Image recognition algorithm adversarial robustness evaluation method and computer storage medium

Abstract

The application discloses an image recognition algorithm robustness evaluation method and a computer storage medium, relates to the safety technical field of deep learning, and particularly relates to a black box migration method of directional adversarial samples. The transformed sample is input into a pre-trained neural network to obtain network output; a loss value of the output and a target category is calculated through a pre-set loss function; the gradient of the loss value to the target sample is calculated, and updating is performed according to a learning rate. The application is characterized in that a large-scale image scaling operation and random transformation are used in each gradient updating iteration, the migration ability of the generated adversarial sample is enhanced, and the accuracy of the model robustness evaluation is improved.

Description

Technical Field

[0001] This invention relates to the field of security technology in deep learning, and in particular to a black-box migration method for targeted adversarial examples and a computer storage medium. Background Technology

[0002] Deep learning models in computer vision have proven highly vulnerable to adversarial examples, where even small, maliciously created perturbations added to clean images can significantly alter model predictions. The transferability of adversarial examples—allowing them to be generated using surrogate models and then successfully attacking black-box models—is the foundation for the enduring need to continuously research potential attacks to advance defensive strategy design, keeping this research area active for over a decade.

[0003] While transferring adversarial examples to black-box models can effectively induce incorrect predictions, guiding the predictions of black-box models to specific labels remains a significant challenge, especially in the absence of large-scale data for training auxiliary models. Li et al. observed that the commonly used cross-entropy (CE) loss function for non-targeted attacks tends to saturate rapidly in directional scenarios, leading to vanishing gradients, and proposed using Poincaré distance to alleviate this problem. Zhao et al. found that simply scaling the target logit and combining it with scaling transformations and using more optimization iterations can significantly enhance directional transfer capabilities. With stochastic scaling transformations becoming the default setting, researchers found that further softening the model output can unlock the potential of CE loss for directional attacks. Despite these advances, triggering the required directional predictions in black-box models remains challenging when there are significant differences in architecture and training strategies between the surrogate and target models, such as between ResNet-50 and Inception-v3 (or Visual Transformer). Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide an image recognition method and computer storage medium for enhancing targeted adversarial attacks, thereby improving the accuracy of black-box targeted attack risk assessment, in order to address the shortcomings of the existing technology.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is: a method for evaluating the robustness of image recognition algorithms against adversarial attacks, comprising the following steps:

[0006] S1. Set the initial adversarial sample as x′0=x, momentum g0=0; x is the image to be attacked; iteration number i=0;

[0007] S2. Transform the current adversarial sample to obtain the transformed adversarial sample.

[0008] S3. Calculate the output of the convolutional neural model for the transformed adversarial sample and the loss function with the target label where y t is the target label;

[0009] S4. Calculate the gradient of the loss function with respect to the current input

[0010] S5. Perform a convolution operation on the gradient and obtain the cumulative momentum using the convolution operation result W is a predefined convolution kernel, and μ is the decay factor for momentum accumulation;

[0011] S6. Update the adversarial sample x′ at the (i + 1)-th iteration using the following formula i+1 : x′ i+1 = x′ i - α·sign(g i+1 ); α is the perturbation step size, and x′ i is the transformed image;

[0012] S7. Increment the value of i by 1, and return to step S2. When i + 1 = T, obtain the directional adversarial sample x′ and proceed to step S8;

[0013] S8. Input the directional adversarial sample x′ into the convolutional neural network model G to be tested, and obtain the recognition result G(x′);

[0014] S9. If maxG(x′) = y t , that is, the output class is the class y of the directional attack t , then the attack is successful.

[0015] The specific implementation process of step S2 includes:

[0016] 1) Sample the transformation probability where represents a uniform distribution with a sampling interval from 0 to 1. If

[0017] p′ < p, proceed to step 2); if p′ > p, then p is the given transformation probability;

[0018] 2) Sample the transformation probability If p′ r < p r , then randomly transform the image x′ i ; if p′ r > p r , directly proceed to step 3); p r is the set random transformation probability;

[0019] 3) From (r) l ,r h Uniformly sample a scaling factor in ) (r l ,r h ) represents the set scaling range, r l <1 <r h ;

[0020] 4) If r′<1, perform the following operation: Use bilinear interpolation to adjust the x-axis of the H×W dimension. i Scale to size r′H×r′W; randomly sample and pad with zeros in the vertical direction. And the number of zeros padded horizontally Pad the top and bottom of the scaled image with zeros. Line up, pad the left and right sides of the image with zeros. The column yields the transformed adversarial examples; H is the image height, and W is the image width; if r′>1, perform the following operations: in image x i Crop one at a random position. Images;

[0021] The cropped image is scaled to size H×W using bilinear interpolation to obtain the transformed adversarial sample.

