Adversarial sample generation method and device
By performing warping transformation and inverse Fourier transform in the frequency domain, an adversarial sample image is generated, which solves the problem that adversarial samples are easily noticed in the prior art, improves the attack success rate and reduces the computing resource consumption.
Patent Information
- Application Number
- CN202411227631.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-03
- Publication Date
- 2025-02-14
AI Technical Summary
Existing adversarial sample generation methods add additional semantic feature information or modify pixel size to the original image, resulting in the generated adversarial sample images being easily noticed by human eyes and having a low attack success rate.
By obtaining the target image data represented by the frequency domain, warp transformation is performed using the preset warp transformation function and the predefined adversarial warp field, the pixel points in the image are moved to map them to a new position, and the inverse is used to use the inverse The discrete cosine Fourier transform converts the warped frequency domain image to the spatial domain to generate an adversarial sample image.
The generated adversarial sample images are more natural and difficult to detect by human eyes, which improves the success rate of adversarial sample attacks, while reducing the time and computing resources required to generate adversarial samples.
Smart Images
Figure CN119445183A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of deep learning, and in particular to a method and device for generating adversarial samples. Background Art
[0002] Adversarial sample attack is an attack method against machine learning models, especially deep learning models. Adversarial samples are generated by adding some perturbations to the input image data, which causes the model to make incorrect predictions.
[0003] At present, existing adversarial sample production methods often add additional semantic feature information irrelevant to the original clean sample image or modify the pixel size of the sample image, resulting in the generated adversarial sample image being easily detected by the human eye. For example, adding perturbations to the pure sky area in the image will often attract the attention of human observers, resulting in a low success rate of the attack. Summary of the invention
[0004] The present application provides a method for generating an adversarial sample to improve the success rate of an adversarial sample attack. The present application also provides an adversarial sample generating device.
[0005] In a first aspect, the present application provides a method for generating an adversarial sample, comprising:
[0006] Acquire target image data represented in frequency domain;
[0007] Using a preset warping transformation function and a predefined adversarial warping field to perform a warping transformation on the target image data to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions;
[0008] The warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0009] Optionally, the target image is warped using a preset warping transformation function and an adversarial warping field, and the formula is as follows:
[0010] D(x) w =W(D(x),M).
[0011] Wherein, M is the adversarial warping field, which defines an offset for each pixel in the target image data, and the offset is used to characterize the position of the pixel in the warped frequency domain image obtained after the warping transformation;
[0012] D(x) wis a warped frequency domain image, D(x) is the target image data represented in the frequency domain, W is a preset warping transformation function, and the warping transformation function uses a same sampling grid to add and sum M and perform normalized cropping operations.
[0013] Optionally, the antagonistic warp field is constructed in the following manner:
[0014] Determine k*k target points on the frequency domain image, and perform a random initialization operation on the target points to obtain an adversarial control grid;
[0015] Normalizing the adversarial control grid, and forming a backward warping field according to the normalized adversarial control grid and the strength parameter;
[0016] An upsampling operation is performed on the backward warped field and a clipping operation is performed on the backward warped field to obtain an adversarial warped field.
[0017] Optionally, the method further includes:
[0018] Inputting the adversarial sample image into the target deep learning model to obtain an output result;
[0019] The adversarial warp field is iteratively trained according to the output results.
[0020] Optionally, the iterative training of the adversarial warp field according to the output result includes:
[0021] The adversarial control grid p′ in the adversarial warping field is iteratively trained using the gradient direction information, wherein the formula for iterative training of the adversarial control grid p′ is as follows:
[0022]
[0023] Where λ is the step size of each iteration, L is the cross entropy loss function of the classifier model, y is the category label of the original clean image x, and p n ' represents the adversarial control grid of the nth iteration, p n+1 ' represents the adversarial control grid of the n+1th iteration. sign() represents the sign function that determines the direction of its gradient. IDCT represents the inverse discrete Fourier transform. D() represents the discrete Fourier transform. W represents the warping function. M represents the adversarial warping field. y adv Indicates the target category selected for the target attack, Represents the gradient of the model’s loss function L() on the input image x with label category y.
