Black-box attack adversarial sample generation method and system based on Gaussian homotopy optimization

Abstract

This application claims priority. The prior application is application number: 2024105299174, title: Black-box attack adversarial sample generation method and system based on Gaussian homotopy optimization, priority date: April 29, 2024. The present invention discloses a black-box attack adversarial sample generation method and system based on Gaussian homotopy optimization, belonging to the field of reliability verification of deep learning image classification models. The method comprises: constructing a smoothing factor adjustment model, initializing the smoothing factor adjustment model and a continuous path learning model; the smoothing factor adjustment model outputs a smoothing factor s; the continuous path learning model outputs a sample perturbation x; using the smoothing factor s to perform Gaussian smoothing on the original adversarial sample generation objective function to obtain several Gaussian homotopy functions G(x,s), with the goal of minimizing the mean of the several Gaussian homotopy functions G(x,s), and jointly training the smoothing factor adjustment model and the continuous path learning model to efficiently generate adversarial samples.

Description

Technical Field

[0001] This invention belongs to the field of generating adversarial samples for black-box attacks. The adversarial samples generated by this invention can be used to test the reliability of classification models. More specifically, it relates to a method and system for generating adversarial samples for black-box attacks based on Gaussian homotopy optimization.

[0002] This application claims priority. The application number of the prior application is: 2024105299174, and the name is: Black-box attack adversarial sample generation method and system based on Gaussian homotopy optimization. The priority date is April 29, 2024. Background Art

[0003] Deep learning has been widely applied in fields such as image classification, text recognition, and smart transportation. The application of deep learning models in various fields involves multiple aspects, including information security, traffic safety, and national defense security. The associated security and privacy issues are increasing and attracting significant attention. While deep learning has brought tremendous progress in many fields, the emergence of adversarial examples has exposed the vulnerabilities of deep learning models. These adversarial examples may not only be the result of intentional tampering by attackers but also arise from various noise interferences in nature. This poses a serious challenge to the deployment and practical application of deep learning models.

[0004] Black-box adversarial example generation involves introducing perturbations into the original data without understanding the target system. This perturbs the target system's predictions about the synthesized samples, causing them to misjudge the target system's predictions. This is crucial for improving the adaptability and robustness of deep learning models. Black-box adversarial example generation requires minimal prior information about the target system, making it suitable for real-world applications. Therefore, it holds significant research value in the field of computer vision.

[0005] In the task of generating black-box attack samples, the objective function is typically designed as a multi-objective non-convex optimization, ensuring that the distance between the generated samples and the original samples is small while introducing perturbations. Gradient descent optimization strategies typically employ a small step-size, multi-iteration approach. Non-convex functions have multiple local minima, making gradient descent optimization schemes prone to local minima and inefficiently generating adversarial samples. Traditional methods for generating adversarial samples for black-box attacks ignore the non-convex nature of this task. The Gaussian homotopy method is a classic approach for solving non-convex and nonlinear optimization problems. However, existing Gaussian homotopy methods operate serially or use a predefined smoothing factor sequence for optimization. This serial approach is inefficient. Predefined smoothing factor sequences often require additional analysis, which is difficult to implement for high-dimensional tasks such as generating black-box attack adversarial samples. Summary of the Invention

[0006] In response to the defects of the existing technology and the need for improvement, the present invention provides a black-box attack adversarial sample generation method and system based on Gaussian homotopy optimization, which aims to solve the problem that the optimization of non-convex objective functions in image black-box attacks is prone to falling into local optimality, thereby generating adversarial samples more efficiently.

