Invalid sample optimization method and device for black box attack on video model boundary

Abstract

The present invention discloses an invalid sample optimization method and device for a boundary black box attack on a video model. The method comprises: firstly establishing current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack; then generating a scaling gradient based on the current stage parameters; and finally updating the sample data of the previous iteration by the scaling gradient, which can effectively reduce the number of invalid samples in each iteration and greatly improve the efficiency of the boundary black box attack.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to an invalid sample optimization method and device for a black box attack on a video model boundary. Background Art

[0002] In recent years, neural networks have been widely used in video models, but they are vulnerable to adversarial sample attacks, which causes great interference to the video model when making classification predictions and serious deviations in the prediction results. Therefore, research in related fields is of great significance. The boundary black box attack obtains information by continuously querying the final classification label of the video model to attack it. It has high practical significance, but due to the large dimension of the video, the boundary black box attack will produce invalid samples with unchanged gradients during the iterative attack process, which greatly reduces the attack efficiency.

[0003] Therefore, how to reduce invalid samples of boundary black box attacks and improve attack efficiency is a technical problem to be solved by technical personnel in this field. Summary of the invention

[0004] The purpose of the present invention is to solve the technical problem in the prior art that there are many invalid samples in boundary black box attacks, resulting in low attack efficiency.

[0005] To achieve the above technical objectives, on the one hand, the present invention provides an invalid sample optimization method for a video model boundary black box attack, the method comprising:

[0006] Establish the current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack;

[0007] generating a scaling gradient based on the current stage parameters;

[0008] The sample data of the previous iteration is updated by the scaling gradient.

[0009] Furthermore, if the current iteration is the first iteration, the sample data is not updated.

[0010] Furthermore, the current stage parameters are established according to the number of visits to the video model by the current iteration of the boundary black box attack. Specifically, the current stage parameters are established by the following formula:

[0011] p=max(t min , t ini -q / d)

[0012] In the formula, p is the current stage parameter, t min is the minimum constant value of the pre-established phase parameter, t iniis the initial constant value of the pre-established stage parameter, q is the number of times the video model is accessed, and d is the decay rate constant value.

[0013] Furthermore, the method also includes correcting the current stage parameter if the current stage parameter is a negative number.

[0014] Furthermore, the current stage parameters are corrected specifically by the following formula:

[0015] p=xab / (q-dt ini )

[0016] Where p is the current stage parameter, x is a random variable taken from Gaussian distribution, a is a constant, b is a constant, q is the number of times the video model is accessed, d is the decay rate constant value, t ini are the initial constant values ​​of pre-established phase parameters.

[0017] Furthermore, after establishing the current stage parameters, the method further includes adjusting the current stage parameters by the following formula:

[0018] p t =pry

[0019] In the formula, p t is the current stage parameter after adjustment, p is the current stage parameter before adjustment, r is the preset adjustment radius constant, and y is a random variable taken from a Gaussian distribution.

[0020] Furthermore, the scaling gradient is generated by the following formula:

[0021] g t =pg

[0022] In the formula, g t is the scaled gradient, p is the current stage parameter, and g is the gradient generated by the current iteration.

[0023] Further, the sample data of the previous iteration is updated by the scaling gradient, for example, by updating the sample data of the previous iteration by the following formula:

[0024] x t =x t-1 +λg t

[0025] In the formula, x t is the updated sample data, x t-1 is the sample data of the previous iteration, and λ is the step size.

[0026] On the other hand, the present invention also provides an invalid sample optimization device for a video model boundary black box attack, the device comprising:

[0027] Establishing a module for establishing current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack;

[0028] A generation module, used for generating a scaling gradient based on the current stage parameters;

[0029] An updating module is used to update the sample data of the previous iteration by using the scaling gradient.

[0030] The present invention provides an invalid sample optimization method and device for a boundary black-box attack on a video model. Compared with the prior art, the method first establishes current stage parameters according to the number of visits to the video model in the current iteration of the boundary black-box attack; then generates a scaling gradient based on the current stage parameters; finally, the sample data of the previous iteration is updated through the scaling gradient, which can effectively reduce the number of invalid samples in each iteration and greatly improve the efficiency of the boundary black-box attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] Figure 1 It is a flowchart of an invalid sample optimization method for a black box attack on a video model boundary provided by an embodiment of this specification;

[0033] Figure 2 The figure shows a schematic diagram of the structure of an invalid sample optimization device for a black box attack on a video model boundary provided by an embodiment of the present specification. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0035] like Figure 1The flowchart of the invalid sample optimization method for the black box attack on the boundary of the video model provided by the embodiment of this specification is shown. Although this specification provides the method operation steps or device structures shown in the following embodiments or drawings, more or fewer operation steps or module units may be included in the method or device based on routine or no creative labor. In the steps or structures where there is no necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied in an actual device, server or terminal product, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiment or drawings (for example, a parallel processor or multi-threaded processing environment, or even a distributed processing, server cluster implementation environment).

