Data-free universal adversarial attack method for deep neural networks for image classification

Abstract

This invention provides a data-free, universal adversarial attack method for deep neural networks in image classification, comprising: Step 1, obtaining class impressions with different confidence levels; Step 2, perturbation initialization; Step 3, inputting the class impressions as training data into the model in batches to obtain the output vector of the original data in the last fully connected layer of the model; adding perturbation to the training data in the same batch and inputting it into the model to obtain the output vector of the perturbed data in the last fully connected layer of the model; calculating the mean cosine similarity between the output vectors of the batch of training data before and after adding perturbation, obtaining the loss value and gradient information, and using the optimizer to update the perturbation; Step 4, verifying the attack effect; Step 5, outputting the perturbation vector and visualizing it. This invention can eliminate the dependence on training data and efficiently generate universal adversarial perturbations.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence and relates to a method for generating adversarial examples using deep neural networks, specifically a data-free universal adversarial attack method for deep neural networks for image classification. Background Technology

[0002] Deep neural networks are currently the state-of-the-art method for most machine learning tasks. However, these networks are vulnerable to adversarial examples. Research shows that image-agnostic perturbations exist, and when these perturbations are added, most data samples can fool the target classifier. This perturbation is called a "universal adversarial perturbation (UAP)," meaning that a single noise can adversarially perturb samples from multiple classes. Because of its universality, UAPs pose a serious threat to the deployment of image classification models. Generating UAPs is crucial for validating model robustness, evaluating model security, and researching adversarial training and defense strategies, and can help better understand and improve the performance and security of deep neural networks.

[0003] Generating a Universal Adversarial Attack (UAP) typically requires a large amount of training data. However, obtaining training data is a difficult task in practice. Therefore, there is currently a lack of efficient and universally applicable adversarial attack methods when training data is unavailable. Summary of the Invention

[0004] To address the problem of ubiquitous adversarial attacks in data-free environments, this invention provides a data-free ubiquitous adversarial attack method for deep neural networks in image classification, which can eliminate the dependence on training data and generate ubiquitous adversarial perturbations with high efficiency.

[0005] The technical solution adopted by this invention to solve its technical problem is as follows:

[0006] A data-free, universal adversarial attack method for deep neural networks for image classification, comprising the following steps:

[0007] Step 1: Generate category impressions: Iteratively update the original input image using the model's gradient to obtain category impressions with different confidence levels;

[0008] Step 2, Perturbation Initialization: Set the initial perturbation to a zero vector with the same dimension as the input image data;

[0009] Step 3: Perform an adversarial attack by minimizing the cosine similarity of the output vectors: Input the category impressions as training data into the model in batches to obtain the output vector of the original data in the last fully connected layer of the model; Add perturbation to the training data in the same batch and input it into the model to obtain the output vector of the perturbated data in the last fully connected layer of the model; Calculate the mean cosine similarity between the output vectors of the batch of training data before and after adding perturbation to obtain the loss value and gradient information, and let the optimizer update the perturbation;

[0010] Step 4: Verify the attack effect: Add the perturbation to the test set sample images. If the classification result after model classification is different from the classification result before adding the perturbation, the attack is successful. Calculate the proportion of successfully attacked samples to the total samples, i.e., the fooling rate. If the fooling rate reaches the set threshold, proceed to step 5. If the fooling rate does not reach the set threshold, repeat steps 3 and 4 until the set iteration limit is reached.

[0011] Step 5: Output the perturbation vector and visualize it.

[0012] As a further embodiment of the present invention, the specific implementation method of step 1 is as follows:

[0013] Step 1.1: Randomly initialize the original image as the input to the model and assign a truth label to the image;

[0014] Step 1.2: Divide the confidence interval into [55,65], [65,75], [75,85], and [85,95] to simulate the model for samples of the same category with different classification difficulties;

[0015] Step 1.3: Use cross-entropy loss to measure the error between the classification result of the original image and its ground truth label, and obtain the loss value;

[0016] Step 1.4: Calculate the gradient information by differentiating the loss value with respect to the input. Use the ADAM optimizer to update the original image and input the updated image into the model. If the confidence of the image's ground truth label belongs to the category described in Step 1.2, stop updating and save the image; this image is the category impression. Otherwise, iterate by inputting the image into the model and updating the image using the gradient information until the image's confidence falls within the range described in Step 1.2.

