A deep neural network attack method based on attack space GAN

Abstract

The present application relates to a kind of deep neural network attack methods based on attack space GAN, belong to machine learning and deep learning security technical field, to solve the problem that the attack effectiveness and concealment of the adversarial sample generated by single-step attack and iterative attack method lack, the Restormer model based on the improvement of Transformer is used as generator to generate perturbation in the present application, simultaneously utilize the feature map generated in latent layer of the encoder in its generator, after processing by convolution layer and ReLU layer, attack space is generated, and the adversarial sample is obtained by superimposing perturbation and attack space;By introducing structural similarity loss function and feature loss function, and the game training between generator and discriminator, the trained generator can generate effective adversarial sample, the present application provides an efficient adversarial attack method, produces the adversarial sample capable of misleading target learning model, enhances the robustness test of deep neural network model.

Description

Technical Field

[0001] This invention belongs to the field of deep learning and machine learning security, and in particular to adversarial attack methods for deep neural networks. Specifically, it relates to an adversarial attack method for deep neural networks based on attack space GAN. Background Technology

[0002] Deep neural networks (DNNs) have achieved remarkable results in fields such as image recognition, speech recognition, and natural language processing. However, the vulnerability of DNNs to adversarial examples has become a major challenge to their widespread application. Generating adversarial examples helps evaluate and test the robustness of models in the real world. By detecting the model's performance under adversarial inputs, researchers can discover potential vulnerabilities, enhance its security, and prevent misjudgments due to small perturbations in critical applications such as autonomous driving and medical diagnosis. Adversarial examples are generated by adding tiny and imperceptible perturbations to the original input, which can cause the model to make incorrect predictions. Although various adversarial attack methods have been proposed, generating adversarial examples that are both visually realistic and highly offensive remains a challenge.

[0003] Traditional adversarial attack methods mainly fall into two categories: the first is single-step attacks, which rely on utilizing the model's gradient information to generate adversarial examples by adding perturbations all at once, thereby changing the model's prediction results; the second is iterative attacks, which gradually increase perturbations through multiple iterations, such as changing single-step perturbations to multiple iterations with small step sizes, optimizing the objective function to find adversarial examples with minimal perturbations, and iteratively pushing input samples toward the decision boundary until a classification error occurs.

[0004] While both of the above attack methods have some effect, they focus on optimizing the magnitude and direction of the perturbation, neglecting the visual naturalness of the adversarial examples and the stability of the attack. Moreover, the adversarial examples generated by the single-step attack method may be too obvious and easy to detect, while the computational cost of the iterative attack method is high. Therefore, these methods cannot satisfy the requirements of generating visually indistinguishable adversarial examples, effectively misleading deep neural networks, and reducing computational complexity. Summary of the Invention

[0005] Purpose of the invention: To address the lack of attack effectiveness and concealment in adversarial examples generated by single-step and iterative attack methods, this invention provides a deep neural network adversarial attack method based on attack space GANs. This method can be applied to various image datasets, effectively evaluate the model's performance in different contexts, and reveal potential erroneous behaviors of the model.

[0006] Technical solution: This invention is a deep neural network adversarial attack method based on attack space GAN, specifically including the following steps:

[0007] Step A: Select a deep neural network image classification model as the target model F, select Restormer, a deep learning model based on Transformer, as the generator G, and select a CNN model as the discriminator D; select a training dataset and process the image size to obtain the original clean image sample x; input the original clean image sample x into the generator G, and the generator G generates perturbations. Simultaneously, feature maps are extracted from the latent feature layer of the encoder of generator G, and the feature maps are sequentially subjected to convolution and ReLU activation to obtain the attack space. ; to disturb The adversarial sample is obtained by superimposing it with the attack space M(x). And the original clean image sample x and the adversarial sample Input discriminator D;

[0008] Step B: Construct the perturbation loss function for constraining the generator output perturbation. Construct a system to distinguish between original clean image samples x and adversarial samples. GAN adversarial objective function With the model parameters of the target model F kept fixed, adversarial examples are tested based on the target model F. The output constructs the attack loss function. And construct the structural similarity loss function in the joint training process. and feature loss function Finally, the overall loss function L of the network is formed; the generator G and discriminator D are alternately fixed, and the GAN network is trained by solving the minimax game. , thus obtaining generator G.

