Adversarial sample generation method and system based on AMADam

Abstract

The invention provides an AMADam-based adversarial sample generation method and system, and relates to the field of adversarial sample generation, and the specific scheme comprises the steps: preprocessing an obtained source image into an attacked image, and creating an all-zero tensor having the same shape as the attacked image; taking the all-zero tensor as initial disturbance, calculating an unbiased first moment and an unbiased second moment of the gradient by adopting an AMADam set momentum item method based on the gradient of the current disturbance in a loop iteration mode, generating new disturbance through the unbiased first moment and the unbiased second moment until the maximum iteration frequency is reached, and obtaining final disturbance; adding the final disturbance to an attacked image to generate an adversarial sample; according to the method, the AMADam algorithm is integrated into the gradient-based iterative attack, the unbiased first moment and the unbiased second moment of the gradient are used, disturbance is generated and updated for the attacked image, the adversarial sample is constructed, and the overall performance of the migration-based adversarial sample generation method is improved.

Description

Technical Field

[0001] The present invention belongs to the field of adversarial sample generation, and in particular to an adversarial sample generation method and system based on AMAdam. Background Art

[0002] In the field of modern artificial intelligence and machine learning, especially the widespread application of deep learning technology, adversarial sample generation technology has become an important research direction; adversarial samples refer to samples that are misclassified by deep learning models by adding small perturbations to the original data. This technology not only reveals the fragility of deep learning models, but also challenges the security and robustness of the models.

[0003] In the prior art, adversarial sample generation methods are mainly divided into two categories: white-box methods and black-box methods. White-box methods rely on a comprehensive understanding of the internal structure and parameters of the model, while black-box methods do not know the internal details of the model. Among them, the transfer-based adversarial sample generation method is a promising strategy in the black-box method. It generates adversarial samples on a known model (source model) and hopes that these samples will be equally effective on an unknown model (target model); this method takes advantage of the transferability between different models, thereby reducing the need for direct queries on the target model.

[0004] However, existing transfer-based adversarial sample generation methods still have many deficiencies and shortcomings:

[0005] (1) Existing methods have limited success in transferring adversarial samples between different models, resulting in unsatisfactory attack effects on the target model.

[0006] (2) Many methods require a large number of iterations and optimizations on the source model, resulting in low generation efficiency and difficulty in quickly generating effective adversarial samples.

[0007] (3) Existing adversarial sample generation methods are prone to fall into local optimality and are unable to find the global optimal solution, resulting in poor performance of the generated adversarial samples and unsatisfactory migration effects.

[0008] Therefore, the existing adversarial sample generation methods have low migration success rate, low generation efficiency, and local optimality problems. Summary of the invention

[0009] In order to overcome the above-mentioned deficiencies of the prior art, the present invention provides an adversarial sample generation method and system based on AMAdam to improve the overall performance of the transfer-based adversarial sample generation method.

[0010] To achieve the above objectives, one or more embodiments of the present invention provide the following technical solutions:

[0011] The first aspect of the present invention provides an adversarial sample generation method based on AMAdam.

[0012] The adversarial sample generation method based on AMAdam includes:

[0013] Preprocess the acquired source image into the attacked image, and create an all-zero tensor with the same shape as the attacked image;

[0014] The all-zero tensor is used as the initial perturbation. Based on the gradient of the current perturbation, the unbiased first-order moment and unbiased second-order moment of the gradient are calculated using the AMAdam collective momentum term method in a cyclic iterative manner. New perturbations are generated through the unbiased first-order moment and unbiased second-order moment until the maximum number of iterations is reached to obtain the final perturbation.

[0015] The final perturbation is added to the attacked image to generate adversarial samples.

[0016] Furthermore, the preprocessing of the acquired source image into the attacked image is to convert the source image into a tensor and normalize the pixel range of the source image to obtain the attacked image.

[0017] Furthermore, the specific steps of the loop iteration are as follows:

[0018] Add the current perturbation to the attacked image to obtain the perturbed image;

[0019] Classify the perturbed image, calculate the loss of the classification result, and obtain the gradient of the current perturbation relative to the loss;

[0020] The unbiased first-order moment and unbiased second-order moment of the gradient are calculated using the AMAdam collective momentum term method;

[0021] Generate new perturbations through unbiased first-order moments and unbiased second-order moments.

[0022] Furthermore, the image after adding disturbance is classified and the loss value of the classification result is calculated, specifically:

[0023] Input the perturbed image into the classification model to obtain the classification result;

[0024] Use the logit loss function to calculate the loss of the classification results.

