A model confrontation attack method, device, equipment and medium

Abstract

The application relates to the technical field of machine learning, and provides a model confrontation attack method and device, equipment and a medium. The method comprises the following steps: obtaining an initial confrontation sample corresponding to a first attack data set carrying a label through an initial generation network, and transmitting the initial confrontation sample to a substitute model corresponding to a target attack model to obtain a loss value of the substitute model; transmitting the first attack data set and a second attack data set not carrying a label to a feature matching network to perform feature matching on semantic features and texture features, and obtaining a loss value of the feature matching network; updating parameters of the initial generation network according to the loss value of the substitute model and the loss value of the feature matching network to obtain a target generation network; transmitting a target attack data set to the target generation network to obtain a target confrontation sample, and transmitting the target confrontation sample to the target attack model to realize model confrontation attack. The attack effect of cross-domain data on the target model is improved, and the model attack range is wider.

Description

Technical Field

[0001] This application relates to the field of machine learning technology, specifically to a method, apparatus, device, and medium for adversarial attacks on models. Background Technology

[0002] Machine learning, a core component of artificial intelligence, is the process by which a non-explicit computer program learns from data and experience to optimize its algorithm and learn how to handle tasks. A model in machine learning refers to a learning strategy defined within a specified hypothesis space, which learns the mapping from input to output through algorithmic optimization.

[0003] Existing research has demonstrated the vulnerability of models by attacking them with optimized perturbations through attack algorithms. However, most attack methods only conduct attacks on datasets with the same distribution. In contrast, existing datasets are distributed datasets with limited ranges. If the dataset is changed to one with a different data distribution, the adversarial perturbations optimized by the attack algorithm will essentially lose their effectiveness due to differences in data distribution and foreground / background. The attack effect cannot be preserved on different cross-domain datasets.

[0004] Therefore, how to improve the attack effectiveness of cross-domain data on target attack models is an urgent problem to be solved. Summary of the Invention

[0005] In view of the shortcomings of the prior art described above, the purpose of this application is to provide a model adversarial attack method, apparatus, device and medium to solve the problem of how to improve the attack effect of cross-domain data on the target attack model in the prior art.

[0006] To achieve the above and other related objectives, this application provides a model adversarial attack method, the method comprising:

[0007] Obtain a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset. The data distributions of the first attack dataset and the second attack dataset are inconsistent.

[0008] The first attack dataset is transmitted to a pre-built initial generation network to generate initial adversarial perturbations. Initial adversarial samples are obtained based on the initial adversarial perturbations. The initial adversarial samples are then transmitted to a pre-built alternative model corresponding to the target attack model to obtain the loss value of the alternative model.

[0009] The first attack dataset and the second attack dataset are matched using a pre-built feature matching network to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching.

[0010] Based on the loss value of the alternative model and the loss value of the feature matching network, the parameters of the initial generation network are updated to obtain the target generation network;

[0011] The target attack dataset is transmitted to the target generation network to generate target adversarial perturbations. Target adversarial samples are obtained based on the target adversarial perturbations, and the target adversarial samples are transmitted to the target attack model to achieve model adversarial attacks.

[0012] In one embodiment of this application, the step of transmitting the first attack dataset to a pre-constructed initial generation network to generate initial adversarial perturbations, and obtaining initial adversarial samples based on the initial adversarial perturbations, includes:

[0013] The first attack dataset is transmitted to the initial generation network;

[0014] The initial generation network generates initial adversarial perturbations corresponding to the first attack dataset according to a preset perturbation range.

[0015] By combining the first attack dataset and the initial adversarial perturbation, the initial adversarial sample corresponding to the first attack dataset is obtained.

[0016] In one embodiment of this application, the step of transmitting the initial adversarial sample to an alternative model corresponding to a pre-constructed target attack model to obtain the loss value of the alternative model includes:

[0017] The initial adversarial sample is transmitted to the alternative model;

[0018] The alternative model is used to execute the alternative model attack task;

[0019] The loss value of the alternative model is obtained based on the gradient when the alternative model performs the attack task. The loss value of the alternative model is negative.

[0020] In one embodiment of this application, the step of performing feature matching between the first attack dataset and the second attack dataset using a pre-constructed feature matching network includes:

[0021] Extract multiple first feature layers from the first attack dataset and multiple second feature layers from the second attack dataset, respectively.

