Deep neural network anti-attack method based on attack space GAN

Abstract

The invention relates to a deep neural network anti-attack method based on an attack space GAN, belongs to the technical field of machine learning and deep learning security, and aims to solve the problem that an anti-attack sample generated by a single-step attack and iterative attack method lacks attack validity and concealment. Meanwhile, a feature map generated by an encoder in a generator at a patent layer is utilized, after processing is conducted through a convolutional layer and a ReLU layer, attack space is generated, and disturbance and attack space are superposed to obtain an adversarial sample; a structural similarity loss function and a feature loss function are introduced, game training between a generator and a discriminator is carried out, the trained generator can generate an effective adversarial sample, the invention provides an efficient adversarial attack method, the adversarial sample capable of misleading a target learning model is generated, and the target learning efficiency is improved. And the robustness test of the deep neural network model is enhanced.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning and machine learning security, and in particular to a method for countering attacks on deep neural networks. Specifically, it relates to a method for countering attacks on deep neural networks based on attack space GAN. Background Art

[0002] Deep neural networks (DNNs) have achieved remarkable results in image recognition, speech recognition, natural language processing and other fields. However, the susceptibility of DNNs to adversarial samples has become a major challenge to their widespread application. The generation of adversarial samples helps to evaluate and test the robustness of models in the real world. By detecting the performance of the model under adversarial inputs, researchers can discover potential vulnerabilities of the model, enhance its security, and prevent misjudgments due to small disturbances in critical applications such as autonomous driving and medical diagnosis. Adversarial samples are generated by adding tiny and imperceptible perturbations to the original input, which may cause the model to make incorrect predictions. Although various adversarial attack methods have been proposed, generating adversarial samples that are visually realistic and highly aggressive remains a difficult problem.

[0003] There are two main types of traditional adversarial attack methods: the first type is single-step attack, which relies on exploiting the gradient information of the model to generate adversarial samples by adding perturbations at one time to change the model's prediction results; the second type is iterative attack, which gradually increases the perturbations through multiple iterations, for example: changing the single-step perturbation to multiple iterations with small steps, optimizing the objective function to find adversarial samples with minimum perturbations, and iteratively pushing the input samples to the decision boundary until classification errors occur.

[0004] Although the above two attack methods have certain attack effects, they both focus on optimizing the amplitude and direction of the disturbance, ignoring the visual naturalness of the adversarial samples and the stability of the attack. In addition, the adversarial samples generated by the single-step attack method may be too obvious and easy to be detected, and the iterative attack method has a high computational cost. Therefore, these methods cannot meet the requirements of generating visually indistinguishable adversarial samples, effectively misleading deep neural networks, and reducing computational complexity. Summary of the invention

[0005] Purpose of the invention: In order to solve the problem that adversarial samples generated by single-step attack and iterative attack methods lack attack effectiveness and concealment, the present invention provides a deep neural network adversarial attack method based on attack space GAN, which can be applied to a variety of image data sets, can effectively evaluate the performance of the model in different scenarios, and reveal the potential erroneous behavior of the model.

[0006] Technical solution: The present invention is a deep neural network anti-attack method based on attack space GAN, which specifically includes the following steps:

[0007] Step A: Select a deep neural network image classification model as the target model F, select the Transformer-based improved deep learning model Restormer as the generator G, and select the CNN model as the discriminator D; select the training data set, take x as the input sample, first use the generator G to generate the perturbation G(x); at the same time, use the encoder of the generator G to generate the attack space M(x); superimpose the perturbation and attack space to obtain the adversarial sample x adv , x adv As the input sample of the discriminator D;

[0008] Step B: Construct the perturbation loss function L for training the generator G perturb ; Construct the loss function L to ensure model stability when training the discriminator D GAN ; Construct a loss function to guide the generation of aggressive adversarial samples during the training of the target model F Constructing the structural similarity loss function L in the joint training process ssim And the feature loss function L feature , and finally form the overall network loss function L; train the GAN network by solving the minimax game arg min G max D L, get the generator G.