[0022] In step 2), random transformations include vertical displacement, horizontal displacement, vertical flipping, horizontal flipping, rotation, scaling, adding noise, DCT transformation, or Dropout transformation of the image.

[0023] The rotation refers to rotating the image 180° clockwise.

[0024] The scaling is to multiply the image by a factor from... Factors for random sampling in the middle.

[0025] The specific implementation process of adding noise includes: adding noise to each pixel of the image from... The noise sampled in the middle is then cropped to the range of (0,1); where ∈ is the perturbation amplitude.

[0026] The specific implementation process of the DCT transform includes: converting the image to the cosine domain through discrete cosine transform, wherein the highest 40% of the frequency components are set to zero, and converting the modified spectrum back to the spatial domain through inverse discrete cosine transform.

[0027] The Dropout transformation randomly sets 10% of the image pixels to zero.

[0028] A computer-readable storage medium having a computer program / instructions stored thereon; the computer program / instructions, when executed by a processor, implement the steps of the above-described method.

[0029] A computer program product includes a computer program / instructions; when the computer program / instructions are executed by a processor, they implement the steps of the above-described method.

[0030] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention can significantly enhance the ability of black-box models to be attacked by targeted adversarial examples, and can obtain targeted adversarial examples with strong transfer performance, thereby improving the accuracy of the robustness evaluation of the model's defense against targeted attacks. The experimental results section of this invention provides black-box transfer attack test results on a large number of convolutional neural network models, visual Transformers, adversarially trained neural network models, and online commercial model interfaces (Google CloudVision API). Compared with existing technologies, this invention has achieved a significant improvement in the targeted transfer adversarial attack capability index, and can better reveal the risks of black-box targeted attacks. Attached Figure Description

[0031] Figure 1 To predict the distribution of a black-box model for targeted attacks under both (TMI) and (RDI-TMI) scaling transformation conditions. The adversarial examples are generated using the ResNet-50 model, and transfer attacks are performed on three models: IRv2, ConvNeXt, and LeVit.

[0032] Figure 2 To assess the average success rate of directed transfer attacks on 9 convolutional neural networks and 6 visual Transformer models, the surrogate model is ResNet-50; green represents existing settings, blue represents existing methods that enhance scale diversity, and red represents the method proposed in this embodiment of the invention.

[0033] Figure 3 The attack success rates of different existing methods with (blue and red) and without (green) scale transformation;

[0034] Figure 4 The graphs show the relationship between the attack success rate and the scale transformation intensity (horizontal axis) for different attack methods in both directional (left) and non-directional (right) scenarios.

[0035] Figure 5 The predicted probabilities and gradient norms of the source class, target class, and irrelevant class during the optimization process for targeted attacks (first 100 iterations); (a) predicted probabilities, (b) changes in gradient norms;

[0036] Figure 6 The predicted distribution of the adversarial sample (top) and its scale-transformed image (bottom) in the surrogate model at different iteration numbers t;

[0037] Figure 7The convergence curves of the RDI transform at different scales and transform intensities are shown.

[0038] Figure 8 This section describes the differences between the EDI transformation method of this invention and existing methods.

[0039] Figure 9 The first result is a visualization of the adversarial examples;

[0040] Figure 10 This is an example of a successful attack on the Google Cloud Vision API that causes the system to detect the target category Tank.

[0041] Figure 11 The second result is a visualization of the adversarial examples;

[0042] Figure 12 This is an example of a successful attack on the Google Cloud Vision API. Detailed Implementation

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Example 1

[0045] In this embodiment of the invention, we investigated in detail the impact of scale transformation (in this embodiment, scale transformation refers to changes in image size, which differs from the linear scaling used in the SI method) on directional transfer capabilities. Besides confirming its importance in effective directional transfer, our main contributions are threefold.

