Adversarial sample generation method based on histogram probability equalization

Abstract

The application discloses a kind of histogram probability equalization-based adversarial sample generation method, the RGB three channels of color image sample are decomposed into RGB three channels, and probability selection channel module is respectively selected to a channel to the RGB three channels of color image sample, and the selected channel is histogram equalization by data enhancement module processing;The channel after histogram equalization is merged with other two channels to form new image x ＊ ;All new images are input into convolutional neural network, and the loss function is obtained and the gradient is calculated by training the convolutional neural network;Adversarial perturbation is generated based on MI-FGSM algorithm, and the corresponding color image sample in the original data set is added to generate adversarial sample.The histogram equalization of the application enhances data, which is used to expand the data set to enhance the portability of the generated image, effectively improves the black-box attack rate of adversarial sample, and improves its portability.

Description

Technical Field

[0001] This invention relates to adversarial example techniques, specifically to an adversarial example generation method based on histogram probability equilibrium. Background Technology

[0002] Given a classifier f(x): x∈X→y∈Y, when an original image x is input to the classifier, the classifier outputs a label y as a prediction. Neural networks are commonly used as classifiers, where J(θ,x,y) is the loss function of the neural network, and θ are the network parameters. The goal of an adversarial attack is to find an adversarial sample x in the vicinity of x that is visually indistinguishable from x. adv This causes the model to misclassify.

[0003] Existing adversarial example generation methods include FGSM, I-FGSM, and MI-FGSM.

[0004] The Fast Gradient Sign Method (FGSM) is the most basic version of this type of method and one of the simplest adversarial example generation methods. In this method, the gradient of the loss function on the input image x is first calculated, and then it is performed step-by-step along the gradient direction. Adding perturbations allows for the rapid generation of adversarial examples. The advantage is that this method reduces the computational cost of generating adversarial examples. However, the effectiveness and transferability of these adversarial attacks are poor. The process can be represented by the following formula.

[0005]

[0006] The I-Iterative Fast Gradient Sign Method (I-FGSM) is an iterative version of FGSM. It divides the gradient calculation in FGSM into multiple iterative steps to mitigate the underfitting caused by single-step attacks. Compared to FGSM, I-FGSM can construct more accurate perturbations, significantly improving the success rate of white-box attacks. However, this comes at the cost of increased computational cost, and sample transferability is not significantly improved. Its process can be represented by the following formula:

[0007]

[0008]

[0009] Where α is the step size of each iteration, T represents the number of iterations; the Clip function constrains the adversarial examples to the ε-neighborhood of the original image x, satisfying the infinity norm L. ∞ constraint.

[0010] The Momentum Iterative Fast Gradient Sign Method (MI-FGSM) is the first method to apply momentum to the adversarial example generation process, enabling the loss function to stably update its direction during computation, breaking through local maxima and reaching the true optimum. This improves the transferability and attack effectiveness of adversarial examples to some extent. However, the transferability is still lacking. The process can be represented by the following formula:

[0011]

[0012]

[0013] Where μ is the decay factor of the momentum term; g T It is the gradient-weighted accumulation of the first T iterations.

[0014] Although there are similar existing technologies, such as the automatic classification method and system for anti-human globulin test images disclosed in patent CN_114913360_A, the purpose of using histogram equalization is to make the image details clearer and facilitate classification, not to solve the transferability problem. Summary of the Invention

[0015] Purpose of the invention: The purpose of this invention is to address the shortcomings of existing technologies and provide a method for generating adversarial examples based on histogram probability equilibrium.

[0016] Technical solution: The present invention provides a method for generating adversarial examples based on histogram probability equilibrium, comprising the following steps:

[0017] Step (1): Collect color image samples to form the original dataset. Decompose the RGB three channels of the color image sample x into red channel (R), green channel (G) and blue channel (B). Save each channel as a separate tensor. Randomly select any channel from the RGB three channels of the color image sample x through the probability selection channel module. Perform histogram equalization on the selected channel through the data augmentation module.

[0018] Step (2): For the color image sample x, the channel after histogram equalization is merged with the other two channels to form a new image x. ★ ; Put all new images x ★ Input the data into a convolutional neural network, train the network, obtain the loss function, and calculate the gradient.

