Generator-based cross-domain cross-model anti-attack method

Abstract

The invention discloses a cross-domain cross-model attack resisting method based on a generator in the technical field of calculation, which comprises the following steps: 1) based on a loss function weighted by label cross entropy loss and intermediate layer CAM graph cosine similarity loss, returning the loss of an adversarial sample on an alternative model obtained by calculation to the generator so as to constrain the formation of adversarial disturbance; 2) adding a random low-pass filtering module behind the generator, and guiding the generator to add disturbance to a low-frequency component with higher mobility after the random low-pass filtering module is added behind the generator; and the migration attack success rate of the image confrontation sample on the unknown target domain is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computing, and in particular to a generator-based cross-domain and cross-model counterattack method. Background Art

[0002] With advances in deep learning theory, the accuracy and complexity of neural network models have continued to improve. Artificial intelligence technologies based on neural networks have been widely deployed in industrial applications of safety and security systems, such as the currently popular autonomous driving, mobile payments, facial recognition on mobile devices, and object detection and recognition. However, deep neural networks are found to be less robust than previously thought. Research by Christian Szegedy and others has demonstrated that adversarial examples can cause DNNs to misclassify images with high confidence by introducing invisible perturbations to the image. Adversarial attacks are malicious methods that exploit adversarial examples to launch threat models. Current attack methods can even engineer specific noise perturbations into images to cause the model to output the attacker's desired classification. For example, in facial recognition payment systems, someone could disguise themselves to commit fraud. This can significantly impact the effectiveness of neural network models and pose a serious threat to the development of artificial intelligence technology.

[0003] The emergence of adversarial examples has drawn increasing attention from researchers to model robustness. Using adversarial attacks to trigger model flaws is an effective model detection method, capable of identifying model vulnerabilities and remediating them, thereby enhancing network robustness. Furthermore, adversarial examples can guide model training for adversarial defenses, thereby improving model performance and reliability and preventing adversarial attacks. Efficiently generating adversarial examples with enhanced perturbation effects has long been a research goal in this field. Adversarial attack methods are categorized as black-box and white-box, depending on the attacker's access to the target model. Black-box attacks can attack real-world deep neural network applications without possessing any information about the target model, making them more threatening than white-box attacks. In a study, Goodfellow et al. proposed the concept of adversarial example transferability: adversarial examples generated for a known neural network model retain their adversarial properties when used against other, unknown classification models. Leveraging this property, the attacker optimizes the generation of adversarial examples for an accessible alternative model and exploits the transferability of these adversarial examples to attack the target black-box model, hoping to cause the target classification model to misclassify, thereby achieving the goal of a black-box attack. This is the principle of the most commonly used migration black box attack method in adversarial attack methods.

[0004] Numerous research efforts are improving the transferability of adversarial attacks from various perspectives, such as advanced gradient computation attack algorithms and input augmentation attack algorithms. Some algorithms improve the transferability of adversarial examples by attacking intermediate layers of neural networks. The ILA algorithm fine-tunes generated adversarial examples by adding perturbations to the feature maps of intermediate layers of the surrogate model, achieving high transferability. ATA proposes using an attention mechanism to identify common features across different models and prioritize their destruction. FIA research suggests that the generation of adversarial examples needs to be guided by irrelevant key features of the source model. These features are extracted from intermediate layers and then used to optimize feature importance. In addition to attacking images in the spatial domain, some attack methods shift their focus to the frequency domain. Research suggests that low-frequency perturbations can reveal common features that multiple models need to learn, emphasizing perturbations on these common features to enhance the transferability of adversarial examples. Results show that low-frequency perturbations can produce strong attacks against both white-box and black-box models. In recent years, with the development of generative networks, existing work has also used generative models to generate adversarial examples. Zhao et al. used a generative adversarial network (GAN) to search in semantic space, generating visually natural adversarial images that lie on the data manifold. This attack scheme is called Natural Adversarial Perturbation Generation (NAG). Song et al. proposed the GAP++ algorithm, which first trains a conditional GAN ​​to simulate the conditional distribution of real data. Then, conditioned on the target category, it searches the latent space of a CGAN to generate images that misclassify the target model.

[0005] These algorithms primarily explore cross-model transferability between models trained on the same data distribution. However, in real-world scenarios, models leak very little relevant information, making it difficult for attackers to obtain training data for unknown models in advance. Therefore, this assumption often fails to hold true in practical applications. Existing transferable black-box attack methods mostly focus on model differences. The resulting image adversarial examples rely solely on transferability between different models. In cross-domain, cross-model black-box scenarios, the attack's effectiveness is limited and often fails to achieve the desired success rate. To overcome this limitation, research on image adversarial example generation methods needs to be conducted in a more realistic cross-domain, cross-model scenario: the attacker neither knows the distribution of the training data nor the pre-trained target model based on that training data. Specifically, the surrogate model and the target model must be trained on different datasets, and adversarial examples are constructed using the surrogate model trained on the other dataset. Generation methods in this setting are more realistic but also more challenging to research.