[0007] To achieve the above objectives, according to one aspect of the present invention, a method for generating black-box attack adversarial samples based on Gaussian homotopy optimization is provided, comprising: constructing a smoothing factor adjustment model, initializing the smoothing factor adjustment model and a continuous path learning model; the input of the smoothing factor adjustment model is an N-dimensional tensor uniformly distributed on (0, 1) The output is an N-dimensional smoothing factor s=s Ψ (T) = Ψ(1-T); the input of the continuous path learning model is the same as the input of the smoothing factor adjustment model, and the output is the sample disturbance Among them, t i is the i-th dimension element, N is a positive integer, Ψ is the network parameter of the smoothing factor adjustment model, s Ψ () is the mapping function of the smoothing factor adjustment model, is the mapping function of the continuous path learning model, is the network parameter of the continuous path learning model; the smoothing factor s is used to perform Gaussian smoothing on the original adversarial sample to generate the target function in parallel, and an N-dimensional parallel Gaussian homotopy function is obtained. Each dimension corresponds to a homotopy layer, and the Gaussian function of the homotopy layer is During the training phase, for all homotopy layers t on the uniform distribution U(0,1), to minimize its Gaussian function Taking the expectation of t as the goal, the smoothing factor adjustment model and the continuous path learning model are jointly trained until the attack loss is less than the set value or the iteration upper limit is reached; after the training is completed, the continuous path learning model outputs the optimal sample perturbation, and the optimal sample perturbation is added to the original image to obtain the adversarial sample image.

[0008] Furthermore, the joint training of the smoothing factor adjustment model and the continuous path learning model specifically includes: updating the smoothing factor adjustment model once every time the continuous path learning model is updated Q times, until the smoothing factor adjustment model is updated P times or the attack loss is less than a set value, wherein Q is a first set number of times, P is a second set number of times, Q≥1, P≥1.

[0009] Furthermore, when Q=1, the smoothing factor adjustment model and the continuous path learning model are updated simultaneously.

[0010] Furthermore, the specific method of updating the continuous path learning model is as follows: SA1, using multiple independently distributed standard normal vectors {u(1) ,u (2) ,...,u (K)} as the model input, according to the output x of the continuous path learning model and the output s of the smoothing factor adjustment model, the zero-order gradient of the Gaussian homotopy function G(x,s) to the sample disturbance x is estimated by Monte Carlo sampling

[0011]

[0012] Where K is the number of multiple independently distributed standard normal vectors, u (k) is the kth independently distributed standard normal vector, f(·) is the target function for generating the original adversarial sample; SA2, according to Back propagates the output of the continuous path learning model and uses the chain rule to obtain the gradient of the objective function with respect to the network parameters of the continuous path learning model. To update the network parameters of the continuous path learning model.

[0013] Furthermore, for:

[0014]

[0015] Furthermore, the specific method of updating the smoothing factor adjustment model is as follows: SA1′, using multiple independently distributed standard normal vectors {u (1) ,u (2) ,...,u (K)} as the model input, according to the output x of the continuous path learning model and the output s of the smoothing factor adjustment model, the zero-order gradient of the Gaussian homotopy function G(x,s) with respect to the smoothing factor s is estimated by Monte Carlo sampling

[0016]

[0017] Where K is the number of multiple independently distributed standard normal vectors, u (k) is the kth independently distributed standard normal vector, f(·) is the target function for generating the original adversarial sample, and d is the vector u (k) Dimension; SA2', according to The output of the smoothing factor adjustment model is back-propagated, and the gradient of the objective function with respect to the network parameters of the smoothing factor adjustment model is obtained using the chain rule. The network parameters of the smoothing factor adjustment model are updated.

[0018] Furthermore, for:

[0019]

[0020] Furthermore, the tensor dimension output by the smoothing factor adjustment model is the same as the tensor dimension of its input; when the tensor dimension is 1, the smoothing factor adjustment model provides an adaptive smoothing factor for the serial homotopy architecture; when the tensor dimension is greater than 1, the smoothing factor adjustment model provides an adaptive smoothing factor for the parallel homotopy architecture.

[0021] According to another aspect of the present invention, a black-box attack adversarial sample generation system based on Gaussian homotopy optimization is provided, comprising: a processor; a memory storing a computer executable program, which, when executed by the processor, enables the processor to execute the black-box attack adversarial sample generation method based on Gaussian homotopy optimization as described above.

[0022] According to another aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the black-box attack adversarial sample generation method based on Gaussian homotopy optimization is implemented as described above.