[0017] As a further embodiment of the present invention, step 1.3, which uses cross-entropy loss to measure the error between the classification result of the original image and its ground truth label, is specifically formulated as follows:

[0018]

[0019] In equation (1), i is the sample; n is the total number of samples; j is the category; m is the total number of categories; y ijIt is a sign function, which is either 0 or 1. It takes the value 1 if the true class of sample i is equal to j, and 0 otherwise; a ij It is the predicted probability that sample i belongs to category j.

[0020] As a further embodiment of the present invention, the category impression mentioned in step 1.4 is a representative sample of the training data obtained by the memory of the mining model, used to simulate the actual data sample of the underlying distribution.

[0021] As a further embodiment of the present invention, the specific implementation method of step 3 is as follows:

[0022] Step 3.1: For each class, take an equal number of class impressions from the confidence interval described in Step 1.2 to form the proxy training set for generating UAP;

[0023] Step 3.2: Divide the proxy training set data into several batches, calculate the cosine similarity of the output vectors of the same batch of data before and after adding perturbation in the last fully connected layer of the model, and the loss value is the mean cosine similarity of the output vectors of the batch of data before and after adding perturbation.

[0024] Step 3.3: Obtain the gradient information by taking the derivative of the loss value with respect to the input. Use the ADAM optimizer to change the perturbation pixel value according to the gradient information, so that the perturbation pixel value is updated in the direction of reducing loss.

[0025] Step 3.4: Prune the perturbation to satisfy the norm constraint of the perturbation.

[0026] As a further embodiment of the present invention, the cosine similarity in step 3.2 is used to measure the similarity of the output vectors of the same image before and after the perturbation is added, and its calculation formula is as follows:

[0027]

[0028] In equation (2), A and B are two attribute vectors, n is the dimension of the vector, and A i and B i These are the components of vectors A and B, respectively.

[0029] As a further embodiment of the present invention, the formula for calculating the loss value in step 3.2 is as follows:

[0030]

[0031] In equation (3), B is a hyperparameter used to control batch size; similarity i It is the cosine similarity between the i-th pair of output vectors in the current batch.

[0032] As a further embodiment of the present invention, the goal of the perturbation is to adversarially interfere with samples from multiple categories using a single noise source. The goal of the perturbation is expressed as follows:

[0033]

[0034] In equation (4), ξ is the pre-trained classifier, x is the test sample, v is the general perturbation, μ is the distribution that the sample follows, p is the norm, and ξ is the threshold for pixel variation.

[0035] As a further embodiment of the present invention, the criteria for a successful attack in step 4 are expressed as follows:

[0036]

[0037] As a further embodiment of the present invention, the formula for calculating the fooling rate is:

[0038]

[0039] In equation (6), It represents the number of samples whose classification results changed after adding perturbation, and N is the total number of samples in the test set.

[0040] The beneficial effects of this invention include:

[0041] By using category impressions as training data to simulate the actual data of the underlying distribution, the dependence on actual data in the UAP generation process can be effectively eliminated, improving the practicality of universal adversarial attacks. By using the mean cosine similarity of the model output vector as the loss value, a large number of iterative calculations in the UAP generation process are avoided, enabling efficient attacks on the target model in a data-free environment. Attached Figure Description

[0042] Figure 1 Flowchart of a data-free universal adversarial attack method for deep neural networks for image classification;

[0043] Figure 2 This is a schematic diagram of the category impression generation process;

[0044] Figure 3 This is a diagram illustrating the category impressions.

