Methods and apparatus for generating adversarial examples based on empirical knowledge

Abstract

This invention discloses an adversarial example generation method based on empirical knowledge. It primarily utilizes empirical knowledge to extract high-performing features as auxiliary information for generating adversarial examples, thereby improving the universality and transferability of the adversarial examples, enabling attacks on different models performing the same task. Taking target image recognition models M1 and M2 as an example, the invention first constructs target image recognition models M1 and M2 using a training set, ensuring accuracy. The second step uses a feature extraction operator designed based on empirical knowledge to extract image features from test set samples x. The third step calculates the perturbation value r for model M1 using a gradient-based adversarial example generation algorithm. The fourth step combines the extracted image features and the calculated perturbation value r to obtain the key local perturbation value ri. x Generate adversarial samples x based on the judgment conditions for generating adversarial samples. adv The fifth step involves attacking M2 using the generated adversarial sample. This invention also provides a corresponding adversarial sample generation device based on empirical knowledge.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, and more specifically, relates to a method and apparatus for generating adversarial examples based on empirical knowledge. Background Technology

[0002] Artificial intelligence (AI) technologies, represented by deep learning, have made significant progress in computer vision, speech recognition, and natural language processing, and have been widely researched and applied in both civilian and military fields, including autonomous driving, finance, smart homes, and national defense. However, due to the vulnerability of AI technologies in complex environments, particularly in their models, algorithms, and data, they have had certain impacts on social stability, national defense, finance, and politics. Adversarial examples are currently a key technique for attacking AI models. By adding imperceptible interference to the original samples, they cause the AI ​​model to output incorrect results. The following formula defines this:

[0003] f(x * )≠f(x)||x * -x|| p ≤ε

[0004] Where, x * Let ||x| represent the sample containing interfering information, and x represent the original sample. * -x|| p ≤ε indicates the addition of a certain range of interference information.

[0005] Adversarial examples are crucial data for studying the robustness of artificial intelligence technologies. Currently, there is considerable research on them, including gradient-based algorithms such as FGSM, JSMA, and PGD; optimization-based algorithms such as CW and ZOO; and adversarial generative networks such as adversarial GANs. Because various adversarial example generation methods calculate adversarial examples based on the basic information of the model during attacks, they are highly effective against that model, but may have lower effectiveness or no attack capability against other models performing the same task.

[0006] Deep neural network models can automatically learn highly discriminative features through convolutional networks, but they often also learn some unimportant features, causing the model to locally collapse onto some poorly defined features. Since adversarial examples are generated using basic information such as the parameters learned by the model, noise generated using gradient-based algorithms such as FGSM and JSMA may also collapse onto unimportant features, resulting in adversarial examples that lack generality and transferability. Summary of the Invention

[0007] In view of the above-mentioned defects or improvement needs of the existing technology, the purpose of this invention is to provide an adversarial example generation method based on empirical knowledge, which solves the problems of poor universality and low transferability of adversarial examples, and their inability to effectively attack artificial intelligence models of the same type of task.

[0008] To achieve the above objectives, according to one aspect of the present invention, a method for generating adversarial examples based on empirical knowledge is provided, comprising the following steps:

[0009] (1) Constructing target image recognition models: Construct target image recognition models M1 and M2 using the training dataset;

[0010] (2) Extracting image features: Based on the category and texture of the original image sample, classic feature extraction operators are used to obtain the edge, corner, region and contour features of the image;

[0011] (3) Calculate the global perturbation: Use a gradient-based adversarial sample generation algorithm on model M1 to backpropagate and calculate the global perturbation value r of the image;

[0012] (4) Obtain adversarial examples of the target image:

[0013] (5) Attacking the target image recognition model: using generated image adversarial examples x adv The input is fed into the target image recognition model M2, and the model is attacked.

[0014] In one embodiment of the present invention, step (4) specifically includes the following sub-steps:

[0015] (4.1) Based on the extracted image features and the global perturbation value r, the intersection of the corresponding positions of the image features and the global perturbation r is taken to obtain the perturbation r of the important region. x ;

[0016] (4.2) If the disturbance value r of the important area x If the value is greater than the threshold ε, the generation of adversarial examples fails.

[0017] (4.3) If the number of iterations is greater than the set number t, the generation of adversarial examples will fail;

[0018] (4.4) If both of the above conditions are met, add the perturbation of the important region to the corresponding position of the original image sample;

[0019] (4.5) If the adversarial sample and the original sample are classified in the target image recognition classification model, then proceed to (3); otherwise, generate an image adversarial sample x. adv .

