Feature distribution-aware adversarial sample generation method in image classification scenarios

Abstract

The present invention discloses a method for generating adversarial samples based on feature distribution perception in image classification scenarios, comprising the following steps: obtaining an original image, a feature carrier image with a large number of repeated geometric figures, and a neural network model to be attacked; obtaining a saliency map of the original image; dividing the saliency map into salient regions and background regions; extracting the salient regions from the original image and inputting them into the neural network model to be attacked to calculate a feature weight map and an aggregated feature map; calculating feature loss based on the feature weight map and the aggregated feature map, and destroying feature information in the salient image to obtain a first noise image; adding geometric interference features to the original image using the feature carrier image to obtain a second noise image; removing the region corresponding to the salient image from the second noise image to obtain a third noise image; and splicing the first and third noise images to obtain adversarial samples. The present invention can effectively improve the performance under common adversarial training models.

Description

Technical Field

[0001] The present invention relates to the technical field of computer vision and AI security, and in particular to a method for generating adversarial samples based on feature distribution perception in image classification scenarios. Background Art

[0002] With the rapid development of deep learning, applications related to deep learning are constantly penetrating into various fields of people's lives.

[0003] When we talk about image classification technology, we generally refer to a class of advanced computer vision methods whose goal is to enable computers to automatically recognize and classify input images. Neural networks have achieved remarkable success in this field, and the rise of deep learning technology, in particular, has brought about a qualitative leap in image classification. At the core of image classification technology are deep convolutional neural networks (CNNs), a neural network architecture specifically designed to process image data. CNNs have a hierarchical structure that learns features in images through multiple convolutional and pooling layers. These feature extraction layers enable neural networks to automatically learn and capture complex patterns and relationships in images, thereby improving the accuracy of image classification.

[0004] However, research has shown that deep neural networks are vulnerable to adversarial attacks, where even small but malicious perturbations can cause them to produce severely erroneous outputs. Adversarial examples are a technique used to trick machine learning models by making subtle but purposeful modifications to input data. The development of this technique has sparked widespread concern about model robustness and security. The creation of adversarial examples typically involves carefully crafted, tiny perturbations to the original data that are barely perceptible to humans but sufficient to cause the model to misclassify. The emergence of adversarial examples has severely limited the application of deep learning in safety-critical applications.

[0005] However, existing adversarial generation methods often use a consistent attack method for the entire image, while ignoring the fact that the distribution of key features related to image categories is inconsistent, that is, key features related to categories are often concentrated in the salient areas of the image, while the background area contains a small number of key features. In response to this characteristic of the image, an adversarial sample generation technology is designed that uses different adversarial attack methods in different areas of the image, that is, to destroy the key features of the image in the salient areas, and to try to insert interference features in the background area. At the same time, previous adversarial sample generation methods based on feature loss often ignore the presence of a large number of noise features in the feature map, which can easily mislead the feature destruction algorithm to interfere with the wrong features. For this scenario, an aggregated feature map method is designed. This method achieves the purpose of suppressing noise features by fusing multiple feature maps, thereby effectively improving the effect of the feature destruction algorithm and generating more transferable adversarial samples. Summary of the Invention

[0006] The purpose of the present invention is to overcome the shortcomings and disadvantages of the existing technology and provide an adversarial sample generation method based on feature distribution perception in image classification scenarios. It attacks the image by applying different forms of perturbation information based on feature distribution, which can effectively improve the effect under common adversarial training models.

[0007] To achieve the above objectives, the present invention provides a technical solution: a method for generating adversarial samples based on feature distribution perception in an image classification scenario, comprising the following steps:

[0008] S1. Obtain the original image, the feature carrier image with a large number of repeated geometric figures, and the neural network model to be attacked;

[0009] S2. Applying a saliency map segmentation method to the original image to obtain a saliency map of the original image, and dividing the saliency map into a salient area and a background area according to a preset threshold;

[0010] S3. Extract the salient region from the original image according to the salient region extraction method as the salient image, and input it into the neural network model to be attacked to calculate the feature weight map and the aggregated feature map;

[0011] S4, calculating feature loss based on the feature weight map and the aggregated feature map obtained in step S3, and destroying feature information in the salient image to obtain a first noise image;

[0012] S5. Adding geometric interference features to the original image using the feature carrier image to obtain a second noise image. Based on the salient image obtained in step S3, removing the region corresponding to the salient image in the second noise image from the image to obtain a third noise image.