[0019] Step (3): Generate adversarial perturbation ε based on the MI-FGSM algorithm, and add the adversarial perturbation ε to the corresponding color image samples in the original dataset to generate adversarial samples x. advFurthermore, in the process of generating adversarial examples, to increase the diversity and complexity of the samples, the RGB channels of the original image are randomly selected when generating each adversarial example. The specific method for the probability selection channel module to randomly select a channel is as follows:

[0020] For a color image sample x, the red (R), green (G), and blue (B) channels are represented by a binary variable z. i To randomly select a channel from [0,1] for equalization processing, that is:

[0021]

[0022] Among them, the hyperparameter z i This represents the probability of selecting channel i, where i∈[{R,G,B}] (generally z...). i Set to the same value, that is This ensures the balance of the channels.

[0023] Pr(i=R), Pr(i=G), and Pr(i=B) represent the conditional probabilities of choosing the red channel (R), green channel (G), and blue channel (B), respectively.

[0024] Furthermore, to prevent network overfitting, the images fed into the model in each iteration are changed by enhancing image contrast. That is, the histogram distribution of an image is transformed into an approximately uniform distribution, and the pixel values ​​of the image are redistributed, thereby enhancing the image contrast and increasing the diversity of image input. This effectively alleviates the overfitting phenomenon in the process of generating adversarial examples, thereby improving the success rate of black-box attacks. The specific method of histogram equalization processing of the selected channels by the data augmentation module in step (1) is as follows:

[0025]

[0026] Where p(k) is the probability density of the k-th gray level, L is the number of gray levels in the selected channel, and n k Let n be the number of pixels contained in the k-th gray level, and n be the total number of pixels in the selected channel. The point whose gray level is changed to k is... The above mapping is applied to each grayscale value in the global range to stretch the histogram. Further, based on the PHE-I-FGSM method (Probability Histogram Equalization IterativeFast Gradient Sign Method), histogram equalization is performed on the original input color image with probability p in each iteration to alleviate overfitting. It randomly selects one of the three RGB channels of the input image for histogram equalization, and the transformation probability p controls the balance between the original input image and the transformed image. The process is as follows:

[0027]

[0028]

[0029] Where x represents the image sample after each iteration, θ refers to the weights and bias parameters of the neural network, y is the classification output of the neural network, and the probability transformation function PHE(x) is the probability transformation function. T adv ;p) then becomes:

[0030]

[0031] α is the step size in each iteration, and T is the number of iterations. Let p represent the adversarial samples in round 0 and round T+1, respectively; p includes Pr(i=R), Pr(i=G) and Pr(i=B);

[0032] To develop a more robust attack method, momentum and data augmentation are combined to mitigate overfitting, resulting in the PHE-MI-FGSM method. The overall iterations of this method are as follows:

[0033]

[0034]

[0035] Where μ is the decay factor of the momentum term, g T It is the gradient-weighted accumulation of the first T iterations. The gradient direction is α, where α represents the learning rate, and α·sign(g) T+1 () refers to the transformed disturbance; This is the adversarial sample for round T.

[0036] Furthermore, in step (2), the new image x ★After inputting into the convolutional neural network, the corresponding tensor is extracted as the feature vector shape, with shape [batch_size, height, weight, 3]. Finally, logits and end_points are output, which are a tensor and a dictionary, respectively. Logits is a tensor with shape [batch_size, num_class], which stores the score of the image under the corresponding category estimated by the network.

[0037] The convolutional neural network described above uses the network model inception_v3.

[0038] Furthermore, the infinite norm L is used for the adversarial perturbation ε in step (3). ∞ Constraining the counter-perturbation, i.e., ||x| adv -x‖ ∞ ≤ε, which transforms adversarial example generation into an optimization problem with the following constraints:

[0039]

[0040] Where J(θ,x,y) is the loss function of the convolutional neural network, and θ is the network parameter.

[0041] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0042] (1) In order to avoid DNN deep neural networks from being attacked by adversarial instances, this invention provides an adversarial example generation method based on histogram probability equilibrium, which is based on image instances with high adversarial nature, i.e. adversarial examples, to study and design them, which helps to improve the security and robustness of DNN networks.

[0043] (2) In view of the low portability of the adversarial samples in the original algorithm, the present invention adds a data augmentation module to the adversarial sample generation algorithm, which effectively improves the black-box attack rate of the adversarial samples and improves their portability.