[0009] Preferably, in step B of the method, a loss function for controlling generator perturbation is constructed based on step A. Loss function to ensure the stability of the discriminator model , guide the generation of loss functions with aggressive adversarial examples and the structural similarity loss function during joint training. and feature loss function Finally, the overall network loss function L is constructed as follows:

[0010] Step a1: Construct the loss function to control the generated disturbance :

[0011]

[0012] In the formula, x represents the original clean image sample. express Norm, i.e., calculating Euclidean distance; Indicates the generated perturbation Norm;

[0013] Step a2: Construct a loss function to improve the stability of the model :

[0014]

[0015] In the formula, G represents the generator, D represents the discriminator, and x represents the original clean image sample; the discriminator D aims to distinguish adversarial examples. and the original clean image sample x;

[0016] Step a3: Construct a loss function to guide the generation of aggressive adversarial examples. :

[0017]

[0018] In the formula, It is a model against adversarial examples The logits output, where y is the actual label. It is the maximum value in the logits output excluding the true label; this loss function represents the difference between the predicted logits value for the true label and the maximum value for other labels; when the logit value corresponding to the true label is greater than the maximum value among the logits corresponding to other labels, the attack loss is greater than 0, indicating that the adversarial example is still tended to be classified as the true category by the target model, and the attack success condition has not yet been met; when the logit value corresponding to the true label is less than the maximum value among the logits corresponding to other labels, the attack loss is 0, indicating that the adversarial example meets the misclassification condition of untargeted attack; Step a4: Construct the structural similarity loss function L during joint training. ssim and feature loss function L feature :

[0019]

[0020] In the formula, This represents the generated adversarial example, i.e. ; , These represent the original clean image samples. Adversarial Examples The average pixel value, , These represent the standard deviations of the two pixel values, This represents the covariance of the pixel values ​​of the two. and It is a constant, usually taken as , Generally speaking, Take 0.01, Set to 0.03; R represents the gray level, set to 255;

[0021]

[0022] In the formula, These are original, clean image samples. Represents the original clean image sample The generated adversarial examples It is the feature mapping of the l-th layer in the pre-trained network. It is the number of elements in the feature map of the l-th layer. express Norm;

[0023] Step a5: Construct the overall network loss function L:

[0024]

[0025] In the L-form, and The parameters are the balance parameters for each part of the loss function. To enhance the model's ability to constrain perturbations, these parameters are set to 1, 10, 1, and 1 by default, respectively, to improve the visual quality of the generated adversarial examples. The GAN network is trained through minimax games, with the generator G fixed to maximize the loss function. Optimize the model parameters of the discriminator D, then fix the discriminator D to minimize the overall network loss function L and optimize the model parameters of the generator G. After training T iterations, the trained generator G is obtained.

[0026] Beneficial Effects: This invention provides a deep neural network adversarial attack method based on attack space GAN. This method uses Restormer as the generator, leveraging its powerful visual representation capabilities to enhance the acceptability and interpretability of adversarial examples. Simultaneously, the feature maps generated by the Restormer's encoder at the latent layer are processed through convolutional and ReLU layers to generate an attack space. This attack space captures a high-level representation of the input data, making it easier to find perturbation directions and thus making the adversarial examples more aggressive. Furthermore, a loss function is introduced, and the GAN network is trained using an adversarial game approach. The generator generates adversarial examples in a self-supervised manner, while the discriminator is responsible for recognizing image samples to ensure the generated examples are realistic. After several iterations of training, the adversarial examples generated by the generator reach the level of real samples, and the discriminator cannot distinguish the authenticity of the current sample. After training the model parameters, only a simple forward propagation is needed to quickly generate adversarial examples, which can generate visually realistic adversarial examples that can effectively mislead the target model. Because this invention adopts the above technical solutions, the model trained by this method can better reveal the model's potential erroneous behaviors, enabling the model to achieve better robustness testing. Attached Figure Description

