Natural confrontation sample generation method and system based on expansion model

Abstract

The invention discloses a natural adversarial sample generation method and system based on an expansion model. The natural adversarial sample generation method comprises the steps of obtaining noise images of a to-be-tested sample at a plurality of preset moments; inputting each noise image into a diffusion model for single-step denoising to obtain a plurality of denoised images at different moments; inputting each de-noised image into a classifier for classification to obtain a log-likelihood probability of each de-noised image corresponding to a target category; obtaining norms of each de-noised image and the to-be-tested sample, and calculating gradients of the log-likelihood probability and the norms to the to-be-tested sample to obtain a gradient value; and updating the to-be-tested sample according to the gradient value to obtain a natural confrontation sample. According to the method, the adversarial sample which is more natural and has certain readability can be generated, additional neural network components and modules are not needed in the process, the calculation cost is lower, plug and play can be realized, and the method can be widely applied to the technical field of artificial intelligence security.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence security technology, and in particular to a method and system for generating natural adversarial samples based on an extended model. Background Art

[0002] Deep neural networks (DNNs) have been widely used in tasks such as image recognition, image segmentation, and image generation. However, adversarial examples can mislead state-of-the-art classification models by adding tiny and imperceptible perturbations to the model input, which poses a threat to the widespread application of DNNs, making people uncertain how the models will fail, and may even lead to catastrophic consequences in tasks such as identity recognition and autonomous driving. Using adversarial examples for training or model evaluation is an effective way to improve the robustness and security of models. However, adversarial example generation methods in previous technologies have difficulty in generating high-quality unrestricted natural adversarial examples based on semantic and feature perturbations, and require a large number of sampling steps and computations. They also require additional components, cannot be plug-and-play, and have low applicability. Summary of the invention

[0003] In order to solve the above technical problems, the purpose of the present invention is to provide a method and system for generating natural adversarial samples based on an extended model, which can generate high-quality natural adversarial samples.

[0004] To achieve the above objectives, an embodiment of the present application proposes a method for generating natural adversarial samples based on an extended model, comprising the following steps:

[0005] Obtaining noise images of the sample to be tested at multiple preset moments;

[0006] Inputting each of the noise images into a diffusion model for single-step denoising to obtain multiple denoised images at different times;

[0007] Inputting each of the denoised images into a classifier for classification, and obtaining a log-likelihood probability of each of the denoised images corresponding to a target category;

[0008] Obtaining the norm of each of the denoised images and the sample to be tested, calculating the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtaining a gradient value;

[0009] The sample to be tested is updated according to the gradient value to obtain a natural adversarial sample.

[0010] In some embodiments, the acquiring of noise images of the sample to be tested at a plurality of preset moments is specifically as follows:

[0011] The sample to be tested is projected onto a Gaussian distribution, and then the noise images at multiple different moments are obtained by sampling from the Gaussian distribution according to the preset moment.

[0012] In some embodiments, the diffusion model includes a denoiser, and each of the noise images is input into the diffusion model for single-step denoising to obtain multiple denoised images at different times, specifically:

[0013] Each of the noise images and the time step corresponding to each of the noise images are input into the denoiser to perform single-step denoising, so as to obtain the denoised images at multiple different moments.

[0014] In some embodiments, inputting each of the denoised images into a classifier for classification to obtain a log-likelihood probability that each of the denoised images corresponds to a target category specifically includes:

[0015] Inputting each of the denoised images and the category labels corresponding to each of the denoised images into the classifier for classification, and obtaining confidence scores of the denoised images corresponding to the target category at different times;

[0016] Taking the natural logarithm of the confidence score to obtain the log-likelihood probability corresponding to the target category.

[0017] In some embodiments, the gradient value includes a first gradient value and a second gradient value, and obtaining the norm of each of the denoised images and the sample to be tested, calculating the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtaining the gradient value specifically includes:

[0018] Calculating the difference between the denoised image and the sample to be tested at different times to obtain a plurality of the norms;

[0019] Calculating the gradient of each of the log-likelihood probabilities with respect to the sample to be tested by back propagation to obtain a plurality of the first gradient values;

[0020] The gradient of each of the norms with respect to the sample to be tested is calculated by back propagation to obtain a plurality of the second gradient values.

[0021] In some embodiments, before updating the sample to be tested according to the gradient value, the method for generating a natural adversarial sample further includes:

[0022] Normalizing the first gradient value and the second gradient value corresponding to the denoised image at different moments to obtain a plurality of normalized gradient values;

[0023] The average of the normalized gradient values ​​is calculated to obtain a gradient average.

[0024] In some embodiments, updating the sample to be tested according to the gradient value to obtain a natural adversarial sample specifically includes:

[0025] Updating the sample to be tested according to the gradient mean, and recording the number of updates;

[0026] Determine update termination times and attack targets;

[0027] When the number of updates reaches the update termination number or the updated sample to be tested reaches the attack target, the updating is stopped to obtain the natural adversarial sample.

[0028] To achieve the above objectives, another aspect of the embodiments of the present application proposes a natural adversarial sample generation system based on an extended model, comprising:

[0029] A noise image acquisition module is used to acquire noise images of the sample to be tested at multiple preset moments;

[0030] A denoised image acquisition module, used for inputting each of the noise images into a diffusion model for single-step denoising to obtain a plurality of denoised images at different times;

[0031] A probability calculation module, used for inputting each of the denoised images into a classifier for classification, and obtaining a log-likelihood probability of each of the denoised images corresponding to a target category;

[0032] A gradient calculation module, used to obtain the norm of each of the denoised images and the sample to be tested, calculate the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtain a gradient value;

[0033] The adversarial sample generation module is used to update the sample to be tested according to the gradient value to obtain a natural adversarial sample.