[0009] Preferably, in step A of the method, the generator G and the discriminator D of the GAN network are selected, the required training data set is selected, and the image size is processed, x is used as the input sample, the perturbation G(x) is generated by the generator G, and the feature map is generated by the latent layer of the encoder in the generator G. After processing by the convolution layer and the ReLU layer, the attack space M(x) is obtained, and G(x) is superimposed with M(x) to obtain the generated adversarial sample x adv ; Then x adv As the input sample of the discriminator D.

[0010] Preferably, in step B of the method, based on step A, a loss function L of the control generator disturbance is constructed. perturb , the loss function L that ensures the stability of the discriminator model GAN , guide the loss function to generate aggressive adversarial samples And the structural similarity loss function L in the joint training process ssim And the feature loss function L feature . Finally, the overall network loss function L is constructed as follows:

[0011] Step a1: Construct the loss function L that controls the generated disturbance perturb :

[0012] L perturb =E x [||G(x)||2]

[0013] L perturb In the formula, x is the input sample, ||·|| represents the l2 norm, that is, the Euclidean distance. ||G(x)||2 represents the l2 norm of the generated perturbation;

[0014] Step a2: Construct a loss function L to improve the stability of the model GAN :

[0015] L GAN =E x logD(x)+E x log(1-D(x adv ))

[0016] L GAN In the formula, G represents the generator, D represents the discriminator, and x represents the clean sample. The goal of the discriminator D is to distinguish the perturbed data x adv and the original data x.

[0017] Step a3: Construct a loss function to guide the generation of aggressive adversarial samples

[0018]

[0019] In the formula, Z(x adv ) is the model's response to adversarial samples x adv The logits output, y is the true label, max i≠y Z(x adv ) i is the maximum value in the logits output except the true label. This loss function represents the difference between the true label value and the maximum value of other labels in the predicted logits value. If the logits value of the true label is less than the maximum value of other labels, then the loss is positive, indicating that the attack is successful; otherwise, the loss is zero, indicating that the attack fails.

[0020] Step a4: Construct the structural similarity loss function L in the joint training process ssim And the feature loss function L feature :

[0021]

[0022] L ssim In the formula, a represents the generated adversarial sample, that is, x adv ;μ x , μ a , σ x , σa and σ x,a Respectively represent two images, the mean, variance and covariance of the images; c1 and c2 are constants, usually c1=(K1·L) 2 , c2=(K2·L) 2 Generally, K1 is 0.01, K2 is 0.03; L represents the gray level and is 255.

[0023]

[0024] L feature In the formula, x is the real image, x adv is the perturbed image, F l is the feature map of layer l in the pre-trained network, N l is the number of elements in the feature map of the lth layer, and ||·|| represents the l2 norm.

[0025] Step a5: Construct the overall network loss function L:

[0026]

[0027] In the formula L, α, β, γ and λ are the balance parameters of each part of the loss function. In order to enhance the model's ability to constrain the amount of perturbation, the above parameters are set to 1, 10, 1 and 1 by default, respectively, to improve the visual quality of the generated adversarial samples. The GAN network is trained by minimax game, and the generator G is fixed to maximize the loss function L GAN Optimize the discriminator D, and then fix the discriminator D to minimize the overall network loss function L to optimize the generator G. After training iterations T times, the trained generator G is obtained.

[0028] Beneficial effects: The present invention provides a deep neural network adversarial attack method based on attack space GAN. The method uses Restormer as a generator, and uses its powerful visual representation ability to enhance the acceptability and interpretability of adversarial samples; at the same time, the feature map generated by the Restormer encoder in the latent layer is processed through the convolution layer and the ReLU layer to generate an attack space, which captures the high-level representation of the input data and is easier to find the perturbation direction, making the adversarial sample more aggressive; at the same time, a loss function is introduced, and the GAN network is trained in an adversarial game manner. The generator generates adversarial samples in a self-supervised manner, and the discriminator is responsible for identifying the image samples to ensure that the generated examples are real. After several iterative trainings, the adversarial samples generated by the generator reach the level of real samples, and the discriminator cannot distinguish the authenticity of the current samples; after the model parameters are trained, only a simple forward propagation is needed to quickly generate adversarial samples, and an output result that is not only visually real but also can effectively attack the target learning model is generated. Because the present invention adopts the above technical solution, the model trained by this method can better reveal the potential erroneous behavior of the model, so that the model can achieve better robustness testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are only used to more fully illustrate the process of the present invention and do not constitute a limitation on the scope of the present invention.

