A multi-space probability enhancement-based adversarial sample generation method

Abstract

The present application relates to the field of robustness and security evaluation of deep neural networks, and in particular to a kind of adversarial sample generation method based on multi-space probability enhancement, which introduces two random data enhancement branches in the adversarial sample generation method, each branch realizes image random cropping and filling and random color transformation based on pixel space and HSV color space respectively, and controls the returned image sample by constructing a probability model, while increasing the diversity of original samples, reduces the dependence of adversarial samples on original data set, thereby improving its transferability.

Description

Technical Field

[0001] This invention relates to the field of robustness and security assessment of deep neural networks, and specifically to an adversarial example generation method based on multi-space probability enhancement. Background Technology

[0002] With the rapid development of deep learning and neural networks, artificial intelligence has reached new heights. Deep neural networks have achieved tremendous success in fields such as computer vision, semantic segmentation, signal recognition, and autonomous driving. Especially in computer vision, deep learning has demonstrated extremely high accuracy in image recognition and classification, even surpassing human skill levels in some cases. Therefore, more and more deep neural networks are being applied to daily life and production. However, in recent years, adversarial examples have become one of the biggest security threats facing deep neural networks. Attackers use deep neural networks to extract feature information from original samples, generate adversarial perturbations through backpropagation, and then add them to the original clean samples, forming adversarial examples. These adversarial perturbations destroy the feature information in the clean samples, successfully misleading the deep neural network. However, for humans, the difference between the two is almost indistinguishable to the naked eye, posing a serious potential threat to the security of neural networks. Therefore, conducting research on adversarial attacks can effectively evaluate the performance of deep neural networks in the face of malicious attacks, help discover their potential vulnerabilities and weaknesses, and is of great significance for assessing the vulnerability of models and improving their robustness.

[0003] Based on whether adversarial attack techniques require knowledge of the target model's network structure, parameter settings, training data, and methods when generating adversarial examples, adversarial attack techniques can be divided into white-box attacks and black-box attacks. In white-box scenarios, attackers can easily understand relevant information about the target model, including its network structure, model weights, and other internal information. Based on this, attackers can implement adversarial attacks more quickly and effectively, and the success rate remains high. In contrast, in black-box scenarios, attackers' understanding of the model is greatly limited; they can only carry out attacks by interacting with the model's inputs and outputs, which is significantly more difficult and complex.

[0004] In image classification networks, let x be a clean original sample, y be the ground truth label of the sample, θ be the model parameters, f(x; θ) be the model's predicted output, and J(x, y; θ) represent the model's loss function. Therefore, an adversarial attack can be expressed as f(x... adv ;θ)≠f(x;θ),x adv Let x be the adversarial sample corresponding to the original sample x, which satisfies ||x|| adv -x|| p ≤ε,||·|| pLet p represent the p-norm distance. In a white-box scenario, adversarial attacks can be viewed as an optimization problem, i.e., searching for a sample x within the neighborhood of x. adv To maximize the loss function of the target network classifier, it is expressed as follows:

[0005]

[0006] Currently widely used adversarial example generation methods include FGSM, I-FGSM, and MI-FGSM. The basic idea of ​​the FGSM method is to generate adversarial perturbations during the backpropagation process of the neural network. Specifically, given an input sample x and its corresponding ground truth label y, the gradient of the loss function with respect to the input sample is calculated, and a small perturbation is added to the input sample along the inverse direction of the gradient, thus generating an adversarial example. The magnitude of this perturbation depends on a hyperparameter called the perturbation size (or perturbation amplitude), which determines the strength of the adversarial attack. The adversarial examples generated by the FGSM method are represented as follows:

[0007]

[0008] Let represent the gradient of the loss function with respect to x, sign(·) denotes the sign function, and ε represent the perturbation magnitude. The I-FGSM method progressively adds the perturbation to the image samples along the gradient direction and recalculates the gradient direction after each iteration, as shown below:

[0009]

