Artificial intelligence image recognition adversarial attack method and system based on gradient average

Abstract

The present application relates to the technical field of image recognition, and particularly relates to an artificial intelligence image recognition adversarial attack method and system based on gradient averaging, wherein multiple image transformed image samples are obtained by performing multiple image transformations on an original input sample in iterative optimization; a pre-trained model is used to obtain model output of the transformed image samples, and cross entropy of both the model output and the true label of the sample input in the original sample set is obtained based on a target loss function; the gradient of the transformed image sample is solved using the cross entropy loss, the average of the gradients of the multiple transformed image samples is calculated, the adversarial perturbation is solved using the average of the gradients, and the adversarial perturbation is added to the original input sample in the next round of iterative optimization, so that an adversarial sample for adversarial attack on the model is generated through iterative optimization. The present application reduces the influence of excessive randomness by averaging the gradient, and generates an adversarial sample with better transferability.

Description

Technical Field

[0001] This invention relates to the field of image recognition technology, and in particular to an artificial intelligence image recognition adversarial attack method and system based on gradient averaging. Background Technology

[0002] Deep Neural Networks (DNNs) have been widely applied in the real world, such as in autonomous driving, object detection, and facial recognition. However, DNNs are vulnerable to adversarial attacks, which are created by adding imperceptible perturbations to benign examples. Adversarial examples can mislead models into making incorrect predictions, posing a significant threat to the security of deep neural networks and their applications. The generation of adversarial examples, also known as adversarial attacks, has attracted considerable attention because it can enhance our understanding of how deep neural network models work and allow us to evaluate and improve the robustness of different models. Generally, adversarial examples exhibit transferability between deep learning models, meaning that adversarial examples generated on proxy models can also mislead the victim model. By exploiting the transferability of adversarial examples, attackers can attack real-world AI applications without knowing anything about the target model, making transfer-based attacks more practical in many real-world scenarios. Therefore, transfer-based attacks have become a very important type of black-box attack.

[0003] However, it is worth noting that with the development of adversarial defenses, the transferability of existing methods has been significantly affected. The difference in attack capability between adversarial examples under white-box and black-box settings is analogous to the difference in performance of neural networks on training and test sets; that is, the transferability of adversarial examples is naturally similar to the generalization ability of neural networks. Therefore, existing solutions include designing advanced optimization algorithms to avoid undesirable extreme values ​​or using model augmentation to enhance the adversarial example generation process. Simultaneously, data augmentation strategies are employed, randomly transforming the original samples before they are input into the model, allowing the model to recognize more patterns and thus improve the transferability of adversarial examples. As a typical method for improving the transferability of adversarial examples using data augmentation strategies, diversified input methods randomly transform the input samples while introducing a probability p to control the balance between the original and transformed images. However, the randomness introduced by the probability p can negatively impact the transferability of adversarial examples. Summary of the Invention

[0004] To address this issue, the present invention provides an AI image recognition adversarial attack method and system based on gradient averaging, which solves the problem that the randomness caused by probability p affects the transferability of adversarial samples. By reducing the excessive influence of randomness, more transferable adversarial samples are generated.

[0005] According to the design scheme provided by the present invention, on the one hand, a method for adversarial attacks on artificial intelligence image recognition based on gradient averaging is provided, comprising:

[0006] Obtain the pre-trained image recognition deep neural network model and the original sample inputs in the model pre-training, and set the termination condition and the target loss function for iterative optimization in adversarial attacks;

[0007] In each iteration of optimization, the original input sample is subjected to multiple image transformations to obtain multiple transformed image samples; the model output of the transformed image samples is obtained using a pre-trained model, and the cross-entropy between the model output and the true labels of the input samples in the original sample set is obtained based on the target loss function. The gradient of the transformed image sample is solved using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. The adversarial perturbation is solved using the average gradient, and the adversarial perturbation is added to the original input sample in the next iteration of optimization.

[0008] The average gradient value of the last iteration is obtained based on the iteration termination condition, and this average gradient value is used to generate adversarial samples in adversarial attacks. These adversarial samples are then used to test the pre-trained image recognition deep neural network model against adversarial attacks.

[0009] As a gradient averaging-based AI image recognition adversarial attack method of the present invention, the iterative optimization termination condition is further set as the maximum number of iterations or the iteration optimization time threshold.

[0010] As a gradient-averaging-based AI image recognition adversarial attack method of this invention, the process of iteratively optimizing the target loss function in the adversarial attack further includes:

[0011] First, the model cross-entropy loss function is constructed based on the original input samples, their corresponding real labels, and the parameters of the pre-trained image recognition deep neural network model.

