A method for generating a migration adversarial sample and a black-box attack method

Abstract

The application discloses a kind of generation methods of migration adversarial sample and black-box attack method, it is related to artificial intelligence security field;The generation method of the adversarial sample is as follows: first, spectrum transformation simulation model enhancement is carried out, then in the middle layer of feature space, important features that those are greatly influenced to model prediction are destroyed;In addition, to limit the size of adversarial perturbation, introduce smooth loss function to remove the high-frequency information of disturbance in the image after spectrum transformation, maintain the continuity of adjacent pixels, and then guide the search of adversarial disturbance, realize the high error rate of black-box transmission;The method of the application adjusts the spectrum saliency map by transformation in frequency domain, simulates diversified substitute models, achieves the effect of model enhancement, and improves the migration of adversarial sample.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, and in particular to a method for generating transferable adversarial examples and a black-box attack method. Background Technology

[0002] Deep neural networks (DNNs) have demonstrated outstanding performance in various fields such as image processing, speech recognition, and natural language processing, becoming one of the core technologies for solving complex problems and driving the development of artificial intelligence. With their widespread application, a serious security threat has gradually emerged—adversarial attacks. These attacks involve malicious attackers adding adversarial examples with subtle perturbations to deceive the model, causing it to make incorrect predictions; for example, interfering with the decision-making of autonomous driving systems. To improve the robustness of models, it is necessary to create adversarial examples to cover as many blind spots as possible in DNNs. Existing adversarial attacks can be categorized into white-box attacks and black-box attacks based on the amount of information the attacker has about the model. Generally speaking, white-box attacks have accessible internal structures, making them easier to implement and with a higher success rate; while black-box attacks are more challenging because attackers can only infer the internal structure and operation of the attacked model from limited information, making them more realistic.

[0003] Black-box attack methods can be categorized into two types. One type involves gradually observing and understanding the model by querying its inputs and outputs. If the attacked model is very complex, with a deep structure and a large number of parameters, the attacker needs to perform more queries and calculations to successfully launch the attack, which is very time-consuming and easily detected by the defense model. Because adversarial examples are transferable, adversarial examples generated on one model can also deceive other models. Therefore, many researchers utilize this transferability to improve the success rate of model attacks. On the one hand, most existing adversarial attacks tend to create adversarial examples by indiscriminately distorting features of the source model. This can lead to model-specific local optima and significantly reduce transferability. On the other hand, most attacks rely on the network's output layer information, performing gradient-based attacks in pixel space. Studying the relationship between different models in the spatial domain ignores the fundamental differences between models, resulting in adversarial examples with obvious visual variations and weak invisibility. In the frequency domain of images, different models also typically rely on different frequency components of each input image when making decisions. Most existing adversarial attacks are prone to overfitting to the model, which limits the applicability of the attack method to other models, meaning the generated adversarial examples have weak transferability. Summary of the Invention

[0004] The purpose of this invention is to provide a method for generating mobile adversarial examples and a black-box attack method, which at least solves the problem of weak mobile adversarial examples generated by existing technologies.

[0005] To achieve the above objectives, the first aspect of this application provides a method for generating transferable adversarial examples, the method comprising: Step 1: performing spectral transformation on images in the original dataset to obtain spectrally transformed images; Step 2: extracting features from the input image of the spectrally transformed image into several feature maps by inputting the spectrally transformed image into a source model; Step 3: selecting a feature map generated by an intermediate layer and using gradient aggregation to find features that affect the importance of different models; Step 4: constructing a feature importance loss function and minimizing it; simultaneously using a smoothing loss function to remove high-frequency perturbations in the spectrally transformed image; Step 5: calculating the overall loss function; Step 6: after obtaining the overall loss function, calculating the current gradient using Equation 7, then normalizing the gradient, and iteratively updating it to obtain adversarial examples using Equation 8.

[0006] Formula 7 is as follows:

[0007]

[0008] In formula 7, As the attenuation factor, In order to be in The gradient accumulated in each iteration.

[0009] Formula 8 is as follows:

[0010]

[0011] In formula 8, The sign function outputs the sign of each element, i.e., 1, -1, or 0, indicating the gradient direction of the corresponding element. Parameters for controlling the magnitude of disturbances, This is to ensure that the values ​​of the generated adversarial examples are within a reasonable range and do not exceed the image size.