[0010] α is the iteration step size, and clip(·) is the clipping function, which restricts the adversarial examples to the neighborhood of the original examples, ensuring that the image is not distorted while achieving the desired adversarial effect. The MI-FGSM method proposes introducing momentum when generating adversarial examples and accumulating gradients through multiple iterations. Momentum is used to adjust the step size of each iteration to maintain directional consistency, thereby accelerating convergence and improving attack effectiveness, as shown below:

[0011]

[0012] μ is the momentum decay factor, g t This represents the cumulative gradient at iteration t. The FGSM series of methods are a class of simple, fast, and easily implemented adversarial attack methods. However, in real-world scenarios, black-box attacks are more practical and feasible. These methods perform poorly when attacking black-box models because they rely on the gradient information of the target model. The internal structure of a black-box model is unknown to the attacker, making it impossible to accurately calculate gradient information and thus failing to generate effective adversarial examples.

[0013] Furthermore, attackers often use transfer-based methods to attack target models. The transferability of adversarial examples refers to the ability of a carefully crafted adversarial example targeting a particular model to successfully deceive other models, even those with different architectures or training data. Attackers can use adversarial examples generated on other models as direct input to the target model to carry out adversarial attacks without needing to understand the specific details of these models. This phenomenon demonstrates the universality and harmfulness of adversarial examples. However, due to the lack of detailed information about the target model, attackers often find it difficult to generate effective adversarial examples, resulting in poor transferability between different models and making black-box attacks more difficult. Therefore, improving the transferability of adversarial examples is currently a research hotspot in this field. Summary of the Invention

[0014] To address the above problems, this invention provides a method for generating adversarial examples based on multi-space probability enhancement, comprising the following steps:

[0015] S1. Collect multiple image samples to form the original sample dataset;

[0016] S2. Construct a multi-space probability enhancement model, which includes an enhancement branch based on pixel space and an enhancement branch based on HSV color space;

[0017] S3. Set the maximum number of iterations T, and initialize the number of iterations t = 0;

[0018] S4. In the t-th iteration, based on the multi-space probability augmentation model, the data augmentation processing method of the input image samples is controlled by probability to obtain the augmented image samples;

[0019] S5. Input the enhanced image samples into the target model for training, and obtain the cumulative gradient according to the loss function; update the enhanced image samples through the cumulative gradient to obtain the perturbed image samples;

[0020] S6. Determine whether the maximum number of iterations T has been reached. If yes, output the current perturbation image sample as an adversarial sample. If not, set the current perturbation image sample as the input image sample, set t = t + 1, and then return to step S4.

[0021] Furthermore, step S4, based on the multi-space probability augmentation model, includes the following data augmentation processing method for input image samples controlled by probability:

[0022] A random value is selected within the interval [0,1] as the clipping and filling probability p; a random value is selected within the interval [0,1] as the color transformation probability q;

[0023] If p < 0.5 and q < 0.5, then a random enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample;

[0024] If p < 0.5 and q ≥ 0.5, then the pixel-space-based enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample;

[0025] If p≥0.5 and q<0.5, then the enhancement branch based on the HSV color space is selected to perform data enhancement processing on the input image sample to obtain the enhanced image sample;

[0026] If p ≥ 0.5 and q ≥ 0.5, then the input image sample is directly used as the augmented image sample.

[0027] Furthermore, a pixel-space-based enhancement branch is selected to perform data augmentation processing on the input image samples to obtain enhanced image samples, including:

[0028] S11. In [Min] crop The pruning ratio prop is a random value taken within the interval [0.9], where Min crop Indicates the minimum cutting ratio;

[0029] S12. Crops the input image sample according to the cropping ratio prop to obtain a cropped image. Fill the area around the cropped image with pixel values ​​of 0 to obtain a filled image. The size of the filled image is the same as the size of the input image sample. Output the filled image as an enhanced image sample.