[0022] The multiple first feature layers and multiple second feature layers are mapped to a pre-constructed regenerable Hilbert space, and semantic features and texture features are matched through the regenerable Hilbert space.

[0023] In one embodiment of this application, the feature matching of semantic features and texture features through the regenerable Hilbert space includes:

[0024] Extract the first feature map from each of the first feature layers and the second feature map from each of the second feature maps;

[0025] The second-order moment distance between the plurality of first feature layers and the plurality of second feature layers is obtained through the regenerable Hilbert space;

[0026] Based on the second-order distance, the distance of semantic features between the first feature map and the second feature map is constrained, and the distance of texture features between the first feature map and the second feature map is also constrained.

[0027] The semantic and texture features constrained by distance are aligned and quantized to obtain the loss value of the feature matching network.

[0028] In one embodiment of this application, the representation of the second-order moment distance includes:

[0029]

[0030] Where loss_H is the second moment distance, D base For the first attack dataset, D cross This is the second attack dataset. For the i-th first feature layer corresponding to the first attack dataset, For the j-th second feature layer corresponding to the second attack dataset, This is a preset mapping function that maps the feature layer to the regenerable Hilbert space.

[0031] In one embodiment of this application, the step of transmitting the target attack dataset to the target generation network, generating target adversarial perturbations, and obtaining target adversarial samples based on the target adversarial perturbations includes:

[0032] The target attack dataset is transmitted to the target generation network;

[0033] The target generation network generates target adversarial perturbations corresponding to the target attack dataset according to a preset perturbation range.

[0034] By combining the target attack dataset and the target adversarial perturbation, the target adversarial sample corresponding to the target attack dataset is obtained.

[0035] In one embodiment of this application, a model adversarial attack device is also provided, the device comprising:

[0036] The dataset acquisition module is used to acquire a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset. The data distributions of the first attack dataset and the second attack dataset are inconsistent.

[0037] The alternative model attack task execution module is used to transmit the first attack dataset to a pre-built initial generation network to generate initial adversarial perturbations, obtain initial adversarial samples based on the initial adversarial perturbations, and transmit the initial adversarial samples to an alternative model corresponding to the pre-built target attack model to obtain the loss value of the alternative model.

[0038] The feature matching module is used to perform feature matching between the first attack dataset and the second attack dataset through a pre-built feature matching network to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching.

[0039] The target generation network generation module is used to update the parameters of the initial generation network based on the loss value of the alternative model and the loss value of the feature matching network to obtain the target generation network;

[0040] An adversarial attack model is used to transmit the target attack dataset to the target generation network, generate target adversarial perturbations, obtain target adversarial samples based on the target adversarial perturbations, and transmit the target adversarial samples to the target attack model to achieve model adversarial attacks.

[0041] In one embodiment of this application, an electronic device is also provided, the electronic device comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the electronic device enables the model adversarial attack method as described above.

[0042] In one embodiment of this application, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a computer's processor, causes the computer to perform the model adversarial attack method as described above.

[0043] The beneficial effects of this invention are:

[0044] First, a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset are obtained. The data distributions of the first and second attack datasets are inconsistent. Then, the first attack dataset is transmitted to a pre-constructed initial generation network to generate initial adversarial perturbations. Initial adversarial samples are obtained based on these perturbations and transmitted to a pre-constructed alternative model corresponding to the target attack model to obtain the loss value of the alternative model. Next, a pre-constructed feature matching network is used to perform feature matching between the first and second attack datasets to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching. Based on the loss value of the alternative model and the loss value of the feature matching network, the parameters of the initial generation network are updated to obtain the target generation network. Finally, the target attack dataset is transmitted to the target generation network to generate target adversarial perturbations. Target adversarial samples are obtained based on these perturbations and transmitted to the target attack model to achieve model adversarial attack. In this application, the second attack dataset has a different data distribution than the first attack dataset, and the second attack dataset does not carry labels. Therefore, the second attack dataset can be regarded as a cross-domain dataset corresponding to the first attack dataset. A feature matching network is used to perform feature matching on the semantic and texture features of the cross-domain data. The loss of the feature matching network is used to update the initial generator network, guiding learning not only at the semantic information level but also at the texture information level. The target generator network, obtained based on the loss of the feature matching network, generates target adversarial examples. Because feature matching is performed on both the first and second attack datasets, when the target adversarial examples attack the target attack model, they achieve the attack effect of cross-domain datasets, with a wider attack range and stronger attack effect. The method in this application can quickly attack cross-domain samples and ensures a high success rate. The limited perturbation coefficient also helps the perturbation escape human scrutiny.

