An integrated search black-box attack method for robustness detection of deep learning models

Abstract

The present invention proposes an integrated search black-box attack method for robustness detection of deep learning models. The implementation steps are as follows: obtaining a set of low-noise perturbation images; constructing an integrated search model; searching the integrated search model; obtaining black-box attack results; and updating the number of perturbation pixels and weight parameters. The present invention searches an integrated search model constructed to contain multiple proxy models, and optimizes the low-noise perturbation images obtained through the search using a weighted set loss function to obtain optimized low-noise perturbation images with high mobility, thereby improving the success rate of model robustness detection. Furthermore, a category query is performed on each optimized low-noise perturbation image. By updating the number of perturbation pixels and weight parameters, and updating the weight parameters of a proxy model, the low-noise perturbation image is optimized in the direction of deceiving the black-box target model, thereby improving the mobility of the low-noise perturbation image and thereby improving the efficiency of model robustness detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of software testing and relates to a black box attack method, specifically to a black box attack method based on integrated search, which can be used to detect the robustness of deep learning models. Background Art

[0002] The most common attack method used by attackers in adversarial attacks is to construct adversarial examples by adding carefully designed, human-imperceptible noise to normal examples. This approach aims to induce machine learning models to misjudge these carefully constructed adversarial examples without interfering with human cognition. Adversarial attacks can be used to test the robustness of deep learning models and improve their security in practical deployments. During the construction of adversarial examples, adversarial attacks can be categorized as white-box or black-box, depending on the amount of information the attacker obtains about the target model. Black-box attacks assume that the attacker has neither the training data nor the model structure used by the black-box target model, nor the specific parameters of the model, but only the model's final prediction results. In this scenario, the target model acts like a black box to the attacker. The attacker can only manipulate the model's inputs and use the final prediction results to probe the black-box target model's sensitivity or to numerically estimate the model's gradient information, thereby guiding the construction of adversarial examples. Black-box attack methods can be categorized as transfer-based black-box attacks, query-based black-box attacks, and transfer-and-query-based black-box attacks. Transfer-based black-box attack methods assume similarity between the proxy model and the black-box target model. They exploit the transferability between the proxy model and the black-box target model to deceive the black-box target model. This means that adversarial examples generated by one model can deceive another model. However, adversarial examples may overfit to the proxy model, resulting in reduced transferability, which in turn affects the success rate of the black-box attack. Unlike transfer-based black-box attack methods, query-based black-box attack methods do not assume similarity between the proxy model and the black-box target model. They typically achieve high attack success rates, but at the expense of the number of queries, which is proportional to the dimensionality of the search space. The number of queries across the entire image space can be very high, requiring millions of queries for a successful attack. This reduced query efficiency further impacts the effectiveness of the black-box attack.

[0003] Black-box attack methods based on migration and query can avoid the technical problem of low adversarial sample migration in black-box attack methods based on migration, and at the same time avoid the technical problem of low query efficiency in black-box attack methods based on query. For example, Chen Ma published Simulating Unknown Target Models for Query-Efficient Black-box in 2021 at the Conference on Computer Vision and Pattern Recognition (CVPR). In Attacks, a black-box attack method based on transfer and query is disclosed. This method uses a pre-trained simulator to generate adversarial samples, where the generated adversarial samples are transferable and can effectively deceive different black-box target models. The main idea is to construct training data in the form of multi-task learning, collect query sequences generated in the process of attacking the proxy model, and use the knowledge distillation loss function based on mean square error to train the simulator in meta-learning; then, the meta-gradient of this loss function is calculated and accumulated from multiple tasks to update the simulator and alleviate the overfitting problem. When attacking a black-box target model that has not been seen in training, the trained simulator can use the classification results fed back by the black-box target model to update the gradient of the simulator to simulate the function of the black-box target model, so as to reduce the number of queries to the black-box target model. The defect of this method is that the number of proxy models used is small, which leads to the overfitting problem of adversarial samples, and then the low transferability of adversarial samples, affecting the success rate of adversarial samples attacking the black-box target model, and thus affecting the success rate of model robustness detection. At the same time, if the classification results fed back by the black-box target model are interfered with by the defense mechanism and contain noise, the gradient of the simulator may deviate from the correct direction, so that the attack effect of the simulator is reduced, resulting in low transferability of adversarial samples generated by the simulator, and a large number of queries on the black-box target model are required, which affects the further improvement of the attack efficiency and ultimately affects the detection efficiency of the model robustness. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide an integrated search black box attack method for deep learning model robustness detection, which is used to solve the technical problems in the prior art of low detection success rate due to low mobility and low detection efficiency due to a large number of queries.

