Visual attention mobility anti-attack method based on adaptive token fine tuning

Abstract

The invention relates to a visual attention mobility anti-attack method based on self-adaptive token fine tuning, which comprises the following steps of: constructing a feature important matrix by utilizing a proxy model middle layer, and generating a semantic-guided sparse mask; performing token-level point multiplication on the sparse mask and the initialized disturbance, and performing linear superposition on the sparse mask and the initialized disturbance and an original image to serve as initial input data; inputting the input data into the agent model for iterative training; in each round of iterative training, sparse masks are continuously updated, the number of discarded tokens is gradually increased, and gradient variance between layers in an agent module is reduced through gradient back propagation by using a gradient penalty factor and a balance factor. Meanwhile, self-adaptive truncation factor sets are designed for different modules of the agent model to weaken the attention mechanism of the model, and through T times of iterative training, a target loss function is maximized to obtain optimal mobility disturbance. Experiments prove that the method has better attack effect and mobility on the attack of the target model.

Description

Technical Field

[0001] The present invention relates to the field of deep learning and adversarial attacks, and in particular to a method for improving the transferability of a ViT model through adaptive token fine-tuning. Background Art

[0002] Vision Transformer (ViT) is the first to use the Transformer structure to build a computer vision model. It successfully extends the Transforme model from the field of natural language processing (NLP) to the field of computer vision (CV). Subsequently, ViT models of various structures have shown excellent performance in tasks such as image classification, object detection, semantic segmentation, and human pose estimation. Recent studies have shown that the performance of the ViT model is as susceptible to adversarial samples with transferability as the CNN model. In practical applications, in order to build a more robust ViT model, it is necessary to identify the defects of the model and conduct targeted training.

[0003] Currently, many effective attack methods have been designed for CNN models, but the effect is poor when directly applied to ViT models. The existing TGR method designs a method to regularize the gradient of the intermediate layer of the model, and performs gradient regularization on the three modules of Attention, QKV, and MLP, but the TGR method directly sets the maximum part of the gradient of each module to zero. This method causes the perturbation to fail to learn the most important feature information of the largest part of the gradient. Another ViT adversarial attack method based on input diversity, PatchOut, adopts a random discarding strategy to solve the problem of model overfitting. However, this strategy discards updates excessively, resulting in the learning perturbation not reaching the optimal level at the end of a limited number of iterations, without considering the efficiency and difficulty of the update. At the same time, the attention module in a specific layer of the ViT model is redundant for image classification and perturbation generation, which easily causes the generated model to overfit the alternative model. Summary of the invention

[0004] In view of the above problems existing in the prior art, the purpose of the present invention is to solve the technical problem of low transferability of the existing attack methods designed for visual attention models.

[0005] To achieve the above object, the present invention adopts the following technical solution: a visual attention transfer counterattack method based on adaptive token fine-tuning, comprising the following steps:

[0006] S1: Set up a loop to get a single image from the dataset each time, x irepresents the i-th image in the dataset. First, the feature importance matrix W is constructed using the intermediate layer of the proxy model. The semantically guided sparse mask w is generated according to the feature importance of each token. The perturbation δ is given an initial value. The sparse mask is then multiplied with the perturbation δ at the token level and then multiplied with x. i Perform linear superposition as initial input data Where w0 is the initial mask of the image, i=1,2,3,…N.

[0007] S2: The input proxy model is trained for T rounds of iterations, i = 1, 2, 3, ... N, t = 1, 2, 3, ... T.

[0008] S3: In each round of training, the sparse mask w is updated using a self-paced incremental patch dropout strategy, dynamically increasing the number of dropped tokens.

[0009] S4: In each round of training, the last layer of the proxy model is used as an anchor for backpropagation of gradients. The large gradients are reduced and the small gradients are amplified through the gradient penalty factor and the adaptive balancing factor, thereby reducing the gradient variance of all intermediate layers of the proxy model.

[0010] S5: In each round of training, the truncation factor is used to weaken the attention mechanism of the Attention module of the proxy model during the back propagation of the token gradient, so that the gradient of the QKV module or the MLP module becomes dominant, and the perturbation is updated by maximizing the loss function through gradient back propagation and will As the input for the next iteration, represents the i-th image in the t-th iteration, Represents image x i The perturbation obtained at the tth iteration is represents the sparse mask of the i-th image at the t-th iteration, t = 1, 2, 3, ... T; after T rounds of iterative training are completed, the output

[0011] S6: Create an adversarial sample set X′ for attacking the target model. The cycle will Input the target model. If the label output by the target model is the same as x i If the original label is different from that of , it means the attack is successful, otherwise it means the attack fails.