[0045] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0046] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0047] Figure 1This is a schematic diagram illustrating the implementation environment of a model adversarial attack method according to an exemplary embodiment of this application;

[0048] Figure 2 This is a schematic flowchart illustrating a model adversarial attack method according to an exemplary embodiment of this application;

[0049] Figure 3 This is a schematic diagram illustrating a framework for adversarial attacks using a model, as shown in an exemplary embodiment of this application.

[0050] Figure 4 This is a block diagram illustrating a model adversarial attack device, as shown in an exemplary embodiment of this application;

[0051] Figure 5 A schematic diagram of the structure of a computer system suitable for an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0052] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0053] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0054] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0055] First, it should be noted that deep learning algorithms are currently widely used in video surveillance and autonomous driving systems, and can pose serious security risks if they are maliciously attacked.

[0056] Autonomous vehicles are used for delivery and patrol in many areas. These vehicles rely on onboard cameras for environmental perception and path planning. Because the vehicles are constantly in motion, the cameras record various video data. By launching a cross-domain dataset attack on the autonomous vehicle's path planning model, the robustness of the model can be openly verified using an attack algorithm. Simultaneously, vulnerabilities in the path planning model can be exposed, allowing for "gap-filling" and improving the vehicle's system perception capabilities in daily life.

[0057] In the field of security monitoring, detection models need to handle scene information in different situations, especially when identifying unknown objects. If the model is trained on a dataset with only one data distribution, it is easy for the model to miss detections when in use, resulting in incalculable losses. For example, criminals wearing strange clothing may evade inspection, or adding a layer of attack perturbation to the camera may render the monitoring system ineffective.

[0058] During the testing phase of the target attack model, it is necessary to test the robustness and security of the model using cross-domain datasets. Therefore, how to improve the attack effect of cross-domain data on the target attack model will directly affect the detection results of the target attack model.

[0059] The following explains the technical terms used in this application:

[0060] Semantic features: Semantics generally refers to the category classification of each pixel in an image. Semantic information can be understood as information related to category classification.

[0061] Texture features: Texture features are global features that reflect the visual characteristics of homogeneous phenomena in an image, embodying the slowly changing or periodically altered surface structure of an object. Image texture is represented by the gray-level distribution of pixels and their surrounding spatial neighborhoods, i.e., local texture information. Furthermore, the varying degrees of repetition in local texture information constitute global texture information.

[0062] Model attacks: Model attacks can be performed in fields such as visual recognition, NLP (Natural Language Processing), and speech recognition. Model attacks can severely impact business security. Modern machine learning algorithms are susceptible to various adversarial attacks in real-world applications, including data and model poisoning during updates, model evasion, model theft, and data inference attacks targeting users' private training data.

[0063] Generative networks are most commonly used in unsupervised learning models, such as for face recognition and image quality improvement. These networks take random noise as input and attempt to output an image that approximates the true distribution, aiming to mislead the discriminative network into believing it is a real image. By learning the features of the training set data, and guided by the discriminative network, the random noise distribution is fitted as closely as possible to the true distribution of the training data, thus generating similar data with the features of the training set.

[0064] Alternative Model: When you want to attack a black-box model provided by a platform, one feasible method is to first train a local model with similar decision boundaries to the target attack model, then perform a white-box attack on the local model to obtain adversarial examples, and then use transferability to achieve an attack on the target attack model. This locally deployed model is called the alternative model.

[0065] Figure 1 This is a schematic diagram illustrating the implementation environment of the model adversarial attack method as an exemplary embodiment of this application.

[0066] Reference Figure 1 As shown, the implementation environment may include a model adversarial execution terminal 101, an interactive terminal 102, and a server 103. The technical solution provided in this application embodiment can be applied to the model adversarial execution terminal 101. The model adversarial execution terminal 101 is used to obtain the first attack dataset, the second attack dataset, and the target dataset output by the interactive terminal 102 to implement the model adversarial attack method in this application embodiment. After transmitting the target adversarial sample to the target attack model to execute the model adversarial task to achieve the model adversarial attack, the result of the model adversarial attack is transmitted to the server 103 for storage.