[0024] Optionally, the using of inverse discrete cosine Fourier transform to convert the warped frequency domain image from the frequency domain to the spatial domain to obtain the adversarial sample image includes:
[0025] Filtering a low-frequency region of the warped frequency domain image to obtain a high-frequency warped frequency domain image;
[0026] The high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0027] In a second aspect, the present application further provides an adversarial sample generation device, the device comprising:
[0028] An acquisition unit, used for acquiring target image data represented in frequency domain;
[0029] A warping transformation unit, used to perform a warping transformation on the target image data using a preset warping transformation function and a predefined adversarial warping field to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions;
[0030] The conversion unit is used to convert the warped frequency domain image from the frequency domain to the spatial domain by using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0031] Optionally, the antagonistic warp field is constructed in the following manner:
[0032] Determine k*k target points on the frequency domain image, and perform a random initialization operation on the target points to obtain an adversarial control grid;
[0033] Normalizing the adversarial control grid, and forming a backward warping field according to the normalized adversarial control grid and the strength parameter;
[0034] An upsampling operation is performed on the backward warped field and a clipping operation is performed on the backward warped field to obtain an adversarial warped field.
[0035] Optionally, the device further comprises:
[0036] An obtaining unit, used for inputting the adversarial sample image into a target deep learning model to obtain an output result;
[0037] A training unit is used to iteratively train the adversarial warp field according to the output result.
[0038] Optionally, the conversion unit is specifically used to:
[0039] Filtering a low-frequency region of the warped frequency domain image to obtain a high-frequency warped frequency domain image;
[0040] The high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0041] In a third aspect, an embodiment of the present application provides a device, comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in the first aspect above.
[0042] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which a code is stored. When the code is executed, a device executing the code implements the method described in the first aspect above.
[0043] Compared with the prior art, this application has the following beneficial effects:
[0044] The present application obtains target image data represented in the frequency domain, and uses a preset warp transformation function and a predefined adversarial warp field to perform a warp transformation on the target image data to obtain an image, wherein the warp transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions, and finally the warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image. The present application uses an adversarial warp field to generate perturbations, which only moves the existing pixel positions in the sample image without introducing semantic information content irrelevant to the original image, and filters its low-frequency disturbances in the frequency domain. Therefore, the generated adversarial sample image is more natural and more difficult to be perceived by the human eye, thereby improving the success rate of adversarial sample attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0046] Figure 1 A flowchart of a method for generating adversarial samples provided in an embodiment of the present application;
[0047] Figure 2 A schematic diagram of the structure of a specific implementation of the adversarial sample generation device provided in this application. DETAILED DESCRIPTION
[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0049] It should be noted that the method and device for generating adversarial samples provided in this application are used in the fields of deep learning and network adversarial. The above is only an example and does not limit the application field of the method and device provided in this application.
[0050] Adversarial sample attack is an attack method against machine learning models, especially deep learning models. Adversarial samples are generated by adding some perturbations to the input image data, which causes the model to make incorrect predictions.
[0051] At present, existing adversarial sample production methods, such as the fast gradient sign method FGSM, the basic iterative method BIM, and the projected gradient descent method PGD, often add additional semantic feature information irrelevant to the original clean sample image or modify the pixel size of the sample image, resulting in the generated adversarial sample images being easily detected by the human eye. For example, adding disturbances to the pure sky area in the image will often attract the attention of human observers, resulting in a low success rate of the attack.
[0052] In view of this, after research, the present application provides an adversarial sample generation method, including: obtaining target image data represented in the frequency domain, using a preset warp transformation function and a predefined adversarial warp field to perform a warp transformation on the target image data represented in the frequency domain, and obtaining a warped frequency domain image, wherein the warp transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions, and finally, using an inverse discrete cosine Fourier transform, the warped frequency domain image is converted from the frequency domain to the spatial domain to obtain an adversarial sample image. The present application uses an adversarial warp field to generate perturbations, which only moves the existing pixel positions in the sample image without introducing semantic information content irrelevant to the original image, and filters its low-frequency disturbances in the frequency domain. Therefore, the generated adversarial sample image is more natural and more difficult to be perceived by the human eye, thereby improving the success rate of adversarial sample attacks.