[0030] Furthermore, an enhancement branch based on the HSV color space is selected to perform data augmentation processing on the input image samples to obtain enhanced image samples, including:

[0031] S21. Decompose the RGB three channels of the input image sample into red, green, and blue channels; obtain the channel value x of the red channel R. R The channel value x of the green channel G and the channel value x of the blue channel B ;

[0032] S22. Based on x R x G x B The three channel values ​​are converted to RGB to HSV to obtain the hue value x. H Saturation value x S and brightness value x V ;

[0033] S23. Randomize a value rand within the interval [0, 360]. H Rand takes a random value within the interval [-0.2, 0.22].S Based on the random value rand H For hue value x H Update to obtain hue value x′ H Based on the random value rand S For saturation value x S The saturation value x′ is obtained by updating. S ;

[0034] S24. Based on the hue value x′ H Saturation value x′ S and brightness value x V The conversion is performed to obtain the updated channel value x′. R Update channel value x′ G and update channel value x′ B ;

[0035] S25. x′ R 、x′ G 、x′ B The images are merged to form a new image, which is then output as an enhanced image sample.

[0036] Furthermore, RGB to HSV conversion methods include:

[0037] Choose x R x G x B The maximum value in the range is used as the brightness value x. V ;

[0038] If x V =0, then the saturation value x S =0, otherwise saturation value

[0039] If x V =x R Then the hue value If x V =x G Then the hue value x V =x B Then the hue value

[0040] Determine the hue value x H Is it less than 0? If so, let x be... H =x H +360, otherwise remain unchanged.

[0041] Furthermore, the specific process of the (t+1)th iteration includes:

[0042] Randomly select an enhancement branch for the input image sample x tData augmentation processing is performed to obtain enhanced image samples. Represented as:

[0043]

[0044] Where MT represents the multi-space probability augmentation model, p represents the cropping and padding probability, q represents the color transformation probability, and Min crop Indicates the minimum cutting ratio;

[0045] Enhance image samples Input the target model for training, and calculate the loss function for enhancing image samples. The gradient is used to obtain the cumulative gradient g of the (t+1)th iteration. t+1 The calculation formula is:

[0046]

[0047] in, Represents the loss function Enhanced image samples The gradient of , where y represents the label of the image sample, θ represents the target model parameters, μ represents the decay coefficient, and ||·||1 represents the L1 norm;

[0048] By accumulating gradient g t+1 Update and enhance image samples Obtain perturbation image samples Represented as:

[0049]

[0050] Where α = ε / T represents the number of iterations, ε represents the perturbation amplitude, and sign(·) represents the sign function. This represents the clipping function.

[0051] Furthermore, the multi-space probability enhancement model is specifically represented as follows:

[0052] MT(x t ;p,q,Min crop ) = T CP (x t ;p,Min crop )+T CC (x t ;q)

[0053]

[0054] Among them, T CP (x;Min crop ) represents the output of the pixel-space-based enhancement branch, T cp (x;p,Mincrop T represents the output obtained by using a pixel-space-based random image cropping and padding method with probability p. CC (x) represents the output of the enhanced branch based on the HSV color space, T CC (x; q) represents the output obtained by using a random color transformation method based on the HSV color space for an image with probability q.

[0055] The beneficial effects of this invention are:

[0056] To address the low success rate of adversarial attacks in black-box scenarios and improve the transferability of adversarial examples, this invention proposes an adversarial example generation method based on multi-space probability augmentation. This method introduces two random data augmentation branches into the adversarial example generation process. Each branch implements random image cropping and padding and random color transformation based on the pixel space and HSV color space, respectively. A probabilistic model is constructed to control the returned image samples, increasing the diversity of the original samples while reducing the dependence of the adversarial examples on the original dataset, thereby improving their transferability. Based on this, the method is introduced into an ensemble model to further improve the success rate of adversarial attacks in black-box scenarios. Extensive experiments on the ImageNet dataset validate the proposed method. Compared to the benchmark methods IFGSM and MIFGSM, the proposed method achieves an average improvement in black-box attack success rate of 28.71% and 8.44%, respectively; compared to adversarial attack methods based on single-space probability augmentation, the success rate is improved by up to 6.81%. The proposed method can improve the transferability of adversarial examples with relatively low complexity, enabling effective attacks in black-box scenarios. Attached Figure Description

[0057] Figure 1 This is a flowchart of the adversarial example generation method based on multi-space probability enhancement of the present invention;

[0058] Figure 2 This invention provides a visualization of the original sample and the sample after cropping and padding.