[0034] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes an electronic device, which includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the natural adversarial sample generation method based on the extended model as described above is implemented.

[0035] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium for computer-readable storage, and the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the natural adversarial sample generation method based on the extended model as described above.

[0036] The beneficial effects of the present invention are as follows: the method and system for generating natural adversarial samples based on the extended model of the present invention first obtains noise images of the sample to be tested at multiple preset moments, then inputs each noise image into the diffusion model for single-step denoising, obtains multiple denoised images at different moments, and then inputs each denoised image into the classifier for classification, obtains the log-likelihood probability of each denoised image corresponding to the target category, and obtains the norm of each denoised image and the sample to be tested, calculates the gradient of the log-likelihood probability and norm to the sample to be tested, obtains the gradient value, and finally updates the sample to be tested according to the gradient value to obtain a natural adversarial sample. The present invention uses the diffusion model as a regularizer to generate noise images at multiple different moments, and applies the diffusion model for regularization and single-step denoising, and then calculates the gradient of the log-likelihood probability and norm to the sample to be tested to obtain the optimization direction of the sample to be tested, which can generate more natural and readable adversarial samples, and does not require additional neural network components and modules in the process, has less computational cost, and can achieve plug-and-play. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solution in the embodiments of the present invention, the following introduction is made to the drawings required for use in the embodiments of the present invention. It should be understood that the drawings introduced below are only for the convenience of clearly describing some embodiments of the technical solution of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 A flowchart of a method for generating natural adversarial samples based on an extended model provided in an embodiment of the present invention;

[0039] Figure 2 A step flow chart of step S103 provided in an embodiment of the present invention;

[0040] Figure 3 A step flow chart of step S104 provided in an embodiment of the present invention;

[0041] Figure 4 A step flow chart of step S105 provided in an embodiment of the present invention;

[0042] Figure 5 A schematic diagram of a flow chart of a method for generating natural adversarial samples based on an extended model provided in an embodiment of the present invention;

[0043] FIG6( a ) is a result of image quality assessment of a denoising diffusion natural attack method at different K values ​​provided by an embodiment of the present invention;

[0044] FIG6( b ) is a result of image quality assessment of the denoising diffusion natural attack method provided by an embodiment of the present invention at different λ values;

[0045] FIG7( a ) is an example diagram of a natural adversarial sample generated by the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0046] FIG7( b ) is another example diagram of a natural adversarial sample generated by the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0047] FIG7( c ) is another example diagram of a natural adversarial sample generated by the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0048] Figure 8 An example diagram of attack results of the denoising diffusion natural attack method provided by an embodiment of the present invention on the MNIST data set;

[0049] Fig. 9 A comparison chart of the results generated by the denoising diffusion natural attack method provided by an embodiment of the present invention and other unrestricted attack methods;

[0050] FIG10( a ) is a diagram showing an example of a result of attacking Google Cloud Vision API in a real scenario using the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0051] FIG10( b ) is another example diagram of the result of attacking Google Cloud Vision API in a real scene using the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0052] FIG10( c ) is another example diagram of the result of attacking Google Cloud Vision API in a real scene using the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0053] FIG10( d ) is another example diagram of the result of attacking Google Cloud Vision API in a real scene using the denoising diffusion natural attack method provided by an embodiment of the present invention;

[0054] Fig.11 A schematic diagram of the structure of a natural adversarial sample generation system based on an extended model provided in an embodiment of the present invention;

[0055] Fig.12 A schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0057] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0058] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0059] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0060] Adversarial Example: An adversarial example refers to an input that can cause a deep neural network to produce an incorrect output result by making a slight perturbation or modification to the original input data. This perturbation is usually artificially designed and imperceptible to humans, but it will cause serious misclassification for the deep neural network model. Adversarial examples are usually divided into restricted adversarial examples and unrestricted adversarial examples. Among them, the perturbation strength of unrestricted adversarial examples is not affected by L p Norm (L1, L2, L ∞ )limit.

[0061] Natural Adversarial Example: Natural adversarial examples are a special type of adversarial examples. One refers to the generated adversarial perturbations are semantic and human-readable, rather than meaningless and incomprehensible noise, or it can also refer to the adversarial examples that approximately follow the distribution of real data. Most natural adversarial examples are unrestricted adversarial examples.

[0062] Diffusion Model (DM): Diffusion model is a type of generative model. The diffusion model in the embodiment of the present invention specifically refers to the Denoising Diffusion Probabilistic Models (DDPM), which is a specific implementation of the diffusion model. It uses a probabilistic model to remove noise and generate new data. During training, Gaussian noise is first added to the training samples to destroy the training data until the samples obey the Gaussian distribution. Then the model (usually U-NET) learns how to reverse the process to generate new data from the noise. The trained diffusion model can gradually denoise a sampled random noise into a sample that obeys the distribution of the training data.

[0063] Latent Diffusion Model (LDM): The latent diffusion model first uses the VAE encoder to obtain a low-dimensional image code. During training, diffusion and denoising processes are performed on this low-dimensional code to reduce the amount of computation. During inference generation, the VAE decoder decodes the obtained low-dimensional code back to the pixel space.

[0064] Denoising Diffusion Implicit Model (DDIM): The denoising diffusion implicit model removes the restriction that the diffusion process is a Markov chain, so that sampling can be performed with fewer steps in the sampling phase. In particular, when the variance coefficient in DDIM is equal to 0, the sampling process of each denoising step degenerates into a deterministic process, and there is no need to add random noise to the sampling result.

