Method and device for enhancing adversarial attack mobility based on future information

Abstract

The invention discloses an anti-attack mobility enhancement method and device based on future information, and the method specifically comprises the steps: firstly initializing each hyper-parameter, and determining a used attack method; then, disturbance is added to the input clean sample image in each iteration round to obtain a disturbance image, gradient information and disturbance are accumulated according to the disturbance image, and disturbance of the current step is obtained; if the iteration process of the selected attack method is prone to overfitting, applying momentum to the process of updating disturbance in each iteration, and using a hyper-parameter as a momentum attenuation factor to prevent overfitting in the iteration process; and after iteration is completed, adding the disturbance sum of each round of iteration to the clean sample to obtain an adversarial sample. The method can be directly applied to any I-FGSM-based attack method, the overfitting problem in the iteration process is solved, and the migration of attack resistance is enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of anti-attack algorithms, and in particular to a method and device for enhancing anti-attack mobility based on future information. Background Art

[0002] Deep neural networks are vulnerable to adversarial examples. In image classification, these adversarial examples can be generated by adding subtle perturbations that are imperceptible to humans to clean input samples. In most cases, adversarial examples that mislead one network also have an attack effect on another network, which is called the transferability of adversarial attacks. The way of using this adversarial transferability to attack black-box networks is called transfer attack. If adversarial examples from a certain attack method can successfully attack more black-box networks, it means that this attack method has better attack transferability. MI-FGSM is a classic method to enhance the transferability of black-box attacks. It not only inherits the iterative method I-FGSM, but also uses momentum to replace the gradient to improve adversarial transferability. This leads to a branch of adversarial attack methods with gradient optimization. Some adversarial attack methods optimize the gradient by modifying the loss function. Another branch of adversarial attack methods is attack methods based on input transformation. These methods use data augmentation to improve gradient differentiation.

[0003] Most attack methods attempt to complete the adversarial attack task in an optimized manner, especially iterative optimization. The iterative optimization process generates a sequence according to the iteration, where each sequence node corresponds to a search point, and the next node is generated through the current iteration information (such as I-FGSM) and the previous iteration information (such as MI-FGSM). Once the optimization method and the starting node are determined, the resulting sequence is fixed to some extent. However, most existing attack methods ignore the nodes after the current iteration, which prevents the optimization process itself from benefiting from the subsequent iteration process, thereby reducing the global gradient information and reducing the portability of the attack. Summary of the invention

[0004] The purpose of the present invention is to provide a method and device for enhancing the mobility of counterattacks, which can optimize the iterative process, solve the overfitting problem in the iterative process, and enhance the mobility of attacks.

[0005] The technical solution to achieve the purpose of the present invention is: a method for enhancing the mobility of anti-attack based on future information, comprising the following steps:

[0006] Step 1: Initialize the hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method to be used;

[0007] Step 2: Add disturbance to the input clean sample image x in each round of iteration to obtain the disturbance image x'. The disturbance is updated with the LoFF accumulated gradient information and disturbance. According to the disturbance image x', the gradient information and disturbance are accumulated in the number of steps Q to obtain the disturbance δ of the current step q. q ;

[0008] Step 3: If the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration;

[0009] Step 4: After the iteration is completed, add the sum of the perturbations of each round of iteration to the clean sample x to obtain the adversarial sample

[0010] A device for enhancing mobility against attacks based on future information, the device is used to implement the method for enhancing mobility against attacks based on future information, the device comprises first to fourth modules, wherein:

[0011] The first module is used to initialize various hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method used;

[0012] In the second module, perturbations are added to the input clean sample image x in each round of iterations to obtain perturbation images x'. The perturbations are updated with the LoFF accumulated gradient information and perturbations. According to the perturbation images x', the gradient information and perturbations are accumulated in the number of steps Q to obtain the perturbation δ of the current step q. q ;

[0013] In the third module, if the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration;

[0014] In the fourth module, after the iteration is completed, the sum of the perturbations of each round of iteration is added to the clean sample x to obtain the adversarial sample

[0015] A mobile terminal comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, a method for enhancing the mobility of counterattacks based on future information is implemented.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps in the method for enhancing the mobility of anti-attack based on future information.

