Adversarial sample generation method based on dynamic heterogeneous redundant architecture, product, equipment and medium

Abstract

The invention discloses an adversarial sample generation method and product based on a dynamic heterogeneous redundant architecture. And disturbance preheating is performed on the input disturbance radius to obtain the disturbance radius, so that sparse degradation of the adversarial sample is avoided, and training collapse caused by too small disturbance radius is effectively prevented. And inputting the disturbance radius and the original picture sample into a generator to obtain a sparse disturbance confrontation sample. And inputting the sparse disturbance adversarial sample into a plurality of target models of different types, and creating an adversarial sample which is more effective for different models, namely model output data. The generator is iteratively trained on the basis of model output data, a high-applicability adversarial sample generator is finally obtained, adversarial samples enabling various victim models to be subjected to error prediction can be generated, and therefore generalization and transfer to any inaccessible victim model are more likely to be achieved in use.

Description

Technical Field

[0001] The present application relates to the field of anti-attack technology, and in particular to an adversarial sample generation method, product, device and medium based on a dynamic heterogeneous redundant architecture. Background Art

[0002] Deep Neural Network (DNN) has excellent performance in various computer vision tasks due to its powerful performance, but it always faces many security issues. Adversarial attacks are a major threat to the robustness and reliability of deep learning models. Among them, adding perturbations that are difficult for the human eye to detect to clean samples can generate adversarial samples, which are destructive to the decision-making process of deep neural networks, causing model prediction distortion, and reducing the stability and security of deep neural network models.

[0003] In the prior art, there are sparse adversarial attack methods that deceive deep neural networks by perturbing only a few pixels in the sample. Its characteristic is that it uses the L0 norm as a constraint to minimize the number of perturbed pixels, so it is not easy to detect, more threatening and practical. However, the existing sparse adversarial attack methods are overly dependent on the gradient or data distribution of a single target model when performing black box attacks, so they have low applicability. Therefore, there is an urgent need for a highly applicable adversarial sample generation method to generate adversarial samples that can be applied to various models. Summary of the invention

[0004] Based on the above problems, the present application provides an adversarial sample generation method, product, device and medium based on a dynamic heterogeneous redundant architecture, so as to provide a highly transferable adversarial sample generation method, thereby generating adversarial samples that can be applied to various models.

[0005] The present application discloses a method for generating adversarial samples based on a dynamic heterogeneous redundant architecture, the method comprising:

[0006] Based on the preset minimum radius, the input disturbance radius is preheated to obtain the disturbance radius;

[0007] Inputting the perturbation radius and the original image sample into the generator to obtain a sparse perturbation adversarial sample;

[0008] Inputting the sparse perturbation adversarial sample into a target model to obtain model output data; the target model is a plurality of models of different types;

[0009] Iteratively training the generator based on the model output data until the generator meets a preset goal, and obtaining the generator as an adversarial sample generator;

[0010] The target original image sample is input into the adversarial sample generator to obtain an adversarial sample to perform an adversarial attack.

[0011] Optionally, preheating the input disturbance radius based on a preset minimum radius includes:

[0012] Increasing the original disturbance radius according to the disturbance requirement to obtain the input disturbance radius;

[0013] Determining whether the input disturbance radius is not greater than the preset minimum radius;

[0014] If yes, preheating the disturbance is performed on the input disturbance radius;

[0015] If not, the input perturbation radius is not processed.

[0016] Optionally, the performing disturbance preheating on the input disturbance radius includes:

[0017] The iterative formula of the disturbance preheating is:

[0018] ∈ wu =∈+max((ω-epoch) / 255,0)

[0019] In the formula, ∈ wu is the disturbance radius after the disturbance preheating, ∈ is the input disturbance radius, ω is the preheating parameter, and epoch is the number of iterations.

[0020] Optionally, inputting the perturbation radius and the original image sample into a generator to obtain a sparse perturbation adversarial sample includes:

[0021] Using the perturbation radius and the original image sample as input data of the generator to obtain dense adversarial perturbation and perturbation mask;

[0022] The dense adversarial perturbation is element-wise multiplied by the perturbation mask to obtain the sparse perturbation adversarial sample.

[0023] Optionally, the iterative training of the generator based on the model output data includes:

[0024] Calculating the loss based on the model output data; the loss includes weight-balanced integrated adversarial loss, sparse loss, sparse quantization loss and gradient perturbation regularization loss;

[0025] The generator is iteratively trained based on the loss.

