A method and system for generating adversarial samples of black-box image targets

Abstract

The present invention relates to a method and system for generating a black-box image target adversarial sample, which belongs to the field of deep learning technology and solves the problem of low success rate of existing adversarial sample migration attack. It includes collecting images of non-target attack categories to construct a training set; selecting a model with the same function as the target model as a substitute model; constructing an adversarial sample generator and an image perturbator; iteratively training the adversarial sample generator and the substitute model using the training set, and each training includes in sequence: inputting the training sample into the adversarial sample generator to obtain the first image, then inputting it into the substitute model, calculating the first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain the second image, then inputting it into the substitute model with the training sample, calculating the second loss function and updating the substitute model parameters; inputting the image to be attacked into the adversarial sample generator to obtain the target adversarial sample. The success rate of the target adversarial sample migration attack is improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to a method and system for generating adversarial samples of black-box image targets. Background Art

[0002] In recent years, deep learning technology has achieved outstanding performance in many fields, including computer vision tasks such as image classification, object detection, and image segmentation. However, due to the "unexplainability" of deep learning, its credibility has always attracted widespread attention. With the emergence of adversarial samples, the security of deep learning has also caused people to think more deeply. Image adversarial samples inject perturbations that are difficult for the human eye to detect into clean images, causing deep learning models to produce incorrect predictions.

[0003] On the one hand, adversarial samples can reveal the "vulnerability" of the model and evaluate the robustness of the model; on the other hand, they can promote the development of technologies such as adversarial defense and adversarial training, and improve the security and robustness of deep learning models. Therefore, adversarial sample generation technology can promote deeper development in the field of deep learning technology and gain wider applications.

[0004] Image adversarial sample generation methods can be divided into white-box attacks and black-box attacks according to the available information of the target model. White-box attack methods require information such as the structure and parameters of the target model, which is difficult to obtain in real attack scenarios; black-box attack methods rely less on target model information, among which black-box transfer attack methods based on substitution models are more effective and have attracted the attention of many scholars. This type of method generally directly generates adversarial samples based on the substitution model of the target model using white-box attack methods to achieve black-box transfer attacks. However, because the generated adversarial samples are heavily dependent on the substitution model, the overfitting phenomenon of the adversarial samples is relatively serious, and the success rate of the transfer attack is seriously affected by the selected substitution model. Summary of the invention

[0005] In view of the above analysis, an embodiment of the present invention aims to provide a method and system for generating adversarial samples of black-box images, so as to solve the problem of low success rate of adversarial sample migration attacks directly generated based on substitution models.

[0006] On the one hand, an embodiment of the present invention provides a method for generating a black-box image target adversarial sample, comprising the following steps:

[0007] Collect images of non-target attack categories to build a training set;

[0008] Select a model with the same functionality as the target model as a replacement model; build an adversarial sample generator and copy the adversarial sample generator as an image perturbator;

[0009] Iteratively train the adversarial sample generator and the substitution model using the training set until the training is completed, and each training includes: inputting the training sample into the adversarial sample generator to obtain a first image, inputting the first image into the substitution model, calculating a first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain a second image, inputting the second image and the training sample into the substitution model, calculating a second loss function and updating the substitution model parameters;

[0010] Input the image to be attacked into the trained adversarial sample generator to obtain the target adversarial sample.

[0011] Based on the further improvement of the above method, the adversarial sample generator is copied as an image perturber, that is, the adversarial sample generator after parameter initialization is used as an image perturber; the image perturber parameters remain unchanged during iterative training.

[0012] Based on a further improvement of the above method, the first loss function is calculated by taking the target attack category as the target label, and calculating the difference between the category prediction value of the first image output by the replacement model and the target label based on the cross entropy loss function.

[0013] Based on the further improvement of the above method, the second loss function is calculated by taking the image category corresponding to the training sample as the true image label, and based on the cross entropy loss function, calculating the sum of the differences between the category prediction values ​​of the training sample and the second image output by the replacement model and the true image label.

[0014] Based on the further improvement of the above method, the second loss function is calculated by the following formula:

[0015] L c =ce(D(x),y)+ce(D(G p (x)),y)

[0016] Among them, L c represents the second loss function, ce(·) represents the cross entropy loss function, D(·) represents the alternative model, G P (·) represents the image perturbator, y represents the true image label, and x represents the training sample.