[0053] The method provided in the embodiment of the present application may be executed by software on a terminal device. The terminal device may be, for example, a mobile phone, a tablet computer, a computer, etc. The software may be, for example, system software.
[0054] In order to make the technical personnel in this field better understand the present application, the present application is further described in detail below in combination with the drawings and specific implementation methods. The method provided in the present application embodiment is described below by taking the first device as an example.
[0055] Figure 1 A flowchart of a method for generating adversarial samples provided in an embodiment of the present application. Figure 1 As shown, the method includes:
[0056] S101: Acquire target image data represented in the frequency domain.
[0057] The first device acquires target image data represented in frequency domain.
[0058] The first device can obtain target image data, and then perform discrete cosine Fourier transform DCT on the target image data to obtain target image data represented in the frequency domain, which can be represented by Y=D(x), where the target image data refers to the image data that needs to be processed to produce adversarial samples. Discrete cosine Fourier transform DCT is a commonly used transform in the field of signal processing, especially in image and video compression technology. DCT is similar to discrete Fourier transform (DFT), but it only uses cosine functions and has some characteristics that are particularly beneficial to image compression.
[0059] The phenomenon that the human eye is insensitive to high-frequency features has been well-researched and proven in the field of visual psychology and image processing. The human eye is more sensitive to low-frequency (i.e., large-scale, overall contour) information, and less sensitive to high-frequency (i.e., small-scale, detail) information. By performing discrete cosine Fourier transform (DCT) on the target image data, the target image data represented in the frequency domain is obtained, and then the high-frequency area of the target image data represented in the frequency domain is processed so that it is not easily perceived by the human eye.
[0060] S102: Performing a warping transformation on the target image data using a preset warping transformation function and a predefined adversarial warping field to obtain a warped frequency domain image.
[0061] The first device can use a preset warping transformation function and a predefined adversarial warping field to perform a warping transformation on the target image to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions. The warping transformation function is a mathematical function that describes how to apply geometric transformations in the spatial domain or frequency domain of an image. This transformation can be affine, projective, or more complex nonlinear transformations. The adversarial warping field is used to apply specific geometric perturbations to the image. The purpose is to maximize the error of model prediction while minimizing visual differences.
[0062] The following is a detailed introduction to using a preset warping transformation function W and a predefined adversarial warping field M to perform a warping transformation on the target image data D(x) to obtain a warped frequency domain image:
[0063] The specific formula can be as follows:
[0064] D(x) w =W(D(x),M).
[0065] The adversarial warp field M defines an offset for each pixel in the target image data, which determines the position of the pixel in the warped frequency domain image obtained after the warp transformation. When using the warp field for image sampling, if the sampling position is not an integer coordinate, bilinear interpolation can be used to calculate the pixel value at that position.
[0066] In some possible implementations, the grid_sample function can be used to sample W. M is summed using the same sampling grid and then normalized and clipped to the range of [-1,1] to obtain the input required by this function.
[0067] Specifically, a grid of the same size as the target image data can be created, where each element in the grid is a two-dimensional coordinate, which is used to represent the position of each pixel in the grid. Then the adversarial warp field can be added to the grid to obtain the coordinates of each pixel after the addition. The coordinates are then normalized;
[0068] Then the target image data and the normalized grid are used as inputs of the grid_sample function to perform sampling operations to obtain the warped frequency domain image.
