Spectrum identification training method for translation invariant adversarial attack

Abstract

The invention discloses a frequency spectrum recognition training method for translation invariant adversarial attacks, which belongs to the field of image training, and comprises the following steps: constructing a translation invariant attack target function, and generating adversarial samples for a group of pictures subjected to translation transformation; the translation invariant attack method can effectively reduce the degree of dependence of the adversarial sample on the adopted white box model, thereby improving the migration attack success rate of the black box defense model. In order to more efficiently optimize the translation invariant attack target function, under the assumption that the convolutional neural network has translation invariance, an attacker can calculate the gradient of a model loss function for a non-translated picture, and then the gradient and a preset kernel matrix are subjected to convolution to approximate the gradient of the translation invariant attack target function. The translation invariant attack method can be combined with all gradient-based attack methods, and the experimental result verifies the effectiveness of the proposed method.

Description

Technical Field

[0001] The present invention relates to the field of image training, and in particular to a spectrum recognition training method for translation-invariant counterattack. Background Art

[0002] Deep learning models can be easily fooled by adversarial examples, which poses a huge security threat to the practical application of deep learning and has triggered extensive research on building more robust deep learning models. Adversarial defense technology enhances the robustness of models by adding different defense mechanisms to the models. Although many defenses have shown good defense capabilities against adversarial examples generated by existing attack methods, it remains to be seen whether they still have defense capabilities against unknown and more powerful attack methods, which has become an important research issue.

[0003] Most adversarial defenses in the existing technology falsely improve the defense capability of the model under gradient-based adversarial attacks by causing obfuscated gradients, but do not really enhance the robustness of the model. Taking JPEG compression as an example, JPEG compression of the input image can make the gradient of the model loss function for the input data non-existent, which makes it impossible for gradient-based attack methods to generate adversarial samples. However, attackers can still break through the defense based on JPEG compression through other attack methods (such as black-box attacks), indicating that its robustness has not been improved. Some works have broken through most defense models by constructing adaptive attacks, but most of these attack methods are based on white-box scenarios and require the specific defense mechanism of the defense model. In the black-box migration attack scenario, some typical defense models show good defense capabilities. However, the current defense capabilities of these defenses against black-box migration attacks are likely to be caused by the lack of more powerful attack methods, rather than their real good robustness in the black-box migration attack scenario. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention provides a translation-invariant adversarial attack identification method.

[0005] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0006] A spectrum recognition training method for translation invariant countermeasure attack includes the following steps:

[0007] S1. Construct a translation-invariant attack objective function and perform multiple rounds of iterations;

[0008] S2. Use the convolutional neural network to calculate the gradient of the model loss function for multiple differently translated images in each iteration;

[0009] S3. Based on the gradients of multiple differently translated images obtained in S2, the translation-invariant attack method is combined with the gradient-based attack method to calculate the gradient of the translation-invariant attack objective function and generate adversarial samples of differently translated images.

[0010] Furthermore, the translation invariant attack objective function in S1 is expressed as:

[0011] ;

[0012] In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, is the magnitude of the perturbation applied to the input sample in the gradient direction.

[0013] Furthermore, the S2 specifically includes the following steps:

[0014] S21. Construct a convolutional neural network with translation invariance of different kernel matrices and set initial conditions.

[0015] S22. Calculate the gradient of a given input image and translate and weighted average the gradient.

[0016] Furthermore, in S21, the different kernel matrices include a uniform kernel matrix, a linear kernel matrix and a Gaussian kernel matrix, and their initial conditions are:

[0017] The given input image is translated no more than 10 pixels in each dimension;

[0018] The constructed convolutional neural network has the same gradient for multiple differently translated images.

[0019] Furthermore, the constructed convolutional neural network has the same gradient for multiple differently translated images, which is specifically expressed as:

[0020] ;

[0021] In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, For a given input image.

[0022] Furthermore, the specific method of calculating the gradient of the given input image in S22 is:

[0023] ;

[0024] In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, Representation and The translation direction is opposite to that of To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, For a given input image, is the symbol for partial derivative calculation.

[0025] Furthermore, the generation method of the adversarial sample in S3 is specifically as follows:

[0026] ;

[0027] In the formula, is the generated adversarial sample, is the real category, is the original image, is the model loss function, is the amplitude of the perturbation applied to the input sample in the gradient direction, is the kernel matrix.

[0028] The present invention has the following beneficial effects:

[0029] Without increasing the computational complexity, the translation-invariant attack method can be combined with all gradient-based attack methods. The experimental results verify the effectiveness of the translation-invariant attack method, which can significantly improve the success rate of black-box migration attacks against typical defense models. The most effective attack in the experiment achieved an average black-box migration attack success rate of 82% against the eight defense models, verifying the lack of robustness of the studied adversarial defense model in the black-box migration attack scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart of the spectrum recognition training method for translation-invariant counterattack of the present invention.