[0044] (3) Due to the low portability of adversarial examples generated by existing attack algorithms in the black-box environment of MI-FGSM, this invention proposes an adversarial instance method based on histogram probability equilibrium, namely HPE-MI-FGSM (Histogram probability equilibrium Momentum Iterative Fast Gradient Signmethod). The effectiveness of this method was verified on the ImageNet dataset. Compared with traditional I-FGSM and MI-FGSM, the average attack success rate of the adversarial training network was also improved.

[0045] (4) This invention introduces data augmentation and encapsulates it into a separate module to broaden the application scenarios. For example, the histogram equalization algorithm in the data augmentation module can be replaced by other data augmentation methods so as to use data augmentation methods that are more suitable for the characteristics of datasets in different scenarios.

[0046] (5) The present invention has a high degree of controllability; in the overall operation process, only the hyperparameters need to be adjusted to obtain adversarial samples under different conditions; it has a more significant attack effect on multiple models and has better universality. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the overall process of the present invention;

[0048] Figure 2 This refers to the original color image input in this embodiment of the invention;

[0049] Figure 3 This is a schematic diagram of the disturbance process in an embodiment of the present invention;

[0050] Figure 4 The final adversarial graph generated using the method of the present invention is shown in the example. Detailed Implementation

[0051] The technical solution of the present invention will be described in detail below, but the scope of protection of the present invention is not limited to the embodiments described.

[0052] like Figure 1 As shown, the present invention provides a method for generating adversarial examples based on histogram probability equilibrium, comprising the following steps:

[0053] Step (1): Collect color image samples to form the original dataset. Decompose the RGB three channels of the color image sample x into red channel (R), green channel (G) and blue channel (B). Save each channel as a separate tensor. Randomly select one channel from the RGB three channels of the color image sample x through the probability selection channel module. Perform histogram equalization on the selected channel through the data augmentation module.

[0054] Step (2): For the color image sample x, the channel after histogram equalization is merged with the other two channels to form a new image x. ★ ; Put all new images x ★ Input the data into a convolutional neural network, train the network, obtain the loss function, and calculate the gradient.

[0055] Step (3): Generate adversarial perturbation ε based on the MI-FGSM algorithm, and add the adversarial perturbation ε to the corresponding color image samples in the original dataset to generate adversarial samples x.adv .

[0056] Example 1:

[0057] This embodiment performs grayscale equalization processing on a color image of shape [H,W,3]. Figure 2 As shown. When processing the image, a single channel is randomly selected, and based on a comprehensive consideration of visual effect and computational efficiency, the minimum grayscale equalization unit is set to 0.01. Specifically, this method is implemented according to the following steps:

[0058] First, count the number of each gray level in the image and calculate the probability density function for each gray level, as shown in the following formula:

[0059]

[0060] Where, p r (r k ) represents the probability density of the k-th gray level, n k This represents the number of pixels at the k-th gray level, where M and N represent the height and width of the image, respectively.

[0061] To facilitate image type conversion, this embodiment uses 201 gray levels in the range [-1.00, 1.00] for histogram equalization, avoiding the processing of integers from 0 to 255. This combination of histogram equalization and random channel selection achieves both data augmentation and randomization, improving robustness and increasing sample diversity and complexity.

[0062] Next, the cumulative distribution function (CDF) for each gray level is calculated based on the probability density function, as shown in the following formula:

[0063]

[0064] Wherein, CDF(r) k ) represents the cumulative distribution function of the k-th gray level.

[0065] Then, each pixel in the original image is remapped according to the CDF, thereby achieving grayscale stretching. Specifically, for each pixel (i,j) in the input image, its new pixel value r ij The calculation method is as follows:

[0066] r ij = (L-1)×CDF(s) ij )

[0067] Where L represents the maximum number of gray levels in the image, S ij This represents the pixel values ​​in the original image.

[0068] The iterative process of the above embodiments is as follows:

[0069] Step 1: Set hyperparameters: number of iterations T, maximum perturbation range eps, data augmentation probability 0.5.

[0070] Step 2: Initialize the number of iterations t = 0.

[0071] Step 3: Read in the original color image ( Figure 2 )

[0072] Step 4: Take a random value p in the interval [0,1]. If p < 0.5, jump to step 5; otherwise, jump to step 6.

[0073] Step 5: Randomly select one of the three RGB channels of the color image and input it into the data enhancement module.

[0074] Step 6: Input the image into the convolutional neural network to obtain the loss function, calculate the gradient, and add perturbation to the image based on the MI-FGSM algorithm. Figure 3 )

[0075] Step 7: t++.