[0006] Building on previous research, this paper proposes a generator-based cross-domain and cross-model adversarial attack method to further improve the cross-domain transferability of image adversarial samples between models trained under different data distributions. Adversarial samples represent vulnerabilities in deep learning, and attack and defense complement each other. This paper aims to improve the transferability of adversarial samples in cross-domain and cross-model black-box scenarios, thereby exploring security vulnerabilities in deep models in real-world scenarios, improving model robustness and making them immune to interference from adversarial samples. It also assists in the development and advancement of defense, mitigating the significant losses caused by security risks in neural network models. Summary of the Invention

[0007] The purpose of this section is to summarize some aspects of the embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and in the abstract and title of the present invention to avoid obscuring the purpose of this section, the abstract and the title of the invention, and such simplifications or omissions should not be used to limit the scope of the present invention.

[0008] Therefore, the purpose of the present invention is to provide a generator-based cross-domain and cross-model adversarial attack method to improve the success rate of migration attacks on image adversarial samples in unknown target domains.

[0009] To solve the above technical problems, the present invention provides a generator-based cross-domain and cross-model adversarial attack method, which adopts the following technical solutions: the method includes: 1) based on a loss function weighted by label cross entropy loss and cosine similarity loss of the intermediate layer CAM graph, the loss of the adversarial sample calculated on the replacement model is fed back to the generator to constrain the formation of adversarial perturbations; 2) a random low-pass filter module is added after the generator, and the random low-pass filter module is added after the generator to guide the generator to add perturbations to low-frequency components with stronger mobility.

[0010] Optionally, the label cross entropy loss is:

[0011] L l =CrossEntropy(F s (x′ s ), y s ) (1)

[0012] In formula (1), x′ s is the original image x s Adversarial examples, y s is x s The corresponding true label, the generator uses the ResNet network, which consists of a downsampling layer, a residual block and an upsampling layer.

[0013] Optionally, the CAM map of category c is obtained by using formula (2) and formula (3):

[0014]

[0015] In formulas (2) and (3), y c It is the output value of category c that has not yet passed through Softmax, A represents the feature map, k represents the channel of feature map A, i and j represent the horizontal and vertical coordinates of feature map A respectively, and z represents the product of the length and width in feature map A.

[0016] Optionally, the cosine similarity loss based on the intermediate layer CAM map is defined by the cosine similarity distance between the original image and the class activation map of the generated adversarial example in the substitution model:

[0017]

[0018] Optionally, the loss function based on the weighted weight of label cross entropy loss and cosine similarity loss of the intermediate layer CAM graph is expressed as:

[0019] L=λ l L l +λ c L c (5).

[0020] Optionally, the generator maximizes formula (5) by formula (6), passes back and updates the parameters of the generator until the model converges.

[0021] F t (G(x t ))≠F t (x t ) st‖G(x t )-x t || ∞ ≤∈ (6)

[0022] Among them, F t (·) is the target domain image x t Trained target model, target domain image x t Generate adversarial samples G(x t ),∈ is to ensure that G(x t ) changes, G(x t ) represents G as x t The generated adversarial samples are generated using L ∞ norm to constrain the distance between the adversarial image and the original image.

[0023] Optionally, the random low-pass filtering module performs Gaussian low-pass filtering on the adversarial sample with a probability of P=0.5 to filter out the high-frequency components therein, and then inputs the result into the substitution model, which can be expressed as follows:

[0024]

[0025] Here, μ is the mean of x and σ is the standard deviation of the Gaussian kernel.

[0026] In summary, the present invention has at least one of the following beneficial effects:

[0027] (1) The generator-based cross-domain and cross-model adversarial attack method of the present invention uses the weighted result of label cross entropy loss and cosine similarity loss based on the intermediate layer class activation map to define the loss function of the generative model, and performs random low-pass filtering in the frequency domain on the adversarial image, so as to constrain and guide the generator to generate more transferable perturbations, thereby improving the success rate of migration attacks on image adversarial samples in unknown target domains.

[0028] (2) The attack effectiveness of the proposed method is significantly superior to other existing methods. In cross-domain and cross-model scenarios, the ASR value of the CUB-200-2011, Flower102, and CIFAR10 datasets is improved by an average of 3.13%. In particular, the transfer attack success rate on the CUB-200-211 dataset reaches 60.7%, and the ASR value in cross-model scenarios is improved by an average of 3.06%, while maintaining a white-box attack success rate of 99.2%. The CDMA method achieves an improvement in the success rate of black-box attacks in cross-model and cross-domain scenarios.