[0031] Figure 2 This is a schematic diagram of the loss plane of the Inc-v3 convolutional neural network under translation transformation when the original image and the image after translation transformation are input into the Inc-v3 convolutional neural network under translation transformation in an embodiment of the present invention.

[0032] Figure 3 This is a schematic diagram of the loss plane of the Inc-v4 convolutional neural network under translation transformation when the original image and the image after translation transformation are input into the Inc-v4 convolutional neural network under translation transformation in an embodiment of the present invention.

[0033] Figure 4 This is a schematic diagram of the loss plane of the original image and the image after translation transformation when inputting the IncRes-v2 convolutional neural network under translation transformation in an embodiment of the present invention.

[0034] Figure 5 The embodiment of the present invention is a schematic diagram of the loss plane of inputting the original image and the image after translation transformation into the Res-152 convolutional neural network under translation transformation.

[0035] Figure 6 This is a schematic diagram of the success rate of attacking kernel matrices of different sizes using the TI-FGSM method in an embodiment of the present invention.

[0036] Figure 7 This is a schematic diagram of the success rate of attacking kernel matrices of different sizes using the TI-MIM method in an embodiment of the present invention.

[0037] Figure 8 This is a schematic diagram of the success rate of attacking kernel matrices of different sizes using the TI-DIM method in an embodiment of the present invention.

[0038] Fig. 9 This is an example diagram of adversarial samples generated by TI-FGSM under different kernel matrix sizes according to an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0040] A spectrum recognition training method for translation-invariant adversarial attacks, such as Figure 1 As shown, the following steps are included:

[0041] S1. Construct a translation-invariant attack objective function and perform multiple rounds of iterations;

[0042] There is a significant difference between the discriminant regions that the adversarial defense model and the normal training model rely on when predicting the original image. Existing attack methods only maximize the model's loss function for the original image x in the process of generating adversarial samples. , which will make the generated adversarial examples It is highly correlated with the discriminative region or gradient of the white-box model. For example, the adversarial perturbation generated by the fast gradient sign method is the model loss function for the original image. The gradient sign direction of . Therefore, for other black-box defense models with different discriminant regions or gradients, it is difficult for adversarial samples to have migration capabilities. As a result, some typical defense models show good robustness against black-box migration attacks.

[0043] In order to reduce the reliance of adversarial samples on the discriminant area of ​​the white-box model and improve the success rate of its migration attack on the black-box model, this embodiment proposes a translation-invariant attack method. Unlike the existing attack method that only maximizes the loss function of the model for the original image, the translation-invariant attack method calculates the loss of the model for a set of images that have been translated and averages them to obtain the translation-invariant attack objective function, as shown below:

[0044] ;

[0045] In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image. In the translation-invariant fast gradient sign method (TI-FGSM), the parameters is a hyperparameter that controls the size of the perturbation. It determines the degree of difference between the adversarial sample and the original image. Specifically, Represents the magnitude of the perturbation applied to the input sample in the gradient direction. This perturbation is to maximize the loss function, thereby generating adversarial samples that can deceive the model. The value of is usually a small positive number, such as 0.01, which determines the strength of the perturbation, that is, the degree of difference between the adversarial sample and the original image. In practical applications, the choice of needs to balance the concealment and effectiveness of the adversarial sample, that is, the adversarial sample should be small enough to be difficult for humans to detect, and strong enough to deceive the model. Translation invariance attack objective function sets the translation amount The value range is ,in Represents the maximum translation amount. You can see that if you set And other weights are 0, the translation invariant attack objective function degenerates into a general attack objective function. By optimizing the translation invariant attack objective function, the generated adversarial sample will not be overly dependent on the discrimination area of ​​the adopted white box model, and the black box migration attack effect on the defense model will also be enhanced. This embodiment only uses translation transformation to construct the attack objective function, and does not use other transformations such as rotation and scaling. The reason behind this is that based on the translation invariance of the convolutional neural network, the translation invariant attack objective function can be efficiently solved.

[0046] S2. Use the convolutional neural network to calculate the gradient of the model loss function for multiple differently translated images in each iteration;

[0047] In order to solve and optimize the translation invariant attack objective function to generate adversarial samples, each round of iteration in the optimization process needs to calculate the model loss function for a total of The gradient of the different translation images will bring high computational complexity. To solve this problem, a feasible solution is to randomly select a part of all the translation images to calculate the gradient, but the gradient obtained by this method is random and inefficient. This embodiment shows that under the assumption that the convolutional neural network is translation invariant, the gradient of the translation invariant attack objective function can be efficiently calculated.