[0025] Furthermore, the method of using the AMAdam collective momentum term to calculate the unbiased first-order moment and unbiased second-order moment of the gradient is specifically:

[0026] Using the momentum term technology, according to the accumulated perturbed gradient information, the velocity vector is accumulated along the gradient direction of the loss function to accelerate the gradient descent and obtain new gradient information;

[0027] The AMAdam algorithm is used to calculate the unbiased first-order moment and unbiased second-order moment of the gradient based on the new gradient information.

[0028] Furthermore, the unbiased first-order moment and unbiased second-order moment of the gradient are calculated according to the new gradient information, specifically:

[0029] The first-order moment of the current gradient is calculated based on the new gradient information and the first-order moment of the gradient accumulated in the previous iteration, and then the unbiased first-order moment of the gradient, the second-order moment of the gradient, and the unbiased second-order moment of the gradient are calculated.

[0030] Furthermore, the new disturbance is generated to support both non-target attack and targeted attack;

[0031] The non-targeted attack only needs to satisfy that the attacked image is no longer recognized as the original classification category;

[0032] The target attack must satisfy the requirement that the attacked image is no longer recognized as the original classification category and is recognized as the classification category specified in advance.

[0033] The second aspect of the present invention provides an adversarial sample generation system based on AMAdam.

[0034] The adversarial sample generation system based on AMAdam includes a preprocessing module, a perturbation generation module, and a sample generation module:

[0035] A preprocessing module, configured to: preprocess the acquired source image into an attacked image, and create an all-zero tensor with the same shape as the attacked image;

[0036] The perturbation generation module is configured to: use the all-zero tensor as the initial perturbation, adopt a cyclic iteration method, based on the gradient of the current perturbation, use the AMAdam collective momentum term method to calculate the unbiased first-order moment and unbiased second-order moment of the gradient, generate new perturbations through the unbiased first-order moment and unbiased second-order moment, until the maximum number of iterations is reached, and obtain the final perturbation;

[0037] The sample generation module is configured to add the final perturbation to the attacked image to generate adversarial samples.

[0038] The third aspect of the present invention provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps in the adversarial sample generation method based on AMAdam as described in the first aspect of the present invention.

[0039] The fourth aspect of the present invention provides an electronic device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the adversarial sample generation method based on AMAdam as described in the first aspect of the present invention are implemented.

[0040] One or more of the above technical solutions have the following beneficial effects:

[0041] The present invention integrates the AMAdam algorithm into the gradient-based iterative attack, adopts the AMAdam collective momentum term method, uses the unbiased first-order moment and unbiased second-order moment of the gradient to generate and update perturbations for the attacked image, constructs adversarial samples, and improves the overall performance of the migration-based adversarial sample generation method.

[0042] The present invention aims to prevent the algorithm from falling into a poor local optimum by improving the optimization algorithm, so that it can search for better adversarial samples; better adversarial samples not only have a stronger attack effect on the source model, but also have a stronger migration performance, and a higher attack success rate on the target model; through these improvements, the present invention greatly improves the overall performance of the adversarial sample generation method based on migration.

[0043] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0045] Figure 1 This is a flow chart of the method of the first embodiment.

[0046] Figure 2 This is a target attack experiment data diagram of the first embodiment.

[0047] Figure 3 This is a data diagram of the non-targeted attack experiment of the first embodiment. DETAILED DESCRIPTION

[0048] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0049] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0050] AMAdam (adaptive modifier of Adam method) is an innovative adaptive modified gradient descent optimization algorithm, which aims to overcome the challenges faced by traditional optimization methods in the field of artificial intelligence. The core contribution of AMAdam is the ability to dynamically adjust the learning rate according to subtle gradient changes, thereby accelerating the convergence of the optimization process. At the same time, it ensures robust stability and reliable and efficient convergence of the algorithm. The present invention uses it to optimize the gradient and then iteratively generate perturbations.

[0051] Embodiment 1

[0052] In one embodiment of the present disclosure, a method for generating adversarial samples based on AMAdam is provided, comprising the following steps:

[0053] Step S1: Preprocess the acquired source image into an attacked image and create an all-zero tensor with the same shape as the attacked image.

[0054] Furthermore, the preprocessing of the acquired source image into the attacked image is to convert the source image into a tensor and normalize the pixel range of the source image to obtain the attacked image.

