Generalized latent infection-based adversarial sample preparation method

Abstract

The application discloses a kind of preparation methods of adversarial sample based on general latent infection, first, clean sample set and target sample set are acquired, the category included in target sample set is divided into known category and unknown category, target sample belonging to known category set constitutes target sample set, and the adversarial sample generation model including feature extractor, size matching module and generator is constructed, the model is superimposed to the corresponding infection layer input of generator after extracting features to target sample and carrying out size matching, to generate adversarial sample to clean sample;Adversarial sample generation model is trained using training sample set, then for each clean sample in clean sample set, randomly select a target sample different from its category together input trained adversarial sample generation model to generate adversarial sample.The adversarial sample generation model constructed by the application supports generating adversarial sample based on any target sample, to improve the universality of adversarial sample generation.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of adversarial sample generation, and more specifically relates to a method for preparing adversarial samples based on general latent infection. BACKGROUND

[0002] Deep neural networks (DNNs) have made remarkable progress in the field of artificial intelligence, successfully applied to image recognition, natural language processing and autonomous driving, and many other fields. Despite the great success, DNNs have been proven to be very vulnerable to adversarial attacks, which mislead DNNs by adding perturbations that are almost imperceptible to the human eye in clean images. Therefore, it is crucial to understand the mechanism behind DNNs and design effective evaluation methods to identify the flaws of DNNs before they are deployed in security-sensitive applications.

[0003] Adversarial attacks can generally be divided into two categories: untargeted attacks and targeted attacks. The goal of untargeted attacks is to make DNNs fail, while targeted attacks not only make DNNs fail, but also mislead them to identify images as a specific target preset. Since targeted attacks have high flexibility and pose a serious threat to security-sensitive applications, they have become the main tool for evaluating the vulnerability of DNNs.

[0004] Targeted attack methods mainly include two technical routes: iterative framework and generator-based framework. The iterative framework generates adversarial samples for each clean image through iteration, but it is prone to overfitting white-box models and has high computational overhead. The generator-based framework uses well-trained generative models to construct adversarial samples, showing good migration potential. However, the generator used in existing methods is only trained to adapt to known target classes. For unknown target classes (i.e., classes not seen during training), existing methods cannot generate effective adversarial samples unless the generator is retrained, limiting comprehensive evaluation of DNNs. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art and provide a method for preparing adversarial samples based on general latent infection. The adversarial sample generation model constructed supports the generation of adversarial samples based on any target sample, whether it is a known class, thereby improving the generality of adversarial sample generation.

[0006] To achieve the above-mentioned purpose of the application, the method for preparing adversarial samples based on general latent infection comprises the following steps:

[0007] S1: Obtain two image sample sets according to actual needs, respectively clean sample set C and target sample set T, the clean sample set C contains a plurality of clean samples x c , and the target sample set T contains a plurality of target samples x tlabeling a corresponding class for each image sample;

[0008] S2: classifying sample categories in the target sample set into a known category set y known and an unknown category set y unknown ;

[0009] S3: constructing a target sample set R from target samples in the target sample set T whose categories belong to the known category set y known ; for each clean sample x c in the clean sample set C, randomly selecting a target sample x c different from the clean sample x t in category from the target sample set R, taking the clean sample x c and the target sample x t as a training sample pair, thereby constructing a training sample set;

[0010] S4: constructing an adversarial sample generation model, including a feature extractor, a size matching module and a generator, wherein:

[0011] the feature extractor is used to extract features of the target sample, and the obtained target feature image is sent to the size matching module;

[0012] the size matching module is used to map the target feature image into input image sizes of K infection layers of the generator respectively, and send the K target feature images of different sizes to the corresponding infection layers of the generator;

[0013] the generator is used to generate an adversarial sample x adv according to the input clean sample and the K target feature images of different sizes, wherein K layers are selected as infection layers in each structure layer of the generator, and in the generation process, the original input features of each infection layer are superimposed with the received target feature image and then input to the infection layer for processing;

[0014] S5: training the adversarial sample generation model using the training sample set to obtain a trained adversarial sample generation model;

[0015] S6: for each clean sample x c in the clean sample set C, randomly selecting a target sample different from it in category from the target sample set T, and then inputting them into the trained adversarial sample generation model in step S5 to obtain an adversarial sample.

