A pixel-guided black box attack method and device

Abstract

The present invention discloses a pixel-guided black-box attack method and device, which relates to the field of drone countermeasures. It is used to solve the problem that the current adversarial sample generation method under black-box attack relies too much on models, lacks key semantic positioning, easily causes redundant disturbances and unnecessary pixel tampering, and leads to a high number of queries and a low attack success rate. It includes: according to the adaptive particle swarm optimization APSO algorithm, determine the key pixels in the clean sample and the mask matrix corresponding to the key pixels; according to the difference between the clean sample identification label and the target image identification label, obtain the key parameters for controlling the generation of adversarial disturbances of the target image through the PID controller, obtain the tampered adversarial sample and the tampered adversarial sample first identification label according to the key parameters and the mask matrix; according to the difference between the tampered adversarial sample first identification label and the target image identification label, obtain the adversarial attack optimization model and the optimal adversarial attack sample.

Description

Technical Field

[0001] The present invention relates to the field of drone countermeasures, and more specifically to a pixel-guided black box attack method and device. Background Art

[0002] With the development of high-performance computing hardware and advanced neural network architectures, deep neural networks have become a powerful tool for solving many high-dimensional complex problems and have achieved remarkable results in many fields such as image classification, natural language processing, object recognition, object detection, speech recognition, and speech translation. However, recent studies have shown that deep neural networks are vulnerable to adversarial samples due to their fragility and uncertainty. Attackers can use adversarial samples to construct deceptive inputs, that is, add subtle perturbations that are not easily perceived by the human eye to the original input, effectively interfering with the normal operation of deep neural networks, thereby causing artificial intelligence systems to behave incorrectly or even cause serious consequences. For example, in autonomous driving scenarios, attackers may tamper with traffic signs or cause the system to miss detection of pedestrians and obstacles. Therefore, the generation method of adversarial samples has become a research hotspot in the field of artificial intelligence security. In-depth exploration of this field, including the analysis of adversarial sample generation mechanisms, the development of efficient detection methods, and the innovation of defense strategies, is crucial to ensuring the security and reliability of artificial intelligence systems. This will not only help improve the defense capabilities of current artificial intelligence systems, but also provide a solid theoretical basis and technical support for the design of future artificial intelligence systems.

[0003] Adversarial sample generation methods can be divided into white-box adversarial attacks and black-box adversarial attacks according to the degree of model information acquisition, and can also be divided into targeted attacks and non-targeted attacks according to the degree of limitation of model misjudgment results. In white-box attacks, adversarial sample generation methods mostly rely on gradient backpropagation of deep neural networks and search for decision boundaries to construct a variety of adversarial perturbations, such as limited-memory BFGS (Limited-memory BFGS), Fast Gradient Sign Method (FGSM), One-step target class method (OTCM) and Proximal Gradient Descent (PGD). However, in real scenarios, due to the confidentiality and access restrictions of most systems, it is impossible to obtain complete information about the model, which greatly limits the applicability of white-box adversarial attack methods, thereby shifting the research focus to black-box adversarial attack methods. Existing black-box adversarial attack methods usually generate adversarial samples by estimating gradients and performing a large number of queries in the decision space, or by using differential evolution and training alternative models, such as zero-order optimization (ZOO), natural evolutionary strategies (NES), transferable embedding based black-box attack (TREMBA), model-based integrated attack methods, etc. However, these methods not only consume a lot of computing resources, but also easily tamper with unnecessary pixels. In addition, when facing target models with complex decisions or customized defense mechanisms, they may not be effective and cannot guarantee a generally high attack success rate, so there are limitations. Summary of the invention

[0004] The embodiments of the present invention provide a pixel-guided black-box attack method and device to solve the problem that the current adversarial sample generation method under black-box attack relies too much on models, lacks key semantic positioning, easily causes redundant disturbances and unnecessary pixel tampering, and leads to a high number of queries and a low attack success rate.

[0005] The embodiment of the present invention provides a pixel-guided black box attack method, comprising:

[0006] According to the deep neural network classifier, clean samples, clean sample identification labels, target images and target image identification labels are obtained;

[0007] The coordinates of the pixel points included in the clean sample are determined as the particle positions, and the pixel values ​​corresponding to the coordinates of the pixel points are determined as the particle values. According to the adaptive particle swarm optimization (APSO) algorithm, the position of each particle is updated, the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points are determined;

[0008] According to the difference between the clean sample identification label and the target image identification label, a key parameter for controlling the generation of adversarial perturbation of the target image is obtained through a PID controller, and a tampered adversarial sample and a first identification label of the tampered adversarial sample are obtained according to the key parameter and the mask matrix;

[0009] According to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image, an adversarial attack optimization model is obtained, and the optimal adversarial attack sample of the adversarial attack optimization model is obtained according to a loop iterative algorithm.