[0017] Compared with the prior art, the present invention has the following significant advantages: (1) it uses future information for iterative optimization, continuously accumulates subsequent gradient information, updates perturbations, and merges intermediate information close to the final result, thereby skipping the local optimum; (2) it can be directly applied to any attack method based on I-FGSM, thereby enhancing the mobility of adversarial attacks, and can also be applied to itself to enhance attack mobility; (3) momentum is applied to the process of updating perturbations, which solves the overfitting problem in the iterative process, thereby enhancing the mobility of adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 The figure is a flow chart of a method for enhancing mobility against attacks based on future information according to the present invention.

[0019] Figure 2 Schematic diagram of the principle of the method for enhancing the mobility of anti-attack based on future information in the present invention.

[0020] Figure 3 Schematic diagram of the principle of using future information to update disturbance in the present invention DETAILED DESCRIPTION

[0021] Combination Figure 1 , Figure 2 , Figure 3 The present invention provides a method for enhancing the mobility of anti-attack based on future information, comprising the following steps:

[0022] Step 1: Initialize the hyperparameters, including the number of steps Q of LoFF (Looking From the Future) and the future penalty coefficient β, and determine the attack method to be used, as follows:

[0023] Step 1: Initialize the hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method to be used;

[0024] Step 2: Add disturbance to the input clean sample image x in each round of iteration to obtain the disturbance image x'. The disturbance is updated with the LoFF accumulated gradient information and disturbance. According to the disturbance image x', the gradient information and disturbance are accumulated in the number of steps Q to obtain the disturbance δ of the current step q.q ;

[0025] Step 3: If the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration;

[0026] Step 4: After the iteration is completed, add the sum of the perturbations of each round of iteration to the clean sample x to obtain the adversarial sample

[0027] As a specific example, Inception-v3 and Vit-B are selected as proxy networks, and IncRes-v2, ResNet50, Swin-B, Inc-V3, and ViT-B are attacked networks.

[0028] As a specific example, in step 1, each hyperparameter is initialized as follows:

[0029] Step 1.1, determine the number of iterations T, constraint ∈ L ∞ , the constraints of each iteration∈ t , update rate α, number of LoFF steps Q and future penalty coefficient β;

[0030] Step 1.2: Determine the attack method A(·) that applies LoFF. If the iterative process of the selected attack method A(·) does not overfit, proceed to step 2; if the iterative process of the selected attack method A(·) overfits, proceed to step 3.

[0031] As a specific example, in step 1.1, set the constraint ∈ L ∞ =16, number of iterations T=16, update rate α=1 / 255, number of LoFF steps Q=4, and the future penalty factor β is set to 1.

[0032] As a specific example, in step 2, a disturbance is added to the input clean sample image x in each iteration to obtain a perturbed image x', as follows:

[0033] Step 2.1: Within the iteration number T, add the sum of the previous j rounds of perturbations to the input sample x to obtain the perturbed sample x'. The formula is as follows:

[0034]

[0035] in represents the best perturbation result of the jth iteration, x represents the clean image sample of the input, t represents the current iteration, and t-1 represents the previous iteration of the current iteration;

[0036] Step 2.2: Within the number of steps Q, each step of LoFF accumulates gradient information based on the perturbed sample x' Then the perturbation δ of the current step q is accumulated by the gradient information q , the formula is as follows:

[0037]

[0038] Among them, α represents the update rate, δ i represents the perturbation of step i, x' represents the initial perturbation sample of this round generated in step 2.1, F is the classification network, A method for accumulating gradient information, q represents the current step, and sign is a symbolic function;

[0039] Step 2.3: After the Q-step LoFF is completed, the optimal perturbation for the current round t is accumulated. The formula is as follows:

[0040]

[0041] Among them, α represents the update rate, β q represents the future penalty coefficient of the qth step, represents the best perturbation result of the jth iteration, δ q-1 represents the total perturbation of the previous q-1 steps of LoFF, x represents the input clean image sample, F is the classification network, A method for representing the accumulated gradient information, where sign(·) is a symbolic function;

[0042] Step 2.4: Determine whether T rounds of iteration are completed, that is, whether the current iteration number t is greater than T. If t≥T, the iteration is completed and proceed to step 4; if t<T, the iteration is not completed, and continue to update the iteration perturbation according to steps 2.1 to 2.3 until the iteration is completed.

