A method and device for generating adversarial samples

Abstract

The present invention discloses a method and device for generating adversarial samples, which belong to the field of artificial intelligence security and adversarial sample generation technology. The method solves the problem that the existing adversarial sample generation method is a full-domain attack strategy, which causes a large amount of redundant disturbances and unnecessary pixel tampering, resulting in high computational overhead and difficulty in achieving the strongest adversarial effectiveness. The method comprises: obtaining the correct category of the target image through a deep convolutional neural network, obtaining the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain based on the generalized class activation map method, the saliency map method and the modified back propagation method, obtaining the key semantic fusion domain by fusing the coarse-fine granularity key semantic pixel points according to the union; obtaining an adversarial attack optimization model according to the key semantic fusion domain, and obtaining the optimal adversarial sample of the adversarial attack optimization model according to the Adam gradient descent algorithm.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security and adversarial sample generation technology, and more specifically relates to a method and device for generating adversarial samples. Background Art

[0002] In recent years, the increasingly mature application of big data technologies has accumulated massive amounts of data across multiple scenarios. The continued development of open-source learning frameworks and the increasing computing power of high-performance GPUs (graphics processing units) have driven advancements in both hardware and software infrastructure, leading to breakthroughs in deep learning models and algorithms for machine learning tasks. Driven by these factors, artificial intelligence (AI) has been widely deployed and successfully applied to fields such as image classification, speech recognition, and natural language processing, accelerating the intelligent transformation of traditional industries. However, numerous studies have shown that deep learning models are subject to serious security threats, significantly undermining the healthy development of AI technology. In image classification tasks, adversarial examples are the most prominent security threat. These examples involve deliberately adding subtle perturbations to the input image, imperceptible to humans, causing deep convolutional neural network models to misjudge and output erroneous predictions. In safety-critical applications such as facial recognition, autonomous driving, and smart healthcare, adversarial examples pose a significant risk of inducing inherent security risks in deep learning models, leading to misidentification of legitimate user identities, highway obstacles and traffic signs, and high-risk pathological medical images, resulting in significant economic losses and even life-threatening consequences. Therefore, in-depth research on the generation methods of adversarial samples has developed into a cutting-edge hotspot in artificial intelligence security research. It provides important theoretical basis and technical support for understanding the decision-making principles of deep convolutional neural network model predictions, revealing the mechanism of how exogenous adversarial attacks induce the intrinsic vulnerability of models, inspiring the construction of adversarial defense mechanisms, and enhancing the generalization and robustness of models.

[0003] Existing adversarial example generation methods, including limited-memory BFGS (L-BFGS), Fast Gradient Sign Method (FGSM), DeepFool, Carlini and Wagne (CW), Basic Iteration Method (BIM), and Momentum Iteration Method, utilize the gradients and decision boundary distances of backpropagated deep neural networks to construct a variety of adversarial perturbations. They also design white-box and black-box adversarial attacks based on the availability of model knowledge, or design targeted or untargeted attacks based on model misjudgment results. However, these methods always synthesize adversarial examples by incorporating adversarial perturbations into the complete semantic space spanned by all image pixels, a typical global attack strategy. This likely results in a large amount of redundant perturbations and unnecessary pixel manipulation, increasing computational overhead and contradicting the attacker's goal of tampering with the fewest pixels and achieving the strongest adversarial effectiveness. Summary of the Invention

[0004] The embodiments of the present invention provide an adversarial sample generation method and device to solve the problem that the existing adversarial sample generation method is a full-domain attack strategy, which causes a large amount of redundant disturbances and unnecessary pixel tampering, resulting in high computational overhead and difficulty in achieving the strongest adversarial effectiveness.

[0005] An embodiment of the present invention provides a method for generating adversarial samples, including:

[0006] Obtain the correct category of the target image through a deep convolutional neural network, and determine the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method, and the modified backpropagation method;

[0007] Determine a first key semantic pixel point set of the first sensitive semantic domain according to a first key semantic threshold, determine a second key semantic pixel point set of the second sensitive semantic domain according to a second key semantic threshold, and determine a third key semantic pixel point set of the third sensitive semantic domain according to a third key semantic threshold;

[0008] Determine the key semantic fusion domains corresponding to the first key semantic pixel set, the second key semantic pixel set, and the third key semantic pixel set according to the union fusion of the coarse-fine granularity key semantic pixel points;

[0009] Obtaining a mask matrix of the key semantic fusion domain through binarization, obtaining an adversarial perturbation of the target image corresponding to the mask matrix through a Hadamard product, obtaining a contaminated adversarial sample based on the adversarial perturbation and the target image, and determining an identification category of the contaminated adversarial sample through a deep convolutional neural network;

[0010] According to the relationship between the identification category of the contaminated adversarial sample, the correct category, and the specified attack category, an adversarial attack optimization model is obtained, and the optimal adversarial sample of the adversarial attack optimization model is obtained according to the Adam gradient descent algorithm.

[0011] Preferably, obtaining the adversarial attack optimization model based on the relationship between the identified category of the contaminated adversarial sample, the correct category, and the specified attack category specifically includes:

[0012] The adversarial attack optimization model includes an untargeted adversarial attack optimization model and a targeted adversarial attack optimization model;

[0013] If the identification category of the contaminated adversarial sample is different from the correct category, it is called the first type of adversarial sample, and an untargeted adversarial attack is determined. The optimization model of the untargeted adversarial attack is as follows:

[0014]

[0015] If the identification category of the contaminated adversarial sample is the same as the specified attack category, it is called the second-class adversarial sample, and a targeted adversarial attack is determined. The targeted adversarial attack optimization model is as follows:

[0016]

[0017] Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, Represents the confidence value corresponding to the correct category in the recognition result of the first type of adversarial sample, represents the confidence value corresponding to any category in the recognition results of the first type of adversarial samples, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI 1 ||0 represents the l0 norm metric, c represents the correct category; ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, represents the confidence value corresponding to any category in the recognition results of the second type of adversarial samples, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, and z represents the identification category of the contaminated adversarial sample.