[0020] In one embodiment of the present invention, step (1) of constructing the target image recognition model specifically includes:

[0021] (1.1) By collecting image data of maritime targets, a sample dataset T is obtained, and the sample dataset T is divided into an independent training set T1 and a test set T2 in a 7:3 ratio; satisfying T1∩T2=φ, T1∪T2=T;

[0022] (1.2) Construct a target image recognition model according to the task, use the training set T1 for optimization training, and use the test set T2 for testing; construct target image recognition models M1 and M2 with good classification performance.

[0023] In one embodiment of the present invention, the Laplacian operator is used to extract image features in step (2).

[0024] In one embodiment of the present invention, step (2) of extracting image features specifically includes:

[0025] (2.1) Based on the characteristics of the original sample x, the eight-neighborhood of the Laplacian operator, which has a better effect on extracting image features, is selected. The operator template is as follows:

[0026]

[0027] (2.2) The original sample x is linearly filtered using the Laplacian operator. For each pixel value in the image, the sum of the products of its neighboring pixels and the corresponding elements of the filter matrix is ​​calculated to obtain the feature that expresses the edge and contour features of the image:

[0028]

[0029] Wherein, the filter matrix is ​​the Laplacian operator w, m,n represent the length and width of the image, z(s,t) represents the pixel value of the image sample x, w is the filter matrix, and the filter center coefficient w(0,0) is aligned with the pixel at position (s,t).

[0030] In one embodiment of the present invention, step (3) of calculating the perturbation of the global region specifically includes:

[0031] (3.1) Calculate the perturbation value using the gradient-based adversarial sample generation technique I-FGSM, and set the initialization parameters, including the perturbation threshold ε and the maximum number of iterations t;

[0032] (3.2) Input the original sample x into the target image recognition and classification model M1, and calculate the sample perturbation value according to the back gradient principle;

[0033]

[0034] Where r represents the generated sample perturbation value, J represents the loss function, α represents the value in the neighborhood of the threshold ε, and sign represents the sign.

[0035] In one embodiment of the present invention, the calculation method of step (4.1) specifically includes:

[0036] By combining the feature with the perturbation r, and multiplying them at corresponding positions, we obtain the perturbation values ​​at the positions corresponding to important features, thus obtaining the local perturbation r. x The formula is as follows: in This indicates that corresponding positions of two matrices are multiplied.

[0037] In one embodiment of the present invention, step (4.4) of adding perturbation to the important region at the position corresponding to the original image sample specifically includes: adding perturbation r x Add to the original sample x, update and generate sample x, using the following formula: x = Clip(x + r) x ), where Clip means cropping.

[0038] In one embodiment of the present invention, the range of the cropped pixel values ​​is 0 to 255.

[0039] According to another aspect of the present invention, an adversarial sample generation apparatus based on empirical knowledge is also provided, including at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, and the memory stores instructions executable by the at least one processor, wherein the instructions, after being executed by the processor, are used to complete the adversarial sample generation method based on empirical knowledge.

[0040] Overall, the technical solutions conceived in this invention have the following advantages compared with existing technologies: First, global perturbation is calculated based on the original samples and gradient-based adversarial sample generation methods; second, high-performing features are extracted from the data using human experience knowledge; then, the intersection of the global perturbation and high-performing features is calculated to generate adversarial samples with experience knowledge, thereby improving the success rate of adversarial sample attacks on similar task models. Attached Figure Description

[0041] Figure 1 This is a flowchart illustrating the adversarial sample generation method based on empirical knowledge in an embodiment of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0043] This invention belongs to the field of adversarial attacks on artificial intelligence. In view of the shortcomings of current adversarial examples, such as poor universality and low transferability, which makes them unable to effectively attack artificial intelligence models, this invention proposes an adversarial example generation method based on empirical knowledge. It mainly uses empirical knowledge to extract high-performing features as auxiliary information for generating adversarial examples, thereby improving the universality and transferability of adversarial examples and increasing the success rate of attacking artificial intelligence models.

[0044] There are many types of empirical knowledge applied to deep learning, the most common of which include pretrained models, CAM graph activation constraints, and assisted learning. In the image domain, various image feature extraction operators designed based on empirical knowledge are mainly used to extract important features such as image edges and contours, including Laplacian, Robert, Prewitt, and Sobel.

[0045] This invention proposes an adversarial example generation method based on empirical knowledge. It mainly utilizes empirical knowledge to extract high-performing features as auxiliary information for generating adversarial examples, thereby improving the universality and transferability of adversarial examples and enabling them to attack different models on the same task.

[0046] This invention uses target image recognition models M1 and M2 as implementation examples. The first step involves constructing target image recognition models M1 and M2 using a training set, ensuring they meet accuracy requirements. The second step uses a feature extraction operator designed with empirical knowledge to extract image features based on test set samples x. The third step calculates the perturbation value r for model M1 using a gradient-based adversarial example generation algorithm. The fourth step combines the extracted image features and the calculated perturbation value r to obtain the key local perturbation value r0. x Generate adversarial samples x based on the judgment conditions for generating adversarial samples. adv The fifth step is to use the generated adversarial sample to attack M2. The specific process is as follows: Figure 1 As shown.