[0012] Then, the generation of adversarial examples is transformed into a conditional optimization problem of the model cross-entropy loss function. The conditional constraints of the model cross-entropy loss function include: generating adversarial examples that are visually indistinguishable from the original input samples by maximizing the model cross-entropy loss function, and using the adversarial examples to mislead the output of the pre-trained image recognition deep neural network model into an incorrect category that is inconsistent with the corresponding real label.

[0013] As a gradient-averaging-based adversarial attack method for AI image recognition in this invention, the iteratively optimized target loss function is further expressed as:

[0014] Where x and y are the original input sample and the corresponding ground truth label, respectively, θ is the model parameters of the pre-trained image recognition deep neural network model, and J(θ,x,y) is the model cross-entropy loss function. adv For adversarial examples, m represents the number of samples of the image that are randomly transformed in each iteration, and T i (x adv (p) represents the probability p of sampling x during the i-th sampling in the iteration process. adv A random transformation function that performs random transformations.

[0015] As part of the gradient averaging-based AI image recognition adversarial attack method of this invention, each iteration of optimization further includes:

[0016] The number of image transformations during the iterative optimization process is set based on the number of samples of the randomly transformed image. The average gradient of multiple transformed images sampled under the same transformation conditions is obtained based on the number of image transformations, so as to use the average gradient to solve the problem against disturbances.

[0017] As a gradient-averaging-based adversarial attack method for AI image recognition in this invention, the iteratively optimized target loss function is further expressed as:

[0018] Where x and y are the original sample input and the corresponding ground truth label, respectively, θ is the model parameters of the pre-trained image recognition deep neural network model, and J(θ,x,y) is the model cross-entropy loss function. adv For adversarial examples, m represents the number of samples of the image that are randomly transformed in each iteration, and T i (x adv ,σ i ) represents the amplitude parameter σ that is randomly transformed during the i-th sampling in the iteration process. i For x adv A random transformation function that performs random transformations.

[0019] As part of the gradient averaging-based AI image recognition adversarial attack method of this invention, each iteration of optimization further includes:

[0020] The number of image transformations in the iterative optimization process is set according to the number of samples of the randomly transformed image, and the transformation amplitude of multiple image transformations is set evenly. The gradient average of multiple transformed images with uniformly set image transformation amplitude from small to large is obtained based on the number of image transformations and the transformation amplitude, so as to use the gradient average to solve the problem against disturbances.

[0021] Furthermore, the present invention also provides an AI image recognition adversarial attack system based on gradient averaging, comprising: a data acquisition module, an iterative optimization module, and an adversarial generation module, wherein,

[0022] The data acquisition module is used to acquire the pre-trained image recognition deep neural network model and the original sample input in the model pre-training, and to set the termination condition and the target loss function for iterative optimization in adversarial attacks.

[0023] The iterative optimization module is used to obtain adversarial perturbations using an iterative optimization algorithm. In each iteration, the original input sample undergoes multiple image transformations, resulting in multiple transformed image samples. The pre-trained model is used to obtain the model output for the transformed image samples. Based on the target loss function, the cross-entropy between the model output and the true labels of the original sample set is obtained. The gradient of the transformed image samples is calculated using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. This average gradient is used to solve for the adversarial perturbation, which is then added to the original input samples in the next iteration.

[0024] The adversarial generation module is used to obtain the average gradient of the last iteration based on the iteration termination condition, and use the average gradient to generate adversarial samples in adversarial attacks, so as to use the adversarial samples to test the pre-trained image recognition deep neural network model against adversarial attacks.

[0025] The beneficial effects of this invention are:

[0026] This invention, from a statistical perspective, approximates the expected gradient by averaging the gradients of multiple transformed images sampled under identical conditions or with uniformly increased image transformation amplitudes during iterative optimization. This mitigates the impact of excessive randomness, generates more transferable adversarial examples, and further improves the model's robustness. Experimental data further demonstrates that this approach significantly enhances the effectiveness of diverse input transfer attacks with various random transformation forms (translation, cropping, rotation, etc.), outperforming the baseline by a considerable margin. Moreover, it seamlessly integrates with other attack methods. Compared to state-of-the-art transfer attack methods, this approach generates more transferable adversarial examples, validating its effectiveness and superiority. Attached image description:

[0027] Figure 1 This is a schematic diagram of an AI image recognition adversarial attack framework based on gradient averaging in the embodiment.

[0028] Figure 2 This illustration shows the attack success rate of seven adversarial sample attacks generated on the Inc-v3 model using DIM-GAA and CIM-GAA under different sampled image numbers m in the example.

[0029] Figure 3This illustration shows the attack success rate of adversarial samples generated by DIM-GAA and CIM-GAA on the Inc-v3 model under different random transformation probabilities p in the example.

[0030] Figure 4 This is a schematic diagram of the randomly changing output in the example. Detailed implementation method:

[0031] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described in detail below with reference to the accompanying drawings and technical solutions.