[0018] Preferably, obtaining the mask matrix of the key semantic fusion domain by binarization, and obtaining the adversarial perturbation of the target image corresponding to the mask matrix by Hadamard product, specifically includes:

[0019] The mask matrix is as follows:

[0020]

[0021] The adversarial perturbation of the target image is as follows:

[0022] ΔI∈I M

[0023] ‖ΔI‖ ∞ ≤δ

[0024]

[0025] Among them, M c represents the mask matrix, L C represents the key semantic fusion domain, ΔI represents the adversarial perturbation of the target image, and I M represents the pixel area of the target image that can be used for malicious tampering, δ represents the maximum tamperable threshold of the adversarial perturbation, I represents the target image, represents the Hadamard product.

[0026] Preferably, the determining of the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method, and the modified back-propagation method specifically includes:

[0027] The importance of the gradient value of any feature map for the correct category confidence, the weight of any feature map for the correct category confidence, and the first sensitive semantic domain are determined by the following formula:

[0028]

[0029]

[0030]

[0031] The second sensitive semantic domain is determined by the following formula:

[0032]

[0033] The lth layer modified gradient and the third sensitive semantic domain are determined by the following formula:

[0034] G l =max(A l ,0)max(G l+1 ,0)

[0035]

[0036] Among them, A k represents the feature map of the kth channel, Y c represents the confidence of the correct category c, Indicates the importance of the gradient value of any feature map to the confidence of the correct category c, Indicates that any feature map for Y c The weight, L G Represents the first sensitive semantic domain, L S represents the second sensitive semantic domain, I(i,j) represents each pixel point included in the target image, G l Represents the corrected gradient of the lth convolutional layer, L B Represents the third sensitive semantic domain, A l Represents the feature map of the lth convolutional layer, A 1 Represents the feature map of the first convolutional layer.

[0037] Preferably, the key semantic fusion domain is as follows:

[0038] L C ={(i,j)∈(P G ∪P S ∪P B )}

[0039] Among them, P G represents the first key semantic pixel set, P G ={(i,j)∈(L G ≥τ G )},P S represents the second key semantic pixel set, P S ={(i,j)∈(L S ≥τ S )},P B represents the third key semantic pixel set, P B ={(i,j)∈(L B ≥τ B )};L C represents the key semantic fusion domain, L G Represents the first sensitive semantic domain, L S Represents the second sensitive semantic domain, L B represents the third sensitive semantic domain, τ Grepresents the first key semantic threshold, τ S represents the second key semantic threshold, τ B represents the third key semantic threshold;

[0040] Before determining the first key semantic pixel point set of the first sensitive semantic domain according to the first key semantic threshold, determining the second key semantic pixel point set of the second sensitive semantic domain according to the second key semantic threshold, and determining the third key semantic pixel point set of the third sensitive semantic domain according to the third key semantic threshold, the method further includes:

[0041] Sort each pixel included in the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain according to the order of semantic sensitivity from large to small to obtain key semantic pixels;

[0042] The first key semantic threshold of the first sensitive semantic domain, the second key semantic threshold of the second sensitive semantic domain, and the third key semantic threshold of the third sensitive semantic domain are respectively obtained according to the key semantic pixel points.

[0043] Preferably, the contaminated adversarial sample is as follows:

[0044] I′=I+ΔI

[0045] The identification categories of the contaminated adversarial samples are as follows:

[0046] z=argmax Y′

[0047] Among them, I′ represents the contaminated adversarial sample, ΔI represents the adversarial perturbation corresponding to the target image, I represents the target image, z represents the recognition category of the contaminated adversarial sample, and Y′ represents the classification result of the contaminated adversarial sample obtained by the deep convolutional neural network.

[0048] An embodiment of the present invention provides an adversarial sample generation device, comprising:

[0049] A first obtaining unit is configured to obtain a correct category of the target image through a deep convolutional neural network, and determine a first sensitive semantic domain, a second sensitive semantic domain, and a third sensitive semantic domain corresponding to the correct category based on a generalized class activation map method, a saliency map method, and a modified backpropagation method;

[0050] a determining unit, configured to determine a first key semantic pixel point set of the first sensitive semantic domain according to a first key semantic threshold, determine a second key semantic pixel point set of the second sensitive semantic domain according to a second key semantic threshold, and determine a third key semantic pixel point set of the third sensitive semantic domain according to a third key semantic threshold;

[0051] The second obtaining unit is configured to determine a key semantic fusion domain corresponding to the first key semantic pixel point set, the second key semantic pixel point set, and the third key semantic pixel point set according to the union fusion of the coarse-fine granularity key semantic pixel points;

[0052] a third obtaining unit, configured to obtain a mask matrix of the key semantic fusion domain by binarization, obtain an adversarial perturbation of the target image corresponding to the mask matrix by a Hadamard product, obtain a contaminated adversarial sample according to the adversarial perturbation and the target image, and determine an identification category of the contaminated adversarial sample by a deep convolutional neural network;

[0053] The fourth obtaining unit is used to obtain an adversarial attack optimization model based on the relationship between the identification category of the contaminated adversarial sample, the correct category, and the specified attack category, and obtain the optimal adversarial sample of the adversarial attack optimization model according to the Adam gradient descent algorithm.

[0054] Preferably, the fourth obtaining unit is specifically used for:

[0055] The adversarial attack optimization model includes an untargeted adversarial attack optimization model and a targeted adversarial attack optimization model;

[0056] If the identification category of the contaminated adversarial sample is different from the correct category, it is called the first type of adversarial sample, and an untargeted adversarial attack is determined. The optimization model of the untargeted adversarial attack is as follows:

[0057]

[0058] If the identification category of the contaminated adversarial sample is the same as the specified attack category, it is called the second-class adversarial sample, and a targeted adversarial attack is determined. The targeted adversarial attack optimization model is as follows:

[0059]

[0060] Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, Represents the confidence value corresponding to the correct category in the recognition result of the first type of adversarial sample, represents the confidence value corresponding to any category in the recognition results of the first type of adversarial samples, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI1||0 represents the l0 norm metric, and c represents the correct category; ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, represents the confidence value corresponding to any category in the recognition results of the second type of adversarial samples, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2 represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, and z represents the identification category of the contaminated adversarial sample.

[0061] An embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs any one of the above-described adversarial sample generation.

[0062] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs any of the above-described adversarial sample generation.