[0013] S6. Concatenate the first noise image and the third noise image to obtain an adversarial sample.

[0014] Furthermore, in step S1, the original image is any image given by the user, which is used to produce the final adversarial sample; the feature carrier image is a special image with a large number of repeated geometric figures, which is used to add interfering geometric features to the original image; the neural network model to be attacked refers to any pre-trained neural network model, which is used to extract the feature weight map and aggregated feature map of the original image, and perform feature destruction to produce the adversarial sample.

[0015] Furthermore, in step S2, the saliency map division method is specifically to obtain the saliency map through an image processing mechanism to identify the key areas and non-key areas of the image;

[0016] Based on the obtained saliency map cam, the following formula is used to distinguish the salient area from the background area:

[0017]

[0018] Where threshold is the parameter used for region segmentation, cam is the saliency map of image processing; S map Is a partition matrix used to divide the salient area and background area of ​​the image. For S map The element value of 1 is used to mark the salient area, while the element value of 0 is used to mark the background area. [i, j] represents the pixel in the i-th row and j-th column of the image; the salient map cam and the partition matrix S map They are all the same size as the original images.

[0019] Furthermore, in step S3, the salient regions of the original image are extracted into an independent image as a salient image using a salient region extraction method. Feature destruction is performed on the salient image with rich category features to prevent the neural network model from relying on the key features of the salient image to make correct decisions.

[0020] The salient region extraction method can be described by the following formula:

[0021] x s =Salieny(Rectangle(S map ),x) (2)

[0022] Where S map represents the partition matrix; x s Represents the salient image extracted from the original image; x represents the original image; Rectangle() represents obtaining the rectangular area that encloses the minimum salient area. The purpose of the Salieny() function is to extract the rectangular area obtained by the Rectangle() function from the original image x;

[0023] The salient image x s Input into the neural network model to be attacked, and calculate the feature weight map and aggregate feature map;

[0024] The feature weight graph is used to measure the importance of each feature value in the aggregate feature graph and can be described by the following formula:

[0025]

[0026] Where, IA y represents the feature weight map of the yth layer of the neural network model to be attacked; n represents the number of calculations; f() represents the neural network model to be attacked; f y() represents the feature map of the yth layer of the neural network model to be attacked; x' represents the reference image in the attribution algorithm, which is set to an image with all zero pixel values ​​and the same size as the original image;

[0027] The purpose of the aggregated feature map is to alleviate the interference of noise features in the feature map and highlight the key features related to the category in the feature map. Its generation formula can be described by the following formula:

[0028]

[0029] Where D k (x s ) represents the result of data enhancement for the salient image for the kth time; f y (D k (x s )) means passing through D k (x s ) obtained; m represents the number of polymerizations required; AFM(x s ) represents the salient image x s Aggregate feature map of .

[0030] Furthermore, in step S4, the calculation of feature loss can be described by the following formula:

[0031] A y ((x s ,x'))=[AFM(x s )-f y (x')]*IA y (5)

[0032] In the formula, (x s ,x') represents the transition from the reference image x' to the salient image x s Path; A y ((x s ,x')) represents the path (x s ,x') aggregate feature loss at the yth layer of the neural network model to be attacked; IA y Represents the feature weight map; AFM(x s ) represents the aggregate feature map; f y (x') represents the feature map of the neural network model to be attacked for the reference image x' at the yth layer; s represents the salient image extracted from the original image, x' represents the reference image in the attribution algorithm, and the reference image is set to an image with all pixel values ​​​​zero and the same size as the original image;

[0033] The purpose of destroying the feature information in the image is to destroy the key features in the salient image, thereby increasing the distance in the feature space;

[0034] The specific process of destroying the feature information in the image is: based on the calculated feature loss, the gradient information of the corresponding input is calculated through backpropagation, and then the gradient information is added to the corresponding input to form a new input; the above process is repeated multiple times;

[0035] Characteristic destruction can be described by the following formula:

[0036]

[0037] Where, Represents a salient image x s The result of the tth iteration, where the result of the initial iteration sign() represents the direction function, the positive output is 1 and the negative output is 0; Indicates that according to the feature loss A y ((x s ,x')) to calculate the gradient information;

[0038] According to the above formula (6) after T iterations, the output The first noise image Where T is the specified number of iterations.

