A local pixel perturbation black-box attack method based on DQN

Abstract

A local pixel perturbation black box attack method based on DQN; including: defining the adversarial attack problem as a multi-objective optimization problem; using the attention mechanism to fuse the high-level features and shallow-level features of the original image to obtain fused features, clustering the fused features to calculate the saliency binary mask of the original image, and then determining its key area; designing and training an autoencoder about the original image; using the obtained autoencoder to compress the key area of ​​the original image, compressing the pixel space into a latent space; using Deep Q Network (DQN) to solve the multi-objective optimization problem, learning to find the best strategy for generating adversarial samples that can balance multiple optimization goals; finally, using the learned best strategy to generate adversarial samples. The present invention uses an image classification model based on a deep neural network as the target model of the black box attack, constructs adversarial samples by solving the multi-objective optimization problem, and realizes an efficient and concealed black box attack on the target model.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning technology, and in particular to a black box attack method based on DQN (Deep Q Network). Background Art

[0002] Although deep neural networks have achieved amazing results in many fields, relevant research shows that deep neural networks are vulnerable to adversarial examples. Based on the visibility of the target model, these attacks can be divided into white-box attacks and black-box attacks. Although current research has been able to construct adversarial examples with small perturbations and good attack effects in white-box attack scenarios, it is still challenging to generate more natural adversarial examples in black-box environments.

[0003] Currently, in black-box attacks, the three key indicators for evaluating adversarial samples are: attack success rate, number of queries to the target model, and degree of image distortion. Existing query-based black-box attacks usually require a large number of queries in pixel space to maintain a high attack success rate (Bai Y, Wang Y, Zeng Y, et al. Query efficient black-box adversarial attack on deep neural networks. Pattern Recognition, 133 (2023): 109037.). In addition, generating adversarial samples with higher visual quality while maintaining a high attack success rate is also a difficulty in current research (Duan M, Qin Y, Deng J, et al. Dual attention adversarial attacks with limited perturbations. IEEE Transactions on Neural Networks and Learning Systems, 2023, 1-15.).

[0004] In summary, the problems of the existing technology are: First, the naturalness and effectiveness of adversarial samples under black-box attacks. While maintaining a high attack success rate, the current methods often have difficulty in generating adversarial samples with a more natural appearance, which limits their usability in practical applications. Second, the large amount of query and computational overhead not only reduces the efficiency of the attack, but also increases the time cost of generating adversarial samples, limiting their feasibility in practice.

[0005] Difficulty in solving the above technical problems: Existing methods often find it difficult to perfectly balance the three aspects of attack success rate, number of queries to the target model, and degree of image distortion. Maintaining a high attack success rate will inevitably increase query overhead or sacrifice the naturalness of adversarial samples. Therefore, they can only make trade-offs in various aspects. Summary of the invention

[0006] In view of the problems existing in the prior art, the present invention provides a local pixel perturbation black-box attack method based on DQN.

[0007] The present invention implements a local pixel perturbation black box attack method based on DQN, the method comprising:

[0008] The first step is to define the adversarial attack problem as a multi-objective optimization problem;

[0009] In the second step, the attention mechanism is used to fuse the high-level features and shallow-level features of the original image to obtain fused features, and the fused features are clustered to calculate the saliency binary mask of the original image, thereby determining its key areas.

[0010] The third step is to design and train the autoencoder for the original image;

[0011] The fourth step is to use the obtained autoencoder to compress the key areas of the original image and compress the pixel space into the latent space;

[0012] Step 5: In the latent space, use DQN to solve the multi-objective optimization problem and learn to find the best strategy for generating adversarial samples that can balance multiple optimization objectives.

[0013] Step 6: Generate adversarial samples using the learned optimal strategy.

[0014] The advantages and positive effects of the present invention are as follows: the present invention defines the adversarial sample generation problem as a multi-objective optimization problem, and makes a compromise between the two evaluation indicators of attack success rate and disturbance size; by modifying only the local pixel values ​​of the image, the image distortion is effectively reduced, thereby generating higher quality adversarial samples; the pixel space is compressed into the image latent space, and the attacker's high stability and good convergence are obtained; and reinforcement learning is used to enable the attacker to generate adversarial samples for most original images in a limited number of steps, thereby improving query efficiency.