[0063] An embodiment of the present invention provides an adversarial sample generation method and device, which includes: obtaining the correct category of the target image through a deep convolutional neural network, determining the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method and the modified back propagation method; determining the first key semantic pixel point set of the first sensitive semantic domain according to the first key semantic threshold, determining the second key semantic pixel point set of the second sensitive semantic domain according to the second key semantic threshold, and determining the third key semantic pixel point set of the third sensitive semantic domain according to the third key semantic threshold; determining the first key semantic pixel point set of the first sensitive semantic domain according to the union fusion of coarse-fine granularity key semantic pixel points. A key semantic fusion domain corresponding to a key semantic pixel point set, the second key semantic pixel point set and the third key semantic pixel point set; a mask matrix of the key semantic fusion domain is obtained by binarization, an adversarial perturbation of the target image corresponding to the mask matrix is obtained by a Hadamard product, a contaminated adversarial sample is obtained according to the adversarial perturbation and the target image, and an identification category of the contaminated adversarial sample is determined by a deep convolutional neural network; an adversarial attack optimization model is obtained according to the relationship between the identification category of the contaminated adversarial sample, the correct category and the specified attack category, and an optimal adversarial sample of the adversarial attack optimization model is obtained according to the Adam gradient descent algorithm. This method proposes an optimal adversarial sample generation method based on key semantic fusion domain, wherein the correct category of the target image is obtained based on the generalized class activation map method, the saliency map method and the modified backpropagation method to obtain the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain. The second sensitive semantic domain and the third sensitive semantic domain can identify key semantic pixels, and the first sensitive semantic domain can identify key semantic pixel blocks. The key semantic fusion domain corresponding to the target image can be accurately obtained by combining the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain; further, an adversarial attack optimization model is constructed according to the key semantic fusion domain, and a local attack for key semantics is proposed to generate the optimal adversarial sample, achieving the intention of minimizing the cost of tampering pixels and achieving the strongest adversarial attack effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 A schematic diagram of a process for generating adversarial samples according to an embodiment of the present invention;

[0066] Figure 2A schematic diagram of the structure of an adversarial sample generation device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0067] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0068] In image classification tasks, key semantic analysis methods such as saliency maps, gradient backpropagation, and gradient-based class activation maps help understand and recognize image content, and locate sensitive pixel regions that contribute to accurate predictions in convolutional neural networks. However, as fine-grained key semantic localization techniques, saliency maps and gradient backpropagation require gradient chain calculation and propagation, which makes it difficult to overcome gradient saturation and can easily lead to underestimation of the saliency of certain key semantic pixels. Gradient-based class activation maps, as coarse-grained key semantic localization techniques, although they do not involve the gradient propagation process, still cannot assess the importance of the virtual weights of any neural network's equivalent fully connected layer to the feature map, which can easily lead to inaccurate localization of key semantic pixel regions. This shows that any graph semantic localization technique struggles to accurately visualize the key semantic pixel domain, and the development of a comprehensive and effective coarse-grained and fine-grained graph semantic localization technique to obtain the key semantic fusion pixel domain remains urgent.

[0069] In order to solve the above problems, an embodiment of the present invention adopts an adversarial sample generation method. The method is based on a deep convolutional neural network and uses three graph semantic localization technologies, namely, saliency map, pruned backpropagation, and generalized class activation map, to obtain the key semantic fusion domain. Then, under the constraint of the key semantic fusion domain, an optimization model with / without specific target adversarial attack is constructed, and finally the optimal adversarial sample is generated, thereby improving the cost-effectiveness of the adversarial attack.

[0070] Figure 1 This is a flowchart of a method for generating adversarial samples provided by an embodiment of the present invention. Figure 1 Taking this as an example, a method for generating adversarial samples provided by an embodiment of the present invention is introduced.

[0071] like Figure 1 As shown, the method provided by the embodiment of the present invention mainly includes the following steps:

[0072] Step 101: obtaining the correct category of the target image through a deep convolutional neural network, and determining the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method, and the modified backpropagation method;

[0073] Step 102: determining a first key semantic pixel point set of the first sensitive semantic domain according to a first key semantic threshold, determining a second key semantic pixel point set of the second sensitive semantic domain according to a second key semantic threshold, and determining a third key semantic pixel point set of the third sensitive semantic domain according to a third key semantic threshold;

[0074] Step 103: determining key semantic fusion domains corresponding to the first key semantic pixel set, the second key semantic pixel set, and the third key semantic pixel set according to the union fusion of the coarse-fine granularity key semantic pixel points;

[0075] Step 104: obtaining a mask matrix of the key semantic fusion domain by binarization, obtaining an adversarial perturbation of the target image corresponding to the mask matrix by a Hadamard product, obtaining a contaminated adversarial sample based on the adversarial perturbation and the target image, and determining the recognition category of the contaminated adversarial sample by a deep convolutional neural network;

[0076] Step 105: Obtain an adversarial attack optimization model based on the relationship between the identified category of the contaminated adversarial sample, the correct category, and the specified attack category, and obtain the optimal adversarial sample of the adversarial attack optimization model based on the Adam gradient descent algorithm.

[0077] Before step 101, it is necessary to first obtain the target image. Specifically, under normal lighting conditions, use a high-definition camera to directly shoot the target to obtain an initial image, the length of which is expressed as N l , width is expressed as N w , further, the initial image is subjected to maximum-minimum normalization processing, so that the initial image is mapped to [0,1] to obtain the target image, which can also be called a clean image, as shown in formula (1):

[0078]

[0079] Where I represents the target image.

[0080] In step 101, the initial image without any contamination is input as the target image into the deep convolutional neural network pre-trained with the ImageNet dataset for image recognition. The target image outputs the classification confidence vector of all categories through the deep convolutional neural network, and the category corresponding to the maximum confidence is determined as the correct category of the target image. The classification confidence vector of all categories is shown in formula (2), and the correct category of the target image is shown in formula (3):

[0081] Y=C(I) (2)

[0082] c=argmaxY (3)

[0083] Among them, C represents the deep convolutional neural network model, Y represents the classification confidence vector of all output categories, and c represents the correct category of the target image I.

[0084] In practical applications, the generalized class activation map method is a coarse-grained semantic localization technology that mainly uses the gradient values of all feature maps of the last convolutional layer to measure the correct category of the target image, which indicates the importance of each feature map for the correct classification decision.