[0065] Regularizer: Regularizer is a penalty term added during the training process of a machine learning model to prevent the model from overfitting. It limits the complexity of the model so that the model performs well on the training set and improves the generalization ability of the model on the test set.

[0066] Deep neural networks (DNNs) have been widely used in tasks such as image recognition, image segmentation, and image generation. However, adversarial examples can mislead state-of-the-art classification models by adding tiny and imperceptible perturbations to the model input, which poses a threat to the widespread application of DNNs, making it uncertain how the models will fail, and may even lead to catastrophic consequences in tasks such as identity recognition and autonomous driving.

[0067] Researchers have explored various adversarial examples in the DNN input space. A common method for obtaining adversarial perturbations is to calculate the signed gradient of the probability likelihood of the target classification with respect to the input. However, many studies use L p The norm imposes constraints. Stronger constraints will produce adversarial examples that are difficult for humans to detect. Conversely, weaker constraints allow stronger adversarial transferability, which means that adversarial examples generated under one model can mislead models with different structures trained under the same training set. Unrestricted adversarial examples, whose adversarial perturbations are not affected by L p Norm constraints allow for nearly unlimited perturbation ranges to create diverse attack patterns.

[0068] However, the lack of constraints does not mean that adversarial perturbations are imperceptible to humans or look natural. More natural adversarial samples should obey the image data distribution and be difficult for humans to identify as meaningless adversarial perturbations. Such natural adversarial samples are widely present in reality. For example, there are samples in the dataset that are easy for humans to classify but difficult for models to handle. Models perform poorly on these samples because they learn some non-robust features. For example, when classifying cows, the model may learn the green grass in the background of images classified as cows as the characteristics of cows. Therefore, when given an image containing green grass, the model will incorrectly classify it as a cow. Another case is that the model can only distinguish different categories based on certain semantic features, such as classifying a plastic object painted in banana color as a banana with high confidence. Therefore, the natural adversarial samples to be generated should be based on perturbations at the semantic and feature levels, which also makes natural adversarial samples usually unrestricted adversarial samples. There are currently many methods for generating more natural unrestricted adversarial samples. The methods that have received more attention in the previous technology include methods based on feature perturbations such as image texture and color and methods based on generative models.

[0069] Methods based on perturbations of features such as image texture and color: Among them, the color space perturbation branch can generate more natural adversarial samples. For example, the Semantic Adversarial Examples (SAE) method in the prior art generates color-based adversarial samples by perturbing the H (hue) and S (saturation) channels of the HSV color space; the ReColorAdv method in the prior art operates in the LUV color space and applies a specific function to all pixels of the same color for transformation to generate more natural adversarial samples; the ColorFool method and the Natural Color Fool (NCF) method in the prior art introduce semantic segmentation and color distribution libraries to perturb different semantic parts of the image respectively, thereby improving the concealment and transferability of adversarial samples. However, the above-mentioned prior art methods only limit the perturbation to the color space, and the generation mode is single. And the attack capability is proportional to the perturbation strength. For example, although the ReColorAdv method can provide the most natural color perturbation, its adversarial migration is low and its migration attack capability is poor under the black box model. Although the NCF method has the strongest white box and black box attack capabilities in color perturbation, it also brings the problem of unnatural color distribution of the generated images.

[0070] Generative Adversarial Network (GAN)-based methods: This type of method projects the image into a semantically continuous latent space, and then searches for latent variables z that are similar to the original image in this latent space. clean Semantically close adversarial examples z Adv , and apply x Adv =G(z Adv ) generates adversarial samples in pixel space. Since the generative model only learns P(X data ), so the generated adversarial samples obey the distribution of training data and show natural semantic changes. For example, the UGAN method in the prior art uses AC-GAN to learn the distribution of legitimate data and sample adversarial samples in the latent space. However, this method lacks an encoder p for mapping samples in the pixel space to the latent space. θ (z|x), nor has an algorithm been designed to obtain the hidden code of a specific image, so it is impossible to find adversarial samples similar to a specific clean sample. The NGAN method in the previous technology also proposed using GAN to generate natural adversarial samples. This method introduces an encoder to encode the image into a low-dimensional latent space and perform semantic perturbations in this space to generate adversarial samples. However, this method is limited by the capabilities of GAN (such as mode collapse and training instability, etc.), and cannot generate high-quality and diverse adversarial samples.

[0071] Diffusion model-based methods: Compared with GAN, another generative model called diffusion model shows a stable training process while generating high-quality images. Diffusion model only needs to inject noise directly during inference without training auxiliary networks. However, diffusion model uses multiple function composites through inverse Markov process. This will result in directly optimizing its hidden variable x T (x T As a result, unacceptable memory consumption occurs when the diffusion model is the final moment. Therefore, related methods in the prior art focus on alleviating this problem, but these methods still require a lot of computational overhead due to the limitation of the generation method of the diffusion model.

[0072] In addition, the unrestricted adversarial sample generation method in the previous technology proposes to optimize the single noisy image after adding noise step by step, and optimize the denoised image at each step of the denoising process. The gradient of the target classifier is used for adversarial attack, and semantic segmentation and CAM activation class graph are used to piece together the optimization area. The diffusion model DDPM divides the forward diffusion process moment t∈[0,1] into 1000 discrete steps. When t=1, it is regarded as the 1000th step of noise addition. At this time, the image is pure Gaussian noise, the structural information of the image is destroyed, and it is impossible to denoise it to the original input. Therefore, a hot start process is designed in this method, and denoising starts from a noisy image corresponding to an intermediate moment. However, the choice of this moment is heuristic and not necessarily reasonable. In addition, this method continuously optimizes the noisy image at each step during the denoising process. The optimized unrestricted adversarial sample may produce a large semantic change, and the semantic perturbation is uncontrollable. Therefore, this method introduces semantic segmentation to ensure that the adversarial perturbation only acts on the background, but as mentioned earlier, the model may misclassify because it has learned non-robust features, which are not restricted by the location where they are generated.