[0015] The present invention will be further described below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of a DQN-based local pixel perturbation black box attack method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0018] In order to solve the problem that the query calculation of query-based black-box attack is too high and the generated adversarial sample image is highly distorted, the present invention provides a local pixel perturbation black-box attack method based on DQN, which can be used for black-box attacks in general scenarios.

[0019] The significance of the invention is that it can provide a new black-box adversarial attack method, which defines the adversarial sample generation problem as a multi-objective optimization problem, and optimizes the compromise between the prediction error and the perturbation size of the target model. These two indicators reflect the attack success rate and the degree of image distortion to a certain extent. By modifying only the local pixel values ​​of the image, the image distortion is effectively reduced, thereby generating higher quality adversarial samples. At the same time, the use of reinforcement learning allows the attacker to generate adversarial images for most adversarial samples in a limited number of steps, which improves the query efficiency and brings new inspiration to the field of adversarial attack research.

[0020] The application principle of the present invention is described in detail below in conjunction with the accompanying drawings.

[0021] like Figure 1 As shown, a local pixel perturbation black box attack method based on DQN provided by an embodiment of the present invention specifically includes the following steps:

[0022] S101: Define the adversarial attack problem as a multi-objective optimization problem;

[0023] S102: using the attention mechanism to fuse the high-level features and shallow-level features of the original image to obtain fused features, clustering the fused features to calculate the saliency binary mask of the original image, and then determining its key areas;

[0024] S103: Design and train an autoencoder for the original image;

[0025] S104: compressing the key area of ​​the original image using the obtained autoencoder to compress the pixel space into the latent space;

[0026] S105: Using DQN to solve multi-objective optimization problems in latent space, learning to find the best strategy for generating adversarial samples that can balance multiple optimization objectives;

[0027] S106: Generate adversarial samples using the learned optimal strategy.

[0028] The embodiment of the present invention provides a DQN-based local pixel perturbation black box attack method, which specifically includes the following steps:

[0029] Step 1: Define the adversarial attack problem as a multi-objective optimization problem. This method aims to generate adversarial samples that simultaneously meet two objectives: one is to maximize the difference between the target model's prediction of the adversarial sample and the true result; the other is to minimize the difference between the adversarial sample and the original image, that is, to make the adversarial sample have a high degree of similarity with the original image under human observation. The above two optimization objectives can be formalized as formula (1):

[0030]

[0031] Where T is the target model of the attack, is the adversarial sample x about the original image, y is the true category of the classification, δ F represents the perturbation added in the key area of ​​the image, ||·|| p Indicates l p norm, L() represents the cross entropy loss function, MSE() represents the mean square error loss function, and En() represents the encoder of the original image. The constraints are:

[0032] x=B+F (2)

[0033] ||δ F ||2≤c1 (3)

[0034] ||δ F || ∞ ≤c2 (4)

[0035] Wherein formula (2) represents the image partition constraint, x is the original image, B and F represent the background area and key area of ​​the image respectively. Formula (3) and formula (4) represent the l2 norm and l2 norm of the adversarial perturbation respectively. ∞ The norms should be smaller than the perturbation thresholds c1 and c2, respectively, to ensure low visual perceptibility of adversarial samples.

[0036] Step 2: Use the attention mechanism to fuse the high-level features and shallow-level features of the original image to obtain fused features, cluster the fused features to calculate the saliency binary mask of the original image, and then determine its key areas; specifically, the following steps are included:

[0037] (1) Using the deep convolution and shallow convolution in the pre-trained image feature extractor F(·), we extract features from the original image and obtain high-level features feature_h and shallow features feature_l;

[0038] (2) Use the attention mechanism to perform weighted fusion of feature_h and feature_l to generate fusion features, where the attention mechanism can use the Squeeze-and-Excitation module;

[0039] (3) Perform spectral clustering on the fused features to generate a saliency binary mask of the original image, and set the salient area as the key area, otherwise it is the background area; specifically, it includes:

[0040] 1) Set the number of clusters and use spectral clustering to cluster the fusion features;

[0041] 2) Convert the clustering results into one-hot encoding, i.e., saliency binary mask;

[0042] 3) Using the nearest neighbor interpolation method, the size of the saliency binary mask is adjusted to the original image size, and the adjusted result is recorded as S, that is, in Represents the pixel position in the original image x;

[0043] 4) Observe the distribution of the original image dataset. If it basically satisfies the center prior, make the following adjustments to the saliency binary mask based on the center prior to prevent the salient area from being inverted with the background area; including:

[0044] ①Definition And define the center pixel position as

[0045] ② Calculate the sum of the geometric distances from the pixels in S0 and S1 to the central pixel:

[0046]

[0047] ③If d1≥d0, then:

[0048] 5) The pixels belonging to S1 are marked as key areas, which are considered to be visually different from other parts, and the key area matrix is ​​defined as:

[0049]

[0050] The pixels belonging to S0 are classified as the background area, representing the relatively less prominent part of the image, and the background area matrix is ​​defined as:

[0051]

[0052] And the dimensions of KM and NM are the same as the original image x, which are h×w×c.

[0053] Step 3: Design and train the autoencoder for the original image;

[0054] The specific steps include:

[0055] (1) Initialize the autoencoder. During the encoding process, the encoder continuously reduces the dimension of the input, converting the n-dimensional pixel matrix x = [z1, z2, …, z n ] is converted to a feature vector v = [v1, v2, …, v m ], m is the dimension of the feature vector, this process can be formalized as formula (8):

[0056] v=En(x) (8)

[0057] Where En(·) represents the encoder. The decoder increases the dimension of the feature vector and restores v to a matrix x′ with the same dimension as the input. This process can be formalized as formula (9):

[0058] x′=De(v) (9)

[0059] Here, De(·) represents a decoder.

[0060] (2) Training of the autoencoder. The encoder and decoder are continuously trained using the mean square error loss function of the input and output. The training loss function of the autoencoder can be formalized as formula (10):

[0061] L = MSE(x′,x) (10)

[0062] Update the autoencoder parameters according to formula (11):

[0063]

[0064] Among them, η represents the learning rate, w is the model parameter, Represents the gradient of the loss function L with respect to the parameter w.

[0065] Step 4: Use the autoencoder trained in step 3 to compress the key area of ​​the original image and compress the pixel space into the latent space; specifically, the key area matrix KM is used as the input of the encoder, and the m-dimensional feature vector v is obtained through formula (8).

[0066] Step 5: In the latent space, use DQN to solve the multi-objective optimization problem and learn to find the best strategy for generating adversarial samples that can balance multiple optimization objectives.

[0067] The specific steps include:

[0068] (1) Define the two core elements of DQN: state and action; specifically:

[0069] 1) Define the initial state space where v i (i∈{1,2,…,N}) is the eigenvector corresponding to the key region matrix of the original image, and N is the number of original images;

[0070] 2) Set the action space as a set of state modification methods. Since any change to any dimension element of the current state vector will affect the subsequent state, the actions acting on the state are defined as two sets of orthogonal bases:

[0071] ① Right now and (j∈{1,2,…,m} and j≠i), where α is a constant. The execution effect of this action is:

[0072]

[0073] ② Right now and The execution effect of this action is:

[0074]

[0075] (2) Design a suitable reward function so that the agent can simultaneously meet the two optimization goals as much as possible during the training process, including: using the query results of the target model and the perturbation norm of the adversarial sample and the original image to design the reward function, and define the reward function formula as follows:

[0076]

[0077] where T(x) = {p1, p2, …, p num} represents the query result of input x on the target model T, p i (i∈{1,2,…,num}) represents the probability that the target model classifies the input into the i-th category (num is the number of classification categories), y is the target category, p y is the probability that the target model classifies the new sample x′ as the true category, p max is the maximum value of the probability that the target model classifies the new sample x′ as a category other than the true category. k is a large constant that serves as a reward for the state that satisfies both the attack success and the perturbation constraints. λ∈(0,1) is the weight coefficient.

