Model enhancement-based variance reduction enhanced adversarial sample generation method

Abstract

The invention provides a variance reduction enhanced confrontation sample generation method based on model enhancement, which effectively improves black box aggressiveness while keeping excellent white box attack performance, and is not easy to defend by some existing confrontation attack defense methods. The method comprises the following steps: performing model enhancement on a victim model by adopting an input transformation pool to obtain an enhanced model set, and calculating an integrated gradient of the enhanced model set through K times of iteration; a new enhancement model is obtained by inputting the transformation pool, and the internal gradient of the internal adversarial sample and the internal gradient of the external adversarial sample are calculated according to the new enhancement model; obtaining a cumulative gradient for updating the internal adversarial sample, and updating the internal adversarial sample by using the cumulative gradient; using the last internal cumulative gradient to update the external gradient, and finally using the external gradient to update the external adversarial sample; and repeating the above steps for T times, and once iteration is completed, successfully generating an adversarial sample.

Description

Technical Field

[0001] The present invention relates to the technical field of deep learning security, and in particular to a variance reduction enhanced adversarial sample generation method based on model enhancement. Background Art

[0002] The success of deep learning has led to its amazing performance in various application scenarios, especially in the field of computer vision. As the performance of deep learning models has been greatly improved, problems that can cause model errors have become valuable. Recent studies have shown that deep learning is facing threats such as backdoor attacks, data poisoning attacks, and adversarial attacks. Among them, adversarial attacks are one of the most flexible and subtle attack methods. Specifically, adversarial samples are made by adding carefully designed perturbations to the original samples. These perturbations are difficult for humans to detect with the naked eye, but deep neural networks are extremely susceptible to these tiny perturbations, which in turn lead to model errors. In addition, it is interesting that adversarial samples are transferable, that is, adversarial samples made for one model can also be used to deceive other models, which makes it possible to attack without knowing the structure and parameters of the target model.

[0003] Currently, various methods in the field of adversarial attacks have problems such as being unable to retain white-box attack performance, having unsatisfactory black-box attack performance, and being easily defended. Summary of the invention

[0004] The purpose of the present invention is to overcome the above-mentioned deficiencies in the prior art and to provide a variance reduction enhanced adversarial sample generation method based on model enhancement, which effectively improves the black box attack performance while retaining the excellent white box attack performance, and is not easily defended by some existing adversarial attack defense methods, thereby greatly increasing the threat of adversarial attacks.

[0005] The technical solution of the present invention is a method for generating adversarial samples based on model enhancement and variance reduction, which is characterized by comprising the following steps:

[0006] Step 1: Use the input transformation pool S to enhance the victim model f to obtain the enhanced model set F, and calculate the integrated gradient g of the enhanced model set F through K iterations. ens ;

[0007] Step 2: Get a new enhanced model f′ by inputting the transformation pool S, and calculate the internal gradient g of the internal adversarial sample based on this new enhanced model f′ m and the internal gradient of the external adversarial example

[0008] Step 3: For the accumulated gradient G used to update the internal adversarial sample m+1 , obtained by the following formula: μ is the attenuation factor, using the cumulative gradient G m+1 To update the internal adversarial examples;

[0009] Step 4, Step 2 and Step 3 need to be repeated M times, and the last internal accumulated gradient G is used m+1 To update the external gradient G t+1 , the formula is as follows: G t+1 =μ·G t +G m+1 , and finally use this external gradient G t+1 To update external adversarial samples;

[0010] Step 5: Repeat the above steps T times; once the iteration is completed, the adversarial sample x is successfully generated. adv .

[0011] The transformation methods in the input transformation pool S in step 1 of the present invention include random horizontal flipping, random rotation, random distortion, random translation and random scaling.

[0012] In step 1 of the present invention, the relationship between the enhancement model set F and the victim model f is: F = {f′|f′ = E(f)}, where f′ represents an enhancement model in the enhancement model set, and E(·) represents an input layer extracted from a custom input transformation pool S.

[0013] In step 1 of the present invention, the integrated gradient g of the enhanced model set F is calculated by K iterations. ens The formula is: In the formula represents the integrated gradient of the tth iteration, represents the adversarial sample of the tth iteration, y represents the clean label of the original sample, and J() represents the target loss function, specifically the cross entropy loss function.

[0014] The number of iterations K in step 1 of the present invention is 5.

[0015] In step 2 of the present invention, the internal gradient g of the internal adversarial sample m and the internal gradient of the external adversarial example The formulas are: and x m Refers to the adversarial sample at the mth iteration.

[0016] In step 3 of the present invention, the cumulative gradient G is used m+1 The formula to update the internal adversarial sample is: In the formula represents the clipping function, α represents the step size, sign() represents the sign function, x refers to the adversarial sample in the initialized state, and x m 、x m+1 They refer to the adversarial samples in the mth and m+1th iterations respectively.