[0059] Figure 3 This invention visualizes the original sample and the sample after color transformation;

[0060] Figure 4 This invention visualizes the original samples and the adversarial samples generated by each method. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] Existing research indicates that data augmentation can improve a model's generalization ability by transforming and expanding training data in various ways, enabling the model to better adapt to different input variations. Introducing data augmentation into the adversarial example generation process can effectively expand the attacker's attack space. By applying various data augmentation techniques to the generated adversarial examples, attackers can explore the generation methods of adversarial examples in more dimensions, making the generated adversarial examples more robust and thus improving the attack effectiveness in black-box scenarios.

[0063] To ensure the diversity of input samples, this invention proposes a Multi-space Probability Enhancement Attack Method (MPEAM). Before each attack iteration, this method randomly processes the original image samples, performing random cropping and padding based on pixel space and random color transformation based on the HSV color space. The returned data samples are controlled by probability hyperparameters p and q. The dataset after these two probability enhancement branches increases random diversity compared to the original dataset, reducing the adversarial examples' dependence on the original dataset and thus improving the transferability of the adversarial examples. Therefore, this invention models the probability transformation model as a multi-space probability enhancement process, where the hyperparameter represents the minimum cropping ratio. Thus, the optimization problem of equation (1) can be transformed into equation (10):

[0064]

[0065] MT(x; p, q, Min) crop ) = T CP (x;p,Min crop )+T CC (x;q) (9)

[0066]

[0067] Among them, T CP (x;Min crop ) represents the output of the pixel-space-based enhancement branch, T cp (x;p,Min crop T represents the output obtained by using a pixel-space-based random image cropping and padding method with probability p. CC(x) represents the output of the enhanced branch based on the HSV color space, T CC (x; q) represents the output obtained by using a random color transformation method based on the HSV color space for an image with probability q.

[0068] MPEAM possesses excellent scalability, allowing direct integration with FGSM-type adversarial example generation methods to construct more transferable attack techniques. This invention integrates MPEAM and MIFGSM methods to form the MPE-MIFGSM method. By adjusting its hyperparameters, it allows for flexible switching between the two. The method flowchart is shown below. Figure 1 As shown. When both hyperparameters p and q are set to 0, MPE-MIFGSM is converted to MIFGSM.

[0069] Specifically, the present invention provides an adversarial example generation method based on multi-space probability enhancement, comprising the following steps:

[0070] S1. Collect multiple image samples to form the original sample dataset;

[0071] S2. Construct a multi-space probability enhancement model, which includes an enhancement branch based on pixel space and an enhancement branch based on HSV color space;

[0072] S3. Set the maximum number of iterations T, and initialize the number of iterations t = 0;

[0073] S4. In the t-th iteration, based on the multi-space probability augmentation model, the data augmentation processing method of the input image samples is controlled by probability to obtain the augmented image samples; S5. The augmented image samples are input into the target model for training, and the cumulative gradient is obtained according to the loss function; the perturbed image samples are obtained by updating the augmented image samples through the cumulative gradient;

[0074] S6. Determine whether the maximum number of iterations T has been reached. If yes, output the current perturbation image sample as an adversarial sample. If not, set the current perturbation image sample as the input image sample, set t = t + 1, and then return to step S4.