[0005] To achieve the above object, the technical solution adopted by the present invention includes the following steps:

[0006] (1) Obtain a low-noise perturbation image set:

[0007] Get H two-dimensional original images T={T1,T2,....,T h ,....,TH}, and perform low-noise perturbation on K pixels in each original image to obtain H low-noise perturbation images X={x1,x2,…,x h ,…,x H}, where C≥2, H≥1000, Th represents the original image with the number of pixels O, O>K, K≤20, x h Indicates T h The corresponding category is y h Low noise perturbation image of

[0008] (2) Building an integrated search model:

[0009] Construct an integrated search model of N types of proxy models, which are composed of multiple visual geometry group networks VGG, multiple residual neural networks ResNet, multiple dense convolutional networks DenseNet, multiple convolutional transformation networks ConvNext, multiple efficiency networks EfficientNet, multiple regular networks RegNet and multiple heuristic networks Inception in parallel. N ≥ 20, the nth proxy model f n The weight parameter is w n ,and

[0010] (3) Search the integrated search model:

[0011] Take H low-noise perturbation images X as the input of the integrated search model, and the nth proxy model performs a h Perform category search and determine x h Search categories The corresponding true category y h Is it satisfied If so, let x h The optimization result x h ′=x h , execute step (4), otherwise, the low noise perturbation image x is calculated by weighted set loss function h Optimize and obtain the optimized low-noise perturbation image set X′={x′1,x′2,...,x′ h ,...,x′ H}, execute step (4); where the low noise disturbance image x h The optimization formula is:

[0012]

[0013]

[0014]

[0015]

[0016]

[0017] Among them, x h ′ represents x h The optimization result of , L′ represents the weighted loss value of the integrated search model, represents the loss value of the nth proxy model, represents the predicted category obtained by inputting the hth low-noise perturbation image into the nth proxy model, p n represents the predicted probability that the h-th low-noise perturbation image belongs to category C;

[0018] (4) Obtaining black box attack results:

[0019] The optimized low-noise perturbation image set X′ is used as the input of the black box target model to be attacked. h ' Perform R queries of the category and judge x h ′Category c of each query h The corresponding true category y h Does it satisfy c h ≠y h If so, then x h ′ is regarded as a successful adversarial sample, otherwise, judge R≤5, if so, execute step (5), otherwise, the attack fails;

[0020] (5) Update the number of perturbed pixels and weight parameters:

[0021] For the number of perturbation pixels K and weight parameter w n Perform an update to generate a low-noise perturbation image with updated parameters, and execute step (4).

[0022] Compared with the prior art, the present invention has the following advantages:

[0023] (1) The present invention searches through an integrated search model constructed with multiple proxy models, and optimizes the low-noise perturbation image obtained through the search through a weighted set loss function to obtain an optimized low-noise perturbation image with high mobility. This avoids the problem of overfitting of the proxy model in the process of black-box attack in the prior art, effectively improves the success rate of black-box attack, and further improves the detection success rate of model robustness.

[0024] (2) In the process of performing category query on each optimized low-noise perturbation image by using the optimized low-noise perturbation image set as the input of the black-box target model to be attacked, when the termination condition is not met, the present invention reduces the influence of the query category with noise on the low-noise perturbation image by updating the number of perturbation pixels and the weight parameters, and updating the weight parameters of a proxy model each time, so that the low-noise perturbation image is optimized in the direction of deceiving the black-box target model, improves the mobility of the low-noise perturbation image, and thus reduces the number of queries on the black-box target model, avoids the influence of the existing technology on the query efficiency caused by the deviation of the update of the simulator gradient from the correct direction, effectively improves the efficiency of the attack, and thus improves the detection efficiency of the model robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is an implementation flow chart of the present invention. DETAILED DESCRIPTION

[0026] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0027] Reference Figure 1 , the present invention comprises the following steps:

[0028] Step 1) Obtain a low-noise perturbation image set:

[0029] Get H two-dimensional original images T={T1,T2,....,T h ,....,T H}, and perform low-noise perturbation on K pixels in each original image to obtain H low-noise perturbation images X={x1,x2,…,x h ,…,x H}, where C≥2, H≥1000, T h represents the original image with the number of pixels O, O>K, K≤20, x h Indicates T h The corresponding category is y h Low-noise perturbation image, in this embodiment, C = 100, H = 1000, O = 65536, K = 20;