[0048] Convolutional neural networks were designed with translation invariance in mind, meaning that the target object in the input image can be correctly identified no matter where it appears. However, due to the existence of structures such as pooling, convolutional neural networks cannot completely maintain translation invariance. The translation invariance attack objective function proposed in this embodiment usually selects a smaller translation transformation. In general, the distance that the image is translated in each dimension will not exceed 10 pixels, that is, In this case, the translation invariance of the convolutional neural network can be basically guaranteed. Therefore, this embodiment assumes that the convolutional neural network has translation invariance, that is, the model is invariant to the translated image. With the original picture The calculated losses are the same, and assuming the model has the same gradients for them, they can be expressed as

[0049] ;

[0050] in Represents a given input image. Based on the above assumptions, the gradient of the translation-invariant attack objective function for a given input image can be approximated as follows:

[0051] ;

[0052] As can be seen from the formula, the translation invariant attack does not require a computational model for The gradient of the image can be calculated only for the given input image. The gradient of , and then translate and weight the gradient. This process is equivalent to the convolution operation, as shown below:

[0053] ;

[0054] Where 𝑊 represents the kernel matrix.

[0055] In this way, the gradient of the translation invariant attack objective function can be obtained through a single gradient calculation, and the computational complexity does not increase compared to existing methods.

[0056] In addition, the translation invariant attack method does not limit the specific selection method of the kernel matrix. This embodiment further proposes three different kernel matrices:

[0057] Uniform kernel matrix (uniformkernelmatrix): Its value is: , that is, the model has the same weight for the loss calculated for all translation transformed images;

[0058] Linear kernel matrix (linearkernelmatrix): Its value is: ,in, , that is, the weight of the loss calculated by the model for the translated image changes linearly with the translation distance.

[0059] Gaussian kernel matrix: Its value is: ,in, and , that is, the weight of the loss calculated by the model for the translated image changes with the translation distance like a Gaussian probability density function.

[0060] S3. Based on the gradients of multiple differently translated images obtained in S2, the translation-invariant attack method is combined with the gradient-based attack method to calculate the gradient of the translation-invariant attack objective function and generate adversarial samples of differently translated images.

[0061] Gradient-based attack methods need to calculate the gradient of the model loss function with respect to the original image, and generate adversarial samples based on this gradient through different attack methods. Combining the translation-invariant attack method with the gradient-based attack method, the gradient in the original method can be replaced with the gradient of the derived translation-invariant attack objective function, thereby obtaining different attack algorithms.

[0062] Specifically, the translation-invariant attack method is combined with the fast gradient sign method (FGSM) to obtain the translation-invariant fast gradient sign method (TI-FGSM), and the process of generating adversarial samples can be described as:

[0063] ;

[0064] Combining the translation-invariant attack method with the momentum iteration method (MIM) can obtain the translation-invariant momentum iteration method (TI-MIM). It can be applied in scenarios such as attack under norm restriction and targeted attack. The attack process is similar to the above method, and is implemented by replacing the gradient in the original method with the gradient of the translation-invariant attack objective function, which will not be described in detail in this embodiment.

[0065] Verification

[0066] This example conducts experiments on the dataset used in the NeurIPS 2017 adversarial attack and defense competition. The dataset contains a total of 1,000 images and is consistent with the distribution of the ImageNet dataset.

[0067] This example selects eight defense models that are relatively effective against black-box transfer attacks on the ImageNet dataset, including:

[0068] •Integrated adversarial training models Inc-v3ens3, Inc-v3ens4 and IncRes-v2ens;

[0069] • High-Level Feature Guided Denoiser (HGD), which won the first place in the defense track of the NeurIPS 2017 adversarial attack and defense competition;

[0070] • Random Image Scaling and Padding (R&P), which won the second place in the defense track of NeurIPS2017 adversarial attack and defense competition;

[0071] •Image transformation defense based on JPEG compression and total variance minimization (TVM);

[0072] •Third place in the defense track of the NeurIPS2017 adversarial attack and defense competition (denoted as NeurIPS-r3).

[0073] In order to perform black-box migration attacks against these defenses, this embodiment selects four normally trained models as white-box models to generate adversarial samples, including Inceptionv3 (denoted as Inc-v3), Inceptionv4 (denoted as Inc-v4), InceptionResNetv2 (denoted as IncRes-v2), and ResNetv2152 (denoted as Res-152).