[0012] Furthermore, in step one, the spectral transformation is represented by the following formula 1:

[0013]

[0014] In formula 1, This indicates that it conforms to the standard deviation. A Gaussian distributed random variable, i.e. ; express The transformation transforms the input image from the spatial domain to the frequency domain, and then applies a masking operation that follows a uniform distribution. ,in The tuning factor is ⊙, and the product of corresponding elements is ⊙. Finally, the image is subjected to an inverse transformation. Transforming back to the spatial domain yields This transformation process can be considered as a spectral transformation.

[0015] Furthermore, in step two, the source model can be any one of Inc-v3, Inc-v4, IncRes-v2, ResNet-v2, VGG-16, or VGG-19.

[0016] Furthermore, in step three, the aggregation gradient is represented by the following formula 3:

[0017]

[0018] In formula 3, It is a with Binary matrices of the same size obey a probability of . The binomial distribution is given by ⊙, where ⊙ represents the product of corresponding elements in the matrix. This indicates the number of times the enhanced image is randomly masked. For the above summation terms Norm.

[0019] Furthermore, in step four, a feature importance loss function is constructed. The loss function is shown in Formula 4 below:

[0020]

[0021] In formula 4, This represents a certain intermediate layer of the model. This represents the feature map of an adversarial example at a certain layer in the model. The aggregation gradient is obtained from Equation 3.

[0022] Furthermore, in step four, the smoothing loss function is shown in Formula 5 below:

[0023]

[0024] In formula 5, For the image after the first The perturbation added during layering. This represents a 3x3 low-pass filter.

[0025] Furthermore, in step five, the final loss function constructed is shown in Formula 6 below:

[0026] In formula 6, Represents cross-entropy loss, For feature importance loss, To smooth out the loss, and This is used to balance the magnitude of these three losses.

[0027] The second aspect of this application provides a black-box attack method, which uses adversarial samples generated by the above method to perform black-box attacks on target models.

[0028] The beneficial effects of this invention are as follows: This invention provides a method for generating adversarial examples and a black-box attack method. In the adversarial example generation method, firstly, a spectral transformation is performed to simulate model enhancement, and then, in the intermediate layer of the feature space, those important features that have a significant impact on model prediction are destroyed. Furthermore, to limit the size of the adversarial perturbation (i.e., the stealth of the adversarial example), a smoothing loss function is introduced to remove high-frequency information of the perturbation, maintaining the continuity of adjacent pixels, thereby guiding the search for adversarial perturbations and achieving high-error-rate black-box transmission.

[0029] Furthermore, the method of the present invention has the following characteristics:

[0030] (1) The method of the present invention achieves the effect of model enhancement by transforming and adjusting the spectral saliency map in the frequency domain to simulate diverse alternative models, thereby improving the transferability of adversarial examples.

[0031] (2) The method of this invention attacks based on the intermediate layer of the feature space, which improves the concealment of adversarial examples. By destroying the positive features that affect the model's decision in the intermediate layer and introducing a smooth loss function to achieve the continuity of adjacent pixels, the variation of adversarial perturbation is reduced, and the invisibility of adversarial examples is improved.

[0032] (3) The present invention has conducted a large number of experiments to study the performance of the adversarial samples generated by the proposed method. The results show the superiority of the migration-based black-box attack and show that its adversarial samples have good concealment. The method of the present invention also performs well in attack defense mechanisms. Attached Figure Description

[0033] Figure 1 This is a flowchart of the adversarial sample generation method in the embodiments of this application.

[0034] Figure 2 Figure (ac) shows the spectral saliency maps of different models, and Figure (d) shows the spectral saliency map generated by the method of the present invention.

[0035] Figure 3 This figure shows the attack success rate of adversarial samples generated from a certain feature layer in the middle when the source model is Inc-v3, when attacking other target models. In the figure, the horizontal axis represents the name of the layer.

[0036] Figure 4 This figure shows the attack success rate of adversarial samples generated from a certain feature layer in the middle of the source model VGG-16 when attacking other target models. In the figure, the horizontal axis represents the name of the layer.

[0037] Figure 5 To achieve different mask probabilities The attack success rate of using adversarial samples generated from the source model Inc-v3 to attack the target model Inc-Res-v2 under different set number of sets N.

[0038] Figure 6 To achieve different mask probabilities The attack success rate of using adversarial samples generated from the source model Inc-v3-Adv to attack the target model Inc-Res-v2 under different set number of sets N.