[0026] Optionally, the iterative training of the generator based on the loss includes:

[0027] The generator is iteratively trained by an iterative training loss function; the formula of the iterative training loss function is:

[0028]

[0029] Where, L overall is the iterative training loss function, is the weighted balanced integrated adversarial loss, L spa is the sparse loss, L qua is the sparse quantization loss, L gard is the gradient perturbation regularization loss, μ s , μ q and μ g is a hyperparameter;

[0030] μ s Used to control the sparsity of the output data of the model;

[0031] μ q Used to reduce the difference between the target model in the training phase and the use phase;

[0032] μ g Used to enable the generator to obtain diversified information from gradient perturbations.

[0033] Optionally, the formula for the weighted balanced integrated adversarial loss is:

[0034]

[0035] Where n is the number of target models, β d is the weight associated with the d-th target model, is the adversarial loss of the d-th target model in the CW attack.

[0036] Optionally, the formula for the gradient perturbation regularization loss is:

[0037] L gard =||x adv -x FGSM ||2

[0038] Where, L gard is the gradient perturbation regularization loss, x adv is the sparse perturbation adversarial sample, x FGSM Adversarial examples generated using the fast gradient sign method.

[0039] Optionally, the method further includes:

[0040] For μ s Preheating is performed; the preheating formula is:

[0041]

[0042] In the formula, μ s >0 means is the sparse hyperparameter of the initial value, represents the maximum sparsity hyperparameter, ξ is the sparsity against perturbations, ξ min is the expected sparsity and epoch is the number of iterations.

[0043] Based on the above-mentioned adversarial sample generation method based on dynamic heterogeneous redundant architecture, the present application also discloses an adversarial sample generation device, including: a preheating unit, a generation unit, an acquisition unit, a training unit and an execution unit;

[0044] The preheating unit is used to perform disturbance preheating on the input disturbance radius based on a preset minimum radius to obtain the disturbance radius;

[0045] The generating unit is used to input the perturbation radius and the original picture sample into the generator to obtain a sparse perturbation adversarial sample;

[0046] The acquisition unit is used to input the sparse perturbation adversarial sample into a target model to obtain model output data; the target model is a plurality of models of different types;

[0047] The training unit is used to iteratively train the generator based on the model output data until the generator meets a preset goal, and obtain the generator as an adversarial sample generator;

[0048] The execution unit is used to input the target original image sample into the adversarial sample generator to obtain the adversarial sample to perform the adversarial attack.

[0049] Optionally, the preheating unit comprises:

[0050] A preprocessing subunit, used for increasing the original disturbance radius according to the disturbance demand to obtain the input disturbance radius;

[0051] A judging subunit, used to judge whether the input disturbance radius is not greater than the preset minimum radius;

[0052] Also used for performing disturbance preheating on the input disturbance radius;

[0053] Also used to not process the input perturbation radius.

[0054] Optionally, the preheating unit is used to:

[0055] The iterative formula of the disturbance preheating is:

[0056] ∈ wu=∈+max((ω-epoch) / 255,0)

[0057] In the formula, ∈ wu is the disturbance radius after the disturbance preheating, ∈ is the input disturbance radius, ω is the preheating parameter, and epoch is the number of iterations.

[0058] Optionally, the generating unit includes:

[0059] An input subunit, configured to use the perturbation radius and the original image sample as input data of the generator to obtain a dense adversarial perturbation and a perturbation mask;

[0060] An acquisition subunit is used to perform element-by-element multiplication of the dense adversarial perturbation and the perturbation mask to obtain the sparse perturbation adversarial sample.

[0061] Optionally, the training unit includes:

[0062] A computing subunit, configured to calculate a loss based on the model output data; the loss includes a weight-balanced integrated adversarial loss, a sparse loss, a sparse quantization loss, and a gradient perturbation regularization loss;

[0063] A training subunit is used to iteratively train the generator based on the loss.

[0064] Optionally, the training subunit is used to:

[0065] The generator is iteratively trained by an iterative training loss function; the formula of the iterative training loss function is:

[0066]

[0067] Where, L overall is the iterative training loss function, is the weighted balanced integrated adversarial loss, L spa is the sparse loss, L qua is the sparse quantization loss, L gard is the gradient perturbation regularization loss, μ s , μ q and μ g is a hyperparameter;

[0068] μ s Used to control the sparsity of the output data of the model;

[0069] μ q Used to reduce the difference between the target model in the training phase and the use phase;

[0070] μ gUsed to enable the generator to obtain diversified information from gradient perturbations.

[0071] Optionally, the formula for the weighted balanced integrated adversarial loss is:

[0072]

[0073] Where n is the number of target models, β d is the weight associated with the d-th target model, is the adversarial loss of the d-th target model in the CW attack.

[0074] Optionally, the formula for the gradient perturbation regularization loss is:

[0075] L gard =||x adv -x FGSM ||2

[0076] Where, L gard is the gradient perturbation regularization loss, x adv is the sparse perturbation adversarial sample, x FGSM Adversarial examples generated using the fast gradient sign method.