[0039] Furthermore, in step S5, the geometric interference features are added to extract the high-frequency features of the feature carrier image and add the extracted high-frequency features to the original image, thereby interfering with the image to make a correct decision, which can be described by the following formula:

[0040]

[0041] Where G represents a filter, which is used to extract high-frequency features of the feature carrier image; x p Represents the feature carrier image; x hit represents the second noise image; The function constrains the input to be within the range [x-ε,x+ε]; ε represents the preset maximum perturbation threshold; x represents the original image;

[0042] The area corresponding to the salient image in the second noise image is removed from the original image to avoid misalignment in subsequent stitching, which can be described by the following formula:

[0043]

[0044] Where, represents the third noise image, S map Represents the partition matrix, Rectangle() represents the rectangular area of ​​the minimum enclosing salient area; finally, by multiplying (1-Rectangle(S map)) to remove the area corresponding to the salient image.

[0045] Furthermore, in step S6, the purpose of stitching is to merge the second noise image with the third noise image to achieve the purpose of performing feature destruction in the salient area and performing feature insertion in the background area, which can be described by the following formula:

[0046]

[0047] Where, represents the first noise image; represents the third noise image; x adv is the final generated adversarial sample; resize() is to restore to the size of the corresponding area of ​​the salient image; concat() is to place the restored salient image in corresponding area.

[0048] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0049] 1. A method of aggregating feature maps is proposed, which can effectively suppress the noise features in the feature maps, thereby more accurately calculating the feature loss function and obtaining more effective interference directions, ultimately improving the performance of adversarial attacks.

[0050] 2. A method is proposed that adopts different attack paradigms according to the different distribution of key features of the image. This method uses a feature destruction attack method in the salient areas of the image with rich features, and an interference feature insertion attack method in the background area, thereby making full use of the inconsistent distribution of image features to effectively improve the attack performance.

[0051] 3. Through a large amount of data verification, compared with the current mainstream adversarial sample generation method, the adversarial samples generated by this invention have an average improvement of 12.65% in attacking normal training models under black box test conditions, and an average improvement of 11.7% in attacking adversarial training models, and have improved most adversarial defense strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Schematic diagram of the process of the present invention.

[0053] Figure 2 Schematic diagram of the feature destruction process.

[0054] Figure 3 Flowchart inserted for the feature.

[0055] Figure 4 Schematic diagram of the process of region removal.

[0056] Figure 5Schematic diagram of the image stitching process.

[0057] Figure 6 It is a specific implementation flow chart of the present invention.

[0058] Figure 7 It is a schematic diagram of a specific implementation scenario of the present invention. DETAILED DESCRIPTION

[0059] The present invention will be further described below with reference to specific embodiments.

[0060] like Figure 1 As shown, this embodiment provides a method for generating adversarial samples based on feature distribution perception in an image classification scenario, including the following steps:

[0061] S1. Obtain the original image, the feature carrier image with a large number of repeated geometric figures, and the neural network model to be attacked.

[0062] Specifically, the dataset used in this experiment is the ImageNet-compatible dataset. This dataset contains 1,000 images that can be correctly classified by most neural networks. The default image size is 299*299*3 RGB images.

[0063] The neural network models used in this implementation example include three categories:

[0064] Normal training models: Inception_v3, Inception_v4, Inception-ResNet_V2, Vgg16, Vgg19, ResNet_152.

[0065] Adversarial training models: Inc-v3adv, IncRes-v2adv, Inc-v3ens3, Inc-v3ens4, IncRes-v2ens.

[0066] Adversarial defense strategies: NPR (Neural Representation Purification), RS (RandomSmooth), HGD (High-level Representation Guided Denoiser), R&P (Random Resizing and Random Padding), ComDefend (Compression Model to Defend), FD (FeatureDistillation), DiffPure (Diffusion Models for Adversarial Purification)

[0067] In this implementation example, the neural network model to be attacked is the Inception_v3 model.

[0068] S2. Obtain a saliency map, and extract salient regions according to a salient region extraction method as a salient image.