[0010] Preferably, the updating of each particle position and determining the fitness value of the particle according to the adaptive particle swarm optimization (APSO) algorithm specifically includes:

[0011] Set the maximum value of the inertia factor, the minimum value of the inertia factor, the maximum number of iterations, the size of the particle swarm corresponding to the clean sample, the self-learning factor and the social learning factor;

[0012] In iteration The iteration number is determined by the following formula according to the maximum value of the inertia factor, the minimum value of the inertia factor, and the maximum number of iterations. The inertia factor of this time is:

[0013]

[0014] According to the iteration The inertia factor , No. Particle iterations The speed of , No. Particle iterations The best position , No. Particle iterations Second position , the optimal position of the particle swarm and in [-1,1] The random perturbation of the interval determines the Particle iterations Speed ​​of times:

[0015]

[0016] Update the position of each particle and determine the fitness value of the particle according to the following formula:

[0017]

[0018]

[0019] in, Represents iteration The inertia factor, represents the maximum value of the inertia factor, represents the minimum value of the inertia factor, represents the maximum number of algorithm iterations, represents the number of iterations of the algorithm, represents the size of the particle swarm, , Indicates Particle iterations The speed of Indicates Particle iterations The speed of represents the self-learning factor, represents the social learning factor, , Indicated in Random numbers in the interval, Indicates Particle iterations The best position of the second Indicates Particle iterations The second position, Indicates Particle iterations The second position, represents the optimal position of the particle swarm, Indicated in Random disturbances in the interval, represents the fitness value of the particle, Indicates a clean sample Determined by a deep neural network classifier The recognition result of Represents the masked sample after the masked pixel Determined by a deep neural network classifier The recognition result of represents a clean sample, Indicates a clean sample The correct label, Represents the masked samples behind the masked pixels, Represents masked samples Identification tag, express Norm metric.

[0020] Preferably, the determining of the key pixel points in the clean sample and the mask matrix corresponding to the key pixel points specifically includes:

[0021] If the iteration The fitness value determined by the iteration is greater than the fitness value corresponding to the individual optimal position recorded. The particle position determined this time updates the individual optimal position;

[0022] After all particles are updated to their individual optimal positions, a particle having a maximum fitness value and a particle position corresponding to the maximum fitness value is selected, and the particle position corresponding to the maximum fitness value is used to update the optimal position of the particle group;

[0023] After all particles are updated to their individual optimal positions, at least one target fitness value greater than a set threshold is selected, a target particle position corresponding to the target fitness value is determined, and the target particle position is determined as a key pixel point; wherein the target fitness value is less than or equal to the maximum fitness value;

[0024] The mask matrix of the key pixel points is obtained by binarizing the clean sample, and the mask matrix is ​​as follows:

[0025]

[0026] in, represents the mask matrix, represents the key pixel point, represents the row index of the key pixel in the clean sample, Indicates the column index of the key pixel in the clean sample.

[0027] Preferably, the key parameters for controlling the generation of the target image anti-disturbance are obtained by a PID controller according to the difference between the clean sample identification label and the target image identification label, specifically including:

[0028] The difference between the clean sample identification label and the target image identification label is expressed by the following formula:

[0029]

[0030] The key parameters for controlling the generation of the target image against disturbance are expressed by the following formula:

[0031]

[0032] in, represents the target image recognition label, represents the clean sample identification label, represents the key parameters controlling the generation of adversarial perturbations of the target image, , and Represents the three parameters of the PID controller, represents the proportional gain, represents the integral gain, represents the differential gain, express The difference between the clean sample identification label and the target image identification label at each moment, express The difference between the clean sample identification label and the target image identification label at each moment, express The difference between the clean sample identification label and the target image identification label at that moment.

[0033] Preferably, obtaining the tampered adversarial sample and the first identification label of the tampered adversarial sample according to the key parameter and the mask matrix specifically includes:

[0034] The tampered adversarial sample is as follows:

[0035]

[0036] The first identification label of the tampered adversarial sample is as follows:

[0037]

[0038] in, represents the tampered adversarial sample, represents a clean sample, represents the weight parameter controlling the generation of adversarial perturbations, represents the target image adversarial perturbation, , represents the mask matrix, represents the key parameters controlling the generation of adversarial perturbations of the target image, Represents limiting the perturbation weight to symbolic functions within the norm bound, , Indicates the first identification label of the tampered adversarial sample, represents a classifier of a deep neural network, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of Indicates the variable value that makes the function reach its maximum value.

[0039] Preferably, the anti-attack optimization model is as follows:

[0040] J(Δx)= min Δx { max [ f y m ( x adv )- max y w ≠y m f y w ( x adv ) ,0]+ε*sign(Δx)}

[0041] in, represents the targeted adversarial attack optimization model, represents the target image adversarial perturbation, represents the tampered adversarial sample, represents the target image recognition label, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of represents any identification label other than the target image identification label, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of represents the weight parameter controlling the generation of adversarial perturbations, Represents limiting the perturbation weight to symbolic functions within the norm bound, , Indicated in Based on The maximum value of max [ f y m ( x adv )- max y w ≠y m f y w ( x adv ) ,0] Indicates taking and The maximum value in Represents the optimal adversarial attack sample of the adversarial attack optimization model.

[0042] The embodiment of the present invention provides a pixel-guided black box attack device, comprising:

[0043] A first obtaining unit is used to obtain a clean sample, a clean sample identification label, a target image, and a target image identification label according to a deep neural network classifier;

[0044] A determination unit, used to determine the coordinates of the pixel points included in the clean sample as the particle position, determine the pixel value corresponding to the coordinates of the pixel points as the particle value, and update each particle position, determine the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points according to the adaptive particle swarm optimization APSO algorithm;

[0045] A second obtaining unit is used to obtain key parameters for controlling the generation of adversarial perturbations of the target image through a PID controller according to the difference between the clean sample identification label and the target image identification label, and obtain the tampered adversarial sample and the first identification label of the tampered adversarial sample according to the key parameters and the mask matrix;

[0046] The third obtaining unit is used to obtain an adversarial attack optimization model according to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image, and obtain the optimal adversarial attack sample of the adversarial attack optimization model according to a loop iterative algorithm.