[0017] In step 4 of the present invention, this external gradient G is used t+1 The formula for updating external adversarial samples is: In the formula represents the clipping function, α represents the step size, sign() represents the sign function, x refers to the adversarial sample in the initialized state, and x t 、x t+1 They refer to the adversarial samples at the tth and t+1th iterations respectively.

[0018] The attenuation factor μ in step 3 and step 4 of the present invention is 1.0, and the number of internal iterations M in step 4 is 20.

[0019] The number of external iterations T in step 5 of the present invention is 10.

[0020] Compared with the prior art, the present invention has the following advantages and effects: the present invention combines the characteristics of deep learning models, and on the basis of the model enhancement method, proposes a variance reduction enhanced adversarial sample method, which makes full use of the diversity of the enhanced model set and reduces the gradient variance, thereby stabilizing the update direction of the adversarial sample. This enables the present invention to effectively improve the transferability of the generated adversarial samples while ensuring the success rate of white-box attacks, and provides new ideas for the field of adversarial attacks on deep learning security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A schematic diagram of an embodiment of the present invention for resisting attacks;

[0022] Figure 2 A comparison diagram of the adversarial sample generated by an embodiment of the present invention and the original sample;

[0023] Figure 3 The top-5 comparison of adversarial samples generated by the embodiment of the present invention and other methods. (a) is the original sample, (b), (c), and (d) are the top-5 adversarial samples generated by MI-FGSM, DEM, and the present invention, respectively, and 0 is the true label. DETAILED DESCRIPTION

[0024] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments, but it should be noted that the present invention is not limited to the following embodiments.

[0025] A variance reduction enhanced adversarial sample generation method based on model enhancement, comprising the following steps:

[0026] Step 1: Use the custom input transformation pool S to enhance the victim model f to obtain the enhanced model set F, and calculate the integrated gradient g of the enhanced model set F through K iterations. ens .

[0027] The transformation methods in the custom input transformation pool S include random horizontal flipping, random rotation, random distortion, random translation and random scaling.

[0028] The number of iterations K is 5.

[0029] The relationship between the enhanced model set F and the victim model f is: F = {f′|f′ = E(f)}, where f′ represents an enhanced model in the enhanced model set, and E(·) represents an input layer extracted from the custom input transformation pool S.

[0030] The integrated gradient g of the enhanced model set F is calculated through K iterations ens The formula is: In the formula represents the integrated gradient of the tth iteration, represents the adversarial sample of the tth iteration, y represents the clean label of the original sample, and J() represents the target loss function, specifically the cross entropy loss function.

[0031] Step 2: Get a new enhanced model f′ through the custom input transformation pool S, and calculate the internal gradient g of the internal adversarial sample based on this new enhanced model f′ m and the internal gradient of the external adversarial example

[0032] The internal gradient g of the internal adversarial example m and the internal gradient of the external adversarial example The formulas are: and

[0033] Step 3: For the accumulated gradient G used to update the internal adversarial sample m+1 , can be obtained by the following formula: Using the accumulated gradient G m+1 To update the internal adversarial examples.

[0034] Using the accumulated gradient G m+1 The formula to update the internal adversarial sample is: In the formula represents the clipping function, which is used to limit the adversarial sample to the ∈-sphere range of x, α represents the step size, which is 16 / 10, sign() represents the sign function, x=x0, refers to the benign adversarial sample in the initialized state, x m 、x m+1 They refer to the adversarial samples in the mth and m+1th iterations respectively.

[0035] Step 4, Step 2 and Step 3 need to be repeated M times, and the last internal accumulated gradient G is used m+1 To update the external gradient G t+1 , the formula is as follows: G t+1 =μ·G t +G m+1 , and finally use this external gradient G t+1 To update the external adversarial sample: In the formula represents the clipping function, which is used to limit the adversarial sample to the ∈-sphere range of x, α represents the step size, which is 16 / 10, sign() represents the sign function, x=x0, refers to the benign adversarial sample in the initialized state, x t 、x t+1 They refer to the adversarial samples at the tth and t+1th iterations respectively.

[0036] The number of inner iterations M is 20.

[0037] Step 5: Repeat the above steps T times. The number of external iterations T is 10. Once the iteration is completed, the adversarial sample x is successfully generated. adv .

[0038] Specifically, the attenuation factor μ in step 3 and step 4 is 1.0. Specifically, the number of internal iterations M in step 4 is 20.

[0039] Generate adversarial examples x adv After that, the adversarial attack can be performed. adv Later, when it is fed into a model with unknown model structure and its parameters, the model predicts it as the wrong classification label.

[0040] like Figure 1-3As shown: the adversarial attack first converts the original sample into an adversarial sample through a replacement model with known structure and its parameters. Based on the transferability of the adversarial sample, the adversarial sample is then input into the victim model for attack. Based on the model enhancement method, the present invention proposes a variance reduction enhanced adversarial sample method, which makes full use of the diversity of the enhanced model set and reduces the gradient variance, thereby stabilizing the update direction of the adversarial sample and improving the transferability of the adversarial sample. The adversarial samples generated by the present invention are the same as those generated by other methods. The human eye cannot see the difference from the original samples. For deep learning models, the adversarial samples generated by the present invention effectively improve the transferability of the generated adversarial samples while ensuring the success rate of the white-box attack, so that the prediction results of the adversarial samples generated by the present invention are far away from the true labels.