[0023] In general, the above technical solutions conceived by the present invention can achieve the following beneficial effects:

[0024] (1) A method for generating adversarial samples for black-box attacks based on Gaussian homotopy optimization is provided. The Gaussian homotopy idea is used to construct a linear model using a fully connected network, namely an adaptive smoothing factor adjustment model. The adaptive smoothing factor makes the objective function convex, and the non-convex problem approaches asymptotic convexity, thereby facilitating optimization. This solves the problem that the optimization of non-convex objective functions in image black-box attacks is prone to falling into local optimality, and can generate adversarial samples more efficiently, realizing the credibility test of deep learning models. The samples generated by the present invention can also be used to enhance training samples, making the training data set more complete and more in line with actual application scenarios, solving the problem of insufficient adaptability in small-sample deep learning models.

[0025] (2) A smoothing factor adjustment model suitable for serial homotopy architecture and parallel homotopy architecture is provided. Among them, the parallel homotopy architecture utilizes the parallel operation characteristics of tensors to simultaneously calculate the zero-order gradient corresponding to different smoothing factors, and adjusts the smoothing factor through backpropagation to provide a parallel adaptive smoothing factor for the homotopy function of the continuous path learning model, thereby optimizing the path fitting process of the continuous path learning model and achieving more efficient adversarial sample generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A flowchart of a method for generating black-box attack adversarial samples based on Gaussian homotopy optimization provided in an embodiment of the present invention;

[0027] Figure 2 A flowchart of the collaborative training of the smoothing factor adjustment model and the continuous path learning model provided in an embodiment of the present invention;

[0028] Figure 3 A diagram of the collaborative training architecture provided by an embodiment of the present invention;

[0029] Figure 4A 、 Figure 4B They are respectively a schematic diagram of a serial workflow and a schematic diagram of a parallel workflow provided by embodiments of the present invention. DETAILED DESCRIPTION

[0030] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely for the purpose of explaining the present invention and are not intended to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below may be combined with each other as long as they do not conflict with each other.

[0031] In the present invention, the terms "first", "second", etc. (if any) in the present invention and the drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0032] Figure 1 Flowchart of the method for generating black-box attack adversarial samples based on Gaussian homotopy optimization provided by the embodiment of the present invention. Figure 1 , combined with Figure 2-4B , a black-box attack adversarial sample generation method based on Gaussian homotopy optimization in this embodiment is described in detail, and the method includes operations S1 to S3.

[0033] Operation S1, builds a smoothing factor adjustment model, initializes the smoothing factor adjustment model and the continuous path learning model; the input of the smoothing factor adjustment model is an N-dimensional tensor uniformly distributed on (0,1) The output is an N-dimensional smoothing factor s=s Ψ (T) = Ψ(1-T); the input of the continuous path learning model is the same as the input of the smoothing factor adjustment model, and the output is the sample perturbation

[0034] Preferably, a smoothing factor adjustment model is constructed using a fully connected layer. The input of the smoothing factor adjustment model is an N-dimensional tensor T~U(0,1) uniformly distributed on (0,1), N≥1, and the smoothing factor output by the model is s=s Ψ (T) = Ψ(1-T), where Ψ is the network parameter of the smoothing factor adjustment model. i is the i-th dimension element, N is a positive integer, Ψ is the network parameter of the smoothing factor adjustment model, s Ψ() is the mapping function of the smoothing factor adjustment model, is the mapping function of the continuous path learning model, Learn the network parameters of the model for continuous paths.

[0035] In this embodiment, the tensor dimension output by the smoothing factor adjustment model is the same as the tensor dimension of its input. When the tensor dimension N is 1, the smoothing factor adjustment model can provide an adaptive smoothing factor for the serial homotopy architecture. Its workflow is as follows: Figure 4A When the tensor dimension N is greater than 1, the smoothing factor adjustment model can provide an adaptive smoothing factor for the parallel homotopy architecture. Its workflow is as follows: Figure 4B shown.