[0032] Let x and y be the clean image and its corresponding ground truth label, respectively, and θ be the model parameters. J(θ,x,y) is the loss function of the neural network, typically the cross-entropy loss function. The goal of an adversarial attack is to generate an adversarial example x that is visually indistinguishable from x by maximizing J(θ,x,y). adv This can mislead the model into giving an incorrect classification. An infinity norm can be used to constrain the adversarial perturbation, i.e., ||x||. adv -x|| ∞ ≤ε. Therefore, adversarial example generation can be transformed into an optimization problem with the following constraints:

[0033]

[0034] Directly solving the optimization problem corresponding to Equation 1 is quite complex and computationally expensive. Therefore, FGSM was proposed, which can draw on the training process of neural networks to simplify the generation process of adversarial examples.

[0035] Fast Gradient Sign Method (FGSM). FGSM is one of the most basic adversarial example generation methods, which calculates the gradient of the loss function with respect to the input. We search for adversarial examples in the upward direction and impose an infinite norm constraint on the adversarial perturbations:

[0036]

[0037] The Momentum Iterative Fast Gradient Sign Method (MI-FGSM) is the first method to introduce momentum into the adversarial example generation process, thereby stabilizing the gradient update direction, improving the convergence process, and significantly increasing the attack success rate. The update process can be summarized as follows:

[0038]

[0039]

[0040] μ is the decay factor of the momentum term, g t It is the gradient weighted accumulation of the first t iterations.

[0041] Diverse Input Method (DIM). In each iteration, DIM randomly transforms the original input with a given probability. This random transformation includes random resizing and random padding to mitigate overfitting during adversarial example generation. This method can be naturally combined with other transfer attack methods to improve adversarial transferability. Its random transformation equation is as follows:

[0042]

[0043] Diverse input methods enhance the transferability of adversarial examples from a data augmentation perspective. By introducing probability (randomness), they balance the success rates of white-box and black-box attacks, achieving a good compromise between offensiveness (for white-box models) and transferability (for black-box models). However, the introduction of probability introduces randomness into the gradient calculation during each iteration, resulting in significant fluctuations. This is particularly true when the probability P = 0.5, where the gradient variance is maximized, leading to maximum randomness and hindering further improvement in the transferability of adversarial examples. While randomness can reduce the possibility of getting stuck in local optima during adversarial example generation to some extent, excessive randomness has negative effects. For example, as shown in Table 1, experiments revealed that while the attack success rate of adversarial examples generated by the DIM method is significantly improved compared to MI-FGSM, its success rate fluctuates considerably, especially in black-box attack success rates, where the largest fluctuation reaches 3.4%, highlighting the negative impact of excessive randomness.

[0044] Table 1. Attack success rates (%) on seven models under a single model setting. Adversarial examples were generated on Inc-v3. * indicates a white-box attack. Maximum and minimum values ​​are highlighted with underscores.

[0045]

[0046] To mitigate the impact of excessive randomness and improve the transferability of adversarial examples, this invention provides a gradient averaging-based method for AI image recognition adversarial attacks, comprising the following:

[0047] S101. Obtain the pre-trained image recognition deep neural network model and the original sample input in the model pre-training, and set the termination condition and the target loss function for iterative optimization in adversarial attacks.

[0048] S102. In each iteration of optimization, the original input sample is transformed multiple times to obtain multiple transformed image samples; the model output of the transformed image samples is obtained using the pre-trained model, and the cross-entropy between the model output and the true label of the sample input in the original sample set is obtained based on the target loss function. The gradient of the transformed image sample is solved using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. The adversarial perturbation is solved using the average gradient, and the adversarial perturbation is added to the original input sample in the next iteration of optimization.

[0049] S103. Obtain the average gradient value under the last iteration based on the iteration termination condition, and use the average gradient value to generate adversarial samples in adversarial attacks, so as to use the adversarial samples to simulate adversarial attacks on the pre-trained image recognition deep neural network model.

[0050] The configurable termination condition for iterative optimization is either the maximum number of iteration rounds or the iteration time threshold.

[0051] Specifically, the process of iteratively optimizing the target loss function in setting up adversarial attacks may include:

[0052] First, the model cross-entropy loss function is constructed based on the original sample input, the corresponding real labels, and the parameters of the pre-trained image recognition deep neural network model.

[0053] Then, the generation of adversarial examples is transformed into a conditional optimization problem of the model cross-entropy loss function. The conditional constraints of the model cross-entropy loss function include: generating adversarial examples that are visually indistinguishable from the original sample input by maximizing the model cross-entropy loss function, and using the adversarial examples to mislead the output of the pre-trained image recognition deep neural network model into an incorrect category that is inconsistent with the corresponding real label.

