A model robustness and attack effectiveness measurement evaluation and score calculation method

Abstract

The application relates to a model robustness and attack effectiveness measurement evaluation and score calculation method, which comprises the following steps: establishing an evaluation index system composed of a model capability evaluation index, an attack effect evaluation index and an attack cost evaluation index; evaluating the evaluation indexes in the evaluation system; and performing score calculation based on a project response theory and a Markov chain Monte Carlo method. The model robustness and attack effectiveness measurement evaluation and score calculation method can intuitively and comprehensively reflect the performance of an evaluation target and the performance difference between different models or attack algorithms, can be used for performance evaluation of various different structure models and various kinds of counter-attack algorithms, and has universality and flexibility.

Description

TECHNICAL FIELD

[0001] The present application relates to a model robustness and attack effectiveness measurement evaluation and score calculation method, belonging to the technical field of artificial intelligence deep learning models. BACKGROUND

[0002] Nowadays, deep learning models are widely used in various fields due to their good performance. However, the vulnerability of the model hinders its application in security-sensitive fields, because the model may produce false conclusions under the action of a small perturbation carefully designed by an attacker, causing serious consequences. Researchers have proposed many defense strategies according to different attack methods, but at the same time, more powerful attack methods have been proposed. In this endless process of "contradictory attack and defense", how to comprehensively and fairly measure the resistance of models with different structures and applied different defense means to attacks, as well as the performance, advantages and disadvantages of different attack methods, has become the focus of researchers.

[0003] At present, in order to comprehensively evaluate the security of deep learning models, some researchers have proposed some evaluation frameworks / systems, for example: DeepSec first proposed an evaluation index framework, but it did not prove the effectiveness of the indicators in the framework in detail, nor was it able to sort the evaluators according to the indicators; RealSafe uses two complementary robustness curves as the main evaluation indicators, and this framework pays more attention to the success rate of attacks under different perturbation budgets, but it is not always applicable to some attacks that limit the decline of success rate and continuously optimize the perturbation, such as boundary attack (a widely used black-box attack), or attacks that are difficult to accurately limit the perturbation scale, such as CW (Carlini and Wagner Attacks, C&W, a widely used white-box attack); AISafety tries to expand the work of the two, but it ignores the universality of the evaluation indicators, and its explainability evaluation and neuron traversal evaluation are difficult to adapt to models of different structures. In addition, the evaluation frameworks proposed by these works lack sufficient flexibility and universality when facing new attack methods, thus limiting their further role. SUMMARY

[0004] In view of the defects and shortcomings of the prior art, the present application provides a universal evaluation framework, a model robustness and attack effectiveness measurement evaluation and score calculation method, which is used to comprehensively, fairly and intuitively measure the robustness of deep learning models with different structures and the effectiveness of different strategy attack algorithms, and reflects the performance of the evaluation target in the form of scores, so as to solve the problems of unreasonable, incomplete, lack of universality, lack of interpretability and limitation of the evaluation target in the existing evaluation framework. Specifically, the model robustness and attack effectiveness measurement evaluation and score calculation method should meet the following requirements:

[0005] Comprehensive: the model robustness and attack effectiveness measurement evaluation and score calculation method can evaluate the model robustness and attack effectiveness from different angles and select reasonable indicators to measure the performance of the evaluation target.

[0006] Fair: the model robustness and attack effectiveness measurement evaluation and score calculation method can be performed under the same conditions or introduce necessary parameters to eliminate differences, and finally obtain fair scores and rankings.

[0007] Universal: the model robustness and attack effectiveness measurement evaluation and score calculation method should be universally applicable to various models and various attack methods.

[0008] To achieve the above-mentioned purpose, the present application provides the following technical solutions:

[0009] A model robustness and attack effectiveness measurement evaluation and score calculation method, comprising:

[0010] Step 1, establishing an evaluation index system composed of model capability evaluation indexes, attack effect evaluation indexes and attack cost evaluation indexes.

[0011] The index classification and meaning of the evaluation index system are as follows:

[0012] C1, model capability evaluation index: the model capability evaluation index is used to reflect the performance of the model itself, so three model capability evaluation indexes are designed to measure the performance of the model itself.

[0013] C2, attack effect evaluation index: the attack effect evaluation index is used to reflect the threat ability of the attack method to the model, and five attack effect evaluation indexes are designed to measure the threat of the attack method according to the output of the model after the attack.