[0077] Optionally, the device further comprises:

[0078] Parameter preheating unit, used to adjust μ s Preheating is performed; the preheating formula is:

[0079]

[0080] In the formula, μ s >0 means is the sparse hyperparameter of the initial value, represents the maximum sparsity hyperparameter, ξ is the sparsity against perturbations, ξ min is the expected sparsity and epoch is the number of iterations.

[0081] Based on the above-mentioned adversarial sample generation method based on a dynamic heterogeneous redundant architecture, the present application also discloses a computer program product, including a computer program, which implements the steps of the above-mentioned method when executed by a processor.

[0082] Based on the above-mentioned adversarial sample generation method based on a dynamic heterogeneous redundant architecture, the present application also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the steps of the above-mentioned method in the claim when executing the computer program.

[0083] Based on the above-mentioned adversarial sample generation method based on dynamic heterogeneous redundant architecture, the present application also discloses a computer storage medium on which computer program instructions are stored, characterized in that the steps of the above-mentioned method are implemented when the computer program instructions are executed by a processor.

[0084] The present application discloses a method, product, device and storage medium for generating adversarial samples based on a dynamic heterogeneous redundant architecture. The input perturbation radius is preheated to obtain the perturbation radius to avoid sparse degradation of the adversarial sample and effectively prevent training collapse caused by too small a perturbation radius. The perturbation radius and the original image sample are input into the generator to obtain a sparse perturbation adversarial sample. The sparse perturbation adversarial sample is input into multiple target models of different types to create more effective adversarial samples for different models, i.e., model output data. The generator is iteratively trained based on the model output data to eventually obtain a highly applicable adversarial sample generator that can generate adversarial samples that cause multiple victim models to make incorrect predictions, thereby making it more likely to generalize and transfer to any inaccessible victim model during use. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0086] Figure 1a A flowchart of a method for generating adversarial samples based on a dynamic heterogeneous redundant architecture disclosed in an embodiment of the present application;

[0087] Figure 1b A schematic diagram of the training process of the generator disclosed in the embodiment of the present application;

[0088] Figure 1c A schematic diagram of the anti-attack results disclosed in the embodiments of the present application;

[0089] Figure 2 A flowchart of another adversarial sample generation method based on a dynamic heterogeneous redundant architecture disclosed in an embodiment of the present application;

[0090] Figure 3 A schematic diagram of the structure of an adversarial sample generation device disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0091] Existing sparse adversarial attack methods perform well in white-box settings, but have problems such as insufficient attack success rate and limited attack range in black-box settings. In addition, in the sample generation process, there is a possibility that sparse perturbations quickly turn into dense perturbations under a small attack radius. Therefore, improving the attack success rate of adversarial attacks in black-box environments and increasing the attack range are very interesting topics in related fields.

[0092] In order to solve the defects of the above-mentioned prior art, this application proposes a highly transferable sparse adversarial attack method that includes three key technologies: perturbation preheating, gradient perturbation regularization, and loss balance. These key technologies can increase the success rate of the attack at a lower visual perturbation cost, balance the impact of different target models, and avoid the transformation of sparse perturbations into dense perturbations at a smaller attack radius.

[0093] At the same time, the method described in this application generates adversarial samples using the model output data distribution of the target model in an end-to-end manner, and increases the diversity of adversarial samples with the help of gradient information. There are also traditional adversarial attack methods based on dynamic heterogeneous redundant architectures in the prior art, which require that each pixel in the sample be perturbed to achieve the attack. Therefore, the method described in this application improves the efficiency of generating adversarial samples compared to traditional attack methods based on dynamic heterogeneous redundant architectures. And its end-to-end advantages can be easily extended to various intensive prediction tasks, such as object detection, semantic segmentation and other tasks, which will contribute to further research on the robustness of deep learning and the inherent security of artificial intelligence.

[0094] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0095] Embodiment 1: This application discloses a method for generating adversarial samples based on a dynamic heterogeneous redundant architecture.

[0096] For details, please refer to Figure 1a , a method for generating adversarial samples based on a dynamic heterogeneous redundant architecture disclosed in this embodiment includes the following steps:

[0097] Step 101: Based on a preset minimum radius, preheat the disturbance on the input disturbance radius to obtain the disturbance radius.