[0029] (3) The research on adversarial attacks in cross-domain and cross-model black-box scenarios conducted by this invention enables attackers to construct adversarial samples to cause the target model to misidentify even when the attacker is unaware of the target model's structure, parameters, or even the data domain, making black-box attacks in the real world possible. Therefore, the security issues of deep learning models urgently need to receive more attention and attention. From the perspective of exploring model security vulnerabilities, the robustness of the model can be improved to resist adversarial attacks, thereby promoting the security of deep learning technology in real-world applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 Generate a network model schematic diagram for the present invention;

[0032] Figure 2 Schematic diagram of the basic generation framework for adversarial samples;

[0033] Figure 3This is a schematic diagram of the CAM model based on the present invention;

[0034] Figure 4 This is a schematic diagram of a random low-pass filtering module of the present invention;

[0035] Figure 5 Generate adversarial examples for CDMA and CDMA (None RF)

[0036] Figure 6 A graph showing the focus area of ​​an image and an adversarial sample feature map. DETAILED DESCRIPTION

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making creative work shall fall within the scope of protection of the present invention.

[0038] In the description of the present invention, it should be noted that the terms "upper," "lower," "inner," "outer," "top / bottom," and the like, indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0039] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "installed," "provided with," "mounted / connected," and "connected" should be understood in a broad sense. For example, "connected" can mean a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, and it can be internal communication between two components. Those skilled in the art will be able to understand the specific meanings of the above terms in the present invention in specific circumstances.

[0040] The generator-based adversarial attack algorithm looks for a generating function to create perturbations, and generates adversarial perturbations for the input image directly from the generator. This function is fitted using a deep neural network model. This article will use the basic adversarial sample generation framework proposed in GAP. After the generative network model is trained, given an input, the trained generator can generate the corresponding image adversarial sample. Figure 1 As shown, by the generator G θ and the alternative model F s (·)composition.

[0041] The label cross entropy loss is:

[0042] L l =CrossEntropy(F s (x′ s ), y s ) (1),

[0043] In formula (1), x′ s is the original image x s Adversarial examples, y s is x s The corresponding true label, the generator uses a ResNet network, which consists of a downsampling layer, a residual block, and an upsampling layer. The generator training goal is to maximize the error of the output adversarial sample on the replacement model to achieve the maximum deception rate.

[0044] argmaxCrossEntropy(F s (x′ s ), y s ) st ||x′ s -x s || ∞ ≤∈ (8)

[0045] For black-box cross-domain scenarios where both the target model and the target domain are unknown: 1) When the loss function directly uses label loss, which is related to the deep network features of the surrogate model, the generator will overfit the structural information of the specific model. 2) The data distribution between datasets is also different. The information learned by the generator from the training dataset during training may not be able to generalize well to other data domains. The existence of these two defects leads to Figure 1 The basic generation method in

[15] cannot optimize adversarial samples using only the cross-entropy loss function of the label, nor can it well complete the task of generating image adversarial samples in cross-domain and cross-model black-box scenarios.

[0046] The present invention discloses a cross-domain and cross-model counterattack method (CDMA algorithm) based on a generator. Figure 2 Improvements to the basic generation framework in

[15] : including:

[0047] 1) Based on a loss function weighted by the label cross entropy loss and the cosine similarity loss of the intermediate layer CAM graph, the loss of the adversarial sample on the replacement model is fed back to the generator to constrain the formation of adversarial perturbations;

[0048] 2) Add a random low-pass filter module after the generator. Add the random low-pass filter module after the generator to guide the generator to add disturbances to the low-frequency components with stronger mobility.

[0049] CAM is a class activation mapping (CAM), also known as a class heat map or saliency map.

[0050] In generative adversarial training, the present invention uses a generator to generate adversarial samples of images, and then performs low-pass filtering on the adversarial images with a probability of 1 / 2 to filter out some high-frequency components in the adversarial perturbation, and then obtains the CAM map of the two images in the specific middle layer of the replacement model, calculates the cosine loss of the two images, and weights them with the cross-entropy loss of the final judgment result, and passes the weighted result back to the generator to update the parameters. The present invention uses label loss to ensure the effect of adversarial sample attacks. The distribution information obtained from the CAM map guides the generator to interfere with the feature parts with good mobility, and guides the generator in combination with a random low-pass filtering module, so as to reduce the overfitting of the generator to the specific model structure and data domain, generate more mobile perturbations between different models and data domains, and achieve the improvement of the mobility of adversarial samples in cross-domain and cross-model scenarios.