[0014] C3, attack cost evaluation index: the performance of the attack method is not only reflected in the misleading ability of the generated adversarial samples to the model, but also the generation time and quality of the adversarial samples are also important to measure the performance of the attack method. Therefore, two calculation cost indicators and three disturbance perception cost indicators are designed to evaluate the performance of the attack method. The attack cost evaluation index can intuitively reflect the advantages and disadvantages of the attack algorithm in achieving the same attack target;

[0015] Further, the index classification C1 includes:

[0016] C11, clear accuracy (C-Acc): the C-Acc index represents the correct rate of the model in classifying the clean data set, which can be represented as

[0017] Wherein, F(x i ) represents the result label value obtained by the classification model f in predicting the original image x i , y i represents the true label of the original image x i ;

[0018] C12, clear example F1 score (CF): the CF index represents the F1 score of the model in classifying the clean data set, which can be represented as

[0019] Wherein, the recall rate is represented as The accuracy rate is represented as

[0020] Wherein

[0021] C13, clear confidence (C-Conf): the C-Conf index represents the average confidence of the model in classifying the clean data set, which can be represented as

[0022] Wherein, P(x i ) represents the confidence matrix obtained by the classification model f in reasoning the original image x i ;

[0023] Further, the index classification C2 includes:

[0024] C21, misclassification ratio (MR): the MR index represents the proportion of pictures that are misclassified as any other class after the attack, which can be represented as:

[0025] wherein, denotes the original image x i generated after being attacked by a denotes the label obtained by the classification model f after reasoning on the adversarial sample y i denotes the true label of the original image x i ;

[0026] C22, Targeted Attack Success (TAS): This index is used to assist in measuring the effect of targeted attack in targeted attack, which can be represented as:

[0027] wherein, denotes the targeted attack target label;

[0028] C23, Average Confidence Change (ACC): The ACC index is used to reflect the change in the confidence of the model prediction before and after the attack, and then measure the degree of deviation of the attack on the model recognition result; ACC is composed of two sub-indices, Average Increase in Adversarial-class Confidence (AIAC) and Average Reduction in True-class Confidence (ARTC), which respectively reveal the degree to which the attack deceives the classifier to classify the attacked picture as an adversarial class or makes it deviate from the true class; AIAC can be represented as: ARTC can be represented as:

[0029] wherein, denotes the label obtained by the classification model f after reasoning on the adversarial sample P(x i ) denotes the confidence matrix obtained by the classification model f after reasoning on the original image x i P(x i ) function subscript represents the confidence value of this class;

[0030] C24, Average Class Activation Mapping Change (ACAMC): This indicator calculates the cosine similarity of the model's focus area before and after the attack to analyze whether the attack makes the model focus on the wrong features or information; ACAMC is calculated by the offset ACAMC of the region corresponding to the class of the model's prediction result before and after the attack A and the offset ACAMC of the region corresponding to the original label class before and after the attack T Two sub-indicators make up ACAMC A which can be expressed as: ACAMC T which can be expressed as

[0031] wherein, represents the model's focus area on the class during sample reasoning, which can be expressed as A k represents the data of channel k in A, A takes the feature layer output by the last convolutional layer, is the weight, which can be expressed as P c is the prediction score of class c, is the data of ij in channel k in A, Z is the area of A; S(a,b) is the cosine similarity of a and b;

[0032] C25, Observable Transfer Rate (OTR): This indicator is used to reflect the proportion of adversarial samples generated by the attack against a specific target model that are misclassified by other models, which can be expressed as:

[0033] wherein, m is the number of standard models to be tested, A(F,x)→x a is the adversarial sample x a generated by the original image x via the attack algorithm A based on the model F, and δ is a specific target model, denotes other models that are not specific target models;

[0034] Further, the indicator classification C3 comprises:

[0035] C31, Calculation Time Cost (CTC): This indicator is used to reflect the time cost of generating an adversarial sample by the attack method;

[0036] C32, Query Number Cost (QNC): This indicator is used to reflect the average model query number of generating an adversarial sample by the attack method; QNCF Forward operation of the model in the process of statistical attack, QNC B Backward operation of the model in the process of statistical attack;

