An attention enhancement-based data-free black-box adversarial sample generation method

Abstract

This invention relates to fields such as AI adversarial techniques, and discloses a data-free black-box adversarial example generation method based on attention enhancement, comprising: randomly sampling a noise space, inputting it into a generator to generate synthetic data. ; Utilizing synthetic data Query black-box target model The system calculates the decision output and caches the input-output pairs; it strengthens the alternative model using an attention enhancement module and trains the enhanced alternative model; it trains the generator using a joint structural information learning strategy; it replays the cached input-output pairs to further train the enhanced alternative model; it employs a white-box attack strategy to construct adversarial examples on the enhanced alternative model and transfers them to the black-box target model to carry out the attack; it overcomes the problems of low learning efficiency of existing alternative models for different synthetic data, poor diversity of synthetic data generated by the generator, and low training efficiency of alternative models, and by optimizing the learning strategies of the alternative model and the generator, the optimized alternative model can accurately simulate the decision output of the black-box target model.

Description

A Data-Free Black-Box Adversarial Example Generation Method Based on Attention Enhancement Technical Field

[0001] This invention relates to fields such as artificial intelligence adversarial technology, and more specifically, to a method for generating data-free black-box adversarial examples based on attention enhancement. Background Technology

[0002] Deep neural networks (DNNs) have achieved excellent results in various tasks such as face recognition and autonomous driving. However, recent research (Szegedy C, Zaremba W, Sutskever I, et al. Intriguing properties of neural networks[J]. arXiv preprint arXiv:1312.6199,2013.) shows that deep neural networks are vulnerable to adversarial attacks. Adversarial examples can be created by adding imperceptible noise to normal samples, causing the target deep neural network to make incorrect predictions. Because it is difficult for the human eye to detect, it poses a serious threat to the widespread application of deep learning in real life. For example, modifying traffic signs in autonomous driving (Liu A, Liu X, Fan J, et al. Perceptual-sensitive gan for generating adversarial patches[C] / / Proceedings of the AAAI conference on artificial intelligence. 2019, 33(01): 1028-1035.) poses a risk to both cars and pedestrians. Attackers could also use it to change the bias of models in closed test sets. Therefore, research on adversarial attacks and robustness of deep neural networks is receiving increasing attention from researchers.

[0003] Existing adversarial attack methods can be divided into white-box attacks and black-box attacks (Li, Y., Cheng, M., Hsieh, C.-J., Lee, TC: A review of adversarial attack and defense for classification methods. The American Statistician 76(4), 329–345(2022)). After understanding the structure and parameters of the target DNNs, adversarial examples can be generated in a white-box manner, including optimization-based methods such as C&W (Carlini N, Wagner D. Towards evaluating the robustness of neural networks[C] / / 2017 ieee symposium on security and privacy (sp). ieee, 2017: 39-57.) and gradient-based methods such as PGD (Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J]. arXiv preprint arXiv:1706.06083,2017.). In a black-box scenario, the attacker is unaware of the target model's structure and has limited access to model parameters or intermediate layer features. The only thing the attacker can use is the probability / label output by the target model.To more effectively attack target models in black-box scenarios, methods based on training alternative models have been continuously proposed (Papernot N, McDaniel P, Goodfellow I, et al. Practical black-box attacks against machine learning[C] / / Proceedings of the 2017 ACM on Asia conference on computer and communications security. 2017: 506-519.)(Dong Y, Pang T, Su H, et al. Evading defenses to transferable adversarial examples by translation-invariant attacks[C] / / Proceedings of the IEEE / CVF conference on computer vision and pattern recognition. 2019: 4312-4321.). Due to transferability, adversarial examples generated based on alternative models can also mislead the target model, even if the structure and parameters of the alternative model are different from those of the target model.