[0017] Based on the further improvement of the above method, the training sample is input into the adversarial sample generator to obtain the first image, and the training sample is input into the image perturber to obtain the second image, and the first image and the second image are obtained by performing image processing on the images output by the adversarial sample generator and the image perturber.

[0018] Based on the further improvement of the above method, the image processing includes: Gaussian smoothing, cropping and standardization in sequence; Gaussian smoothing is to perform a two-dimensional convolution operation on the output image to obtain a smoothed image; cropping is to use a cropping function to make the perturbation of the smoothed image satisfy the perturbation constraint; standardization is to use the mean and standard deviation of the training set to standardize the cropped image to obtain the first image or the second image.

[0019] Based on the further improvement of the above method, in the two-dimensional convolution operation, the input and output are both 3 channels, the convolution kernel size is 3, and the parameters satisfy the Gaussian distribution with a variance of 4.

[0020] Based on the further improvement of the above method, the cropping function is a differentiable function, and the cropped image is obtained by the following formula:

[0021] x adv = Clip(min(max(x perturbed ,x-ε),x+ε))

[0022] Among them, x adv represents the cropped image, x represents the training sample, x perturbed represents the smoothed image, max(·) represents the maximum value function, min(·) represents the minimum value function, Clip(·) represents the clipping function, and ε represents the preset disturbance value.

[0023] On the other hand, an embodiment of the present invention provides a black-box image target adversarial sample generation system, comprising:

[0024] An image acquisition module is used to collect images of non-target attack categories to build a training set;

[0025] A model building module is used to select a model with the same function as the target model as a replacement model; build an adversarial sample generator and copy the adversarial sample generator as an image perturbator;

[0026] A model training module is used to iteratively train the adversarial sample generator and the replacement model using the training set until the training is completed, and each training includes: inputting the training sample into the adversarial sample generator to obtain a first image, inputting the first image into the replacement model, calculating a first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain a second image, inputting the second image and the training sample into the replacement model, calculating a second loss function and updating the replacement model parameters;

[0027] The adversarial sample generation module is used to input the image to be attacked into the trained adversarial sample generator to obtain the target adversarial sample.

[0028] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: by iteratively training the substitution model using the perturbed image and the training sample image, the robustness of the substitution model is improved, and the smoothness of the decision boundary of the substitution model is improved; the perturbation range of the perturbated image is the same as the perturbation range of the adversarial sample, which reduces the overfitting phenomenon of the adversarial sample generated by the adversarial sample generator, and the adversarial sample generator is trained by using the iteratively updated substitution model, which improves the success rate of the adversarial sample migration attack.

[0029] In the present invention, the above-mentioned technical solutions can also be combined with each other to achieve more preferred combination solutions. Other features and advantages of the present invention will be described in the subsequent description, and some advantages can become obvious from the description, or can be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0031] Figure 1 This is a flow chart of a method for generating adversarial samples of black-box image targets in Embodiment 1 of the present invention;

[0032] Figure 2 This is a schematic diagram of model training in Example 1 of the present invention;

[0033] Figure 3 Schematic diagram of the structure of a black-box image target adversarial sample generation system in Example 2 of the present invention. DETAILED DESCRIPTION

[0034] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0035] Example 1

[0036] A specific embodiment of the present invention discloses a method for generating adversarial samples of black-box image targets, such as Figure 1 As shown, the following steps are included:

[0037] S1: Collect images of non-target attack categories to build a training set.

[0038] It should be noted that the target attack category of the target model, that is, the image category of the target adversarial sample attack finally generated, must be determined first. Then, this embodiment constructs a training set by collecting images of non-target attack categories, thereby expanding the category range of the original images, generating diversified target adversarial samples, and improving the attack success rate.

[0039] The images of the non-targeted attack category are 3-channel color images. You can collect them yourself or use image data from public datasets, such as the ImageNet dataset and the PASCAL VOC dataset.

[0040] According to the image size of the input target model, the collected images are unified in size and normalized, and then put into the training set as training samples. Since the size of the training set will affect the training effect of the model, preferably, the training samples in the training set are not less than 50,000.