[0037] C33, Average Norm Distortion (AND): This index represents the norm distance of the image before and after the attack; AND is composed of three sub-indices: Average Maximum Pixel Distance (AMPD), Average Euclidean Distance (AED), and Average Pixel Change Ratio (APCR);

[0038] AMPD is the maximum deviation of the modified pixels of the adversarial sample relative to the original image, which is often used as a disturbance limit condition for attack methods, and can be expressed as: where ||·||∞ represents the infinite norm, which is used to calculate the maximum deviation of pixels in the image; ∞

[0039] AED is the Euclidean distance between the original image and the adversarial sample, which can be expressed as: where ||·||2 represents the Euclidean norm used to calculate the Euclidean distance, and ||·||0 represents the 0 norm used to calculate the number of non-zero elements in the vector;

[0040] APCR is the number of modified pixels of the adversarial sample relative to the original image, which can be expressed as:

[0041] C34, Average Euclidean Distance in Frequency Domain (AED-FD): This index represents the average Euclidean distance of the high-frequency and low-frequency components after frequency domain difference of the image before and after the attack; AED-FD is composed of two sub-indices: the Euclidean distance of the low-frequency component reconstruction image AED-FD L and the Euclidean distance of the high-frequency component reconstruction image AED-FD H

[0042] AED-FD L can be expressed as AED-FD H can be expressed as

[0043] where φ ll (x) = L T ​​(L x L T ) L, φ lh+hl+hh (x) = L T (L x H T ) H + H T (H x L T ) L + H T (H x H T ) L, L and H are low-pass filter and high-pass filter of the orthogonal wavelet respectively;

[0044] C35, Average Metrics Similarity (AMS): This index represents the degree of feature shift of image color, structure, texture, etc. before and after attack; AMS consists of two sub-indices, Average Deep Metrics Similarity (ADMS) and Average Low-level Metrics Similarity (ALMS);

[0045] ALMS is defined as the Multiple Scales Gradient Magnitude Similarity Deviation (MS-GMSD) of all attack successful adversarial samples, which can be expressed as wherein: wherein σ j (x, y) is the GMSD score at the jth scale, ω j is the weight value of different scales;

[0046] ADMS is defined as the Deep Image Structure and Texture Similarity (DISTS) of all attack successful adversarial samples, which can be expressed as wherein: wherein: is the texture similarity measure, which can be expressed as is the structure similarity measure, which can be expressed as {a ij , β ij} are learnable weights, and satisfy wherein: respectively represent the global average of and represent the variance of and represent the mean of and ​​global covariance, c1 and c2 bias.

[0047] Step 2, evaluate the indicators of the foregoing step 1, including:

[0048] S11, cross-combine a plurality of models and attack methods, collect and calculate evaluation indicators of each model-attack method, and form a data matrix;

[0049] S12, according to the task target, superimpose and average the data matrix obtained in S11 along the change direction of the attack method or the model, so as to mask the differences caused by different models or different attack methods, and obtain general evaluation indicator data;

[0050] S13, map and normalize the general evaluation indicator data generated in S12 to obtain evaluation indicators suitable for score calculation after processing;

[0051] S14, calculate the ability score of the evaluation target using a comprehensive ability calculation method based on the item response theory and the Markov chain Monte Carlo method on the evaluation indicators processed in S13;

[0052] S15, analyze and evaluate the ability score of the evaluation target calculated by the foregoing evaluation method.

[0053] Further, the step S11 includes:

[0054] S11-1, select a plurality of models and attack methods, and cross-combine them;

[0055] S11-2, for each model-attack method, use the attack method to attack the model for testing, and calculate the evaluation indicators according to the collected and tested data;

[0056] S11-3, take each evaluation indicator as an element to form a data matrix with the attack method and the model as the axis;

[0057] Further, the step S11-2 includes:

[0058] S11-2-1, traverse the original image, input it into the model for inference, and record the Grad-CAM data and the inference result in the process;

[0059] S11-2-2, traverse the original image to generate an adversarial sample, and record the adversarial sample generation time data and the model query amount data in the process;

[0060] S11-2-3, traverse the adversarial sample generated in the foregoing step, input it into the model for inference, and record the Grad-CAM data and the inference result data in the process;

[0061] S11-2-4, calculate indicators C11-C13 using the data recorded in step S11-2-1;

[0062] S11-2-5, calculate indicators C33-C35 by comparing the original image with the adversarial sample generated in step S11-2-2;

[0063] S11-2-6, compare the adversarial sample inference data recorded in step S11-2-3 with the original image inference data recorded in step S11-2-1, and calculate indicators C21-C25;

[0064] S11-2-7, calculate indicators C31-C32 using the data of the generated adversarial sample recorded in step S11-2-2.