[0069] In some possible implementations, the warped frequency domain image can be constructed as follows:
[0070] First, we select the adversarial control grid p′. For simplicity, we can select target points on a uniform grid of size k×k in the entire frequency domain of the target image data and perform a random initialization operation p′=rand [-1,1] (k,k,2), where rand [-1,1] (·) is a function that returns a random tensor with the same shape as the input and pixel values in the range [-1, 1]. Here, the backward warping field of the adversarial control grid p′ can be expressed as is a set of real numbers, 2 represents the dimension, that is, a region of size k*k is selected as the initial adversarial control grid, and then a strength parameter s can be used to define the strength of P, that is, P = ψ(p′)×s, ψ represents the normalization operation, where the strength parameter here is a hyperparameter, represented by s, which is used to control the strength of the backwarping field, that is, the degree of warping of the image. Similarly, k is also a hyperparameter, which is used to control the size of the initial adversarial control grid. When k and s are small, the adversarial sample images generated by our method have better perceptual evaluation metric results, which means that they are more similar to the original clean sample images (that is, the target image data represented in the frequency domain), but smaller k and s mean smaller perturbation solution space, and its attack success rate and target label category confidence are lower. When k and s gradually increase, the results obtained are the opposite.
[0071] After selecting p′, in order to adjust the size of the backward warp field P to the same as the target image data, the adversarial control grid point p′ can be used to interpolate the entire frequency domain warp field of the target image data, that is, to upsample the warp field.
[0072] In some possible implementations, since the control grid points are in a uniform grid covering the entire image, a bicubic interpolation function can be applied for interpolation.
[0073] Finally, a clipping function, Clip(·), can be applied to perform a clipping operation on the image generated after the upsampling operation so that the sampling points selected in the adversarial control grid p′ do not fall outside the image boundary. The process of generating the adversarial warp field M is M = Clip(U(ψ(p′)×s)).
[0074] S103: Using inverse discrete cosine Fourier transform, the warped frequency domain image is converted from the frequency domain to the spatial domain to obtain an adversarial sample image.
[0075] The first device can use an inverse discrete cosine Fourier transform to convert the warped frequency domain image from the frequency domain to the spatial domain to obtain an adversarial sample image.
[0076] In some possible implementations, the first device may filter the low-frequency region of the warped frequency domain image to obtain a warped frequency domain image retaining only the high-frequency region, which may also be called a high-frequency warped frequency domain image.
[0077] Specifically, the warped frequency domain image D(x) obtained by warping transformation is w Set a mask threshold mask filter low-frequency disturbance information, where the mask value is 0 or 1, for D(x) w The high-frequency area of the image is retained, while the low-frequency area reuses the content of the target image data to obtain a high-frequency warped frequency domain image.
[0078] Then, the high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using the inverse discrete cosine Fourier transform to obtain the adversarial sample image. In this way, the high-frequency region of the target image data represented in the frequency domain is processed so that it is not easily perceived by the human eye.
[0079] In some possible implementations, the present application can also input the adversarial sample image into the target deep learning model to obtain the output result, and iteratively train the adversarial warp field according to the output result so that the adversarial sample image can better meet the needs of adversarial attacks.
[0080] The adversarial control grid p′ is updated iteratively using the gradient direction information to achieve the purpose of adversarial attack.
[0081] First, the elements in the adversarial control grid p′ are randomly initialized. In the case of targeted attack settings and non-targeted attack settings, the process of p′ iteration is as follows:
[0082]
[0083] Among them, λ is the step size of each iteration, for example, it is set to s / 2, L is the cross entropy loss function of the classifier model, y is the category label of the target image data x, and p n ' represents the adversarial control grid of the nth iteration, p n+1 ' represents the adversarial control grid of the n+1th iteration. sign() represents the sign function that determines the direction of its gradient. IDCT represents the inverse discrete Fourier transform. D() represents the discrete Fourier transform. W represents the warping function (the public API grid_sample function provided by PyTorch is used here). M represents the adversarial warping field. y adv Indicates the target category selected for the target attack, represents the gradient of the model’s loss function L(·) on the input image x with label category y.
[0084] Adversarial attacks can be divided into targeted attacks and non-targeted attacks according to the attacker's attack target. Targeted attacks refer to misleading the prediction results of the target deep learning model to a specific category selected by the attacker. When the adversarial samples constructed by the attacker can be misclassified by the target deep model as the attack category specified by the attacker, the attack is successful. Non-targeted attacks are successful when the prediction results of the target deep learning model are wrong, but there is no need to mislead the output to a specific category. When the adversarial samples constructed by the attacker can be misclassified by the target deep learning model, the attack is successful.