[0073] The Content-based Unrestricted Adversarial Attack (ACA) method in the prior art first uses the inverse process of the denoising diffusion implicit model to add noise to the image to approximately follow the Gaussian distribution, and then gradually samples from this noise sample along the inverse Markov process using the denoising diffusion implicit model. Unlike the above methods, this method does not gradually optimize the intermediate noise during the denoising process and use hot start to prevent semantic drift, but directly applies the gradient of the target label of the attacked classifier to the final generated image to the pure Gaussian noise. In order to alleviate the problem that the semantic difference between the noise image and the sample to be tested is too large after being decoded, the ACA method introduces the BLIP model to generate text titles on the input image as a condition in the inverse diffusion process of the conditional diffusion model to constrain the generation space. However, this also limits its scope of use, resulting in its lack of plug-and-play capabilities. In addition, this method requires multiple sampling steps to calculate noise and generate adversarial samples, which has a high computational cost.

[0074] To this end, an embodiment of the present invention proposes a method for generating natural adversarial samples based on an extended model, first obtaining noise images of a sample to be tested at multiple preset moments, then inputting each noise image into a diffusion model for single-step denoising, obtaining denoised images at multiple different moments, and then inputting each denoised image into a classifier for classification, obtaining the log-likelihood probability of each denoised image corresponding to the target category, and obtaining the norm of each denoised image and the sample to be tested, calculating the gradient of the log-likelihood probability and the norm to the sample to be tested, obtaining the gradient value, and finally updating the sample to be tested according to the gradient value to obtain a natural adversarial sample. The present invention uses a diffusion model as a regularizer to generate noise images at multiple different moments, and applies the diffusion model for regularization and single-step denoising, and then calculates the log-likelihood probability and the norm to the gradient of the sample to be tested to obtain the optimization direction of the sample to be tested, which can generate more natural and readable adversarial samples, and does not require additional neural network components and modules in the process, with less computational cost, and can achieve plug-and-play. This natural adversarial sample generation method can be applied to scenarios such as model security assessment, model robustness testing, security vulnerability discovery, and defense strategy evaluation, but is not limited to these.

[0075] Reference Figure 1 , Figure 1 A flowchart of a method for generating a natural adversarial sample based on an extended model provided by an embodiment of the present invention. An embodiment of the present invention proposes a method for generating a natural adversarial sample based on an extended model, and the method includes steps S101 to S105:

[0076] S101, obtaining noise images of a sample to be tested at multiple preset moments;

[0077] In some optional embodiments, for the latent diffusion model (LDM), first use the VAE encoder to obtain the low-dimensional latent variables of the sample to be tested, randomly sample a time step and the Gaussian noise corresponding to the time step, and obtain the latent variables of the noise version at the corresponding moment (i.e., the noise image). For the ordinary denoising diffusion probability model (Denoising Diffusion Probabilistic Models, DDPM), directly add the Gaussian noise of the corresponding moment to the sample to be tested to obtain the latent variables of the noise version. In order to maintain the consistency of the algorithm description, the embodiment of the present invention ignores the LDM encoding and decoding process, and the image encoded by the former using VAE and the original image of the latter (i.e., the sample to be tested) are collectively referred to as x0, and the latent variables at the corresponding moment (i.e., the noise image) are collectively referred to as x t .

[0078] It should be noted that, since natural adversarial perturbations may appear in different frequency regions of an image, an embodiment of the present invention randomly samples noise at multiple different times and integrates images with different noise intensities to guide the image to undergo effective semantic changes and improve image quality.

[0079] As an optional implementation, the step of obtaining noise images of the sample to be tested at multiple preset moments can be further divided into the following steps S1011:

[0080] S1011, projecting the sample to be tested onto the Gaussian distribution, and then sampling from the Gaussian distribution according to preset moments to obtain noise images at multiple different moments.

[0081] For example, given an input test sample x0, the test sample is used as the initial adversarial sample Using Diffusion Model The forward process projects the test sample onto its latent variable. The projection process is as follows: sample a time step from the forward distribution As an index of noise intensity. A larger value corresponds to a smaller drift coefficient. It means that the sample to be tested has a small coefficient in the linear combination with the noise. Then, the sampling noise And calculate

[0082] Specifically, the embodiment of the present invention needs to use the diffusion process defined by the denoising diffusion probability model (DDPM). The denoising diffusion probability model (DDPM) is a generative model based on the diffusion process, which generates samples that obey the distribution of training data through "noising-denoising". Each step of the diffusion process is defined as a Markov chain, as shown in the following formula:

[0083]

[0084] in, is the variance sequence, which controls the amount of noise added in the tth step. It can be deduced that I is the identity matrix. Then the diffusion process can be defined as follows:

[0085]

[0086] Through the above formula, the input sample to be detected is directly projected into a Gaussian distribution q(x t |x0), and then sample noise images at multiple preset moments from this Gaussian distribution. Those skilled in the art will appreciate that the preset moment can be selected according to actual needs.

[0087] S102, inputting each noise image into a diffusion model for single-step denoising to obtain multiple denoised images at different times;

[0088] In some optional embodiments, the diffusion model uses an unconditional diffusion model, which is connected to the classifier as a regularizer to constrain the confidence of the target label along the noise path to the search space of the input test sample gradient. In practice, a diffusion model trained in pixel space such as ADM (OpenAI) or a diffusion model trained in latent space such as Latent Diffusion Model (LDM) can be used. The embodiment of the present invention can also use a conditional diffusion model, and only the conditional item needs to be set to an empty condition.