[0065] Further, the step S13 comprises:

[0066] S13-1, map the general evaluation indicator data generated in S12 to the range [0, 1];

[0067] S13-2, to prevent the distribution of the mapped indicator data, use the max-min normalization method to normalize the value of the mapped indicator to [0, 1], and obtain the processed evaluation indicator suitable for score calculation.

[0068] Further, the step S14 comprises:

[0069] S14-1, set θ i represents the ability of the ith subject, a j represents the discrimination of the jth test item, β j represents the difficulty of the jth test item, c j represents the guessing parameter of the jth test item, N represents the number of subjects, m represents the number of test items, X i＝1→N,j＝1→m represents the subject score matrix, L represents the number of iterations, M represents the number of convergence steps, and here the subject refers to the evaluation target, i.e. the model or the adversarial attack algorithm; set the initial values of the parameters N, m, L, and M according to user or system instructions, and use the processed evaluation indicators obtained in step 2 to construct the subject score matrix X i＝1→N,j＝1→m ; randomly select an initial value for the parameters θ, a, β, and c

[0070] S14-2, after the initial parameter setting is completed, start the loop until the number of iterations is completed;

[0071] S14-3, obtain the set Calculate the subject ability score and item parameters

[0072] Step 3, score calculation based on item response theory and Markov chain Monte Carlo method.

[0073] Specifically comprising the following steps:

[0074] S14-1, set θ i represents the ability of the ith subject, a j represents the discrimination of the jth test item, β j represents the difficulty of the jth test item, c j represents the guessing parameter of the jth test item, N represents the number of subjects, m represents the number of test items, X i＝1→N,j＝1→m represents the subject score matrix, L represents the number of iterations, M represents the number of convergences, and here the subject refers to the evaluation target, i.e. the model or the adversarial attack algorithm; according to user or system instructions, set initial values for parameters N, m, L, M, and use the processed evaluation indicators obtained in step 2 to construct the subject score matrix X i＝1→N,j＝1→m ; randomly select an initial value for parameters θ, a, β, and c

[0075] S14-2, after the initial parameter setting is completed, start the loop until the number of iterations is completed;

[0076] S14-3, obtain the set Calculate the ability score of the subject and item parameters

[0077] Further, the step S14-2 comprises:

[0078] S14-2-1, randomly extract a candidate state value: sample each subject (i = 1, 2, …, N)

[0079] S14-2-2, calculate the acceptance probability:

[0080]

[0081] S14-2-3, sample u from uniform distribution: u ~ Uniform[0, 1], if then accept the transition: and let otherwise, reject the transition, and let

[0082] S14-2-4, sample each item parameter (j = 1, 2, …, m)

[0083] S14-2-5, calculate the acceptance probability:

[0084]

[0085] S14-2-6, sample u from uniform distribution [0, 1], if the sampling point satisfies then accept the transition, and let otherwise, reject the transition, and let

[0086] Advantages

[0087] Compared with the existing evaluation technology, the measurement and score calculation method of the deep learning model robustness has the following advantages:

[0088] The evaluation target is more diverse, and the measurement method of the present application can be used for performance evaluation of various different structure models and different types of adversarial attack algorithms, and is more universal and flexible.

[0089] The score calculation method of the present application can analyze the performance score of the evaluation target according to a more comprehensive and strongly explanatory evaluation index system, and can more intuitively and comprehensively reflect the performance of the evaluation target and the performance difference between different models or attack algorithms. BRIEF DESCRIPTION OF DRAWINGS

[0090] Figure 1 is a score calculation flowchart based on the item response theory and the Markov chain Monte Carlo method of the present application;

[0091] Figure 2 is a general flowchart of the measurement, evaluation and score calculation method of the model robustness and attack effectiveness of the present application;

[0092] Figure 3 is a detailed flowchart of an embodiment of the present application. DETAILED DESCRIPTION

[0093] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and are not used to limit the present application.

[0094] Embodiment 1, see the attached drawings of the specification Figure 3 .

[0095] A, B, C are used to represent three classical models in this embodiment; I, II are used to represent two classical attack methods; S0 is used to represent the used data set.