[0055] Step S2: Use the all-zero tensor as the initial perturbation, and use a cyclic iterative method to calculate the unbiased first-order moment and unbiased second-order moment of the gradient based on the gradient of the current perturbation using the AMAdam collective momentum term method. Generate new perturbations through the unbiased first-order moment and unbiased second-order moment until the maximum number of iterations is reached to obtain the final perturbation.

[0056] Furthermore, the specific steps of the loop iteration are as follows:

[0057] Add the current perturbation to the attacked image to obtain the perturbed image;

[0058] Classify the perturbed image, calculate the loss of the classification result, and obtain the gradient of the current perturbation relative to the loss;

[0059] The unbiased first-order moment and unbiased second-order moment of the gradient are calculated using the AMAdam collective momentum term method;

[0060] Generate new perturbations through unbiased first-order moments and unbiased second-order moments.

[0061] Furthermore, the image after adding disturbance is classified and the loss value of the classification result is calculated, specifically:

[0062] Input the perturbed image into the classification model to obtain the classification result;

[0063] Use the logit loss function to calculate the loss of the classification results.

[0064] Furthermore, the method of using the AMAdam collective momentum term to calculate the unbiased first-order moment and unbiased second-order moment of the gradient is specifically:

[0065] Using the momentum term technology, according to the accumulated perturbed gradient information, the velocity vector is accumulated along the gradient direction of the loss function to accelerate the gradient descent and obtain new gradient information;

[0066] The AMAdam algorithm is used to calculate the unbiased first-order moment and unbiased second-order moment of the gradient based on the new gradient information.

[0067] Furthermore, the unbiased first-order moment and unbiased second-order moment of the gradient are calculated according to the new gradient information, specifically:

[0068] The first-order moment of the current gradient is calculated based on the new gradient information and the first-order moment of the gradient accumulated in the previous iteration, and then the unbiased first-order moment of the gradient, the second-order moment of the gradient, and the unbiased second-order moment of the gradient are calculated.

[0069] Furthermore, the new disturbance is generated to support both non-target attack and targeted attack;

[0070] The non-targeted attack only needs to satisfy that the attacked image is no longer recognized as the original classification category;

[0071] The target attack must satisfy the requirement that the attacked image is no longer recognized as the original classification category and is recognized as the classification category specified in advance.

[0072] Step S3: Add the final perturbation to the attacked image to generate adversarial samples.

[0073] As an embodiment, the specific implementation of the adversarial sample generation method based on AMAdam is as follows: Figure 1 As shown:

[0074] Step 1: Obtain an image, pre-process the image, and obtain the attacked image;

[0075] Preprocess the image, including:

[0076] The image is converted into a tensor, and the [0, 255] pixel range of the image is normalized or standardized to control the pixels within [0, 1] to obtain the attacked image.

[0077] Step 2: Create an all-zero tensor with the same shape as the attacked image as the initial perturbation;

[0078] An all-zero perturbation tensor is created, whose shape (size and number of channels) is the same as the attacked image, for the next perturbation iteration calculation.

[0079] Step 3: Set the initial parameter value for iterative calculation;

[0080] Initialize the gradient g 0 =0, parameter β 1 =0.74, first moment of gradient m 0 = 0, unbiased second moment of gradient Infinitesimal value∈=10 -8 .

[0081] Step 4: Input the perturbed image into the classification model to obtain the classification result, use the Logit loss function to calculate the classification loss value, and then call the back propagation method to calculate the gradient of the perturbation relative to the loss;

[0082] The perturbed image is input into the classification model, the classifier loss is calculated by the logit loss function, and then the perturbed gradient g is obtained. a ; Among them, the formula of logit loss function is:

[0083] The formula for non-targeted attack is:

[0084]

[0085] The target attack formula is:

[0086]

[0087] Among them, f() represents the classification model, x adv represents the adversarial sample generated in the iterative process, y true Represents the correct classification label of the source image, y t represents the target category misclassified by the adversarial sample misleading the classification model, e true 、e t Represents the Logit output of the correct category and the target category respectively.

[0088] Step 5: Use the momentum term method to integrate the momentum term into the attack process, accumulate the velocity vector along the gradient direction of the loss function to accelerate the gradient descent, and obtain new gradient information. The formula is:

[0089]

[0090] Where μ is the attenuation factor of the momentum term, g i The accumulated gradient for the previous iteration.