[0039] Figure 7 The impact of different loss function terms on attack success rate. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0041] To address the issue of weak transferability of adversarial examples generated by existing technologies, this invention first provides a method for generating transferable adversarial examples. The method uses the ImageNet compatible dataset as the original dataset, a publicly available dataset containing 1000 images. The method also utilizes the following publicly available models: six publicly available normal training models, five publicly available adversarial training models, and three advanced defense mechanisms.

[0042] The six publicly available, normally trained models are as follows: Inc-v3, Inc-v4, IncRes-v2, ResNet-v2, VGG-16, and VGG-19.

[0043] The five publicly available adversarial training models are as follows: Inc-v3-Adv, Inc-v3-Ens3, Inc-v3-Ens4,

[0044] IncRes-v2-Adv, IncRes-v2-Ens.

[0045] Inc-v3-Adv is an Inception-v3 model trained using adversarial training. Inc-v3-Ens3 and Inc-v3-Ens4 are Inception-v3 models trained using ensemble learning, with the numbers 3 and 4 indicating the number of models used in the ensemble. IncRes-v2-Adv is an Inception-ResNet-v2 model trained using adversarial training. IncRes-v2-Ens is an Inception-ResNet-v2 model trained using ensemble learning.

[0046] The three advanced defense mechanisms are: High-Gender Guided Noise Reduction (HGD), Random Resizing and Padding (R&P), and Feature Distillation (FD).

[0047] The specific details of HGD can be found in the following published papers, which will not be repeated here: Liao F, Liang M, Dong Y, et al. Defense against adversarial attacks using high-level representation guided denoiser[C] / / Proceedings of the IEEE conference on computer vision and pattern recognition. 2018: 1778-1787.

[0048] The specific details of the R&P can be found in the following published paper, which will not be repeated here: Xie C, Wang J, Zhang Z, et al. Mitigating adversarial effects through randomization[J].arXiv preprint arXiv:1711.01991, 2017.

[0049] The specific content of FD can be obtained from the following published papers, which will not be repeated in this application: Liu Z, Liu Q, Liu T, et al. Feature distillation: Dnn-oriented jpeg compression against adversarial examples[C] / / 2019 IEEE / CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2019: 860-868.

[0050] Please refer to Figure 1 The diagram illustrates a flowchart of a method for generating mobile adversarial examples according to an embodiment of this application. The method includes the following steps:

[0051] Step 1: Perform spectral transformation on the images in the original dataset to obtain the spectral transformed images. The spectral transformation is represented by the following formula 1.

[0052]

[0053] In formula 1, This indicates that it conforms to the standard deviation. A Gaussian distributed random variable, i.e. , express The transformation transforms the input image from the spatial domain to the frequency domain, and then applies a masking operation that follows a uniform distribution. ,in The tuning factor is ⊙, and the product of corresponding elements is ⊙. Finally, the image is subjected to an inverse transformation. Transforming back to the spatial domain yields This transformation process is considered as a spectral transformation, and the resulting spectral saliency map is equivalent to an integration of the model.

[0054] Spectral transformation only changes the color of the image and does not change the semantic information of the image. Therefore, this transformation does not affect the model's ability to understand and recognize objects, but rather enriches the image information after the transformation.

[0055] The explanation for step one is as follows:

[0056] The spectral saliency maps of different models are different, and each model shows different interests in the same frequency component. For example... Figure 2 As shown, in the spectral saliency map, low-frequency components are concentrated in the upper left corner of the spectrum, while high-frequency components are mainly in the lower right corner. Therefore, the component representation pattern in the frequency domain is more fixed compared to the different representations in the spatial domain. Inspired by this, in order to better reveal the differences between models, this invention introduces spectral transformation from the frequency domain perspective. By simulating a spectral saliency map similar to the attacked model, the gap between the source model and the attacked model is narrowed.

[0057] Step 2: Input the image obtained after spectral transformation into the source model. The source model can be any one of the six normally trained models mentioned above. The convolutional and pooling layers in the source model extract features from the input image to form several feature maps.

[0058] Step 3: Select a feature map generated by a certain intermediate layer and use aggregated gradients to find features that affect the importance of different models. The aggregated gradient is represented by the following formula 3.