[0012] Furthermore, in S1, the method for constructing the feature importance matrix W is:

[0013]

[0014] Where C(l) represents the number of channels in the lth layer, Represents the gradient information of the image at layer l, Represents the l-th layer feature information of the image, l∈(0,L).

[0015] Furthermore, in S1, the method for obtaining the sparse mask w is:

[0016] Divide the input data of the proxy model into n blocks of tokens of specified size Then, according to the token blocks of the image, the feature importance matrix W is represented as a matrix of n token-level size:

[0017]

[0018] Where W p , They represent the feature importance matrix of the entire image and the feature importance matrix of the tokens in the image respectively.

[0019] The F-norm is used to measure each token Then normalize it to get the feature importance

[0020]

[0021] in represents the feature importance matrix of the i-th block of tokens, and denote the minimum and maximum values ​​of feature importance in n blocks of tokens, respectively. is the feature importance matrix of the j-th block token, 1 p is a tensor of size C×P×P containing all 1s.

[0022] Feature importance based on each token The total feature importance c of the original image is constructed, and the token discarding in each iterative training process is controlled by introducing the scaling factor α ≥ 0 and the drift coefficient β ≥ 0. The process of generating the sparse mask w is expressed as:

[0023] w=(qt<α·c-β)

[0024] where q t is a random variable sampled from a uniform distribution at the token level, and a semantically guided sparse mask w is generated for each training iteration through Boolean operations.

[0025] The sparse mask w generated by the t-th iteration training for the i-th block of tokens t The process is expressed as:

[0026]

[0027] in is the mask of the i-th token in the t-th iteration, Denote as a random variable sampled from a uniform distribution for the ith token, represents the feature importance of the i-th token, and then the mask w is obtained by looping through all tokens.

[0028] Furthermore, in S3, the method of using the self-stepping patch discarding strategy to update the sparse mask to dynamically increase the number of discarded tokens is:

[0029] A self-paced patch dropout strategy dynamically updates the semantically guided sparse mask in each round of training iteration:

[0030]

[0031] where w t represents the sparse mask generated by the t-th iteration training, c t The feature importance at the tth iteration, c is the feature importance of the original image, q t Indicates that at the tth iteration, A variable randomly sampled from Represents a uniform distribution at the token level.

[0032] N p (w t ) is w t The number of tokens discarded in the process must satisfy N as the number of iterations increases. p (w1) <N p (w2)<… <N p (w T ), that is, gradually discarding perturbed tokens to prevent overfitting of the perturbations generated by the proxy model.

[0033] Furthermore, in S4, in order to avoid losing important feature information when the gradient is directly set to 0, a mild gradient penalty factor γ∈(0,1) is used to scale the token gradient of a single layer in the proxy model to reduce the gradient variance:

[0034]

[0035] in represents the gradient of the ith token in the lth layer of the mth module of the proxy model, represents the gradient of the classification loss of the proxy model, Denotes the latent vector representation of the ith token of the lth layer of the m-module of the proxy model.

[0036] Since the last layer is most relevant to the final classification, the gradient of the last layer is selected as the anchor, and the gradient variance of all layers of the target model is reduced in turn through back propagation.

[0037]

[0038] in represents the token gradient variance of the lth layer in module m, and λ is an adaptive balancing factor to balance the relative importance between the gradient penalty factor and the gradient variance.

[0039] Furthermore, in S5, in order to weaken the attention mechanism of the Attention module in the proxy model, a truncation factor τ is designed. For m = Attention, when l∈{l′+1,…,L}, τ is set (l,m) is 0, and τ is set when l∈{1,…,l′} (l,m) Is non-zero.

[0040] To further reduce the variance of gradients in all layers, a truncation factor set is set for all layers of the proxy model For m = Attention, set For m = QKV or m = MLP, set At the same time, for the truncation factors of different modules, set τ (l,Attention) <max(τ (l,QKV) ,τ (l,MLP) ) to further weaken the attention mechanism of the training process, where τ (l′,m) represents the truncation factor of the l′th layer of the proxy model module m, τ (l,Attention) , τ (l,QKV) , τ (l,MLP) Respectively represent the truncation factors of Attention, QKV, and MLP modules at the lth layer.

[0041] Furthermore, in S6, the perturbation generated by T-times iterative training for a single image is Create an adversarial sample set X′ for attacking the target model. Will Input the target model. If the label output by the target model is the same as x i If the original label is different from that of , it means the attack is successful, otherwise it means the attack fails.

[0042] Compared with the prior art, the present invention has at least the following advantages:

[0043] 1. Compared with the TGR method designed specifically for the ViT model, the method of the present invention directly sets the maximum part of the gradient of each module to zero. However, the maximum part of the gradient in each module may be highly correlated with some feature information. Therefore, in the subsequent iterative training process, this part of the semantic information will be ignored, and the quality of the generated perturbation will eventually be damaged. To address this problem, the present invention proposes a method for adaptively reducing token gradients. During the training process, a large gradient variance will tend to overfit the proxy model, causing the perturbation update to fall into a local optimum and also reducing the mobility of adversarial attacks. The purpose of the method of the present invention is to reduce the overall gradient variance of all layers of the ViT model to improve the training effect.