[0027] The accompanying drawings are only for more fully illustrating the process of the present invention and do not constitute a limitation on the scope of the present invention.

[0028] Figure 1 This is a flowchart of a deep neural network adversarial attack method based on attack space GAN according to the present invention; Detailed Implementation Plan

[0029] The invention will be further explained below with reference to the accompanying drawings. Figure 1 This is a flowchart of adversarial sample generation in this invention, which mainly includes the following steps:

[0030] Step A: Select the VGG16 image classification model as the target model F, select the Restormer deep learning model based on Transformer improvement as the generator G, and select a deep neural network model composed of convolutional layers as the discriminator D; select the training dataset GTSRB, process the image size, take x as the original clean image sample, and first use the generator G to generate perturbations. Simultaneously, the feature maps generated by the encoder in the generator at the latent layer are processed through convolutional and ReLU layers to generate the attack space. The adversarial sample is obtained by superimposing the perturbation and attack spaces. And the original clean image sample x and the adversarial sample Input discriminator D;

[0031] Step B: Construct the perturbation loss function for generator G during training The loss function used to ensure model stability during discriminator D training. With the model parameters of the target model F kept fixed, adversarial examples are tested based on the target model F. The output constructs the attack loss function. Constructing the structural similarity loss function during joint training. and feature loss function Finally, the overall network loss function L is formed; the classification accuracy of the target model F on the GTSRB dataset reaches [percentage missing]. The generator G is trained by inputting samples x from the GTSRB dataset into a GAN network. The generator G generates adversarial examples in a self-supervised manner, while the discriminator D is responsible for recognizing the image samples to ensure that the generated examples are real. This is achieved through a minimax game. After T iterations of training, the adversarial examples generated by the generator reach the level of real examples, and the discriminator cannot distinguish the authenticity of the current example, thus obtaining the trained generator G.

[0032] Preferably, in step B of the method, the loss function for generating the perturbation is controlled. Loss function to ensure model stability , guide the generation of loss functions with aggressive adversarial examples Structural similarity loss function during joint training and feature loss function The steps for constructing the overall network loss function L are as follows:

[0033] Step a1: Construct the loss function to control the generated disturbance :

[0034]

[0035] In the formula, As a sample of the original clean image express Norm, i.e., calculating Euclidean distance; Indicates the generated perturbation Norm; constrains the generated adversarial perturbations to minimize the perturbation amount while maintaining the attack effect, thereby increasing the stealth of the adversarial examples and balancing the attack effect and the perceptibility of the perturbations.

[0036] Step a2: Construct a loss function to improve the stability of the model :

[0037]

[0038] In the formula, G represents the generator, D represents the discriminator, and x represents the original clean image sample; the discriminator D aims to distinguish adversarial examples. The original clean image sample x; the discriminator D will gradually improve its discrimination ability during the adversarial training process, and can more accurately distinguish between clean samples and adversarial samples, which helps to evaluate the quality and concealment of the adversarial samples generated by the generator G;

[0039] Step a3: Construct a loss function to guide the generation of aggressive adversarial examples. :

[0040]