[0069] In order to distinguish the salient areas from the background areas of the original image, it is necessary to generate a saliency map corresponding to the original image. A variety of image processing mechanisms can be used to generate saliency maps. In this implementation example, a Class Activation Mapping (CAM) is specifically used to generate the saliency map of the original image. The salient areas and background areas are divided using the following formula:

[0070]

[0071] Wherein, threshold is a parameter used for region segmentation, and in this embodiment, 40 is selected; cam is a saliency map of image processing; S map Is a partition matrix used to divide the salient area and background area of ​​the image. For S map The element value of 1 is used to mark the salient area, while the element value of 0 is used to mark the background area. [i, j] represents the pixel in the i-th row and j-th column of the image. map They are all the same size as the original images.

[0072] Because the salient region contains a large amount of feature information, the feature information of this region can be destroyed. However, the background region has less feature information, so it is necessary to insert interference features to further interfere.

[0073] The salient region extraction method in this embodiment is the smallest rectangular region that encloses the salient region. The rectangular region is extracted as a separate image and resized to 299*299*3 RGB format as the salient image x s At the same time, the salient image is used as the input image for the next step. The salient region extraction method can be described by the following formula:

[0074] x s =Salieny(Rectangle(S map ),x)

[0075] Where S map represents the partition matrix; x sRepresents the salient image extracted from the original image; x represents the original image; Rectangle() represents obtaining the rectangular area that contains the minimum salient area. The purpose of the Salieny() function is to extract the rectangular area obtained by the Rectangle() function from the original image x.

[0076] S3. Obtain the aggregated feature map and feature weight map of the salient image and calculate the feature loss.

[0077] like Figure 2 As shown in the figure, the calculation of the feature loss function mainly includes two paths: the left side shows the generation of the aggregated feature map, and the right side shows the generation of the feature weight map. Finally, the two are multiplied together to form the feature loss function.

[0078] First, we introduce the generation process of the aggregated feature map. The aggregated feature map is used to suppress the noise features in the original feature map and retain the key features in the feature map. The aggregated feature map can be described by the following formula:

[0079]

[0080] Among them, x s represents the salient image extracted from the original image, f y () represents the feature map of the yth layer of the neural network model to be attacked; f y (D k (x s )) means passing through D k (x s ) obtained; m represents the number of polymerization times required, and in this embodiment, m selects 9 times of polymerization; AFM(x s ) represents the salient image x s Aggregate feature map of x s Represents the salient image extracted from the original image; the y layer specifically selects the Mixed_5b / concat layer of the inception_v3 model; D k (x s ) represents the result of data enhancement for the kth salient image, specifically using self-mixup. Self-mixup can be described by the following formula:

[0081] x mix =(1-λ)*x+λ*T(x)

[0082] Where λ represents the blending factor and T(x) represents the random translation of the image. In this implementation example, λ is set to 0.6, and T(x) is the random translation range of [-10, 10] pixels.

[0083] Next, we will introduce the implementation of the feature weight map. The feature weight map is mainly used to measure the importance of each weight in the feature map, and is usually generated based on gradient information or feature attribution algorithms. In this implementation example, the feature attribution algorithm is used:

[0084]

[0085] Among them, IA y The feature weight map of the yth layer of the neural network model to be attacked; n represents the number of calculations, which is specifically 30; f() represents the neural network model to be attacked, which is the inception_v3 model; the y layer specifically selects the Mixed_5b / concat layer of the inception_v3 model; f y () represents the feature map of the yth layer of the neural network model to be attacked; x' represents the reference image in the attribution algorithm, specifically a completely black image with all RGB channels set to 0; x s represents the salient image extracted from the original image; represents the differential operator.

[0086] The feature loss calculation method can be described by the following formula:

[0087] A y ((x s ,x'))=[AFM(x s )-f y (x')]*IA y

[0088] Among them, (x s ,x') represents the transition from the reference image x' to the salient image x s Path; A y ((x s ,x')) represents the path (x s ,x') aggregate feature loss at layer y; IA y Represents the feature weight map defined above; AFM(x s ) represents the aggregate feature map defined above; f y (x') represents the feature map of the neural network model to be attacked for the reference image x' at the yth layer; s represents the salient image extracted from the original image; x' represents the reference image in the attribution algorithm, specifically a completely black image with all RGB channels set to 0; f y () represents the yth layer of the neural network model, specifically the Mixed_5b / concat layer of the inception_v3 model.

[0089] S4. Destroy feature information in the image to obtain a first noise image.