[0047] An embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes any one of the above-mentioned pixel-guided black-box attack methods.

[0048] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes any one of the above-mentioned pixel-guided black-box attack methods.

[0049] The embodiment of the present invention provides a pixel-guided black-box attack method and device, which includes obtaining a clean sample, a clean sample identification label, a target image and a target image identification label according to a classifier of a deep neural network; determining the coordinates of the pixel points included in the clean sample as the particle position, determining the pixel value corresponding to the coordinates of the pixel points as the particle value, updating each particle position, determining the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points according to an adaptive particle swarm optimization APSO algorithm; obtaining key parameters for controlling the generation of adversarial disturbances of the target image through a PID controller according to the difference between the clean sample identification label and the target image identification label, obtaining a tampered adversarial sample and a tampered adversarial sample first identification label according to the key parameters and the mask matrix; obtaining an adversarial attack optimization model according to the difference between the tampered adversarial sample first identification label and the target image identification label; and obtaining the optimal adversarial attack sample of the adversarial attack optimization model according to a cyclic iteration algorithm. This method uses the APSO algorithm to determine the key pixels and the corresponding mask matrix, which can accurately and efficiently lock the pixels that have a significant impact on the attack, avoid operations on unnecessary pixels, and thus reduce the consumption of computing resources and improve the efficiency and success rate of the attack; at the same time, the determined mask matrix also provides a basis for the subsequent targeted generation of adversarial samples; the PID controller is used to obtain the key parameters for controlling the generation of adversarial perturbations of the target image according to the difference between the clean sample identification label and the target image identification label, which can achieve precise control of the adversarial perturbation generation process; combined with the previously obtained mask matrix to generate tampered adversarial samples, it can improve the concealment of adversarial samples while ensuring a certain attack success rate, making them more difficult to detect; the attack model can be continuously optimized to ensure that the adversarial samples with the best attack effect can be obtained, the stability and success rate of the attack strategy in practical applications can be improved, and it can adapt to different attack scenarios and targets. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of a black box attack method flow chart guided by a pixel point according to an embodiment of the present invention;

[0052] Figure 2 A schematic diagram of the structure of a pixel-guided black-box attack device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Terms involved in the embodiments of the present invention:

[0055] 1. The APSO (Adaptive Particle Swarm Optimization) algorithm is an improved swarm intelligence optimization algorithm. It is an improvement on the PSO (Particle Swarm Optimization) algorithm. The improvement measures include adaptive control algorithm parameters (inertia weight and acceleration factor). Taking bird foraging as an example, in the adaptive particle swarm optimization algorithm, each bird in the flock is called a "particle" and has speed and position like the bird. A certain number of particles are randomly generated as valid solutions to the problem search space, and then iterative search is performed. The fitness of the particles is determined by the fitness value function corresponding to the problem to obtain the optimization result.

[0056] 2. PID (proportional-integral-derivative control) controller, composed of proportional unit, integral unit and derivative unit, is a common feedback loop component in industrial control applications. The PID controller compares the collected data with a reference value, and then uses the difference to calculate a new input value, the purpose of which is to make the system data reach the reference value or remain at the reference value level.

[0057] 3. Mask Matrix is ​​a matrix widely used in deep learning and other fields. It is mainly used to selectively block or filter data. The elements in the mask matrix are usually 0 and 1, where 1 means that the corresponding element or position is "visible" or "valid", and 0 means that the corresponding element or position is "blocked" or "invalid".

[0058] Figure 1 A flowchart of a pixel-guided black box attack method provided by an embodiment of the present invention is as follows: Figure 1 Taking this as an example, a pixel-guided black-box attack method provided by an embodiment of the present invention is introduced.

[0059] like Figure 1As shown, the method provided by the embodiment of the present invention mainly includes the following steps:

[0060] Step 101, obtaining a clean sample, a clean sample identification label, a target image, and a target image identification label according to a deep neural network classifier;

[0061] Step 102, determining the coordinates of the first pixel point included in the clean sample as the particle position, determining the pixel value corresponding to the coordinates of the pixel point as the particle value, and updating each particle position, determining the fitness value of the particle, the key pixel point in the clean sample, and the mask matrix corresponding to the key pixel point according to the adaptive particle swarm optimization APSO algorithm;

[0062] Step 103, according to the difference between the clean sample identification label and the target image identification label, a key parameter for controlling the generation of the target image adversarial perturbation is obtained through a PID controller, and a tampered adversarial sample and a first identification label of the tampered adversarial sample are obtained according to the key parameter and the mask matrix;

[0063] Step 104, obtaining an adversarial attack optimization model according to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image; and obtaining an optimal adversarial attack sample of the adversarial attack optimization model according to a loop iterative algorithm.

[0064] Before step 101, you need to obtain the original image. You can select any image from the ImageNet dataset as the original image. Generally, the images in the dataset are converted to RGB (Red - Green - Blue, color mode) during processing, where the value range of each channel is 0-255, 0 means no brightness and the color is black, and 255 means the maximum brightness and the color is white. The original image is further standardized so that the pixel value of each channel of the original image is adjusted to [0,1] or [ - 1,1] In the embodiment of the present invention, the clean sample is as follows:

[0065]

[0066] in, represents a clean sample, represents the original image, Represents the mean value of each channel of the original image, Represents the standard deviation of each channel of the original image.