[0044] 2. Most of the current adversarial attack methods are designed for CNN models. If they are directly applied to the ViT model, the effect and efficiency of the attack will be greatly reduced. However, the token gradient regularization method designed for the ViTs model simply sets the largest part of the gradient in each module to zero, so that the perturbation does not learn important feature information during the limited training process. The method of the present invention designs a gradient penalty factor to appropriately reduce the largest part of the gradient in the module so that the perturbation can be continuously optimized to avoid overfitting. By calculating the gradient variance of all layers of ViT, an adaptive balance factor is further designed to dynamically adjust the quotient of the gradient variance of the current layer and the next layer during the gradient back propagation process to update the gradient of the current layer. While retaining the important features of the largest part of the gradient, the training process is also stabilized.

[0045] 3. To enhance the input diversity of the ViTs model, previous methods update by randomly discarding tokens. However, this direct discarding method may discard some tokens containing important feature information, and does not consider the efficiency and difficulty of updating. The present invention combines the self-paced learning strategy with the feature importance of the image, and dynamically controls the number of discarded tokens according to the feature importance of the tokens in each round of iterative training. Under a limited training budget, perturbation can learn richer feature information.

[0046] 4. The present invention also weakens the attention modules of some layers in the ViTs model. A large number of attention modules in the ViTs model are redundant for image classification and perturbation generation tasks, which causes the model to over-focus on global information during training and cause overfitting. The present invention proposes a truncation and scaling strategy to weaken the attention mechanism, and adopts different truncation factor sets for different modules. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 The figure is a simplified flow chart of the method of the present invention.

[0048] Figure 2The success rate of attention truncation attack under different adaptive factors.

[0049] Figure 3 This is a comparison chart of the experimental attack effects. DETAILED DESCRIPTION

[0050] The present invention is described in further detail below.

[0051] The proxy models that can use the method of the present invention include but are not limited to the ViT model mentioned in the experiment, and the target models that can be made using the method of the present invention for attack include but are not limited to the ViT model and CNN model mentioned in the experiment.

[0052] Vision transformers (ViTs) have shown excellent performance in a variety of computer vision tasks, but the model is extremely vulnerable to adversarial attacks. Different CNN models are affected by adversarial samples with transferability, that is, adversarial samples made on proxy models can attack other black-box models and make the models make incorrect classifications. This phenomenon also occurs between ViT models. In order to improve the transferability of samples between ViTs models with different architectures, the following uses the ViT model as the target model to be attacked, and proposes a method to improve the transferability of the ViT model against adversarial attacks through adaptive token fine-tuning.

[0053] Compared with the TGR method designed specifically for the ViT model, the method of the present invention directly sets the maximum part of the gradient of each module to zero. However, the maximum part of the gradient in each module may be highly correlated with some feature information. Therefore, in the subsequent iterative training process, this part of the semantic information will be ignored, and the quality of the generated perturbation will eventually be damaged. To address this problem, the present invention proposes a method for adaptively reducing token gradients. During the training process, a large gradient variance will tend to overfit the proxy model, causing the perturbation update to fall into a local optimum while also reducing the mobility of adversarial attacks. The purpose of the method of the present invention is to reduce the overall gradient variance of all layers of the ViT model to improve the training effect.

[0054] First, we reduce the gradient variance of a single ViT layer. For the m modules in the middle layer l of the ViT model, we use represents the latent vector of the i-th token, and its corresponding gradient is expressed as in Represents the gradient of the objective loss function of the proxy model during the training process. This method reduces the maximum gradient by a mild gradient penalty factor γ∈(0,1). For m=QKV or m=KLP modules, the above token gradient is modified to For the m=Attent module, this method is consistent with the TGR approach, searching for the maximum gradient set S in the same row or column as the maximum gradient, so that the gradient in the set S is scaled to

[0055] The gradient variance of all layers of the ViT model is further reduced. Since the last layer of the ViT model is most relevant to classification, the last layer is selected as the anchor. Then the maximum gradient of all layers is adaptively scaled to ensure that its gradient variance is consistent with the variance of the previous layer. The method of adaptive variance reduction of token gradients for the tth iteration can be expressed as:

[0056]

[0057] in and They represent the token gradient variance of the lth layer and the l+1th layer in module m, respectively, and λ is the adaptive balancing factor. Finally, the token gradients of all layers of the ViT model are made smoother through an adaptive update strategy, while allowing the gradient to retain some of the feature information contained in the maximum gradient during the back propagation process, making the training process more stable.

