of the present invention;

[0038] Figure 4 Schematic diagram of the principle of multi-scale perturbation generation in the transferable counterattack method based on adaptive multi-scale degradation of the present invention;

[0039] Figure 5 It is a schematic diagram of the principle of adaptive perturbation fusion in the transferable counterattack method based on adaptive multi-scale degradation of the present invention. DETAILED DESCRIPTION

[0040] The following describes the specific embodiments of the present invention in conjunction with the accompanying drawings so that those skilled in the art can better understand the present invention. It should be noted that in the following description, when detailed descriptions of known functions and designs may dilute the main content of the present invention, such descriptions will be omitted here.

[0041] Figure 1 It is a flowchart of a specific implementation of the transferability anti-attack method based on adaptive multi-scale degradation of the present invention.

[0042] In this embodiment, if Figure 1 As shown, the transferability countermeasure attack method based on adaptive multi-scale degradation of the present invention includes the following steps:

[0043] Step S1: Initialization

[0044] For a given input image x with a resolution of h×w, the input image x is used as the initial image x 0 , that is, x 0 =x, initialize the cumulative gradient g 0 =0, initialize the number of iterations t to 0.

[0045] Step S2: Multi-scale perturbation generation

[0046] The specific process of multi-scale perturbation generation is as follows: Figure 2 As shown, first, for the image x t Use Gaussian blur and downsampling to generate a series of images with different resolution degradation scales Where L represents the number of degradation scales, the image x t As an image at scale 0 This gives us a collection of images The images in the image set X have resolutions ranging from h×w to h·s L-1 ×w·s L-1A series of gradually degraded images of , where s is the scale factor. Then, the gradient information is used to generate gradient perturbations on the corresponding degraded images, thereby interfering with the image information at that scale. At each degradation scale, the perturbation is generated in the following form:

[0047]

[0048] In formula (1), represents the gradient perturbation on the degenerate scale l, represents the image at the degradation scale l, y represents the true label corresponding to the input image x, θ represents the parameters in the classification network, and J represents the loss function used, such as cross entropy, etc. Is the loss function relative to the image after resolution degradation gradient.

[0049] It should be noted that the previous transformation-based method calculates the gradient relative to the original input x. The present invention needs to generate multi-scale perturbations, so the present invention calculates the input image after resolution degradation gradient.

[0050] In this embodiment, if Figure 2 As shown, L=3.

[0051] Step S3: Adaptive perturbation fusion

[0052] After generating gradient perturbations of different scales, how to effectively fuse them is an important issue. In previous model enhancement methods based on input transformation, the typical approach is to directly take the average. However, this strategy is not always optimal, because the model focus area and gradient information at different scales may not be completely consistent. In addition, if the perturbation of a specific scale falls into a local optimum for the alternative model, continuing to use fixed weights will significantly affect the transferability of the overall adversarial sample. To solve this problem, the present invention adopts an adaptive multi-scale perturbation fusion method, which uses noise injection to evaluate the transferability of perturbations at different degradation scales to adaptively generate fusion weights, thereby achieving flexible integration. Specifically, for each degradation scale, the adversarial samples generated by the present invention are as follows:

[0053] First, for each degradation scale l, the pre-generated adversarial samples

[0054]

[0055] In formula (2), represents the adversarial sample at the degradation scale l, the symbol ↑ represents the upsampling operation to the resolution of the input image x, that is, h×w, and α is a hyperparameter. Restricted image satisfy:

[0056]

[0057] Satisfaction otherwise ∈ represents the maximum amplitude of the disturbance, sgn represents the sign of the disturbance;

[0058] Next, for the pre-generated adversarial examples Add noise and make predictions to simulate the attack capability of adversarial perturbations in black-box attacks:

[0059]

[0060] In formula (3), Indicates that from the adversarial sample The predicted label obtained in, f represents the classification network, the predicted label Evaluate the transferability of the degradation scale l and calculate the predicted label Prediction result y with input image x real , that is, y real = KL divergence between f(x;θ), and get the adaptive fusion weight of gradient perturbation under degradation scale l

[0061]

[0062] In formula (4), KL represents KL divergence calculation;

[0063] Finally, the multi-degenerate scale perturbation is fused with its weight to obtain the perturbation of the t+1th iteration

[0064]

[0065] Step S4: Momentum update

[0066] Update the momentum g t g t+1 :

[0067]

[0068] Where μ is the attenuation factor, Indicates disturbance 1-norm of ;

[0069] Step S5: Update the image

[0070] The image x t For image x t+1 :

[0071] x t+1 =x t +α·sign(g t+1 )

[0072] Step S6: Determine the number of iterations. If the threshold is reached, output the adversarial sample. Otherwise, return to step S2.

[0073] Update the number of iterations t = t + 1, and determine whether the number of iterations t is equal to the iteration threshold T. If so, output the adversarial sample. Otherwise, return to step S2.