[0067] In one embodiment of this application, a model adversarial execution terminal 101 acquires a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset, wherein the data distributions of the first attack dataset and the second attack dataset are inconsistent; the first attack dataset is transmitted to a pre-constructed initial generation network to generate initial adversarial perturbations, initial adversarial samples are obtained based on the initial adversarial perturbations, and the initial adversarial samples are transmitted to a pre-constructed alternative model corresponding to the target attack model to obtain the loss value of the alternative model; feature matching is performed on the first attack dataset and the second attack dataset through a pre-constructed feature matching network to obtain the loss value of the feature matching network, wherein the feature matching includes semantic feature matching and texture feature matching; the parameters of the initial generation network are updated based on the loss value of the alternative model and the loss value of the feature matching network to obtain a target generation network; the target attack dataset is transmitted to the target generation network to generate target adversarial perturbations, target adversarial samples are obtained based on the target adversarial perturbations, and the target adversarial samples are transmitted to the target attack model to realize model adversarial attack. In this embodiment, the second attack dataset has a different data distribution than the first attack dataset, and the second attack dataset does not carry labels. Therefore, the second attack dataset can be regarded as a cross-domain dataset corresponding to the first attack dataset. A feature matching network is used to perform feature matching on the semantic and texture features of the cross-domain data. The loss of the feature matching network is used to update the initial generator network, guiding learning not only at the semantic information level but also at the texture information level. Based on the loss of the feature matching network, a target generator network generates target adversarial examples. Because feature matching is performed on both the first and second attack datasets, when the target adversarial examples attack the target attack model, they achieve the attack effect of cross-domain datasets, with a wider attack range and stronger attack effect. The method in this application can quickly attack cross-domain samples and ensures the success rate of the attack. The limited perturbation coefficient also helps the perturbation escape human scrutiny.

[0068] The above section introduced the exemplary implementation environment of the technical solution of this application. Next, we will continue to introduce the model adversarial attack method of this application.

[0069] To address the urgent problem of how to improve the attack effectiveness of cross-domain data against target attack models in the existing technology, this application proposes a model adversarial attack method, a model adversarial attack device, an electronic device, a computer-readable storage medium, and a computer program product. These embodiments will be described in detail below.

[0070] Please see Figure 2 , Figure 2This is a schematic flowchart illustrating a model adversarial attack method in an exemplary embodiment of this application. This method can be applied to... Figure 1 The implementation environment is shown. It should be understood that this method can also be applied to other exemplary implementation environments and specifically executed by devices in other implementation environments. This embodiment does not limit the implementation environment to which the method is applicable.

[0071] like Figure 2 As shown, in an exemplary embodiment, the model adversarial attack method includes at least steps S210 to S250, which are described in detail below:

[0072] In step S210, a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset are obtained. The data distributions of the first attack dataset and the second attack dataset are inconsistent.

[0073] For example, implementing a model adversarial attack method against an autonomous driving model of an autonomous vehicle requires adding perturbations to image data such as pedestrians, vehicles, roads, and road signs to perform adversarial attacks on the autonomous driving model, testing the safety of the autonomous driving model, and then upgrading the autonomous driving model to improve its robustness. In this embodiment, the first attack dataset can also be called the original dataset, and may include, for example, image data of pedestrians, vehicles, roads, and road signs with labels; the second attack dataset can also be called the cross-domain dataset. The data distribution of the cross-domain dataset is inconsistent with that of the original dataset, but the categories present in the cross-domain dataset are the same as those in the original dataset.

[0074] It should be noted that the target dataset in this application embodiment may be, for example, a dataset that does not carry labels and whose data distribution is inconsistent with the first attack dataset and the second attack dataset.

[0075] In step S220, the first attack dataset is transmitted to the pre-built initial generation network to generate initial adversarial perturbations. Initial adversarial samples are obtained based on the initial adversarial perturbations, and the initial adversarial samples are transmitted to the alternative model corresponding to the pre-built target attack model to obtain the loss value of the alternative model.