[0067] It should be noted that you can also select any image from other data sets for preprocessing to obtain clean samples. The ImageNet data set is just one of the many types of data, and there is no limitation on the specific types of other data sets here.

[0068] In step 101, the preprocessed data set including clean samples and the target image are input into the pre-trained deep neural network for image recognition. Specifically, the deep neural network randomly selects a pre-processed and trained clean sample from the data set, and can obtain the classification confidence vector results of all labels corresponding to the clean sample; the target image can also obtain its corresponding classification confidence vector results after passing through the deep neural network; further, the label corresponding to the maximum classification confidence is determined as the clean sample identification label and the target image identification label respectively.

[0069] In the embodiment of the present invention, the classification confidence vectors of all labels can be determined by the following formula (2), and the target image recognition label and the clean sample recognition label are shown in formula (3):

[0070]

[0071]

[0072] in, represents a deep neural network model, Represents the classification confidence vector result containing all labels output by the deep neural network. Labels and clean samples representing target images .

[0073] It should be noted that It represents the confidence vector of the deep neural network for classifying the sample image. Assuming the classification confidence vector is [0.1, 0.2, 0.3, 0.4, 0.6], Representation vector When the maximum element value in is 0.6, the corresponding index value is 3, that is, when hour, In practical applications, when the clean sample identification label is the same as the target image identification label, the target image needs to be reselected. For example, if the clean sample identification label is 128, then the target image identification label can be any positive integer except 128.

[0074] In step 102, APSO initialization includes creating particles and randomizing the particles, wherein the particle position is equivalent to the coordinates of the pixel points included in the clean sample, and the particle value is equivalent to the pixel value corresponding to the coordinates of the pixel points, that is, the coordinates of each pixel point included in the clean sample are determined as the particle position, and the pixel value corresponding to the coordinates of each pixel point is determined as the particle value.

[0075] Furthermore, the initial velocity of each particle is set, the individual optimal position of each particle can be set as the initial position of each particle, and the optimal position of the particle group can be temporarily set as the position of the first particle.

[0076] According to the APSO algorithm, the iteration cycle is set from Start and iterate until (Because the total number of iterations times). When , the inertia factor of the current iteration is updated according to the following formula, which can also be used to determine the inertia factor of iteration t:

[0077]

[0078] in, Represents iteration The inertia factor, represents the maximum value of the inertia factor, represents the minimum value of the inertia factor, represents the maximum number of algorithm iterations, represents the number of iterations of the algorithm, represents the size of the particle swarm, .

[0079] Furthermore, in the iteration times, it can be determined that each particle iteration The speed of the second time is determined by the following formula Particle iterations Speed ​​of times:

[0080]

[0081]

[0082]

[0083] in, Indicates Particle iterations The speed of Indicates Particle iterations The speed of Self-learning factor, represents the social learning factor, , Indicated in Random numbers in the interval, Indicates Particle iterations The best position of the second Indicates Particle iterations The second position, represents the optimal position of the particle swarm, Indicated in Random disturbances in the interval, represents the minimum value of self-learning, represents the maximum value of the self-learning factor, represents the minimum value of the social learning factor, Represents the maximum value of the social learning factor.

[0084] Furthermore, it is also possible to determine the The position of the second is updated according to the following formula Particle iterations Second position:

[0085]

[0086] in, Indicates Particle iterations The second position, Indicates Particle iterations The second position.

[0087] When determining the Particle iterations After the position of the first time, the fitness value of each particle can be determined, that is, the fitness value of the first time can be determined by the following formula: The fitness value of a particle.

[0088]

[0089] in, represents the particle fitness value, Indicates a clean sample Determined by a deep neural network classifier The recognition result of Represents the masked sample after the masked pixel Determined by a deep neural network classifier The recognition result of represents a clean sample, Indicates a clean sample The correct label, Represents the masked samples behind the masked pixels, Represents masked samples Identification tag, express Norm metric.

[0090] In practical applications, for each particle, after each fitness value is calculated, if the current fitness value is greater than the previously recorded individual optimal position The fitness value corresponding to the particle is used to update the individual optimal position with the position corresponding to the fitness value determined by the current particle. For current location .

[0091] After all particles have updated their individual optimal positions, compare the fitness values ​​corresponding to the current individual optimal positions of all particles, find the particle position corresponding to the largest fitness value, and use the particle position corresponding to the largest fitness value to update the optimal position of the particle swarm. In the embodiment of the present invention, after all iterations are completed Finally, according to the fitness values ​​calculated during the entire iteration process, find the particles (pixels) with larger fitness values. Usually, a threshold can be set, and the particles corresponding to the fitness values ​​greater than the threshold are determined as key pixels, and the position coordinates of the key pixels are recorded. These position coordinates are the pixel positions that have a greater impact on the target image category recognition results in the clean sample image.

[0092] It should be noted that, in the embodiment of the present invention, since different thresholds may need to be set for different clean samples, the specific value of the threshold is not limited here.

[0093] Furthermore, by binarizing the clean samples, we get the mask matrix corresponding to the key pixels:

[0094] (10)

[0095] in, represents the mask matrix, represents the key pixel point, represents the row index of the key pixel in the clean sample, Indicates the column index of the key pixel in the clean sample.