[0051] The research goal of the generator-based image adversarial sample generation method in cross-domain and cross-model scenarios is to: t The target model F trained under t (·), generator G θ Only using the alternative model F s (·) and the original image x s The information of the target domain image x is within the perturbation range. t Generate adversarial samples G(x t ), G(x t ) and the target domain image x t Compared with the original one, it has smaller distortion and successfully deceives the network model F trained on any domain including the original one. t (·), which makes it misclassified. It can be expressed as:

[0052] F t (G(x t ))≠F t (x t ) st||G(x t )-x t || ∞ ≤∈ (6)

[0053] ∈ is to ensure that G(x t ) changes, G(x t ) represents G as x tThe generated adversarial sample, the parameters θ of the generator are updated by the back propagation of the gradient of the loss function, which is only related to the original and the alternative model. In order to reduce the difference between the adversarial sample and the original image, the two images are visually close. The present invention adopts L ∞ norm to constrain the distance between the adversarial image and the original image.

[0054] Generally speaking, the loss function of adversarial sample generation methods based on generators is mostly constructed based on the difference between the discrimination results or discrimination processes of the substitution model for the original image and the substitution sample. In a cross-domain and cross-model black-box scenario, the attacker can only use the substitution model trained with other datasets to construct adversarial samples. In this case, the label space of the substitution model is inconsistent with the label space of the target model, making it impossible to optimize the adversarial sample using only label cross entropy. Directly using the loss function related to the model judgment result may cause the generator to overfit during model training and cannot effectively guarantee the transfer attack effect of the generated image adversarial sample on other domains. Therefore, how to construct an effective adversarial sample optimization function based on the substitution model and ensure that the image difference measurement based on the substitution model has reference value for the model's classification judgment is an important issue that the adversarial attack algorithm must solve when determining the loss function in this scenario.

[0055] Generally speaking, convolutional neural networks used for image recognition progressively extract features from the input image by stacking multiple convolutional layers. Research has shown that the early convolutional layers tend to extract relatively simple, low-level features, while later convolutional layers combine the features extracted by the previous layers to obtain more abstract, semantically informative features. The intermediate layers of a neural network model extract transferable features shared between different models. In a study on the feature transferability of deep learning neural networks, the authors tested the generalization performance and specificity of neurons in the same layer and determined that the first three layers of the neural network are essentially universal features. These universal features have strong generalization capabilities across different model structures, data, and tasks. Generally speaking, the adversarial perturbations generated by the generator are highly dependent on the specific network model. Compared with label loss functions that rely on model judgment results, adversarial examples that destroy the universal features of the image in the intermediate layers of the surrogate model have higher transferability.

[0056] Based on the mechanism that different convolutional neural networks have similar feature processing processes, in order to link the intermediate layer features with better generalization ability with the judgment of model classification, thereby guiding the cross-domain generation of image adversarial samples, improving the attack success rate and migration ability of generated adversarial samples, and making the generated adversarial samples as close to the real image as possible. The present invention introduces Grad-CAM technology, extracts the feature maps of the original image and the generated adversarial sample in the specific intermediate layer in the replacement model, performs weighted fusion to obtain CAM, and adds a regularization constraint based on CAM on the basis of the label loss function, so as to alleviate the problem of overfitting of the generator to the specific model during the adversarial sample generation process. Based on the CAM model schematic diagram as shown in FIG. Figure 3 shown.

[0057] Grad-CAM is a gradient-weighted class activation mapping method that can visualize any CNN-based classification network and locate important areas in the image that are relevant to network predictions. As shown in formulas (2) and (3), Grad-CAM uses the gradient information of the convolutional layer in the CNN to understand the importance of each neuron for category recognition. That is, Grad-CAM uses the gradient of the network backpropagation to calculate the weight of each channel in the feature map, multiply the weights of different neurons by their respective feature values, and then sum the corresponding values ​​of all neurons. The sum is processed using the ReLU function to retain pixel values ​​that have a positive effect on the classification and suppress pixel values ​​that have a negative effect on the classification.

[0058]

[0059] In formulas (2) and (3), y c It is the output value of category c that has not yet passed through Softmax, A represents the feature map, k represents the channel of feature map A, i and j represent the horizontal and vertical coordinates of feature map A respectively, and Z represents the product of the length and width in feature map A.

[0060] The CAM map of the category is obtained through the above operations. The cosine similarity loss based on the intermediate layer CAM map is defined by the cosine similarity distance between the original image and the category activation map of the generated adversarial sample in the replacement model:

[0061]

[0062] The loss function during training is the weighted sum of the two losses:

[0063] L=λ l L l +λ c L c (5).