[0004] Previous work (Dong Y, Pang T, Su H, et al. Evading defenses to transferable adversarial examples by translation-invariant attacks[C] / / Proceedings of the IEEE / CVF conference on computer vision and pattern recognition. 2019: 4312-4321.)(Orekondy T, Schiele B, Fritz M. Knockoff nets: Stealing functionality of black-box models[C] / / Proceedings of the IEEE / CVFconference on computer vision and pattern recognition. 2019: 4954-4963.) has mostly focused on using real training data to query the target model to train alternative models for attacks. However, due to privacy and security issues, it is difficult to obtain the training data of the target model. Nevertheless, existing methods still face the following two challenges:

[0005] (1) Traditional alternative model structures lack adaptability to different synthetic data: Since the training data of the target model is unknown, when using a large amount of synthetic data to train the alternative model, it is impossible to effectively distinguish and utilize the valuable information of different levels and types contained in these data, which limits its attack effect.

[0006] (2) Lack of diversity in synthetic data: To achieve a higher attack success rate, it is crucial that the decision boundary of the alternative model is as similar as possible to the target model. Good diversity in synthetic data helps the alternative model to get closer to the decision boundary of the target model. Conversely, a lack of diversity in synthetic data, including class imbalance, hinders the effective training of the alternative model and affects the effectiveness of the attack. Summary of the Invention

[0007] The applicant declares that this invention is used under legal circumstances.

[0008] The purpose of this invention is to address the shortcomings of existing technologies by providing a data-free black-box adversarial example generation method based on attention enhancement. By introducing an attention enhancement module, the alternative model selectively focuses on important parts of the input data during processing, thereby extracting more valuable information for the current target and optimizing the processing effect and performance of the alternative model. Through the proposed joint structural information learning strategy, the invention aims to explore the differences in how alternative models process data. This method can capture more valuable information for the generator, thereby promoting its learning process and improving the diversity of synthesized data. Finally, adversarial examples are carefully constructed on the alternative models and transferred to the black-box target model for attack, achieving a data-free black-box attack based on attention enhancement.

[0009] This invention is achieved through the following technical solution: a method for generating data-free black-box adversarial examples based on attention enhancement, comprising the following specific steps:

[0010] 1) Randomly sample noise space and input it into generator G to generate synthetic data. ;

[0011] 2) Utilizing synthetic data Query black-box target model The decision output is cached, and the input-output pairs are buffered.

[0012] 3) Enhance the alternative model S using the attention enhancement module, and train the enhanced alternative model S;

[0013] 4) Train the generator G using a joint structural information learning strategy;

[0014] 5) Replay the buffered input-output pairs to further train the alternative model S;

[0015] 6) Employ white-box attack strategies to construct adversarial examples on the enhanced alternative model S and then transfer them to the target model to carry out the attack.

[0016] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following configuration is specifically adopted: Step 1) specifically involves randomly sampling noise vectors from a noise space that follows a standard normal distribution. The input noise vector is fed into generator G, which receives the input noise vector. Generate synthetic data The generator G uses a basic architecture consisting of three convolutional layers, with the convolutional layers and linear upsampling layers interleaved, and a batch normalization layer and a ReLU activation function added after all layers except the last one.

[0017] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 2) specifically includes the following steps:

[0018] 2.1) Synthesize the data Input into the black-box target model Query its decision output Among them, decision output It could be a hard label or a soft label that outputs the predicted probability;

[0019] 2.2) Black-box target model Decision output As synthetic data The tag, with As sample label pairs for subsequent training;

[0020] 2.3) Set up a circular buffer of a certain length to store the target model of the query black box. Return output and synthesized data ,Right now( , ).

[0021] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following configuration is specifically adopted: Step 3) includes the following steps:

[0022] 3.1) Attention enhancement module for synthetic data As input, the data is passed through a global pooling layer, a linear layer, and a sigmoid function in sequence to generate a feature weight mask.

[0023] 3.2) During the forward propagation of the substitution model S, the input synthetic data is first processed. Perform a convolution operation, and then multiply the result of the convolution with the feature weight mask element by element.

[0024] 3.3) The result of the multiplication operation is then passed to subsequent layers of the alternative model S for forward propagation, ultimately yielding the prediction result of the alternative model. And by measuring the loss, the decision output of the black-box objective model T is minimized. and alternative model prediction results The difference is used to train the replacement model S; and the loss is expressed as:

[0025] ;

[0026] Where, if the decision output T(x) is a hard label, then D is the cross-entropy loss function; if the decision output T(x) is a soft label, then D is... loss function, and The loss function is the absolute error loss function.