[0054] To mitigate the impact of excessive randomness and improve the transferability of adversarial examples, the following strategies can be adopted in this embodiment: (1) Do not remove the probability P, and then average the gradients of multiple transformed images sampled under the same conditions to approximate the expected value of the gradient; or, (2) Remove the probability P, and then average the gradients of multiple transformed images with uniformly set image transformation amplitudes from small to large to approximate the expected value of the gradient. The above two different averaging methods mitigate the impact of excessive randomness and enhance the transferability of adversarial examples. In order to solve the problem of excessive randomness in the process of generating adversarial examples using diverse methods, the gradient averaging attack method combined with the scheme of this embodiment can have two forms, named GAA① and GAA② respectively.

[0055] The specific idea behind GAA① is that, each time the input image is transformed, the probability p is not removed, the parameters of each random transformation are not changed, only the number of random transformations is increased, and then the gradients of the images after multiple transformations are averaged, that is, the gradients of multiple transformed images sampled under the same conditions are averaged. Taking DIM as an example, the optimization formula corresponding to DIM-GGA① changes compared to DIM as follows:

[0056]

[0057] m represents the number of samples of the image that are randomly changed during each iteration. It is easy to see from formula (6) that DIM-GGA① and DIM can be converted to each other by setting m.

[0058] The specific idea of ​​GAA② is to remove the probability P and increase the number of transformations each time the input image is transformed. At the same time, in order to take into account the magnitude of various transformations, the transformation magnitude of multiple image transformations is evenly set. Then, the gradients of the transformed images are averaged, that is, the gradients of multiple transformed images with uniformly set image transformation magnitudes from small to large are averaged. Its optimization formula changes compared to DIM as follows:

[0059]

[0060] It is important to note that in Formula 7, T is used for each... i (x adv ,σ i The corresponding transformations are not equal, σ i These are the parameters corresponding to the magnitude of each change.

[0061] The framework of the gradient averaging attack in this embodiment is as follows: Figure 1 As shown, given an original image, it is transformed multiple times. Then, the gradients of the multiple transformed images are calculated, and the gradients are averaged to reduce the influence of randomness, thereby obtaining adversarial examples with higher transferability.

[0062] It is worth noting that the solution presented in this case is general. As can be seen from equations (6) and (7), the gradient averaging method used in this case addresses the problem of excessive randomness in diverse inputs. For diverse input methods, the transformations used are random resizing and random padding. Therefore, even if the transformations in diverse input methods are replaced with random rotation, random translation, random pruning, etc., the gradient averaging attack method in this case remains applicable.

[0063] Considering the significant randomness of diverse input methods, this embodiment employs gradient averaging to approximate the expected gradient by averaging multiple calculated gradients, thus mitigating the impact of excessive randomness and achieving better transferability. In the adversarial attack process of DIM, the average gradient of multiple transformed images sampled under the same conditions is used to replace the original gradient value, resulting in DIM-GAA①, whose pseudocode is shown in Algorithm 1. Similarly, the average gradient of multiple transformed images with uniformly large image transformation amplitudes is used to replace the original gradient value, resulting in DIM-GAA②, whose pseudocode is summarized in Algorithm 2. It is worth noting that when each input transformation in DIM is replaced with random cropping, random rotation, random translation, etc., corresponding CIM-GAA① / ②, RIM-GAA① / ②, TIM-GAA① / ②, etc., will be formed. Furthermore, this scheme also has good scalability and can be well combined with other transfer attack methods to further improve the transferability of adversarial examples.

[0064]

[0065]

[0066]

[0067] Furthermore, based on the above method, this embodiment of the invention also provides an AI image recognition adversarial attack system based on gradient averaging, comprising: a data acquisition module, an iterative optimization module, and an adversarial generation module, wherein...

[0068] The data acquisition module is used to acquire the pre-trained image recognition deep neural network model and the original sample input in the model pre-training, and to set the termination condition and the target loss function for iterative optimization in adversarial attacks.

[0069] The iterative optimization module is used to obtain adversarial perturbations using an iterative optimization algorithm. In each iteration, the original input sample is transformed multiple times to obtain multiple transformed image samples. The pre-trained model is used to obtain the model output for the transformed image samples, and the cross-entropy between the model output and the true labels of the original sample set is obtained based on the target loss function. The gradient of the transformed image samples is solved using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. The adversarial perturbation is solved using this average gradient, and the adversarial perturbation is added to the original input sample in the next iteration.

[0070] The adversarial generation module is used to obtain the average gradient of the last iteration based on the iteration termination condition, and use the average gradient to generate adversarial samples in adversarial attacks, so as to use the adversarial samples to test the pre-trained image recognition deep neural network model against adversarial attacks.

[0071] To verify the effectiveness of this solution, the following explanation is based on experimental data:

[0072] Experimental setup:

[0073] Dataset: 1000 images belonging to 1000 categories were randomly selected from the ImageNet validation set. These images were all correctly classified by the network being tested. All images were pre-scaled to 299×299×3.