[0075] Specifically, step S4, based on the multi-space probability augmentation model, includes the following data augmentation processing method for input image samples controlled by probability:

[0076] A random value is selected within the interval [0,1] as the clipping and filling probability p; a random value is selected within the interval [0,1] as the color transformation probability q;

[0077] If p < 0.5 and q < 0.5, then a random enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample;

[0078] If p < 0.5 and q ≥ 0.5, then the pixel-space-based enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample;

[0079] If p≥0.5 and q<0.5, then the enhancement branch based on the HSV color space is selected to perform data enhancement processing on the input image sample to obtain the enhanced image sample;

[0080] If p ≥ 0.5 and q ≥ 0.5, then the input image sample is directly used as the augmented image sample.

[0081] The MPE-MIFGSM algorithm flow, formed by combining MPEAM and MIFGSM, is shown in Table 1.

[0082] Table 1 MPE-MIFGSM Algorithm Flow

[0083]

[0084]

[0085] Preferably, the pixel-space-based enhancement branch employs a pixel-space-based random cropping and padding method to process the image. In image processing, cropping refers to selecting a specified region from the target image and extracting that region to form a new image. Padding involves adding pixels around the target image, typically to adjust the image size or maintain its aspect ratio. In this method's random cropping and padding process, a key hyperparameter, Min, is introduced. crop , representing the minimum cropping ratio, has a value range of [0.8, 0.9]. This parameter is introduced to control the degree of cropping to ensure that the image retains sufficient information after cropping. Once the image has been cropped, it is padded with 0 values ​​around it to ensure that the image is restored to its original size, thus effectively avoiding information loss. The purpose of this process is to maintain the integrity and accuracy of the image, thereby ensuring that the algorithm can subsequently analyze and process based on complete information. The algorithm flow for random image cropping and padding is shown in Table 2. After cropping and padding, the sample is as follows: Figure 2 As shown.

[0086] Table 2. Random Image Cropping and Filling Based on Pixel Space

[0087]

[0088] Specifically, the enhanced image samples are obtained by selecting a pixel-space-based enhancement branch to perform data augmentation processing on the input image samples, including:

[0089] S11. In [Min] cropThe pruning ratio prop is a random value taken within the interval [0.9], where Min crop Indicates the minimum cutting ratio;

[0090] S12. Crops the input image sample according to the cropping ratio prop to obtain a cropped image. Fills the area around the cropped image with pixel values ​​of 0 to obtain a filled image. The size of the filled image is the same as the size of the input image sample. The filled image is output as an enhanced image sample.

[0091] Preferably, the enhancement branch based on the HSV color space employs a random color transformation method based on the HSV color space to process images. Existing image datasets are mostly presented in RGB color space format. The RGB color space primarily represents colors through three channels: Red, Green, and Blue. This representation limits the expressive power of colors; for the human visual system, many colors cannot be accurately represented by a single combination of RGB channels. Furthermore, the three channels in the RGB color space are independent and cannot well represent the correlation between colors. In this invention, random color transformation is required. If using the RGB color space, the combination of colors and their spatial relationships must be considered, which can easily lead to image distortion during random transformation. The HSV color space describes colors through Hue, Saturation, and Value. This representation is closer to the human perception of color and more intuitively expresses the attributes of colors. In the HSV color space, hue, saturation, and brightness are independent, each controlling the overall color attributes, intensity, and lightness of an image. Adjusting one attribute does not affect the others, making color modification and control easier. Since this method only changes color, it only adds color offsets to hue and saturation. The color transformation algorithm flow is shown in Table 3. The samples after random transformation by this algorithm are shown below. Figure 3 As shown.

[0092] Table 2 Random Color Transformation of Images Based on HSV Color Space

[0093]

[0094]

[0095] Specifically, an enhancement branch based on the HSV color space is selected to perform data augmentation processing on the input image samples to obtain enhanced image samples, including:

[0096] S21. Decompose the RGB three channels of the input image sample into red, green, and blue channels; obtain the channel value x of the red channel R. R The channel value x of the green channelG and the channel value x of the blue channel B ;

[0097] S22. Based on x R x G x B The three channel values ​​are converted to RGB to HSV to obtain the hue value x. H Saturation value x S and brightness value x V ;