[0041] In the formula, It is a model against adversarial examples of Output, It's a real label. Besides the real label, The maximum value in the output; this loss function represents the predicted value. The difference between the value of the actual label and the maximum value of other labels; when the actual label corresponds to The value is greater than the corresponding value of other tags. When the value is the maximum, the attack loss is greater than 0, indicating that the adversarial example is still tended to be judged as the true class by the target model, and the attack success condition has not yet been met; when the true label corresponds to The value is less than the corresponding value of other tags. When the value is the maximum, the attack loss is 0, indicating that the adversarial sample meets the misclassification condition of untargeted attack; when the two are equal, it is in the classification boundary state. During the adversarial training process, the generator G will gradually generate higher quality and more aggressive adversarial samples, making these samples visually highly similar to the original samples, thus making them difficult to detect;

[0042] Step a4: Construct the structural similarity loss function during joint training. and feature loss function :

[0043]

[0044] In the formula, This represents the generated adversarial example, i.e. ; , These represent the original clean image samples. Adversarial Examples The average pixel value, , These represent the standard deviations of the two pixel values, This represents the covariance of the pixel values ​​of the two. and It is a constant, usually taken as , Generally speaking, Take 0.01, Set to 0.03; R represents the gray level, set to 255;

[0045]

[0046] In the formula, These are original, clean image samples. Represents the original clean image sample The generated adversarial examples It is the feature mapping of the l-th layer in the pre-trained network. It is the number of elements in the feature map of the l-th layer. express Norm;

[0047] Step a5: Construct the overall network loss function L:

[0048]

[0049] In the L-form, and The parameters are the balance parameters for each part of the loss function. To enhance the model's ability to constrain perturbations, these parameters are set to 1, 10, 1, and 1 by default, respectively, to improve the visual quality of the generated adversarial examples. The GAN network is trained through minimax games, with the generator G fixed, to maximize the loss function L. GAN The discriminator D is optimized, and then fixed to minimize the overall network loss function L. The generator G is optimized, and after training iterations T, the trained generator G is obtained. Multi-objective loss function optimization can simultaneously consider the perturbation, aggressiveness, and stealth of generated adversarial examples, as well as the stability of the training process. It can maintain the high aggressiveness of adversarial examples while minimizing their visual perceptibility, making adversarial examples highly similar to the original examples, thus making them more difficult to detect. This helps the generator G generate high-quality adversarial examples, and the robustness of the target model can be evaluated and improved through testing with adversarial examples.

[0050] To verify the beneficial effects of this invention, the VGG16 model was selected as the target model, the Restormer deep learning model based on Transformer was selected as the generator G, and the deep neural network model composed of convolutional layers was selected as the discriminator D. T was set to 100 to ensure that the generator G and the discriminator D fully learn the features and distribution of the data. The generator G can generate realistic adversarial examples, while the discriminator D can accurately distinguish between the original samples and adversarial examples, thereby improving the quality of adversarial examples and enhancing the robustness of the model.

[0051] After selecting the model and determining the number of training iterations, the model training was completed; three adversarial defense methods were selected: (1) adversarial training using FGSM (Adv.); (2) ensemble adversarial training (Ens.); (3) iterative adversarial training using PGD (Iter.Adv); and the trained generator G was used to test the attack on the defense target model, and the attack results of the present invention were compared with FGSM attack, CW attack, and PGD attack; the GTSRB dataset contains 43 traffic sign categories and 51,839 images, and the results of the targetless attack are shown in Table 1, where the larger the value, the better the attack effect.

[0052] The experimental results are shown in Table 1. In the GTSRB dataset, for the three attack methods FGSM, CW, and PGD, with defensive measures in place, the attack space GAN adversarial attack method proposed in this invention achieved a higher success rate for untargeted attacks, and its advantage was more pronounced under the Adv. defense model. The above analysis and examples demonstrate that the attack space GAN adversarial attack method proposed in this invention can achieve good attack performance on the GTSRB dataset, enhancing the robustness testing of deep neural network models and providing an important tool for evaluating the robustness of deep neural network models.

[0053] Table 1 Comparison of attack performance of the present invention and other attack methods on the GTSRB dataset.

[0054] .