[0089] It should be noted that the embodiment of the present invention can overcome the problem of too large back propagation calculation graph in the multi-step denoising reconnection classifier scheme by performing only single-step denoising in each noise path, thereby reducing the calculation cost.

[0090] As an optional implementation, the diffusion model includes a denoiser, and each noise image is input into the diffusion model for single-step denoising to obtain a plurality of denoised images at different moments. Specifically, the step can be further divided into the following steps S1021:

[0091] S1021. Input each noise image and the time step corresponding to each noise image into a denoiser to perform single-step denoising, so as to obtain a plurality of denoised images at different times.

[0092] For example, each noise image x t and its corresponding time step t is input to the denoiser ∈ of the diffusion model θ (·,·). The denoiser takes the noisy image and its corresponding time step as input and outputs the predicted noise According to the denoising process definition formula below, the denoised image can be obtained from the previous time step Or the predicted denoised image Both images are recorded in the computational graph and can be used to optimize the input test samples

[0093] Specifically, the embodiment of the present invention requires a denoising process defined by a denoising diffusion implicit model (DDIM). The denoising diffusion implicit model (DDIM) defines a known noise distribution as follows:

[0094]

[0095] The above equation is a non-Markov process. Subsequently, each step of the denoising process can be defined as follows:

[0096]

[0097] When σ r = 0, the above formula loses randomness and degenerates into a deterministic process, the denoising diffusion implicit model (DDIM) degenerates into a Dirac distribution, and the denoising process can be regarded as an initial value problem of solving a deterministic ordinary differential equation. At this time, the denoised image predicted after single-step denoising is for:

[0098]

[0099] Image editing method based on diffusion model via step-by-step prediction This inverse Markov process obtains the final denoised image For example, if there are 1000 denoising steps in total, starting from pure Gaussian noise, the model needs to be called 1000 times. However, for a certain sample to be tested, the method of the embodiment of the present invention directly uses the time t of this step to perform a single-step denoising diffusion implicit model (DDIM) denoising through the above formula to obtain a denoised image This process only requires calling the model once. In an optimization of a sample to be tested, the embodiment of the present invention only requires sampling of noise and sub-optimization at K different moments, and the computational cost is much lower than that of other prior art methods involved.

[0100] S103, inputting each denoised image into a classifier for classification, and obtaining a log-likelihood probability of each denoised image corresponding to a target category;

[0101] In some optional embodiments, the classifier can be a structure such as CNN, MLP, and ViT, which serves as the attacked model in the case of white-box attack, and in the case of black-box attack, the classifier is used as a substitute model to connect the diffusion model to generate natural adversarial samples, and directly use the generated adversarial samples to migrate and attack the black-box model.

[0102] It should be noted that the embodiment of the present invention takes into account that the attacked classifier is different from the noise classifier used in the conditional guided diffusion model (the classifier is fine-tuned on the noise image), and there may be a problem of distribution drift. In order to alleviate this problem, the embodiment of the present invention uses the predicted denoised image As the input of the classifier, it can effectively alleviate the problem of semantic drift in generating adversarial samples.

[0103] Reference Figure 2 , Figure 2 A step flow chart of step S103 provided in an embodiment of the present invention, further as an optional implementation manner, inputting each denoised image into a classifier for classification to obtain the log-likelihood probability of each denoised image corresponding to the target category can be further divided into the following steps S1031 and S1032:

[0104] S1031, inputting each denoised image and the category label corresponding to each denoised image into a classifier for classification, and obtaining the confidence scores of the denoised images at different times corresponding to the target category;

[0105] S1032. Take the natural logarithm of the confidence score to obtain the log-likelihood probability corresponding to the target category.

[0106] Specifically, given the classification confidence f:x∈R of the attacked model H×W×C ×y∈Y→R, the classifier receives the denoised image as input And the category label y, and then output the confidence score of the given target category. For each sampled noise image, take the natural logarithm of the confidence score and calculate its log-likelihood probability

[0107] S104, obtaining the norm of each denoised image and the sample to be tested, calculating the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtaining the gradient value;

[0108] Reference Figure 3 , Figure 3 A step flow chart of step S104 provided in an embodiment of the present invention, further as an optional implementation manner, the gradient value includes a first gradient value and a second gradient value, the norm of each denoised image and the sample to be tested is obtained, the log-likelihood probability and the gradient of the norm to the sample to be tested are calculated, and the step of obtaining the gradient value can be further divided into the following steps S1041 to S1043:

[0109] S1041, calculating the difference between the denoised image and the sample to be tested at different times to obtain multiple norms;

[0110] S1042, calculating the gradient of each log-likelihood probability with respect to the test sample by back propagation, and obtaining a plurality of first gradient values;

[0111] S1043. Calculate the gradient of each norm with respect to the test sample through back propagation to obtain multiple second gradient values.

[0112] Specifically, back propagation is performed to calculate the first gradient value of the log-likelihood probability of the target category to the input sample to be tested along each noise path and the L gradient of the denoised image and the sample to be tested. p The second gradient value of the input test sample.