[0074] The experiment combines the translation-invariant attack method with the fast gradient sign method (FGSM), the momentum iteration method (MIM) and the diverse input method (DIM). The diverse input method randomly transforms the input data in each round of gradient iteration of adversarial sample generation to improve the migration ability of adversarial samples. The combined methods are respectively denoted as the translation-invariant fast gradient sign method (TI-FGSM), the translation-invariant momentum iteration method (TI-MIM) and the translation-invariant diverse input method (TI-DIM).

[0075] This embodiment mainly focuses on The untargeted attack experiments were conducted under the restriction of the norm. In all experiments, the maximum perturbation scale was set to e=16, and the image pixel value range was [0,255]. For the multi-step gradient iteration based method, the number of iterations was set to T=10 and the iteration step size was set to α=1.6. The momentum decay coefficient in MIM and TI-MIM was set to μ=1.0. It is worth noting that the settings of these parameters are only related to the original attack method.

[0076] First, we verify the translation invariance of the convolutional neural network. The experiment uses the original 1,000 images in the dataset and translates them by −10 to 10 pixels in each dimension. The original images and the translated images are input into the Inc-v3, Inc-v4, IncRes-v2, and Res-152 models respectively and the model losses are calculated. Figure 2-Figure 5 The loss plane of the model under translation transformation is shown, where the loss of the model under each translation transformation is the average loss of all translation images. Figure 2-Figure 5As can be seen in , the loss plane of the convolutional neural network is relatively smooth within the range of −10 to 10 pixels in each dimension. This shows that the convolutional neural network is translation invariant when the translation transformation is relatively small. In the translation invariant attack objective function, the translation distance of the image in each dimension will not exceed 10 pixels, so the loss of the original image and the translated image is very close. Therefore, the translation invariant attack method can assume that the model calculates the same loss for the translated image and the original image, and derive the gradient of the translation invariant attack objective function based on this assumption.

[0077] Experiments were conducted on the selection of different kernel matrices in the translation invariant attack method. The experiment used three methods, TI-FGSM, TI-MIM and TI-DIM, to attack the Inc-v3 model, where each method used three different kernel matrices, namely uniform kernel matrix, linear kernel matrix and Gaussian kernel matrix. Table 1 shows the success rate of black-box transfer attacks on eight adversarial defense models using attack methods with different kernel matrices, where the attack success rate is the classification error rate calculated by the corresponding model using the adversarial samples generated by different methods as input.

[0078] Table 1 Comparison of attack success rates (%) of translation-invariant attack methods using different kernel matrices

[0079]

[0080] From the results shown in Table 1, it can be seen that for TI-FGSM, the linear kernel matrix achieved a higher attack success rate than the uniform kernel matrix and the Gaussian kernel matrix. For TI-MIM and TI-DIM, the Gaussian kernel matrix achieved an attack effect similar to that of the linear kernel matrix. In all cases, the linear kernel matrix and the Gaussian kernel matrix achieved better attack effects than the uniform kernel matrix. This shows that in the design of the kernel matrix, a higher weight should be set for transformations with a smaller translation distance, and a lower weight should be set for transformations with a larger translation distance. Based on the experimental analysis of this embodiment, the following experiments all use the Gaussian kernel matrix.

[0081] The size of the kernel matrix in the translation-invariant attack method also plays a key role in the success rate of the black-box migration attack. If the kernel matrix size is 1×1, the translation-invariant attack objective function degenerates to the original attack objective function, and the attack method based on translation-invariant also degenerates to its original version. Therefore, this embodiment verifies the influence of the kernel matrix size on the attack results through experiments.

[0082] The experiment uses TI-FGSM, TI-MIM and TI-DIM to attack the Inc-v3 model, where the kernel matrix is ​​selected as a Gaussian kernel matrix, and its size increases from 1×1 to 21×21, with a change granularity of 2. Since the length and width of the kernel matrix are equal, for the sake of simplicity, this embodiment uses its length to represent the kernel matrix size, that is, the kernel matrix size ranges from 1 to 21. Figure 6-Figure 8 The success rate curves of black-box migration attacks on five defense models, IncRes-v2ens, HGD, R&P, TVM, and NeurIPS-r3, using adversarial samples generated by TI-FGSM, TI-MIM, and TI-DIM at different kernel matrix sizes are shown. It can be seen that the success rate of black-box migration attacks increases with the increase of kernel matrix size, but tends to stabilize after the kernel matrix size exceeds 15. The kernel matrix size is set to 15 in the following experiments.

[0083] Fig. 9 Examples of adversarial samples generated by using TI-FGSM to attack the Inc-v3 model with different kernel matrix sizes are shown. In the translation-invariant attack method, the gradients used to update the adversarial samples are obtained through convolution operations, so the effect is smoother. The perturbations added to the adversarial samples generated by the translation-invariant attack method also become smoother as the kernel matrix size grows.