[0027] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following configuration is specifically adopted: The attention enhancement module uses a set of lightweight operations to extract features from the input data, and the specific calculation process is as follows:

[0028] ;

[0029] in, For attention enhancement modules, This represents a global average pooling operation based on channel features. and These are the weights and biases of the linear layer; represents the sigmoid function, which maps eigenvalues ​​to an output between 0 and 1, where x is the synthetic data.

[0030] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 4) specifically includes:

[0031] 4.1) First, directly calculate the Kullback-Leibler (KL) divergence difference between the decision output T(x) of the alternative model S and the black-box target model T;

[0032] 4.2) The input data is processed using global average pooling to obtain the feature values ​​of each channel, and the results are flattened into a two-dimensional tensor. At the same time, the output confidence is normalized. Through broadcasting and subtraction, the feature value tensor of each image and the output confidence are combined into joint structural information.

[0033] 4.3) Construct a distance matrix using joint structural information, where each element represents the Euclidean distance between samples; calculate the mean squared error loss between each pair of combinations based on the distances in these joint structural information; finally, train the generator G using the mean squared error loss between the Kullback-Leibler (KL) divergence difference and the joint structural information.

[0034] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following settings are specifically adopted: The specific calculation process of the joint structure information is as follows:

[0035] ;

[0036] ;

[0037] Where B represents the amount of training data in each training iteration; This represents a single image in the set of training data; This represents the output of the corresponding model; This indicates a global average pooling operation; The joint structural features represent the matrix formed by merging the features extracted from the input image through global pooling with the output of the alternative model S; A is defined as each synthetic data joint structural features Between The matrix formed by norm distance; the loss function of generator G is expressed as:

[0038] ;

[0039] Where D is the metric function. If the decision output T(x) of the black-box target model T is a label, the cross-entropy loss function is used for measurement; if the decision output T(x) of the black-box target model T is a probability value, the Kullback-Leibler (KL) divergence difference is used for measurement; MSE is the mean squared error loss function, used to measure the difference between the norm distances of two sets; by widening the gap between the synthetic data and the original predicted values, and increasing the difference in joint structural information of the synthetic data x, the generator G can synthesize more diverse data.

[0040] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 5) specifically includes:

[0041] 5.1) Randomly sample images and their corresponding black-box target model T output pairs from the circular buffer;

[0042] 5.2) Input the image into a network consisting of an attention enhancement module and an alternative model S, and train it based on the difference between the network output and the output of the black-box target model T until the alternative model S converges.

[0043] To further improve the data-free black-box adversarial example generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 6) includes the following specific steps:

[0044] 6.1) After step 5), adversarial examples are generated on the trained surrogate model S using a white-box iterative attack algorithm. Specifically, it is expressed as follows:

[0045] ;

[0046] ;

[0047] Where X is the sample to be attacked. This represents the initial attack sample (i.e., the sample that has not yet undergone iterations, with an iteration count of 0); n represents the nth iteration. The gradient of the obtained adversarial sample with respect to label y, For sign removal operation, As a hyperparameter, clip indicates that adversarial perturbations will be clipped to not exceed the perturbation constraint;

[0048] 6.2) After the iteration is completed, the final adversarial example will be generated. Input black-box target model This induces the user to make misleading decisions, successfully carrying out a highly efficient black-box attack without data.

[0049] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0050] (1) This invention enables successful data-free black-box attacks on a given black-box target model. Data-free means that no information related to the training data of the black-box target model can be accessed. This strict setting is more in line with the requirements of real-world scenarios, especially now that privacy data protection is receiving increasing attention. In this case, the attacker trains an alternative model by using synthetic data.

[0051] (2) This invention utilizes the attention mechanism to enhance the substitution model and trains the enhanced substitution model, overcoming the problem that the traditional substitution model structure lacks adaptability to different synthetic data and is insufficient in attack efficiency; it introduces an attention enhancement module, which assigns comprehensive feature values ​​to different synthetic data. The feature values ​​represent the importance of a given image, rather than treating all data as equally important, thus overcoming the problem of lack of adaptability to different synthetic data.