[0047] To achieve the above objectives, the present invention employs the following technical solution, comprising the following steps:

[0048] (1) Construct target image recognition models: Use the training dataset to construct target image recognition models M1 and M2.

[0049] (2) Extracting image features: Based on the category and texture of the original image sample, classic feature extraction operators are used to obtain features such as the edge, corner, region, and contour of the image.

[0050] (3) Calculate the global perturbation: Use a gradient-based adversarial sample generation algorithm on model M1 to backpropagate and calculate the global perturbation value r of the image.

[0051] (4) Obtain adversarial examples of the target image:

[0052] (4.1) Based on the extracted image features and the global perturbation value r, the intersection of the corresponding positions of the image features and the global perturbation r is taken to obtain the perturbation r of the important region. x .

[0053] (4.2) If the disturbance value r of the important area x If the value is greater than the threshold ε, the generation of adversarial examples fails.

[0054] (4.3) If the number of iterations is greater than the set number t, the generation of adversarial examples will fail;

[0055] (4.4) If both of the above conditions are met, add the perturbation of the important region to the corresponding position of the original image sample;

[0056] (4.5) If the adversarial sample and the original sample are classified in the target image recognition classification model, then proceed to (3); otherwise, generate an image adversarial sample x. adv .

[0057] (5) Attacking the target image recognition model: using generated image adversarial examples x adv The input is fed into the target image recognition model M2, and the model is attacked.

[0058] The method of the present invention is described below with reference to a specific embodiment:

[0059] (1) Constructing a target image recognition model

[0060] (1.1) By collecting image data of maritime targets, a sample dataset T is obtained, and the sample dataset T is divided into an independent training set T1 and a test set T2 in a 7:3 ratio. The conditions T1∩T2=φ and T1∪T2=T are met.

[0061] (1.2) Construct a target image recognition model according to the task, optimize and train it using the training set T1, and test it using the test set T2. Construct target image recognition models M1 and M2 with good classification performance. Good classification performance means that the classification accuracy exceeds the preset value.

[0062] (2) Extracting image features

[0063] (2.1) Based on the characteristics of the original sample x, select an operator with good image feature extraction performance. This example uses the Laplacian operator's eight-neighbor domain as an example. The operator template is as follows:

[0064]

[0065] (2.2) The original sample x is linearly filtered using the Laplacian operator. For each pixel value of the image, the sum of the products of its neighboring pixels and the corresponding elements of the filter matrix (Laplacian operator w) is calculated to obtain the feature that expresses the image edge, contour and other features.

[0066]

[0067] Where m and n represent the length and width of the image, z(s,t) represents the pixel value of image sample x, w is the filter matrix, and the center coefficient w(0,0) of the filter is aligned with the pixel at position (s,t).

[0068] (3) Calculate the disturbance in the global region

[0069] (3.1) The perturbation value is calculated using the gradient-based adversarial sample generation technique I-FGSM, and the initialization parameters are set, including the perturbation threshold ε and the maximum number of iterations t.

[0070] (3.2) Input the original sample x into the target image recognition and classification model M1, and calculate the sample perturbation value according to the back gradient principle.

[0071]

[0072] Where r represents the generated sample perturbation value, J represents the loss function, α represents the value in the neighborhood of the threshold ε, and sign represents the sign.

[0073] (4) Calculate the disturbance in important areas

[0074] (4.1) Combine the feature with the perturbation r, multiply the corresponding positions to obtain the corresponding values, obtain the perturbation values ​​at the positions corresponding to the important features, and obtain the local perturbation r. x The formula is as follows.

[0075]

[0076] in, This indicates that corresponding positions of two matrices are multiplied.

[0077] (4.2) Determine the disturbance r xIf the perturbation is greater than the threshold ε, then the adversarial sample generation fails; otherwise, proceed to (4.3).

[0078] (4.3) Determine if the number of iterations is greater than the maximum value t. If the number of iterations is greater than t, the adversarial sample generation fails; otherwise, go to (4.4).

[0079] (4.4) The disturbance r x Add to the original sample x, update and generate sample x, as shown in the following formula.

[0080] x = Clip(x + r) x )

[0081] Clip indicates cropping, with pixel values ​​ranging from 0 to 255.

[0082] (4.5) Determine whether sample x is an adversarial sample. Input sample x into the target image recognition and classification model M1. If the predicted value is not equal to the label f1(x), then the adversarial sample x is obtained. adv =x; otherwise, adversarial sample generation fails, go to (3).