[0084] Compare the black-box migration attack success rates of the translation-invariant attacks TI-FGSM, TI-MIM and TI-DIM with the benchmark methods FGSM, MIM and DIM. The experiment first uses the above attack method to attack the four white-box models Inc-v3, Inc-v4, IncRes-v2 and Res-152, and then uses the generated adversarial samples as input data to test the eight adversarial defense models studied in this embodiment to obtain the black-box migration attack success rate. In the experiment, the translation-invariant attacks TI-FGSM, TI-MIM and TI-DIM all use Gaussian kernel matrices, and their size is set to 15. Table 2 shows the black-box migration attack success rates of FGSM and TI-FGSM on all defense models. Table 3 shows the black-box migration attack success rates of MIM and TI-MIM on all defense models. Table 4 shows the black-box migration attack success rates of DIM and TI-DIM on all defense models.

[0085] Table 2 Comparison of attack success rates (%) between FGSM and TI-FGSM

[0086] Table 3 Comparison of attack success rates (%) between MIM and TI-MIM

[0087]

[0088] Table 4 Comparison of attack success rates (%) between DIM and TI-DIM

[0089]

[0090] From the experimental results in the three tables, we can see that compared with the baseline attack method, the translation-invariant attack method can greatly improve the success rate of the black-box migration attack on the defense model when different white-box models are selected. Under normal circumstances, the translation-invariant attack method can increase the attack success rate by 5% to 30%. It is worth emphasizing that, as can be seen from Table 4, by combining the translation-invariant attack method with DIM to obtain the TI-DIM attack, the adversarial samples generated using IncRes-v2 as the white-box model have a black-box migration attack success rate of about 60% on the defense model. The experimental results illustrate the vulnerability of these defense models to black-box migration attacks, and also verify the effectiveness of the translation-invariant attack method proposed in this embodiment. The perturbations added to the adversarial samples generated using TI-FGSM are smoother. Similar phenomena can also be observed in adversarial samples generated by other translation-invariant attack methods.

[0091] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0092] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0093] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0094] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0095] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A spectrum recognition training method for translation invariant countermeasure attack, characterized in that: The steps include: S1. Construct a translation-invariant attack objective function and perform multiple rounds of iterations; S2. Use the convolutional neural network to calculate the gradient of the model loss function for multiple differently translated images in each iteration; S3. Based on the gradients of multiple differently translated images obtained in S2, the translation-invariant attack method is combined with the gradient-based attack method to calculate the gradient of the translation-invariant attack objective function and generate adversarial samples of differently translated images.

2. The spectrum recognition training method for shift-invariant countermeasure attack according to claim 1 is characterized in that: The translation invariant attack objective function in S1 is expressed as: ； In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, is the magnitude of the perturbation applied to the input sample in the gradient direction.

3. The spectrum recognition training method for shift-invariant countermeasure attack according to claim 1 is characterized in that: The S2 specifically includes the following steps: S21. Construct a convolutional neural network with translation invariance of different kernel matrices and set initial conditions. S22. Calculate the gradient of a given input image and translate and weighted average the gradient.

4. The spectrum recognition training method for shift-invariant countermeasure attack according to claim 3 is characterized in that: In S21, the different kernel matrices include a uniform kernel matrix, a linear kernel matrix, and a Gaussian kernel matrix, and their initial conditions are: The given input image is translated no more than 10 pixels in each dimension; The constructed convolutional neural network has the same gradient for multiple differently translated images.

5. The spectrum recognition training method for shift-invariant countermeasure attack according to claim 4 is characterized in that: The constructed convolutional neural network has the same gradient for multiple differently translated images, specifically expressed as: ； In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, For a given input image.

6. The spectrum recognition training method for shift-invariant attack according to claim 4 is characterized in that: The specific method of calculating the gradient of the given input image in S22 is: ； In the formula, is the model loss function; To put pictures Shift in two dimensions and The translation transformation image after pixels, Representation and The translation direction is opposite to that of To transform the image by translation The weight of the loss calculated for the input, is the generated adversarial sample, is the real category, is the original image, For a given input image, is the symbol for partial derivative calculation.

7. The spectrum recognition training method for shift-invariant countermeasure attack according to claim 1, characterized in that: The method for generating adversarial samples in S3 is specifically as follows: ； In the formula, is the generated adversarial sample, is the real category, is the original image, is the model loss function, is the amplitude of the perturbation applied to the input sample in the gradient direction, is the kernel matrix.

Images