[0052] (3) This invention uses a joint structure information learning strategy to train the generator, which overcomes the problem of poor diversity of synthesized data in traditional synthesis methods; it proposes a joint structure information learning strategy to enable the generator to deeply mine valuable information from joint structure features, thereby improving the diversity of synthesized data and overcoming the problem of poor diversity of synthesized data in traditional synthesis methods.

[0053] (4) This invention generates adversarial samples by implementing a white-box attack algorithm on an alternative model. Under the premise of ensuring the concealment of the attack, it transfers the attack to a high-complexity and high-precision target black-box model and achieves the purpose of misleading the target model's classification decision under the condition of no data.

[0054] (5) This invention overcomes the problems of low learning efficiency of existing alternative models for different synthetic data, poor diversity of synthetic data generated by generators, low training efficiency of alternative models, and weak attack concealment. By optimizing the learning strategies of alternative models and generators, the optimized alternative models can accurately simulate the decision output of the target model and carry out transfer attacks on the target model, which is a technical difficulty of dataless black-box attacks based on attention enhancement.

[0055] (6) This invention realizes a data-free black-box attack based on attention enhancement, providing a novel perspective for discovering the vulnerability of deep neural network models in the field of image classification. It can enhance the attack capability on the target model while improving the robustness of the local model against malicious attacks through corresponding defense measures. Attached Figure Description

[0056] Figure 1 is a flowchart of the data-free black-box adversarial example generation method based on attention enhancement.

[0057] Figure 2 is a framework diagram of a data-free black-box adversarial example generation method based on attention enhancement.

[0058] Figure 3 illustrates the lack of diversity in synthetic data and the inadequate fit of alternative models.

[0059] Figure 4 shows the simulation results of sample classification generated by the attention-enhanced data-free black-box adversarial sample generation method (AEA) and the baseline method (DST).

[0060] In Figure 2, The loss function used by the generator The loss function used in the alternative model; in Figure 4, AEA represents the method proposed in this invention, while DST is the benchmark method used for comparison. Detailed Implementation

[0061] The present invention will be further described in detail below with reference to embodiments, but the implementation of the present invention is not limited thereto.

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to represent selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0064] Example 1:

[0065] This invention presents a data-free black-box adversarial example generation method based on attention enhancement. The method generally consists of three parts: data synthesis, querying the black-box target model, and substitution training. First, substitution data is synthesized, which will be used to query the black-box target model. Then, the substitution model is trained based on the output of the black-box target model on this data. Regarding the black-box target model, since it is unknown to the attacker, a large-scale substitution model is selected to ensure the sufficiency and effectiveness of knowledge transfer. By introducing an attention enhancement module in the substitution training part, the substitution model selectively focuses on important parts of the input data when processing data, thereby extracting more valuable information for the current target and optimizing the processing effect and performance of the substitution model. This invention employs a set of lightweight operations to implement the attention enhancement module. Specifically, global pooling and linear layers are used, and finally, the input image is mapped to the corresponding feature values ​​through the sigmoid function. Furthermore, by introducing the proposed joint structural information learning strategy in the substitution training, the aim is to explore the differences in how the substitution model processes data. This method can capture more valuable information for the generator, thereby promoting its learning process and improving the diversity of the synthesized data. As shown in Figure 3, when the samples synthesized by the generator lack sufficient diversity, the decision boundary of the trained alternative model cannot accurately fit the decision boundary of the black-box target model, which directly affects the effectiveness of the subsequently generated adversarial examples. An improved method is used to carefully construct adversarial examples on the trained alternative model and transfer them to the black-box target model to carry out the attack, thereby achieving a data-free black-box attack based on attention enhancement, as shown in Figures 1 and 2, including the following steps:

[0066] 1) Randomly sample noise space and input it into generator G to generate synthetic data. ;

[0067] 2) Utilizing synthetic data Query black-box target model The decision output is cached, and the input-output pairs are buffered.

[0068] 3) Enhance the alternative model S using the attention enhancement module, and train the enhanced alternative model S;

[0069] 4) Train the generator G using a joint structural information learning strategy;

[0070] 5) Replay the buffered input-output pairs to further train the alternative model S;

[0071] 6) Employ white-box attack strategies to construct adversarial examples on the enhanced alternative model S and then transfer them to the target model to carry out the attack.