[0085] In the embodiment of the present invention, the importance of the gradient value of any feature map to the correct category confidence of the target image is determined by the following formula (4):

[0086]

[0087] The weight of the correct category confidence of any feature map for the target image is determined by the following formula (5):

[0088]

[0089] The first sensitive semantic domain is obtained by adjusting it to the size of the target image through the upsample function as shown in formula (6):

[0090]

[0091] In the above formula, A k represents the feature map of the kth channel, Y c represents the confidence of the correct category c of the target image, Indicates the importance of the gradient value of any feature map to the correct category c confidence of the target image, Represents the weight of the confidence of any feature map for the correct category c of the target image, L G Represents the first sensitive semantic domain, Represents each pixel included in any feature map.

[0092] It should be noted that Y is the confidence vector of the deep convolutional neural network model for the target image classification. For example, the classification confidence vectors are: [0.1, 0.2, 0.05, 0.6, 0.05], and argmaxY represents the index value 4 corresponding to the maximum element value 0.6 in vector Y. Formula (3) c = argmaxY, which can be understood as when c = 4, maxY = 0.6. Based on this, Y can be determined c Represents the value of the cth element in vector Y.

[0093] Furthermore, based on the correct category of the target image and the deep convolutional neural network, the saliency map method is used to obtain the second sensitive semantic domain. The saliency map method is a pixel-level fine-grained semantic localization technology. Generally, the gradient value of a multi-input variable function can be used to measure the importance and contribution of each input variable to the output of the function. Therefore, the saliency map method mainly uses the gradient value of the correct category of the input image (target image) of the first convolutional layer to the output of the target model to measure the importance of each pixel point (i, j) of the input image for the correct classification decision, and obtain the second sensitive semantic domain, as shown in formula (7):

[0094]

[0095] Among them, L S Represents the second sensitive semantic domain, and I(i,j) represents each pixel point included in the target image.

[0096] Furthermore, based on the correct category of the target image and the deep convolutional neural network, the modified backpropagation method is used to obtain the third sensitive semantic domain. The modified backpropagation method is a pixel-level fine-grained semantic localization technology. Generally speaking, when the feature map and gradient are positive, they have a positive contribution to the classification decision, while when the feature map and gradient are negative, they have a negative effect on the classification decision. Therefore, the modified backpropagation method only retains the positive feature maps and gradients that have a positive contribution to the classification decision process during the gradient backpropagation process, and eliminates the negative feature maps and gradients, thereby identifying the third sensitive semantic domain of the image through the modified gradient backpropagation process.

[0097] Specifically, the modified gradient G of the lth layer is calculated by the feature map of the lth layer and the gradient of the l+1th layer. l , as shown in formula (8):

[0098] G l =max(A l ,0)max(G l+1 ,0) (8)

[0099] According to the chain rule, the importance of each pixel in the feature map of the first activation layer to the correct category of the target image is calculated to obtain the third sensitive semantic field as shown in formula (9):

[0100]

[0101] Among them, L B Represents the third sensitive semantic domain, G l A represents the corrected gradient of the lth convolutional layer. 1 Represents the feature map of the first convolutional layer.

[0102] In step 102, in an embodiment of the present invention, the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain respectively represent the semantic sensitivity of each pixel point (i, j) included in the target image. According to the relationship of semantic sensitivity from large to small, each pixel point in the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain are sorted, and a Top-T sorting array is obtained, where T is generally expressed by the following formula (10):

[0103]

[0104] Among them, N l Indicates the width of the target image, N w Indicates the length of the target image. In practical applications, the first sensitive semantic domain, the second sensitive semantic domain, and one-third of the third sensitive semantic domain are considered as the first key semantic domain, which contains the Top-T key semantic pixels.

[0105] Furthermore, after obtaining the semantic sensitivity corresponding to the T-th pixel in the sorted array, the semantic sensitivity of each pixel is assigned to a key semantic threshold to obtain a first key semantic threshold, a second key semantic threshold, and a third key semantic threshold. In an embodiment of the present invention, the key semantic threshold is used to measure the semantic criticality of each pixel in the sensitive semantic domain. Specifically, the first key semantic threshold is used to measure the semantic criticality of each pixel in the first sensitive semantic domain, the second key semantic threshold is used to measure the semantic criticality of each pixel in the second sensitive semantic domain, and the third key semantic threshold is used to measure the semantic criticality of each pixel in the third sensitive semantic domain.

[0106] The first key semantic pixel point set of the first sensitive semantic domain, the second key semantic pixel point set of the second sensitive semantic domain, and the third key semantic pixel point set of the third sensitive semantic domain are determined according to the first key semantic threshold, the second key semantic threshold, and the third key semantic pixel point set. The first key semantic pixel point set, the second key semantic pixel point set, and the third key semantic pixel point set are respectively as shown in formulas (11), (12), and (13):

[0107] P G ={(i,j)∈(L G ≥τ G )} (11)

[0108] P S ={(i,j)∈(L S ≥τ S )} (12)

[0109]

[0110] Among them, P GRepresents the first key semantic pixel set, P S Represents the second key semantic pixel set, P B Represents the third key semantic pixel set, L G Represents the first sensitive semantic domain, L S Represents the second sensitive semantic domain, L B represents the third sensitive semantic domain, τ G represents the first key semantic threshold, τ S represents the second key semantic threshold, τ B Indicates the third key semantic threshold.

[0111] Furthermore, the union method is used to fuse the coarse-fine granularity key semantic pixel points to obtain the key semantic fusion domains corresponding to the first key semantic pixel point set, the second key semantic pixel point set, and the third key semantic pixel point set, as shown in formula (14):

[0112] L C ={(i,j)∈(P G ∪P S ∪P B )} (14)

[0113] Among them, L C Represents the key semantic fusion domain.

[0114] In step 103, the key semantic fusion domain is binarized to obtain a 0-1 logical mask matrix. The mask matrix is shown in formula (15):

[0115]

[0116] Furthermore, the mask matrix is located by the Hadamard product to obtain the pixel area of the target image that can be used for malicious tampering. The pixel area of the target image that can be used for malicious tampering is shown in formula (16):

[0117]

[0118] Among them, M c represents the mask matrix, L C represents the key semantic fusion domain, I represents the target image, Represents the Hadamard product, that is, the multiplication of corresponding elements of the same type of matrices; I M Indicates the pixel area of the target image that can be used for malicious tampering.