[0059]

[0060] In formula 3, It is a with Binary matrices of the same size obey a probability of . The binomial distribution makes the transformed image have random probability. To remove certain pixels from an image, ⊙ represents the product of corresponding elements in a matrix. This indicates the number of times the enhanced image is randomly masked. For the above summation terms Norm. Therefore, the gradient after aggregation highlights the key feature regions, namely... Larger values ​​indicate more important features, which can guide adversarial examples in a more transferable direction.

[0061] Step 4: To suppress the influence of important positive features on model decisions and promote the influence of negative features, construct the following feature importance loss function. And minimize it. The loss function is shown in Equation 4 below.

[0062]

[0063] In formula 4, This represents a certain intermediate layer of the model. This represents the feature map of an adversarial example at a certain layer in the model. The aggregation gradient is obtained from Equation 3.

[0064] Step four also employs a smoothing loss function to remove high-frequency disturbances from the spectral transformed image. The smoothing loss function is shown in Formula 5 below.

[0065]

[0066] In formula 5, For the image after the first Perturbations added during layering, This represents a 3x3 low-pass filter.

[0067] The explanations for steps three and four are as follows:

[0068] During inference, the model extracts many features from the input image, which play an important role in the model's prediction. Perturbing the features in the model's feature space can directly lead to incorrect model predictions. Therefore, the key to generating highly transferable adversarial examples is to explore which features are more likely to transfer between models. Disrupting the features that dominate the model's decision-making helps to avoid getting trapped in the model's local optima, and the resulting adversarial perturbations are more aggressive and transferable than existing pixel space attacks.

[0069] Based on the above reasons, this invention introduces feature importance to determine the impact of different features on model decision-making, thereby suppressing important positive features on model decision-making and promoting negative features, thereby achieving the purpose of improving transferability.

[0070] Specifically, the importance of a feature is directly proportional to its contribution to the final decision, as expressed in this invention by the following formula:

[0071]

[0072] In formula 2, Represents a source model, This is the image after the spectral transformation in the previous step. Indicates the image at the 1st Feature map of the layer Represents the true label relative to the image of The output of this invention is first calculated. It means from the first The calculation begins at the first layer, and the model output is relative to the first layer. The gradient of the layer feature map, since this gradient may carry model-specific feature maps, this invention introduces the aggregation of gradients from multiple images that have lost some pixels in the feature space. The formula for aggregating the gradient is Equation 3. The aggregated gradient highlights the key feature regions, i.e. Larger values ​​indicate more important features, which can guide adversarial examples in a more transferable direction.

[0073] The reason for using a smoothing loss function to remove high-frequency disturbances in this invention is as follows:

[0074] High-frequency information contains subtle features such as details and textures in an image, which can vary significantly across different images. Therefore, if too much emphasis is placed on high-frequency information when generating adversarial perturbations, the perturbations may become overly detailed and fail to achieve good transferability across different datasets or models. To make the adversarial perturbations smoother in the feature space and reduce the impact of high-frequency perturbations, this invention employs a method for removing high-frequency perturbations through low-pass filtering. This method makes the adversarial perturbations more generalizable, reduces dependence on high-frequency information of specific images, enhances the continuity of adjacent pixels, and thus improves the transferability of the attack. Simultaneously, removing high-frequency perturbations also reduces the impact of adversarial perturbations on image details, making the attack more covert and difficult to detect.

[0075] Step 5: Calculate the overall loss function. The final loss function constructed in this invention is shown in Formula 6 below:

[0076]

[0077] In formula 6, Represents cross-entropy loss, For feature importance loss, To smooth out the loss, and The magnitudes of these three losses are used to balance the values ​​of these losses, and by optimizing these three losses, the generated adversarial examples have better mobility and concealment.

[0078] Step 6: After obtaining the overall loss function, calculate the current gradient using the following formula 7, then normalize the gradient and continuously iterate and update it to obtain the adversarial examples using the following formula 8.

[0079] Formula 7 is as follows:

[0080]

[0081] In formula 7, As the attenuation factor, In order to be in The gradient accumulated in each iteration can be normalized to control the step size of the update in each iteration, preventing it from being too large or too small, which helps to better guide the attack direction.

[0082] Formula 8 is as follows:

[0083]

[0084] In formula 8, The sign function outputs the sign of each element, i.e., 1, -1, or 0, indicating the gradient direction of the corresponding element. Parameters for controlling the magnitude of disturbances, This is to ensure that the values ​​of the generated adversarial examples are within a reasonable range and do not exceed the image size.