[0041] The present invention conducts experiments on the ImageNet dataset. The present invention randomly selects 1,000 images belonging to 1,000 categories from the ILSVRC 2012 validation set. These images can almost be recognized by the model we use, and these images are pre-resized to 299×299×3.

[0042] The relevant settings in the experiment of the present invention are as follows: maximum perturbation ∈=16, number of iterations T=10, step size α=1.6. For MI-FGSM, the default attenuation factor μ=1.0 is used. For DI-FGSM, the transformation probability p=1.0 is set. For DE-FGSM, the diversity list is set to [340,380,420,460,500]. For S2-FGSM, the number of replicas N=5 is set.

[0043] The adversarial samples in the experiments of the present invention are all generated by the Inc-v3 model, and the method of the present invention is compared with other common adversarial attack methods, as shown in Table 1:

[0044] Table 1 Effects of different adversarial attack methods.

[0045]

[0046] The last two rows in the table are the methods proposed by the present invention, among which RDE-FGSM is a customized model enhancement method proposed by the present invention, and RDVE-FGSM is a variance reduction enhanced adversarial sample generation method based on model enhancement proposed by the present invention.

[0047] It can be seen from the experimental results that compared with the existing results, the method proposed in the present invention can effectively improve the transferability of the generated adversarial samples while ensuring the success rate of white-box attacks.

[0048] In addition, it should be noted that the above content described in this specification is only an example of the structure of the present invention. Any equivalent changes or simple changes made based on the structure, features and principles described in the patent concept of the present invention are included in the protection scope of the patent of the present invention. Technicians in the technical field of the present invention can make various modifications or supplements to the specific embodiments described or replace them in a similar manner, as long as they do not deviate from the structure of the present invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A variance reduction enhanced adversarial sample generation method based on model enhancement, characterized in that: The following steps are involved: Step 1: Use the input transformation pool S to enhance the victim model f to obtain the enhanced model set F, and calculate the integrated gradient g of the enhanced model set F through K iterations. ens ; Step 2: Get a new enhanced model f by inputting the transformation pool S ′ , and based on this new enhanced model f ′ Calculate the internal gradient g of the internal adversarial example m and the internal gradient of the external adversarial example Step 3: For the accumulated gradient G used to update the internal adversarial sample m+1 , obtained by the following formula: μ is the attenuation factor, using the cumulative gradient G m+1 To update the internal adversarial examples; Step 4, Step 2 and Step 3 need to be repeated M times, and the last internal accumulated gradient G is used m+1 To update the external gradient G t+1 , the formula is as follows: G t+1 =μ·G t +G m+1 , and finally use this external gradient G t+1 To update external adversarial samples; Step 5: Repeat the above steps T times; once the iteration is completed, the adversarial sample x is successfully generated. adv .

2. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1 is characterized in that: The transformation methods in the input transformation pool s in step 1 include random horizontal flipping, random rotation, random distortion, random translation and random scaling.

3. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1 is characterized in that: In step 1, the relationship between the enhanced model set F and the victim model f is: F = {f ′ |f ′ =E(f)}, where f ′ represents an enhanced model in the enhanced model set, and E(·) represents an input layer extracted from the custom input transformation pool S.

4. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1 is characterized in that: In step 1, the integrated gradient g of the enhanced model set F is calculated through K iterations ens The formula is: In the formula represents the integrated gradient of the tth iteration, represents the adversarial sample of the tth iteration, y represents the clean label of the original sample, and J() represents the target loss function, specifically the cross entropy loss function.

5. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1, characterized in that: In step 2, the internal gradient g of the internal adversarial sample m and the internal gradient of the external adversarial example The formulas are: and x m Refers to the adversarial sample at the mth iteration.

6. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1, characterized in that: In step 3, the cumulative gradient G is used m+1 The formula to update the internal adversarial sample is: In the formula represents the clipping function, α represents the step size, sign() represents the sign function, x refers to the adversarial sample in the initialized state, and x m 、x m+1 They refer to the adversarial samples in the mth and m+1th iterations respectively.

7. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1 is characterized in that: In step 4, using this external gradient G t+1 The formula for updating external adversarial samples is: In the formula represents the clipping function, α represents the step size, sign() represents the sign function, x refers to the adversarial sample in the initialized state, and x t 、x t+1 They refer to the adversarial samples at the tth and t+1th iterations respectively.

8. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1, characterized in that: The number of iterations K in step 1 is 5.

9. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1, characterized in that: The attenuation factor μ in step 3 and step 4 is 1.0, and the number of internal iterations M in step 4 is 20.

10. The variance reduction enhanced adversarial sample generation method based on model enhancement according to claim 1, characterized in that: The number of external iterations T in step 5 is 10.

Images