[0036] The embodiment of the present invention relates to Gaussian homotopy optimization, which transforms the original non-convex objective function into a series of homotopy functions that are easier to solve through Gaussian smoothing transformation. Each smoothing factor corresponds to a homotopy function, which is called a homotopy layer. Figure 4A The serial workflow diagram shown in the figure starts from the easiest asymptotically convex function to solve, and uses the solution of this homotopy layer as the initial solution of the next homotopy layer, gradually approaching the original objective function. Figure 4B The parallel workflow diagram shown above leverages the parallel computing power of tensors to learn the continuous path x(T) by fitting the relationship between multiple homotopy layers and the corresponding optimal solutions, thereby predicting the optimal solution when the smoothing factor is 0. A sufficiently large smoothing factor makes the objective function asymptotically convex, thus obtaining a better optimization direction.

[0037] Preferably, in this embodiment, the network parameters of the smoothing factor adjustment model are initialized with a larger value to ensure that the black-box attack adversarial sample generation target function G(x,s) after Gaussian homotopy transformation approaches an asymptotically convex function.

[0038] Operation S2 uses the smoothing factor s to perform Gaussian smoothing on the original adversarial sample generation target function to obtain N-dimensional parallel Gaussian homotopy functions. Each dimension corresponds to a homotopy layer, and the Gaussian function of the homotopy layer is During the training phase, for all homotopy layers t on the uniform distribution U(0,1), to minimize its Gaussian function With the expectation of t as the goal, the smoothing factor adjustment model and the continuous path learning model are jointly trained until the attack loss is less than the set value or the upper limit of the iteration number is reached.

[0039] The goal of generating adversarial samples in a black box attack is to find x that minimizes f(x) and adjust the smoothing factor to s output by the model. Ψ (T) is used as a smoothing factor and Gaussian smoothing is used to process f(x), that is:

[0040]

[0041] Where g(y) is the Gaussian kernel. Gaussian smoothing can make the processed f(x) obtain asymptotic convexity, thus obtaining a better optimization direction.

[0042] The goal of the smoothing factor adjustment model is to find the network parameter Ψ that minimizes the mean of the Gaussian homotopy function on the U(0,1) uniform distribution. * ,Right now

[0043] Preferably, the original adversarial sample generation objective function is:

[0044] f(x)=λl(0.5tanh(tanh -1 (2a)+x))+‖0.5tanh(tanh -1 (2a)+x)-a‖ 2

[0045] Among them, f(·) is the original adversarial sample generation objective function, x is the sample perturbation, λ is the hyperparameter, l(·) is the attack loss, and a is the input image data.

[0046] Preferably, the smoothing factor adjustment model and the continuous path learning model are jointly trained, specifically including: updating the smoothing factor adjustment model once every Q times the continuous path learning model is updated, until the smoothing factor adjustment model is updated P times or the attack loss is less than a set value, where Q is a first set number of times, P is a second set number of times, Q ≥ 1, and P ≥ 1. When Q = 1, the smoothing factor adjustment model and the continuous path learning model are updated simultaneously.

[0047] Specifically, see Figure 2 ,The process of jointly training the smoothing factor adjustment model and the ,continuous path learning model is as follows steps 1-6.

[0048] Step 1: Generate an N-dimensional tensor Each t i Corresponding to a homotopy layer. In the absence of additional priors, T is uniformly sampled on the interval (0,1).

[0049] Step 2: Input the N-dimensional tensor T into the smoothing factor adjustment model and the continuous path learning model, and input the output s of the smoothing factor adjustment model into the continuous path learning model. Ψ The product of (T) and the vector u that obeys the standard normal distribution is input into the update module of the continuous path learning model to participate in the calculation of the zero-order gradient and add parallel adaptively adjusted Gaussian perturbations to the image.

[0050] Step 3: Update the continuous path learning model and output the disturbance.

[0051] In step 4, execute steps 1 to 3 Q times to train the continuous path learning model, and then go to step 5.

[0052] In step 5, the adversarial sample is input as a parameter into the update module of the smoothing factor adjustment model, participates in the gradient calculation of the smoothing factor adjustment model, and updates the smoothing factor adjustment model.