[0098] In the sparse adversarial attack method, the use of a smaller perturbation radius will cause the generator to crash during the training process, which can be specifically manifested as the initial sparse perturbation quickly degenerating into a dense perturbation within just a few cycles. When the perturbation radius is very small, it is somewhat difficult for the generator to optimize both the adversarial strength and the sparsity at the same time. Therefore, in the method described in this embodiment, the original perturbation radius is first increased according to the perturbation requirement to obtain the input perturbation radius. Among them, the perturbation requirement can be set according to different data sets and different perturbation intensities. Subsequently, it is determined whether the input perturbation radius is not greater than the preset minimum radius. If so, the input perturbation radius is preheated for perturbation. If not, the input perturbation radius is not processed. Among them, the preset minimum radius can also be set according to different data sets and different perturbation intensities.

[0099] For example, when the original disturbance radius is 10 and the preset minimum radius is 15, after the original disturbance radius is increased to 15 according to the disturbance demand, it is not greater than the preset minimum radius, that is, disturbance preheating is required. When the original disturbance radius is 10 and the preset minimum radius is 15, after the original disturbance radius is increased to 20 according to the disturbance demand, it is greater than the preset minimum radius, that is, disturbance preheating is not required.

[0100] As an optional method, disturbance preheating can be performed according to the following formula. The iterative formula of disturbance preheating is:

[0101] ∈ wu =∈+max((ω-epoch) / 255,0) (1)

[0102] In the formula, ∈ wu is the disturbance radius after disturbance preheating, ∈ is the input disturbance radius, ω is the preheating parameter, and epoch is the number of iterations.

[0103] As training progresses, the warm-up parameter gradually reduces the perturbation radius to a value equal to the original perturbation radius, so as to obtain the desired sparsity in the end while maintaining the stability of the optimization process. The method described in this embodiment can help the generator to optimize stably, and can generate an arbitrarily small perturbation radius to ensure that it is invisible to humans, thereby avoiding the sparse degradation problem of adversarial samples.

[0104] Step 102: Input the perturbation radius and the original image sample into the generator to obtain a sparse perturbation adversarial sample.

[0105] In the method described in this embodiment, the perturbation radius and the original image sample are used as input data of the generator to obtain dense adversarial perturbation and perturbation mask. Then, the dense adversarial perturbation and the perturbation mask are element-wise multiplied to obtain a sparse perturbation adversarial sample.

[0106] Step 103: Input the sparse perturbation adversarial sample into the target model to obtain model output data.

[0107] In the method described in this embodiment, the target model is multiple models of different types (architectures), such as ResNet50, ResNet152 and DenseNet121, etc., where ResNet represents a residual network, DenseNet represents a dense network, and the numbers "50", "152" and "121" represent the number of convolutional layers.

[0108] Step 104: Iteratively train the generator based on the model output data until the generator meets a preset goal, and obtain the generator as an adversarial sample generator.

[0109] In the method described in this embodiment, in order to make all target models make wrong predictions, the generator generates adversarial samples that are transferable, easy to generalize and transfer. This embodiment calculates the loss based on the model output data, and iteratively trains the generator based on the loss. Among them, the loss includes weight-balanced integrated adversarial loss, sparse loss, sparse quantization loss and gradient perturbation regularization loss. As an optional method, the generator is iteratively trained by iterative training loss function. The formula of the iterative training loss function is:

[0110]

[0111] Where, L overall is the iterative training loss function, To balance the weights of the integrated adversarial loss, L spa is the sparse loss, L qua is the sparse quantization loss, L gard is the gradient perturbation regularization loss, μ s , μ q and μ g is a hyperparameter.

[0112] Among them, μ s Used to control the sparsity of the model output data. In order to optimize the decoder by using the continuous value during back propagation in the training phase and quantize it to generate the mask in the attack phase, this embodiment adopts μ q Reduce the difference between the target model in the training phase and the use phase, μ g It is used to enable the generator to obtain diversified information from the gradient perturbation, which can be specifically adopted only in the first half of the training.

[0113] In the method described in this embodiment, μ s needs to be repeatedly tuned to achieve the desired sparsity level while maintaining sufficient attack performance. s This will lead to a decrease in the attack success rate or even training crash, while a too small μ sThis will result in poor sparsity against perturbations. s As an optional method, this embodiment adjusts μ s For preheating, the formula is:

[0114]

[0115] In the formula, μ s >0 means is the sparse hyperparameter of the initial value, represents the maximum sparsity hyperparameter, ξ is the sparsity against perturbations, ξ min is the expected sparsity.

[0116] In this way, μ s Start with a small value and gradually increase it in the next few training cycles until the generated adversarial samples meet the desired sparsity. This can help the generator explore a range of sparsity levels and effectively adjust the optimization strategy, gradually enabling the generator to converge to the optimal point of the loss situation, thereby finding a balance between sparsity and attack success rate. Specifically, as the training progresses in the warm-up phase, μ s Increases steadily, encouraging the generator to prioritize sparsity.