[0085] In summary, the method described above in this invention is applied in the frequency domain. and The technology ensures that the transformed image retains most of the information of the original image, generating diverse frequency domain transformed images. These images are then randomly masked and input into the model. While attacking important features in the intermediate layer of the feature space, a smooth loss function is used to constrain the distribution of perturbations and limit the size of the perturbations to enhance the stealth of the attack, thereby improving the success rate of the attack and the black-box transfer capability.

[0086] The present invention further provides an algorithm for the above-mentioned adversarial example generation method, as shown below:

[0087] The migration and invisibility tests of adversarial examples are as follows:

[0088] This invention tests the transferability and invisibility of generated adversarial examples by attacking the target model.

[0089] For transferability, the attack success rate metric is used, which is the proportion of adversarial samples that successfully mislead the attacked model out of all generated adversarial samples. It is calculated using the following formula 9.

[0090]

[0091] In formula 9, This represents the true label of the original image after it has been input into the model. This represents the label predicted after the adversarial example is input into the model.

[0092] For invisibility, the structural similarity index (SSIM) is used to measure it, which is the similarity between the adversarial sample and the original sample. The higher the SSIM value, the higher the similarity between the two images, calculated using the following formula 10:

[0093]

[0094] In formula 10, , For brightness comparison, For contrast comparison, For structural comparison.

[0095] The hardware and software conditions during the testing process are as follows:

[0096] The CPU used in this invention is a 12-core Intel(R) Xeon(R) Platinum 8255C, the GPU is an RTX3080, and the memory is 40GB. The software used is PyCharm, version 2021.3.1.

[0097] The hyperparameter settings during the test are as follows:

[0098] In the experiment, the maximum perturbation was set to... Number of iterations Step length For the baseline method, set MI-FGSM. DI-FGSM conversion probability For PI-FGSM, this invention sets an amplification factor. projection factor When attacking a normally trained model, the kernel size When attacking a defense model In addition, TAP's , , FIA's The probability of randomly discarding the mask is To ensure fairness, this invention sets the standard deviation of the noise. Tuning factor Number of random masking attempts , The convolution kernel using a low-pass filter is 3x3 in size.

[0099] For feature layer attacks, the best-performing layer is selected for each model. For example, for the VGG-16 model, Conv3_3 is selected; for the Inc-v3 model, Mixed_5b is selected; for the IncRes-v2 model, Conv_4a_3*3 is selected; and for the ResNet-152 model, the last layer of the second block is selected for attack.

[0100] Attacking a normally trained model during testing

[0101] To quantitatively compare the transferability of the proposed method with baseline methods, Inc-v3, Inc-v4, IncRes-v2, and ResNet-v2 were selected as source models to attack other normally trained models. Table 1 below shows the success rates of different attack methods on several common normally trained models. It can be seen that the proposed method significantly outperforms other transferable attack methods. For example, when using Inc-v3 as the source model, the proposed method (FM-FSTA) achieves a maximum success rate improvement of 48.6% compared to MI-FGSM, a maximum improvement of 39.6% compared to DI-FGSM, and a maximum improvement of 31.2% compared to PI-FGSM. Furthermore, compared to other feature space-based attacks, this invention performs best in all cases (white-box attacks* and black-box attacks). For example, the method of this invention (FM-FSTA) improves the success rate by up to 16.6% compared to TAP attacks, up to 18.3% compared to ATA attacks, and up to 2.6% compared to FIA attacks. This demonstrates the effectiveness of the model-enhanced frequency domain transformation and smoothing loss proposed in this invention.

[0102] Table 1. Statistics on the attack success rate of different methods on different normal training models.

[0103]

[0104] Attack and defense model test

[0105] Table 2 below lists the success rates of attacking adversarially trained models when the source models are Inc-v3, ResNet-152, and IncRes-v2, respectively. It can be seen that, because the defense model is adversarially trained, it exhibits stronger robustness against adversarial examples compared to normally trained models. This invention (FM-FSTA) also performs best when attacking adversarially trained models. Taking Inc-v3 as the source model as an example, when attacking Inc-v3-Adv, it improves the success rate by 33.4% compared to MI-FGSM, 30.1% compared to DI-FGSM, and 22% compared to PI-FGSM. Although the success rate is not as high as that of feature space-based attacks like TAP, FM-FSTA performs better than ATA and FIA, which are also feature space-based attacks, showing a 10.4% improvement over ATA and a 3% improvement over FIA. When attacking the IncRes-v2-Ens model, the success rate of these methods decreased, indicating that the IncRes-v2-Ens model is more robust than the other four models. Compared with other attacks, this invention also significantly improves the transferability of attacks, with a success rate of 43.9% when the source model is ResNet-152.