[0064] The generator of the present invention maximizes formula (5) through formula (6), and back-propagates and updates the parameters of the generator until the model converges. Through Grad-Cam technology, the attacker can visualize the importance of the features of the image sample in the middle layer of the model to the model classification results. Therefore, the cosine loss based on CAM can guide the generator to interfere with the important features that affect the model judgment and destroy the important target perception features that dominate the deep model decision. The constraint of label loss can ensure that the generated adversarial perturbation changes in the direction of causing the target model to misclassify, thus ensuring the attack effect of the generated image adversarial sample and improving the migration effect of the data set obtained by training under different image data sets. At the same time, since the adversarial perturbation only acts on the area that the model pays more attention to, and does not need to act on all pixels, the adversarial perturbation can be reduced, making the adversarial sample intuitively closer to the original sample.

[0065] In cross-domain black-box scenarios, not only is the target model unknown, but the dataset used to train the target model is also unknown, meaning the original and target domains are likely different. Due to differences in data distribution between datasets, images across domains can differ significantly in feature distribution. Transferable black-box attack methods train surrogate models without any knowledge of the target dataset's data distribution. The resulting surrogate model differs significantly from the target model, making it difficult for the generator to generalize knowledge acquired from the original source to the unknown target domain, thus affecting the transferability of the generated adversarial images. Furthermore, when the models involved employ different architectures, the transferability of the domain knowledge learned by the source model decreases, making cross-model and cross-domain transferable adversarial attacks more difficult.

[0066] Some adversarial example generation methods use data augmentation strategies to increase the diversity of input samples, thereby mitigating overfitting to specific data domains. Recent research has found that the frequency domain characteristics of input images can affect the generalization performance of deep models. Many researchers have conducted extensive work on the frequency principle of deep neural networks, gradually attempting to theoretically understand the learning and generalization processes of general deep neural networks. In the frequency domain, images are divided into high-frequency and low-frequency components. The low-frequency component is the data area where the pixel values ​​do not vary much and contains most of the image's semantic information. The high-frequency component contains noise and image contour information, which represents areas where the pixel values ​​fluctuate greatly. Existing work has theoretically demonstrated that low-frequency components are given higher priority during the learning process of deep neural networks. Some researchers have proposed a general frequency principle, the frequency principle (F-Principle) in the optimization process of deep neural networks. This principle states that during training, convolutional neural networks tend to first acquire the low-frequency components of an image and then fit its high-frequency components. Furthermore, research has enhanced the transferability of adversarial examples by emphasizing the perturbation of common (low-frequency) features. Discarding the high-frequency information of adversarial images can improve the robustness of the DCNN model to adversarial samples.

[0067] Inspired by the above principles, in order to improve the performance of the generator on different data sets, the present invention proposes a random low-pass filtering module from the perspective of stronger generalization ability of low-frequency components. The schematic diagram of the random low-pass filtering module is shown in the figure. Figure 4 shown.

[0068] By performing a low-pass filter on the adversarial image with a certain probability, the misleading effect of the adversarial image on the alternative model can be weakened by removing some disturbances, increasing the robustness of the adversarial sample and thus improving its transferability. The filtering operation in this module uses a Gaussian low-pass filter to filter out the high-frequency part of the adversarial disturbance of the image. Gaussian low-pass filtering is one of the most basic low-pass filtering methods in image processing. It is used to filter out the high-frequency components of the image (the image details), retain the low-frequency data, and smooth and reduce the noise of the image. The common implementation method is discretized window sliding convolution, which can be implemented in the spatial domain. The basic principle is to perform a convolution operation on the image using a Gaussian kernel generated by a Gaussian function. The two-dimensional Gaussian filter kernel is expressed as follows:

[0069]

[0070] Where μ is the mean of x, and σ is the standard deviation of the Gaussian kernel. The addition of a random low-pass filter prevents these high-frequency perturbations from providing positive feedback to the surrogate model (causing the model to misclassify). Instead, the generator generates low-frequency perturbations that generalize better within the neural network. This reduces the variance between perturbation noise across models and improves the success rate of adversarial examples when applied to other black-box models. From a spatial perspective, Gaussian filtering correlates each perturbed pixel with its surrounding pixels, reducing the variance in noise across models and enhancing the transferability of adversarial examples. From a frequency domain perspective, random transformations in the frequency domain can alter the weighting of image frequency components, affecting the model's recognition and prediction of adversarial examples and forcing the algorithm to generate more diverse and robust adversarial examples. However, because high-frequency components representing noise and texture are more difficult to detect than low-frequency components containing underlying object structure, excessive Gaussian filtering can blur adversarial images, making them more easily discernible to the human eye.