[0083] (5) Attacking the target image recognition model: using generated image adversarial examples x adv Input the target image recognition model M2, attack the model, and output the result.

[0084] Furthermore, the present invention also provides an adversarial example generation apparatus based on empirical knowledge, including at least one processor and a memory, wherein the at least one processor and the memory are connected via a data bus, and the memory stores instructions that can be executed by the at least one processor, wherein the instructions, after being executed by the processor, are used to complete the adversarial example generation method based on empirical knowledge.

[0085] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples based on empirical knowledge, characterized in that, Includes the following steps: (1) Constructing a target image recognition model: Constructing a target image recognition model using the training dataset. ; (2) Extracting image features: Based on the category and texture of the original image sample, classic feature extraction operators are used to obtain the edge, corner, region and contour features of the image; (3) Calculate the perturbation in the global region: for the model A gradient-based adversarial example generation algorithm is used to calculate the global perturbation value of the image through backpropagation. ; Step (3) specifically includes calculating the global disturbance: (3.1) Calculate the perturbation value using the gradient-based adversarial example generation technique I-FGSM, and set the initialization parameters, including the perturbation threshold. Maximum number of iterations ; (3.2) Input the original sample To target image recognition and classification model The sample perturbation value is calculated based on the inverse gradient principle; in, This represents the generated sample perturbation value. Represents the loss function. Indicates at the threshold The values ​​in the neighborhood of , Symbols; (4) Obtaining adversarial examples of the target image: Step (4) specifically includes the following sub-steps: (4.1) Based on the extracted image features and the global perturbation value r, take the image features and the global perturbation value r. The intersection of corresponding positions yields the perturbation of the important region. ; (4.2) If the disturbance value of the important area If the value is greater than the threshold ε, the generation of adversarial examples fails. (4.3) If the number of iterations is greater than the set number If so, the generation of adversarial examples will fail; (4.4) If both of the above conditions are met, add the perturbation of the important region to the corresponding position of the original image sample; (4.5) If the adversarial sample and the original sample are classified in the target image recognition classification model, then proceed to (3); otherwise, generate an image adversarial sample. ; (5) Attack the target image recognition model: Use generated image adversarial examples Input to target image recognition model To attack the model.

2. The adversarial example generation method based on empirical knowledge as described in claim 1, characterized in that, The step (1) of constructing the target image recognition model specifically includes: (1.1) A sample dataset was obtained by collecting image data of maritime targets. and the sample dataset according to The proportion is divided into independent training sets. and test set ;satisfy , ; (1.2) Construct a target image recognition model based on the task, using the training set. Optimize training and test set Conduct testing; build a target image recognition model with good classification performance. .

3. The adversarial example generation method based on empirical knowledge as described in claim 1, characterized in that, In step (2), the Laplacian operator is used to extract image features.

4. The adversarial example generation method based on empirical knowledge as described in claim 3, characterized in that, Step (2) of extracting image features specifically includes: (2.1) Based on the original sample Based on the characteristics of [the algorithm], the eight-neighborhood operator of the Laplacian operator, which has a better effect on extracting image features, is selected. The operator template is as follows: (2.2) Linear filtering of the original samples using the Laplacian operator For each pixel value in the image, the sum of the products of its neighboring pixels and the corresponding elements of the filter matrix is ​​calculated to obtain the feature that expresses the image's edges and contours. Wherein, the filter matrix is ​​a Laplacian operator. , Indicates the length and width of the image. Represents image samples pixel values, Let be the filter matrix, and let the filter center coefficients be... Alignment position is Pixels.

5. The adversarial example generation method based on empirical knowledge as described in claim 1, characterized in that, The calculation method for step (4.1) specifically includes: Will and By combining perturbations and multiplying them at corresponding positions, the perturbation values ​​at the locations of important features are obtained, thus acquiring the local perturbation. The formula is as follows: ,in This indicates that corresponding positions of two matrices are multiplied.

6. The adversarial example generation method based on empirical knowledge as described in claim 1, characterized in that, The step (4.4) of adding perturbations to important regions at the corresponding positions in the original image samples specifically includes: adding perturbations... Add to original sample Update and generate samples The formula is as follows: ,in It indicates cutting.

7. The adversarial example generation method based on empirical knowledge as described in claim 6, characterized in that, The range of pixel values ​​to be cropped is 0 to 255.

8. An adversarial example generation device based on empirical knowledge, characterized in that, It includes at least one processor and a memory, which are connected via a data bus. The memory stores instructions that can be executed by the at least one processor. After being executed by the processor, the instructions are used to complete the adversarial sample generation method based on empirical knowledge as described in any one of claims 1-7.

Images