[0074] Models: In the experiments, four normally trained networks were considered: Inception-v3 (Inc-v3), Inception-v4 (Inc-v4), Inception-Resnet-v2 (IncRes-v2), and Resnet-v2-101 (Res-101), as well as three adversarially trained networks with strong defense capabilities: ens3-adv-Inception-v3 (Inc-v3). ens3 ),ens4-adv-Inception-v3(Inc-v3 ens4 ) and ens-adv-Inception-ResNet-v2(IncRes-v2 ens Furthermore, the proposed solution was validated on several typical defense models, including high-level representation-guided denoising (HGD), random resizing and padding (R&P), NIPS-r3, feature distillation (FD), purifying perturbations via image compression model (Comdefend), and randomized smoothing (RS).

[0075] Baseline Methods: Starting with DIM, the methods are analyzed and improved, and DIM is used as the baseline. Furthermore, in the process of diversifying inputs, the original random transformations are replaced with other forms of random transformations, such as random rotation, cropping, and translation, resulting in methods like RIM, CIM, and TIM, which are also used as baselines. To better verify the effectiveness and superiority of the proposed solution, the most advanced migration attack method S... 2 I-SI-TI-DIM serves as our baseline.

[0076] Hyperparameter settings: For hyperparameter settings, the maximum perturbation is ε = 16, the number of iterations T = 10, and the step size α = 1.6. For MI-FGSM, the attenuation coefficient is set to μ = 1.0 by default. For DIM, the conversion probability p is set to 0.5. For this scheme, the average number of iterations m = 5. For all GAA① methods, the random transformation function T(x adv The transformation probability p in ;p) is set to 0.5. For the random transformation operation T(·), it represents different operations in different methods. In RIM, CIM, and TIM, it represents rotating, cropping, and translating the image, respectively. The specific transformation operation settings are as follows:

[0077] For the transformation operation T(·) in DIM and DIM-GAA①, the original input image x is first randomly scaled to rnd×rnd×3, where rnd∈[299,330), and then the image is randomly padded to 330×330×3. For T(x; σ) in DIM-GAA②, σ represents the value of rnd, which takes values ​​of 299, 307, 314, 322, and 329 in the five transformations. For the transformation operation T(·) in CIM and CIM-GAA①, the original input image x is first randomly cropped to rnd×rnd×3, where rnd∈[279,299), and then the image is randomly padded to 299×299×3. For T(x; σ) in CIM-GAA②, σ represents the value of rnd, which takes values ​​of 279, 284, 289, 294, and 298 in the five transformations. For the transformation operation T(·) in RIM and RIM-GAA①, the input image x is randomly rotated by θ degrees around the image center, where θ ∈ [-10, 10]. For T(x; σ) in RIM-GAA②, σ represents the value of θ, which takes uniform random values ​​between -10 and 10 in each of the five transformations. For the transformation operation T(·) in TIM and TIM-GAA①, the input image x is randomly translated by rnd pixels along the four dimensions (up, down, left, and right), where rnd ∈ [0, 10]. For T(x; σ) in TIM-GAA②, σ represents the value of rnd, which takes values ​​of 0, 2, 5, 7, and 10 in each of the five transformations.

[0078] To facilitate an intuitive understanding of several random transformations, such as Figure 4 As shown, the images from the first row to the last row represent the original input and images after various random transformations, respectively. A portion of the randomly transformed images is displayed. Specifically, the input image undergoes multiple random transformations, and... Figure 4 The image shows the output of the random transformation. As can be seen from the figure, the random transformation did not change the semantic information of the image.

[0079] 1. Verification experiment in a single network simulated attack test

[0080] Adversarial examples were generated on four normally trained networks using both the baseline method and the proposed approach, and then tested on all seven networks (four normally trained networks and three adversarial trained networks). The results are shown in Table 2, where the attack success rate refers to the model classification error rate with the adversarial examples as input.

[0081] The results show that our proposed solution not only maintains a high attack success rate on white-box models but also significantly improves the attack success rate on black-box models. For example, when generating adversarial examples on Inc-v3, the attack success rates of DIM, CIM, RIM, and TIM on Inc-v4 are 71.4%, 67.4%, 70.1%, and 70.4%, respectively. In contrast, the DIM-GAA②, CIM-GAA②, RIM-GAA②, and TIM-GAA② methods in our proposed solution achieve attack success rates of 85.6%, 82.4%, 84.5%, and 83.9%, respectively, which are 14.2%, 15.0%, 14.4%, and 13.5% higher than the corresponding baseline attacks. Furthermore, when targeting advanced adversarial training models, the GAA attack method in our proposed solution consistently outperforms the baseline attacks, achieving a significant improvement in attack success rate. These outstanding results strongly demonstrate that our method can effectively improve the transferability of adversarial examples.