[0036] The invalid sample optimization method for the black box attack on the video model boundary provided in the present embodiment can be applied to terminal devices such as clients and servers, such as Figure 1 As shown, the method specifically comprises the following steps:

[0037] Step S101: Establish current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack.

[0038] Specifically, the boundary black box attack will generate invalid samples with unchanged gradients in each iteration. As the number of iterations increases, the number of invalid samples will increase, and these increased invalid samples will greatly limit the attack efficiency of the boundary black box attack. Therefore, for each iterative attack of the boundary black box attack, the current iteration parameters corresponding to the current iteration are established, so as to optimize the invalid samples according to the parameters.

[0039] In some embodiments, if the current iteration is the first iteration, the sample data is not updated.

[0040] In some embodiments, the current stage parameters are established according to the number of visits to the video model by the current iteration of the boundary black box attack, and the current stage parameters are established specifically by the following formula:

[0041] p=max(t min , t ini -q / d)

[0042] In the formula, p is the current stage parameter, t min is the minimum constant value of the pre-established phase parameter, t ini is the initial constant value of the pre-established stage parameter, q is the number of times the video model is accessed, and d is the decay rate constant value.

[0043] In some cases, the current stage parameter calculated by the above formula may be a negative number, so it needs to be processed again to obtain a positive current stage parameter.

[0044] If the current stage parameter is a negative number, the current stage parameter is corrected, specifically, the current stage parameter is corrected by the following formula:

[0045] p=xab / (q-dt ini )

[0046] Where p is the current stage parameter, x is a random variable taken from Gaussian distribution, a is a constant, b is a constant, q is the number of times the video model is accessed, d is the decay rate constant value, t ini are the initial constant values ​​of pre-established phase parameters.

[0047] After establishing the current stage parameters, the method further includes adjusting the current stage parameters by the following formula:

[0048] p t =pry

[0049] In the formula, p t is the current stage parameter after adjustment, p is the current stage parameter before adjustment, r is the preset adjustment radius constant, and y is a random variable taken from a Gaussian distribution.

[0050] Step S102: Generate a scaling gradient based on the current stage parameters.

[0051] In some embodiments, the scaling gradient is generated by the following formula:

[0052] g t =pg

[0053] In the formula, g t is the scaled gradient, p is the current stage parameter, and g is the gradient generated by the current iteration.

[0054] Step S103: Update the sample data of the previous iteration by using the scaling gradient.

[0055] Specifically, the sample data in the previous iteration is updated according to the scaling gradient, that is, the sample data in the previous iteration is scaled according to the scaling gradient, thereby reducing the generation of invalid samples.

[0056] Specifically, in some embodiments, the updating of the sample data of the previous iteration by the scaling gradient is performed by, for example, updating the sample data of the previous iteration by the following formula:

[0057] x t =x t-1+λg t

[0058] In the formula, x t is the updated sample data, x t-1 is the sample data of the previous iteration, and λ is the step size.

[0059] Through the above operation, the updated sample data x can be greatly reduced t The probability of the updated sample data being an invalid sample is increased, and the updated sample data can become a valid sample with a greater probability, thereby achieving the effect of reducing invalid samples.

[0060] After the above processing, invalid samples of boundary black box attacks can be effectively reduced and the attack efficiency can be improved.

[0061] Based on the above-mentioned invalid sample optimization method for black-box attack on the boundary of video model, one or more embodiments of this specification also provide a platform and terminal for optimizing invalid samples for black-box attack on the boundary of video model. The platform or terminal may include devices, software, modules, plug-ins, servers, clients, etc. using the methods described in the embodiments of this specification and combined with necessary implementation hardware devices. Based on the same innovative concept, the system in one or more embodiments provided in the embodiments of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the system are similar, the implementation of the specific system in the embodiments of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. The terms "unit" or "module" used below can be a combination of software and / or hardware that implements predetermined functions. Although the system described in the following embodiments is preferably implemented in software, hardware and a combination of software and hardware are also possible and conceived.

[0062] Specifically, Figure 2 : is a schematic diagram of the module structure of an embodiment of an invalid sample optimization device for a video model boundary black box attack provided in this specification, such as Figure 2 As shown, the invalid sample optimization device for the black box attack on the boundary of the video model provided in this specification includes:

[0063] Establishing a module for establishing current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack;

[0064] A generation module, used for generating a scaling gradient based on the current stage parameters;

[0065] An updating module is used to update the sample data of the previous iteration by using the scaling gradient.

[0066] It should be noted that the above-mentioned system may also include other implementation modes according to the description of the corresponding method embodiment. The specific implementation modes may refer to the description of the above-mentioned corresponding method embodiment, which will not be described one by one here.

[0067] The present application also provides an electronic device, including:

[0068] processor;

[0069] a memory for storing instructions executable by the processor;

[0070] The processor is configured to execute the method provided in the above embodiment.