[0041] S2: Select a model with the same functionality as the target model as a replacement model; construct an adversarial sample generator and copy the adversarial sample generator as an image perturbator.

[0042] It should be noted that the target model is a black box model. The specific model structure is unknown, but the function or task of the target model can be determined, such as image classification, image recognition, image segmentation, etc.

[0043] This embodiment constructs three deep learning models: a substitution model, an adversarial sample generator, and an image perturber; wherein the substitution model is used to simulate the target model; the adversarial sample generator is used to generate adversarial samples; and the image perturber is used to generate perturbed images.

[0044] Specifically, the function of the substitute model is the same as that of the target model, and considering that the selection of the substitute model will affect the effect of the generated adversarial sample transfer attack, the success rate of the adversarial sample transfer attack generated by selecting a substitute model with better performance will be higher, and there is no restriction on the structure and parameters of the substitute model.

[0045] Preferably, in the image classification task, ResNet50 is selected as the alternative model.

[0046] The alternative model is pre-trained using the training set of step S1 or a public dataset.

[0047] It should be noted that the model structure of the adversarial sample generator in this embodiment is not limited. For example, any of the following deep learning models can be selected: VGG, ResNet, Densenet, U-Net. The input and output of the adversarial sample generator are both images. The input and output sizes of the adversarial sample generator are set according to the uniform image size, and the adversarial generator parameters are initialized by random sampling from the Gaussian distribution.

[0048] Preferably, a U-Net model is used as the adversarial sample generator, and the input and output are both 224×224×3, which is the same as the input size of the alternative model. When generating adversarial samples, the adversarial sample generator not only learns the image features of the target category, but also reconstructs the training samples (original images). Because the U-Net model can transfer shallow features to the deep structure of the model, it will speed up the model convergence during the training process.

[0049] It should be noted that copying the adversarial sample generator as an image perturber means using the adversarial sample generator after parameter initialization as the image perturber, that is, the model structure and parameters of the image perturber are the same as those of the adversarial sample generator after parameter initialization.

[0050] S3: Iteratively train the adversarial sample generator and the replacement model using the training set until the training is completed. Each training includes:

[0051] S31, input the training sample into the adversarial sample generator to obtain a first image, input the first image into the substitution model, calculate the first loss function and update the adversarial sample generator parameters;

[0052] S32: Input the training sample into the image perturbator to obtain a second image, input the second image and the training sample into the substitution model, calculate the second loss function and update the substitution model parameters.

[0053] It should be noted that each training in the iterative training of this step includes two steps in sequence, such as Figure 2 As shown, step S31 is to update the adversarial sample generator parameters by reducing the difference between the predicted category of the first image (which can be understood as the adversarial sample) generated by the current adversarial sample generator and the target attack category, so that it generates a first image that improves the attack success rate; step S32 is to retrain the substitute model with the image perturber, and update the substitute model parameters by reducing the difference between the predicted category of the second image (which can be understood as the perturbed image) generated by the image perturber and the original training sample and the real image category.

[0054] That is to say, as the parameters of the substitute model are updated in one iteration, the update of the parameters of the adversarial sample generator in the next iteration is affected; the two models interact and promote each other, gradually reducing the error until convergence. After the image perturber parameters are determined in step S2, the parameters remain unchanged during the iterative training and will not be updated. Because the training set constructed in step S1 is too small compared to the training set of the target model, if the image perturber parameters are constantly updated, the distribution of the perturbed images generated is also in a changing state, making it difficult for the substitute model to converge, and ultimately making it impossible for the adversarial sample generator to converge.

[0055] In step S31, the training sample is input into the adversarial sample generator to obtain a first image, which is obtained by performing image processing on the output image. The image processing includes: Gaussian smoothing processing, cropping processing and normalization processing in sequence.

[0056] Specifically, Gaussian smoothing is to perform a two-dimensional convolution operation on the output image to obtain a smoothed image, which is used to reduce some high-frequency noise in the image, retain image edge information, and improve the mobility of adversarial samples. In the two-dimensional convolution operation, both the input and output are 3 channels, the convolution kernel size is 3, and the parameters satisfy the Gaussian distribution with a variance of 4.

[0057] Since the output of the adversarial generator is formed by adding a small perturbation to the original training sample, the cropping process is to use a cropping function on the smoothed image so that the perturbation of the cropped image satisfies the perturbation constraint.