[0098] S23. Randomize a value rand within the interval [0, 360]. H Rand is a random value generated within the interval [-0.2, 0.2]. S Based on the random value rand H For hue value x H Update to obtain hue value x′ H Based on the random value rand S For saturation value x S The saturation value x′ is obtained by updating. S ;

[0099] S24. Based on the hue value x′ H Saturation value x′ S and brightness value x V The conversion is performed to obtain the updated channel value x′. R Update channel value x′ G and update channel value x′ B ;

[0100] S25. x′ R 、x′ G 、x′ B The images are merged to form a new image, which is then output as an enhanced image sample.

[0101] Specifically, before converting RGB to HSV, the values ​​of R, G, and B need to be limited to between 0 and 1. RGB to HSV conversion methods include:

[0102] Choose x R x G x B The maximum value in the range is used as the brightness value x. V ;

[0103] If x V =0, then the saturation value x S =0, otherwise saturation value

[0104] If x V =x R Then the hue value If x V =x G Then the hue value x V =x B Then the hue value

[0105] Determine the hue value x H Is it less than 0? If so, let x be... H =x H +360, otherwise remain unchanged.

[0106] Preferably, the performance of the method proposed in this invention is demonstrated through experiments, using the following seven classification models: Resnet-v2-101 (Res-101), Resnet-v2-152 (Res-152), Inception-v3 (Inc-v3), Inceptionv4 (Inc-v4), InceptionRsenetv2 (IncRes-v2), and adv-Inception-v3 (Inc-v3). adv The tests included Res-101, Xce, Inc-v3, and Inc-v4 models in a white-box environment, and Res-152, IncRes-v2, and Inc-v3 models. adv These three models were tested in a black-box scenario. ImageNet is one of the most commonly used datasets for image classification, detection, and localization in the field of deep learning. In this invention, one image that can be correctly classified by the experimental model was randomly selected from each class in the validation set of the ImageNet dataset to form a dataset of 1000 adversarial examples.

[0107] This invention selects iterative IFGSM and MIFGSM from the FGSM class of methods as the benchmark methods. Figure 4 Visualizing the original samples and adversarial samples generated by each method clearly demonstrates that the adversarial perturbations generated by the proposed method have higher stealth capabilities. Experiments verify the effectiveness of the proposed method by comparing the attack success rates of MPE-MIFGSM and the baseline method on the experimental model. For the baseline method, the hyperparameters are set as follows: maximum perturbation ε = 16, number of iterations T = 10, iteration step size α = 1.6, and momentum decay coefficient μ = 1. For the hyperparameters of the proposed multi-space probability enhancement method: pruning-fill probability p = 0.5, color transformation probability q = 0.5, indicating that the original sample and the transformed sample have the same weight, and the minimum pruning ratio Min... crop =0.8, ensuring that some noise is introduced without losing sample feature information.

[0108] This invention conducts attack tests on experimental models against the proposed method MPE-MIFGSM and benchmark attack methods under both black-box and white-box conditions. The attack success rate is the ratio of the number of misclassified samples to the total number of samples. IFGSM, MIFGSM, and MPE-MIFGSM generate adversarial examples on four models under white-box conditions, and their attack success rates are tested on all experimental models. The adversarial attack success rates of the benchmark methods and the proposed method are shown in Table 4.

[0109] As shown in Table 4, the white-box attack success rate of MPE-MIFGSM remained above 96.02%. Compared to MIFGSM, the attack success rate in the white-box scenario decreased slightly, but still remained at a high level. This may be because the diversified operations introduced into the original adversarial attack methods made the model more robust, leading to a decrease in the white-box attack success rate. The black-box success rate, however, showed a significant improvement. For example, when using Res-101 as the white-box model to attack the IncRes-v2 model in the black-box scenario, the attack success rate increased by 10.75%, while the attack success rate against the adversarially trained Inc-v3 model increased significantly. adv The success rate of network-based attacks also increased by 5.6%. These experimental results demonstrate that the MPE-MIFGSM method can achieve a high success rate in white-box scenarios and significantly improve the success rate in black-box scenarios.