[0117] In the method described in this embodiment, the goal of inputting sparse perturbation adversarial samples into each target model for integrated attack is to use multiple target models to create more effective adversarial samples to complete the attack. In order to ensure that in each training round, the generator maximizes the probability that the adversarial sample is misclassified as an incorrect label, as an optional method, the loss function proposed in the CW (attack method proposed by Carlini & Wagner) attack can be used to train the generator. The formula of the loss function is:

[0118]

[0119] In the formula, is the adversarial loss of the dth target model in the CW attack, x adv is a sparse perturbation adversarial sample, i is the number of sparse perturbation adversarial samples, j is the jth sparse perturbation adversarial sample, and k is the attack intensity.

[0120] In the method described in this embodiment, different target models exhibit different robustness, and the differences therein will pose a challenge to the training of the generator. Because different target models will exert different optimization effects, the attack strength of the adversarial samples will be reduced, making the performance of the adversarial samples uneven. Specifically, the adversarial samples obtained by the generator have a higher attack success rate for a specific subset of models, while having a poorer adversarial effect on other models. Therefore, in order to make the performance of the adversarial samples generated by the generator on different models more balanced, the method described in this embodiment proposes a weighted balanced integrated adversarial loss.

[0121] As an alternative approach, the weight-balanced ensemble adversarial loss is formulated as:

[0122]

[0123] Where n is the number of target models, β d is the weight associated with the dth target model.

[0124] This method can improve the overall effectiveness against all models and alleviate the attack imbalance problem. d It is used to balance the impact of adversarial samples on each target model in the set. The calculation formula is as follows:

[0125]

[0126] Where x is the original image sample and y is the sample label.

[0127] In the method described in this embodiment, the weight balancing loss method can be to assign appropriate weights to each target model according to its robustness. Models with better robustness and more attack challenges will be assigned higher weights, that is, the robustness of the model is proportional to the weight assigned to it.

[0128] In the method described in this embodiment, in order to control the sparsity of adversarial samples, a sparse loss is used to train the generator. As an optional method, the formula of the sparse loss is:

[0129] L spa =||x adv -x||1 (7)

[0130] Where, L spa is the sparse loss.

[0131] In the method described in this embodiment, the adversarial perturbation of the adversarial sample generated by the sparse adversarial attack needs to be as sparse as possible, and the generator will output dense perturbations and sparse masks at the same time. Among them, the sparse mask is a matrix containing only 0 and 1, which is used to determine which perturbed pixels in the dense perturbation need to be retained, so as to achieve the purpose of sparse perturbation. In order to make the sparse masks generated by the generator as close as possible during the training and actual use stages, the generator is trained using sparse quantization loss. As an optional method, the formula for sparse quantization loss is:

[0132] L qua =||ψ binary -ψ||2 (8)

[0133] Where, L qua is the sparse quantization loss, ψ binary is the perturbation mask after binarization, and ψ is the continuous-valued perturbation mask.

[0134] In the deployment phase after training, the sparse mask needs to be binarized to generate a real sparse perturbation, that is, to make the perturbation sparse. The continuous value perturbation mask is used to ensure that the gradient can be calculated during the training phase and then back propagated.

[0135] In the method described in this embodiment, in order to increase the attack strength of sparse attacks by increasing the diversity of perturbations and overcome the problems of weak transferability or attack degradation, a gradient attack is used to regularize the generator. The key to gradient perturbation regularization is to use gradient-based perturbations to increase the strength of adversarial attacks. This method ensures that the generator can learn more robust and more transferable features when generating adversarial samples. As an optional method, in each training period of the generator, the adversarial samples generated by the generator should be close to the adversarial samples generated by the fast gradient sign method. This embodiment uses the L2 norm for quantization. Specifically, the formula for the gradient perturbation regularization loss can be:

[0136] L gard =||x adv -x FGSM ||2 (9)

[0137] Where, L gard is the gradient perturbation regularization loss, x adv is a sparse perturbation adversarial sample, x FGSM Adversarial examples generated using the fast gradient sign method.

[0138] As an optional method, since gradient perturbation regularization is used in each training round, the sparse perturbations obtained by the generator will degenerate into dense perturbations. Therefore, the gradient perturbation regularization method can be used only in the first half of the training rounds.

[0139] Among them, the formula for the adversarial sample generated by the fast gradient sign method is:

[0140]

[0141] Where ∈ is the input disturbance radius, L d (f(x, θ), y) is the cross entropy loss of the d-th target model, is the Hamiltonian operator, and θ is the parameter of the generator.