[0078] (3) Conduct DQN training process; specifically include:

[0079] 1) Build two neural networks with the same structure: the target Q network and the evaluation Q network.

[0080] 2) Update the evaluation Q network based on the selected action and the feedback reward value; including:

[0081] ①Use ε-greedy strategy to select action a t Acting on the current state v t , get the next state v t+1 =a t (v t ), that is, randomly sampling β∈[0,1]. If β≥ε, then select the set {Q(v,a1,θ),Q(v,a2,θ),…,Q(v,a 2m ,θ)} is applied to the current state; if β < ε, an action is randomly selected to act on the current state, and ε is decayed according to formula (15):

[0082]

[0083] Among them, ε s is the initial value, ε e is the final value of attenuation, step is the current attenuation step number, ε d is the attenuation step length;

[0084] ② Calculate the new state v according to the following formula (16): t+1 The corresponding new sample x′:

[0085] x′=KM′+NM (16)

[0086] in Then the new sample x′ is input into the target model to obtain the query feedback, and the corresponding reward r is calculated according to formula (14): t+1 ;

[0087] ③The quadruple <v t ,a t ,r t+1 ,v t+1 >Also called transition, stored in the playback buffer M;

[0088] ④ Update the evaluation Q network: When iterating each training sample, randomly take out a batch of transitions in the playback buffer to update the evaluation Q network. The target value to be achieved by the evaluation Q network is calculated by the target Q network, as shown in formula (17):

[0089]

[0090] Where θ′ is the parameter of the target θ network, and A is the set of all actions. The loss function for evaluating the Q network is defined as the mean square error loss function, which is formalized as formula (18):

[0091]

[0092] ⑤ Update the target Q network: every h iteration steps, assign the parameters of the evaluation Q network to the target Q network and update the target Q network.

[0093] 3) Save the evaluation Q network.

[0094] Step 6: The method for generating adversarial samples based on the best strategy learned is:

[0095] (1) Calculate the saliency binary mask of the original image according to step 2 to obtain the key area matrix and background area matrix of the original image;

[0096] (2) using the obtained autoencoder to compress the key region matrix of the original image, compressing the pixel space into the latent space, and obtaining the feature vector of the key region matrix;

[0097] (3) Use the best strategy learned in step 5 (evaluation Q network) to add actions to the feature vector, and repeat this process until the maximum number of iterations is reached or the attack termination condition is met;

[0098] (4) The modified feature vector is restored to a pixel matrix with the same dimension as the original image using the obtained autoencoder, and the adversarial sample is obtained according to formula (16).

[0099] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A local pixel perturbation black-box attack method based on DQN, characterized in that: The method comprises: The first step is to define the adversarial attack problem as a multi-objective optimization problem. The first optimization goal is to maximize the difference between the target model's prediction of the adversarial sample and the true result; the second optimization goal is to minimize the difference between the adversarial sample and the original image. In the second step, the attention mechanism is used to fuse the high-level features and shallow-level features of the original image to obtain fused features, and the fused features are clustered to calculate the saliency binary mask of the original image, thereby determining its key areas. The third step is to design and train the autoencoder for the original image; The fourth step is to use the obtained autoencoder to compress the key areas of the original image and compress the pixel space into the latent space; Step 5: In the latent space, use DQN to solve the multi-objective optimization problem and learn to find the best strategy for generating adversarial samples that can balance multiple optimization objectives. In the sixth step, when conducting a black box attack, the key areas of the original image obtained in the second step are compressed, and after generating the feature vector, the best strategy is implemented to add actions; then, the feature vector after adding the action is restored using the autoencoder, and the restored feature vector is compared with the original image and the background is added to finally generate an adversarial sample.