[0110] Table 4 Comparison of success rates for attacking a single model

[0111]

[0112] Ensemble models are a machine learning technique that improves overall performance or generalization ability by combining multiple individual models. Existing literature indicates that if an adversarial example is adversarial in multiple networks, then the adversarial example may have higher transferability. Therefore, attacking a collection of multiple networks simultaneously can generate more aggressive adversarial examples. The specific ensemble method used in this invention is shown in the following equation (11):

[0113]

[0114] Among them l k (X;θ k ) represents the output of the k-th model, w k This represents the ensemble weights of the model, and K represents the number of models, and X represents the input samples for the models.

[0115] The experiments used IFGSM, MIFGSM, and MPE-MIFGSM to generate adversarial examples on ensemble models of Res-101, Xce, Inc-v3, and Inc-v4, and attacked all experimental models. The ensemble weights for each network remained consistent at 1 / 4. The experimental results are shown in Table 5. Table 5 shows that the adversarial examples generated on the ensemble models generally have high transferability. Compared to IFGSM and MIFGSM, MPE-MIFGSM increased the average attack success rate by 28.72% and 8.44% respectively in the black-box scenario. Compared to MIFGSM, the white-box attack success rate of this method decreased slightly, but the attack success rate in the black-box scenario significantly improved. For Res-152 in the black-box scenario, the attack success rate reached 94.81%, and for the adversarially trained Inc-v3... adv The attack success rate was 56.48%.

[0116] Table 5 Comparison of Success Rates of Attack Integration Models

[0117]

[0118] To further verify the effectiveness of the proposed method, MPE-MIFGSM was compared with single-space-based probabilistic augmentation adversarial attack methods, i.e., image samples were only subjected to pixel-space-based cropped and padded (CP) or HSV-space-based color transformation (CC). Adversarial examples were generated on the Res101, Xce, Inc-v3, and Inc-v4 ensemble models to attack all experimental models. The experimental results are shown in Table 6. Table 6 shows that compared to CP-MIFGSM and CC-MIFGSM, the success rate of white-box attacks with MPE-MIFGSM is slightly lower. This is because the introduction of excessive data augmentation allows the model to better learn the invariance of the data, making it more tolerant of small perturbations, thus reducing the effectiveness of adversarial perturbations. The success rate of black-box attacks improved by an average of 2.45-4.55%, with the highest improvement of 6.81% for Inc-v3adv.

[0119] Table 6 Comparison of attack success rates with single-space probability enhancement methods

[0120]

[0121] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "setting," "connection," "fixing," "rotation," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal connection of two components or the interaction between two components. Unless otherwise explicitly limited, those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0122] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for generating adversarial examples based on multi-space probability enhancement, characterized in that, Includes the following steps: S1. Collect multiple image samples to form the original sample dataset; S2. Construct a multi-space probability enhancement model, which includes an enhancement branch based on pixel space and an enhancement branch based on HSV color space; S3. Set the maximum number of iterations T, and initialize the number of iterations t=0; S4. In the t-th iteration, based on the multi-space probability augmentation model, the data augmentation processing method of the input image samples is controlled by probability to obtain the augmented image samples; Step S4, based on a multi-space probability augmentation model, involves data augmentation processing of input image samples using probability control, including: A random value is selected within the interval [0,1] as the clipping and filling probability p; a random value is selected within the interval [0,1] as the color transformation probability q; If p < 0.5 and q < 0.5, then a random enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample; If p < 0.5 and q ≥ 0.5, then the pixel-space-based enhancement branch is selected to perform data augmentation processing on the input image sample to obtain the enhanced image sample; If p≥0.5 and q<0.5, then the enhancement branch based on the HSV color space is selected to perform data enhancement processing on the input image sample to obtain the enhanced image sample; If p≥0.5 and q≥0.5, then the input image sample is directly used as the augmented image sample; S5. Input the enhanced image samples into the target model for training, and obtain the cumulative gradient according to the loss function; update the enhanced image samples through the cumulative gradient to obtain the perturbed image samples; S6. Determine whether the maximum number of iterations T has been reached. If so, output the current perturbation image sample as an adversarial sample. If not, set the current perturbation image sample as the input image sample, set t=t+1, and then return to step S4.