[0071] In summary, the loss function of the generator-based image adversarial sample generation method in the cross-domain and cross-model scenario proposed in the present invention consists of two parts: label loss and CAM map loss, which are used to optimize the generator in the adversarial generative network model. Label loss ensures the effect of adversarial sample attacks, and CAM-based loss is used to constrain the generation of perturbations. In generating perturbations, the attack will be forced to generate perturbations in key areas of the image, reducing overfitting of features learned by the alternative model. In addition, a random low-pass filtering module is designed for the low-frequency part of the image that is more mobile in the frequency domain model. Random frequency domain low-pass filtering can destroy some high-frequency information in the image, so that the generator tends to generate low-frequency perturbations with better mobility between different models and data domains, thereby improving the migration attack capability of the adversarial sample. The obtained CDMA adversarial image generation network model is shown as follows. Figure 1 As shown:

[0072] The training process of the CDMA algorithm generator first takes the clean Imagnet image dataset as input, generates perturbations through a forward propagation in the generator network, and obtains the perturbations after scaling to meet L ∞A perturbed image with a norm constraint is added to the original image to produce an adversarial sample. The original and adversarial images are then introduced into the frequency domain, and the adversarial image is low-pass filtered with a probability of 0.5 to remove some high-frequency components of the adversarial perturbation that affect mobility. After the transformation is complete, the image is converted from the frequency domain to the spatial domain and then input into the substitution model. Grad-CAM technology is used to obtain a CAM map of the two images in the intermediate layer of the substitution model. The weighted result of the cosine loss of the two images and the cross-entropy loss of the final judgment result is calculated. This is then passed back to the generator, generating adversarial perturbations in the direction of maximum loss to update the parameters. After one round of iteration on the Imagnet dataset, the generator is trained, and the resulting generator only requires a single forward propagation to generate adversarial samples for a specific domain.

[0073] Experimental steps:

[0074] The experiment will analyze the migration success rate of the CDMA algorithm under three settings: white-box, black-box, and cross-domain black-box. It will also analyze the impact of the experimental hyperparameter settings on the effectiveness of the algorithm attack. The cross-domain black-box experiment does not use the original training data of the target model during the training of the alternative model. Two sets of experiments were designed to analyze the attack effectiveness of the proposed migration black-box attack method. To further evaluate the effectiveness of the method, the experiment conducted black-box attacks on various target networks using mainstream datasets. ASR, the core metric, was used to measure the method's performance, and a detailed comparison was conducted with other black-box attack methods, including DIM, FIA, GAP, and CDA.

[0075] Dataset: To ensure the reliability and reproducibility of experiments, the choice of dataset is crucial. This study will use the Imagnet 2012 dataset for training. This dataset contains 1,000 image categories, each with approximately 1,000 images, for a total of approximately 1.2 million training images. Pre-training model datasets for unknown target domains will use the CIFAR-10 dataset, the CUB200-2011 dataset, and the Flower102 dataset. The CIFAR-10 dataset contains 60,000 images. The CUB200-2011 dataset contains 11,788 bird images, encompassing 200 bird subcategories. The Flower102 dataset is a flower image dataset containing 102 categories.

[0076] Target Models: The experiment uses ResNet 50 pre-trained on the Imagenet dataset as an alternative model. For the target model to be attacked, six neural networks, namely VGG16, Inc-v3, ResNet152, Dense169, ResNet50, and VGG19, are used in different experiments.

[0077] Baseline Attacks: To verify the effectiveness of the algorithm proposed in this paper, the experiment will compare it with different attack methods, such as the algorithm DIM using data augmentation strategy, the feature-level attack algorithm FIA, the generator-based attack algorithm GAP, and the CDA algorithm proposed for cross-domain scenarios.

[0078] Parameter Settings: In subsequent experiments, the hyperparameters involved in different adversarial attack algorithms are set as follows: the maximum perturbation value ε is set to 15, the learning rate le is 0.0025, the number of iterations epoch = 1, the batch size = 16, the step size of the iterative attack (DIM) is set to α = ε / T = 1.6, the loss function of the CDMA algorithm is λ1 = λ2 = 1, the convolution kernel size of the Gaussian blur in the low-pass filter is 5*5, the standard deviation σ = 1.1, and the application probability P = 0.5.

[0079] Evaluation: This invention uses Attack Success Rate (ASR) as a performance metric for adversarial attack methods. ASR is a key indicator for measuring classifier robustness. It refers to the ratio of the total number of samples where an attacker successfully deceives the model by modifying the input data and obtains an erroneous output. It can measure the fault tolerance of the classification network under specific attacks. For transfer attack methods, a higher ASR value indicates a stronger transferability.