[0142] In the method described in this embodiment, the use of gradient-based adversarial attacks, such as projected gradient descent PGD (Projected Gradient Descent) attack and momentum iterative fast gradient sign method MI-FGSM (Momentum Iterative Fast Gradient Sign Method), can further improve the performance of the generator in this embodiment. However, these methods require multiple back-propagation iterations, which increases the training time. In order to strike a balance between training time and attack effect, this embodiment selects the fast gradient sign method FGSM (Fast Gradient Sign Method) to obtain the gradient perturbation regularization loss. Among them, the training process of the generator can be specifically as follows: Figure 1b shown.

[0143] Step 105: Input the target original image sample into the adversarial sample generator to obtain an adversarial sample to perform an adversarial attack.

[0144] In the method described in this embodiment, after the training is completed, a clean example, that is, the target original image, is input into the trained generator to obtain an adversarial sample in an end-to-end manner for performing an adversarial attack.

[0145] The method described in this embodiment performs perturbation preheating on the input perturbation radius to avoid sparse degradation of adversarial samples and effectively prevent training collapse caused by too small perturbation radius. And by inputting sparse perturbation adversarial samples into multiple target models of different types, more effective adversarial samples for different models are created, that is, model output data, and the generator is iteratively trained based on the model output data. The method described in this embodiment can obtain a highly applicable adversarial sample generator, which can make adversarial samples that make incorrect predictions for multiple victim models, so that they are more likely to be generalized and transferred to any inaccessible victim model during use.

[0146] The anti-attack results obtained by the method described in this embodiment are as follows Figure 1cAs shown, (a) represents a clean sample (target original image), (b) represents an adversarial sample, (c) represents a dense perturbation generated by the generator, (d) represents a perturbation mask generated by the generator, and (e) represents the obtained sparse perturbation.

[0147] The method described in this embodiment was experimented, and the experimental results are shown in the following table:

[0148] Table 1 Comparison of black box attack experimental results on CIFAR-10 dataset

[0149]

[0150] In Table 1, Spa represents sparsity and L2 represents norm. VGG19 is a convolutional neural network proposed by the Visual Geometry Group of the University of Oxford, and 19 represents the depth of the network architecture. The meanings of Res50 (i.e. Resnet50), Res101 and DenseNet121 refer to the explanation section of step 103. IncV3 (i.e. Inception-V3) represents the third generation model in Google's Inception series. Swin (i.e. Swin Transformer) represents the Transformer model with hierarchical shift windows. SparseFool is a sparse adversarial attack method proposed at the 2019 Conference on Computer Vision and Pattern Recognition. Ensxxx means using VGG16, ResNet18, ViT as the target model (ViT is Vision Transformer, a Transformer architecture used in the field of computer vision). TSAA is a transferable sparse adversarial attack method proposed at the 2022 Conference on Computer Vision and Pattern Recognition. Pixel is a fast and effective black-box attack method based on pixel rearrangement proposed at the 2022 International Joint Conference on Neural Networks.

[0151] Table 2 Comparison of black box attack experimental results on ImageNet-1K dataset

[0152]

[0153] In Table 2, WRes (i.e. WideResNet) is a wide residual neural network, and the numbers "50" and "101" are the depth of the network architecture. ResX50 (i.e. ResNeXT) is a variant of the residual neural network, a combination of ResNet and Inception. EffB6 (i.e. EfficientNet-B6) is a high-level convolutional neural network, and B6 is the network architecture.

[0154] Table 3 Comparison of the effects of using different proxy models on black box attacks

[0155]

[0156]

[0157] In RegX200MF mentioned in Table 3, Reg (RegNet) is a neural network based on the model network design space, and MF (Million FLOPs) represents million floating point operations. 200MF means that the computational complexity of the model is about 200 million floating point operations. Cait and SViT (Simple ViT) in Table 3 both represent variants of the ViT network.

[0158] It can be seen that Table 1, Table 2 and Table 3 respectively show the comparison of experimental results of black box attack on different data sets by the method described in this embodiment, and also give the black box attack results obtained by conducting experiments using different target models by the method described in this embodiment.

[0159] Example 2: This application discloses another adversarial sample generation method based on a dynamic heterogeneous redundant architecture, please refer to Figure 2 , the method described in this embodiment introduces the training process of the generator.

[0160] Step 201: Increase the original preheating radius to the input disturbance radius according to actual needs.

[0161] Step 202: Determine whether the input disturbance radius is not greater than the preset minimum radius. If yes, proceed to step 203. If no, take the input disturbance radius as the disturbance radius and proceed to step 204.

[0162] Step 203: preheat the disturbance to the input disturbance radius to obtain the disturbance radius.

[0163] Step 204: Input the perturbation radius and the original image sample into the generator to obtain dense adversarial perturbation and perturbation mask.

[0164] Step 205: perform element-wise multiplication of the dense adversarial perturbation and the perturbation mask to obtain a sparse perturbation adversarial sample.