[0113] For example, for each noise image, the log-likelihood probability is calculated Relative to the sample to be tested The gradient of is calculated and the gradient is used to update the sample to be tested. Since K noise images are sampled, this process needs to be repeated K times. K can also be regarded as the number of images in a batch, but calculating the gradient for a batch of images will result in higher video memory overhead. Therefore, the embodiment of the present invention calculates the gradient of the log-likelihood probability of the target class for each noise sample separately and accumulates them. At the same time, the L between the denoised image and the sample to be tested is introduced. p norm to limit excessive semantic fluctuations and obtain a sparse solution. The final optimization goal for a single image is to minimize γ is a weight coefficient, where the gradient of a single noise image is calculated by:

[0114]

[0115] S105. Update the sample to be tested according to the gradient value to obtain a natural adversarial sample.

[0116] As an optional implementation, before the step of updating the sample to be tested according to the gradient value, the natural adversarial sample generation method further includes the following steps A1051 and A1052:

[0117] A1051, normalizing the first gradient value and the second gradient value corresponding to the denoised image at different times to obtain a plurality of normalized gradient values;

[0118] A1052. Calculate the mean of multiple normalized gradient values ​​to obtain a gradient mean.

[0119] Specifically, since the gradients of the noise images calculated at different times have different amplitudes, directly summing the calculated gradients may mask weak gradient signals. Therefore, the embodiment of the present invention applies gradient normalization to the first gradient value and the second gradient value of each noise image through the following formula to obtain the normalized gradient value g k :

[0120]

[0121] Since the noise image is sampled from a distribution with a large variance, the estimated gradient of the noise image sampled at a given time step may be inaccurate. Taking the average of the normalized gradient values ​​helps to obtain smooth and natural gradient values. Therefore, the normalized gradient values ​​are averaged by the following formula to obtain the gradient mean g:

[0122]

[0123] Reference Figure 4 , Figure 4A step flow chart of step S105 provided in an embodiment of the present invention, further as an optional implementation, the step of updating the sample to be tested according to the gradient value to obtain the natural adversarial sample can be further divided into the following steps S1051 to S1053:

[0124] S1051. Update the sample to be tested according to the gradient mean and record the number of updates;

[0125] Specifically, the gradient mean calculated above is used to optimize and update the test sample using the following formula:

[0126]

[0127] Among them, λ is the update step size.

[0128] It should be noted that the embodiment of the present invention directly optimizes the sample to be tested. On the one hand, it has a smaller computational overhead and does not need to introduce a neural network module for semantic segmentation and obtaining image titles, and has a wider applicability. On the other hand, directly optimizing the sample to be tested can also alleviate the problem of serious semantic changes in unrestricted natural adversarial samples.

[0129] S1052, determining the update termination times and the attack target;

[0130] S1053. When the number of updates reaches the update termination number or the updated sample to be tested reaches the attack target, stop updating and obtain a natural adversarial sample.

[0131] Specifically, the above steps S101 to S105 are repeatedly executed until the number of updates reaches the update termination number or the attack target is completed, and then the update is stopped to generate a natural adversarial sample.

[0132] Those skilled in the art will appreciate that the update termination times and attack targets can be set according to actual needs. For example, the update termination times can be 50 times, 60 times, etc.; the attack target can be: the original label of the sample to be tested is no longer the output with the highest probability of the attacked model or the original label is no longer in the Top-5 label list.

[0133] In summary, the processing flow of the method for generating natural adversarial samples based on the extended model in the embodiment of the present invention is as follows: Figure 5 As shown:

[0134] The first step is to obtain the hidden variables of the sample to be tested and obtain the noise image;

[0135] In the second step, the noise image at time t is input into the diffusion model to perform single-step denoising to obtain the predicted denoised image;

[0136] Step 3: Repeat the first and second steps to obtain multiple predicted denoised images.

[0137] In the fourth step, the denoised image is input into the classifier to calculate the log-likelihood probability of the corresponding target category;

[0138] The fifth step is to perform back propagation to calculate the gradient of the log-likelihood probability of the target category to the input sample to be tested along each noise path and the L probability of the denoised image and the sample to be tested. p The gradient of the norm to the input sample to be tested;

[0139] The sixth step is to normalize the gradient, accumulate and calculate the average gradient value, and perform single-step optimization on the original sample to be tested according to the average gradient value;

[0140] Step 7: Repeat steps 1 to 6 until the update termination times are reached or the attack target is completed.

[0141] The above is a description of the method for generating natural adversarial samples based on the extended model in the embodiment of the present invention. It can be appreciated that compared with the adversarial sample method in the prior art, the embodiment of the present invention has the following advantages:

[0142] First, randomly sampling noise at multiple different times and integrating images with different noise intensities can guide the image to undergo effective semantic changes and improve image quality;

[0143] Second, by performing only single-step denoising on each noise path, the problem of too large back-propagation calculation graph under the multi-step denoising and reconnection classifier scheme can be overcome, thus reducing the calculation cost;

[0144] Third, using the diffusion model as a regularizer can reduce the probability of converging to meaningless and unnatural noise, generate more natural and readable adversarial samples, and have stronger black box transferability and robustness against defense models;

[0145] Fourth, using the predicted denoised image as the input of the classifier can effectively alleviate the problem of semantic drift in generating adversarial samples;

[0146] 5. Directly optimize the test samples, with smaller computational overhead, and there is no need to introduce neural network components and modules for semantic segmentation and obtaining image titles in the process. It has wider applicability and can be plug-and-play.

[0147] In order to further verify the effectiveness of the embodiment of the present invention, the effect of the embodiment of the present invention is further described below in combination with experiments.