[0030] In order to address the drawback of existing technologies that focus on optimizing the size of disturbances, resulting in uncertain locations for adding disturbances, the low-noise disturbance of the present invention can determine the location of disturbances to produce less disturbances, thereby enhancing the imperceptibility of human visual perception and improving the success rate of attacks. The method of adding low-noise disturbances is determined based on two characteristics of the disturbance, namely the disturbance amplitude and the disturbance location. The disturbance of each pixel is decomposed into the product of two variables: the amplitude of the disturbance and the binary selection factor. If the selection factor is 1, one pixel is disturbed. If the selection factor is 0, no disturbance is added. Low-noise disturbances are performed on K pixels in each original image. The disturbance formula is:

[0031]

[0032] ε h =δ⊙G

[0033] st.I T G=K,G∈{0,1} N

[0034] Among them, δ∈R N represents the disturbance amplitude, R N represents an N-dimensional real vector, G∈{0,1} N represents the perturbation position, L represents the cross entropy loss function, ⊙ represents the quadrature, ||·||2 represents the Euclidean norm, ε h Indicates that in T h The disturbance added on T G=K means K pixels are disturbed, I T Represents the transpose operation of the identity matrix.

[0035] T h The corresponding low-noise perturbation image x h , whose expression is:

[0036] x h =T h +ε h

[0037] Among them, ε h Indicates T h Added disturbances;

[0038] Step 2) Build an integrated search model:

[0039] Construct an integrated search model of N types of proxy models, which are composed of multiple visual geometry group networks VGG, multiple residual neural networks ResNet, multiple dense convolutional networks DenseNet, multiple convolutional transformation networks ConvNext, multiple efficiency networks EfficientNet, multiple regular networks RegNet and multiple heuristic networks Inception in parallel. N ≥ 20, the nth proxy model f n The weight parameter is w n ,and

[0040] The constructed integrated search model includes the multi-class visual geometry group network VGG, which includes VGG13, VGG16, and VGG19; VGG13 includes five cascaded basic blocks consisting of two stacked convolutional layers, three fully connected layers, and a softmax layer; VGG16 includes five cascaded basic blocks consisting of three stacked convolutional layers, three fully connected layers, and a softmax layer; VGG19 includes five cascaded basic blocks consisting of four stacked convolutional layers, three fully connected layers, and a softmax layer;

[0041] Multi-class residual neural network ResNet includes ResNet18, ResNet50 and WideResNet50; ResNet18 includes four cascaded basic blocks, average pooling layer, fully connected layer and softmax layer, where each basic block includes two stacked residual modules BasicBlock, and the residual module BasicBlock includes two stacked convolutional layers; ResNet50 includes four cascaded basic blocks, average pooling layer, fully connected layer and softmax layer, where the first, second, third and fourth basic blocks respectively include two stacked residual modules BottleNeck, three residual modules Block BottleNeck, four residual modules BottleNeck, six residual modules BottleNeck, BasicBlock includes three stacked convolutional layers; WideResNet50 includes four cascaded basic blocks, an average pooling layer, a fully connected layer and a softmax layer, among which the first, second, third and fourth basic blocks respectively include two stacked wide residual modules BottleNeck, three wide residual modules BottleNeck, four wide residual modules BottleNeck, and six wide residual modules BottleNeck, and BottleNeck includes four stacked convolutional layers;

[0042] The multi-class dense convolutional network DenseNet includes DenseNet161, DenseNet169 and DenseNet201; DenseNet161 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer, and the DenseBlock modules of the first, second, third and fourth basic blocks respectively include stacked six residual modules BottleNeck, twelve residual modules BottleNeck, thirty-six residual modules BottleNeck, and twenty-four residual modules BottleNeck, BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer; DenseNet169 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer, and the first, second, third, The DenseBlock module of the fourth basic block includes six stacked residual modules BottleNeck, twelve residual modules BottleNeck, thirty-two residual modules BottleNeck, and thirty-two residual modules BottleNeck, respectively. BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer. DenseNet201 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer, and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer. The DenseBlock modules of the first, second, third, and fourth basic blocks include six stacked residual modules BottleNeck, twelve residual modules BottleNeck, forty-eight residual modules BottleNeck, and thirty-two residual modules BottleNeck, respectively. BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer.