2. The adversarial example generation method based on multi-space probability enhancement according to claim 1, characterized in that, The input image samples are augmented by selecting a pixel-space-based augmentation branch, resulting in augmented image samples, including: S11. In [Min] crop The pruning ratio prop is a random value taken within the interval [0.9], where Min crop Indicates the minimum cutting ratio; S12. Crops the input image sample according to the cropping ratio prop to obtain a cropped image. Fill the area around the cropped image with pixel values ​​of 0 to obtain a filled image. The size of the filled image is the same as the size of the input image sample. Output the filled image as an enhanced image sample.

3. The adversarial example generation method based on multi-space probability enhancement according to claim 1, characterized in that, An enhanced image sample is obtained by selecting an enhancement branch based on the HSV color space to perform data augmentation processing on the input image sample, including: S21. Decompose the RGB three channels of the input image sample into red, green, and blue channels; obtain the channel value x of the red channel R. R The channel value x of the green channel G and the channel value x of the blue channel B ; S22. Based on x R x G x B The three channel values ​​are converted to RGB to HSV to obtain the hue value x. H Saturation value x S and brightness value x V ; S23. Take a random value rand within the interval [0, 360]. H Rand is a random value generated within the interval [-0.2, 0.2]. S Based on the random value rand H For hue value x H Update to get hue value Based on the random value rand S For saturation value x S Update to obtain saturation value ; S24. Based on hue values Saturation value and brightness value x V Perform the conversion to obtain the updated channel value. Update channel value and update channel value ; S25. Will , , The images are merged to form a new image, which is then output as an enhanced image sample.

4. The adversarial example generation method based on multi-space probability enhancement according to claim 3, characterized in that, RGB to HSV conversion methods include: Choose x R x G x B The maximum value in the range is used as the brightness value x. V ; If x V =0, then the saturation value x S =0, otherwise the saturation value x S = ; If x V =x R Then the hue value x H = If x V =x G Then the hue value x H = ;x V =x B Then the hue value x H = ; Determine the hue value x H Is it less than 0? If so, let x be... H =x H +360, otherwise remain unchanged.

5. The adversarial example generation method based on multi-space probability enhancement according to claim 1, characterized in that, The specific process of the (t+1)th iteration includes: Randomly select an enhancement branch for the input image sample x t Data augmentation processing is performed to obtain enhanced image samples. , represented as: Where MT represents the multi-space probability augmentation model, p represents the cropping and padding probability, q represents the color transformation probability, and Min crop Indicates the minimum cutting ratio; Enhance image samples Input the target model for training, and calculate the loss function for enhancing image samples. The gradient is used to obtain the cumulative gradient g of the (t+1)th iteration. t+1 The calculation formula is: in, Represents the loss function Enhanced image samples The gradient of θ, where y represents the label of the image sample and θ represents the target model parameters. The attenuation coefficient is represented by ||·||1, which represents the L1 norm. By accumulating gradient g t+1 Update and enhance image samples Obtain perturbation image samples , represented as: in, Indicates the number of iterations. This indicates the disturbance amplitude, and sign(·) represents the sign function. This represents the clipping function.

6. The adversarial example generation method based on multi-space probability enhancement according to claim 5, characterized in that, The multi-space probability enhancement model is specifically represented as follows: in, This represents the output of the pixel-space-based enhancement branch. T represents the output obtained by using a pixel-space-based random image cropping and padding method with probability p. CC (x) represents the output of the enhanced branch based on the HSV color space, T CC (x;q) represents the output obtained by using a random color transformation method based on the HSV color space for an image with probability q.

Images