[0058] The PatchOut attack reduces the overfitting of the proxy model caused by the perturbation during the training process by creating diverse inputs. Specifically, some patches in the adversarial perturbation are randomly discarded through a binary (0 or 1) mask w. This is a simple and effective method. However, the randomly discarded patches may contain important semantic feature information. Losing these patches will make it difficult to keep up with the perturbation, or it will not be possible to learn the optimal perturbation under a limited training budget (10 iterations of training). Therefore, under a limited training budget, the present invention proposes a semantically guided self-paced patch discarding strategy, which prevents patches containing important semantic feature information from being discarded to a certain extent.

[0059] Generate semantically guided sparse masks. Compared with using randomly generated sparse masks, the present invention first uses GradCAM technology to construct the feature importance matrix of the middle layer of the ViT model Where C(l) represents the number of channels in the lth layer, Represents the gradient information of the image at layer l, Represents the l-th layer feature information of the image, l∈(0,L). Further, according to the block of tokens, the feature importance matrix W is represented as a matrix of n token-level size Where W p , Represent the feature importance matrix of the entire image and the feature importance matrix of the tokens in the image respectively. The feature importance of the i-th token is calculated using the F-norm Then the feature importance of the tokens is normalized to facilitate the calculation process:

[0060]

[0061] in represents the normalized feature importance of the i-th token, represents the feature importance matrix of the i-th block of tokens, and are the minimum and maximum importance of n tokens, respectively. p is a tensor of size C×P×P with all values ​​set to 1. In order to control the number of discarded tokens, a scaling factor α≥0 and a drift factor β≥0 are introduced to control the discard of tokens during each iteration of training. To further improve the efficiency and effectiveness of training against perturbations, a dynamic pace is used to control the discard of tokens during each iteration of training. For the tth iteration, the sparse mask defined based on the importance of token features can be expressed as:

[0062]

[0063] where w t represents the sparse mask generated by the t-th iteration training, c t The feature importance at the tth iteration, c represents the original feature importance of the image, q t Indicates that at the tth iteration, A variable randomly sampled from Represents a uniform distribution at the token level. The generated semantically guided sparse mask not only provides diversified input but also prevents tokens containing important semantic feature information from being discarded. The strategy proposed in this paper effectively integrates self-paced learning into the training process and maximizes the adaptive loss function in each round of iterative training. The transferability of the generated adversarial perturbations between different models is further improved.

[0064] Feature-based adversarial attack research shows that not all features in deep learning models contribute positively to the generation of perturbations. On the other hand, previous research on the ViT model shows that the attention modules of certain specific layers in the ViT model are redundant for image classification and perturbation generation tasks, and their excessive focus on global features leads to overfitting. Based on this problem, the present invention proposes a weakening strategy of the attention mechanism to reduce the impact of attention on the perturbation training process.

[0065] Previous studies have shown that the shallow layers of the ViT model pay more attention to some general features, while the deep layers pay more attention to the features of specific models or specific tasks, and the learned features have stronger model or task dependencies. In order to remove the overfitting phenomenon caused by excessive global attention, the present invention multiplies the gradient of the deep layer of ViT with a truncation factor for truncation. Specifically, for the m = Attention module, for the deep layer, when l∈{l′+1,…,L}, τ is set (l,m) is 0, using hard truncation. For shallow layers, when l∈{1,…,l′}, set τ (l,m) is non-zero, and soft truncation is used. In this way, the dependence of the adversarial perturbation training process on the token gradient of the deep layer of the ViT model is weakened.

[0066] In order to effectively balance the impact of different modules on the perturbation training process, the present invention further proposes a hybrid gradient truncation strategy. Constrain the token gradients of different modules in all layers of ViT. For m = Attention, set For the deep network part, hard truncation (τ (l,m) =0,l>l′), and the shallow part is softly cut off (τ (l,m) >0,l≤l′). When m=QKV or m=MLP, set All layers in these two modules adopt a soft truncation strategy, which can continuously weaken the attention of the ViT model.

[0067] A method for improving the anti-attack transferability of a ViTs model based on adaptive token fine-tuning includes the following steps:

[0068] S1: Set up a loop to get a single image from the dataset each time, x i represents the i-th image in the dataset. First, the feature importance matrix W is constructed using the intermediate layer of the proxy model. The semantically guided sparse mask w is generated according to the feature importance of each token. The perturbation δ is given an initial value. The sparse mask is then multiplied with the perturbation δ at the token level and then multiplied with x. i Perform linear superposition as initial input data Where w0 is the initial mask of the image, i=1,2,3,…N;

[0069] S2: Perform T rounds of iterative training on the input proxy model, i = 1, 2, 3, ... N;

[0070] S3: In each round of training, the sparse mask w is updated using a self-paced incremental patch drop strategy to dynamically increase the number of dropped tokens;

[0071] S4: In each round of training, the last layer of the proxy model is used as an anchor for backpropagation of gradients. The large gradients are reduced and the small gradients are amplified through the gradient penalty factor and the adaptive balancing factor, thereby reducing the gradient variance of all intermediate layers of the proxy model.