[0082] Table 2: Success rate (%) of adversarial attacks on seven models under a single model setting. The adversarial samples were created on Inc-v3, Inc-v4, InRes-v2, and Res-101, respectively. * indicates a white-box attack.

[0083]

[0084]

[0085] 2. Verification Experiment of Integrated Network Simulation Attack Testing

[0086] To further validate the effectiveness of our proposed solution, we consider attacking multiple models simultaneously. An ensemble attack approach is employed, fusing the logit outputs of different models. Specifically, adversarial examples are generated by ensembled four normally trained models: Inc-v3, Inc-v4, IncRes-v2, and Res101, all assigned the same weights. The transferability of the adversarial examples is tested on both normally trained and adversarially trained models.

[0087] As shown in Table 3, the proposed solution consistently achieves the highest attack success rate under both white-box and black-box settings. For example, compared to the baseline attack DIM, the average attack success rates of DIM-GAA① and DIM-GAA② in this proposed solution are 79.8% and 84.4%, respectively, which are 6.0% and 10.6% higher than DIM. Notably, the proposed solution demonstrates even greater improvement in adversarial training models, averaging 6.6% to 21.4% higher than the baseline attack. These results convincingly demonstrate that gradient averaging can effectively enhance the transferability of adversarial attacks.

[0088] Table 3: Attack success rate (%) of adversarial attacks on seven models under the integrated model settings. Adversarial samples were generated on the integrated models, namely Inc-v3, Inc-v4, InRes-v2, and Res-101. * indicates white-box models.

[0089]

[0090] 3. Defense model simulated attack experiment

[0091] In addition to the normally trained and adversarial trained models, the effectiveness of our proposed solution on other advanced defenses was also considered, including High-level representation-guided denoising (HGD), random resizing and padding (R&P), NIPS-r3, feature distillation (FD), perturbation cleansing via image compression (Comdefend), and random smoothing (RS). All adversarial examples were generated on ensemble models Inc-v3, Inc-v4, IncRes-v2, and Res101 with the same ensemble weights. These adversarial examples were used to test state-of-the-art defense methods.

[0092] The experimental results are shown in Table 4. It is evident that the gradient-averaged attack in this proposal significantly enhances the baseline attack methods across all advanced defense approaches. For example, the average success rates of DIM and CIM against the six defense models are 44.8% and 43.9%, respectively. In contrast, the average success rates of DIM-GAA② and CIM-GAA② in this proposal are 65.6% and 59.1%, respectively, exceeding the corresponding baseline attacks by 20.8% and 15.2%. This significant improvement demonstrates the remarkable effectiveness of this proposal against other defense models. It also indicates that current defense mechanisms remain vulnerable to well-designed adversarial examples and are far from meeting the requirements for true security.

[0093] Table 4: Success rate (%) of adversarial attacks against advanced defense methods. Adversarial examples were generated on ensemble models, namely Inc-v3, Inc-v4, InRes-v2, and Res-101.

[0094]

[0095] 4. Hyperparameter Experiment

[0096] A series of ablation experiments were used to study the effects of different parameters, including the number of image transformations (m) and the transformation probability (p). To simplify the analysis, only two methods, DIM-GAA① and CIM-GAA①, were selected as representatives for analysis.

[0097] The number of image transformations (average number of samples) m: First, we study the impact of the number of transformed image copies, i.e., the average number of samples m in each iteration, on the attack success rate of the seven models. m increases from 1 to 10 in step size of 1. When m = 1, DIM-GAA① and CIM-GAA① degenerate into DIM and CIM, respectively. Figure 2 The attack success rates of the DIM-GAA① and CIM-GAA① methods on various networks are shown, with dashed and solid lines representing the success rates of white-box and black-box attacks, respectively. The results show that as m increases, the success rate of white-box attacks remains relatively stable at around 100%, while the success rate of black-box attacks gradually increases. Furthermore, for all attacks, if m is small, i.e., only a small number of transformed inputs are used for gradient averaging, the black-box success rate can be significantly increased. This phenomenon demonstrates the importance of gradient averaging during the attack process. Intuitively, a larger number of transformed image copies predicts better adversarial transferability. However, larger values ​​of m require higher computational costs; therefore, different values ​​of m can be set to balance computational cost and attack success rate. Considering both factors, a value of 5 for m is chosen.

[0098] Transition probability p: The impact of transition probability p on attack success rate under white-box and black-box settings is studied. The transition probability p varies between 0 and 1 in steps of 0.1. When p = 0, both DIM-GAA① and CIM-GAA① degenerate into MI-FGSM. Figure 3 The attack success rates of DIM-GAA① and CIM-GAA① on various networks are shown, with dashed and solid lines representing the success rates of white-box and black-box attacks, respectively. The results show that the trends of DIM-GAA① and CIM-GAA① are generally similar as p increases. With increasing p, the black-box attack success rate of both DIM-GAA① and CIM-GAA① gradually increases, while the white-box attack success rate only decreases slightly but remains above 98.6%. When p = 1, the white-box attack success rate of DIM-GAA① is the lowest at 98.6%, while the white-box attack success rate of DIM (results shown in Table 1) is 97.1%. These results indicate that the introduction of gradient averaging can better balance white-box and black-box attacks, simultaneously improving the white-box and black-box success rates of adversarial examples.