[0030] Figure 1 This is a flow chart of a deep neural network counterattack method based on attack space GAN of the present invention; Specific implementation plan

[0031] The present invention will be further explained below with reference to the accompanying drawings. Figure 1 It is a flowchart of adversarial sample generation in the present invention, which mainly includes the following steps:

[0032] Step A: Select the VGG16 image classification model as the target model F, select the Transformer-based improved deep learning model Restormer as the generator G, and select the deep neural network model composed of convolutional layers as the discriminator D; select the training data set GTSRB, process the image size, take x as the input sample, and first use the generator G to generate the perturbation G(x); at the same time, use the feature map generated by the encoder in the generator in the latent layer, and generate the attack space M(x) after processing through the convolutional layer and the Relu layer; superimpose the perturbation and attack space to obtain the adversarial sample x adv , and x adv As the input sample of the discriminator D;

[0033] Step B: Construct the perturbation loss function L for training the generator G perturb; Construct the loss function L to ensure the stability of the model when training the discriminator D GAN ; Construct a loss function to guide the generation of aggressive adversarial samples during the training of the target model F Constructing the structural similarity loss function L in the joint training process ssim And the feature loss function L feature , and finally constitute the overall network loss function L. The classification accuracy of the target model F on the GTSRB dataset reaches 96.79%. The sample x in the GTSRB dataset is input into the GAN network to train the generator G. The generator G generates adversarial samples in a self-supervised manner. The discriminator D is responsible for identifying the image samples to ensure that the generated examples are real. Through the minimax game arg min G max D L, after T iterative training, the adversarial samples generated by the generator reach the level of real samples, and the discriminator cannot distinguish the authenticity of the current samples, and the trained generator G is obtained.

[0034] Preferably, in step B of the method, the loss function L of the generated disturbance is controlled perturb , the loss function L that ensures the stability of the model GAN , guide the loss function to generate aggressive adversarial samples Structural similarity loss function L during joint training ssim And the feature loss function L feature , the steps to construct the overall network loss function L are as follows:

[0035] Step a1: Construct the loss function L that controls the generated disturbance perturb :

[0036] L perturb =E x [||G(x)||2]

[0037] L perturb In the formula, x is the input sample, ||·|| represents the l2 norm, that is, the Euclidean distance. ||G(x)||2 represents the l2 norm of the generated perturbation; the generated adversarial perturbation is constrained so that the perturbation amount is as small as possible while maintaining the attack effect, so as to increase the concealment of the adversarial sample and balance the attack effect and the perceptibility of the perturbation.

[0038] Step a2: Construct a loss function L to improve the stability of the model GAN :

[0039] L GAN =E x logD(x)+E x log(1-D(x adv ))

[0040] L GAN In the formula, G represents the generator, D represents the discriminator, and x represents the clean sample. The goal of the discriminator D is to distinguish the perturbed data x adv and the original data x. The discriminator D will gradually improve its discrimination ability during the adversarial training process, and can more accurately distinguish clean samples from adversarial samples, which helps to evaluate the quality and concealment of adversarial samples generated by the generator G.

[0041] Step a3: Construct a loss function to guide the generation of aggressive adversarial samples

[0042]

[0043] In the formula, Z(x adv ) is the model's response to adversarial samples x adv The logits output, y is the true label, max i≠y Z(x adv ) i is the maximum value in the logits output except the true label. This loss function represents the difference between the predicted logits value and the maximum value of other labels. If the logits value of the true label is less than the maximum value of other labels, the loss is positive, indicating a successful attack; otherwise, the loss is zero, indicating a failed attack. Generator G will gradually generate higher quality and more aggressive adversarial samples during adversarial training, making these samples visually highly similar to the original samples and thus difficult to detect.