[0043] As a specific example, in step 3, the momentum Applied to each iteration to update the perturbation The process uses the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process, as follows:

[0044] Step 3.1, use the hyperparameter η as the momentum decay coefficient of LoFF;

[0045] The process of step 3.2 and LoFF remains unchanged. In each round of iteration, the momentum M is introduced into the perturbation update process of step 2 with the help of the hyperparameter η. The specific formula is as follows:

[0046]

[0047] where <·,·> is the inner product, and η is the momentum decay factor, is the gradient of the tth iteration, is the momentum of the tth round, α is the update rate, represents the best perturbation result in the tth round, and sign(·) is a symbolic function.

[0048] As a specific example, in step 4, the sum of the perturbations of each iteration is added to the clean sample x to obtain the adversarial sample The details are as follows:

[0049] Add the sum of iterative perturbations to the clean sample x to get the adversarial sample The formula is as follows:

[0050]

[0051] in represents the best perturbation result of the tth round, T represents the total number of iterations, and t represents the tth iteration.

[0052] The present invention also provides a device for enhancing mobility against attacks based on future information, which is used to implement the method for enhancing mobility against attacks based on future information. The device includes first to fourth modules, wherein:

[0053] The first module is used to initialize various hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method used;

[0054] In the second module, perturbations are added to the input clean sample image x in each round of iterations to obtain perturbation images x'. The perturbations are updated with the LoFF accumulated gradient information and perturbations. According to the perturbation images x', the gradient information and perturbations are accumulated in the number of steps Q to obtain the perturbation δ of the current step q. q ;

[0055] In the third module, if the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration;

[0056] In the fourth module, after the iteration is completed, the sum of the perturbations of each round of iteration is added to the clean sample x to obtain the adversarial sample

[0057] The present invention also provides a mobile terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for enhancing mobility against attacks based on future information is implemented.

[0058] The present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, the steps in the method for enhancing the mobility of counterattacks based on future information are implemented.

[0059] The present invention uses future information to perform iterative optimization in a new method, and the method can be applied to any attack method based on I-FGSM, thereby enhancing the mobility of counterattacks.

[0060] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0061] Example

[0062] Combination Figure 2 This embodiment adopts a future information-based anti-attack migration enhancement method of the present invention, applies it to multiple classification networks and attack methods, and compares the effects with the corresponding attack methods. The comparison baselines are four representative attack methods: MI-FGSM, EMI-FGSM, Admix and SIA. The specific steps are as follows:

[0063] Step 1: Initialize each hyperparameter;

[0064] Perturbation constraint ∈ L ∞ =16, number of iterations T=16, update rate α=1 / 255, number of LoFF steps Q=4, future penalty factor β is set to 1, the momentum decay factor η of LoFF with momentum decay factor is 1, Inception-v3 and Vit-B are selected as proxy networks, IncRes-v2, ResNet50, Swin-B, Inc-V3, ViT-B are selected as attacked networks;

[0065] Step 2: Add disturbance to the input clean sample image x in each round of iteration to obtain the disturbance image x'. The disturbance is updated with the LoFF accumulated gradient information and disturbance. According to the disturbance image x', the gradient information and disturbance are accumulated in the number of steps Q to obtain the disturbance δ of the current step q. q , as follows:

[0066] Step 2.1, let the current iteration number be t, generate the adversarial sample x' of the tth round, and add the sum of the perturbations of the previous t-1 rounds of iterations to the input sample x. The formula is as follows:

[0067]

[0068] in, represents the best perturbation result of the tth iteration;

[0069] Step 2.2: Let the current number of steps be q, and accumulate the gradient information based on the sum of the adversarial sample x' of the current iteration and the perturbation of the previous q-1 steps Then the perturbation δ of the current step q is updated according to the update rate α and the updated gradient information q , the formula is as follows:

[0070]

[0071] Where q represents the current step number of LoFF, q=0, 1, 2, ..., Q-1 represents the qth step of LoFF, δ q represents the perturbation of the qth step, sign(·) is the symbolic function;

[0072] Step 2.3: After the Q-step LoFF is completed, the perturbation of the current round t is accumulated The formula is as follows:

[0073]

[0074] Among them, α represents the update rate, β q represents the future penalty coefficient of the qth step, represents the best perturbation result of the jth iteration, δ q-1 represents the sum of the perturbations of the previous q-1 steps of LoFF, x represents the input clean image sample, F is the classification network, A method for representing accumulated gradient information, sign(·) is a symbolic function;

[0075] Step 2.4: Determine whether T rounds of iteration are completed, that is, whether the current iteration number t is greater than T. If t≥T, the iteration is completed and proceed to step 4; if t<T, the iteration is not completed, and continue to update the iteration perturbation according to steps 2.1 to 2.3 until the iteration is completed.

[0076] Step 3: If the iterative process of the selected attack method is prone to overfitting, then the momentum Applied to each iteration to update the perturbation The process uses the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process, as follows:

[0077] Taking the MI-FGSM attack method as an example, the adversarial samples generated by the adversarial method MLoFF-MI with MLoFF applied are used to attack IncRes-v2, ResNet50, Swin-B, Inc-V3, and ViT-B, and the attack success rate ASR1 is obtained. Compared with the attack success rate ASR2 of the MI method without MLoFF, the increment Inc. = ASR1-ASR2 is obtained.

[0078] Step 4: After the iteration is completed, add the sum of the perturbations of each round of iteration to the clean sample x to obtain the final adversarial sample The details are as follows:

[0079] Through Inc., we can find that except for white-box attacks, the attack effect of MLoFF-MI is stronger than MI. Especially when attacking IncRes-v2, it can greatly enhance ASR, with an incremental Inc. of 10.3%.

[0080] In summary, the present invention provides a method for enhancing the mobility of adversarial attacks based on future information. It uses future information for iterative optimization, continuously accumulates subsequent gradient information, updates disturbances, and merges intermediate information close to the final result, thereby skipping the local optimum. It can be directly applied to any attack method based on I-FGSM, enhances the mobility of adversarial attacks, solves the overfitting problem in the iterative process, and thus enhances the mobility of adversarial attacks.

[0081] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for enhancing the transferability of adversarial attacks based on future information, characterized in that: The following steps are involved: Step 1: Initialize the hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method to be used; Step 2: Add disturbance to the input clean sample image x in each round of iteration to obtain the disturbance image x'. The disturbance is updated with the LoFF accumulated gradient information and disturbance. According to the disturbance image x', the gradient information and disturbance are accumulated in the number of steps Q to obtain the disturbance δ of the current step q. q ; Step 3: If the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration; Step 4: After the iteration is completed, add the sum of the perturbations of each round of iteration to the clean sample x to obtain the adversarial sample 2. The method for enhancing the mobility of anti-attack based on future information according to claim 1 is characterized in that: Inception-v3 and Vit-B are selected as proxy networks, and IncRes-v2, ResNet50, Swin-B, Inc-V3, and ViT-B are attacked networks.

3. The method for enhancing the mobility of anti-attack based on future information according to claim 2 is characterized in that: In step 1, initialize the hyperparameters as follows: Step 1.1, determine the number of iterations T, constraint ∈ L ∞ , the constraints of each iteration∈ t , update rate α, number of LoFF steps Q and future penalty coefficient β; Step 1.2: Determine the attack method A(·) that applies LoFF. If the iterative process of the selected attack method A(·) does not overfit, proceed to step 2; if the iterative process of the selected attack method A(·) overfits, proceed to step 3.

4. The method for enhancing the mobility of anti-attack based on future information according to claim 3 is characterized in that: In step 1.1, set the constraint ∈ L ∞ =16, number of iterations T=16, update rate α=1 / 255, number of LoFF steps Q=4, and the future penalty factor β is set to 1.