[0076] Step 8: Determine if t is equal to T. If not, jump back to step 3.

[0077] Step 9: Output the final adversarial example ( Figure 4 ).

[0078] This embodiment has 201 gray levels in the range of [-1.00, 1.00], and the gray levels can be evenly distributed through histogram equalization. Compared with the conventional uint8 unit histogram equalization in the range of [0, 255], this invention achieves an improvement in computational efficiency of approximately 20% while improving the visual effect.

[0079] Example 2:

[0080] In this embodiment, the technical solution of the present invention is compared with three existing solutions through relevant experiments.

[0081] Table 1. Experimental Comparison Data

[0082]

[0083] The above data is based on the Inc-v3 model. Adversarial examples were generated using five attack methods and attacked a total of seven network models, including the Inv-v3 model itself (inception_v3, inception_v4, inception_resnet_v2_2016_08_30, resnet_v2_101, and ensemble network models trained with Step.LL adversarial training (ens3_adv_inception_v3_rename, ens4_adv_inception_v3_rename, ens_adv_inception_resnet_v2_rename).

[0084] Table 1 shows the percentage of successful attacks, i.e., the attack success rate. Yellow boxes represent white-box attacks, and blue boxes represent black-box attacks. HF-I-FGSM (this invention) and HF-MI-FGSM (this invention) add the data augmentation module designed in this invention to the classic iterative attack algorithms I-FGSM and MI-FGSM, respectively. It can be seen that compared to existing methods, this invention achieves a certain improvement in performance against black-box attacks, increasing the success rate by up to 7.3%.

[0085] In this embodiment, all adversarial examples are generated under the following hyperparameters (where p represents the P-value of the three channels), as shown in Table 2.

[0086] Table 2 Hyperparameters of Examples

[0087] Hyperparameters: p 0.33 / 0.33 / 0.34 T 20 ε 16 m 1 alpha (ε*2 / 255)

[0088] As can be seen from the above embodiments, the adversarial sample generation method based on histogram probability equilibrium of the present invention can generate adversarial samples that achieve better attack effects under black-box models and ensemble models trained adversarially.

[0089] Compared with existing algorithms, this invention greatly improves the transferability of adversarial examples, enhances the black-box attack effect of adversarial examples while keeping the perturbation cost unchanged, and the whole algorithm is easy to implement. The algorithm flow is explained in detail using the original color image O as an example.

[0090] Step 1: Import the necessary libraries for running the program, such as the TensorFlow deep learning framework and NumPy data processing libraries.

[0091] Step 2: Define a TensorFlow placeholder `x_input` to occupy a position when building the computation graph, and feed data into the placeholder in subsequent sessions using the `feed_dict()` function. Initialize hyperparameters and global variables at the beginning of the code, including but not limited to the model parameter path `checkpoint` and the data input path `input_dir`.

[0092] Step 3: Define the perturbation eps during training as 2 / 255 times the placeholder preset maximum perturbation, and the tensor shape batch_shape for batch reading of images.

[0093] Step 4: Read the label names corresponding to the dataset using the defined function `read_labeled_image_dict`. This function reads a txt file containing image filenames and labels and maps its contents to a dictionary `filename_label_dict`. The specific implementation code is as follows:

[0094] 1. Open a file: Use the open() function to open a txt file in the specified path, open it in read-only mode 'r', and return a file object f.

[0095] 2. Define a dictionary: Define an empty dictionary filename_label_dict to store the label name corresponding to each filename.

[0096] 3. Read line by line: Use a for loop to read the contents of a txt file line by line.

[0097] 4. Separate filename and label name: For each line of content, use the str's split() method with spaces as the delimiter to split it into two strings: filename and label name, and assign them to the variables filename and label.

[0098] 5. Store in a dictionary: Store the filename and label name as the key and value in the dictionary filename_label_dict, respectively, by using filename_label_dict[filename] = label.

[0099] 6. Return dictionary: After reading the entire file, return the dictionary filename_label_dict, where each element is a key-value pair of filename and label name.

[0100] Step 5: Here we enter the formal model computation process. The code implements an adversarial example attack algorithm based on the TensorFlow framework, and uses TensorFlow's placeholders, computation graph, and loop nodes, saving it to the computation graph. The specific implementation is as follows:

[0101] 1. Define a float32 type TensorFlow placeholder x_input to occupy a position when building the computation graph, and feed data into the placeholder in subsequent sessions using the feed_dict() function.