[0046] First, we found that enhancing the strength of the transformation can further improve directional transfer capabilities. This differs from the requirement in non-directional scenarios to maintain the surrogate model's correct prediction of the transformed image. Our results indicate that for directional attacks, a larger scale of transformation can lead to better transfer capabilities.

[0047] Secondly, we propose a hypothesis to explain how scaling transformation works. For example... Figure 1As observed, scaling simultaneously reinforces the impression of the target class while suppressing features of other related classes—those ranking in the top 2–50 predictions of the original image. Essentially, scaling acts as a catalyst, enhancing features inherent to multiple classes. This not only mitigates the adversarial effect of the perturbation but also helps to leverage these inherent features to support the target class.

[0048] Third, we demonstrate how our findings can be applied to significantly enhance directed transfer capabilities. For example... Figure 2 As shown, simply scaling the transformation yields better attack performance than previous settings. We propose a novel Enhanced Diverse Input (EDI) transformation to further improve this performance. EDI is compatible with current state-of-the-art methods and sets new state-of-the-art (SOTA) performance for standard ImageNet-compatible datasets and a variety of challenging scenarios, including when transferred to adversarial training models and the Google Cloud Vision API, by simply combining a wider range of scale variations and additional random augmentations.

[0049] We focus on simple transfer-oriented adversarial attacks, i.e., generating targeted adversarial examples based on the gradient of a substitute model without training the generative or auxiliary model on additional data. Consider a model trained for a K-classification task. It outputs a logit value given an input image x∈X. We use the normalized value p = Softmax(l) of the output as the value for each category y. i The predicted probability. The goal of a targeted attack is to add a [something] in l p - A perturbation δ of radius ∈ within the norm sphere forces the classifier to output the target class y. t :

[0050] argmax f(x+δ)=t,‖δ‖ p ≤∈.

[0051] Typically, this goal is driven by the Iterative Fast Signed Gradient Method (I-FGSM) in a multi-step gradient descent manner, using l ∞ Constraints and cross-entropy loss function L CE :

[0052]

[0053] The optimization process for DI-TI-MI-FGSM (DTMI) is presented here:

[0054]

[0055] Where μ is the momentum accumulation decay factor, W is the predefined convolution kernel, and T is the resizing and padding (R&P) operation with probability p and scaling factor r > 1.

[0056] The significant benefits of DTMI are attributed to the dynamic multi-scale input created by DI. Specifically, DI draws inputs from a uniform distribution at each iteration. Mid-sampling r′, x i The size of (R)DI is adjusted to r'H×r'W, and then randomly padded to rH×rW. Recently, Byun et al. confirmed that its simpler variant, RDI, is more efficient by simply adding an adjustment operation that transforms the expanded scale into a reduced scale. Besides (R)DI, many input transformation methods have been proposed to improve transferability. SI averages the gradient of a linearly scaled image to the power of five. Admix mixes the original image with images from other categories. SSA adds noise in the frequency domain. SIA and BSR apply random transformations and shuffling and rotation operations to image patches, respectively. ODI attaches the image to a 3D object and uses images rendered at various viewing angles for inference.

[0057] We first demonstrate the dominant contribution of the default integrated scale transformations (i.e., DI and RDI methods) to simple target attacks. We show that overall attack performance can be easily enhanced by simply increasing scale diversity, and provide new insights that, together with a simple yet powerful transformation EDI, significantly improve target migration capabilities.

[0058] We first quantify the contribution of multi-scale inputs to existing attacks. We experiment with different attacks and use the average tSuc (directed migration attack success rate) to measure their migration capabilities. Figure 3 As shown, there are significant differences between each method with and without scale transformation. This makes these methods appear to be designed to handle multi-scale inputs better, but all methods ignore why they are key to the target transfer capability.