[0044] Step a4: Construct the structural similarity loss function L in the joint training process ssim And the feature loss function L feature :

[0045]

[0046] L ssim In the formula, a represents the generated adversarial sample, that is, x adv ;μ x , μ a , σ x , σ a and σ x,a Respectively represent two images, the mean, variance and covariance of the images; c1 and c2 are constants, usually c1=(K1·L) 2 , c2=(K2·L) 2 Generally, K1 is 0.01, K2 is 0.03; L represents the gray level and is 255.

[0047]

[0048] L feature In the formula, x is the real image, x adv is the perturbed image, F l is the feature map of layer l in the pre-trained network, N l is the number of elements in the feature map of the lth layer, and ||·|| represents the l2 norm.

[0049] Step a5: Construct the overall network loss function L:

[0050]

[0051] In the formula L, α, β, γ and λ are the balance parameters of each part of the loss function. In order to enhance the model's ability to constrain the amount of perturbation, the above parameters are set to 1, 10, 1 and 1 by default, respectively, to improve the visual quality of the generated adversarial samples. The GAN network is trained by minimax game, and the generator G is fixed to maximize the loss function L GAN Optimize the discriminator D, and then fix the discriminator D to minimize the overall network loss function L to optimize the generator G. After training iterations T times, the trained generator G is obtained. Multi-objective loss function optimization can simultaneously consider the perturbation amount, aggressiveness, and concealment of the generated adversarial samples, as well as the stability of the training process. While maintaining the high aggressiveness of the adversarial samples, it can minimize their visual perceptibility, making the adversarial samples visually highly similar to the original samples, making them more difficult to detect, which helps the generator G generate high-quality adversarial samples and evaluate and improve the robustness of the target model through testing of adversarial samples.

[0052] In order to verify the beneficial effects of the present invention, the VGG16 model is selected as the target model, the deep learning model Restormer based on Transformer improvement is used as the generator G, and the deep neural network model composed of convolutional layers is used as the discriminator D. T is set to 100 to ensure that the generator G and the discriminator D fully learn the characteristics and distribution of the data. The generator G can generate realistic adversarial samples, and the discriminator D can accurately distinguish between the original samples and adversarial samples, thereby improving the quality of adversarial samples and enhancing the model robustness test.

[0053] After selecting the model and determining the number of model trainings, the model training is completed. Three adversarial defense methods are selected: (1) using FGSM for adversarial training (Adv.); (2) integrated adversarial training (Ens.); (3) using PGD for iterative adversarial training (Iter.Adv). The trained generator G model is defended, and the attack results of the present invention are compared with the FGSM attack, CW attack, and PGD attack. There are 43 traffic sign categories and 51,839 images in the GTSRB dataset. The results of the non-target attack are shown in Table 1. The larger the value, the better the attack effect.

[0054] The experimental results are shown in Table 1. In the GTSRB dataset, for the three attack methods of FGSM, CW and PGD, in the presence of defense measures, the attack space GAN adversarial attack method proposed in the present invention can significantly improve the attack effect, better attack the target model under the three defense methods, and has obvious advantages in breaking through the Adv. defense. The above analysis and example verification show that the attack space GAN adversarial attack method proposed in the present invention can achieve better attack effects in the GTSRB dataset, enhance the robustness test of the deep neural network model, and provide an important tool for evaluating the robustness of the deep neural network model.