[0119] In the embodiment of the present invention, for the adversarial attack optimization problem, the optimization variable is the adversarial perturbation corresponding to the target image, and its feasible domain is expressed by the following formula (17):

[0120] ΔI∈I M(17)

[0121] Among them, ΔI represents the adversarial perturbation corresponding to the target image, I M Indicates the pixel area of the target image that can be used for malicious tampering.

[0122] It should be noted that, in the embodiment of the present invention, the above-mentioned constraints guide the attacker to focus only on the pixels contained in the key semantic fusion domain for malicious tampering, greatly reducing the feasible tampering space, and focusing the tampering attention on the key semantic pixel points that determine the correct decision of the model, which helps to improve the effectiveness of the attack and reduce the cost of the attack.

[0123] Furthermore, a maximum tamperable threshold of the adversarial perturbation corresponding to the target image is set to ensure the smallness of the adversarial perturbation and avoid excessive tampering of pixel values, thereby escaping the detection of the human eye. In the embodiment of the present invention, the mathematical expression of this constraint condition is shown in formula (18):

[0124] ‖ΔI‖ ∞ ≤δ (18)

[0125] Wherein, ΔI represents the adversarial perturbation corresponding to the target image, and δ represents the maximum tamperable threshold of the adversarial perturbation. It should be noted that in the embodiment of the present invention, δ is usually set to 0.1.

[0126] Furthermore, based on the adversarial perturbation of the target image and the target image, a contaminated adversarial sample is synthesized, which can also be referred to as a contaminated adversarial sample. The contaminated adversarial sample is specifically shown in formula (19):

[0127] I′=I+ΔI (19)

[0128] The contaminated adversarial sample obtained above is input into the deep convolutional neural network. The result output by the deep convolutional neural network is determined as the new classification result, which is here called the classification result of the contaminated adversarial sample. Furthermore, the category with the maximum confidence in the classification result is determined as the recognition category of the contaminated adversarial sample, which is expressed by formula (20):

[0129] z=argmaxY′ (20)

[0130] Wherein, I′ represents the contaminated adversarial sample, ΔI represents the adversarial perturbation corresponding to the target image, I represents the target image, z represents the recognition category of the contaminated adversarial sample, Y′ represents the classification confidence vector of all categories obtained by the contaminated adversarial sample through the deep convolutional neural network, and Y′=max C(I′).

[0131] In step 105, based on the relationship between the determined recognition result of the contaminated adversarial sample and the correct category of the target image and the specified attack category, an untargeted adversarial attack optimization model or a targeted adversarial attack optimization model can be obtained.

[0132] Specifically, when it is determined that the identification category of the contaminated adversarial sample is different from the correct category of the target image, the contaminated adversarial sample is called the first type of adversarial sample, and an adversarial attack without a specific target is obtained, while requiring the number of tampered pixels to be as small as possible. Here, a weight parameter is introduced to balance the intention of minimizing the tampering cost and maximizing the attack effectiveness. The optimization model of the untargeted adversarial attack is shown in formula (21):

[0133]

[0134] Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, Represents the confidence value corresponding to the correct category in the recognition result (confidence vector) of the first type of adversarial sample, Represents the confidence value corresponding to any category in the recognition result (confidence vector) of the first type of adversarial class, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI 1 ||0 represents the l0 norm metric, which is used to count the total number of non-zero pixels of the first type of adversarial perturbation, c represents the correct category, and z represents the identification category of the contaminated adversarial sample.

[0135] When it is determined that the identification category of the contaminated adversarial sample is the same as the specified attack category, the contaminated adversarial sample is called the second-class adversarial sample, and a targeted adversarial attack is obtained. At this time, the feasible domain of the adversarial perturbation is expressed as the common domain of the second key semantic domain corresponding to the correct category c and the third key semantic domain corresponding to the specified attack category t, which is expressed by the following formula (22):

[0136] ΔI∈M c +M t -M c ⊙M t (twenty two)

[0137] Among them, M c Represents the second key semantic domain, M t Represents the third key semantic domain.

[0138] Furthermore, it is required that the number of tampered pixels is as small as possible. A weight parameter is also introduced to balance the intention of minimum tampering cost and maximum attack effectiveness through the weight parameter. The targeted adversarial attack optimization model is shown in formula (23):

[0139]

[0140] Among them, ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, It represents the confidence value corresponding to any category in the recognition result (confidence vector) of the second type of adversarial sample, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2 represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, which is used to count the total number of non-zero pixels of the second type of adversarial perturbation.

[0141] In the embodiment of the present invention, whether the non-targeted adversarial attack optimization model is obtained through formula (21) or the targeted adversarial attack optimization model is obtained through formula (23).

[0142] In practical applications, in order to obtain the optimal adversarial sample, preferably, the Adam gradient descent algorithm can be used to iteratively solve and optimize Formula (21) and Formula (23) to obtain the optimal adversarial sample.

[0143] Specifically, the maximum iteration step is initialized to K = 1000, the decay parameter β1 = 0.9 and the decay parameter β2 = 0.999, ε = 10e-8, the first-order and second-order moment estimates m0 = 0 and v0 = 0, and the learning rate η = 0.1;

[0144] The gradient g of the kth step is determined by the following formula (24): k :

[0145]

[0146] The first-order moment estimate m of the attenuation parameters β1 and β2 in the kth step is determined by the following formula k and the second-order moment estimate v k , further determine the modified moment estimates of the attenuation parameters β1 and β2 and

[0147] m k =β1m k -1+(1-β1)g k (25)

[0148]

[0149]

[0150]

[0151] Update the adversarial perturbation by the following formula:

[0152]

[0153] Among them, g k represents the gradient value of the kth step, Represents the loss function J relative to the variable ΔI k The gradient value of Indicates the gradient calculation symbol, ΔI k represents the adversarial perturbation at step k, m k-1 represents the first-order moment estimate of the k-1th step, v k-1 represents the k-1th step moment estimate, represents the kth power of the attenuation parameter β1, represents the kth power of the attenuation parameter β2, ΔI k+1 represents the adversarial perturbation at the k+1th step.

[0154] In practical applications, if the maximum iteration step is reached, the iteration converges and the iteration can be stopped to finally obtain the optimal adversarial sample.