[0059] Interestingly, we found that the performance of multi-scale inputs differed significantly between targeted and untargeted attack scenarios by further altering the resizing ratio. For example... Figure 4 As shown, a larger range of scale variations is always beneficial for target transfer, but only a small range yields optimal non-target results, which to some extent violates the design principles of input-transformation-based methods. Specifically, transformations that enhance non-target transfer capabilities need to preserve the loss of the surrogate model. Therefore, the intensity of variation is usually limited to a small range to achieve better improvement. This counterintuitive observation about target scenes leads us to speculate:

[0060] The function of scaling transformation is to stimulate and utilize intrinsic, multi-class features, thereby leading to more transferable, similarly general, many-to-single-target transfer.

[0061] First, the (R)DI method is equivalent to attacking an ensemble of models vertically. In each iteration, it randomly samples the surrogate model and pre-loads a randomized R&P layer, causing the surrogate model to infer the attacked image at random scales. On one hand, the R&P operation mitigates the adversarial effect of the current perturbation and approximates a minimax optimization process. Simultaneously, the unusual scale of the input makes the surrogate model pay more attention to other classes—those that are neglected during optimization but possess rich features. Therefore, the R&P operation continuously weakens the target perturbation and strengthens the impression of relevant classes, helping to attack all the useful features of the target class at different scales, ultimately leading to better transfer capabilities. It shares the same spirit as generalized target perturbations and generative target attacks, which learn many-to-one transfer capabilities, but fully utilize the intrinsic information of a single image rather than learning from large-scale data across multiple classes.

[0062] Here, we provide empirical evidence for our hypothesis. We first investigate the adversarial perturbation optimization dynamics of existing methods. We record and... Figure 5 The text describes the source class probability p during the first 100 iterations. s Target category probability p t Other class probabilities p o =∑p\{p s ,p t The changes in the values ​​of the inputs are shown, along with their gradient norms relative to the input. The results demonstrate that multi-scale inputs soften the prediction distribution better than the logit softening method and are key to avoiding gradient vanishing, thus achieving stable perturbation optimization.

[0063] To better demonstrate how it mitigates the adversarial effect and highlights the image's intrinsic information, we randomly selected an image labeled "espresso" and with the target tag "paintbrush" for a more detailed explanation. For example... Figure 6 As shown, the perturbation saturates after approximately 10 iterations. Thereafter, the surrogate model predicts the adversarial example as the expected label with high confidence, leading to gradient vanishing and subsequent update failures. Scale transformation weakens the perturbation and enhances the relevance to the surrogate model; we can observe that the top 5 predicted labels of the transformed image are mostly from the top 50 categories of the clean image. Simultaneously, stronger transformations (such as at the 30th iteration) may destroy the target category impression caused by the perturbation. This dual effect transfers the multi-scale and multi-class features of the image to a single target category, such as... Figure 1 As shown. This also explains the existing experimental phenomena, namely that more optimization steps are needed to handle diversity.

[0064] Figure 7 We verified that greater scale diversity requires more optimization steps to converge. Visually, we found that the generated perturbations guide the model's predictions by utilizing the original content and generating local or global patterns semantically identical to the target label; see [link to related documentation]. Figure 9 and 12 This supports our many-to-one (similar to general attack) migration analysis.

[0065] Based on the above findings, we propose a simple yet powerful Enhanced Diverse Inputs (EDI) transform method to achieve better target transferability by directly enhancing input diversity. First, we introduce random transformations (including translation and flipping, rotation, scaling, noise, low-frequency filtering, and random discarding in the vertical and horizontal dimensions) to bring more diversity to the image. EDI randomly selects a transformation for the entire image with probability p. r Secondly, we extend the range of random scaling variation of (R)DI [1, r] to [r]. l ,r h ](r l <1 <r h We sample a scaling factor. When r′<1, it performs R&P operations; when r′>1, it randomly crops a square region and resizes it to its original size. The resizing cropping operation is to overcome the computational burden of the DI method. With this design, EDI is either equivalent to RDI (r′<1) or DI (r′>1), while incorporating scaling changes to enhance diversity. Figure 8 This paper briefly reviews existing input transformation methods and our EDI. We also utilize top-k labels to aid optimization, making better use of multi-scale and multi-class features. In summary, the attack target is...

[0066]

[0067] Among them 1 k It is a multi-hot encoding of the top-k categories of the surrogate model compared to a clean image.