[0096] The detailed steps of this embodiment are as follows:

[0097] Step I, cross-combine the models A, B, C and attack methods I, II, a total of 6 model-attack method groups are generated;

[0098] Step II, for a model-attack method group, traverse the original images x i (x i ∈S0) in the data set, input x i into the model for inference, and record the Grad-CAM data and inference result in the process;

[0099] Step III, attack the model using the attack method in this group: traverse the original images x i to generate adversarial samples Record the adversarial sample generation time data and model query amount data in the process;

[0100] Step IV, traverse the adversarial samples generated in the foregoing steps and input them into the model for inference, and record the Grad-CAM data and inference result data in the process;

[0101] Step V, calculate indicators C11-C13 using the data recorded in step II to obtain evaluation indicators c11-c13;

[0102] Step VI, calculate indicators C33-C35 using the adversarial samples generated in step III by comparing with the original images to obtain evaluation indicators c33-c35;

[0103] Step VII, compare the adversarial sample inference data recorded in the foregoing step IV with the original image inference data recorded in step II, calculate indicators C21-C25 to obtain evaluation indicators c21-c25;

[0104] Step VIII, calculate indicators C31-C32 using the data of the generated adversarial samples recorded in step III to obtain evaluation indicators c31-c32;

[0105] Step IX, record the evaluation indicator array [c11…c35] of the model-attack method, and determine whether the indicators of all model-attack methods are calculated, if all are calculated, continue to execute step X, otherwise, repeat steps II-IV until completion;

[0106] Step X, the evaluation index calculated in the model i and attack method j group is denoted as an element E in the data matrix ij ij , a data matrix M is formed with attack method and model as the axis, which can be expressed as

[0107] Step XI, according to the task objective, the data matrix M obtained in step X is superimposed and averaged along the change direction of the attack method or the model, to obtain a general evaluation index data M': when the task objective is to evaluate the robustness of the model, the data of the elements in the data matrix need to be superimposed and averaged along the attack method direction, which can be expressed as When the task objective is to evaluate the attack method, the elements in the data matrix need to be superimposed and averaged along the model direction, which can be expressed as M'=[E Ⅰ E Ⅱ ]=[(E AⅠ +E BⅠ +E CⅠ ) / 3 E AⅡ +E BⅡ +E CⅡ ) / 3];

[0108] Step XII, map all element values in the general evaluation index matrix M' generated in step XI to the range of [0, 1];

[0109] Step XIII, normalize the values of the mapped indexes to [0, 1] using the max-min normalization method, to obtain the processed evaluation index matrix X suitable for score calculation;

[0110] Step XIV, set the initial values of the parameters in the score calculation method: set the initial value of the number of subjects N=3, the number of test items m=13, the number of iteration steps L=1000, the number of convergence steps M=70, and the subject score matrix is equal to the processed evaluation index matrix X in step XIII three;

[0111] Step XV, randomly extract a candidate state value: sample

[0112] Step XVI, calculate the acceptance probability The calculation formula is as described above;

[0113] Step XVII, sample u from a uniform distribution Uniform[0, 1], if then accept the transition: and let otherwise, reject the transition, and let

[0114] ​Step XVIII, sample each item parameter (j = 1, 2, …, m)

[0115] Step XIX, calculate the acceptance probability: The calculation formula is as described above.

[0116] Step XX, sample u ~ Uniform [0, 1] from a uniform distribution, if the sampling point satisfies then accept the transition, and let otherwise, reject the transition, and let

[0117] Step XXI, determine whether the iteration step is completed, if not, return to Step X to continue execution; if yes, execute Step XXII.

[0118] Step XXII, obtain the sample set Calculate the ability score of the subject and the item parameter

[0119] Step XXIII, analyze and evaluate the model A, B, C or attack method I, II according to the ability score of the evaluation target calculated in Step XXII.

[0120] The present application is described in detail through the above examples. It should be noted that the examples are only preferred embodiments of the present application, and are not all embodiments, and the protection scope of the present application is not limited to the content disclosed in the examples and the drawings. The protection scope of the present application is determined by the claims. Without departing from the spirit and essence of the present application, the technical solutions obtained by equivalent substitution or modification of the technical features in the examples or claims all fall within the protection scope of the present application.