[0091] Step 6: Calculate the first-order moment of the current gradient based on the newly accumulated gradient information and the first-order moment of the gradient accumulated in the previous iteration. The formula is:

[0092] m i+1 =β 1 ·m i +(1-β 1 )·g i+1

[0093] Among them, m i+1 is the first-order moment of the current gradient, m i is the first-order moment of the cumulative gradient of the previous iteration, g i+1 is the newly accumulated gradient information.

[0094] Step 7: Calculate the unbiased first-order moment of the gradient based on the first-order moment of the current gradient. The formula is:

[0095]

[0096] in, is the unbiased first-order moment of the current gradient.

[0097] Step 8: Calculate the second-order moment of the gradient based on the unbiased first-order moment of the current gradient. The formula is:

[0098]

[0099] Among them, v i+1 is the unbiased second moment of the current gradient.

[0100] Step 9: Calculate the unbiased second-order moment of the current gradient based on the second-order moment of the current gradient and the unbiased second-order moment of the gradient accumulated in the previous iteration. The format is:

[0101]

[0102] in, is the unbiased second moment of the current gradient.

[0103] Step 10: Generate and update the perturbation of the attacked image based on the unbiased first-order moment and unbiased second-order moment of the gradient;

[0104] The AMAdam algorithm is integrated into the gradient-based iterative attack, called AI-FGSM. The unbiased first-order moment and unbiased second-order moment of the gradient are used to generate and update perturbations on the attacked image to construct adversarial samples. The gradient is updated using AI-FGSM, which is expressed as:

[0105]

[0106] Among them, L is the Logit loss function, represents the calculation of gradient, represents the adversarial sample, y true Indicates the correct classification label of the source image.

[0107] The method of generating non-target adversarial samples is as follows:

[0108]

[0109] The above method of generating adversarial samples is an untargeted attack. The attack effect of an untargeted attack only needs to satisfy that the attacked image is no longer recognized as the original correct classification label; the attack effect of a targeted attack needs to satisfy that the attacked image is no longer recognized as the original correct classification label, and is recognized as the classification category we specified in advance. The method of generating targeted adversarial samples is as follows, the formula is:

[0110]

[0111] Among them, L is the Logit loss function, represents the calculation of gradient, represents the adversarial sample, y true Represents the correct classification label of the source image, y t Indicates the target category that the adversarial sample misleads the classification model to misclassify.

[0112] Step 11: Determine whether the maximum number of iterations has been reached. If so, add perturbations to the attacked image to generate adversarial samples; if not, loop through steps 4 to 11.

[0113] Generate and update perturbations for the attacked image through image gradient information; determine whether the maximum number of iterations has been reached. If so, add perturbations to the attacked image to generate adversarial samples.

[0114] The method designed in this embodiment conducts a number of specific experiments using Restnet-50, Dense121, VGG16, and Inc-v3 as source models and target black box models. In the experiments, the effects of this embodiment are compared with the baseline method and the recently studied data enhancement ADI (Adjustment of diversified inputs) method. The results are as follows: Figure 2 shown.

[0115] In such Figure 2 The target attack experimental data shown in the figure indicate that, compared with the baseline method MI, the method of this embodiment has improved the target migration success rate of DI-TI-AI on the target black box model compared with DI-TI-MI, and the target migration success rate of ADI-TI-AI on the target black box model is also significantly improved compared with ADI-TI-MI.

[0116] In addition, specific experiments were also conducted using a 1,000-image dataset for untargeted black-box attacks. The experimental results are as follows: Figure 3 As shown, under the same number of iterations, the number of successful images using the method of this embodiment is generally better than that of the baseline method.

[0117] Embodiment 2

[0118] In one embodiment of the present disclosure, an adversarial sample generation system based on AMAdam is provided, including a preprocessing module, a perturbation generation module and a sample generation module:

[0119] A preprocessing module, configured to: preprocess the acquired source image into an attacked image, and create an all-zero tensor with the same shape as the attacked image;

[0120] The perturbation generation module is configured to: use the all-zero tensor as the initial perturbation, adopt a cyclic iteration method, based on the gradient of the current perturbation, use the AMAdam collective momentum term method to calculate the unbiased first-order moment and unbiased second-order moment of the gradient, generate new perturbations through the unbiased first-order moment and unbiased second-order moment, until the maximum number of iterations is reached, and obtain the final perturbation;

[0121] The sample generation module is configured to add the final perturbation to the attacked image to generate adversarial samples.