[0072] S5: In each round of training, the truncation factor is used to weaken the attention mechanism of the Attention module of the proxy model during the back propagation of the token gradient, so that the gradient of the QKV module or the MLP module becomes dominant, and the perturbation is updated by maximizing the loss function through gradient back propagation and will As the input for the next iteration, represents the i-th image in the t-th iteration, Represents image x i The perturbation obtained at the tth iteration, t = 1, 2, 3, ... T; after T rounds of iterative training are completed, the output

[0073] S6: Create an adversarial sample set X′ for attacking the target model. Will Input the target model. If the label output by the target model is the same as x i If the original label is different from that of , it means the attack is successful, otherwise it means the attack fails.

[0074] Furthermore, in S1, the method for constructing the feature importance matrix W is:

[0075] In the iterative training process, in order to enhance input diversity and reduce the overfitting of the proxy model to the disturbance, the transferability of the adversarial disturbance is improved. First, the important feature matrix of the specific layer of the ViT model is constructed based on GradCAM, which can be expressed as:

[0076]

[0077] Where C(l) represents the number of channels in the lth layer. Taking the common RGB image as an example, the number of channels is 3, corresponding to the three components of red, green and blue, and their value range is 0-255. and They are the gradient and feature information of the image at layer l, respectively, l∈(0,L). Therefore, the feature importance matrix of an RGB image is the superposition of the gradient and feature information of the three channels.

[0078] Furthermore, in S1, the method for obtaining the sparse mask w is:

[0079] Since the ViT model requires the input of the image to be a block of tokens of a specified size,

[0080] Divide the input data of the proxy model into n blocks of tokens of specified size Then, according to the token blocks of the image, the feature importance matrix W is represented as a matrix of n token-level size:

[0082]

[0083] The F-norm can be used to measure the importance of each token feature matrix and then normalized to obtain

[0084]

[0085] Where W p , They represent the feature importance matrix of the entire image and the feature importance matrix of the tokens in the image respectively. p is a tensor of size C×P×P containing all 1s.

[0086] Further based on the feature importance of each token The total feature importance c of the original image is constructed, and the token discarding in each iterative training process is controlled by introducing the scaling factor α ≥ 0 and the drift coefficient β ≥ 0. The process of generating the sparse mask w is expressed as:

[0087] w=(q t <α·c-β)

[0088] where q t is a random variable sampled from a uniform distribution at the token level, and a semantically guided sparse mask w is generated for each training iteration through Boolean operations.

[0089] Specifically, the sparse mask w generated by the t-th iteration training for the i-th block token is t The process can be expressed as:

[0090]

[0091] in is the mask of the i-th token in the t-th iteration, Denote y as a random variable sampled from a uniform distribution for the ith token. represents the feature importance of the i-th token. Then the mask w is obtained by looping through all tokens. α≥0 and β≥0 are hyperparameters used to control the number of discarded tokens.

[0092] Furthermore, in S3, the method of using the self-stepping patch discarding strategy to update the sparse mask to dynamically increase the number of discarded tokens is:

[0093] In order to improve the efficiency and effectiveness of training against disturbances, a self-paced learning strategy is used. In each round of iterative training, an increasing mask w is defined t :

[0094]

[0095] where w t represents the sparse mask generated by the t-th iteration training, c t The feature importance at the tth iteration, c is the initial feature importance of the image, T is the number of iterations, q t Indicates that each iteration starts from A variable randomly sampled from represents a uniform distribution at the token level. N p (w t ) indicates w t The number of tokens discarded in the matrix (i.e., the number of 0 values ​​in the matrix). The expected value is used to control the number of tokens discarded, so the mask w t Approximately equal to As the number of iterations increases, the number of tokens discarded satisfies N p (w t ) <N p (w t+1 ), in order to speed up the updating efficiency of the disturbance and prevent overfitting.

[0096] Furthermore, in S4, if the gradient fluctuates greatly during the iterative training process, it will cause difficulty in model convergence and fail to learn the optimal perturbation. However, in optimizing the gradient variance, many methods only consider the gradient variance of the last updated perturbation, while ignoring the gradient variance during the back propagation process. Directly adjusting the final gradient often results in the destruction of feature information. The last layer of the ViT model is most relevant to the final classification, so the last layer is used as an anchor, and the intermediate gradients are gradually adjusted, which can retain the feature information to a great extent, making the perturbation more effective.