[0043] The multi-class convolutional transformation network ConvNext includes ConvNextSmall, ConvNextLarge and ConvNextHuge; ConvNextSmall includes four cascaded basic blocks consisting of three stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer; ConvNextLarge includes four cascaded basic blocks consisting of six stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer; ConvNextHuge includes four cascaded basic blocks consisting of nine stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer, where each inverse bottleneck layer includes four stacked convolutional layers, where the first and last convolutional layers are point convolution, the second convolutional layer is grouped convolution, and the third convolutional layer is depth convolution;

[0044] The multi-class efficiency network EfficientNet includes EfficientNetB0, EfficientNetB4 and EfficientNetB7; EfficientNetB0 includes seven cascaded basic blocks consisting of one or two stacked inverse bottleneck layers, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; EfficientNetB4 includes seven cascaded basic blocks consisting of two to six stacked inverse bottleneck layers, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; EfficientNetB7 includes seven cascaded basic blocks consisting of three to ten stacked inverse bottleneck layers, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; wherein each inverse bottleneck layer includes three stacked convolutional layers, the first and last convolutional layers are point convolutions, and the second convolutional layer is depth convolution;

[0045] The multi-class regular network RegNet includes RegNetx400, RegNety400 and RegNetz400; RegNetx400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; RegNety400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; RegNetz400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; each residual module includes two stacked convolutional layers, the first convolutional layer is a point convolution and the second convolutional layer is a depth convolution;

[0046] The multi-class heuristic swarm network Inception includes Inceptionv3 and Inceptionv4. Inceptionv3 includes eleven cascaded basic blocks consisting of one or more stacked Inception modules, a global average pooling layer, a Dropout layer, a fully connected layer, and a softmax layer. Inceptionv4 includes eleven cascaded basic blocks consisting of one or more stacked Inception modules or Residual-Inception modules, a global average pooling layer, a Dropout layer, a fully connected layer, and a softmax layer. Each Inception module includes four parallel branches, each branch includes different types and numbers of convolutional layers or pooling layers, and finally the outputs of the four branches are spliced ​​together along the channel direction.

[0047] Step 3) Search the integrated search model:

[0048] Take H low-noise perturbation images X as the input of the integrated search model, and the nth proxy model performs a h Perform category search and determine x h Search categories The corresponding true category y h Is it satisfied If so, let x h The optimization result x′ h =x h , execute step (4), otherwise, the low noise perturbation image x is calculated by weighted set loss function h Optimize and obtain the optimized low-noise perturbation image set X′={x′1,x′2,...,x′ h ,...,x′ H}, execute step (4);

[0049] The nth proxy model performs a category search on each low-noise perturbation image. This is achieved by: the five basic blocks cascaded from VGG13, VGG16, and VGG19 are used as feature extraction layers to extract features of the low-noise perturbation image; three fully connected layers convert the features of the low-noise perturbation image into category probabilities; the softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category;

[0050] The four cascaded basic blocks in ResNet18, ResNet50, and WideResNet50 serve as feature extraction layers to extract features of low-noise perturbation images. The average pooling layer reduces the dimensionality of the features of the low-noise perturbation images. The fully connected layer converts the reduced dimensionality features into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the highest probability as the search category.

[0051] The three cascaded basic blocks in DenseNet161, DenseNet169, and DenseNet201 serve as feature extraction layers to extract features of low-noise perturbation images. The global average pooling layer reduces the dimensionality of the features of the low-noise perturbation images. The fully connected layer converts the reduced dimensionality features into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

[0052] The four cascaded basic blocks in ConvNextSmall, ConvNextLarge, and ConvNextHuge serve as feature extraction layers to extract features of the low-noise perturbation image. The global average pooling layer reduces the dimensionality of the low-noise perturbation image features to a vector. The fully connected layer converts the reduced dimensionality vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

[0053] The seven cascaded basic blocks in EfficientNetB0, EfficientNetB4, and EfficientNetB7 serve as feature extraction layers to extract features of low-noise perturbation images. The global average pooling layer reduces the features of the low-noise perturbation image to a vector. The dropout layer randomly discards some features of the low-noise perturbation image. The fully connected layer converts the reduced-dimensional vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

[0054] The four cascaded basic blocks in RegNetx400, RegNety400, and RegNetz400 serve as feature extraction layers to extract features from low-noise perturbation images. The global average pooling layer reduces the dimensionality of the low-noise perturbation image features to a vector. The fully connected layer converts the reduced dimensionality vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