[0155] In an embodiment of the present invention, after the optimal adversarial sample is obtained by an untargeted adversarial attack optimization model and an Adam gradient descent algorithm, the optimal adversarial sample is input into a deep convolutional neural network so that the prediction result is any category other than the correct category; if the optimal adversarial sample is obtained by a targeted adversarial attack optimization model and an Adam gradient descent algorithm, the optimal adversarial sample is input into a deep convolutional neural network so that the prediction result is a specified category other than the correct category.

[0156] In summary, an embodiment of the present invention provides an adversarial sample generation method and device, which proposes an optimal adversarial sample generation method based on key semantic fusion domain, wherein the correct category of the target image is obtained based on the generalized class activation map method, the saliency map method and the modified back propagation method to obtain the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain can identify key semantic pixel points, and the first sensitive semantic domain can identify key semantic pixel blocks. The key semantic fusion domain corresponding to the target image can be accurately obtained by combining the first sensitive semantic domain, the second sensitive semantic domain and the third sensitive semantic domain; further, an adversarial attack optimization model is constructed according to the key semantic fusion domain, a local attack oriented to key semantics is proposed, and the optimal adversarial sample is generated, thereby achieving the intention of minimizing the cost of tampering with pixels and achieving the strongest adversarial attack effectiveness.

[0157] It should be noted that the adversarial sample generation method provided in the embodiment of the present invention can be used in application scenarios such as face recognition scenarios and STOP traffic sign recognition scenarios for unmanned autonomous driving vehicles.

[0158] When the application scenario of the adversarial sample generation method provided by the embodiment of the present invention is face recognition, it specifically includes:

[0159] Given a clean face image of Zhang San (without any manipulation), input it into a face recognition model based on a convolutional neural network and it is identified as the correct category: Zhang San;

[0160] In the case of an untargeted adversarial attack, after adding the first type of adversarial perturbation to Zhang San's face image and inputting it into the face recognition model, it is identified as Li Si, achieving a mistaken identity attack effect;

[0161] In the case of a targeted adversarial attack, the attack category is set as Wang Wu. After adding the second type of adversarial perturbation to Zhang San's face picture, it is input into the face recognition model and identified as Wang Wu, achieving the attack effect of misidentifying the designated target.

[0162] When the adversarial sample generation method provided by the embodiment of the present invention is applied to an unmanned autonomous driving car recognizing a STOP traffic sign, the method specifically includes:

[0163] An unmanned autonomous vehicle collects an image containing a STOP traffic sign and inputs it into an environmental perception and recognition model based on a convolutional neural network. The image is recognized as STOP and the vehicle immediately brakes to a stop.

[0164] In the case of an untargeted adversarial attack, after adding the first type of adversarial perturbation to the collected image of a STOP traffic sign and inputting it into the environmental perception and recognition model, it was identified as a (non-STOP) speed limit of 40. The car did not brake and continued to move, resulting in a traffic accident.

[0165] In the case of a targeted adversarial attack, a (non-STOP) speed limit of 60 is set. After adding the second type of adversarial perturbation to the collected image of the STOP traffic sign, it is input into the environmental perception and recognition model, and is recognized as a (non-STOP) speed limit of 60. The car does not brake and continues to move, resulting in a traffic accident.

[0166] Based on the same inventive concept, an embodiment of the present invention provides an adversarial sample generation device. Since the principle of solving the technical problem of the device is similar to that of an adversarial sample generation method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0167] Figure 2 A schematic diagram of an adversarial sample generation structure provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes a first obtaining unit 201, a determining unit 202, a second obtaining unit 203, a third obtaining unit 204 and a fourth obtaining unit 205, specifically:

[0168] A first obtaining unit 201 is configured to obtain a correct category of a target image through a deep convolutional neural network, and determine a first sensitive semantic domain, a second sensitive semantic domain, and a third sensitive semantic domain corresponding to the correct category based on a generalized class activation map method, a saliency map method, and a modified backpropagation method;

[0169] a determining unit 202 configured to determine a first key semantic pixel set of the first sensitive semantic domain according to a first key semantic threshold, determine a second key semantic pixel set of the second sensitive semantic domain according to a second key semantic threshold, and determine a third key semantic pixel set of the third sensitive semantic domain according to a third key semantic threshold;

[0170] The second obtaining unit 203 is configured to determine the key semantic fusion domain corresponding to the first key semantic pixel set, the second key semantic pixel set, and the third key semantic pixel set according to the union fusion of the coarse-fine granularity key semantic pixel points;

[0171] A third obtaining unit 204 is configured to obtain a mask matrix of the key semantic fusion domain by binarization, obtain an adversarial perturbation of the target image corresponding to the mask matrix by a Hadamard product, obtain a contaminated adversarial sample according to the adversarial perturbation and the target image, and determine an identification category of the contaminated adversarial sample by a deep convolutional neural network;

[0172] The fourth obtaining unit 205 is used to obtain an adversarial attack optimization model based on the relationship between the identification category of the contaminated adversarial sample, the correct category, and the specified attack category, and obtain the optimal adversarial sample of the adversarial attack optimization model according to the Adam gradient descent algorithm.

[0173] Preferably, the fourth obtaining unit 205 is specifically configured to:

[0174] The adversarial attack optimization model includes an untargeted adversarial attack optimization model and a targeted adversarial attack optimization model;

[0175] If the identification category of the contaminated adversarial sample is different from the correct category, it is called the first type of adversarial sample, and an untargeted adversarial attack is determined. The optimization model of the untargeted adversarial attack is as follows:

[0176]

[0177] If the identification category of the contaminated adversarial sample is the same as the specified attack category, it is called the second-class adversarial sample, and a targeted adversarial attack is determined. The targeted adversarial attack optimization model is as follows:

[0178]

[0179] Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, Represents the confidence value corresponding to the correct category in the recognition result of the first type of adversarial sample, represents the confidence value corresponding to any category in the recognition results of the first type of adversarial samples, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI 1 ||0 represents the l0 norm metric, c represents the correct category; ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, represents the confidence value corresponding to any category in the recognition results of the second type of adversarial samples, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2 represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, and z represents the identification category of the contaminated adversarial sample.

[0180] Preferably, the third obtaining unit 204 is specifically configured to:

[0181] The mask matrix is as follows:

[0182]

[0183] The adversarial perturbation of the target image is as follows:

[0184] ΔI∈I M

[0185] ‖ΔI‖ ∞ ≤δ

[0186]

[0187] Among them, M c represents the mask matrix, L C represents the key semantic fusion domain, ΔI represents the adversarial perturbation of the target image, and I M represents the pixel area of the target image that can be used for malicious tampering, δ represents the maximum tamperable threshold of the adversarial perturbation, l represents the target image, represents the Hadamard product.