[0016] The application is based on a general potential infection adversarial sample preparation method, first acquires a clean sample set and a target sample set, divides the categories contained in the target sample set into known categories and unknown categories, forms a target sample set by target samples in the target sample set whose categories belong to the known category set, and constructs an adversarial sample generation model including a feature extractor, a size matching module and a generator, the model is input to the corresponding infection layer of the generator by extracting features from the target sample and performing size matching, so as to infect the clean sample to generate an adversarial sample; the training sample set is used to train the adversarial sample generation model, and then for each clean sample in the clean sample set, an arbitrary target sample different from the category of the clean sample is selected to input the trained adversarial sample generation model together, and an adversarial sample is obtained.

[0017] The application has the following beneficial effects:

[0018] 1) The application can introduce category features between different categories of images, without relying on specific categories or target DNN models, thereby improving the generation ability and quality of adversarial samples for unknown target categories;

[0019] 2) Experiments show that the application can be used for standard models, adversarial training models and visual-linguistic basic models, effectively generating high-quality adversarial samples for any target category, and has a wide range of application scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0020] Figure 1 is a specific embodiment flowchart of the application based on a general potential infection adversarial sample preparation method;

[0021] Figure 2 is a structure diagram of the adversarial sample generation model in the application;

[0022] Figure 3 is a training and attack schematic diagram of the adversarial sample generation model in the embodiment;

[0023] Figure 4 is a comparison diagram of the attack success rate of the application in a series of known categories in the embodiment;

[0024] Figure 5 is a comparison diagram of the attack success rate of the application method and the random selection method for known categories in the embodiment;

[0025] Figure 6 is a comparison diagram of the attack success rate of the number of samples in each category to attack unknown categories in the embodiment. DETAILED DESCRIPTION

[0026] The specific embodiments of the present application based on the universal potential infection of the preparation method of the adversarial sample are described below in conjunction with the drawings, so that those skilled in the art can better understand the present application. It needs to be specially reminded that in the following description, when the detailed description of the known function and design may weaken the main content of the present application, these descriptions will be ignored here.

[0027] Embodiments

[0028] Figure 1 is the specific embodiment flowchart of the present application based on the universal potential infection of the preparation method of the adversarial sample. As Figure 1 shown, the specific steps of the present application based on the universal potential infection of the preparation method of the adversarial sample are:

[0029] S101: Obtain an image sample set:

[0030] According to the actual needs, two image sample sets are obtained, which are a clean sample set C and a target sample set T. The clean sample set contains a plurality of clean samples x c , and the target sample set contains a plurality of target samples x t . The corresponding class of each image sample is labeled.

[0031] S102: Classify the class type:

[0032] According to the actual needs, the sample classes in the target sample set are classified into a known class set y known and an unknown class set y unknown .

[0033] S103: Select a training sample set:

[0034] The target samples in the target sample set T whose classes belong to the known class set y known are used to form a target sample set R. For each clean sample x c in the clean sample set C, a target sample x c with a different class is randomly selected from the target sample set R. x t , the clean sample x c and the target sample x t are used as a training sample pair, thereby forming a training sample set.

[0035] S104: Construct an adversarial sample generation model:

[0036] In order to generate high-quality adversarial samples, the present application constructs an adversarial sample generation model. Figure 2 is the structure diagram of the adversarial sample generation model in the present application. As Figure 2As shown, the adversarial sample generation model in the present application includes a feature extractor, a dimension matching module (DMM) and a generator. Next, each module will be described in detail.

[0037] The feature extractor is used to extract features from the target sample and send the obtained target feature image to the dimension matching module. In this embodiment, the feature extractor uses a feature extraction module removed from a pre-trained classification model. In this way, the parameters of the feature extractor can be fixed during training to improve training efficiency.

[0038] The dimension matching module is used to map the target feature image to the input image size of K infection layers of the generator, respectively, and send the K target feature images of different sizes to the corresponding infection layers of the generator. The dimension matching module is a commonly used module in the field of computer vision or deep learning, and its specific structure can be set as needed in actual application.

[0039] The generator is used to generate an adversarial sample x adv wherein K layers are preselected as infection layers in each structure layer of the generator, and the original input features of each infection layer are superimposed with the received target feature image before being input into the infection layer for processing. By using the above method, the features of the target sample can be introduced and infect the clean sample, thereby generating an adversarial sample. The generator in this embodiment uses a U-Net network, which is composed of a series of convolutional layers and pooling operations, including a symmetric encoder (downsampling path) and a decoder (upsampling path). U-Net has skip connections that can help pass more rich information and alleviate the problem of gradient vanishing, thereby improving the quality of the generated image. In actual application, the initial image output by the generator may exceed the pixel value, so a clipping function clip() is used to process it, which clips the numerical value to the image pixel value range, thereby obtaining the adversarial sample.