[0148] Experiment 1: Benchmark Experiment

[0149] For the sake of distinction, the natural adversarial sample generation method based on the extended model proposed in the embodiment of the present invention is referred to as the denoising diffusion natural attack method (DDNA) below. In order to verify the effectiveness of the denoising diffusion natural attack method (DDNA) proposed in the embodiment of the present invention, the embodiment of the present invention compares the untargeted attack results of the denoising diffusion natural attack method (DDNA) with other unrestricted attack methods under the white-box and black-box substitution model settings. The comparison results are shown in Table 1 below. ImageNet-1k is selected as the tested data set, and the indicator is the Top-1 attack success rate (ASR,%). This setting requires that the label of the generated adversarial sample is not the initial label, but can be other category labels. The diffusion model used for generation is the latent diffusion model (LDM). In order to be consistent with the process of using the unconditional diffusion model proposed in the embodiment of the present invention, the guide text of the sampling stage is set to an empty condition in the setting. The "Surrogate" column represents the white-box model used to generate adversarial samples under the framework of the denoising diffusion natural attack method (DDNA), and the other columns represent the attack success rate of the adversarial samples generated under these white-box models to migrate and attack other black-box models. As can be seen from Table 1, the natural adversarial sample generation method proposed in the embodiment of the present invention has a higher average black-box and white-box attack success rate, which is better than the unrestricted attack method in the prior art.

[0150] Table 1

[0151]

[0152] As shown in Table 2 below, the defense robustness comparison results of the denoising diffusion natural attack method (DDNA) and other unrestricted attack methods under different defense methods. It can be seen from Table 2 that the natural adversarial sample generation method proposed in the embodiment of the present invention is comprehensively superior to the unrestricted attack method in the previous technology and has better defense robustness.

[0153] Table 2

[0154] Defense Clean SAE ReColorAdv NCF Ours None 4.2 68.8 94.0 76.6 99.2 <![CDATA[JPEG 75 ]]> 5.9 45.4 40.1 64.3 97.9 <![CDATA[JPEG 45 ]]> 8.5 46.0 54.8 64.7 95.4 Gray 13.3 15.4 29.4 19.7 91.2 <![CDATA[Inc-v3 ens3 ]]> 13.3 28.7 16.6 37.7 57.8 <![CDATA[IncRes-v2 ens ]]> 5.5 16.6 8.8 30 42.9 HGD 4.6 12.2 9.5 24.4 41.3 DiffPure 11.8 51.1 27.6 65.0 74.0

[0155] Table 3 below shows the image quality evaluation results of the denoising diffuse natural attack method (DDNA) and other unrestricted attack methods under different evaluation indicators, evaluated by FID (↓) and LIPIS (↓) indicators. The smaller the score, the more natural the generated image.

[0156] Table 3

[0157] Metric Clean SAE ReColorAdv NCF Ours FID 57.8 69.9 57.8 67.1 62.6 LPIPS 0 0.38 0.09 0.44 0.22

[0158] As shown in Figure 6(a) and Figure 6(b), the generated image quality evaluation results of the denoising diffusion natural attack method (DDNA) under different parameter settings, the ablation experiment proves that the natural adversarial sample generation method proposed in the embodiment of the present invention has better image quality with the number of single optimization batches (that is, the diffusion model is only called eight times in one optimization).

[0159] Experiment 2: Visualization Experiment

[0160] As shown in Figure 7(a), Figure 7(b) and Figure 7(c), they are examples of natural adversarial samples generated by the denoising diffusion natural attack method (DDNA). From left to right in Figure 7(a), Figure 7(b) and Figure 7(c) are clean samples, natural adversarial samples generated by the denoising diffusion natural attack method (DDNA) and adversarial perturbations; Figure 8 The following is an example of the attack results of the denoising diffusion natural attack method (DDNA) on the MNIST dataset; Fig. 9 The figure shows the comparison of the results generated by the denoising diffusion natural attack method (DDNA) and other unrestricted attack methods. From Figure 7(a), Figure 7(b), Figure 7(c), Figure 8 as well as Fig. 9 It can be seen that the adversarial samples generated by the natural adversarial sample generation method proposed in the embodiment of the present invention contain obvious target classification features. The above visualization experiments show that the natural adversarial sample generation method proposed in the embodiment of the present invention can effectively generate feature-level natural adversarial samples by modifying image semantics.

[0161] Experiment 3: Real-world attack

[0162] As shown in Figures 10(a), 10(b), 10(d) and 10(c), they are example diagrams of the results of the denoising diffusion natural attack method (DDNA) in a real scenario through a black box transfer attack on the Google Cloud Vision API. It can be seen from Figures 10(a), 10(b), 10(d) and 10(c) that the natural adversarial sample generation method proposed in an embodiment of the present invention can modify image features to attack machine learning online services, which has practical significance.

[0163] Reference Fig.11 , an embodiment of the present invention further provides a natural adversarial sample generation system based on an extended model, comprising:

[0164] A noise image acquisition module is used to acquire noise images of the sample to be tested at multiple preset moments;

[0165] A denoising image acquisition module is used to input each noise image into a diffusion model for single-step denoising to obtain multiple denoising images at different times;

[0166] A probability calculation module is used to input each denoised image into a classifier for classification, and obtain the log-likelihood probability of each denoised image corresponding to the target category;

[0167] The gradient calculation module is used to obtain the norm of each denoised image and the sample to be tested, calculate the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtain the gradient value;

[0168] The adversarial sample generation module is used to update the test sample according to the gradient value to obtain a natural adversarial sample.

[0169] The contents of the above-mentioned embodiments of the natural adversarial sample generation method based on an extended model are all applicable to the embodiments of the natural adversarial sample generation system based on an extended model. The functions specifically implemented by the embodiments of the natural adversarial sample generation system based on an extended model are the same as those of the above-mentioned embodiments of the natural adversarial sample generation method based on an extended model, and the beneficial effects achieved are also the same as those achieved by the above-mentioned embodiments of the natural adversarial sample generation method based on an extended model.