[0058] It is worth noting that the cropping function is a differentiable function, that is, a differentiable function. Because it is necessary to obtain the parameter gradient of the adversarial sample generator when updating the adversarial sample generator parameters, the cropping process of the output image must be differentiable.

[0059] Specifically, the cropped image is obtained by the following formula:

[0060] x adv = Clip(min(max(x perturbed ,x-ε),x+ε)) Formula (1)

[0061] Among them, x adv represents the cropped image, x represents the training sample, x perturbed represents the smoothed image, max(·) represents the maximum value function, min(·) represents the minimum value function, Clip(·) represents the clipping function, and ε represents the preset perturbation value. The smaller the perturbation value, the closer the cropped image is to the original training sample.

[0062] The perturbation constraint condition is that the perturbation norm of the cropped image is less than or equal to the preset perturbation value. The formula is as follows:

[0063] ||x adv -x|| 1,2,∞ ≤ε formula (2)

[0064] Among them, ||·|| 1,2,∞ Represents 1-norm, 2-norm, or infinity norm.

[0065] Preferably, an infinite norm is selected and the disturbance value is preset to 16.

[0066] Finally, the cropped image is standardized using the mean and standard deviation of the training set using the following formula:

[0067]

[0068] Among them, x' adv represents the image after standardization, that is, the first image in step S31, μ represents the mean value of the image data in the training set, and σ represents the standard deviation of the image data in the training set.

[0069] Exemplarily, images collected from the ImageNet dataset are constructed as a training set, and the mean μ is calculated to be (0.485, 0.456, 0.406) and the standard deviation σ is (0.229, 0.224, 0.225) according to the three-channel values ​​of each training sample in the training set.

[0070] Furthermore, the first image after image processing is output to the substitution model, and the first loss function is calculated by taking the target attack category as the target label, and calculating the difference between the category prediction value of the first image output by the substitution model and the target label based on the cross entropy loss function. The formula is as follows:

[0071] L a =ce(D(G a (x)),y t ) Formula (4)

[0072] Among them, L a represents the first loss function, ce(·) represents the cross entropy loss function, D(·) represents the alternative model, G a (·) represents the adversarial sample generator, y t Represents the target label.

[0073] It should be noted that the first loss function is calculated at the end of the forward propagation, and the adversarial sample generator parameters are updated using the gradient descent method according to the first loss function during the backward propagation. Specifically, the adversarial sample generator parameter gradient is obtained by backward propagation according to the first loss function, and the Adam optimizer is used to update the parameters.

[0074] Preferably, the parameter learning rate in the Adam optimizer is 0.0005, and the exponential decay factors of the first-order and second-order moments of the gradient are 0.5 and 0.999, respectively.

[0075] In step S32, the training sample is input into the image perturbator to obtain a second image, that is, the image output by the image perturbator is processed to obtain the second image. The image processing method is the image processing method in step S31.

[0076] The obtained second image and the corresponding training sample are input into the substitution model together, and the second loss function is calculated by taking the image category corresponding to the training sample as the true image label. Based on the cross entropy loss function, the sum of the differences between the category prediction values ​​of the training sample and the second image output by the substitution model and the true image label is calculated. The formula is as follows:

[0077] L c =ce(D(x),y)+ce(D(G p (x)),y) Formula (5)

[0078] Among them, L c represents the second loss function, G P (·) represents the image perturbator, and y represents the true image label.

[0079] It should be noted that the second loss function is calculated at the end of the forward propagation, and the substitution model parameters are updated using the gradient descent method according to the second loss function during the backward propagation. Specifically, the substitution model parameter gradient is obtained by backward propagation according to the second loss function, and the SGD optimizer is used to update the parameters.

[0080] Preferably, the parameter learning rate in the SGD optimizer is 0.0005, the momentum is 0.9, and the weight decay parameter is 0.0005.

[0081] Finally, when the maximum number of iterations is reached, the iterative training ends and a trained adversarial sample generator is obtained.

[0082] S4: Input the image to be attacked into the trained adversarial sample generator to obtain the target adversarial sample.