[0072] Example 2:

[0073] This embodiment is a further optimization based on the above embodiment. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 1) specifically involves: randomly sampling noise vectors from a noise space that follows a standard normal distribution. The input noise vector is fed into generator G, which receives the input noise vector. Generate synthetic data The generator G uses a basic architecture consisting of three convolutional layers, with the convolutional layers and linear upsampling layers interleaved, and a batch normalization layer and a ReLU activation function added after all layers except the last one.

[0074] Example 3:

[0075] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 2) specifically includes the following steps:

[0076] 2.1) Synthesize the data Input into the black-box target model Query its decision output Among them, decision output It could be a hard label or a soft label that outputs the predicted probability;

[0077] 2.2) Black-box target model Decision output As synthetic data The tag, with As sample label pairs for subsequent training;

[0078] 2.3) Set up a circular buffer of a certain length to store the target model of the query black box. Return output and synthesized data ,Right now( , ).

[0079] Example 4:

[0080] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 3) includes the following steps:

[0081] 3.1) Attention enhancement module for synthetic data As input, the data is passed through a global pooling layer, a linear layer, and a sigmoid function in sequence to generate a feature weight mask.

[0082] 3.2) During the forward propagation of the substitution model S, the input synthetic data is first processed. Perform a convolution operation, and then multiply the result of the convolution with the feature weight mask element by element.

[0083] 3.3) The result of the multiplication operation is then passed to subsequent layers of the alternative model S for forward propagation, ultimately yielding the prediction result of the alternative model. And by measuring the loss, the decision output of the black-box objective model T is minimized. and alternative model prediction results The difference is used to train the replacement model S; and the loss is expressed as:

[0084] ;

[0085] Where, if the decision output T(x) is a hard label, then D is the cross-entropy loss function; if the decision output T(x) is a soft label, then D is... loss function, and The loss function is the absolute error loss function.

[0086] Example 5:

[0087] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better implement the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following setting is specifically adopted: The attention enhancement module uses a set of lightweight operations to extract features from the input data. The specific calculation process is as follows:

[0088] ;

[0089] in, For attention enhancement modules, This represents a global average pooling operation based on channel features. and These are the weights and biases of the linear layer; represents the sigmoid function, which maps eigenvalues ​​to an output between 0 and 1, where x is the synthetic data.

[0090] Example 6:

[0091] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following setting is specifically adopted: Step 4) specifically includes:

[0092] 4.1) First, directly calculate the Kullback-Leibler (KL) divergence difference between the decision output T(x) of the alternative model S and the black-box target model T;

[0093] 4.2) The input data is processed using global average pooling to obtain the feature values ​​of each channel, and the results are flattened into a two-dimensional tensor. At the same time, the output confidence is normalized. Through broadcasting and subtraction, the feature value tensor of each image and the output confidence are combined into joint structural information.

[0094] 4.3) Construct a distance matrix using joint structural information, where each element represents the Euclidean distance between samples; calculate the mean squared error loss between each pair of combinations based on the distances in these joint structural information; finally, train the generator G using the mean squared error loss between the Kullback-Leibler (KL) divergence difference and the joint structural information.

[0095] As shown in Figure 4, the simulation experiment reveals differences in the number of categories for different types of images, which may be due to the varying difficulty of synthesizing images of different categories. Even so, the samples synthesized by the method described in this invention exhibit a more uniform category distribution than the baseline method. Therefore, the method proposed in this invention can generate samples with higher diversity.

[0096] Example 7:

[0097] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following settings are specifically adopted: The specific calculation process of the joint structure information is as follows:

[0098] ;

[0099] ;

[0100] Where B represents the amount of training data in each training iteration; This represents a single image in the set of training data; This represents the output of the corresponding model; This indicates a global average pooling operation; The joint structural features represent the matrix formed by merging the features extracted from the input image through global pooling with the output of the alternative model S; A is defined as each synthetic data joint structural features Between The matrix formed by norm distance; the loss function of generator G is expressed as:

[0101] ;

[0102] Where D is the metric function. If the decision output T(x) of the black-box target model T is a label, the cross-entropy loss function is used for measurement; if the decision output T(x) of the black-box target model T is a probability value, the Kullback-Leibler (KL) divergence difference is used for measurement; MSE is the mean squared error loss function, used to measure the difference between the norm distances of two sets; by widening the gap between the synthetic data and the original predicted values, and increasing the difference in joint structural information of the synthetic data x, the generator G can synthesize more diverse data.