Claims

1. A deep neural network adversarial attack method based on attack space GAN, characterized by the following steps: Step A: Select a deep neural network image classification model as the target model F, select Restormer, a deep learning model based on Transformer, as the generator G, and select a CNN model as the discriminator D; A training dataset is selected and the image dimensions are processed to obtain a raw, clean image sample x; the raw, clean image sample x is input into a generator G, which generates a perturbation. Simultaneously, feature maps are extracted from the latent feature layer of the encoder of generator G, and the feature maps are sequentially subjected to convolution and ReLU activation to obtain the attack space. The adversarial sample is obtained by superimposing the perturbation G(x) with the attack space M(x). And the original clean image sample x and the adversarial sample Input discriminator D; Step B: Construct the perturbation loss function for constraining the generator output perturbation. Construct a system to distinguish between original clean image samples x and adversarial samples. GAN adversarial objective function With the model parameters of the target model F kept fixed, adversarial examples are tested based on the target model F. The output constructs the attack loss function. And construct the structural similarity loss function in the joint training process. and feature loss function Finally, the overall loss function L of the network is formed; the generator G and discriminator D are alternately fixed, and the GAN network is trained by solving the minimax game. , thus obtaining generator G.

2. The deep neural network adversarial attack method based on attack space GAN according to claim 1, characterized in that, In step B of the method, based on step A, a loss function for controlling generator perturbation is constructed. Loss function to ensure the stability of the discriminator model , guide the generation of loss functions with aggressive adversarial examples and the structural similarity loss function during joint training. and feature loss function Finally, the overall network loss function L is constructed as follows: Step a1: Construct the loss function to control the generated disturbance : ； In the formula, x represents the original clean image sample. express Norm, i.e., calculating Euclidean distance; Indicates the generated perturbation Norm; Step a2: Construct a loss function to improve the stability of the model : ； In the formula, G represents the generator, D represents the discriminator, and x represents the original clean image sample; the discriminator D aims to distinguish adversarial examples. and the original clean image sample x; Step a3: Construct a loss function to guide the generation of aggressive adversarial examples. : ； In the formula, It is a model against adversarial examples of Output, It's a real label. Besides the real label, The maximum value in the output; this loss function represents the predicted value. The difference between the value of the actual label and the maximum value of other labels; when the actual label corresponds to The value is greater than the corresponding value of other tags. When the value is the maximum, the attack loss is greater than 0, indicating that the adversarial example is still tended to be judged as the true class by the target model, and the attack success condition has not yet been met; when the true label corresponds to The value is less than the corresponding value of other tags. When the value is the maximum, the attack loss is 0, indicating that the adversarial sample meets the misclassification condition of untargeted attack; Step a4: Construct the structural similarity loss function during joint training. and feature loss function : ； In the formula, This represents the generated adversarial example, i.e. ; , These represent the original clean image samples. Adversarial Examples The average pixel value, , These represent the standard deviations of the two pixel values, This represents the covariance of the pixel values ​​of the two. and It is a constant, usually taken as , Generally speaking, Take 0.01, Set to 0.03; R represents the gray level, set to 255; ； In the formula, These are original, clean image samples. Represents the original clean image sample The generated adversarial examples It is the feature mapping of the l-th layer in the pre-trained network. It is the number of elements in the feature map of the l-th layer. express Norm; Step a5: Construct the overall network loss function L: ； In equation L, α, β, γ, and λ are the balancing parameters of each part of the loss function. To enhance the model's ability to constrain perturbations, these parameters are set to 1, 10, 1, and 1 by default, respectively, to improve the visual quality of the generated adversarial examples. The GAN network is trained through minimax games, with the generator G fixed, to maximize the loss function L. GAN Optimize the model parameters of the discriminator D, then fix the discriminator D to minimize the overall network loss function L and optimize the model parameters of the generator G. After training for T iterations, the trained generator G is obtained.

Images