[0096] In order to more clearly introduce how to determine the key pixels in clean samples and the mask matrix corresponding to the key pixels according to the APSO algorithm, the following takes a clean sample dataset containing various animal images as an example to introduce how to find the key pixels in these images that have a greater impact on the animal category recognition results. The specific steps include:

[0097] Step 102-1, determine the parameter value by initialization setting, set the maximum value of the inertia factor , minimum ; Maximum number of algorithm iterations ; The size of the particle swarm , that is, there are currently 50 particles (representing 50 pixels to search); self-learning factor , social learning factor .

[0098] Step 102-2, create 50 particles, the position of each particle corresponds to the pixel coordinates in the clean sample, and the position of each particle is randomly initialized within the pixel coordinate range of the image. Pixel image, The position coordinates of the particles (Initial ) can be arrive Randomly generated between.

[0099] The particle value of each particle is determined based on the actual pixel value of the clean sample at that location. At the same time, the initial velocity of each particle is It is also randomly set within a reasonable range, such as [-5, 5] .

[0100] Initialize the individual optimal position of each particle To its initial position , the optimal position of the particle swarm Temporarily set the position of the first particle .

[0101] Step 102-3, from Start and iterate until (Because the total number of iterations Second-rate).

[0102] In each iteration When the iteration is determined according to formula (4) The inertia factor For example, when iterating 10 times, you can use , get the inertia factor after 10 iterations is 0.85.

[0103] For each particle , according to formula (5), determine each particle iteration For example, for a particle , in the iteration Second time , assuming , (the speed of the previous iteration), , (current individual optimal position), (Current Location), (the optimal position of the current particle swarm), , , , then you can , the coordinates are calculated here respectively and The coordinates are calculated similarly to the above formula. Assume that after calculation of The coordinate changes to , The coordinate changes to ,but .

[0104] Update the position of each particle according to formula (8) . Continue with the above particles For example, at the 6th iteration, .

[0105] Step 102-4, for each particle, after updating its position in each iteration, calculate its fitness value .

[0106] Suppose there is a deep neural network classifier, the input is an image sample, and the output is the animal category recognition result. , first obtain a clean sample (Original full image) Correct label obtained by the classifier (For example, "dog"), that is ; Then the pixel point corresponding to the particle position is added to the clean sample Medium occlusion (get occlusion samples ), and then obtain the masked samples through the classifier Identification tag (For example, after masking, it is identified as "cat"), that is .

[0107] According to the formula , calculate the fitness value. For example, suppose The corresponding vector is expressed as [0, 1, 0, 0, ⋯] (indicates the probability distribution of being identified as a "dog", etc.), The corresponding vector is expressed as [0, 0, 1, 0, ⋯] (indicates the probability distribution of being identified as a "cat", etc.), then by calculating The fitness value is obtained by using the norm measurement. The specific calculation method is to first calculate the vector difference [0 - 0, 1 - 0, 0 - 1, 0 - 0, ⋯] = [0, 1, -1, 0, ⋯] , then calculate its norm, assuming the value is , then the current fitness value of the particle is .

[0108] For each particle After each fitness value is calculated, if the current fitness value is greater than the previously recorded individual optimal position The corresponding fitness value is updated to the optimal position of the individual For current location For example, particles , in the iteration The current fitness value is ,Before The corresponding fitness value is , then update For current location After all particles have updated their individual optimal positions, compare the fitness values ​​corresponding to the current individual optimal positions of all particles, find the particle position corresponding to the largest fitness value, and update the optimal position of the particle group. For example, in the iteration When the fitness values ​​of all 50 particles are compared, the particle The fitness value corresponding to the individual optimal position is the largest, which is , then update For particles The individual optimal position.

[0109] Step 102-5, after all iterations are completed Finally, according to the fitness value calculated during the entire iteration process, find the particle (pixel) with the larger fitness value. Usually a threshold can be set, such as a fitness value greater than The pixels represented by the particles are regarded as key pixels. The position coordinates of these key pixels are recorded. These coordinates are the pixel positions that have a greater impact on the animal category recognition results in the clean sample image. For example, after screening, it is found that The fitness value of a particle is greater than , and their position coordinates are Etc., these are the coordinate positions of the determined key pixel points in the clean sample image. The mask matrix corresponding to the key pixel points is determined according to formula (10).

[0110] In step 103, the difference between the clean sample identification label and the target image identification label is determined by the following formula:

[0111]

[0112] in, express The difference between the clean sample identification label and the target image identification label at each moment, represents the target image recognition label, Represents the clean sample identification label.

[0113] Furthermore, the key parameters for controlling the generation of anti-disturbance of the target image are obtained through the PID controller, which are:

[0114]

[0115] in, represents the key parameters controlling the generation of adversarial perturbations of the target image, , and Represents the three parameters of the PID controller, represents the proportional gain, represents the integral gain, represents the differential gain, express The difference between the clean sample identification label and the target image identification label at each moment, express The difference between the clean sample identification label and the target image identification label at each moment, express The difference between the clean sample identification label and the target image identification label at that moment.

[0116] In an embodiment of the present invention, after determining the key parameters for controlling the generation of adversarial perturbations of the target image, it is necessary to obtain the tampered adversarial sample and the first identification label of the tampered adversarial sample according to the key parameters and the mask matrix, wherein the tampered adversarial sample is as follows:

[0117]

[0118]

[0119] The first identification label of the tampered adversarial sample is as follows:

[0120]

[0121]

[0122] in, represents the tampered adversarial sample, represents a clean sample, represents the weight parameter that controls the generation of the target image against the disturbance, represents the target image adversarial perturbation, Represents limiting the perturbation weight to symbolic functions within the norm bound, represents the mask matrix, represents the key parameters controlling the generation of adversarial perturbations of the target image, Indicates the first identification label of the tampered adversarial sample, represents a classifier of a deep neural network, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of Indicates the variable value that makes the function reach its maximum value.