[0103] Example 8:

[0104] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following setting is specifically adopted: Step 5) specifically includes:

[0105] 5.1) Randomly sample images and their corresponding black-box target model T output pairs from the circular buffer;

[0106] 5.2) Input the image into a network consisting of an attention enhancement module and an alternative model S, and train it based on the difference between the network output and the output of the black-box target model T until the alternative model S converges.

[0107] Example 9:

[0108] This embodiment is a further optimization based on any of the above embodiments. The similarities with the aforementioned technical solutions will not be repeated here. As shown in Figures 1 and 2, to better realize the data-free black-box adversarial sample generation method based on attention enhancement described in this invention, the following settings are specifically adopted: Step 6) includes the following specific steps:

[0109] 6.1) After step 5), adversarial examples are generated on the trained surrogate model S using a white-box iterative attack algorithm. Specifically, it is expressed as follows:

[0110] ;

[0111] ;

[0112] Where X is the sample to be attacked. This represents the initial attack sample (i.e., the sample that has not yet undergone iterations, with an iteration count of 0); n represents the nth iteration. The gradient of the obtained adversarial sample with respect to label y, For sign removal operation, As a hyperparameter, clip indicates that adversarial perturbations will be clipped to not exceed the perturbation constraint;

[0113] 6.2) After the iteration is completed, the final adversarial example will be generated. Input black-box target model This induces the user to make misleading decisions, successfully carrying out a highly efficient black-box attack without data.

[0114] Example 10:

[0115] A data-free black-box adversarial example generation method based on attention enhancement, as shown in Figures 1 and 2, includes the following steps:

[0116] A. Randomly sample noise space, and the generator produces synthetic data:

[0117] Randomly sample noise vectors from a noise space that follows a standard normal distribution. In generator G, generator G receives the input noise vector. Generate synthetic data The generator G uses a basic architecture consisting of three convolutional layers, with the convolutional layers and linear upsampling layers interleaved, and a batch normalization layer and a ReLU activation function added after all layers except the last one.

[0118] B. Query the target model and cache the input / output pairs:

[0119] Synthetic data Input into the black-box target model Query its decision output Among them, decision output It could be a hard label or a soft label that outputs the predicted probability;

[0120] black box target model Decision output As synthetic data The tag, with As sample label pairs for subsequent training;

[0121] Set a circular buffer of a certain length to store the target model of the query black box. Return output and synthesized data ,Right now( , ).

[0122] C. Train the generator using a joint structure learning strategy:

[0123] First, the Kullback-Leibler (KL) divergence difference between the decision output T(x) of the alternative model S and the black-box target model T is directly calculated;

[0124] Secondly, the input data is processed using global average pooling to obtain the feature values ​​of each channel, and the results are flattened into a two-dimensional tensor. At the same time, the output confidence is normalized. Through broadcasting and subtraction, the feature value tensor of each image and the output confidence are combined into joint structural information.

[0125] Finally, a distance matrix is ​​constructed using the joint structural information, where each element represents the Euclidean distance between samples. Based on the distance between each pair of combinations in the joint structural information, the mean squared error loss between them is calculated. Finally, the generator G is trained using the mean squared error loss between the Kullback-Leibler (KL) divergence difference and the joint structural information.

[0126] The specific calculation process for the joint structure information is as follows:

[0127] ;

[0128] ;

[0129] Where B represents the amount of training data in each training iteration; This represents a single image in the set of training data; This represents the output of the corresponding model; This indicates a global average pooling operation; The joint structural features represent the matrix formed by merging the features extracted from the input image through global pooling with the output of the alternative model S; A is defined as each synthetic data joint structural features Between The matrix formed by norm distance; the loss function of generator G is expressed as:

[0130] ;

[0131] Where D is the metric function. If the decision output T(x) of the black-box target model T is a label, the cross-entropy loss function is used for measurement; if the decision output T(x) of the black-box target model T is a probability value, the Kullback-Leibler (KL) divergence difference is used for measurement; MSE is the mean squared error loss function, used to measure the difference between the norm distances of two sets; by widening the gap between the synthetic data and the original predicted values, and increasing the difference in joint structural information of the synthetic data x, the generator G can synthesize more diverse data.