[0102] 2. Use TensorFlow's clip_by_value() function to limit the input value after adding positive or negative perturbation to the range [-1, 1].

[0103] 3. Create an empty tensor y to store the labels later. Create another empty tensor end to store the classification results, with a shape of [10, 1001].

[0104] 4. Define a while loop node, with the input x_input, label y, index i, x_max, x_min, gradient grad, and classification result end as loop variables. Exit the loop when the stop() condition is False, otherwise continue execution.

[0105] 5. Execute the computation graph inside the loop, and store the return values ​​in x_adv, y_out, grad_out, and end_out.

[0106] 6. Use the Saver class to load the trained model checkpoint_path, and run the code in the session. Execute the computation graph using the sess.run() function and save the results in the corresponding variables.

[0107] 7. Save the generated x_adv using the save_images() function. Test and print the results using the sess.run() function to obtain the label y and classification result end, and save them to y_list and end_list respectively. Iterate through end_list, find the classification label max_label corresponding to the maximum confidence rate for each sample, and print it out.

[0108] The above are the five main steps of this code snippet. It primarily uses TensorFlow's computation graph and loop nodes to implement the adversarial example attack algorithm, which can effectively generate adversarial examples and conduct tests.

[0109] In addition, during the training process of the main function code, the three most core functions are all called in the while_loop: graph(), the stopping condition stop(), and the probability histogram data augmentation (PHE) function input_diversity() called by graph(). Therefore, their contents will be described in detail.

[0110] I. The graph() function

[0111] The input image is subjected to an FGSM (Fast Gradient Sign Method) attack, which perturbs the original image to obtain an image that can be misclassified by the classification model. The specific implementation process is as follows:

[0112] The input parameters of this function include

[0113] -x: Current input image

[0114] -y: Real label

[0115] -i: The number of iterations for the current attack.

[0116] -x_max: The maximum value of the image pixels.

[0117] -x_min: Minimum value of image pixels

[0118] -grad: Current gradient

[0119] -end: The prediction result of the classification model

[0120] 1. First, calculate the perturbation range `eps` for each channel based on the number of channels in the input image and the `FLAGS.max_epsilon` parameter.

[0121] 2. Calculate the step size `alpha` for each image update based on the `FLAGS.num_iter` parameter, and set the initial momentum `momentum`.

[0122] 3. Call the specified classification model (multiple options are available in the code) and obtain the output `logits` and

[0123] `end_points`. Here, `logits` represents the output of the classification model, and `end_points` are the outputs of each layer of the classification model, which help in the analysis of image features.

[0124] 4. Obtain the prediction result `pred`, which is the label corresponding to the category with the highest probability.

[0125] 5. Stabilize the true label `y` using `y = first_round * pred + (1 - first_round) * y`. `first_round` indicates whether it is the first round of perturbation operation, and it is converted into a tensor. Then, a mask operation is used in the first round to set the stabilized label to the current prediction result `preditcion`.

[0126] 6. Perturb the image using the cross-entropy loss function and calculate the corresponding perturbation noise. The value of noise is calculated based on the current perturbed image and its gradient, and then the perturbation noise is standardized. The momentum term is used to prevent getting trapped in local optima during the optimization process.

[0127] 7. Use `x = x + alpha * tf.sign(noise)` to perturb the input image and update the image.

[0128] 8. Finally, use `tf.clip_by_value()` to limit the image pixel values ​​to a reasonable range and return the updated image, stabilized labels, and other parameters.

[0129] This code demonstrates an attack on a selected classification model (such as InceptionV3, ResNet, or InceptionResNetV2), causing it to misclassify a normal image. It utilizes the FGSM attack and gradient optimization techniques, a relatively common image attack method.

[0130] II. stop() function

[0131] The function `stop` determines whether execution should continue while performing an FGSM attack on the input image. The input parameter for this function is the same as `graph`, because the parameters of the loop function and the stop function in the `while_loop` must be consistent.

[0132] The main function of this function is to determine whether the preset number of iterations `num_iter` has been reached during the execution of the FGSM attack. If the current number of iterations is less than `num_iter`, it returns `True`, indicating that the attack needs to continue, i.e., the `graph()` function in the `while_loop` is executed; otherwise, it returns `False`, indicating that the attack has been completed, i.e., the `while_loop()` function is exited.