[0099] 5. Extended Experiment

[0100] Extensive extended experiments were used to comprehensively analyze and evaluate the proposed solution. First, the success rate of the proposed solution was compared with that of state-of-the-art migration attack methods. Second, the image quality of adversarial samples generated by different attack methods was compared and analyzed. Finally, the time consumption of the baseline attack method and the corresponding gradient averaging attack method was compared.

[0101] Success rate comparison with state-of-the-art migration attack methods: To better evaluate the attack performance of our proposed solution, gradient averaging attack is compared with the state-of-the-art migration attack method S. 2 A comparison was made between I-SI-TI-DIM. The experimental results are shown in Table 5, which demonstrates that by combining this approach with strong attack methods, the proposed solution achieved a higher attack success rate. For example, S 2 The success rate of I-SI-TI-DI-RIM-GAA① on Res-101 was 92.4%, while S 2 With an I-SI-TI-DIM score of 89.2%, these outstanding results highlight the strong attack performance of this solution.

[0102] Table 5: Success rate (%) of adversarial attacks on seven models under a single model setting. Adversarial samples were generated on Inc-v3. * indicates a white-box attack.

[0103]

[0104] Comparison of image quality of adversarial examples generated by different attack methods: Table 6 reports the image quality of adversarial examples generated by different methods following three typical perceptual metrics. The three metrics are: Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index Measure (SSIM), and Learned Perceptual Image Patch Similarity (LPIPS). The results show that the proposed solution generates adversarial examples of better image quality than the baseline attack methods. This further illustrates the superiority of the proposed solution. For example, taking the SSIM metric as an example, the CIM-GAA② in the proposed solution has the highest score of 0.678, while the baseline attack CIM score is 0.673.

[0105] Table 6: Image quality of the generated adversarial examples was evaluated based on four metrics. The adversarial examples were generated on Inc-v3.

[0106]

[0107] Comparison of attack time for different attack methods: The experiment requires multiple image transformations, followed by averaging the gradients of multiple transformed images, which increases the time cost of generating adversarial examples to some extent. Therefore, the time consumption of the baseline attack and the proposed solution can be analyzed. Since the number of image transformations is the same in GAA① and GAA②, their time consumption is similar, so only one is selected for demonstration. Table 7 shows the average time for the baseline attack and the corresponding GAA② method to generate an adversarial example. For example, using Inc-v3 as an alternative model, DIM and DIM-GAA② require an average of 0.089 seconds and 0.339 seconds to generate an adversarial example, respectively, both with low time consumption. From the results, the gradient averaging attack method does increase the time consumption, but it is acceptable overall, especially since the gradient averaging attack method significantly improves the success rate of adversarial example attacks. The experiment was conducted on an RTX 2080Ti GPU.

[0108] Table 7: Average time (s) to generate an adversarial example on Inc-v3, Inc-v4, InRes-v2, and Res-101, respectively. The time required by the baseline method is to the left of the slash, and the time required by the proposed method is to the right.

[0109]

[0110] The experimental data above demonstrates that, compared to existing diverse input transfer attack methods, the gradient averaging attack proposed in this study achieves a higher success rate on both normally trained and adversarially trained models. Furthermore, the study validates the proposed method on diverse input transfer attacks involving other forms of random transformations (translation, pruning, rotation, etc.), further emphasizing its effectiveness and superiority, and revealing the potential of gradient averaging in improving adversarial transferability. This provides valuable insights for further exploration in the field of adversarial attacks.

[0111] Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0112] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0113] The units and method steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations are not considered to be beyond the scope of this invention.

[0114] Those skilled in the art will understand that all or part of the steps in the above methods can be implemented by a program instructing related hardware, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk. Optionally, all or part of the steps in the above embodiments can also be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiments can be implemented in hardware or as a software functional module. This invention is not limited to any particular combination of hardware and software.

[0115] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for adversarial attacks on artificial intelligence image recognition based on gradient averaging, characterized in that, Include: Obtain the pre-trained image recognition deep neural network model and the original input samples in the model pre-training, and set the termination condition and target loss function for iterative optimization in adversarial attacks; In each iteration of optimization, the original input sample undergoes multiple image transformations, and multiple transformed image samples are obtained by sampling under the same conditions or by sampling multiple transformed images with uniformly set image transformation amplitudes from small to large. The model output of the transformed image samples is obtained using a pre-trained model, and the cross-entropy between the model output and the true labels of the original sample set is obtained based on the target loss function. The gradient of the transformed image samples is solved using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. The average gradient is used to solve the adversarial perturbation, and the adversarial perturbation is added to the original input sample in the next iteration of optimization. The average gradient value of the last iteration is obtained based on the iteration termination condition, and this average gradient value is used to generate adversarial samples in adversarial attacks. These adversarial samples are then used to test the pre-trained image recognition deep neural network model against adversarial attacks.