[0122] Embodiment 3

[0123] The purpose of this embodiment is to provide a computer-readable storage medium.

[0124] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the adversarial sample generation method based on AMAdam as described in the first embodiment of the present disclosure.

[0125] Embodiment 4

[0126] The purpose of this embodiment is to provide an electronic device.

[0127] An electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps in the adversarial sample generation method based on AMAdam as described in the first embodiment of the present disclosure are implemented.

[0128] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. The adversarial sample generation method based on AMAdam is characterized by: include: Preprocess the acquired source image into the attacked image, and create an all-zero tensor with the same shape as the attacked image; The all-zero tensor is used as the initial perturbation. Based on the gradient of the current perturbation, the unbiased first-order moment and unbiased second-order moment of the gradient are calculated using the AMAdam collective momentum term method in a cyclic iterative manner. New perturbations are generated through the unbiased first-order moment and unbiased second-order moment until the maximum number of iterations is reached to obtain the final perturbation. The final perturbation is added to the attacked image to generate adversarial samples.

2. The adversarial sample generation method based on AMAdam as claimed in claim 1, characterized in that: The preprocessing of the acquired source image into the attacked image is to convert the source image into a tensor and normalize the pixel range of the source image to obtain the attacked image.

3. The adversarial sample generation method based on AMAdam as claimed in claim 1, characterized in that: The specific steps of the loop iteration are as follows: Add the current perturbation to the attacked image to obtain the perturbed image; Classify the perturbed image, calculate the loss of the classification result, and obtain the gradient of the current perturbation relative to the loss; The unbiased first-order moment and unbiased second-order moment of the gradient are calculated using the AMAdam collective momentum term method; Generate new perturbations through unbiased first-order moments and unbiased second-order moments.

4. The adversarial sample generation method based on AMAdam as claimed in claim 3, characterized in that: The image after adding disturbance is classified and the loss value of the classification result is calculated, specifically: Input the perturbed image into the classification model to obtain the classification result; Use the logit loss function to calculate the loss of the classification results.

5. The adversarial sample generation method based on AMAdam as claimed in claim 3, characterized in that: The method of using the AMAdam collective momentum term to calculate the unbiased first-order moment and unbiased second-order moment of the gradient is specifically: Using the momentum term technology, according to the accumulated perturbed gradient information, the velocity vector is accumulated along the gradient direction of the loss function to accelerate the gradient descent and obtain new gradient information; The AMAdam algorithm is used to calculate the unbiased first-order moment and unbiased second-order moment of the gradient based on the new gradient information.

6. The adversarial sample generation method based on AMAdam as claimed in claim 5, characterized in that: The unbiased first-order moment and unbiased second-order moment of the gradient are calculated according to the new gradient information, specifically: The first-order moment of the current gradient is calculated based on the new gradient information and the first-order moment of the gradient accumulated in the previous iteration, and then the unbiased first-order moment of the gradient, the second-order moment of the gradient, and the unbiased second-order moment of the gradient are calculated.

7. The adversarial sample generation method based on AMAdam as claimed in claim 1, characterized in that: It also includes that the new disturbance is generated to support both non-target attack and target attack; The non-targeted attack only needs to satisfy that the attacked image is no longer recognized as the original classification category; The target attack must satisfy the requirement that the attacked image is no longer recognized as the original classification category and is recognized as the classification category specified in advance.

8. The adversarial sample generation system based on AMAdam is characterized by: Including preprocessing module, perturbation generation module and sample generation module: A preprocessing module, configured to: preprocess the acquired source image into an attacked image, and create an all-zero tensor with the same shape as the attacked image; The perturbation generation module is configured to: use the all-zero tensor as the initial perturbation, adopt a cyclic iteration method, based on the gradient of the current perturbation, use the AMAdam collective momentum term method to calculate the unbiased first-order moment and unbiased second-order moment of the gradient, generate new perturbations through the unbiased first-order moment and unbiased second-order moment, until the maximum number of iterations is reached, and obtain the final perturbation; The sample generation module is configured to add the final perturbation to the attacked image to generate adversarial samples.

9. An electronic device, comprising: a memory for non-transitory storage of computer readable instructions; a processor for executing the computer-readable instructions; Wherein, when the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is executed.

10. A storage medium, characterized in that: The computer-readable instructions are non-transitorily stored, wherein when the computer-readable instructions are executed by a computer, the method of any one of claims 1 to 7 is performed.

Images