[0045] Figure 4 A schematic diagram of universal adversarial perturbations generated for different models using category impressions. Detailed Implementation

[0046] The technical solution of the present invention will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0048] Example 1

[0049] A data-free, universal adversarial attack method for deep neural networks in image classification, such as... Figure 1 As shown, the detailed implementation steps are as follows:

[0050] S1: Select a pre-trained target model and enter evaluation mode. Select a randomly initialized image and set its ground truth label. Input the image into the model to obtain the classification result. Use the cross-entropy loss function to calculate the error between the classification result and the ground truth label to obtain the loss value. The calculation formula is as follows:

[0051]

[0052] In the above formula, i is the sample; n is the total number of samples; j is the category; m is the total number of categories; y ij It is a sign function, which is either 0 or 1. It takes the value 1 if the true class of sample i is equal to j, and 0 otherwise; a ij It is the predicted probability that sample i belongs to category j.

[0053] The gradient information is obtained by differentiating the loss value with respect to the input. The ADAM optimizer updates the image based on this gradient information. The confidence intervals are set sequentially to [55, 65], [65, 75], [75, 85], and [85, 95]. The updated image is input into the model. If the confidence of the image's ground truth label's category falls within the set interval, the update stops and the image is saved as the category impression. Otherwise, the image is iteratively input into the model, and the gradient information is used to update the image until the image's confidence meets the requirements. The category impression generation process is as follows: Figure 2 As shown, the resulting category impressions are as follows Figure 3 As shown.

[0054] S2, the category impressions are used as a proxy training set for generating UAP and input into the model in batches to obtain the output vectors corresponding to the category impressions; then, an initial perturbation is added to this batch of data and input into the model to obtain the perturbed output vectors corresponding to the category impressions. The mean cosine similarity between the two is calculated as the current loss, and its calculation formula is as follows:

[0055]

[0056] In the above formula, loss is the loss value; B is a hyperparameter used to control the batch size; similarity i It is the cosine similarity between the i-th pair of output vectors in the current batch;

[0057]

[0058] In the above formula, similarity is the cosine similarity, A and B are two attribute vectors, n is the dimension of the vector, and A i and B i These are the components of vectors A and B, respectively.

[0059] S3, the gradient information is obtained by differentiating the loss value with respect to the input. The ADAM optimizer is then used to update the perturbation based on the gradient information, and the perturbation is pruned to satisfy the norm constraint. General adversarial perturbations generated for different models are then used, such as class impressions. Figure 4 As shown.

[0060] S4. Add the cropped perturbation to the test set images and input them into the model. A successful attack is defined as a change in the classification result of the image after adding the perturbation.

[0061]

[0062] In the above formula, is a pre-trained classifier, x is a test sample, and v is a general perturbation;

[0063] The fool rate of statistical perturbation, which is the proportion of successfully attacked samples out of the total number of samples in the test set, is calculated using the following formula:

[0064]

[0065] In the above formula, is a pre-trained classifier, x is a test sample, and v is a general perturbation; It represents the number of samples whose classification results changed after adding perturbation, and N is the total number of samples in the test set.