[0165] Step 206: Input the sparse perturbation adversarial sample into the target model to obtain model output data.

[0166] Step 207: Calculate the loss based on the model output data, and iteratively train the generator based on the loss.

[0167] Based on the above embodiment, a method for generating adversarial samples based on a dynamic heterogeneous redundant architecture is disclosed. This embodiment correspondingly discloses an adversarial sample generating device. Figure 3, the adversarial sample generation device includes: a preheating unit 301, a generation unit 302, an acquisition unit 303, a training unit 304 and an execution unit 305;

[0168] The preheating unit 301 is used to perform disturbance preheating on the input disturbance radius based on a preset minimum radius to obtain the disturbance radius;

[0169] The generating unit 302 is used to input the perturbation radius and the original picture sample into a generator to obtain a sparse perturbation adversarial sample;

[0170] The acquisition unit 303 is used to input the sparse perturbation adversarial sample into a target model to obtain model output data; the target model is a plurality of models of different types;

[0171] The training unit 304 is used to iteratively train the generator based on the model output data until the generator meets the preset goal, and obtain the generator as an adversarial sample generator;

[0172] The execution unit 305 is used to input the target original image sample into the adversarial sample generator to obtain the adversarial sample to perform the adversarial attack.

[0173] Optionally, the preheating unit 301 includes:

[0174] A preprocessing subunit, used for increasing the original disturbance radius according to the disturbance demand to obtain the input disturbance radius;

[0175] A judging subunit, used to judge whether the input disturbance radius is not greater than the preset minimum radius;

[0176] Also used for performing disturbance preheating on the input disturbance radius;

[0177] Also used to not process the input perturbation radius.

[0178] Optionally, the preheating unit 301 is used to:

[0179] The iterative formula of the disturbance preheating is:

[0180] ∈ wu =∈+max((ω-epoch) / 255,0)

[0181] In the formula, ∈ wu is the disturbance radius after the disturbance preheating, ∈ is the input disturbance radius, ω is the preheating parameter, and epoch is the number of iterations.

[0182] Optionally, the generating unit 302 includes:

[0183] An input subunit, configured to use the perturbation radius and the original image sample as input data of the generator to obtain a dense adversarial perturbation and a perturbation mask;

[0184] An acquisition subunit is used to perform element-by-element multiplication of the dense adversarial perturbation and the perturbation mask to obtain the sparse perturbation adversarial sample.

[0185] Optionally, the training unit 304 includes:

[0186] A computing subunit, configured to calculate a loss based on the model output data; the loss includes a weight-balanced integrated adversarial loss, a sparse loss, a sparse quantization loss, and a gradient perturbation regularization loss;

[0187] A training subunit is used to iteratively train the generator based on the loss.

[0188] Optionally, the training subunit is used to:

[0189] The generator is iteratively trained by an iterative training loss function; the formula of the iterative training loss function is:

[0190]

[0191] Where, L overall is the iterative training loss function, is the weighted balanced integrated adversarial loss, L spa is the sparse loss, L qua is the sparse quantization loss, L gard is the gradient perturbation regularization loss, μ s , μ q and μ g is a hyperparameter;

[0192] μ s Used to control the sparsity of the output data of the model;

[0193] μ q Used to reduce the difference between the target model in the training phase and the use phase;

[0194] μ g Used to enable the generator to obtain diversified information from gradient perturbations.

[0195] Optionally, the formula for the weighted balanced integrated adversarial loss is:

[0196]

[0197] Where n is the number of target models, β d is the weight associated with the d-th target model, is the adversarial loss of the d-th target model in the CW attack.

[0198] Optionally, the formula for the gradient perturbation regularization loss is:

[0199] L gard =||x adv -x FGSM ||2

[0200] Where, L gard is the gradient perturbation regularization loss, x adv is the sparse perturbation adversarial sample, x FGSM Adversarial examples generated using the fast gradient sign method.

[0201] Optionally, the device further comprises:

[0202] Parameter preheating unit, used to adjust μ s Preheating is performed; the preheating formula is:

[0203]

[0204] In the formula, μ s >0 means is the sparse hyperparameter of the initial value, represents the maximum sparsity hyperparameter, ξ is the sparsity against perturbations, ξ min is the expected sparsity and epoch is the number of iterations.

[0205] Based on the above-mentioned adversarial sample generation method based on a dynamic heterogeneous redundant architecture, the present application also discloses a computer program product, including a computer program, which implements the steps of the above-mentioned method when executed by a processor.

[0206] Based on the above-mentioned adversarial sample generation method based on a dynamic heterogeneous redundant architecture, the present application also discloses a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the steps of the above-mentioned method in the claim when executing the computer program.