[0083] It should be noted that this embodiment does not limit the category of the image to be attacked, but collecting images of non-target attack categories to generate target adversarial samples can better reflect the attack effect of this embodiment. The image to be attacked is input into the trained adversarial sample generator, and the output is also subjected to Gaussian smoothing and cropping to obtain the target adversarial sample that meets the perturbation constraint condition.

[0084] It should be noted that the attack success rate ASR (Attack Success Rate) is calculated using the following formula to evaluate the attack effect:

[0085]

[0086] Among them, the number of samples with successful attacks indicates that the image category of the image to be attacked is not the target label, but the number of generated adversarial samples predicted as the target label by the target model, and the total number of samples indicates the total number of images to be attacked.

[0087] Furthermore, when there are multiple target attack categories, the average attack success rate AASR (Average Attack Success Rate) is calculated by the following formula to evaluate the attack effect:

[0088]

[0089] Where N represents the number of target attack categories, ASR i Represents the attack success rate of the i-th target attack category.

[0090] For example, 10 target categories are randomly selected from the ImageNet dataset, with category numbers 24, 99, 245, 344, 471, 555, 661, 701, 802 and 919, and category names are: Great Gray Owl, Goose, French Bulldog, Hippopotamus, Cannon, Fire Truck, Model T Car, Parachute, Sled and Road Sign. 450 images of non-target attack categories are selected as the attack images. VGG19 is selected BN , DenseNet121, ResNet50, ResNet152 and WRN-50-2 are used as black box target models, all of which perform image classification tasks and are trained using the ImageNet dataset. ResNet50 and VGG19 are selected respectively BN As an alternative model, the U-Net model is used as the adversarial sample generator and image perturbator. Using steps S1-S3, 10 adversarial sample generators are trained for 10 target categories respectively.

[0091] The target adversarial samples generated by 10 adversarial sample generators and 450 images to be attacked are used to attack the black-box target model respectively. The average attack success rate of attacking the 10 targets is calculated and compared with the average attack success rate of the target adversarial samples generated by the existing PGD, MIM, DIM, DIM-TI, Po-TRIP, GAP, and CDA methods. The comparison results are shown in Table 1.

[0092] Table 1 Comparison of average attack success rates between the method in this embodiment and the existing method

[0093]

[0094]

[0095] In Table 1, * indicates the average attack success rate calculated when the model structure of the substitute model is the same as that of the black box target model. At this time, the black box average target attack success rate of the present embodiment method is not much different from that of the existing method. When this is not the case, the black box average target attack success rate of the present embodiment method is significantly improved compared with the existing method.

[0096] Compared with the prior art, the present embodiment discloses a method for generating adversarial samples of black-box image targets, which improves the robustness of the substitute model and the smoothness of the decision boundary of the substitute model by iteratively training the substitute model using perturbation images and training sample images; the perturbation range of the perturbation image is the same as the perturbation range of the adversarial sample, which reduces the overfitting phenomenon of the adversarial sample generated by the adversarial sample generator, and uses the iteratively updated substitute model to train the adversarial sample generator, thereby improving the success rate of the adversarial sample migration attack.

[0097] Example 2

[0098] Another example of the present invention discloses a black-box image target adversarial sample generation system, thereby realizing the black-box image target adversarial sample generation method in Example 1. The specific implementation of each module refers to the corresponding description in Example 1. Figure 3 As shown, the system includes:

[0099] An image acquisition module 101 is used to acquire images of non-target attack categories to construct a training set;

[0100] A model building module 102 is used to select a model with the same function as the target model as a substitute model; build an adversarial sample generator and copy the adversarial sample generator as an image perturbator;

[0101] The model training module 103 is used to iteratively train the adversarial sample generator and the replacement model using the training set until the training is completed, and each training includes: inputting the training sample into the adversarial sample generator to obtain a first image, inputting the first image into the replacement model, calculating the first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain a second image, inputting the second image and the training sample into the replacement model, calculating the second loss function and updating the replacement model parameters;

[0102] The adversarial sample generation module 104 is used to input the image to be attacked into the trained adversarial sample generator to obtain a target adversarial sample.

[0103] Since the black-box image target adversarial sample generation system of this embodiment and the aforementioned black-box image target adversarial sample generation method can refer to each other in their related aspects, they are repeated here and will not be repeated here. Since the principles of this system embodiment and the aforementioned method embodiment are the same, this system embodiment also has the corresponding technical effects of the aforementioned method embodiment.