[0040] S105: Train the adversarial sample generation model:

[0041] The training sample set is used to train the adversarial sample generation model, and a trained adversarial sample generation model is obtained.

[0042] The setting of the loss function is very important for the adversarial sample generation model, and can be set as needed in actual application. Figure 3 is a schematic diagram of the training and attack of the adversarial sample generation model in this embodiment. As shown in Figure 3As shown, the loss function of the adversarial sample generation model in this embodiment adopts two parts, one part is the feature similarity between the target sample and the generated adversarial sample, and the other part is the feature similarity between the difference noise of the clean sample and the generated adversarial sample and the target sample, and the specific calculation method of the loss function LOSS is as follows:

[0043] LOSS=[1-S(F(x adv ),F(x t ))]+α[1-S(F(δ),F(x t ))]

[0044] Wherein, S() represents the feature similarity, F() represents the feature extraction, δ=x adv -x c represents the deviation image, and α represents the weight hyperparameter. In this embodiment, the feature extraction module of the classification head module is removed in the pre-trained classifier, and the cosine distance is used for the feature similarity.

[0045] S106: generate adversarial samples:

[0046] For each clean sample x c in the clean sample set C, an arbitrary target sample different from its category is selected from the target sample set T, and then the two are input into the adversarial sample generation model trained in step S105 to obtain an adversarial sample.

[0047] In order to better illustrate the technical effect of the present application, a specific example is used to experimentally verify the present application.

[0048] Embodiment

[0049] This embodiment aims to demonstrate the effectiveness of the present application. In this embodiment, the ImageNet training set is used to train the model of the present application, and the performance is evaluated on the ImageNet validation set. The present application considers a variety of network models, including DenseNet-121, ResNet-50 and VGG-19 as alternative models. In this embodiment, a variety of black box models are selected, including ResNet-152, VGG-19, Inception-v3, ViT, DeiT and CLIP, to test the transferability of the attack. Then, the proposed method is evaluated on the defense model, and the defense model used in this embodiment includes Inc-v3adv, Inc-v3ens3, Inc-v3ens4, IncRes-v2ens, and large visual-linguistic models such as LLaVA and Qwen-VL.

[0050] For different attack categories, different comparison methods are selected in this embodiment: for iterative attacks, MI algorithm and SU algorithm are selected; for single-target generation attacks, TTP method is selected; for multi-target generation attacks, HGN and ESMA are selected. In all experiments, the perturbation constraint ε is set to 16, the number of known categories N is set to 200, α is set to 0.5, and the number of samples M in each known category is set to 325. The present application uses the AdamW optimizer to train the generator for 20 cycles.

[0051] In this embodiment, 200 categories are selected from ImageNet as known categories, and the remaining 800 categories are used as unknown categories. Then the generator is trained using the known categories, and the success rate of targeted attacks is evaluated on unknown categories. Since only HGN and the present application can be evaluated on unknown categories, this embodiment only compares the attack success rates of the present application (denoted as GAKer) and HGN on different models. Table 1 is a comparison table of attack success rates of the present application and HGN algorithm in this embodiment.

[0052]

[0053] Table 1

[0054] As shown in Table 1, the attack success rate of the present application is significantly better than HGN, highlighting its excellent transferability. For example, when using ResNet-50 as the substitute model and VGG-19 as the black box model, the present application achieves a success rate of 41.69% on unknown categories, while HGN only achieves 0.05%. This result highlights the limitations of existing methods in generating targeted adversarial samples for unknown categories, while the present application demonstrates its effective generalization ability for these categories. Even when the substitute model is ResNet-50, the attack success rate of the present application on the VGG-19 black box model for unknown categories reaches 41.69%, which highlights the limitations of existing methods in generating adversarial samples for unknown categories, and proves the effective generalization ability of the present application on these categories.