[0080] Two sets of experiments were designed to analyze the attack effect of the migratable black box attack method proposed in this invention.

[0081] First, we analyze the effectiveness of the CDMA method on network models with known data domains. We use the ResNet 50 model pre-trained on the Imagnet dataset as an alternative model for optimizing and generating adversarial samples. We attack the VGG16, VGG19, ResNet50, ResNet152, and Inc_v3 models, also pre-trained on the Imagnet dataset. The resulting ASR scores are shown in Table 1.

[0082] Table 1: Success rate of transfer attack of adversarial examples on Imagnet training model (%)

[0083]

[0084] Table 1 shows the experimental results of transfer attacks using the CDMA method on various target models in a known data domain. The Clean row in the table shows the recognition error rate of the model trained in the Imagnet domain, the ResNet50 column shows the white-box attack success rate, and the rightmost column shows the average ASR of the black-box attack method on different models. The highest ASR value in each column is bolded, and the second-highest value is underlined. The experimental results show that, under the same experimental settings, the proposed CDMA method improves the cross-model ASR by an average of 3.06% compared to other black-box methods. The white-box attack success rate on the ResNet50 model is 99.2%, only 0.23% lower than the highest attack success rate. The analysis of these results suggests that the CDMA method focuses on finding relatively common image features across different models, failing to consider all important features. In particular, some critical image features may be ignored due to their lack of commonality. This prevents the algorithm from fully perturbing the features, resulting in a lower white-box attack success rate than other algorithms.

[0085] The experiment then tested the effectiveness of the CDMA method under cross-domain and cross-model black-box attack conditions. It also tested the success rate of the CDMA method migration attack without the RF module. The attack models used six different models trained on the CUB 200-2011, CIFAR10, and Flower102 datasets for VGG19 and ResNet152. The resulting ASR values ​​are shown in Table 2:

[0086] Table 2: Adversarial examples on the CUB 200-2011 dataset migration success rate (%)

[0087]

[0088] Others,

[0089] Table 3: Adversarial example transfer success rate on CIFAR10 dataset (%)

[0090]

[0091] Table 4: Adversarial sample transfer success rate on Flower102 dataset (%)

[0092]

[0093] Tables 1, 2, 3, and 4 demonstrate the experimental results of transfer attacks using the proposed method on target models pre-trained on multiple unknown data domains. Compared to other black-box attack methods, the CDMA method achieves strong attack effectiveness across multiple data domains. It achieves the highest transfer attack success rate, achieving an average ASR of 60.72%, particularly against models trained on the CUB-200-2011 dataset. The ASR of the model trained on the CUB-200-2011 dataset improves by 3.60% compared to the average of the other four algorithms. The average ASR on the CIFAR10 and Flower 102 datasets improves by 3.15% and 3.19% respectively. Regarding this result, the present invention analyzes and believes that CUB-200-2011 and Flower 102 belong to fine-grained datasets, and the similarity between images in the datasets is relatively high. Therefore, the trained model mainly makes judgments by extracting abstract and subtle texture information, and this feature is very susceptible to interference from noise. That is, the models trained in these two data domains will be relatively fragile and can easily achieve interference effects with smaller adversarial perturbations. The similarity between features in CIFAR10 images is low, and the differences between features are large, making the attack relatively difficult.

[0094] Figure 5 The following images show the effects of adversarial examples generated by CDMA and CDMA (None RF). The adversarial perturbations generated by the CDMA (None RF) algorithm are granular and somewhat visible. The CDMA algorithm, with the addition of a frequency-domain filtering module, weakens some low-transfer high-frequency perturbations, resulting in adversarial images with less high-frequency information and a softer, more blurred image. Comparing the attack success rates of the two methods, the presence of the RF module improves the ASR performance of the CDMA (None RF) method by an average of 0.6% to 1.78% across multiple unknown target domains. This is due to varying degrees of discrepancy between the models trained on different target domains and the surrogate models. Therefore, a generator trained solely with CDMA (None RF) cannot consistently generate perturbations effectively. Random low-pass filtering primarily targets high-frequency components (typically detail information) in the image. By randomizing this detail, it disrupts the local pixels of the adversarial perturbation, altering the model's classification results and encouraging the generator to reduce the generation of high-frequency components that are often specific to a particular model or unknown domain. Consequently, the resulting adversarial examples are more transferable. Compared with the GAP algorithm, the CDMA (None RF) method only adds a CAM-based cosine similarity loss, which can improve the ASR of the adversarial attack method by an average of 3.5% in different target domains, surpassing the CDA algorithm which is also based on the GAP algorithm.