[0123] In practical applications, it is necessary to set the threshold of the weight parameter required to generate the adversarial perturbation of the target image to ensure the subtlety of the adversarial perturbation of the target image and avoid excessive tampering of pixel values, which will affect the observability of the image and thus escape the detection of the human eye. In addition, the pixel value of each channel in the tampered adversarial sample needs to be kept within [0,1] or [-1,1] , avoiding excessive attacks and wasting computing power, thereby ensuring the effectiveness of the generated tampered adversarial samples. The constraints are as follows:

[0124]

[0125]

[0126] in, represents the weight parameters required to generate the target image against the perturbation, represents the threshold of the weight parameter, represents the tampered adversarial sample, represents the dimension of the tampered adversarial sample. It should be noted that, in the embodiment of the present invention, The value is usually 0.1.

[0127] In step 104, an adversarial attack optimization model is obtained according to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image; and an optimal adversarial attack sample of the adversarial attack optimization model is obtained according to a loop iterative algorithm.

[0128] Specifically, the difference between the first identification label of the tampered adversarial sample and the identification label of the target image is determined based on the following formula:

[0129]

[0130] in, represents the difference between the first identification label of the tampered adversarial sample and the identification label of the target image, represents the target image recognition label, Indicates the first identification label of the tampered adversarial sample.

[0131] Furthermore, the adversarial attack model is as follows:

[0132] J(Δx)= min Δx { max [ f y m ( x adv )- max y w ≠y m f y w x adv ,0]+ε*sign(Δx)}(20)

[0133] in, represents the targeted adversarial attack optimization model, represents the target image adversarial perturbation, represents the tampered adversarial sample, represents the target image recognition label, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of represents any identification label other than the target image identification label, Represents a tampered adversarial sample Determined by a deep neural network classifier The recognition result of represents the weight parameter controlling the generation of adversarial perturbations, Represents limiting the perturbation weight to symbolic functions within the norm bound, , Indicated in Based on The maximum value of max [ f y m ( x adv )- max y w ≠y m f y w ( x adv ) ,0] Indicates taking and The maximum value in Represents the optimal adversarial attack sample of the adversarial attack optimization model.

[0134] In the embodiment of the present invention, in order to obtain the optimal adversarial sample of the adversarial attack optimization model, the formula (20) can be solved and optimized through a loop iterative algorithm.

[0135] First initialize the maximum number of iterations Then, it is determined whether the difference between the first identification label of the tampered adversarial sample and the identification label of the target image is the same. If they are the same, that is, formula (20) satisfies , it indicates a successful target attack. On this basis, the solution is continuously iterated until the minimum value of the adversarial attack optimization model is obtained, and the optimal adversarial attack sample of the adversarial attack optimization model is obtained; if the difference between the first identification label of the tampered adversarial sample and the target image identification label is different, that is, , it means that the target attack is unsuccessful, and it is necessary to return to step 102, iterate through the APSO algorithm to determine the key pixel points in the current tampered adversarial sample, and then execute steps 103 and 104.

[0136] It should be noted that when re-executing step 103, it is no longer based on the difference between the clean sample identification label and the target image identification label, but needs to be based on the difference between the current tampered adversarial sample first identification label and the target image identification label, that is, the difference between the tampered adversarial sample first identification label and the target image identification label is determined according to formula (19), and the remaining steps are consistent with the previous content.

[0137] In an embodiment of the present invention, a pixel-guided black-box attack method and device are provided. The method uses the APSO algorithm to determine key pixels and corresponding mask matrices, and can accurately and efficiently lock pixels that have a significant impact on the attack, avoid operations on non-essential pixels, and thus reduce computing resource consumption, thereby improving the efficiency and success rate of the attack; at the same time, the determined mask matrix also provides a basis for the subsequent targeted generation of adversarial samples; the key parameters for controlling the generation of adversarial perturbations of the target image are obtained by a PID controller according to the difference between the clean sample identification label and the target image identification label, so as to achieve precise control of the adversarial perturbation generation process; the tampered adversarial sample is generated in combination with the mask matrix obtained previously, which can improve the concealment of the adversarial sample while ensuring a certain attack success rate, making it more difficult to detect; the attack model can be continuously optimized to ensure that the adversarial sample with the best attack effect can be obtained, the stability and success rate of the attack strategy in practical applications can be improved, and it can adapt to different attack scenarios and targets.

[0138] Based on the same inventive concept, an embodiment of the present invention provides a pixel-guided black-box attack device. Since the principle of solving the technical problem of the device is similar to that of a pixel-guided black-box attack method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0139] Figure 2 A schematic diagram of the structure of a pixel-guided black box attack device provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the device includes: a first obtaining unit 201, a determining unit 202, a second obtaining unit 203 and a third obtaining unit 204.

[0140] A first obtaining unit 201 is used to obtain a clean sample, a clean sample identification label, a target image and a target image identification label according to a deep neural network classifier;

[0141] A determination unit 202 is used to determine the coordinates of the pixel points included in the clean sample as the particle position, determine the pixel value corresponding to the coordinates of the pixel points as the particle value, and update each particle position, determine the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points according to the adaptive particle swarm optimization APSO algorithm;

[0142] A second obtaining unit 203 is used to obtain key parameters for controlling the generation of adversarial perturbations of the target image through a PID controller according to the difference between the clean sample identification label and the target image identification label, and obtain the tampered adversarial sample and the first identification label of the tampered adversarial sample according to the key parameters and the mask matrix;

[0143] The third obtaining unit 204 is used to obtain an adversarial attack optimization model according to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image; and obtain the optimal adversarial attack sample of the adversarial attack optimization model according to a loop iterative algorithm.