[0188] Preferably, the first obtaining unit 201 is specifically configured to:

[0189] The importance of the gradient value of any feature map for the correct category confidence, the weight of any feature map for the correct category confidence, and the first sensitive semantic domain are determined by the following formula:

[0190]

[0191]

[0192]

[0193] The second sensitive semantic domain is determined by the following formula:

[0194]

[0195] The lth layer modified gradient and the third sensitive semantic domain are determined by the following formula:

[0196] G l =max(A l ,0)max(G l+1 ,0)

[0197]

[0198] Among them, A k represents the feature map of the kth channel, Y c represents the confidence of the correct category c, Indicates the importance of the gradient value of any feature map to the confidence of the correct category c, Indicates that any feature map for Y c The weight, L G Represents the first sensitive semantic domain, L S represents the second sensitive semantic domain, I(i,j) represents each pixel point included in the target image, G l Represents the corrected gradient of the lth convolutional layer, L B Represents the third sensitive semantic domain, A l Represents the feature map of the lth convolutional layer, A 1 Represents the feature map of the first convolutional layer.

[0199] Preferably, the key semantic fusion domain is as follows:

[0200] L C ={(i,j)∈(P G ∪P S ∪P B )}

[0201] Among them, P G represents the first key semantic pixel set, P G ={(i,j)∈(LG ≥τ G )},P S represents the second key semantic pixel set, P S ={(i,j)∈(L S ≥τ S )},P B represents the third key semantic pixel set, P B ={(i,j)∈(L B ≥τ B )};L C represents the key semantic fusion domain, L G Represents the first sensitive semantic domain, L S Represents the second sensitive semantic domain, L B represents the third sensitive semantic domain, τ G represents the first key semantic threshold, τ S represents the second key semantic threshold, τ B represents the third key semantic threshold;

[0202] The determining unit 202 is further configured to:

[0203] Sort each pixel included in the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain according to the order of semantic sensitivity from large to small to obtain key semantic pixels;

[0204] The first key semantic threshold of the first sensitive semantic domain, the second key semantic threshold of the second sensitive semantic domain, and the third key semantic threshold of the third sensitive semantic domain are respectively obtained according to the key semantic pixel points.

[0205] Preferably, the contaminated adversarial sample is as follows:

[0206] I′=I+ΔI

[0207] The identification categories of the contaminated adversarial samples are as follows:

[0208] z=argmax Y′

[0209] Among them, I′ represents the contaminated adversarial sample, ΔI represents the adversarial perturbation corresponding to the target image, I represents the target image, z represents the recognition category of the contaminated adversarial sample, and Y′ represents the classification result of the contaminated adversarial sample obtained by the deep convolutional neural network.

[0210] It should be understood that the units included in the above-mentioned adversarial example generation device are merely logical divisions based on the functions implemented by the device. In actual applications, these units can be superimposed or separated. Furthermore, the functions implemented by the adversarial example generation device provided in this embodiment correspond one-to-one with the adversarial example generation method provided in the above-mentioned embodiment. The more detailed processing flow implemented by this device has been described in detail in the above-mentioned method embodiment 1 and will not be described in detail here.

[0211] Another embodiment of the present invention also provides a computer device, which includes: a processor and a memory; the memory is used to store computer program code, and the computer program code includes computer instructions; when the processor executes the computer instructions, the electronic device executes each step of an adversarial sample generation method in the method flow shown in the above method embodiment.

[0212] Another embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer device, the computer device executes each step of an adversarial sample generation method in the method flow shown in the above method embodiment.

[0213] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0214] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A method for generating adversarial samples, characterized in that: include: Obtain the correct category of the target image through a deep convolutional neural network, and determine the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method, and the modified backpropagation method; Determine a first key semantic pixel point set of the first sensitive semantic domain according to a first key semantic threshold, determine a second key semantic pixel point set of the second sensitive semantic domain according to a second key semantic threshold, and determine a third key semantic pixel point set of the third sensitive semantic domain according to a third key semantic threshold; Determine the key semantic fusion domains corresponding to the first key semantic pixel set, the second key semantic pixel set, and the third key semantic pixel set according to the union fusion of the coarse-fine granularity key semantic pixel points; Obtaining a mask matrix of the key semantic fusion domain through binarization, obtaining an adversarial perturbation of the target image corresponding to the mask matrix through a Hadamard product, obtaining a contaminated adversarial sample based on the adversarial perturbation and the target image, and determining an identification category of the contaminated adversarial sample through a deep convolutional neural network; According to the relationship between the identification category of the contaminated adversarial sample, the correct category, and the specified attack category, an adversarial attack optimization model is obtained, and the optimal adversarial sample of the adversarial attack optimization model is obtained according to the Adam gradient descent algorithm.

2. The method according to claim 1, wherein The method of obtaining an adversarial attack optimization model based on the relationship between the identified category of the contaminated adversarial sample, the correct category, and the specified attack category specifically includes: The adversarial attack optimization model includes an untargeted adversarial attack optimization model and a targeted adversarial attack optimization model; If the identification category of the contaminated adversarial sample is different from the correct category, it is called the first type of adversarial sample, and an untargeted adversarial attack is determined. The optimization model of the untargeted adversarial attack is as follows: If the identification category of the contaminated adversarial sample is the same as the specified attack category, it is called the second-class adversarial sample, and a targeted adversarial attack is determined. The targeted adversarial attack optimization model is as follows: Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, Represents the confidence value corresponding to the correct category in the recognition result of the first type of adversarial sample, represents the confidence value corresponding to any category in the recognition results of the first type of adversarial samples, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI 1 ||0 represents the l0 norm metric, c represents the correct category; ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, represents the confidence value corresponding to any category in the recognition results of the second type of adversarial samples, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2 represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, and z represents the identification category of the contaminated adversarial sample.

3. The method according to claim 1, wherein Obtaining a mask matrix of the key semantic fusion domain by binarization, and obtaining an adversarial perturbation of the target image corresponding to the mask matrix by Hadamard product, specifically including: The mask matrix is as follows: The adversarial perturbation of the target image is as follows: ΔI∈I M ‖ΔI‖ ∞ ≤δ Among them, M c represents the mask matrix, L C represents the key semantic fusion domain, ΔI represents the adversarial perturbation of the target image, and I M represents the pixel area of the target image that can be used for malicious tampering, δ represents the maximum tamperable threshold of the adversarial perturbation, I represents the target image, represents the Hadamard product.