[0097] For the i-th card in the l-th layer of the m-module (m = {QKV, MLP, Attention}), the potential representation is Then the gradient corresponding to this layer can be expressed as In order to reduce the gradient variance and retain important feature information at the same time, a gradient penalty factor γ∈(0,1) is set to avoid the problem of feature loss caused by directly setting the largest part of the gradient to zero. Therefore, the gradient of the ViT layer in m=QKV or m=MLP can be expressed as:

[0098]

[0099] Furthermore, for all ViT layers, the variance is calculated with the gradient of the last layer as the anchor, and an adaptive balancing factor λ is introduced. The quotient of the variance of the gradients of the two adjacent layers is used to adjust the gradient layer by layer through gradient back propagation:

[0100]

[0101] Furthermore, S5 shows that some specific layers in the Attention module of the ViT model are redundant for image classification or perturbation generation tasks, and these attention layers will over-focus on global features. To avoid overfitting, the present invention designs a hard truncation strategy to multiply the gradient of the deep part of the Attention module with the truncation factor τ for attention truncation. For l∈{l′+1,…,L}, set τ (l,m) is 0, and τ is set when l∈{1,…,l′} (l,m) Is non-zero.

[0102] Specifically, to further reduce the total token gradient variance, a truncation factor set A hybrid gradient truncation strategy is introduced for all layers of each module in the ViT model. For m = Attention, set For the deep network part, hard truncation (τ (l,m) =0,l>l′), and the shallow part is softly cut off (τ (l,m) >0,l≤l′). When m=QKV or m=MLP, set All layers in these two modules adopt a soft truncation strategy. To continuously weaken the effectiveness of the attention mechanism, the truncation factor of the same layer in different modules is set to τ. (l,Attention) <max(τ (l,QKV) ,τ (l,MLP) ). Experimental results and analysis

[0103] Dataset and model selection: The selection of the dataset is consistent with the benchmark method experiment. 1,000 images of different categories are randomly selected from the ILSVRC2012 validation set to evaluate the method proposed in the present invention. The present invention selects 4 ViT models with different structures to produce adversarial samples, including ViT-B / 16, PiT-B, CaiTS / 24, and Visformer-S. Considering that the ViT model has a different architecture from the CNN model, the experiment divides the attack scenarios into two categories. For the attack on the ViT model, four models, DeiT-B, TNT-S, LeViT-256, and ConViT-B, are used as target models to test the transferability of the adversarial samples generated above. For the attack on the CNN model, four models, Inception-v3 (Inc-v3), Inception-v4 (Inc-v4), Inception-ResNet-v2 (IncRes-v2), and ResNet-v2-152 (Res-v2), are used for testing. The attack effects on three defense models, Inception-v3-ens3 (Inc-v3ens3), Inception-v4-ens4 (Inc-v4ens4), and Inception-ResNet-v2 (IncRes-v2adv), were further tested.

[0104] Benchmark method: The method of the present invention is designed to optimize the gradient, so three classic gradient attack methods, MI-FGSM (MIM), VMI-FGSM (VMI), and SGM, are selected for comparison. In order to demonstrate the effectiveness of the method proposed in the present invention, two currently most advanced ViT attack methods, PNA and TGR, are further selected for comparison.

[0105] Evaluation criteria and parameter settings: Consistent with the baseline method, the attack success rate (ASR) is used as the evaluation criterion for all migration comparison experiments. The perturbation is set to ∈ = 16, and the total number of iterations is T = 10, so the update step size of each parameter is All compared methods use momentum as a stable update strategy with a decay factor of μ=1.0, and the hyperparameter settings are consistent with the original method. The penultimate layer of the ViT model is selected to generate token-level feature importance. To compare with the PatchOut method, the number of tokens is set to 130 to ensure that the expected number of tokens discarded in the method of the present invention is larger than that of PatchOut. The standard ViT model has requirements on the input size of the image before partitioning, so we uniformly resize the image to 224×224 and the token size to 16×16. For the adaptive gradient variance reduction strategy, the gradient penalty factor is set to γ=0.5 and the adaptive balance factor is set to λ=0.01.

[0106] Transferability evaluation: First, the transferability of the proposed method was verified on the ViT model. The experimental results are shown in Table 1. Under the white-box setting, the proposed method achieved a 100% attack success rate. At the same time, it showed better transferability than other baseline methods under the black-box setting, and increased the attack success rate by 6.4% on average for the black-box model. It can be seen that all the benchmark methods that optimize the gradient have achieved good attack performance, especially the TGR method designed for the ViT model, which greatly improves the transferability of the attack. However, TGR directly sets the token with the maximum gradient part to zero, thereby preventing the perturbation from learning the most important feature information. In contrast, our method greatly retains the original feature information, and this method avoids the overfitting phenomenon caused by excessive gradients.