[0055] In addition, the method of the present application was compared with the state-of-the-art iterative-based method (SU), single-objective generator-based attack (TTP) and multi-objective generator-based attacks (HGN, ESMA) on the known classes. All multi-objective generator-based attacks (HGN, ESMA and the method of the present application) were trained on the same 200 classes. The same 200 classes were used for training. Since the TTP method requires training a model for each target class, the cost of training 200 models is too high. Therefore, 10 classes were randomly selected from the 200 classes, and 10 TTP models (TTP-10) were trained for each surrogate model, respectively. Then, the method of the present application (denoted as GAKer-10) was tested on the same 10 classes. Table 2 is a comparison table of the success rates of the directed attacks of the known classes of the present application and the comparative methods in this embodiment.

[0056]

[0057] Table 2

[0058] As shown in Table 2, the success rate of the directed attack of the present application on the black-box model is higher than that of the iterative-based SU method. For example, if the surrogate model is Dense-121, the average success rate of the present application on different models is 10.38% higher than that of SU. Among different models, the present application is 10.38% higher than SU on average. For generator-based attacks, the success rate of the attack of the present application is similar to that of the ESMA method, but better than that of the HGN method. The performance of the present application on multiple models is improved by 10.5% and 5.47% on average compared with HGN and ESMA, respectively.

[0059] This embodiment also discusses the influence of different parameter selection in the training data set on the attack ability of the generator. The experimental results show that when the number of selected known classes increases from 10 to 500, the success rate of the generator attack on unknown classes is significantly improved. In addition, the number of samples selected for each known class has an important influence on the success rate of attacking unknown classes. When the number of samples for each class is set to 325, the success rate of the generator attack on the white-box model reaches a maximum of 41.69%.

[0060] Figure 4 Figure 1 is a comparison chart of the success rates of the present application in a series of known classes in this embodiment. As shown in Figure 1, the success rate of the present application on the white-box model is 41.69%, which is the highest among the four methods. The success rate of the SU method is 31.25%, which is the lowest among the four methods. The success rate of the TTP method is 34.38%, which is higher than that of the SU method but lower than that of the present application. The success rate of the HGN method is 36.25%, which is higher than that of the SU method but lower than that of the present application. Figure 4As shown in the table, the present embodiment uses Res-50 as the substitute model, and the performance of the Res-152 black box model is evaluated for known (K) and unknown (U) categories, and the influence of the number N of known categories on the performance of the generator is analyzed. When N is limited, such as 10 or 50, the success rate of the generator attack on the unknown category is relatively low. The reason for this limitation is that the generator is trained on a narrow group of known categories, so it is challenging to generalize in a wider category. However, when N increases to 500, the white-box success rate of the generator on the remaining 500 unknown categories is close to 49.45%. Due to the limitations of parameters and training, it is challenging to expect the generator to consistently achieve high success rates in a wide range of known categories. Therefore, considering the trade-off, the present invention ultimately chooses to set N to 200 to balance the performance of the generator on known and unknown categories.

[0061] As can be known from the description of the present invention, the adversarial sample generation model constructed by the present invention can generate adversarial samples for multiple different target samples, which belongs to a multi-target generation model. Research on multi-target generation models emphasizes not only determining the number of target categories but also selecting which target categories to attack. The number of target categories, but also selecting which target categories to attack. When there is a significant difference between the selected target categories, the generator can achieve a higher success rate of targeted attack.

[0062] The present invention uses similarity to measure the difference between the selected target categories to train the adversarial sample generation model, mainly including:

[0063] (1) Select some images with the smallest classification loss for each category.

[0064] (2) Extract the feature vectors of these images and calculate the average of the feature vectors to represent the target category.

[0065] (3) Introduce a similarity greedy algorithm to select a group of feature vectors with the largest cosine similarity difference, thereby identifying the known categories.

[0066] Specifically, the algorithm randomly selects a feature vector as the initial category and puts it into the selected group. Then, the algorithm selects a vector from the remaining feature vectors with the lowest average cosine similarity to the selected category group, and adds this selected category to the selected and repeats this process until the specified number of target categories is reached.

[0067] In the present invention, multiple experiments are conducted to eliminate the randomness caused by initial selection. To verify the effectiveness of the selection method of the present invention, it is compared with the random selection strategy. Figure 5Figure 4 is a graph showing the success rate of the attack on known classes by the method of the present application and the random selection method in the embodiment. As shown in Figure 4, the method of the present application is significantly better than random selection on known classes. Compared with the random selection method, the success rate of the present application on the black box model Res-152 is increased by 16.52%, and the success rate of the present application on the black box model Res-152 is increased by 16.52% when the substitute model is Res-50. This proves the necessity of selecting known classes and the effectiveness of the selection method. Figure 5

[0068] The number of samples in each known class, the number of samples in each known class when sorting the target data set (denoted by M), is a key factor. M is too small, which may result in the data set failing to capture the characteristics of the class, and M is too large, which may result in the data set failing to capture the characteristics of the class. And M is too large, which increases the possibility of containing poor quality samples. The larger the value of M, the more likely it is to contain poor quality samples, such as occlusion or blur, thereby weakening the representativeness of the data set. Weaken the representativeness of the characteristics of the class.