[0074] Examples

[0075] In this example, the evaluation indicator used is the attack success rate. The attack success rate refers to the error probability of the generated adversarial sample obtaining the prediction result through the classification network, which is the most commonly used evaluation method. In addition, in this example, the ImageNet dataset is used to evaluate the present invention. According to previous work, 1000 images with a resolution of 299×299×3 in 1000 categories in ILSVRC 2012 are used as the ImageNet dataset for the experiment. For the attacked model, in this example, 7 public pre-trained classification networks are considered, including ResNet-50 (Res-50), ResNet101 (Res-101), Inception-v3 (Inc-v3), SqueezeNet (SENet), MobileNet-v3 (mobo-v3), DenseNet161 (Dense-161) and EfficientNet-v2 (EffiNet-v2). Some current studies have proposed defense models to resist black-box attacks. In order to further prove the effectiveness of the present invention, in this example, 8 defense models are also considered, including Inc-v3 ens3 、Inc-v3 ens4 、IncRes ens4 , HGD, R&P, NIPS-r3, JPEG, and RS. The alternative models used in the experiments for these defense models are all Res-50. Furthermore, the experiments are divided into two attack scenarios: the first is a white-box attack (data marked with asterisks in the test results), and the second is a black-box attack, which uses adversarial examples generated by white-box attacks to test the transferability of the attack on other models. For public pre-trained networks, the test results and the average success rate (Avg.) of black-box attacks are shown in Table 1.

[0076] Table 1

[0077] As can be seen in Table 1, the proposed method (AMDA) outperforms previous methods in terms of average transfer attack success rate across all models. The proposed method improves the overall average attack success rate by 6.7% over the previous best method, reaching 80.1%. For the white-box attack success rate (i.e., the results on the diagonal in the table), the proposed method is close to 100.0%. Furthermore, Table 2 shows the black-box attack success rate against the defense model.

[0078]

[0079]

[0080] Table 2

[0081] It can be clearly seen from Table 2 that the present invention (AMDA) is ahead of the current advanced methods and achieves the best attack performance on each defense model.

[0082] Although the above describes the illustrative specific embodiments of the present invention to facilitate understanding of the present invention by those skilled in the art, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations using the concepts of the present invention are protected.

Claims

1. A transferable adversarial attack method based on adaptive multi-scale degradation, characterized by: The following steps are involved: (1) Initialization For a given input image x with a resolution of h×w, the input image x is used as the initial image x 0 , that is, x 0 =x, initialize the cumulative gradient g 0 =0, initialize the number of iterations t to 0; (2) Multi-scale perturbation generation First, for the image x t Use Gaussian blur and downsampling to generate a series of images with different resolution degradation scales Among them, L represents the number of degradation scales, and the image x t As an image at scale 0 This gives us a collection of images The images in the image set X have resolutions ranging from h×w to h·s L-1 ×w·s L-1 A series of gradually degraded images of , where s is the scale factor. Then, the gradient information is used to generate gradient perturbations on the corresponding degraded images, thereby interfering with the image information at that scale. At each degradation scale, the perturbation is generated in the following form: In formula (1), represents the gradient perturbation on the degenerate scale l, represents the image at the degradation scale l, y represents the true label corresponding to the input image x, θ represents the parameters in the classification network, and J represents the loss function used. Is the loss function relative to the image after resolution degradation gradient; (3) Adaptive perturbation fusion First, for each degradation scale l, the pre-generated adversarial samples In formula (2), represents the adversarial sample at the degradation scale l, the symbol ↑ represents the upsampling operation to the resolution of the input image x, that is, h×w, and α is a hyperparameter. Restricted image satisfy: Satisfaction otherwise ∈ represents the maximum amplitude of the disturbance, sgn represents the sign of the disturbance; Next, for the pre-generated adversarial examples Add noise and make predictions to simulate the attack capability of adversarial perturbations in black-box attacks: In formula (3), Indicates that from the adversarial sample The predicted label obtained in, f represents the classification network, the predicted label Evaluate the transferability of the degradation scale l and calculate the predicted label Prediction result y with input image x real , that is, y real = KL divergence between f(x;θ), and get the adaptive fusion weight of gradient perturbation under degradation scale l In formula (4), KL represents KL divergence calculation; Finally, the multi-degenerate scale perturbation is fused with its weight to obtain the perturbation of the t+1th iteration (4) Update the momentum g t g t+1 : Where μ is the attenuation factor, Indicates disturbance 1-norm of ; (5) The image x t For image x t+1 : x t+1 =x t +α·sign(g t+1 ) (6) Update the number of iterations t = t + 1, and determine whether the number of iterations t is equal to the iteration threshold T. If so, output the adversarial sample. Otherwise, return to step (2).

Images