[0076] For example, the first attack dataset is transmitted to the initial generation network, and the initial generation network adds perturbation to the first attack dataset to obtain the initial adversarial sample; then the initial adversarial sample is transmitted to the alternative model corresponding to the target attack model, and the loss value of the alternative model is obtained by gradient descent. In this embodiment of the application, the loss value of the alternative model is used to update the initial generation network.

[0077] In step S230, the first attack dataset and the second attack dataset are matched using a pre-built feature matching network to obtain the loss value of the feature matching network. Feature matching includes semantic feature matching and texture feature matching.

[0078] It should be noted that the feature matching network performs feature matching on the semantic and texture features of cross-domain data. The loss of the feature matching network is used to update the initial generator network. This can guide the learning of the generator network not only at the semantic information level, but also at the texture information level.

[0079] In step S240, the parameters of the initial generator network are updated based on the loss value of the alternative model and the loss value of the feature matching network to obtain the target generator network.

[0080] In step S250, the target attack dataset is transmitted to the target generation network to generate target adversarial perturbations. Target adversarial samples are obtained based on the target adversarial perturbations and transmitted to the target attack model to realize model adversarial attacks.

[0081] As can be seen from steps S210 to S250 above, in the scheme proposed in this embodiment, the data distribution of the second attack dataset is inconsistent with that of the first attack dataset, and the second attack dataset does not carry labels. Therefore, the second attack dataset can be regarded as a cross-domain dataset corresponding to the first attack dataset. Through a feature matching network, semantic and texture features of the cross-domain data are matched. The loss of the feature matching network is used to update the initial generator network, which can guide the learning of the generator network not only at the semantic information level but also at the texture information level. The target generator network obtained based on the loss of the feature matching network generates target adversarial examples. Because feature matching is performed on the first and second attack datasets, when the target adversarial examples attack the target model, they can achieve the attack effect of cross-domain datasets, and the attack range is wider and the attack effect is stronger. The method in this application can quickly attack cross-domain samples and ensure the success rate of the attack. The limited perturbation coefficient can also help the perturbation escape human scrutiny.

[0082] In one embodiment of this application, Figure 2 The step S220 shown involves transmitting the first attack dataset to a pre-built initial generation network to generate initial adversarial perturbations, and obtaining initial adversarial samples based on these perturbations, including:

[0083] The first attack dataset is transmitted to the initial generation network;

[0084] The initial generation network generates initial adversarial perturbations corresponding to the first attack dataset according to a preset perturbation range.

[0085] By combining the first attack dataset and the initial adversarial perturbation, the initial adversarial sample corresponding to the first attack dataset is obtained.

[0086] For example, the first attack dataset can be referred to as the original dataset or the benchmark dataset. The first attack dataset is... in For the original sample, These are the labels corresponding to the original samples. The initial generator network outputs a small initial adversarial perturbation within a given perturbation range ε. Obtain the initial adversarial sample

[0087] In one embodiment of this application, Figure 2 Step S220, which involves transmitting the initial adversarial sample to the pre-built alternative model corresponding to the target attack model to obtain the loss value of the alternative model, includes:

[0088] The initial adversarial sample is transmitted to the alternative model;

[0089] The alternative model is used to execute the alternative model attack task;

[0090] The loss value of the alternative model is obtained based on the gradient when the alternative model performs the attack task. The loss value of the alternative model is negative.

[0091] For example, the initial adversarial sample The data is transmitted to the alternative model corresponding to the autonomous driving model. The alternative model performs a model attack task, turns the loss value into a negative value by gradient descent, and backpropagates the loss value to the initial generator network to solve the loss of the subsequent feature matching network and update the initial generator network.

[0092] In one embodiment of this application, Figure 2 Step S230, which involves performing feature matching between the first attack dataset and the second attack dataset using a pre-built feature matching network, includes:

[0093] Extract multiple first feature layers from the first attack dataset and multiple second feature layers from the second attack dataset, respectively.

[0094] The multiple first feature layers and multiple second feature layers are mapped to a pre-constructed regenerable Hilbert space, and semantic features and texture features are matched through the regenerable Hilbert space.

[0095] For example, a second attack dataset without labels can be called a cross-domain dataset, denoted as... in For cross-domain samples, feature matching can be achieved through mapping using the second-order moment matching of the regenerable kernel Hilbert space. In order to perform semantic feature matching in this space, multiple levels of feature maps are used for spatial matching calculation, which can cover not only texture information matching but also semantic feature matching.