2. The DQN-based local pixel perturbation black-box attack method according to claim 1, characterized in that: The first step defines the adversarial attack problem as a multi-objective optimization problem. The first optimization goal is to maximize the difference between the target model's prediction of the adversarial sample and the true result; the second optimization goal is to minimize the difference between the adversarial sample and the original image. Specifically, it includes: This method aims to generate adversarial samples that simultaneously meet two objectives: one is to maximize the difference between the target model's prediction of the adversarial sample and the true result; the other is to minimize the difference between the adversarial sample and the original image, that is, to make the adversarial sample have a high degree of similarity with the original image under human observation. The above two optimization objectives can be formalized as formula (1): Where T is the target model of the attack, is the adversarial sample about the original image x, y is the true category of the classification, δ F represents the perturbation added in the key area of ​​the image, ||·|| p Indicates l p norm, L( ) represents the cross entropy loss function, MSE( ) represents the mean square error loss function, En( ) represents the encoder of the original image; the constraints are: x=B+F (2) ||d F ||2≤c1 (3) ||d F || ∞ ≤c2 (4) Wherein formula (2) represents the image partition constraint, x is the original image, B and F represent the background area and key area of ​​the image respectively, and formula (3) and formula (4) represent the l2 norm and l2 norm of the adversarial perturbation respectively. ∞ The norms should be smaller than the perturbation thresholds c1 and c2, respectively, to ensure low visual perceptibility of adversarial samples.

3. The DQN-based local pixel perturbation black-box attack method according to claim 1, characterized in that: The second step uses the attention mechanism to fuse the high-level features and shallow-level features of the original image to obtain fused features, clusters the fused features to calculate the saliency binary mask of the original image, and then determines its key areas; specifically includes: (1) Using the deep convolution and shallow convolution in the pre-trained image feature extractor F(·), we extract features from the original image to obtain high-level features feature_h and shallow features feature_l; (2) Use the attention mechanism to perform weighted fusion of feature_h and feature_l to generate fusion features; (3) Perform spectral clustering on the fused features to generate a saliency binary mask of the original image and set the salient area as the key area, otherwise it is the background area.

4. The DQN-based local pixel perturbation black-box attack method according to claim 1, characterized in that: The fifth step uses DQN to solve the multi-objective optimization problem in the latent space, and learns to find the best strategy for generating adversarial samples that can balance multiple optimization objectives; specifically, it includes: (1) Define the two core elements of DQN: state and action; (2) Design a suitable reward function so that the agent can simultaneously meet multiple optimization objectives as much as possible during the training process; (3) Conduct DQN training process.

5. The DQN-based local pixel perturbation black-box attack method according to claim 4, characterized in that: Further comprising: designing a reward function using the query result of the target model and the perturbation norm of the adversarial sample and the original image, and defining the reward function formula as: where T(x) = {p1, p2, …, p num } represents the query result of input x on the target model T, p i (i∈{1,2,…,num}) represents the probability that the target model classifies the input into the i-th category (num is the number of classification categories), y is the target category, p y is the probability that the target model classifies the new sample x′ as the true category, p max is the maximum value of the probability that the target model classifies the new sample x′ as a category other than the true category. k is a large constant that serves as a reward for the state that satisfies both the attack success and the perturbation constraints. λ∈(0,1) is the weight coefficient.

6. The DQN-based local pixel perturbation black-box attack method according to claim 1, characterized in that: The sixth step, when performing a black box attack, compresses the key area of ​​the original image obtained in the second step, generates a feature vector, and then implements the best strategy to add an action; then, the feature vector after the action is added is restored by using an autoencoder, and the restored feature vector is compared with the original image and the background is added, and finally an adversarial sample is generated; specifically, it includes: (1) Calculate the saliency binary mask of the original image according to the second step to obtain the key area and background area of ​​the original image; (2) Using the obtained autoencoder to compress the key area of ​​the original image, compress the pixel space into the latent space, and obtain the feature vector of the key area; (3) Use the best strategy learned in step 5 to add actions to the feature vector, and repeat this process until the maximum number of iterations is reached or the attack termination condition is met; (4) The modified feature vector is restored to a pixel matrix with the same dimension as the original image using the obtained autoencoder, and then the matrix is ​​compared with the key area, and the processed matrix is ​​added to the background area to obtain the adversarial sample.

Images