[0085] It should be noted that the adversarial warp field M is iterated each time with the iteration of the adversarial control grid p′, so the adversarial sample image generated using M is also iteratively updated until the number of iterations reaches the preset iteration number threshold or the generated adversarial sample image attack is successful.
[0086] The present application obtains target image data represented in the frequency domain, and uses a preset warp transformation function and a predefined adversarial warp field to perform a warp transformation on the target image data to obtain a warped frequency domain image, wherein the warp transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions, and finally the warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image. The present application uses an adversarial warp field to generate perturbations, which only moves the existing pixel positions in the sample image without introducing semantic information content irrelevant to the original image, and filters its low-frequency disturbances in the frequency domain. Therefore, the generated adversarial sample image is more natural and more difficult to be perceived by the human eye, thereby improving the success rate of adversarial sample attacks.
[0087] In addition, since the adversarial sample images generated in the present application do not include more complex semantic information, the time spent on generating adversarial sample images is less than that in the prior art, and computing resources can also be saved.
[0088] The above are some specific implementations of the adversarial sample generation method provided in the embodiments of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiments of the present application will be introduced from the perspective of functional modularization. The device and the adversarial sample generation method described above can be referenced to each other.
[0089] Figure 2 The structural block diagram provided for the embodiment of the present invention is referred to as the specific implementation mode 2, and the Figure 2 The device may include:
[0090] An acquisition unit 200 is used to acquire target image data represented in the frequency domain;
[0091] A warping transformation unit 210, configured to perform a warping transformation on the target image data using a preset warping transformation function and a predefined adversarial warping field to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions;
[0092] The conversion unit 220 is used to convert the warped frequency domain image from the frequency domain to the space domain by using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0093] Optionally, the target image is warped using a preset warping transformation function and an adversarial warping field, and the formula may be as follows:
[0094] D(x)w=W(D(x),M).
[0095] Wherein, M is the adversarial warping field, which defines an offset for each pixel in the target image data, and the offset is used to characterize the position of the pixel in the warped frequency domain image obtained after the warping transformation;
[0096] D(x)w is a warped frequency domain image, D(x) is target image data represented in the frequency domain, and W is a preset warping transformation function, which uses a same sampling grid to perform addition and normalization cropping operations on M.
[0097] Optionally, the antagonistic warp field is constructed in the following manner:
[0098] Determine k*k target points on the frequency domain image, and perform a random initialization operation on the target points to obtain an adversarial control grid;
[0099] Normalizing the adversarial control grid, and forming a backward warping field according to the normalized adversarial control grid and the strength parameter;
[0100] An upsampling operation is performed on the backward warped field and a clipping operation is performed on the backward warped field to obtain an adversarial warped field.
[0101] Optionally, the device further comprises:
[0102] An obtaining unit, used for inputting the adversarial sample image into a target deep learning model to obtain an output result;
[0103] A training unit is used to iteratively train the adversarial warp field according to the output result.
[0104] Optionally, the training unit is specifically used to:
[0105] Iteratively training an adversarial control grid p′ in the adversarial warping field using gradient direction information;
[0106] The formula for iterative training of the adversarial control grid p′ is as follows:
[0107]
[0108] Where λ is the step size of each iteration, L is the cross entropy loss function of the classifier model, y is the category label of the original clean image x, and p n ' represents the adversarial control grid of the nth iteration, pn+1 ' represents the adversarial control grid of the n+1th iteration. sign() represents the sign function that determines the direction of its gradient. IDCT represents the inverse discrete Fourier transform. D() represents the discrete Fourier transform. W represents the warping function. M represents the adversarial warping field. y adv Indicates the target category selected for the target attack, Represents the gradient of the model’s loss function L() on the input image x with label category y.
[0109] Optionally, the conversion unit is specifically used to:
[0110] Filtering a low-frequency region of the warped frequency domain image to obtain a high-frequency warped frequency domain image;
[0111] The high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
[0112] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0113] The device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the method described in any embodiment of the present application.