[0096] In one embodiment of this application, Figure 2 Step 230, which involves feature matching of semantic and texture features using a regenerable Hilbert space, includes:

[0097] Extract the first feature map from each of the first feature layers and the second feature map from each of the second feature maps;

[0098] The second-order moment distance between the plurality of first feature layers and the plurality of second feature layers is obtained through the regenerable Hilbert space;

[0099] Based on the second-order distance, the distance of semantic features between the first feature map and the second feature map is constrained, and the distance of texture features between the first feature map and the second feature map is also constrained.

[0100] The semantic and texture features constrained by distance are aligned and quantized to obtain the loss value of the feature matching network.

[0101] For example, an attack on a cross-domain distributed dataset is achieved through adaptive feature matching, which disrupts the distribution of the dataset through training perturbations. In this embodiment, a feature extraction network is used to generate attack perturbations and cross-domain adaptive feature matching, selectively filtering different feature matches within the network. When constraining different cross-domain distributions, the algorithm employs dual constraints of texture and semantic features. Data features are mapped to a custom regenerable kernel Hilbert space second-moment distance for quantization. The loss obtained from feature matching is combined with the loss of the alternative network to update the initial generator network and obtain the target generator network.

[0102] For example, see Figure 3 , Figure 3This is a schematic diagram illustrating a model adversarial attack framework in an exemplary embodiment of this application. In this exemplary embodiment, the original data (i.e., the data in the first attack dataset) is an image of skiing, and the cross-domain data (i.e., the data in the second attack dataset) is an image of a giraffe. First, the original data is transmitted to an initial generation network. Adversarial noise (i.e., adversarial perturbation) is generated through the feature extraction and feature processing encoding modules in the initial generation network. The adversarial noise is combined with the original data to obtain adversarial samples. The adversarial samples are transmitted to a detection network (i.e., a replacement network) to obtain the loss value of the detection network. The loss value of the detection network is then backpropagated to the initial generation network to update it in conjunction with the loss value of the subsequent feature matching network. Furthermore, the original data and the cross-domain data are combined and input into a pre-constructed feature matching network. The feature matching network calculates semantic and texture features in the multi-layer feature maps, maps the data features to a custom regenerable kernel Hilbert space second-order moment distance for quantization to achieve feature matching, and backpropagates the loss value of the feature matching network to the initial generation network to update it in conjunction with the loss value of the detection network.

[0103] It should be noted that when performing feature matching, the feature distribution of the first attack dataset and the second attack dataset can be constrained according to the preset number of iterations until the number of iterations is satisfied, and then the loss value of the feature matching network is output.

[0104] In one embodiment of this application, the representation of the second-order moment distance includes:

[0105]

[0106] Where loss_H is the second moment distance, D base For the first attack dataset, D cross This is the second attack dataset. For the i-th first feature layer corresponding to the first attack dataset, For the j-th second feature layer corresponding to the second attack dataset, This is a preset mapping function that maps the feature layer to the regenerable Hilbert space.

[0107] In one embodiment of this application, Figure 2 Step S250 involves transmitting the target attack dataset to the target generation network, generating target adversarial perturbations, and obtaining target adversarial samples based on the target adversarial perturbations, including:

[0108] The target attack dataset is transmitted to the target generation network;

[0109] The target generation network generates target adversarial perturbations corresponding to the target attack dataset according to a preset perturbation range.

[0110] By combining the target attack dataset and the target adversarial perturbation, the target adversarial sample corresponding to the target attack dataset is obtained.

[0111] For example, transmitting the target attack dataset to the target generation network. In this process, the target counter-perturbation output is smaller within a given perturbation range ε. Then, the target attack dataset is combined with the target adversarial perturbation to obtain the target adversarial sample. in These are samples from the target attack dataset.

[0112] Figure 4 This is a block diagram illustrating a model adversarial attack apparatus according to an exemplary embodiment of this application. The apparatus can be applied to… Figure 1 The implementation environment shown is not limited to this embodiment. This device can also be applied to other exemplary implementation environments and specifically configured in other devices. This embodiment does not limit the implementation environment to which the device is applicable.