2. The AI ​​image recognition adversarial attack method based on gradient averaging according to claim 1, characterized in that, The termination condition for iterative optimization is set as the maximum number of iterations or the iteration time threshold.

3. The AI ​​image recognition adversarial attack method based on gradient averaging according to claim 1, characterized in that, The process of setting up the iterative optimization of the target loss function in adversarial attacks includes: First, the model cross-entropy loss function is constructed based on the original input samples, their corresponding real labels, and the parameters of the pre-trained image recognition deep neural network model. Then, the generation of adversarial examples is transformed into a conditional optimization problem of the model cross-entropy loss function. The conditional constraints of the model cross-entropy loss function include: generating adversarial examples that are visually indistinguishable from the original sample input by maximizing the model cross-entropy loss function, and using the adversarial examples to mislead the output of the pre-trained image recognition deep neural network model into an incorrect category that is inconsistent with the corresponding real label.

4. The gradient averaging-based AI image recognition adversarial attack method according to claim 1 or 3, characterized in that, The iterative optimization objective loss function is expressed as: ,in, and These are the original sample input and the corresponding ground truth labels, respectively. These are the model parameters for a pre-trained deep neural network model for image recognition. The model's cross-entropy loss function is... For adversarial examples, m represents the number of samples of the image that are randomly transformed during each iteration. For the i-th sampling, x is sampled with a given probability p. adv A random transformation function that performs random transformations.

5. The AI ​​image recognition adversarial attack method based on gradient averaging according to claim 4, characterized in that, Each iteration of optimization also includes: The number of image transformations during the iterative optimization process is set based on the number of samples of the randomly transformed image. The average gradient of multiple transformed images sampled under the same transformation conditions is obtained based on the number of image transformations, so as to use the average gradient to solve the problem against disturbances.

6. The method for adversarial attacks on artificial intelligence image recognition based on gradient averaging according to claim 1 or 3, characterized in that, The iterative optimization objective loss function is expressed as: ,in, and These are the original sample input and the corresponding ground truth labels, respectively. These are the model parameters for a pre-trained deep neural network model for image recognition. The model's cross-entropy loss function is... For adversarial examples, m represents the number of samples of the image that are randomly transformed during each iteration. The amplitude parameter is randomly changed during the i-th sampling in the iteration process. For x adv A random transformation function that performs random transformations.

7. The AI ​​image recognition adversarial attack method based on gradient averaging according to claim 6, characterized in that, Each iteration of optimization also includes: The number of image transformations in the iterative optimization process is set according to the number of samples of the randomly transformed image, and the transformation amplitude of multiple image transformations is set evenly. The gradient average of multiple transformed images with uniformly set image transformation amplitude from small to large is obtained based on the number of image transformations and the transformation amplitude, so as to use the gradient average to solve the problem against disturbances.

8. An AI image recognition adversarial attack system based on gradient averaging, characterized in that, It includes: a data acquisition module, an iterative optimization module, and an adversary generation module, among which, The data acquisition module is used to acquire the pre-trained image recognition deep neural network model and the original input samples in the model pre-training, and to set the termination condition and the target loss function for iterative optimization in adversarial attacks. The iterative optimization module is used to obtain adversarial perturbations using an iterative optimization algorithm. In each iteration, the original input sample is transformed multiple times, and multiple transformed image samples are obtained by sampling under the same conditions or by sampling multiple transformed images with uniformly set image transformation amplitudes from small to large. The model output of the transformed image samples is obtained using a pre-trained model, and the cross-entropy between the model output and the true labels of the original sample set is obtained based on the target loss function. The gradient of the transformed image samples is solved using the cross-entropy loss, and the average gradient of multiple transformed image samples is calculated. The adversarial perturbation is solved using this average gradient, and the adversarial perturbation is added to the original input sample in the next iteration. The adversarial generation module is used to obtain the average gradient of the last iteration based on the iteration termination condition, and use the average gradient to generate adversarial samples in adversarial attacks, so as to use the adversarial samples to test the pre-trained image recognition deep neural network model against adversarial attacks.

9. An electronic device, characterized in that, include: At least one processor, and a memory coupled to said at least one processor; The memory stores a computer program that can be executed by the at least one processor to implement the artificial intelligence image recognition adversarial attack method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the artificial intelligence image recognition adversarial attack method as described in any one of claims 1 to 7.

Images