5. The method for enhancing the mobility of anti-attack based on future information according to claim 1, characterized in that: In step 2, a perturbation is added to the input clean sample image x in each round within the number of iterations to obtain a perturbed image x', as follows: Step 2.1: Within the iteration number T, add the sum of the previous j rounds of perturbations to the input sample x to obtain the perturbed sample x'. The formula is as follows: in represents the best perturbation result of the jth iteration, x represents the clean image sample of the input, t represents the current iteration, and t-1 represents the previous iteration of the current iteration; Step 2.2: Within the number of steps Q, each step of LoFF accumulates gradient information based on the perturbed sample x' Then the perturbation δ of the current step q is accumulated by the gradient information q , the formula is as follows: Among them, α represents the update rate, δ i represents the perturbation of step i, x' represents the initial perturbation sample of this round generated in step 2.1, F is the classification network, A method for accumulating gradient information, q represents the current step, and sign is a symbolic function; Step 2.3: After the Q-step LoFF is completed, the optimal perturbation for the current round t is accumulated. The formula is as follows: Among them, α represents the update rate, β q represents the future penalty coefficient of the qth step, represents the best perturbation result of the jth iteration, δ q-1 represents the total perturbation of the previous q-1 steps of LoFF, x represents the input clean image sample, F is the classification network, A method for representing the accumulated gradient information, where sign(·) is a symbolic function; Step 2.4: Determine whether T rounds of iteration are completed, that is, whether the current iteration number t is greater than T. If t≥T, the iteration is completed and proceed to step 4; if t<T, the iteration is not completed, and continue to update the iteration perturbation according to steps 2.1 to 2.3 until the iteration is completed.

6. The method for enhancing the mobility of anti-attack based on future information according to claim 1, characterized in that: In step 3, the momentum Applied to each iteration to update the perturbation The process uses the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process, as follows: Step 3.1, use the hyperparameter η as the momentum decay coefficient of LoFF; The process of step 3.2 and LoFF remains unchanged. In each round of iteration, the momentum M is introduced into the perturbation update process of step 2 with the help of the hyperparameter η. The specific formula is as follows: where <·,·> is the inner product, and η is the momentum decay factor, is the gradient of the tth iteration, is the momentum of the tth round, α is the update rate, represents the best perturbation result in the tth round, and sign(·) is a symbolic function.

7. The method for enhancing the mobility of anti-attack based on future information according to claim 1, characterized in that: In step 4, the sum of the perturbations of each iteration is added to the clean sample x to obtain the adversarial sample The details are as follows: Add the sum of iterative perturbations to the clean sample x to get the adversarial sample The formula is as follows: in represents the best perturbation result of the tth round, T represents the total number of iterations, and t represents the tth iteration.

8. A device for enhancing the mobility of counterattacks based on future information, characterized in that: The device is used to implement the method for enhancing the mobility of anti-attack based on future information as described in any one of claims 1 to 7, and the device includes first to fourth modules, wherein: The first module is used to initialize various hyperparameters, including the number of steps Q of LoFF and the future penalty coefficient β, and determine the attack method used; In the second module, perturbations are added to the input clean sample image x in each round of iterations to obtain perturbation images x'. The perturbations are updated with the LoFF accumulated gradient information and perturbations. According to the perturbation images x', the gradient information and perturbations are accumulated in the number of steps Q to obtain the perturbation δ of the current step q. q ; In the third module, if the iterative process of the selected attack method is overfitting, the momentum Applied to each iteration to update the perturbation process, and use the hyperparameter μ as the momentum decay factor of LoFF to prevent overfitting in the iterative process; represents the optimal momentum for the tth iteration, represents the optimal perturbation for the tth iteration; In the fourth module, after the iteration is completed, the sum of the perturbations of each round of iteration is added to the clean sample x to obtain the adversarial sample 9. A mobile terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for enhancing the mobility of counterattacks based on future information as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps in the method for enhancing the mobility of counterattacks based on future information as described in any one of claims 1 to 7 are implemented.

Images