[0113] like Figure 4 As shown, this exemplary model adversarial attack device includes:

[0114] The dataset acquisition module 401 is used to acquire a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset. The data distribution of the first attack dataset and the second attack dataset is inconsistent.

[0115] Alternative model attack task execution module 402 is used to transmit the first attack dataset to a pre-built initial generation network to generate initial adversarial perturbations, obtain initial adversarial samples based on the initial adversarial perturbations, and transmit the initial adversarial samples to an alternative model corresponding to the pre-built target attack model to obtain the loss value of the alternative model.

[0116] The feature matching module 403 is used to perform feature matching on the first attack dataset and the second attack dataset through a pre-built feature matching network to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching.

[0117] The target generation network generation module 404 is used to update the parameters of the initial generation network based on the loss value of the alternative model and the loss value of the feature matching network to obtain the target generation network;

[0118] Adversarial attack model 405 is used to transmit the target attack dataset to the target generation network, generate target adversarial perturbations, obtain target adversarial samples based on the target adversarial perturbations, and transmit the target adversarial samples to the target attack model to realize model adversarial attack.

[0119] In this exemplary model adversarial attack device, the second attack dataset has a different data distribution from the first attack dataset, and the second attack dataset does not carry labels. Therefore, the second attack dataset can be regarded as a cross-domain dataset corresponding to the first attack dataset. A feature matching network is used to perform feature matching on the semantic and texture features of the cross-domain data. The loss of the feature matching network is used to update the initial generator network, guiding learning not only at the semantic information level but also at the texture information level. The target generator network, obtained based on the loss of the feature matching network, generates target adversarial examples. Because feature matching is performed on both the first and second attack datasets, when the target adversarial examples attack the target model, they achieve the attack effect of cross-domain datasets, with a wider attack range and stronger attack effect. The method in this application can quickly attack cross-domain samples and guarantees the success rate of the attack. The limited perturbation coefficient also helps the perturbation escape human scrutiny.

[0120] It should be noted that the model adversarial attack device and the model adversarial attack method provided in the above embodiments belong to the same concept. The specific ways in which each module and unit performs operations have been described in detail in the method embodiments, and will not be repeated here. In practical applications, the model adversarial attack device provided in the above embodiments can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above, and this is not a limitation.

[0121] Embodiments of this application also provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the electronic device to implement the model adversarial attack methods provided in the above embodiments.

[0122] Figure 5 A schematic diagram of a computer system suitable for an electronic device according to an embodiment of this application is shown. It should be noted that... Figure 5 The computer system 500 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0123] like Figure 5As shown, the computer system 500 includes a Central Processing Unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 502 or programs loaded from Storage Unit 508 into Random Access Memory (RAM) 503, such as performing the methods described in the above embodiments. The RAM 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An Input / Output (I / O) interface 505 is also connected to the bus 504.

[0124] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. Removable media 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 510 as needed so that computer programs read from them can be installed into storage section 508 as needed.

[0125] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs various functions defined in the system of this application.

[0126] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0127] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0128] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0129] Another aspect of this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a computer's processor, causes the computer to perform the model-adversarial attack method as described above. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0130] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the model-adversarial attack methods provided in the various embodiments described above.

[0131] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A model adversarial attack method, characterized in that, The method includes: Acquire a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset. The data distribution of the first attack dataset and the second attack dataset is inconsistent. The first attack dataset includes image data with labels, including pedestrian images, vehicle images, road images, and road sign images. The second attack dataset has the same data category as the first attack dataset but does not carry labels. The first attack dataset is transmitted to a pre-built initial generation network to generate initial adversarial perturbations. Initial adversarial samples are obtained based on the initial adversarial perturbations. The initial adversarial samples are then transmitted to a pre-built alternative model corresponding to the target attack model to obtain the loss value of the alternative model. The target attack model includes an autonomous driving model. The first attack dataset and the second attack dataset are matched using a pre-built feature matching network to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching. Based on the loss value of the alternative model and the loss value of the feature matching network, the parameters of the initial generation network are updated to obtain the target generation network; The target attack dataset is transmitted to the target generation network to generate target adversarial perturbations. Target adversarial samples are obtained based on the target adversarial perturbations and transmitted to the autonomous driving model to achieve model adversarial attacks.