[0144] It should be understood that the units included in the above pixel-guided black-box attack device are only logical divisions based on the functions implemented by the device. In practical applications, the above units can be superimposed or split. In addition, the functions implemented by the pixel-guided black-box attack device provided in this embodiment correspond one-to-one to the pixel-guided black-box attack method provided in the above embodiment. The more detailed processing flow implemented by the device has been described in detail in the above method embodiment 1 and will not be described in detail here.

[0145] Another embodiment of the present invention also provides a computer device, which includes: a processor and a memory; the memory is used to store computer program code, and the computer program code includes computer instructions; when the processor executes the computer instructions, the electronic device executes each step of a pixel-guided black box attack method in the method flow described in the above method embodiment.

[0146] Another embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer device, the computer device executes each step of a pixel-guided black box attack method in the method flow described in the above method embodiment.

[0147] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0148] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A pixel-guided black-box attack method, characterized in that: include: According to the deep neural network classifier, clean samples, clean sample identification labels, target images and target image identification labels are obtained; The coordinates of the pixel points included in the clean sample are determined as the particle positions, and the pixel values ​​corresponding to the coordinates of the pixel points are determined as the particle values. According to the adaptive particle swarm optimization (APSO) algorithm, the position of each particle is updated, the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points are determined; According to the difference between the clean sample identification label and the target image identification label, a key parameter for controlling the generation of adversarial perturbation of the target image is obtained through a PID controller, and a tampered adversarial sample and a first identification label of the tampered adversarial sample are obtained according to the key parameter and the mask matrix; According to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image, an adversarial attack optimization model is obtained, and according to a cyclic iteration algorithm, an optimal adversarial attack sample of the adversarial attack optimization model is obtained; The determining of the key pixel points in the clean sample and the mask matrix corresponding to the key pixel points specifically includes: If the fitness value determined by iteration t times is greater than the fitness value corresponding to the recorded individual optimal position, the individual optimal position is updated with the particle position determined by iteration t times; After all particles are updated to their individual optimal positions, a particle having a maximum fitness value and a particle position corresponding to the maximum fitness value is selected, and the particle position corresponding to the maximum fitness value is used to update the optimal position of the particle group; After all particles are updated to their individual optimal positions, at least one target fitness value greater than a set threshold is selected, a target particle position corresponding to the target fitness value is determined, and the target particle position is determined as a key pixel point; wherein the target fitness value is less than or equal to the maximum fitness value; The mask matrix of the key pixel points is obtained by binarizing the clean sample, and the mask matrix is ​​as follows: The difference between the clean sample identification label and the target image identification label is expressed by the following formula: err k =and m -and The key parameters for controlling the generation of the target image against disturbance are expressed by the following formula: u k =K p ·(err k -err k-1 )+K i ·err k +K d ·(err k -2err k-1 +err k-2 ) The tampered adversarial sample is as follows: x adv =x+ε*sign(Δx) The first identification label of the tampered adversarial sample is as follows: The anti-attack optimization model is as follows: Where I represents the mask matrix, gBest represents the key pixel, RL represents the row index of the key pixel in the clean sample, CL represents the column index of the key pixel in the clean sample, and y m represents the target image recognition label, y represents the clean sample recognition label, and u k represents the key parameter controlling the generation of adversarial perturbations of the target image, K p , K i and K d Represents the three parameters of the PID controller, K p Represents proportional gain, K i Indicates the integral gain, K d represents the differential gain, err k represents the difference between the clean sample recognition label and the target image recognition label at time k, err k-1 represents the difference between the clean sample recognition label and the target image recognition label at k-1 time, err k-2 represents the difference between the clean sample recognition label and the target image recognition label at k-2 moments; x adv represents the tampered adversarial sample, x represents the clean sample, ε represents the weight parameter for controlling the generation of adversarial perturbations, Δx represents the adversarial perturbation of the target image, Δx = I·u k , sign(·) means limiting the perturbation weight to l ∞ symbolic functions within the norm bound, y adv represents the first identification label of the tampered adversarial sample, f represents the classifier of the deep neural network, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier adv The recognition result, argmax represents the variable value that makes the function reach the maximum value; J(Δx) represents the targeted adversarial attack optimization model, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier m The recognition result, y w represents any identification label other than the target image identification label, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier w The recognition result of Indicates that in y w ≠y m Based on The maximum value of Indicates taking and the maximum value of 0, Represents the optimal adversarial attack sample of the adversarial attack optimization model.