[0069] Samples with smaller classification loss are more representative of the target class, as they may exhibit more prominent features. They may exhibit more prominent features. Still following the greedy strategy described above, 200 known classes are selected, but different number of samples are selected for each known class. In the ImageNet training data set, each class contains about 1300 pictures, and the class contains about 1300 pictures. The present application will select 1, 130, 325, 650 and 1300 pictures with the smallest classification loss for each known class.

[0070] Figure 6 Figure 6 is a graph showing the success rate of the attack on unknown classes by the number of samples in each class in the embodiment. As shown in Figure 6, the number of samples in each class will significantly affect the success rate of attacking unknown classes. As M increases from 1, the success rate of attacking unknown classes also increases. The success rate of attacking unknown classes also increases. When M is set to 325, the white box attack success rate can reach up to 41.69%. Continuing to increase M will not improve the success rate of attacking unknown classes, and even reduce the performance of attacking known classes. Performance on known classes. Therefore, 325 is finally selected as the number of samples for each known class in the embodiment. This decision emphasizes the importance of the number and quality of target class samples. Figure 6 Through the above data analysis and comparison, it is proved that the method of the present application can effectively attack unknown classes and known classes in various models.

[0071]

[0072] ​​While the foregoing specific embodiments of the application have been described in some detail to provide a clear understanding thereof, it will be apparent to those of ordinary skill in the art that numerous modifications can be made to the specific embodiments described without departing from the spirit and scope of the application defined by the appended claims.

Claims

1. A method for preparing a general-purpose adversarial sample based on potential infection, characterized by, The method comprises the following steps: S1: According to the actual needs, two image sample sets are obtained, which are a clean sample set C and a target sample set T respectively, the clean sample set C contains a plurality of clean samples x c , and the target sample set T contains a plurality of target samples x t , and the corresponding category of each image sample is labeled; S2: classifying the sample categories in the target sample set into a known category set y according to actual needs known and an unknown category set y unknown ; S3: the target sample set T is divided into two parts, one part is the target sample set R, the other part is the target sample set C; the target sample set R is composed of target samples whose categories belong to the known category set y in the target sample set T; for each clean sample x in the clean sample set C known , a target sample x c whose category is different from the clean sample x c is randomly selected from the target sample set R t ; the clean sample x c and the target sample x t are taken as a training sample pair, thereby forming a training sample set; S4: constructing an adversarial sample generation model, comprising a feature extractor, a size matching module and a generator, wherein: the feature extractor is used to extract features of a target sample and send the obtained target feature image to the size matching module; the size matching module is used to map the target feature image into input image sizes of K infection layers of the generator respectively, and send K target feature images of different sizes to corresponding infection layers of the generator; The generator is used for generating the adversarial sample x according to the input clean sample and K target feature images of different sizes adv Wherein, in each structure layer of the generator, K layers are pre-selected as infection layers, and in the generation process, the original input features of each infection layer are superimposed with the received target feature image and then input into the infection layer for processing. S5: training the adversarial sample generation model by using a training sample set to obtain a trained adversarial sample generation model; S6: For each clean sample x in the clean sample set C c From the target sample set T, an arbitrary target sample different from its category is selected, and then input into the trained adversarial sample generation model in step S5 to obtain an adversarial sample.

2. The method of claim 1, wherein the method further comprises, in the step S4, the feature extractor adopts a feature extraction module removed from a pre-trained classification model.

3. The method of claim 1, wherein the method further comprises, in the step S4, the generator adopts a U-Net network.

4. The method of claim 1, wherein the method further comprises, in the step S5, the loss function LOSS in the training process of the adversarial sample generation model is calculated as follows: LOSS = S(F(x adv ), F(x t )) + a S(F(5), F(x t )) where S() denotes the feature similarity, F() denotes the feature extraction, and δ = x adv -x c denotes the bias image, and a denotes the weight hyperparameter.

5. The method of claim 4, wherein the method further comprises, the feature similarity adopts a cosine distance.

Images