[0055] The eleven cascaded basic blocks in Inceptionv3 and Inceptionv4 serve as feature extraction layers to extract features of low-noise perturbation images. The global average pooling layer reduces the features of the low-noise perturbation image to a vector. The dropout layer randomly discards some features of the low-noise perturbation image. The fully connected layer converts the reduced-dimensional vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

[0056] The weighted loss formula is not only applicable to classification tasks with logit or probability vectors, but also to tasks such as target detection and target segmentation. As long as the model loss can be aggregated, the weighted loss shows better optimization performance than the weighted probability and weighted logits. The weighted probability and weighted logits are the outputs after the softmax layer, and their gradients are easily close to zero, which will cause the gradient to disappear and lead to slow perturbation updates. The weighted loss function is the output before the softmax layer, and their gradients are larger, which makes it easier to produce effective perturbations. The weighted set loss function is used to perform the perturbation on the low-noise perturbation image x. h The optimization formula is:

[0057]

[0058]

[0059]

[0060]

[0061]

[0062] Among them, x h ′ represents x h The optimization result of , L′ represents the weighted loss value of the integrated search model, represents the loss value of the nth proxy model, represents the predicted category obtained by inputting the hth low-noise perturbation image into the nth proxy model, p n represents the predicted probability that the h-th low-noise perturbation image belongs to category C;

[0063] Step 4) Obtain the black box attack results:

[0064] The optimized low-noise perturbation image set X′ is used as the input of the black box target model to be attacked. h ' Perform R queries of the category and judge x h ′Category c of each query h The corresponding true category yh Does it satisfy c h ≠y h If so, then x h ′ is regarded as a successful adversarial sample, otherwise, judge R≤5, if so, execute step (5), otherwise, the attack fails;

[0065] Step 5) Update the number of disturbed pixels and weight parameters:

[0066] For the number of perturbation pixels K and weight parameter w n Perform an update to generate a low-noise perturbation image with updated parameters, and execute step (4).

[0067] For the number of perturbation pixels K and weight parameter w n To update, the update formulas are:

[0068] K′=2K

[0069] w′ n =w n +η

[0070] Among them, K′, w′ n Represent K and w respectively n The update result of η represents w n Increased step size.

Claims

1. An integrated search black box attack method for deep learning model robustness detection, characterized by: The steps include: (1) Obtain a low-noise perturbation image set: Get H two-dimensional original images T={T1,T2,....,T h ,....,T H }, and perform low-noise perturbation on K pixels in each original image to obtain H low-noise perturbation images X={x1,x2,…,x h ,…,x H }, where C≥2, H≥1000, T h represents the original image with the number of pixels O, O>K, K≤20, x h Indicates T h The corresponding category is y h Low noise perturbation image of (2) Building an integrated search model: Construct an integrated search model of N types of proxy models, which are composed of multiple visual geometry group networks VGG, multiple residual neural networks ResNet, multiple dense convolutional networks DenseNet, multiple convolutional transformation networks ConvNext, multiple efficiency networks EfficientNet, multiple regular networks RegNet and multiple heuristic networks Inception in parallel. N ≥ 20, the nth proxy model f n The weight parameter is w n ,and (3) Search the integrated search model: Take H low-noise perturbation images X as the input of the integrated search model, and the nth proxy model performs a h Perform category search and determine x h Search categories The corresponding true category y h Is it satisfied If so, let x h The optimization result x h ′=x h , execute step (4), otherwise, the low noise perturbation image x is calculated by weighted set loss function h Optimize and obtain the optimized low-noise perturbation image set X′={x1′,x2′,...,x h ′,...,x′ H }, execute step (4); where the low noise disturbance image x h The optimization formula is: Among them, x h ′ represents x h The optimization result of , L′ represents the weighted loss value of the integrated search model, represents the loss value of the nth proxy model, represents the predicted category obtained by inputting the h-th low-noise perturbation image into the n-th proxy model, represents the predicted probability that the h-th low-noise perturbation image belongs to the c-th category; (4) Obtaining black box attack results: The optimized low-noise perturbation image set X′ is used as the input of the black box target model to be attacked. h ' Perform R queries of the category and judge x h ′Category c of each query h The corresponding true category y h Does it satisfy c h ≠y h If so, then x h ′ is regarded as a successful adversarial sample, otherwise, judge R≤5, if so, execute step (5), otherwise, the attack fails; (5) Update the number of perturbed pixels and weight parameters: For the number of perturbation pixels K and weight parameter w n Perform an update to generate a low-noise perturbation image with updated parameters, and execute step (4).