[0053] Step 6: Repeat Step 1 to Step 5 P times, or if the attack loss is less than the set value, stop training and output the disturbance.

[0054] In an embodiment of the present invention, a specific method for updating a continuous path learning model is provided. Figure 3 As shown, it specifically includes the following sub-operations SA1 and SA2.

[0055] Sub-operation SA1 uses multiple independently distributed standard normal vectors As the model input, the output x of the continuous path learning model and the smoothing factor adjust the output s of the model, and the zero-order gradient of G(x,s) on the sample perturbation is estimated by Monte Carlo sampling

[0056] Sub-operation SA2 performs backpropagation on the output of the continuous path learning model and uses the chain rule to obtain the gradient of the objective function with respect to the network parameters of the continuous path learning model. To update the network parameters of the continuous path learning model.

[0057] and They are:

[0058]

[0059]

[0060] In an embodiment of the present invention, a specific method for updating the smoothing factor adjustment model is provided. Figure 3 As shown, it specifically includes the following sub-operations SA1'-sub-operations SA2'.

[0061] Sub-operation SA1' uses multiple independently distributed standard normal vectors As the model input, the output x of the continuous path learning model and the output s of the smoothing factor adjustment model are used, and the zero-order gradient of G(x,s) on the smoothing factor is estimated by Monte Carlo sampling

[0062] Sub-operation SA2', back-propagates the output of the smoothing factor adjustment model, and uses the chain rule to obtain the gradient of the objective function with respect to the network parameters of the smoothing factor adjustment model The network parameters of the model are adjusted by updating the smoothing factor.

[0063] According to an embodiment of the present invention, and They are:

[0064]

[0065]

[0066] Where d is the vector u (k) The dimension of , T is a random uniform sampling on the interval (0,1).

[0067] Operation S3, after training is completed, the continuous path learning model outputs the optimal sample perturbation, that is, in To learn the optimal parameters of the continuous path model, the optimal sample perturbation is added to the original image to obtain the adversarial sample image.

[0068] For any image, the black-box attack adversarial sample generation method based on Gaussian homotopy optimization in this embodiment can be executed to generate an adversarial sample image corresponding to the image. This can be used for adversarial training of models, thereby enhancing the security, privacy protection, robustness, and anti-attack capabilities of models (such as image classification models), thereby improving the credibility and practicality of machine learning models. Examples of images include the MNIST and Cifar10 datasets.

[0069] The embodiment of the present invention provides a black-box attack adversarial sample generation method based on Gaussian homotopy optimization. It utilizes the Gaussian homotopy idea and uses a fully connected network to construct a linear model, namely, an adaptive smoothing factor adjustment model, to provide adaptive variable perturbations for image data, so that non-convex problems are approached to asymptotic convexity, thereby facilitating optimization. It solves the problem that the optimization of non-convex objective functions in image black-box attacks is prone to falling into local optimality, and can generate adversarial samples more efficiently, thereby realizing credibility testing of deep learning models.

[0070] Example 2

[0071] A system for generating black-box attack adversarial samples based on Gaussian homotopy optimization includes a processor and a memory storing a computer-executable program. When executed by the processor, the program causes the processor to execute the black-box attack adversarial sample generation method based on Gaussian homotopy optimization. The related technical solutions are the same as those in Example 1 and are not further described here.

[0072] Example 3

[0073] A computer-readable storage medium stores a computer program that, when executed by a processor, implements the aforementioned method for generating adversarial samples for a black-box attack based on Gaussian homotopy optimization. The related technical solutions are the same as those in Example 1 and will not be further elaborated here.