[0071] The electronic device provided by the embodiment of the present application stores the executable instructions of the processor in a memory. When the processor executes the executable instructions, it can first establish the current stage parameters according to the number of times the video model is accessed in the current iteration of the boundary black box attack; then generate a scaling gradient based on the current stage parameters; finally, update the sample data of the previous iteration through the scaling gradient, which can effectively reduce the number of invalid samples in each iteration and greatly improve the efficiency of the boundary black box attack.

[0072] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0073] The methods or devices described in the above embodiments provided in this specification can implement business logic through computer programs and record them on storage media, and the storage media can be read and executed by computers to achieve the effects of the solutions described in the embodiments of this specification, such as:

[0074] Establish the current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack;

[0075] generating a scaling gradient based on the current stage parameters;

[0076] The sample data of the previous iteration is updated by the scaling gradient.

[0077] The storage medium may include a physical device for storing information, which is usually a medium that digitizes information and then stores it in an electrical, magnetic or optical manner. The storage medium may include: a device that stores information in an electrical energy manner, such as various memories, such as RAM, ROM, etc.; a device that stores information in a magnetic energy manner, such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory, a USB flash drive; a device that stores information in an optical manner, such as a CD or a DVD. Of course, there are other readable storage media, such as quantum memory, graphene memory, etc.

[0078] The embodiments of this specification are not limited to complying with industry communication standards, standard computer resource data update and data storage rules, or the situations described in one or more embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the custom method or embodiment can also achieve the same, equivalent or similar, or predictable implementation effects after deformation of the above-mentioned embodiments. The embodiments obtained by using these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of the embodiments of this specification.

[0079] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a computer-readable medium such as a microprocessor or processor and a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, ATMEL AT91SAM, MICROCHIP PIC18F26K20, and SILICONE LABS C8051F320. The memory controller can also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules for implementing the method and structures within the hardware component.

[0080] The device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. There may be other divisions in actual implementation, such as multiple units or plug-ins may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interface, indirect coupling or communication connection of the device or unit, which may be electrical, mechanical or other forms.

[0081] These computer program instructions may also be loaded onto a computer or other programmable resource data updating device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0082] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0083] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. An invalid sample optimization method for black-box attack on video model boundaries, characterized in that: The method comprises: Establish the current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack; generating a scaling gradient based on the current stage parameters; Update the sample data of the previous iteration by the scaling gradient; The current stage parameters are established according to the number of visits to the video model by the current iteration of the boundary black box attack. Specifically, the current stage parameters are established by the following formula: ， In the formula, p is the current stage parameter, is the minimum constant value of the pre-established phase parameter, are the initial constant values ​​of the pre-established phase parameters, q is the number of times the video model is visited, d is the decay rate constant value; Among them, the scaling gradient is generated by the following formula: ， In the formula, is the scaling gradient, p is the current stage parameter, g The gradient generated for the current iteration; The sample data of the previous iteration is updated by the scaling gradient, and the sample data of the previous iteration is updated by the following formula: ， In the formula, is the updated sample data, is the sample data of the previous iteration, is the step length.

2. The invalid sample optimization method for the black box attack on the video model boundary as claimed in claim 1 is characterized in that: If the current iteration is the first iteration, the sample data will not be updated.

3. The invalid sample optimization method for video model boundary black box attack as claimed in claim 1, characterized in that: The method further includes correcting the current stage parameter if the current stage parameter is a negative number.

4. The invalid sample optimization method for the black box attack on the video model boundary as claimed in claim 3 is characterized in that: Specifically, the current stage parameters are corrected by the following formula: ， In the formula, p is the current stage parameter, x is a random variable drawn from a Gaussian distribution, is a constant, b is a constant, q is the number of times the video model is visited, d is the decay rate constant value, are the initial constant values ​​of pre-established phase parameters.

5. The invalid sample optimization method for video model boundary black box attack as claimed in claim 1, characterized in that: After establishing the current stage parameters, the method further includes adjusting the current stage parameters by the following formula: ， In the formula, is the adjusted current stage parameter, p is the current stage parameter before adjustment, r is the preset adjustment radius constant, y is a random variable drawn from a Gaussian distribution.

6. An invalid sample optimization device for black box attack on video model boundaries, characterized in that: The device comprises: Establishing a module for establishing current stage parameters according to the number of visits to the video model by the current iteration of the boundary black box attack; A generation module, used for generating a scaling gradient based on the current stage parameters; An updating module, used for updating the sample data of the previous iteration by using the scaling gradient; The current stage parameters are established according to the number of visits to the video model by the current iteration of the boundary black box attack. Specifically, the current stage parameters are established by the following formula: ， In the formula, p is the current stage parameter, is the minimum constant value of the pre-established phase parameter, are the initial constant values ​​of the pre-established phase parameters, q is the number of times the video model is visited, d is the decay rate constant value; Among them, the scaling gradient is generated by the following formula: ， In the formula, is the scaling gradient, p is the current stage parameter, g The gradient generated for the current iteration; The sample data of the previous iteration is updated by the scaling gradient, and the sample data of the previous iteration is updated by the following formula: ， In the formula, is the updated sample data, is the sample data of the previous iteration, is the step length.

Images