2. The model adversarial attack method according to claim 1, characterized in that, The step of transmitting the first attack dataset to a pre-constructed initial generation network to generate initial adversarial perturbations, and obtaining initial adversarial samples based on the initial adversarial perturbations, includes: The first attack dataset is transmitted to the initial generation network; The initial generation network generates initial adversarial perturbations corresponding to the first attack dataset according to a preset perturbation range. By combining the first attack dataset and the initial adversarial perturbation, the initial adversarial sample corresponding to the first attack dataset is obtained.

3. The model adversarial attack method according to claim 1, characterized in that, The step of transmitting the initial adversarial sample to an alternative model corresponding to the pre-constructed target attack model to obtain the loss value of the alternative model includes: The initial adversarial sample is transmitted to the alternative model corresponding to the autonomous driving model; The alternative model is used to execute the alternative model attack task; The loss value of the alternative model is obtained based on the gradient when the alternative model performs the attack task. The loss value of the alternative model is negative.

4. The model adversarial attack method according to claim 1, characterized in that, The step of performing feature matching between the first attack dataset and the second attack dataset using a pre-built feature matching network includes: Extract multiple first feature layers from the first attack dataset and multiple second feature layers from the second attack dataset, respectively. The multiple first feature layers and multiple second feature layers are mapped to a pre-constructed regenerable Hilbert space, and semantic features and texture features are matched through the regenerable Hilbert space.

5. The model adversarial attack method according to claim 4, characterized in that, The feature matching of semantic and texture features through the regenerable Hilbert space includes: Extract the first feature map from each of the first feature layers and the second feature map from each of the second feature maps; The second-order moment distance between the plurality of first feature layers and the plurality of second feature layers is obtained through the regenerable Hilbert space; Based on the second-order moment distance, the distance of semantic features between the first feature map and the second feature map is constrained, and the distance of texture features between the first feature map and the second feature map is also constrained. The semantic and texture features constrained by distance are aligned and quantized to obtain the loss value of the feature matching network.

6. The model adversarial attack method according to claim 5, characterized in that, The representation of the second-order moment distance includes: in, The second moment distance, For the first attack dataset, This is the second attack dataset. For the i-th first feature layer corresponding to the first attack dataset, For the j-th second feature layer corresponding to the second attack dataset, This is a preset mapping function that maps the feature layer to the regenerable Hilbert space.

7. The model adversarial attack method according to claim 1, characterized in that, The step of transmitting the target attack dataset to the target generation network, generating target adversarial perturbations, and obtaining target adversarial samples based on the target adversarial perturbations includes: The target attack dataset is transmitted to the target generation network; The target generation network generates target adversarial perturbations corresponding to the target attack dataset according to a preset perturbation range. By combining the target attack dataset and the target adversarial perturbation, the target adversarial sample corresponding to the target attack dataset is obtained.

8. A model-based adversarial attack device, characterized in that, The device includes: The dataset acquisition module is used to acquire a first attack dataset with labels, a second attack dataset without labels, and a target attack dataset. The data distribution of the first attack dataset and the second attack dataset is inconsistent. The first attack dataset includes image data with labels, including pedestrian images, vehicle images, road images, and road sign images. The second attack dataset has the same data category as the first attack dataset but does not carry labels. The alternative model attack task execution module is used to transmit the first attack dataset to a pre-built initial generation network to generate initial adversarial perturbations, obtain initial adversarial samples based on the initial adversarial perturbations, and transmit the initial adversarial samples to an alternative model corresponding to a pre-built target attack model to obtain the loss value of the alternative model. The target attack model includes an autonomous driving model. The feature matching module is used to perform feature matching between the first attack dataset and the second attack dataset through a pre-built feature matching network to obtain the loss value of the feature matching network. The feature matching includes semantic feature matching and texture feature matching. The target generation network generation module is used to update the parameters of the initial generation network based on the loss value of the alternative model and the loss value of the feature matching network to obtain the target generation network; An adversarial attack model is used to transmit the target attack dataset to the target generation network, generate target adversarial perturbations, obtain target adversarial samples based on the target adversarial perturbations, and transmit the target adversarial samples to the autonomous driving model to realize model adversarial attacks.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the electronic device to implement the model adversarial attack method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by the computer's processor, causes the computer to perform the model adversarial attack method as described in any one of claims 1 to 7.

Images