2. The method according to claim 1, characterized in that The low-noise perturbation of K pixels in each original image in step (1) refers to the perturbation of each original image T h The K pixels that satisfy the following formula are perturbed with low noise, where the formula for low noise perturbation of the pixel at position G is: e h =δ⊙G st.Ι T G=K,G∈{0,1} N Among them, δ∈R N represents the disturbance amplitude, R N represents an N-dimensional real vector, G∈{0,1} N represents the perturbation position, L represents the cross entropy loss function, ⊙ represents the quadrature, ||·||2 represents the Euclidean norm, ε h Indicates that in T h The disturbance added on T G=K means K pixels are disturbed, I T Represents the transpose operation of the identity matrix.

3. The method according to claim 1, characterized in that T described in step (1) h The corresponding low-noise perturbation image x h , whose expression is: x h =T h +e h Among them, ε h Indicates T h Added disturbance.

4. The method according to claim 1, wherein The integrated search model described in step (2), wherein: The multi-class visual geometry group network VGG includes VGG13, VGG16 and VGG19; VGG13 includes five cascaded basic blocks consisting of two stacked convolutional layers, three fully connected layers and a softmax layer; VGG16 includes five cascaded basic blocks consisting of three stacked convolutional layers, three fully connected layers and a softmax layer; VGG19 includes five cascaded basic blocks consisting of four stacked convolutional layers, three fully connected layers and a softmax layer; Multi-class residual neural network ResNet includes ResNet18, ResNet50 and WideResNet50; ResNet18 includes four cascaded basic blocks, average pooling layer, fully connected layer and softmax layer, where each basic block includes two stacked residual modules BasicBlock, and the residual module BasicBlock includes two stacked convolutional layers; ResNet50 includes four cascaded basic blocks, average pooling layer, fully connected layer and softmax layer, where the first, second, third and fourth basic blocks respectively include two stacked residual modules BottleNeck, three residual modules Block BottleNeck, four residual modules BottleNeck, six residual modules BottleNeck, BasicBlock includes three stacked convolutional layers; WideResNet50 includes four cascaded basic blocks, an average pooling layer, a fully connected layer and a softmax layer, among which the first, second, third and fourth basic blocks respectively include two stacked wide residual modules BottleNeck, three wide residual modules BottleNeck, four wide residual modules BottleNeck, and six wide residual modules BottleNeck, and BottleNeck includes four stacked convolutional layers; The multi-class dense convolutional network DenseNet includes DenseNet161, DenseNet169 and DenseNet201; DenseNet161 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer, and the DenseBlock modules of the first, second, third and fourth basic blocks respectively include stacked six residual modules BottleNeck, twelve residual modules BottleNeck, thirty-six residual modules BottleNeck, and twenty-four residual modules BottleNeck, BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer; DenseNet169 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer, and the first, second, third, The DenseBlock module of the fourth basic block includes six stacked residual modules BottleNeck, twelve residual modules BottleNeck, thirty-two residual modules BottleNeck, and thirty-two residual modules BottleNeck, respectively. BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer. DenseNet201 includes four cascaded basic blocks, a global average pooling layer, a fully connected layer, and a softmax layer, wherein each basic block includes a cascaded DenseBlock module and a Transition layer. The DenseBlock modules of the first, second, third, and fourth basic blocks include six stacked residual modules BottleNeck, twelve residual modules BottleNeck, forty-eight residual modules BottleNeck, and thirty-two residual modules BottleNeck, respectively. BottleNeck includes four stacked convolutional layers, and the Transition layer includes a cascaded convolutional layer and an average pooling layer. The multi-class convolutional transformation network ConvNext includes ConvNextSmall, ConvNextLarge and ConvNextHuge; ConvNextSmall includes four cascaded basic blocks consisting of three stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer; ConvNextLarge includes four cascaded basic blocks consisting of six stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer; ConvNextHuge includes four cascaded basic blocks consisting of nine stacked inverse bottleneck layers, a global average pooling layer, a fully connected layer and a softmax layer, where each inverse bottleneck layer includes four stacked convolutional layers, where the first and last convolutional layers are point convolution, the second convolutional layer is grouped convolution, and the third convolutional layer is depth convolution; The multi-class efficiency network EfficientNet includes EfficientNetB0, EfficientNetB4 and EfficientNetB7; EfficientNetB0 includes seven cascaded basic blocks consisting of one or two stacked inverse bottleneck layers, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; EfficientNetB4 includes seven cascaded basic blocks consisting of two to six stacked inverse bottleneck layers, a global average pooling layer, a dropout layer, a fully connected layer and a softmax layer; EfficientNetB7 includes seven cascaded basic blocks consisting of three to ten stacked inverse bottleneck layers, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; wherein each inverse bottleneck layer includes three stacked convolutional layers, the first and last convolutional layers are point convolutions, and the second convolutional layer is depth convolution; The multi-class regular network RegNet includes RegNetx400, RegNety400 and RegNetz400; RegNetx400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; RegNety400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; RegNetz400 includes four cascaded basic blocks consisting of one to six stacked residual modules, a global average pooling layer, a fully connected layer and a softmax layer; each residual module includes two stacked convolutional layers, the first convolutional layer is a point convolution and the second convolutional layer is a depth convolution; The multi-class heuristic swarm network Inception includes Inceptionv3 and Inceptionv4; Inceptionv3 includes eleven cascaded basic blocks consisting of one or more stacked Inception modules, a global average pooling layer, a dropout layer, a fully connected layer and a softmax layer; Inceptionv4 includes eleven cascaded basic blocks consisting of one or more stacked Inception modules or Residual-Inception modules, a global average pooling layer, a Dropout layer, a fully connected layer and a softmax layer; each Inception module includes four parallel branches, each branch includes convolutional layers or pooling layers of different types and numbers, and finally the outputs of the four branches are spliced ​​along the channel direction.