[0068] In each iteration, we randomly apply 9 transformations to the image x. i ',include:

[0069] 1. Vertical displacement: Scroll the image along the vertical axis from... The length of the random sample in the middle;

[0070] 2. Horizontal displacement: Scroll the image along the horizontal axis from... Width of random sampling in the middle;

[0071] 3. Vertical Flip: Flip the image along the horizontal axis;

[0072] 4. Horizontal Flip: Flip the image along the vertical axis;

[0073] 5. Rotate: Rotate the image 180° clockwise;

[0074] 6. Scaling: Multiplies the image by a factor from... Factors for random sampling in the middle;

[0075] 7. Add noise: Add noise to each pixel from... The noise sampled in the middle is then clipped back to the (0,1) range.

[0076] 8. DCT Transform: The image is transformed to the cosine domain through a discrete cosine transform, in which the highest 40% of the frequency components are set to zero, and then the modified spectrum is transformed back to the spatial domain through an inverse discrete cosine transform.

[0077] 9. Dropout: Randomly sets 10% of the image pixels to zero.

[0078] When r′<1 and r′>1, we apply R&P operations and resizing / cropping respectively. Specifically, when r′<1, we resize the image to the size r′H×r′W and randomly pad it to the original size H×W. To consider the extreme case r′=r l We can see that this is equivalent to having an adjustable size ratio. and sampling r R ′ DI RDI = 1. We also maintain the same scaling intensity as the DI in the enlarged case. For DI, the ratio of the height of the enlarged image to the original image is r′. DI Therefore, EDI will trim a single value when r′>1. The image patch is then resized back to its original size H×W. The cropped image patch is then enlarged with the same intensity as the DI (Digital Integrity). Note that in data classification tasks like ImageNet, the input image is typically square, i.e., H = W.

[0079] The steps of the entire attack process in this embodiment are as follows:

[0080] For a given surrogate model f and the image x to be attacked, the target label y t The attack iteration count is T, the perturbation step size is α, the perturbation amplitude is ∈ , μ is the momentum accumulation decay factor, and W is a predefined convolution kernel. This is the proposed EDI transformation method.

[0081] S1: Set the initial adversarial sample as x′0 = x, and the momentum g0 = 0;

[0082] Repeat steps S2 - S5 for T times to obtain the directional attack adversarial sample.

[0083] S2: Transform the current adversarial sample

[0084] S2: Calculate the loss function of the output of the model for the transformed sample and the target label

[0085] S3: Calculate the gradient of the loss function with respect to the current input

[0086] S4: Convolve the gradient and accumulate the momentum

[0087] S5: Update the adversarial sample x′ i+1 = x′ i -α·sign(g i );

[0088] Among the steps described in step S2, the specific steps of the EDI transformation proposed in this invention are as follows: Given the transformation probability p, the scaling rate interval (r l , r h ), and the random transformation probability p r :

[0089] A1: Sample the transformation probability If p′ < p, perform the subsequent operations; if p′ > p, directly return

[0090] A2: Sample the transformation probability If p′ r < p r , randomly select an operation in the {Method details: Random transformation} section to execute; if p′ r > p r , do not perform any operation;

[0091] A3: Uniformly sample a scaling rate from (r i , r h )

[0092] A4: If r′ < 1, perform the following operations:

[0093] B1: Use bilinear interpolation to scale x′ of size H×W i to the size of r′H×r′W;

[0094] B2: Randomly sample the number of zeros padded in the vertical and horizontal directions

[0095] B3: Pad the scaled image with zeros on all four sides. Restore the row (column) to its original size H×W;

[0096] If r′>1, perform the following operation:

[0097] C1: Crop an image at a random location. Images;

[0098] C2: Scale the cropped image from C1 to size H×W using bilinear interpolation.

[0099] The experimental results of this embodiment are as follows:

[0100] Dataset. To demonstrate the effectiveness and unleash the potential of transfer-oriented attacks, we conducted a series of experiments on the widely used ImageNet-Compatible dataset to evaluate the performance of these attacks. This dataset, released for the NIPS 2017 adversarial competition, contains 1,000 images of size 299×299; each image is assigned a target category for evaluation of transfer-oriented attacks.