[0107] Table 1 shows the attack success rates of the proposed method and all the comparative methods on 8 different ViT models. '*' indicates white box setting

[0108]

[0109] In addition, the transferability of the method of the present invention was verified on the defenseless CNN model and the defense CNN model across models. As with the test on the ViTs model, the prepared adversarial samples were input into the target model to calculate the classification results. The attack results on the CNN model are shown in Table 2. The transferability of all comparison methods on the CNN model is significantly reduced, but the method of the present invention is still significantly better than all benchmark methods. The black-box attack success rate is increased by an average of 10.96%, which is higher than the transferability improvement ratio on the ViT model, indicating that the method is more advantageous for cross-model attacks. In addition to avoiding overfitting the proxy model, the method of the present invention also allows the perturbation to learn image features as much as possible, so that the perturbation can attack ViTs and better attack the CNN model. At the same time, the average attack success rate of the three proxy models on CNN exceeds 60%, among which the average attack success rate on the defense CNN model can reach up to 50.6%.

[0110] Table 2 shows the attack success rates of the method of the present invention and all the comparative methods on the defenseless CNN model and the defense CNN model.

[0111]

[0112] To further improve the transferability of the method of the present invention, based on the PatchOut random discarding strategy, we use the semantic information of the image as a guide, and introduce a self-paced learning strategy to make the learned perturbation more effective. The results are shown in Table 3. The black box attack success rate is increased by an average of 6.56%. Compared with the PatchOut strategy, the success rate is further increased by 4.18%.

[0113] Table 3 shows the average attack success rate of the random drop strategy on the ViT model, the defenseless CNN model and the defense CNN model. 'PO' represents the PatchOut strategy, and 'SPPO' represents the self-paced drop strategy proposed in this invention.

[0114]

[0115] Ablation experiments: We designed three sets of ablation experiments to verify the effectiveness of the proposed method, namely (1) adaptive factor, (2) attention truncation, and (3) attack on different modules of ViT.

[0116] (1) Adaptive factor λ: The role of the adaptive factor λ in guiding the gradient variance between different layers to be smoother was explored in the ViT-B model. Experiments have found that a larger adaptive factor has a better effect on gradient smoothing, and similar effects are also found in other modules of ViT. However, in cross-model experiments, it was found that smoother gradients do not necessarily have better transferability. Over-balanced gradient variance can lead to changes in the training process and loss of some important features. In order to balance the relationship between gradient variance and attack performance, the experiment sets λ = 0.01.

[0117] (2) Attention truncation: The attention module of the ViT model may have redundancy, which may lead to perturbation overfitting in the proxy model. We adopt a truncation strategy to truncate some attention layers in the ViT model. Considering the differences between the models, we conducted ablation experiments on the four proxy models with different truncation layers. Figure 2 As shown in the figure, three of the models need to be partially truncated to achieve better transferability. The Visformer-S model only performs attention scaling without truncation to achieve the best results. We believe that this is because the model has a shallow number of layers and scaling is sufficient to improve the overfitting caused by the attention mechanism.

[0118] (3) Attacking different modules of ViT: The experiment used four proxy models to conduct ablation experiments and calculated the average attack success rate on all black-box ViTs, defenseless CNNs and defense CNNs. Table 4 shows the experimental results on ViT-B. Attacking the attention module can greatly improve the transferability of adversarial perturbations.

[0119] Table 4 shows the average attack success rate of attack calculations on different modules on the ViT-B model.

[0120]