5. The method according to claim 1, wherein The nth proxy model described in step (3) performs a category search on each low-noise perturbation image, and the implementation method is: The five cascaded basic blocks in VGG13, VGG16, and VGG19 serve as feature extraction layers to extract features of low-noise perturbation images. The three fully connected layers convert the features of low-noise perturbation images into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category. The four cascaded basic blocks in ResNet18, ResNet50 and WideResNet50 are used as feature extraction layers to extract features of low-noise perturbation images; The average pooling layer reduces the dimensionality of the low-noise perturbation image features; the fully connected layer converts the reduced dimensionality features into category probabilities; the softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the highest probability as the search category; The three cascaded basic blocks in DenseNet161, DenseNet169, and DenseNet201 serve as feature extraction layers to extract features of low-noise perturbation images. The global average pooling layer reduces the dimensionality of the features of the low-noise perturbation images. The fully connected layer converts the reduced dimensionality features into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category. The four cascaded basic blocks in ConvNextSmall, ConvNextLarge, and ConvNextHuge serve as feature extraction layers to extract features of the low-noise perturbation image. The global average pooling layer reduces the dimensionality of the low-noise perturbation image features to a vector. The fully connected layer converts the reduced dimensionality vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category. The seven cascaded basic blocks in EfficientNetB0, EfficientNetB4, and EfficientNetB7 are used as feature extraction layers to extract features of low-noise perturbation images; The dropout layer randomly discards some features of the low-noise perturbation image; the global average pooling layer reduces the features of the low-noise perturbation image to a vector; the fully connected layer converts the reduced vector into category probabilities; the softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category; The four cascaded basic blocks in RegNetx400, RegNety400, and RegNetz400 serve as feature extraction layers to extract features from low-noise perturbation images. The global average pooling layer reduces the dimensionality of the low-noise perturbation image features to a vector. The fully connected layer converts the reduced dimensionality vector into category probabilities. The softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category. The eleven basic blocks cascaded in Inceptionv3 and Inceptionv4 serve as feature extraction layers to extract features of low-noise perturbation images; The dropout layer randomly discards some features of the low-noise perturbation image; the global average pooling layer reduces the features of the low-noise perturbation image to a vector; the fully connected layer converts the reduced vector into category probabilities; the softmax layer normalizes the category probabilities into a probability vector to obtain the probability distribution of each category, and outputs the category with the maximum probability as the search category.

6. The method according to claim 1, characterized in that The number of disturbed pixels K and weight parameter w described in step (5) n To update, the update formulas are: K′=2K w n ′=w n +n Among them, K′, w n ′ represents K, w n The update result of η represents w n Increased step size.

Images