[0101] Models and Metrics. Experiments covered 10 convolutional neural networks (CNNs), including VGG16-bn (VGG), ResNet-50 (RN50), DenseNet-121 (DN), Xception (Xcep), MobileNet-v2 (MNv2), EfficientNet-b0 (EN), Inception ResNet-v2 (IRv2), Inception-v3 (INv3), Inception-v4 (INv4), and ConvNeXt-small (CNX), as well as 6 visual Transformer models, including Vision Transformer (ViT), MaxViT, LeViT, ConViT, Twins, and Pooling-based ViT (PiT). We primarily used ResNet-50 to generate adversarial examples because it has shown good transferability based on previous research. Transferring adversarial examples generated by CNNs to Transformers is challenging; therefore, we evaluate the transferability of different methods by calculating the average tSuc (targeted attack success rate) for CNNs and Transformers separately, denoted as Avg(C) and Avg(T). Experiments were run on a single NVIDIA GeForce RTX 4090 GPU.

[0102] Baseline attack. We follow the default settings for a simple targeted attack, utilizing L...Logit Loss and TMI attack were used as baseline methods. We set a total of 300 iterations with a step size of 2 / 255 and a perturbation amplitude of 16 / 255. The TI method used a 5×5 Gaussian kernel, and the MI method had a decay factor of 1.0.

[0103] Parameter settings. Setting r l =0.3,r h =1.6, p=1.0, p r =0.8, k=50 for EDI, and no fine-tuning for other combined attacks. To compare with EDI and other input transformation methods, we follow all the default settings in their original papers, but with some modifications. First, some methods require more transformation copies; for example, SIA, SSA, and BSR require 20 transformations of the image to average the gradient for stable optimization. For fairness, we set these three methods to transform only once per iteration. Furthermore, our results show that a slight instability is beneficial for optimization. Second, for methods that would otherwise require more computation, we allow 5 times the computation, such as SI and Admix (parameters m1=1, m2=5 in the original paper). Finally, we set the transformation probability of DI, RDI, and ODI to 0.9, which yields better results than their original settings (p=0.7).

[0104] Comparison with other input transformation-based methods. First, EDI is compared with existing transformation methods. Adversarial examples against other black-box models in our model pool are generated using ResNet-50, and the results are shown in Table 1. We supplemented DI with a resizing ratio of 1.6 and RDI with a resizing ratio of 3.3 for comparison with the previous setting (r = 1.1). The proposed EDI performs well among all compared methods and achieves the best tSuc across all black-box models. The ODI method is competitive in improving the transferability of orientations but is insufficient in computational efficiency. To make a fair comparison in terms of time consumption, we present the EDI results with more iterations and compute the average gradient over four transformed copies. Both methods show further improvements and outperform the ODI method.

[0105] Table 1 shows the tSuc and time consumption (seconds) per image for attacks on black-box CNNs using input transformation-based methods. The baseline attack is TMI, and the surrogate model is ResNet-50. In the comparison, the best and second-best results are marked with bold and underline, respectively.

[0106]

[0107] Default settings; Calculate the average gradient of the four transformed samples.

[0108] Table 2 shows the tSuc of existing-technical methods using ResNet-50 as an alternative model for black-box CNNs, with a scale transformation ratio of r = 3.3 for RDI. In the comparisons, the best results are marked in bold.

[0109]

[0110] The proposed EDI is compared with state-of-the-art migration-oriented attack methods SU and CFM. We also compare it with other state-of-the-art methods that significantly improve migrationability without introducing additional data during optimization, including Ghost, LinBP, SGM, IAA, and DHF. We follow the best settings reported in their papers. The results are shown in Table 2. We first compare the proposed method with previous benchmarks, where RDI-CFM provides the best attack performance. Our EDI outperforms RDI-CFM even without other advanced methods. We further investigate the compatibility of EDI with CFM and compare it with other input transformation methods. As shown in the second part of Table 2, EDI outperforms other transformation methods, achieving 73.22% Avg(C) and 34.4% Avg(T). EDI-CFM-TMI further improves the attack performance to 77.7% Avg(C) and 46.3% Avg(T).

[0111] Table 3 shows the ensemble attack results of generating adversarial examples through 500 iterations using an ensemble surrogate model based on ResNet-50, ResNet-152, VGG16, and DenseNet-121.