[0132] D. Alternative models for training attention enhancement:

[0133] First, the attention enhancement module uses synthetic data. As input, the data is passed through a global pooling layer, a linear layer, and a sigmoid function in sequence to generate a feature weight mask.

[0134] Secondly, during the forward propagation of the alternative model S, the input synthetic data is first processed. Perform a convolution operation, and then multiply the result of the convolution with the feature weight mask element by element.

[0135] Finally, the result of the multiplication operation is passed to subsequent layers of the alternative model S for forward propagation, ultimately yielding the prediction result of the alternative model. And by measuring the loss, the decision output of the black-box objective model T is minimized. and alternative model prediction results The difference is used to train the replacement model S; and the loss is expressed as:

[0136] ;

[0137] Where, if the decision output T(x) is a hard label, then D is the cross-entropy loss function; if the decision output T(x) is a soft label, then D is... loss function, and The loss function is the absolute error loss function.

[0138] The attention enhancement module employs a set of lightweight operations to extract features from the input data. The specific calculation process is as follows:

[0139] ;

[0140] in, For attention enhancement modules, This represents a global average pooling operation based on channel features. and These are the weights and biases of the linear layer; represents the sigmoid function, which maps eigenvalues ​​to an output between 0 and 1, where x is the synthetic data.

[0141] E. Replay training of alternative models:

[0142] Images are randomly sampled from the circular buffer along with their corresponding output pairs from the black-box target model T. The images are then fed into a network consisting of an attention enhancement module and an alternative model S, and trained based on the difference between the network output and the output of the black-box target model T until the alternative model S converges.

[0143] F. Generate adversarial examples after the loop ends:

[0144] After step E, adversarial examples are generated on the trained alternative model S using a white-box iterative attack algorithm. Specifically, it is expressed as follows:

[0145] ;

[0146] ;

[0147] Where X is the sample to be attacked. This represents the initial attack sample (i.e., the sample that has not yet undergone iterations, with an iteration count of 0); n represents the nth iteration. The gradient of the obtained adversarial sample with respect to label y, For sign removal operation, As a hyperparameter, clip indicates that adversarial perturbations will be clipped to not exceed the perturbation constraint;

[0148] After the iteration is complete, the final adversarial example will be generated. Input black-box target model This induces the user to make misleading decisions, successfully carrying out a highly efficient black-box attack without data.