[0207] Based on the above-mentioned adversarial sample generation method based on dynamic heterogeneous redundant architecture, the present application also discloses a computer storage medium on which computer program instructions are stored, characterized in that the steps of the above-mentioned method are implemented when the computer program instructions are executed by a processor.

[0208] The embodiments in this specification are described in a progressive manner. As for the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the methods.

[0209] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0210] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0211] The features described in the embodiments of this specification can be replaced or combined with each other, so that professional and technical personnel in this field can implement or use the present application.

[0212] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for generating adversarial samples based on a dynamic heterogeneous redundant architecture, characterized in that: include: Based on the preset minimum radius, the input disturbance radius is preheated to obtain the disturbance radius; Inputting the perturbation radius and the original image sample into the generator to obtain a sparse perturbation adversarial sample; Inputting the sparse perturbation adversarial sample into a target model to obtain model output data; the target model is a plurality of models of different types; Iteratively training the generator based on the model output data until the generator meets a preset goal, and obtaining the generator as an adversarial sample generator; The target original image sample is input into the adversarial sample generator to obtain an adversarial sample to perform an adversarial attack.

2. The method according to claim 1, characterized in that The preheating of the disturbance radius input based on the preset minimum radius includes: Increasing the original disturbance radius according to the disturbance requirement to obtain the input disturbance radius; Determining whether the input disturbance radius is not greater than the preset minimum radius; If yes, preheating the disturbance is performed on the input disturbance radius; If not, the input perturbation radius is not processed.

3. The method according to claim 2, characterized in that The preheating of the disturbance on the input disturbance radius includes: The iterative formula of the disturbance preheating is: ∈ wu =∈+max((ω-epoch) / 255,0) In the formula, ∈ wu is the disturbance radius after the disturbance preheating, ∈ is the input disturbance radius, ω is the preheating parameter, and epoch is the number of iterations.

4. The method according to claim 1, characterized in that: The step of inputting the perturbation radius and the original image sample into a generator to obtain a sparse perturbation adversarial sample includes: Using the perturbation radius and the original image sample as input data of the generator to obtain dense adversarial perturbation and perturbation mask; The dense adversarial perturbation is element-wise multiplied by the perturbation mask to obtain the sparse perturbation adversarial sample.

5. The method according to claim 1, characterized in that: The iterative training of the generator based on the model output data comprises: Calculating the loss based on the model output data; the loss includes weight-balanced integrated adversarial loss, sparse loss, sparse quantization loss and gradient perturbation regularization loss; The generator is iteratively trained based on the loss.

6. The method according to claim 5, characterized in that The iterative training of the generator based on the loss comprises: The generator is iteratively trained by an iterative training loss function; the formula of the iterative training loss function is: Where Loveall is the iterative training loss function, For the weighted balanced integrated adversarial loss, Lsp a is the sparse loss, Lqu a is the sparse quantization loss, Lgar d is the gradient perturbation regularization loss, μs, μq and μg are hyperparameters; μs is used to control the sparsity of the output data of the model; μq is used to reduce the difference between the target model in the training phase and the use phase; μg is used to enable the generator to obtain diversified information from gradient perturbations.

7. The method according to claim 6, characterized in that The formula for the weighted balanced integrated adversarial loss is: Where n is the number of target models, βd is the weight associated with the dth target model, is the adversarial loss of the d-th target model in the CW attack.

8. The method according to claim 6, characterized in that The formula for the gradient perturbation regularization loss is: Lgard=|lxadv-xrGsull Where Lgar d is the gradient perturbation regularization loss, xad v is the sparse perturbation adversarial sample, x FGSM Adversarial examples generated using the fast gradient sign method.

9. The method according to claim 6, characterized in that The method further comprises: μs is preheated; the preheating formula is: In the formula, μ s >0 means is the sparse hyperparameter of the initial value, represents the maximum sparsity hyperparameter, ξ is the sparsity against perturbations, ξ min is the expected sparsity and epoch is the number of iterations.

10. An adversarial sample generation device, characterized in that: include: Preheating unit, generating unit, acquiring unit, training unit and executing unit; The preheating unit is used to perform disturbance preheating on the input disturbance radius based on a preset minimum radius to obtain the disturbance radius; The generating unit is used to input the perturbation radius and the original picture sample into the generator to obtain a sparse perturbation adversarial sample; The acquisition unit is used to input the sparse perturbation adversarial sample into a target model to obtain model output data; the target model is a plurality of models of different types; The training unit is used to iteratively train the generator based on the model output data until the generator meets a preset goal, and obtain the generator as an adversarial sample generator; The execution unit is used to input the target original image sample into the adversarial sample generator to obtain the adversarial sample to perform the adversarial attack.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

12. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images