[0170] The embodiment of the present invention also provides an electronic device, which includes: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory, and when the program is executed by the processor, the above-mentioned natural adversarial sample generation method based on the extended model is realized. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0171] like Fig.12 FIG. 1 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention, referring to FIG. Fig.12 , an embodiment of the present invention provides an electronic device, including:

[0172] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0173] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the natural adversarial sample generation method based on the extended model of the embodiment of the present invention;

[0174] Input / output interface 1003, used to implement information input and output;

[0175] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0176] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0177] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0178] An embodiment of the present invention also provides a storage medium, which is a computer-readable storage medium used for computer-readable storage. The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the above-mentioned natural adversarial sample generation method based on the extended model.

[0179] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0180] The embodiment of the present invention also discloses a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes Figure 1 The method shown.

[0181] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the above-mentioned boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0182] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified to the contrary, one or more of the above-mentioned functions and / or features can be integrated into a single physical device and / or software module, or one or more functions and / or features can be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0183] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0184] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0185] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and editable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the above-mentioned program is printed, since the above-mentioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or processing in other suitable ways as necessary, and then stored in a computer memory.

[0186] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0187] In the above description of this specification, the description with reference to the terms "one embodiment / example", "another embodiment / example" or "certain embodiments / examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0188] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0189] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for generating natural adversarial samples based on an extended model, characterized in that: The following steps are involved: Obtaining noise images of the sample to be tested at multiple preset moments; Inputting each of the noise images into a diffusion model for single-step denoising to obtain multiple denoised images at different times; Inputting each of the denoised images into a classifier for classification, and obtaining a log-likelihood probability of each of the denoised images corresponding to a target category; Obtaining the norm of each of the denoised images and the sample to be tested, calculating the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtaining a gradient value; The sample to be tested is updated according to the gradient value to obtain a natural adversarial sample.

2. According to claim 1, a method for generating natural adversarial samples based on an extended model is characterized in that: The step of obtaining noise images of the sample to be tested at multiple preset moments is specifically as follows: The sample to be tested is projected onto a Gaussian distribution, and then the noise images at multiple different moments are obtained by sampling from the Gaussian distribution according to the preset moment.

3. According to claim 1, a method for generating natural adversarial samples based on an extended model is characterized in that: The diffusion model includes a denoiser, and each of the noise images is input into the diffusion model for single-step denoising to obtain multiple denoised images at different times, specifically: Each of the noise images and the time step corresponding to each of the noise images are input into the denoiser to perform single-step denoising, so as to obtain the denoised images at multiple different moments.

4. The method for generating natural adversarial samples based on an extended model according to claim 1, characterized in that: The step of inputting each of the denoised images into a classifier for classification to obtain a log-likelihood probability of each of the denoised images corresponding to a target category specifically includes: Inputting each of the denoised images and the category labels corresponding to each of the denoised images into the classifier for classification, and obtaining confidence scores of the denoised images corresponding to the target category at different times; Taking the natural logarithm of the confidence score to obtain the log-likelihood probability corresponding to the target category.

5. The method for generating natural adversarial samples based on an extended model according to claim 1, characterized in that: The gradient value includes a first gradient value and a second gradient value, and the obtaining of the norms of each of the denoised images and the sample to be tested, calculating the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtaining the gradient value specifically includes: Calculating the difference between the denoised image and the sample to be tested at different times to obtain a plurality of the norms; Calculating the gradient of each of the log-likelihood probabilities with respect to the sample to be tested by back propagation to obtain a plurality of the first gradient values; The gradient of each of the norms with respect to the sample to be tested is calculated by back propagation to obtain a plurality of the second gradient values.

6. The method for generating natural adversarial samples based on an extended model according to claim 5, characterized in that: Before updating the sample to be tested according to the gradient value, the natural adversarial sample generation method further includes: Normalizing the first gradient value and the second gradient value corresponding to the denoised image at different moments to obtain a plurality of normalized gradient values; An average is calculated for the multiple normalized gradient values ​​to obtain a gradient average.

7. The method for generating natural adversarial samples based on an extended model according to claim 6, characterized in that: The updating of the sample to be tested according to the gradient value to obtain a natural adversarial sample specifically includes: Updating the sample to be tested according to the gradient mean, and recording the number of updates; Determine update termination times and attack targets; When the number of updates reaches the update termination number or the updated sample to be tested reaches the attack target, the updating is stopped to obtain the natural adversarial sample.

8. A natural adversarial sample generation system based on an extended model, characterized in that: include: A noise image acquisition module is used to acquire noise images of the sample to be tested at multiple preset moments; A denoised image acquisition module, used for inputting each of the noise images into a diffusion model for single-step denoising to obtain a plurality of denoised images at different times; A probability calculation module, used for inputting each of the denoised images into a classifier for classification, and obtaining a log-likelihood probability of each of the denoised images corresponding to a target category; A gradient calculation module, used to obtain the norm of each of the denoised images and the sample to be tested, calculate the log-likelihood probability and the gradient of the norm to the sample to be tested, and obtain a gradient value; The adversarial sample generation module is used to update the sample to be tested according to the gradient value to obtain a natural adversarial sample.

9. An electronic device, characterized in that: The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for realizing connection and communication between the processor and the memory. When the program is executed by the processor, the steps of the natural adversarial sample generation method based on the extended model as described in any one of claims 1 to 7 are realized.

10. A storage medium, the storage medium being a computer-readable storage medium, used for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the natural adversarial sample generation method based on the extended model as described in any one of claims 1 to 7.

Images