[0133] III. The input_diversity() function

[0134] The `Input_diversity()` function performs random channel histogram equalization on an input image. This function accepts a four-dimensional input tensor, where the first dimension represents the number of input images, and the last three dimensions are the image's width, height, and number of channels. Specifically, the function performs the following operations on each image:

[0135] 1. Perform channel separation on the input image, that is, save the three RGB channels as separate tensors.

[0136] 2. Randomly selecting a channel for equalization increases image diversity, thereby improving the model's robustness. Users can choose whether to enable this random channel selection feature based on their needs.

[0137] 3. Perform histogram equalization on a single channel.

[0138] The specific operations of histogram equalization are as follows: First, enumerate the pixels, that is, traverse within a certain range (-1.00 to 1.00) centered on each pixel value. Use the `tf.equal` function to find the position of the current pixel value; that position is True, otherwise False. Count the number of True occurrences, which is the total number of times the current pixel value appears in that channel. Calculate the target mapping value z of the pixel according to the formula. Use the `tf.where` function to update the mapping values ​​of all pixels, obtaining the three equalized channels.

[0139] 4. Combine the processing results of the three channels into one image.

[0140] 5. Iterate through all the input images to obtain a list of equalized images.

[0141] 6. Use the `tf.cond` function to implement a random selection function, selecting the equalized image with a certain probability. If the probability meets the condition, return the equalized image; otherwise, return the original input image.

Claims

1. A method for generating adversarial examples based on histogram probability equilibrium, characterized in that, Includes the following steps: Step (1): Collect color image samples to form the original dataset. The RGB three channels are decomposed into the red channel. Green Channel and the blue channel Each channel is saved as a separate tensor; the probability selection module selects channels for each color image sample. The RGB three channels are randomly selected, and the selected channel is subjected to histogram equalization processing through the data augmentation module. The method for the probability selection channel module to randomly select a channel is as follows: For color image samples Red Channel Green Channel and the blue channel Through a binary variable To randomly select a channel for equalization processing, that is: ； Among them, hyperparameters Indicates selection The probability of a channel. ; These respectively indicate the selection of the red channel. Green Channel and the blue channel The conditional probability; The specific method by which the data augmentation module performs histogram equalization on the selected channels is as follows: ； in, For the first The probability density of each gray level. The number of gray levels in the selected channel. For the first The number of pixels contained in each gray level The grayscale value is changed to represent the total number of pixels in the selected channel. The point is The above mapping is performed on each gray value in the global range to stretch the histogram. Step (2): For color image samples The channel that has undergone histogram equalization is then merged with the other two channels to form a new image. ; Put all new images Input the data into a convolutional neural network, train the network, obtain the loss function, and calculate the gradient. Step (3): Generate adversarial perturbations based on the PHE-I-FGSM algorithm Add this adversarial perturbation to the corresponding color image samples in the original dataset. Generate adversarial examples The detailed method is as follows: Based on PHE-I-FGSM, the original input color image is processed in each iteration. Histogram equalization is performed on the probability of the input color image: One channel is randomly selected from the three channels for histogram equalization to transform the probability. They jointly control the balance between the original color image and the transformed image, and the process is as follows: ； ； in, For the image samples after each iteration, This refers to the weights and bias parameters of the convolutional neural network. The probability transformation function is the classification output determined by the convolutional neural network. Then it is: ； It is the step size of each iteration. For the number of iterations, , These represent adversarial examples from round 0 and round T+1, respectively. include and ; Then, momentum and data augmentation are combined and iterated, the process of which is as follows: ； ； in, It is the decay factor of the momentum term. It was before Gradient-weighted accumulation in rounds of iteration, For the gradient direction, Indicates the learning rate. This refers to the transformed disturbance; This is the adversarial sample for round T.

2. The adversarial example generation method based on histogram probability equalization according to claim 1, characterized in that, In step (2), the new image After inputting into the convolutional neural network, the corresponding tensor is extracted as the feature vector shape, with shape [batch_size, height, weight, 3]. The final outputs are logits and end_points, which are a tensor and a dictionary, respectively. Logits is a tensor with shape [batch_size, num_class], which stores the score of the image under the corresponding category estimated by the network.

3. The adversarial example generation method based on histogram probability equilibrium according to claim 1, characterized in that, For the counter-disturbance in step (3) Using the infinity norm Constraining the counter-disturbance, i.e. The generation of adversarial examples is thus transformed into an optimization problem with the following constraints: ； in Let be the loss function of the convolutional neural network. These are network parameters.

Images