[0114] The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method described in any embodiment of the present application.
[0115] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.
[0116] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0117] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0118] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. A method for generating adversarial samples, characterized in that: include: Acquire target image data represented in frequency domain; Using a preset warping transformation function and a predefined adversarial warping field to perform a warping transformation on the target image data to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions; The warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
2. The method according to claim 1, characterized in that The target image is warped using a preset warping transformation function and a countermeasure warping field, and the formula is as follows: D(x) w =W(D(x),M). Wherein, M is the adversarial warping field, which defines an offset for each pixel in the target image data, and the offset is used to characterize the position of the pixel in the warped frequency domain image obtained after the warping transformation; D(x) w is a warped frequency domain image, D(x) is the target image data represented in the frequency domain, W is a preset warping transformation function, and the warping transformation function uses a same sampling grid to add and sum M and perform normalized cropping operations.
3. The method according to claim 1, characterized in that The adversarial warp field is constructed in the following way: Determine k*k target points on the frequency domain image, and perform a random initialization operation on the target points to obtain an adversarial control grid; Normalizing the adversarial control grid, and forming a backward warping field according to the normalized adversarial control grid and the strength parameter; An upsampling operation is performed on the backward warped field and a clipping operation is performed on the backward warped field to obtain an adversarial warped field.
4. The method according to claim 1, characterized in that The method further comprises: Inputting the adversarial sample image into the target deep learning model to obtain an output result; The adversarial warp field is iteratively trained according to the output results.
5. The method according to claim 4, characterized in that The iterative training of the adversarial warp field according to the output result comprises: Iteratively training an adversarial control grid p′ in the adversarial warping field using gradient direction information; The formula for iterative training of the adversarial control grid p′ is as follows: Where λ is the step size of each iteration, L is the cross entropy loss function of the classifier model, y is the category label of the original clean image x, and p n ' represents the adversarial control grid of the nth iteration, p n+1 ' represents the adversarial control grid of the n+1th iteration. sign() represents the sign function that determines the direction of its gradient. IDCT represents the inverse discrete Fourier transform. D() represents the discrete Fourier transform. W represents the warping function. M represents the adversarial warping field. y adv Indicates the target category selected for the target attack, Represents the gradient of the model’s loss function L() on the input image x with label category y.
6. The method according to claim 1, characterized in that The method of converting the warped frequency domain image from the frequency domain to the spatial domain by using an inverse discrete cosine Fourier transform to obtain an adversarial sample image includes: Filtering a low-frequency region of the warped frequency domain image to obtain a high-frequency warped frequency domain image; The high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
7. A device for generating adversarial samples, characterized in that: include: An acquisition unit, used for acquiring target image data represented in frequency domain; A warping transformation unit, used to perform a warping transformation on the target image data using a preset warping transformation function and a predefined adversarial warping field to obtain a warped frequency domain image, wherein the warping transformation is used to move pixel points in the target image data so that the pixel points are mapped to new positions; The conversion unit is used to convert the warped frequency domain image from the frequency domain to the spatial domain by using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.
8. The device according to claim 7, characterized in that The adversarial warp field is constructed in the following way: Determine k*k target points on the frequency domain image, and perform a random initialization operation on the target points to obtain an adversarial control grid; Normalizing the adversarial control grid, and forming a backward warping field according to the normalized adversarial control grid and the strength parameter; An upsampling operation is performed on the backward warped field and a clipping operation is performed on the backward warped field to obtain an adversarial warped field.
9. The device according to claim 7, characterized in that The device also includes: An obtaining unit, used for inputting the adversarial sample image into a target deep learning model to obtain an output result; A training unit is used to iteratively train the adversarial warp field according to the output result.
10. The device according to claim 7, characterized in that The conversion unit is specifically used for: Filtering a low-frequency region of the warped frequency domain image to obtain a high-frequency warped frequency domain image; The high-frequency warped frequency domain image is converted from the frequency domain to the spatial domain using an inverse discrete cosine Fourier transform to obtain an adversarial sample image.