[0066] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A deep neural network data-free universal adversarial attack method for image classification, characterized by the steps of The method comprises the following steps: Step 1, generating a category impression: iteratively updating the original input picture by using the gradient of the model to obtain a category impression with different confidence levels; Step 2, disturbance initialization: setting the initial disturbance as a zero vector with the same dimension as the input picture data; Step 3, performing an adversarial attack by minimizing the cosine similarity of the output vector: inputting the category impression into the model in batches as training data to obtain the output vector of the original data at the last fully connected layer of the model; inputting the data with disturbance into the model to obtain the output vector of the data with disturbance at the last fully connected layer of the model; calculating the average cosine similarity between the output vectors of the training data before and after adding the disturbance to obtain the loss value and gradient information, and submitting the loss value and gradient information to the optimizer to update the disturbance; Step 4, verifying the attack effect: adding the disturbance to the test set sample pictures, and if the classification result after the model classification is different from that before the disturbance is added, the attack is successful; calculating the proportion of the samples that are successfully attacked in the total samples, i.e. the fool rate, and if the fool rate reaches a set threshold, executing step 5; if the fool rate does not reach the set threshold, repeatedly executing steps 3 and 4 until the iteration upper limit is reached; Step 5, outputting the disturbance vector and visualizing it; The specific implementation method of step 1 is as follows: Step 1.1, randomly initializing the original picture as the input of the model, and setting a true value label for the picture; Step 1.2, dividing the confidence interval into [55, 65], [65, 75], [75, 85] and [85, 95] to simulate samples with different classification difficulties of the same category; Step 1.3, using cross-entropy loss to measure the error between the classification result of the original picture and the true value label to obtain the loss value; Step 1.4, obtaining the gradient information by taking the derivative of the loss value with respect to the input, and using the ADAM optimizer to update the original picture and input the updated picture into the model; if the confidence of the category to which the true value label belongs is in the interval in step 1.2, stop updating and save the picture, which is the category impression; otherwise, iteratively input the picture into the model and update the picture by using the gradient information until the confidence of the picture falls within the interval in step 1.

2.

2. The deep neural network data-free universal adversarial attack method for image classification of claim 1, wherein, The specific formula for measuring the error between the classification result of the original picture and the true value label by using cross-entropy loss in step 1.3 is as follows: （1）； In formula (1), is the sample; is the total number of samples; is the class; is the total number of classes; is the sign function, which is 0 or 1, and takes 1 if the sample has a true class equal to and 0 otherwise; is the predicted probability that the sample belongs to the class .

3. The deep neural network data-free universal adversarial attack method for image classification of claim 1, wherein, The category impression in step 1.4 is a representative sample of the training data obtained by excavating the memory of the model, which is used to simulate actual data samples of the underlying distribution.

4. The image classification oriented deep neural network data-free universal adversarial attack method according to claim 1, characterized in that, The specific implementation method of step 3 is as follows: Step 3.1, for each category, taking an equal number of category impressions from the confidence interval in step 1.2 to form a proxy training set for generating UAP; Step 3.2, dividing the proxy training set data into batches, calculating the cosine similarity between the output vectors of the same batch of data before and after adding the disturbance at the last fully connected layer of the model, and taking the average cosine similarity between the output vectors before and after adding the disturbance as the loss value of the batch of data; Step 3.3, obtaining the gradient information by taking the derivative of the loss value with respect to the input, and using the ADAM optimizer to change the pixel value of the disturbance according to the gradient information, so that the pixel value of the disturbance is updated in the direction of loss reduction; Step 3.

4. The perturbation is clipped to satisfy the norm constraint of the perturbation.

5. The deep neural network data-free universal adversarial attack method for image classification of claim 4, wherein, The cosine similarity in step 3.2 is used to measure the similarity of the output vectors of the same picture before and after adding the perturbation, and the calculation formula is: （2）； In formula (2), and are two attribute vectors, is the dimension of the vectors, and are the components of the vectors and respectively.

6. The deep neural network data-free universal adversarial attack method for image classification of claim 5, wherein, The calculation formula of the loss value in step 3.2 is: （3）； In formula (3), is a hyperparameter that controls the batch size; is the cosine similarity between output vectors.

7. The image classification oriented deep neural network data-free universal adversarial attack method according to claim 1, characterized in that, The goal of the perturbation is to interfere with samples from multiple categories in an adversarial manner by a single noise, and the goal of the perturbation is represented as: （4）； In formula (4), is a trained classifier, is a test sample, is a universal perturbation, is a distribution to which the sample is subject, is a norm, is a threshold for pixel change.

8. The deep neural network data-free universal adversarial attack method for image classification of claim 7, wherein, The standard of attack success in step 4 is represented as: （5）。 9. The deep neural network data-free universal adversarial attack method for image classification of claim 8, wherein, The calculation formula of the fool rate is: （6）； In formula (6), is the number of samples whose classification results change after adding the disturbance, is the total number of test set samples.

Images