[0074] It will be easily understood by those skilled in the art that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A black-box attack adversarial sample generation method based on Gaussian homotopy optimization, characterized in that: include: Constructing a smoothing factor adjustment model, and initializing the smoothing factor adjustment model and the continuous path learning model; The input of the smoothing factor adjustment model is an N-dimensional tensor uniformly distributed on (0, 1) The output is an N-dimensional smoothing factor s=s Ψ (T) = Ψ(1-T); the input of the continuous path learning model is the same as the input of the smoothing factor adjustment model, and the output is the sample disturbance Among them, t i is the i-th dimension element, N is a positive integer, Ψ is the network parameter of the smoothing factor adjustment model, s Ψ ( ) is the mapping function of the smoothing factor adjustment model, is the mapping function of the continuous path learning model, Learning the network parameters of the model for continuous paths; The smoothing factor s is used to perform Gaussian smoothing on the original adversarial sample generation target function to obtain N-dimensional parallel Gaussian homotopy functions. Each dimension corresponds to a homotopy layer, and the Gaussian function of the homotopy layer is During the training phase, for all homotopy layers t on the uniform distribution U(0, 1), to minimize its Gaussian function Taking the expectation of t as the goal, jointly train the smoothing factor adjustment model and the continuous path learning model until the attack loss is less than the set value or reaches the iteration upper limit; After training, the continuous path learning model outputs the optimal sample perturbation, which is added to the original image to obtain an adversarial sample image.

2. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 1, wherein: The joint training of the smoothing factor adjustment model and the continuous path learning model specifically includes: Every time the continuous path learning model is updated Q times, the smoothing factor adjustment model is updated once until the smoothing factor adjustment model is updated P times or the attack loss is less than a set value, where Q is a first set number of times, P is a second set number of times, Q≥1, and P≥1.

3. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 2, wherein: When Q=1, the smoothing factor adjustment model and the continuous path learning model are updated simultaneously.

4. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 2 or 3, wherein: The specific method of updating the continuous path learning model is: SA1, using multiple independently distributed standard normal vectors {u (1) ,u (2) ,...,u (K) } as the model input, according to the output x of the continuous path learning model and the output s of the smoothing factor adjustment model, the zero-order gradient of the Gaussian homotopy function G(x, s) to the sample disturbance x is estimated by Monte Carlo sampling Where K is the number of multiple independently distributed standard normal vectors, u( k ) is the k-th independently distributed standard normal vector, f(·) is the target function for generating the original adversarial sample; SA2, according to Back propagates the output of the continuous path learning model and uses the chain rule to obtain the gradient of the objective function with respect to the network parameters of the continuous path learning model. To update the network parameters of the continuous path learning model.

5. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 4, wherein: for:

6. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 2 or 3, wherein: The specific method of updating the smoothing factor adjustment model is: SA1′, using multiple independently distributed standard normal vectors {u (1) ,u (2) ,...,u (K) } as the model input, according to the output x of the continuous path learning model and the output s of the smoothing factor adjustment model, the zero-order gradient of the Gaussian homotopy function G(x, s) to the smoothing factor s is estimated by Monte Carlo sampling Where K is the number of multiple independently distributed standard normal vectors, u (k) is the kth independently distributed standard normal vector, f(·) is the target function for generating the original adversarial sample, and d is the vector u (k) Dimensions; SA2′, according to The output of the smoothing factor adjustment model is back-propagated, and the gradient of the objective function with respect to the network parameters of the smoothing factor adjustment model is obtained using the chain rule. The network parameters of the smoothing factor adjustment model are updated.

7. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 6, wherein: for:

8. The method for generating black-box attack adversarial samples based on Gaussian homotopy optimization according to claim 1, wherein: The tensor dimension of the smoothing factor adjustment model output is the same as the tensor dimension of its input; When the input tensor dimension is 1, the smoothing factor adjustment model provides an adaptive smoothing factor for the serial homotopy architecture; when the input tensor dimension is greater than 1, the smoothing factor adjustment model provides an adaptive smoothing factor for the parallel homotopy architecture.

9. A black-box attack adversarial sample generation system based on Gaussian homotopy optimization, characterized in that: include: processor; A memory storing a computer executable program, wherein when the program is executed by the processor, the processor executes the black-box attack adversarial sample generation method based on Gaussian homotopy optimization according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the black-box attack adversarial sample generation method based on Gaussian homotopy optimization according to any one of claims 1 to 8 is implemented.

Images