[0055] Table 1 Comparison of attack performance of the present invention and other attack methods on the GTSRB dataset

[0056]

Claims

1. A deep neural network adversarial attack method based on attack space GAN, which is characterized by the following steps: Step A: Select a deep neural network image classification model as the target model F, select the Transformer-based improved deep learning model Restormer as the generator G, and select the CNN model as the discriminator D; Select a training data set, take x as the input sample, first use the generator G to generate the perturbation G(x); at the same time, use the encoder of the generator G to generate the attack space M(x); superimpose the perturbation and attack space to obtain the adversarial sample x adv , x adv As the input sample of the discriminator D; Step B: Construct the perturbation loss function L for training the generator G perturb ; Construct the loss function L to ensure model stability when training the discriminator D GAN ; Construct a loss function to guide the generation of aggressive adversarial samples during the training of the target model F Constructing the structural similarity loss function L in the joint training process ssim And the feature loss function L feature , and finally form the overall network loss function L; train the GAN network by solving the minimax game arg min G max D L, get the generator G.

2. According to claim 1, a deep neural network counterattack method based on attack space GAN is characterized in that: In step A of the method, the generator G and the discriminator D of the GAN network are selected, the required training data set is selected, and the image size is processed. x is used as the input sample, and the perturbation G(x) is generated by the generator G. At the same time, the latent layer of the encoder in the generator G is used to generate a feature map. After processing by the convolution layer and the ReLU layer, the attack space M(x) is obtained, and G(x) and M(x) are superimposed to obtain the generated adversarial sample x adv ; Then x adv As the input sample of the discriminator D.

3. According to claim 1, a deep neural network counterattack method based on attack space GAN is characterized in that: In step B of the method, based on step A, a loss function L of the control generator disturbance is constructed perturb , the loss function L that ensures the stability of the discriminator model GAN , guide the loss function to generate aggressive adversarial samples And the structural similarity loss function L in the joint training process ssim And the feature loss function L feature ,Finally, the overall network loss function L is constructed as follows: Step a1: Construct the loss function L that controls the generated disturbance perturb : L perturb =E x [||G(x)||2] L perturb In the formula, x is the input sample, ||·|| represents the l2 norm, that is, the Euclidean distance, and ||G(x)||2 represents the l2 norm of the generated disturbance; Step a2: Construct a loss function L to improve the stability of the model GAN : L GAN =E x logD(x)+E x log(1-D(x adv )) L GAN In the formula, G represents the generator, D represents the discriminator, and x represents the clean sample. The goal of the discriminator D is to distinguish the perturbed data x adv and the original data x; Step a3: Construct a loss function to guide the generation of aggressive adversarial samples In the formula, Z(x adv ) is the model's response to adversarial samples x adv The logits output, y is the true label, max i≠y Z(x adv ) i It is the maximum value in the logits output except the true label. This loss function represents the difference between the value of the true label in the predicted logits value and the maximum value of other labels. If the logits value of the true label is less than the maximum value of other labels, then the loss is positive, indicating that the attack is successful; otherwise, the loss is zero, indicating that the attack fails. Step a4: Construct the structural similarity loss function L in the joint training process ssim And the feature loss function L feature : L ssim In the formula, a represents the generated adversarial sample, that is, x adv ;μ x , μ a , σ x , σ a and σ x,a Respectively represent two images, the mean, variance and covariance of the images; c1 and c2 are constants, usually c1=(K1·L) 2 , c2=(K2·L) 2 , K1 is 0.01, K2 is 0.03; L represents the gray level, which is 255; L feature In the formula, x is the real image, x adv is the perturbed image, F l is the feature map of layer l in the pre-trained network, N l is the number of elements in the feature map of the lth layer, and ||·|| represents the l2 norm; Step a5: Construct the overall network loss function L: In the formula L, α, β, γ and λ are the balance parameters of each part of the loss function. In order to enhance the model's ability to constrain the amount of perturbation, the above parameters are set to 1, 10, 1 and 1 by default, respectively, to improve the visual quality of the generated adversarial samples. The GAN network is trained through the minimax game, and the generator G is fixed to maximize the loss function L GAN Optimize the model parameters of the discriminator D, and then fix the discriminator D to minimize the overall network loss function L to optimize the model parameters of the generator G. After training iterations T times, the trained generator G is obtained.

Images