Claims

1. A method for measuring, evaluating, and calculating scores of model robustness and attack effectiveness, characterized in that, The method comprises: Step 1, establishing an evaluation index system composed of model capability evaluation indexes, attack effect evaluation indexes and attack cost evaluation indexes; The model capability evaluation indexes comprise clean sample accuracy (C11), clean sample F1 score (C12) and clean sample average correct classification confidence (13); the attack effect evaluation indexes comprise adversarial sample misclassification proportion (C21), attack accuracy C22, adversarial sample average confidence change (C23), adversarial sample model attention area offset (C24) and adversarial sample observable transfer rate (C25); and the attack cost evaluation indexes comprise attack consumption cost (C31), attack query amount cost (C32), average norm distortion (C33), average frequency domain Euclidean distance (C34) and average feature similarity (C35); Step 2, evaluating the evaluation indexes in the evaluation index system; The step of evaluating the evaluation indexes in the evaluation index system comprises the following steps: S11, cross-combining a plurality of models and attack methods, respectively collecting and calculating the evaluation indexes of each model-attack method combination to form a data matrix; S12, according to a task target, superimposing and averaging the data matrix obtained in S11 along the change direction of the attack method or the model, so as to mask the differences caused by different models or different attack methods, and obtaining general evaluation index data; S13, mapping and normalizing the general evaluation index data obtained in S12 to obtain evaluation indexes suitable for score calculation after processing; S14, using a comprehensive ability calculation method based on the item response theory and the Markov chain Monte Carlo method to calculate the ability score of the evaluation target according to the evaluation indexes after processing in S13; and S15, analyzing and evaluating the ability score of the evaluation target calculated by the foregoing evaluation method; Step 3, score calculation based on the item response theory and the Markov chain Monte Carlo method The score calculation based on the item response theory and the Markov chain Monte Carlo method includes the following steps, assuming: θ i represents the ability of the ith subject, a j represents the discrimination of the jth test item, β j represents the difficulty of the jth test item, c j represents the guessing parameter of the jth test item, N represents the number of subjects, m represents the number of test items, X i＝1→N,j＝1→m represents the subject score matrix, L represents the number of iterations, M represents the number of convergence steps, and here the subject refers to the evaluation target, i.e. the model or the adversarial attack algorithm; according to the experiment, initial values are set for the parameters N, m, L, and M, and the processed evaluation index obtained in the S14 is used to construct the subject score matrix X i＝1→N,j＝1→m ; an initial value is arbitrarily selected for the parameters θ, a, β, and c After the initial parameters are set, the loop is started and is executed until the number of iterations is completed; a sample set is obtained The ability score of the subject is calculated and the item parameters The "after the initial parameter setting is completed, start executing the loop until the iteration step is completed" includes: randomly extracting a candidate state value: sampling each subject (i=1, 2, …, N) Calculate acceptance probability: Sample u from a uniform distribution: u~Uniform[0, 1], if Accept transition: and let Otherwise, reject the transition, and let Sample each item parameter (j=1, 2, …, m) Calculate acceptance probability: Sample u from a uniform distribution: u~Uniform[0, 1], if the sampling point satisfies Accept transition, and let Otherwise, reject the transition, and let 2. The method of claim 1, wherein the method further comprises: determining a score for the model robustness and attack effectiveness based on the model robustness and attack effectiveness. The clean sample accuracy (C11) index represents the accuracy of the model in classifying the clean dataset, and can be represented as wherein F(x i ) represents the result label value obtained by the classification model f in predicting the original image x i , y i represents the true label of the original image x i ; the clean sample F1 score (C12) index represents the F1 score of the model in classifying the clean dataset, and can be represented as wherein the recall rate is represented as the accuracy rate is represented as wherein The clean sample average correct classification confidence (C13) index represents the average confidence of the model in classifying the clean dataset, and can be represented as wherein P(x i ) represents the confidence matrix obtained by the classification model f in reasoning the original image x i ; the adversarial sample misclassification proportion (C21) index represents the proportion of the number of pictures that are misclassified as any other class different from that before the attack after the attack, and can be represented as: wherein represents the adversarial sample generated after the original image x i is attacked by a, represents the label obtained by the classification model f in reasoning the adversarial sample , y i represents the true label of the original image x i ; the attack accuracy index (C22) is used to measure the effect of the directed attack, and can be represented as: wherein represents the target label of the directed attack; the adversarial sample confidence offset index (C23) is used to reflect the change in the confidence of the model before and after the attack, and to measure the degree of deviation of the attack on the model recognition result, and is composed of two sub-indices of the average confidence increase of the adversarial class and the average confidence decrease of the real class, which respectively reveal the degree to which the attack deceives the classifier to classify the attacked picture as the adversarial class or deviates from the real class, and can be represented as: and wherein represents the label obtained by the classification model f in reasoning the adversarial sample , P(x i ) represents the confidence matrix obtained by the classification model f in reasoning the original image x i , P(x i ) function subscript represents the confidence value of the class; the attention region offset (C24) of the adversarial sample model is used to analyze whether the attack makes the model pay attention to the wrong features or information by calculating the cosine similarity of the attention region of the model before and after the attack, and is composed of two sub-indicators of the offset of the region corresponding to the prediction result class of the model before and after the attack and the offset of the region corresponding to the original label class before and after the attack, and can be respectively represented as: and wherein, represents the attention region of the model on the class during sample reasoning, and can be represented as A k represents the data of channel k in A, A is the feature layer of the output of the last convolutional layer, is the weight, and can be represented as P c is the prediction score of the class c, is the data of ij in channel k in A, Z is the area of A, and S(a,b) is the cosine similarity of a and b; the observable transfer rate (C25) of the adversarial sample is used to reflect the proportion of the adversarial sample generated by the attack to a specific target model being misclassified by other models, and can be represented as: wherein, m is the number of standard models to be tested, A(F,x)→x a is the adversarial sample x a is generated by the original picture x via the attack algorithm A based on the model F; the attack time cost (C31) is used to reflect the time cost of the attack method for generating an adversarial sample; the attack query amount cost (C32) is used to reflect the average model query amount of the attack method for generating an adversarial sample, including the Forward operation of the model in the attack process and the Backward operation of the model in the attack process; the average norm distance distortion (C33) represents the norm distance of the image before and after the attack, which is composed of three sub-indicators of the average maximum pixel distance, the average Euclidean distance, and the average pixel change ratio; the average frequency domain Euclidean distance (C34) represents the average Euclidean distance of the high-frequency and low-frequency components of the image after frequency domain difference before and after the attack, which is composed of two sub-indicators of the Euclidean distance of the low-frequency component reconstruction image and the Euclidean distance of the high-frequency component reconstruction image; the average feature similarity (C35) represents the offset degree of the color, structure, texture and other features of the image before and after the attack, which is composed of two sub-indicators of the average deep feature similarity and the average low-level feature similarity.