[0090] The specific formula for destroying the feature information in the image:

[0091]

[0092] in, Represents the gradient information of the aggregated feature loss. The iterative optimization formula is as follows:

[0093]

[0094] Among them, sign() represents the direction function, the positive output is 1, and the negative output is 0; represents the result of the tth iteration, where the result of the initial iteration ε represents the preset maximum disturbance threshold, which is set to 16; Indicates the calculation of disturbance information. In this embodiment, the number of iterations is set to 10. After the number of iterations is completed, the first noise image is output.

[0095] S5. Add geometric interference features to the original image and remove the area corresponding to the salient image to obtain a third noisy image.

[0096] Figure 3 It shows how to insert geometric interference features into the original image. Figure 3 As shown, we first need to extract low-frequency features from the input image. The process can be described by the formula x*G, where x represents the original image and G represents the filter (variance is 4, convolution kernel size is 17*17). After that, we need to extract high-frequency features from the feature carrier image. The process can be described by the formula (x p -x p *G) description, where x p Denotes the feature carrier image, and G denotes the filter (variance is 4, convolution kernel size is 17*17). Finally, the two are combined into one image through the fusion module to obtain the second noise image. The process can be expressed by the formula Description, where The function is a truncation function, which means that the input is constrained to be within the range of [x-ε,x+ε] to ensure the visibility of the output image; ε represents the preset maximum perturbation threshold, specifically 16; and (x*G+(x p -x p *G)) represents the fusion of the outputs of the above two processes. The output second noise image is based on the original image, into which the high-frequency features of the feature carrier image are inserted.

[0097] Figure 4 It shows how to remove the salient image corresponding area in the second noise image. Figure 4As shown in FIG, the smallest rectangular area enclosing the salient area is calculated and set to zero by multiplication, thereby obtaining the third noise image.

[0098] S6. Concatenate the first noise image and the third noise image into a complete adversarial sample.

[0099] like Figure 5 As shown in Figure 1, the first noise image is resized to the size of the corresponding area of ​​the original salient image and placed in the corresponding area of ​​the third noise image to form a complete adversarial sample. The process can be described by the following formula:

[0100]

[0101] in, represents the first noise image; represents the third noise image; x adv is the final generated adversarial sample; resize() is to restore to the size of the corresponding area of ​​the salient image; concat() is to place the restored salient area on Finally, the entire adversarial sample generation process is completed through the splicing module. Figure 6 A specific implementation flow chart of the present invention is shown. Figure 7 A schematic diagram of a specific implementation scenario of the present invention is shown.

[0102] The above-described embodiments are only preferred embodiments of the present invention and are not intended to limit the scope of implementation of the present invention. Therefore, any changes made based on the shape and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A feature distribution-aware adversarial sample generation method for image classification scenarios, characterized by: The following steps are involved: S1. Obtain the original image, the feature carrier image with a large number of repeated geometric figures, and the neural network model to be attacked; S2. Applying a saliency map segmentation method to the original image to obtain a saliency map of the original image, and dividing the saliency map into a salient area and a background area according to a preset threshold; S3. Extract the salient region from the original image according to the salient region extraction method as the salient image, and input it into the neural network model to be attacked to calculate the feature weight map and the aggregated feature map; The feature weight graph is used to measure the importance of each feature value in the aggregate feature graph and can be described by the following formula: Where, IA y represents the feature weight map of the yth layer of the neural network model to be attacked; n represents the number of calculations; f() represents the neural network model to be attacked; f y () represents the feature map of the yth layer of the neural network model to be attacked; x' represents the reference image in the attribution algorithm, which is set to an image with all zero pixel values ​​and the same size as the original image; The purpose of the aggregated feature map is to alleviate the interference of noise features in the feature map and highlight the key features related to the category in the feature map. Its generation formula can be described by the following formula: Where D k (x s ) represents the result of data enhancement for the salient image for the kth time; f y (D k (x s )) means passing through D k (x s ) obtained; m represents the number of polymerizations required; AFM(x s ) represents the salient image x s Aggregate feature map of S4, calculating feature loss based on the feature weight map and the aggregated feature map obtained in step S3, and destroying feature information in the salient image to obtain a first noise image; The calculation of feature loss can be described by the following formula: A y ((x s ,x'))=[AFM(x s )-f y (x')]*IA y (5) In the formula, (x s ,x') represents the transition from the reference image x' to the salient image x s Path; A y ((x s ,x')) represents the path (x s ,x') aggregate feature loss at the yth layer of the neural network model to be attacked; IA y Represents the feature weight map; AFM(x s ) represents the aggregated feature map; f y (x') represents the feature map of the neural network model to be attacked for the reference image x' at the yth layer; s represents the salient image extracted from the original image, x' represents the reference image in the attribution algorithm, and the reference image is set to an image with all pixel values ​​​​zero and the same size as the original image; S5. Adding geometric interference features to the original image using the feature carrier image to obtain a second noise image. Based on the salient image obtained in step S3, removing the region corresponding to the salient image in the second noise image from the image to obtain a third noise image. S6. Concatenate the first noise image and the third noise image to obtain an adversarial sample.

2. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1 is characterized by: In step S1, the original image is any image given by the user, which is used to produce the final adversarial sample; the feature carrier image is a special image with a large number of repeated geometric figures, which is used to add interfering geometric features to the original image; the neural network model to be attacked refers to any pre-trained neural network model, which is used to extract the feature weight map and aggregated feature map of the original image and perform feature destruction to produce the adversarial sample.

3. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1 is characterized by: In step S2, the saliency map division method specifically comprises obtaining the saliency map through an image processing mechanism to identify key areas and non-key areas of the image; Based on the obtained saliency map cam, the following formula is used to distinguish the salient area from the background area: Where threshold is the parameter used for region segmentation, cam is the saliency map of image processing; S map Is a partition matrix used to divide the salient area and background area of ​​the image. For S map The element value of 1 is used to mark the salient area, while the element value of 0 is used to mark the background area. [i, j] represents the pixel in the i-th row and j-th column of the image; the salient map cam and the partition matrix S map They are all the same size as the original images.

4. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1, characterized in that: In step S3, the salient region of the original image is extracted into an independent image as a salient image through a salient region extraction method, and feature destruction is performed on the salient image with rich category features to prevent the neural network model from relying on the key features of the salient image to make correct decisions; The salient region extraction method can be described by the following formula: x s =Salieny(Rectangle(S map ),x)(2) Where S map represents the partition matrix; x s Represents the salient image extracted from the original image; x represents the original image; Rectangle() represents obtaining the rectangular area that encloses the minimum salient area. The purpose of the Salieny() function is to extract the rectangular area obtained by the Rectangle() function from the original image x; The salient image x s Input into the neural network model to be attacked and calculate the feature weight map and aggregation feature map.

5. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1, characterized in that: In step S4, the purpose of destroying the feature information in the image is to destroy the key features in the salient image, thereby increasing the distance in the feature space; The specific process of destroying the feature information in the image is: based on the calculated feature loss, the gradient information of the corresponding input is calculated through backpropagation, and then the gradient information is added to the corresponding input to form a new input; the above process is repeated multiple times; Characteristic destruction can be described by the following formula: Where, Represents a salient image x s The result of the tth iteration, where the result of the initial iteration sign() represents the direction function, the positive output is 1 and the negative output is 0; Indicates that according to the feature loss A y ((x s ,x')) to calculate the gradient information; According to the above formula (6) after T iterations, the output The first noise image Where T is the specified number of iterations.

6. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1, characterized in that: In step S5, the geometric interference features are added to extract the high-frequency features of the feature carrier image and add the extracted high-frequency features to the original image, thereby interfering with the image to make the correct decision, which can be described by the following formula: Where G represents a filter, which is used to extract high-frequency features of the feature carrier image; x p Represents the feature carrier image; x hit represents the second noise image; The function constrains the input to be within the range [x-ε,x+ε]; ε represents the preset maximum perturbation threshold; x represents the original image; The area corresponding to the salient image in the second noise image is removed from the original image to avoid misalignment in subsequent stitching, which can be described by the following formula: Where, represents the third noise image, S map Represents the partition matrix, Rectangle() represents the rectangular area of ​​the minimum enclosing salient area; finally, by multiplying (1-Rectangle(S map )) to remove the area corresponding to the salient image.

7. The method for generating adversarial samples based on feature distribution perception in image classification scenarios according to claim 1, characterized in that: In step S6, the purpose of stitching is to merge the second noise image with the third noise image to achieve the purpose of performing feature destruction in the salient area and performing feature insertion in the background area, which can be described by the following formula: Where, represents the first noise image; represents the third noise image; x adv is the final generated adversarial sample; resize() is to restore to the size of the corresponding area of ​​the salient image; concat() is to place the restored salient image in corresponding area.

Images