[0106] Table 2. Statistics on the attack success rate of different methods on different normal training models.

[0107]

[0108] Furthermore, this invention selects three advanced defense mechanisms: HGD, R&P, and FD. Table 3 below shows the success rates of different methods generating adversarial examples on the Inc-v3 model and attacking the three different defense mechanisms. It can be seen that this attack is more powerful than other methods. For example, when attacking the R&P model, it improves the success rate by 15.1% compared to MI-FGSM, 10.5% compared to NI-FGSM, and 3.6% compared to FIA, demonstrating the effectiveness of this invention in attacking advanced defense models and raising awareness of the security implications of developing stronger defenses. However, as can be seen from the figure, the success rate of these methods attacking the FD defense mechanism is also lower than the success rate of attacking the other two defense mechanisms, indicating that the defense model with the added FD defense mechanism is more robust.

[0109] Table 3. Statistics on the attack success rate of different methods on three advanced defense mechanisms.

[0110]

[0111] Invisibility test

[0112] As shown in Table 4 below, this invention exhibits better invisibility compared to other attack methods that enhance transferability. Compared to the MI-FGSM attack, the SSIM value is improved by 0.139; compared to NI-FGSM, by 0.097; and compared to the TAP attack, by 0.154. The superior performance of this invention is due to the fact that the spectral transformation can be better hidden within the frequency components of the image. The human eye is not sensitive to frequency domain changes, making adversarial attacks more difficult to detect. The destruction of important features in the feature layer and the construction of a smoothing loss further improve the quality of adversarial examples.

[0113] Table 4. Statistical table of invisibility test results of different methods of the present invention.

[0114]

[0115] To investigate the impact of different layers in the model's feature space on attacks, the following experiment was conducted.

[0116] When using Inc-v3 and VGG-16 as source models, the success rate of adversarial examples created on different layers to attack different target models was analyzed. Attacking deeper layers (Mixed_6a / Mixed_7a) yielded the best white-box attack performance. However, attacking intermediate layers (Conv_4a / Mixed_5b) showed higher transfer performance than attacking shallow layers (Conv_1a / Conv_2b) and deep layers (Mixed_6a / Mixed_7a). This invention posits that shallow layers contain low-level features (edges, textures, etc.) that have little impact on the output, while similarly, deep layers contain high-level features (such as semantics). However, attacks on deep layers are prone to overfitting to the source model, failing to create transferable adversarial examples. Figure 3 It can be seen that, for the Inc-v3 model, while its attack effect on adversarially trained defense models is not as good as that on the Conv_4a layer when attacking the Mixed_5b layer, its attack success rate is worse than that on most undefended normal models. Figure 4 It can be seen that for the VGG-16 model, selecting Conv3_3 layer for attack is the most effective.

[0117] To investigate the impact of ensemble size and mask probability on portability, the following experiments were conducted.

[0118] Using Inc-v3 as the source model, attacks were launched against the normally trained model IncRes-v2 and the defensive model Inc-v3-Adv. Figure 5 and Figure 6 This shows the mask probability and the number of ensembles. The impact on the success rate of attacks on the attacked model. It can be seen that the mask probability... It has a significant impact on the success rate, and this impact tends to be consistent across different attack models, as... As the size increases, the success rate of the attack will rise, but a larger size... A value of 0.5 (e.g., 0.5) will destroy important structural information in the image, thus greatly reducing the success rate. Therefore, the optimal attack method for normally trained models is... The optimal attack-defense model is between 0.2 and 0.3. It should be between 0.1 and 0.2. (For set numbers) , The larger the set size, the higher the success rate, but it will gradually saturate, and using multiple models will increase resource consumption. Finally, select the number of sets. Mask probability for a normally trained model Mask probability of the defense model .

[0119] To investigate the impact of different loss terms on attack performance, the following experiment was conducted.