[0121] Analysis of attack efficiency and effect: The experiment used the ViT-B / 16 model to generate adversarial samples and retained the intermediate results of 10 iterations. Figure 3The classification probabilities of the method of the present invention and the TGR(PO) method in the perturbation token discarding process are shown. In each round of iteration, the class activation map of the unlabeled adversarial sample is generated by GradCAM on CaiT-S / 24. The experimental results show that the method of the present invention only needs 5 rounds of iterations to make the model give an incorrect classification, while the TGR(PO) method needs 9 rounds. After 10 rounds of iterations, the confidence of the wrong label of the method of the present invention is also higher than that of the TGR(PO) method. These two results show that the method of the present invention has both higher efficiency and higher attack effect.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A visual attention transfer adversarial attack method based on adaptive token fine-tuning, characterized in that: The steps include: S1: Set up a loop to get a single image from the dataset each time, x i represents the i-th image in the dataset. First, the feature importance matrix W is constructed using the intermediate layer of the proxy model. The semantically guided sparse mask w is generated according to the feature importance of each token. The perturbation δ is given an initial value. The sparse mask is then multiplied with the perturbation δ at the token level and then multiplied with x. i Perform linear superposition as initial input data Where w0 is the initial mask of the image, i=1, 2, 3, ...N; S2: Perform T rounds of iterative training on the input proxy model, i = 1, 2, 3, ... N, t = 1, 2, 3, ... T; S3: In each round of training, the sparse mask w is updated using a self-paced incremental patch drop strategy to dynamically increase the number of dropped tokens; S4: In each round of training, the last layer of the proxy model is used as an anchor for backpropagation of gradients. The large gradients are reduced and the small gradients are amplified through the gradient penalty factor and the adaptive balancing factor, thereby reducing the gradient variance of all intermediate layers of the proxy model. S5: In each round of training, the truncation factor is used to weaken the attention mechanism of the Attention module of the proxy model during the back propagation of the token gradient, so that the gradient of the QKV module or the MLP module becomes dominant, and the perturbation is updated by maximizing the loss function through gradient back propagation. and will As the input for the next iteration, represents the i-th image in the t-th iteration, Represents image x i The perturbation obtained at the tth iteration is represents the sparse mask of the i-th image at the t-th iteration, t = 1, 2, 3, ... T; after T rounds of iterative training are completed, the output S6: Create an adversarial sample set X′ for attacking the target model. The cycle will Input the target model. If the label output by the target model is the same as x i If the original label is different from that of , it means the attack is successful, otherwise it means the attack fails.

2. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 1, characterized in that: In S1, the method for constructing the feature importance matrix W is: Where C(l) represents the number of channels in the lth layer, Represents the gradient information of the image at layer l, Represents the l-th layer feature information of the image, l∈(0,L).

3. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 2, characterized in that: In S1, the method for obtaining the sparse mask w is: Divide the input data of the proxy model into n blocks of tokens of specified size Then, according to the token blocks of the image, the feature importance matrix W is represented as a matrix of n token-level size: Where W p , Represent the feature importance matrix of the entire image and the feature importance matrix of the tokens in the image respectively; The F-norm is used to measure each token The feature importance of is then normalized to obtain in represents the feature importance matrix of the i-th block of tokens, and Represents the minimum and maximum value of feature importance in n blocks of tokens, 1 p is a tensor of size C×P×P with all values ​​1; Feature importance based on each token The total feature importance c of the original image is constructed, and the token discarding in each iterative training process is controlled by introducing the scaling factor α ≥ 0 and the drift coefficient β ≥ 0. The process of generating the sparse mask w is expressed as: w=(q t (α·c-β) where q t is a random variable sampled from a uniform distribution at the token level; The sparse mask w generated by the t-th iteration training for the i-th block of tokens t The process is expressed as: in is the mask of the i-th token in the t-th iteration, Denote as a random variable sampled from a uniform distribution for the ith token, represents the feature importance of the i-th token.

4. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 3, characterized in that: In S3, the method of using the self-stepping patch discarding strategy to update the sparse mask to dynamically increase the number of discarded tokens is: A self-paced patch dropout strategy dynamically updates the semantically guided sparse mask in each round of training iteration: where w t represents the sparse mask generated by the t-th iteration training, c t The feature importance at the tth iteration, c is the feature importance of the original image, q t Indicates that at the tth iteration, A variable randomly sampled from Represents a uniform distribution at the token level.

5. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 4, characterized in that: In S4, a mild gradient penalty factor γ∈(0,1) is used to scale the token gradient of a single layer in the proxy model to reduce the gradient variance: in represents the gradient of the i-th token in the m-th layer of the proxy model, represents the gradient of the classification loss of the proxy model, represents the latent vector representation of the ith token of the ith layer of the m-th module of the proxy model; Reduce the gradient variance of all layers of the target model sequentially through back-propagation; in represents the token gradient variance of the,th layer in module m, and λ is the adaptive balancing factor.

6. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 5, characterized in that: In S5, a truncation factor τ is designed. For m = AAttention, when l∈{l′+1,…,L}, τ is set (l，m) is 0, and τ is set when l∈{1,…,l′} (l，m) is non-zero; For m = Attention, set For m = QKV or m = MLP, set At the same time, for the truncation factors of different modules, set τ (l，Attention) <max(τ (l,QKV) , τ (l,MLP) ) to further weaken the attention mechanism of the training process, where τ (l′，m) represents the truncation factor of the l′th layer of the proxy model module m, τ (l,Attention) , τ (l,QKV) , τ (l,MLP ) represent the truncation factors of Attention, QKV, and MLP modules at the lth layer respectively.

7. The method for countering visual attention transfer attacks based on adaptive token fine-tuning according to claim 6, characterized in that: In S6, the perturbation generated by T iterations of training is used for a single image. Create an adversarial sample set X′ for attacking the target model. Will Input the target model. If the label output by the target model is the same as x i If the original label is different from that of , it means the attack is successful, otherwise it means the attack fails.

Images