[0104] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0105] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for generating adversarial samples of black-box image targets, characterized in that: The following steps are involved: Collect images of non-target attack categories to build a training set; Select a model with the same functionality as the target model as a replacement model; Build an adversarial sample generator and copy the adversarial sample generator as an image perturbator; Iteratively train the adversarial sample generator and the substitution model using the training set until the training is completed, and each training includes: inputting the training sample into the adversarial sample generator to obtain a first image, inputting the first image into the substitution model, calculating a first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain a second image, inputting the second image and the training sample into the substitution model, calculating a second loss function and updating the substitution model parameters; Input the image to be attacked into the trained adversarial sample generator to obtain the target adversarial sample.

2. The method for generating adversarial samples of black-box image targets according to claim 1, characterized in that: The copied adversarial sample generator is an image perturber, which uses the adversarial sample generator after parameter initialization as an image perturber; the image perturber parameters remain unchanged during iterative training.

3. The method for generating adversarial samples of black-box image targets according to claim 1, characterized in that: The first loss function is calculated by taking the target attack category as the target label and calculating the difference between the category prediction value of the first image output by the substitution model and the target label based on the cross entropy loss function.

4. The method for generating adversarial samples of black-box image targets according to claim 1, characterized in that: The second loss function is calculated by taking the image category corresponding to the training sample as the real label of the image, and calculating the sum of the differences between the category prediction values ​​of the training sample and the second image output by the substitution model and the real label of the image based on the cross entropy loss function.

5. The method for generating black-box image target adversarial samples according to claim 4, characterized in that: The second loss function is calculated by the following formula: IT c =what(D(x),y)+what(D(G p (x)),y) Among them, L c represents the second loss function, ce(·) represents the cross entropy loss function, D(·) represents the alternative model, G P (·) represents the image perturbator, y represents the true image label, and x represents the training sample.

6. The method for generating adversarial samples of black-box image targets according to claim 1, characterized in that: The step of inputting the training sample into the adversarial sample generator to obtain the first image and the step of inputting the training sample into the image perturber to obtain the second image is to obtain the first image and the second image after performing image processing on the images output by the adversarial sample generator and the image perturber.

7. The method for generating black-box image target adversarial samples according to claim 6, characterized in that: The image processing includes: Gaussian smoothing, cropping and standardization in sequence; the Gaussian smoothing is to perform a two-dimensional convolution operation on the output image to obtain a smoothed image; the cropping is to use a cropping function to perturb the smoothed image so that the perturbation of the cropped image satisfies the perturbation constraint condition; the standardization is to use the mean and standard deviation of the training set to perform standardization on the cropped image to obtain the first image or the second image.

8. The method for generating black-box image target adversarial samples according to claim 7, characterized in that: In the two-dimensional convolution operation, both the input and output have 3 channels, the convolution kernel size is 3, and the parameters satisfy the Gaussian distribution with a variance of 4.

9. The method for generating black-box image target adversarial samples according to claim 7, characterized in that: The cropping function is a differentiable function, and the cropped image is obtained by the following formula: x adv =Clip(min(max(x perturbed ,x-e),x+e)) Among them, x adv represents the cropped image, x represents the training sample, x perturbed represents the smoothed image, max(·) represents the maximum value function, min(·) represents the minimum value function, Clip(·) represents the clipping function, and ε represents the preset disturbance value.

10. A black-box image target adversarial sample generation system, characterized in that: include: An image acquisition module is used to collect images of non-target attack categories to build a training set; A model building module is used to select a model with the same function as the target model as a replacement model; build an adversarial sample generator and copy the adversarial sample generator as an image perturbator; A model training module is used to iteratively train the adversarial sample generator and the replacement model using the training set until the training is completed, and each training includes: inputting the training sample into the adversarial sample generator to obtain a first image, inputting the first image into the replacement model, calculating a first loss function and updating the adversarial sample generator parameters; inputting the training sample into the image perturbator to obtain a second image, inputting the second image and the training sample into the replacement model, calculating a second loss function and updating the replacement model parameters; The adversarial sample generation module is used to input the image to be attacked into the trained adversarial sample generator to obtain the target adversarial sample.

Images