2. The method according to claim 1, characterized in that The updating of each particle position and determining the fitness value of the particle according to the adaptive particle swarm optimization APSO algorithm specifically includes: Set the maximum value of the inertia factor, the minimum value of the inertia factor, the maximum number of iterations, the size of the particle swarm corresponding to the clean sample, the self-learning factor and the social learning factor; When iterating t times, the inertia factor of iteration t is determined by the following formula according to the maximum value of the inertia factor, the minimum value of the inertia factor, and the maximum number of iterations: According to the inertia factor ω of iteration t t , the speed of the i-th particle after iteration t The optimal position of the i-th particle after t iterations The position of the i-th particle at iteration t The optimal position of the particle swarm gBest t And the random perturbation in the interval [-1,1] determines the speed of the i-th particle at iteration t+1: Update the position of each particle and determine the fitness value of the particle according to the following formula: fitness_value=||f y (x)-f y′ (x′)||2 Among them, ω t represents the inertia factor of iteration t, ω max represents the maximum value of the inertia factor, ω min Represents the minimum value of the inertia factor, t max represents the maximum number of algorithm iterations, t represents the number of algorithm iterations, i represents the size of the particle swarm, i = 1, 2, ..., n, represents the speed of the ith particle after iteration t, represents the speed of the ith particle iteration t+1 times, c1 represents the self-learning factor, c2 represents the social learning factor, r1 and r2 represent random numbers in the interval [0, 1]. represents the optimal position of the ith particle after t iterations, represents the position of the ith particle after iteration t, represents the position of the ith particle at iteration t+1, gBest t represents the optimal position of the particle swarm, represents random disturbance in the interval [-1, 1], fitness_value represents the fitness value of the particle, and f y (x) represents the recognition result of y determined by the clean sample x through the deep neural network classifier, f y′ (x′) represents the masked sample x′ after the masked pixel is determined by the deep neural network classifier to determine the recognition result y′, x represents the clean sample, y represents the correct label of the clean sample x, x′ represents the masked sample after the masked pixel, y′ represents the recognition label of the masked sample x′, and ||·||2 represents the l2 norm metric.

3. A pixel-guided black box attack device, characterized in that: include: A first obtaining unit is used to obtain a clean sample, a clean sample identification label, a target image, and a target image identification label according to a deep neural network classifier; A determination unit, used to determine the coordinates of the pixel points included in the clean sample as the particle position, determine the pixel value corresponding to the coordinates of the pixel points as the particle value, and update each particle position, determine the fitness value of the particle, the key pixel points in the clean sample, and the mask matrix corresponding to the key pixel points according to the adaptive particle swarm optimization APSO algorithm; A second obtaining unit is used to obtain key parameters for controlling the generation of adversarial perturbations of the target image through a PID controller according to the difference between the clean sample identification label and the target image identification label, and obtain the tampered adversarial sample and the first identification label of the tampered adversarial sample according to the key parameters and the mask matrix; A third obtaining unit is used to obtain an adversarial attack optimization model according to the difference between the first identification label of the tampered adversarial sample and the identification label of the target image, and obtain an optimal adversarial attack sample of the adversarial attack optimization model according to a cyclic iteration algorithm; The determining unit is specifically used for: If the fitness value determined by iteration t times is greater than the fitness value corresponding to the recorded individual optimal position, the individual optimal position is updated with the particle position determined by iteration t times; After all particles are updated to their individual optimal positions, a particle having a maximum fitness value and a particle position corresponding to the maximum fitness value is selected, and the particle position corresponding to the maximum fitness value is used to update the optimal position of the particle group; After all particles are updated to their individual optimal positions, at least one target fitness value greater than a set threshold is selected, a target particle position corresponding to the target fitness value is determined, and the target particle position is determined as a key pixel point; wherein the target fitness value is less than or equal to the maximum fitness value; The mask matrix of the key pixel points is obtained by binarizing the clean sample, and the mask matrix is ​​as follows: The difference between the clean sample identification label and the target image identification label is expressed by the following formula: err k =and m -and The key parameters for controlling the generation of the target image against disturbance are expressed by the following formula: u k =K p ·(err k -err k-1 )+K i ·err k +K d ·(err k -2err k-1 +err k-2 ) The tampered adversarial sample is as follows: x adv =x+ε*sign(Δx) The first identification label of the tampered adversarial sample is as follows: The anti-attack optimization model is as follows: Where I represents the mask matrix, gBest represents the key pixel, RL represents the row index of the key pixel in the clean sample, CL represents the column index of the key pixel in the clean sample, and y m represents the target image recognition label, y represents the clean sample recognition label, and u k represents the key parameter controlling the generation of adversarial perturbations of the target image, K p , K i and K d Represents the three parameters of the PID controller, K p Represents proportional gain, K i Indicates the integral gain, K d represents the differential gain, err k represents the difference between the clean sample recognition label and the target image recognition label at time k, err k-1 represents the difference between the clean sample recognition label and the target image recognition label at k-1 time, err k-2 represents the difference between the clean sample recognition label and the target image recognition label at k-2 moments; x adv represents the tampered adversarial sample, x represents the clean sample, ε represents the weight parameter for controlling the generation of adversarial perturbations, Δx represents the adversarial perturbation of the target image, Δx = I·u k , sign(·) means limiting the perturbation weight to l ∞ symbolic functions within the norm bound, y adv represents the first identification label of the tampered adversarial sample, f represents the classifier of the deep neural network, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier adv The recognition result, argmax represents the variable value that makes the function reach the maximum value; J(Δx) represents the targeted adversarial attack optimization model, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier m The recognition result, y w represents any identification label other than the target image identification label, Represents the tampered adversarial sample x adv Determine y through the deep neural network classifier w The recognition result of Indicates that in y w ≠y m Based on The maximum value of Indicates taking and the maximum value of 0, Represents the optimal adversarial attack sample of the adversarial attack optimization model.

4. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes a pixel-guided black-box attack method as described in any one of claims 1-2.

5. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, the processor executes a pixel-guided black-box attack method as described in any one of claims 1-2.

Images