3. The method of claim 2, wherein the model robustness and attack effectiveness measurement evaluation and score calculation method is characterized by: The average maximum pixel distance is the maximum deviation of the pixels of the adversarial sample relative to the original picture, which is often used as a disturbance limit condition for attack methods, and can be expressed as: where ||·||∞ represents the infinity norm used to calculate the maximum deviation of the pixels in the picture. ∞ The average Euclidean distance is the Euclidean distance between the original picture and the adversarial sample, and can be expressed as: where ||·||2 represents the Euclidean norm used to calculate the Euclidean distance, and ||·||0 represents the 0 norm used to calculate the number of non-zero elements in the vector. The average pixel change ratio is the number of pixels modified by the adversarial sample relative to the original picture, and can be expressed as: The Euclidean distance of the low-frequency component reconstructed image can be expressed as The Euclidean distance of the high-frequency component reconstructed image can be expressed as where φ ll (x) = L T (LxL T )L, φ lh+hl+hh (x) = L T (LxH T )H + H T (HxL T )L + H T (HxL T )L, L and H are the low-pass filter and high-pass filter of the orthogonal wavelet respectively. The average depth feature similarity is the multi-scale gradient amplitude similarity deviation of all adversarial samples that are successfully attacked, and can be expressed as where: where σ j (x, y) is the GMSD score at the jth scale, ω j is the weight value of different scales. The average low-level feature similarity is the depth image structure and texture similarity of all adversarial samples that are successfully attacked, and can be expressed as where: where: is the texture similarity measure, which can be expressed as is the structure similarity measure, which can be expressed as {a ij , β ij} are learnable weights, and satisfy where: represent the global average of and , respectively. represent the variance of and , respectively. represent the variance of and global covariance, c1 and c2 bias.

Images