[0120] Each time, a term in the overall loss function (Equation 6) is removed to examine the impact of these terms on attack performance. Figure 7 This demonstrates the attack performance of the method of this invention when generating adversarial examples to attack other models under different conditions using the Inc-v3 model as the source model. It can be seen that the adversarially trained model can resist adversarial examples. When... and At that time, the method had the lowest attack success rate against all defense models, indicating that these defense models are robust to the adversarial samples generated using this invention.

[0121] By adding smoothing loss ( , This invention discovers that it reduces the success rate of white-box attacks because it eliminates the high-frequency components of perturbations that have a significant impact on white-box operations. Therefore, when attacking ResNet-v2, IncRes-v2, and VGG-16, it is more effective than attacking... The high success rate of attacks demonstrates the effectiveness of loss mitigation; when , When considering only the feature importance of suppressing the feature space and ignoring the smoothing loss, the attack of this invention achieves high transferability on Inc-v3, IncRes-v2, ResNet-v2, and VGG-16 models, but is not as good as... and The results are good. This demonstrates that adversarial training models and normal models are highly complementary. Adversarial training injects adversarial samples from other models into the training set, tending to address the weaknesses of the original model and improving its robustness. This invention sets... and To balance the performance of these two loss functions, it exhibits strong aggressiveness in both normal training models and adversarial training models.

[0122] The embodiments described above are merely one implementation method of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating transferable adversarial examples, characterized in that, The method includes: Step 1: Perform spectral transformation on the images in the original dataset to obtain the spectral transformed images; The spectral transformation is represented by the following formula 1: In formula 1, This indicates that it conforms to the standard deviation. A Gaussian distributed random variable, i.e. ; express The transformation transforms the input image from the spatial domain to the frequency domain, and then applies a masking operation that follows a uniform distribution. ,in The tuning factor is ⊙, and the product of corresponding elements is ⊙. Finally, the image is subjected to an inverse transformation. Transforming back to the spatial domain yields This transformation process can be considered as a spectral transformation; Step 2: Extract features from the input image obtained after spectral transformation to form several feature maps; Step 3: Select a feature map generated by a certain intermediate layer and use gradient aggregation to find features that affect the importance of different models; The aggregation gradient is represented by the following formula 3: In formula 3, It is a with Binary matrices of the same size obey a probability of . The binomial distribution is given by ⊙, where ⊙ represents the product of corresponding elements in the matrix. This indicates the number of times the enhanced image is randomly masked. For the summation term Norm; Step 4: Construct a feature importance loss function and minimize it; at the same time, use a smoothing loss function to remove high-frequency disturbances in the image after spectral transformation; Feature Importance Loss Function The loss function is shown in Formula 4 below: In formula 4, This represents a certain intermediate layer of the model. This represents the feature map of an adversarial example at a certain layer in the model. The aggregation gradient is obtained from Equation 3; The smoothing loss function is shown in Formula 5 below: In formula 5, For the image after the first The perturbation added during layering. This represents a 3x3 low-pass filter; The importance of features and their contribution to the final decision are shown in the following formula: Represents a source model, This is the image after the spectral transformation in the previous step. Indicates the image at the 1st Feature map of the layer Represents the image's true label of Output; Step 5: Calculate the overall loss function; The final loss function constructed is shown in Formula 6 below: In formula 6, Represents cross-entropy loss, For feature importance loss, To smooth out the loss, and Used to balance the magnitude of these three losses; Step 6: After obtaining the overall loss function, calculate the current gradient using Equation 7, then normalize the gradient, and continuously iterate and update it to obtain the adversarial example using Equation 8. Formula 7 is as follows: In formula 7, As the attenuation factor, In order to be in The gradient accumulated in each iteration; Formula 8 is as follows: In formula 8, The sign function outputs the sign of each element, i.e., 1, -1, or 0, indicating the gradient direction of the corresponding element. Parameters for controlling the magnitude of disturbances, This is to ensure that the values ​​of the generated adversarial examples are within a reasonable range and do not exceed the image size.

2. The method for generating mobile adversarial examples according to claim 1, characterized in that, In step two, the source model can be any one of Inc-v3, Inc-v4, IncRes-v2, ResNet-v2, VGG-16, or VGG-19.

3. A black-box attack method, characterized in that, The adversarial sample generated by the method of claim 1 is used to perform a black-box attack on the target model.

Images