[0149] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Any simple modifications or equivalent changes made to the above embodiments based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A data-free black-box adversarial example generation method based on attention enhancement, characterized in that: The specific steps include: 1) Randomly sampling the noise space and inputting it into the generator G to generate synthetic data. 2) Utilizing synthetic data Query black-box target model The decision output is cached; 3) The alternative model S is enhanced using the attention enhancement module, and the enhanced alternative model S is trained; including the following steps: 3.1) The attention enhancement module uses synthetic data As input, a feature weight mask is generated by sequentially passing through a global pooling layer, a linear layer, and a sigmoid function; 3.2) During the forward propagation of the substitution model S, the input synthetic data is first processed... Perform a convolution operation, then multiply the result of the convolution with the feature weight mask element-wise; 3.3) Pass the result of the multiplication operation to the subsequent layers of the alternative model S for forward propagation, and finally obtain the prediction result of the alternative model. And by measuring the loss, the decision output of the black-box objective model T is minimized. and alternative model prediction results The difference is used to train the replacement model S; and the loss is expressed as: Wherein, if the decision output T(x) is a hard label, then D is the cross-entropy loss function; if the decision output T(x) is a soft label, then D is... loss function, and The loss function is the absolute error loss function; 4) The generator G is trained using a joint structure information learning strategy; specifically: 4.1) First, the Kullback-Leibler divergence difference between the decision output T(x) of the substitute model S and the black-box target model T is directly calculated; 4.2) The input data is processed using global average pooling to obtain the feature values ​​of each channel, and the results are flattened into a two-dimensional tensor; at the same time, the output confidence is normalized; through broadcasting and subtraction, the feature value tensor of each image and the output confidence are combined into joint structure information; 4.3) A distance matrix is ​​constructed using the joint structure information, where each element represents the Euclidean distance between samples; based on the distance between each pair of combinations in these joint structure information, the mean squared error loss between them is calculated; finally, the generator G is trained using the mean squared error loss between the Kullback-Leibler divergence difference and the joint structure information; the specific calculation process of the joint structure information is as follows: ； Where B represents the amount of training data in each training iteration; This represents a single image in the set of training data; This represents the output of the corresponding model; This indicates a global average pooling operation; The joint structural features represent the matrix formed by merging the features extracted from the input image through global pooling with the output of the alternative model S; A is defined as each synthetic data joint structural features Between The matrix formed by norm distance; the loss function of generator G is expressed as: Where D is the metric function. If the decision output T(x) of the black-box target model T is a label, the cross-entropy loss function is used for measurement; if the decision output T(x) of the black-box target model T is a probability value, the Kullback-Leibler divergence difference is used for measurement; MSE is the mean squared error loss function, used to measure the difference between the norm distances of two sets; by widening the gap between the synthetic data and the original predicted values, and increasing the difference in joint structural information of the synthetic data x, more diverse data can be synthesized; 5) Replay the cached input-output pairs to further train the alternative model S; 6) Use the white-box attack strategy to construct adversarial examples on the enhanced alternative model S and transfer them to the target model to carry out the attack.

2. The method for generating data-free black-box adversarial examples based on attention enhancement according to claim 1, characterized in that: Step 1) specifically involves: randomly sampling noise vectors from a noise space that follows a standard normal distribution. The input noise vector is fed into generator G, which receives the input noise vector. Generate synthetic data The generator G uses a basic architecture consisting of three convolutional layers, with the convolutional layers and linear upsampling layers interleaved, and a batch normalization layer and a ReLU activation function added after all layers except the last one.

3. The method for generating data-free black-box adversarial examples based on attention enhancement according to claim 1, characterized in that: Step 2) specifically includes the following steps: 2.1) synthesizing data Input into the black-box target model Query its decision output Among them, decision output 2.2) The black-box target model is either a hard label or a soft label that outputs predicted probabilities; Decision output As synthetic data The tag, with 2.3) Set up a circular buffer of a certain length to store the target model for querying the black box. Return output and synthesized data ,Right now( ， )。 4. The method for generating data-free black-box adversarial examples based on attention enhancement according to claim 1, characterized in that: The attention enhancement module uses a set of lightweight operations to extract features from the input data. The specific calculation process is as follows: ;in, For attention enhancement modules, This represents a global average pooling operation based on channel features. and These are the weights and biases of the linear layer; represents the sigmoid function, which maps eigenvalues ​​to an output between 0 and 1, where x is the synthetic data.

5. The method for generating data-free black-box adversarial examples based on attention enhancement according to claim 3, characterized in that: Step 5) specifically involves: 5.1) Randomly sampling images and their corresponding black-box target model T output pairs from the circular buffer; 5.2) Inputting the images into a network composed of an attention enhancement module and an alternative model S, and training the network based on the difference between the network output and the black-box target model T output until the alternative model S converges.

6. The method for generating data-free black-box adversarial examples based on attention enhancement according to claim 1, characterized in that: Step 6) includes the following specific steps: 6.1) After step 5), adversarial examples are generated on the trained alternative model S using a white-box iterative attack algorithm. Specifically, it is expressed as follows: ； Where X is the sample to be attacked. This represents the initial attack sample; n indicates the nth iteration. The gradient of the obtained adversarial sample with respect to label y, For sign removal operation, For hyperparameters, clip indicates that the adversarial perturbation is clipped to not exceed the perturbation constraint; 6.2) After the iteration, the final adversarial examples are... Input black-box target model This induces the user to make misleading decisions, successfully carrying out a highly efficient black-box attack without data.

Images