[0112]

[0113] We evaluate the improvement of EDI over ensemble-based attacks. Simultaneously, we aim to obtain more robust perturbations for worst-case migration assessment. Therefore, we optimize the perturbations based on ensemble optimization of surrogate models including ResNet-50, ResNet-152, VGG16, and DenseNet-121, performing 500 iterations. We also combine the SI attack with CFM-TMI to achieve better performance. The results are listed in Table 3. We can observe significant improvements brought by EDI over TMI, CFM-TMI, and SI-CFM-TMI attacks. Ultimately, EDI-SI-CFM-TMI achieves 89.0% Avg(C) and 76.7% Avg(T).

[0114] Visualization can serve as evidence for our hypothesis that scale diversity does indeed facilitate quasi-universal many-to-one transfers. For example... Figure 9and 11 As shown, greater diversity and attack model ensemble result in perturbations that are semantically aligned with the target label. This can be observed in targeted, general attacks, where perturbations are trained to transfer large-scale data from different categories to a single target category. However, data-specific semantic alignment perturbations manipulate the content and texture of the image itself to generate the target semantics.

[0115] Table 4. Avg(C) / Avg(T) for low-ranking label transfer

[0116]

[0117] We progressively target low-ranking labels up to the least likely labels to validate the general effectiveness of our method beyond the default settings provided by the dataset; the results are shown in Table 4. Our proposed EDI improves the worst-case transfer performance by 28% / 11.3% and achieves 67.5% / 35.8% tSuc for both CNNs and transformers combined with CFM.

[0118] Table 5. tSuc values ​​of ensemble attacks against robust and adversarially trained models.

[0119]

[0120] We investigate the robustness of our approach to strong and secure models against attacks of unknown origin. Victim models include ResNet-50 trained using Augmix, stylized ImageNet (SIN and SIN-IN), adversarial training (AT) strategies, and Inception-v3 and Inception ResNet-v2 trained using the Ensemble AT method. As shown in Table 5, ensemble attacks achieve considerable tSuc against these defense methods, especially the adversarial training defense models, which are carefully designed to defend against adversarial examples. EDI improves the average tSuc of CFM-TMI by 25% and achieves 65.1% tSuc in collaboration with SI.

[0121] Table 6 Results of the attack on the Google Cloud Vision API

[0122]

[0123] We conducted a migration-based targeted attack on the widely used, deployed Google Cloud Vision API. We compared EDI-TMI and RDI-TMI, and tested the best-performing method based on the integrated EDI-SI-CFM-TMI. We randomly selected 100 correctly classified images for evaluation and measured uSuc if the source label disappeared from the returned label list, and tSuc if the target label appeared in the list. Semantically similar labels were considered the same label. The results are shown in Table 6. Figure 10 and 12 Our EDI combines SI, CFM, and four surrogate models to achieve outstanding performance of up to 82%, with EDI achieving 38% tSuc (more than twice that of RDI).

[0124] This invention demonstrates the significant potential of leveraging multi-scale inputs to enhance directional transferability. Specifically, we propose a natural hypothesis that multi-scale inputs enable directional transferability by facilitating a quasi-general many-to-single optimization process. Our hypothesis is supported by various experimental evidences and can serve as guidance for designing powerful attacks. Based on this, we propose an EDI method that significantly outperforms other input transformation methods, achieving superior directional transferability without introducing additional computational burden. Combining EDI with other techniques, we achieve EDI-SI-CFM-TMI. ens The proposed method achieves an average tSuc of 76.6% across six vision transformers, 65.1% against nine defense models, and 82% against the Google Cloud Vision API. These results demonstrate that the proposed method can better evaluate the robustness of deployed models and reveal potential security risks.

[0125] Example 2

[0126] Embodiment 2 of the present invention provides a terminal device corresponding to Embodiment 1 above. The terminal device can be a processing device for a client, such as a mobile phone, a laptop, a tablet computer, a desktop computer, etc., to execute the method of the above embodiments.

[0127] The terminal device in this embodiment includes a memory, a processor, and a computer program stored in the memory; the processor executes the computer program in the memory to implement the steps of the method in Embodiment 1 described above.