[0095] Figure 6This is a comparison of the focus areas of the original image and the adversarial sample feature map. The Image image is selected from the Flower102 dataset and the CUB-200-2011 dataset. The CAM image is the class activation map obtained from the original image and the adversarial sample in the Conv5_3 layer of the ResNet152 model. The CAM image can visualize the adversarial sample and more intuitively show the contribution of each pixel to the classification result. Figure 6 As can be seen in the figure, the ResNet152 model assigns different levels of importance to features in the original and adversarial images during image recognition. This is because the CDMA algorithm, when generating adversarial images, somewhat alters the ResNet152 model's attention during image classification. While attention in the original image should be focused on a feature point of the target object, in the adversarial sample, attention is shifted to background irrelevant to the classification, ultimately leading to incorrect classification results. This demonstrates that the CDMA algorithm can indeed, to a certain extent, destroy key image features, thereby improving the effectiveness of cross-domain and cross-model transfer attacks.

[0096] Overall, the excellent performance of the CDMA method in the above transferability experiments demonstrates that the proposed generator-based cross-domain, cross-model black-box attack method outperforms other black-box attack methods in complex cross-domain black-box scenarios. The trained generator has strong generalization capabilities, focusing on the most important features of the input image and performing targeted perturbations, allowing the generated perturbations to be more concentrated in meaningful areas of the image. Comparative results indicate that the improved attack success rate of the CDMA method in cross-domain black-box scenarios is primarily due to the inclusion of the CAM-based cosine similarity loss. This module also contributes to a higher attack success rate than the CDA algorithm, also proposed for cross-domain, cross-model black-box scenarios. Secondly, the frequency-domain random image transformation framework further improves the transferability of adversarial examples. The frequency-domain low-pass filtering module randomly filters the generated adversarial images, destroying the local feature information in the adversarial examples and forcing the model to generate more robust and diverse adversarial examples. Although the impact of the RF module is limited, it still improves the attack effectiveness of the proposed method.

[0097] The above are all preferred embodiments of the present invention, and are not intended to limit the scope of protection of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A generator-based cross-domain and cross-model adversarial attack method, characterized by: The method comprises: 1) Based on the weighted loss function of label cross entropy loss and cosine similarity loss of the intermediate layer CAM graph, the loss of the adversarial sample on the substitution model is fed back to the generator to constrain the formation of adversarial perturbations; 2) Add a random low-pass filter module after the generator, and guide the generator to add disturbances to low-frequency components with stronger mobility.

2. The generator-based cross-domain and cross-model counterattack method according to claim 1 is characterized in that: The label cross entropy loss is: L l =CrossEntropy(F s (x′ s ),y s ) (1), In formula (1), x′ s is the original image x s Adversarial examples, y s For x s Corresponding to the true label, the generator uses a ResNet network, which consists of a downsampling layer, a residual block, and an upsampling layer.

3. The generator-based cross-domain and cross-model counterattack method according to claim 2 is characterized in that: The CAM graph of category c is obtained by formula (2) and formula (3): In formulas (2) and (3), y c It is the output value of category c that has not yet passed through Softmax. A represents the feature map, k represents the channel of feature map A, i and j represent the horizontal and vertical coordinates of feature map A respectively, and Z represents the product of the length and width in feature map A.

4. The generator-based cross-domain and cross-model counterattack method according to claim 3 is characterized in that: The cosine similarity loss based on the intermediate layer CAM map is defined by the cosine similarity distance between the original image and the class activation map of the generated adversarial sample in the substitution model:

5. The generator-based cross-domain and cross-model counterattack method according to claim 4 is characterized in that: The loss function based on the weighted label cross entropy loss and the cosine similarity loss of the intermediate layer CAM graph is expressed as: L=λ l L l +λ c L c (5)。 6. The generator-based cross-domain and cross-model counterattack method according to claim 5, characterized in that: The generator maximizes formula (5) through formula (6), passes back and updates the parameters of the generator until the model converges. F t (G(x t ))≠F t (x t )s.t.||G(x t )-x t || ∞ ≤∈ (6) Among them, F t (·) is the target domain image x t Trained target model, target domain image x t Generate adversarial samples G(x t ),∈ is to ensure that G(x t ) changes, G(x t ) represents G is x t The generated adversarial samples are generated using L ∞ norm to constrain the distance between the adversarial image and the original image.

7. The generator-based cross-domain and cross-model anti-attack method according to any one of claims 1 to 6, characterized in that: The random low-pass filtering module performs Gaussian low-pass filtering on the adversarial sample with a probability of P=0.5 to filter out the high-frequency components, and then inputs them into the substitution model, which can be expressed as: Here, μ is the mean of x and σ is the standard deviation of the Gaussian kernel.

Images