4. The method according to claim 1, wherein The determining of the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain corresponding to the correct category based on the generalized class activation map method, the saliency map method, and the modified backpropagation method specifically includes: The importance of the gradient value of any feature map for the correct category confidence, the weight of any feature map for the correct category confidence, and the first sensitive semantic domain are determined by the following formula: The second sensitive semantic domain is determined by the following formula: The lth layer modified gradient and the third sensitive semantic domain are determined by the following formula: G l =max(A l ,0)max(G l+1 ,0) Among them, A k represents the feature map of the kth channel, Y c represents the confidence of the correct category c, Indicates the importance of the gradient value of any feature map to the confidence of the correct category c, Indicates that any feature map for Y c The weight of I G Represents the first sensitive semantic domain, L S represents the second sensitive semantic domain, I(i,j) represents each pixel point included in the target image, G l Represents the corrected gradient of the lth convolutional layer, L B Represents the third sensitive semantic domain, A l Represents the feature map of the lth convolutional layer, A 1 Represents the feature map of the first convolutional layer.

5. The method according to claim 1, wherein The key semantic fusion domains are as follows: L C ={(i,j)∈(P G ∪P S ∪P B )} Among them, P G represents the first key semantic pixel set, P G ={(i,j)∈(L G ≥τ G )},P S represents the second key semantic pixel set, P S ={(i,j)∈(L S ≥τ S )},P B represents the third key semantic pixel set, P B ={(i,j)∈(L B ≥τ B )};L C represents the key semantic fusion domain, L G Represents the first sensitive semantic domain, L S Represents the second sensitive semantic domain, L B represents the third sensitive semantic domain, τ G represents the first key semantic threshold, τ S represents the second key semantic threshold, τ B represents the third key semantic threshold; Before determining the first key semantic pixel point set of the first sensitive semantic domain according to the first key semantic threshold, determining the second key semantic pixel point set of the second sensitive semantic domain according to the second key semantic threshold, and determining the third key semantic pixel point set of the third sensitive semantic domain according to the third key semantic threshold, the method further includes: Sort each pixel included in the first sensitive semantic domain, the second sensitive semantic domain, and the third sensitive semantic domain according to the order of semantic sensitivity from large to small to obtain key semantic pixels; The first key semantic threshold of the first sensitive semantic domain, the second key semantic threshold of the second sensitive semantic domain, and the third key semantic threshold of the third sensitive semantic domain are respectively obtained according to the key semantic pixel points.

6. The method according to claim 1, wherein The contaminated adversarial examples are as follows: I′=I+ΔI The identification categories of the contaminated adversarial samples are as follows: z=argmax Y′ Among them, I′ represents the contaminated adversarial sample, ΔI represents the adversarial perturbation corresponding to the target image, I represents the target image, z represents the recognition category of the contaminated adversarial sample, and Y′ represents the classification result of the contaminated adversarial sample obtained by the deep convolutional neural network.

7. A device for generating adversarial samples, characterized in that: include: A first obtaining unit is configured to obtain a correct category of the target image through a deep convolutional neural network, and determine a first sensitive semantic domain, a second sensitive semantic domain, and a third sensitive semantic domain corresponding to the correct category based on a generalized class activation map method, a saliency map method, and a modified backpropagation method; a determining unit, configured to determine a first key semantic pixel point set of the first sensitive semantic domain according to a first key semantic threshold, determine a second key semantic pixel point set of the second sensitive semantic domain according to a second key semantic threshold, and determine a third key semantic pixel point set of the third sensitive semantic domain according to a third key semantic threshold; The second obtaining unit is configured to determine a key semantic fusion domain corresponding to the first key semantic pixel point set, the second key semantic pixel point set, and the third key semantic pixel point set according to the union fusion of the coarse-fine granularity key semantic pixel points; a third obtaining unit, configured to obtain a mask matrix of the key semantic fusion domain by binarization, obtain an adversarial perturbation of the target image corresponding to the mask matrix by a Hadamard product, obtain a contaminated adversarial sample according to the adversarial perturbation and the target image, and determine an identification category of the contaminated adversarial sample by a deep convolutional neural network; The fourth obtaining unit is used to obtain an adversarial attack optimization model based on the relationship between the identification category of the contaminated adversarial sample, the correct category, and the specified attack category, and obtain the optimal adversarial sample of the adversarial attack optimization model according to the Adam gradient descent algorithm.

8. The device according to claim 7, wherein The fourth obtaining unit is specifically used for: The adversarial attack optimization model includes an untargeted adversarial attack optimization model and a targeted adversarial attack optimization model; If the identification category of the contaminated adversarial sample is different from the correct category, it is called the first type of adversarial sample, and an untargeted adversarial attack is determined. The optimization model of the untargeted adversarial attack is as follows: If the identification category of the contaminated adversarial sample is the same as the specified attack category, it is called the second-class adversarial sample, and a targeted adversarial attack is determined. The targeted adversarial attack optimization model is as follows: Among them, ΔI 1 represents the first type of adversarial perturbation generated by untargeted adversarial attack, represents the confidence value corresponding to the correct category in the recognition result of the first type of adversarial sample, Y z 1 represents the confidence value corresponding to any category in the recognition results of the first type of adversarial samples, λ 1 represents the weight parameter required to generate the first type of adversarial perturbation, ||ΔI 1 ||0 represents the l0 norm metric, c represents the correct category; ΔI 2 represents the second type of adversarial perturbation generated by targeted adversarial attacks, represents the confidence value corresponding to any category in the recognition results of the second type of adversarial samples, t represents the specified attack category, represents the confidence value corresponding to the attack category t specified in the recognition result of the second type of adversarial sample, λ 2 represents the weight parameter required to generate the second type of adversarial perturbation, ||ΔI 2 ||0 represents the l0 norm metric, and z represents the identification category of the contaminated adversarial sample.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the adversarial sample generation method according to any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that A computer program is stored, and when the computer program is executed by a processor, the processor executes the adversarial sample generation method according to any one of claims 1 to 6.

Images