[0128] In some implementations, the memory may be high-speed random access memory (RAM), and may also include non-volatile memory, such as at least one disk storage device.

[0129] In other implementations, the processor can be any type of general-purpose processor, such as a central processing unit (CPU) or a digital signal processor (DSP), and there is no limitation here.

[0130] Example 3

[0131] Embodiment 3 of the present invention provides a computer-readable storage medium corresponding to Embodiment 1 above, on which a computer program / instructions are stored. When the computer program / instructions are executed by a processor, they implement the steps of the method of Embodiment 1 above.

[0132] A computer-readable storage medium can be a tangible device that holds and stores instructions for use by an instruction execution device. A computer-readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof.

[0133] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0134] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0135] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0136] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0137] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for evaluating the robustness of an image recognition algorithm against adversarial attacks, characterized in that, Includes the following steps: S1. Set the initial adversarial sample as... ,momentum ; Image to be attacked; Number of iterations ; S2. Transform the current adversarial sample to obtain the transformed adversarial sample. ; S3. Calculate the pre-trained convolutional neural model's response to the transformed adversarial examples. Output Loss function with target label ; For target labels; S4. Calculate the gradient of the loss function with respect to the current input. ; S5. Perform a convolution operation on the gradient and obtain the cumulative momentum using the convolution operation result. ; It is a predefined convolution kernel. It is the decay factor of momentum accumulation; S6. Update the adversarial sample in the (i+1)th iteration using the following formula. : ; For the perturbation step size, The transformed image; S7 Increment the value by 1, return to step S2, when At that time, targeted adversarial examples were obtained. Proceed to step S8; T is the maximum number of iterations; S8. Targeted adversarial examples Input the convolutional neural network model to be tested The recognition results were obtained. ; S9, if That is, the output category is the category of targeted attack. This means the attack was successful; The specific implementation process of step S2 includes: 1) Sampling transformation probability ,in This indicates a uniform distribution with a sampling interval of 0 to 1. Proceed to step 2); if ,but ; Given the transformation probability; 2) Sampling transformation probability ,like Then for the image Perform random transformations; if Proceed directly to step 3). The set random transformation probability; 3) From Uniform sampling at a scaling factor ; For the set scaling range, ; 4) If Perform the following operations: Use bilinear interpolation to... Size Zoom to Dimensions; Number of zeros padded vertically in random sampling And the number of zeros padded horizontally Pad the scaled image with zeros at the top and bottom. Line up, pad the left and right sides of the image with zeros. The transformed adversarial sample is obtained from the column; H is the image height, W is the image width; like Perform the following operations on the image: Crop a random position The image; the cropped image is scaled to the desired size using bilinear interpolation. This yields the transformed adversarial sample.

2. The method for evaluating the robustness of image recognition algorithms according to claim 1, characterized in that, In step 2), random transformations include vertical displacement, horizontal displacement, vertical flipping, horizontal flipping, rotation, scaling, adding noise, DCT transformation, or Dropout transformation of the image.

3. The method for evaluating the robustness of image recognition algorithms according to claim 2, characterized in that, The rotation refers to rotating the image 180° clockwise.

4. The method for evaluating the robustness of image recognition algorithms according to claim 2, characterized in that, The scaling is to multiply the image by a factor from... Factors for random sampling in the middle.

5. The method for evaluating the robustness of image recognition algorithms according to claim 2, characterized in that, The specific implementation process of adding noise includes: adding noise to each pixel of the image from... The noise from the mid-sampled pixels is then cropped to the nearest pixel. Within the range; among which, The amplitude of the disturbance.

6. The method for evaluating the robustness of image recognition algorithms according to claim 2, characterized in that, The specific implementation process of the DCT transform includes: converting the image to the cosine domain through discrete cosine transform, wherein the highest 40% of the frequency components are set to zero, and converting the modified spectrum back to the spatial domain through inverse discrete cosine transform.

7. The method for evaluating the robustness of image recognition algorithms according to claim 2, characterized in that, The Dropout transformation randomly sets 10% of the image pixels to zero.

8. A computer-readable storage medium having a computer program / instructions stored thereon; characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 7.

9. A computer program product, comprising a computer program / instructions; characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the method of any one of claims 1 to 7.

Images