Method and system for confronting attack by using momentum of self-adaptive strategy

Abstract

The invention provides a momentum confrontation attack method and system using a self-adaptive strategy. The method comprises the following steps: training a sample according to selected data; the trained samples are preprocessed; based on the preprocessed sample, selecting a neural network model to obtain a momentum model; introducing an adaptive step length matrix, and obtaining an adversarial sample model according to the momentum model and the adaptive step length matrix; and obtaining an adversarial attack success rate according to the adversarial sample model. According to the method, migration and stability of attack resistance are effectively improved, and the highest attack success rate of an existing momentum-based attack method can be achieved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a momentum counterattack method and system using an adaptive strategy. Background Art

[0002] Whether it is a convolutional neural network or the current hot Transformer network and diffusion model, they are all vulnerable to attacks from adversarial samples, resulting in model prediction errors, thus restricting the popularization and use of artificial intelligence systems. At present, the momentum-based adversarial attack method has the following main problems: the white-box attack success rate of the adversarial attack method is high, and the black-box attack success rate is low. In other words, adversarial attack methods generally have the problem of low transferability, and the attack success rate of existing adversarial attack methods is not high enough. As the number of iterations of the adversarial attack algorithm increases, the stability of the attack success rate is not high enough.

[0003] In summary, the prior art has the following problems: facing black box models, the existing momentum-based adversarial attack methods have low transferability. Summary of the invention

[0004] The purpose of the present invention is to solve the problem of how to improve the transferability of existing momentum countermeasure attack methods in the face of black box models.

[0005] To this end, on the one hand, an embodiment of the present invention provides a momentum counterattack method using an adaptive strategy (a momentum counterattack method with optimal convergence), the method comprising the following steps:

[0006] Training samples based on selected data;

[0007] Preprocess the trained samples;

[0008] Based on the preprocessed samples, a neural network model is selected to obtain a momentum model;

[0009] An adaptive step size matrix is ​​introduced, and an adversarial sample model is obtained according to the momentum model and the adaptive step size matrix;

[0010] The adversarial attack success rate is obtained according to the adversarial sample model.

[0011] On the other hand, an embodiment of the present invention further provides a momentum counterattack system using an adaptive strategy, including:

[0012] A training unit, used for training samples according to selected data;

[0013] A processing unit, used for preprocessing the trained samples;

[0014] A computing unit, used for selecting a neural network model to obtain a momentum model based on the preprocessed samples;

[0015] A construction unit, used to introduce an adaptive step size matrix, and obtain an adversarial sample model according to the momentum model and the adaptive step size matrix;

[0016] An output unit is used to obtain the success rate of the adversarial attack according to the adversarial sample model.

[0017] The above technical solution has the following beneficial effects: the present invention effectively improves the mobility and stability of anti-attack, and can achieve the highest attack success rate of existing momentum-based attack methods. More importantly, it proves that this method has the optimal convergence rate in general convex cases, filling the gap in theoretical analysis in this field. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flow chart of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention;

[0019] Figure 2 It is a structural schematic diagram of a momentum counterattack system using an adaptive strategy provided by an embodiment of the present invention;

[0020] Figure 3 The embodiment of the present invention provides a schematic diagram of adversarial sample generation and migration attack;

[0021] Figure 4 This is a first implementation comparison diagram of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and an existing method MI-FGSM;

[0022] Figure 5 It is a comparison diagram of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and a second implementation method of the existing method MI-FGSM;

[0023] Figure 6 It is a comparison diagram of the third implementation mode of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and an existing method MI-FGSM;

[0024] Figure 7 It is a fourth implementation comparison diagram of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and an existing method MI-FGSM;

[0025] Figure 8 It is a fifth implementation comparison diagram of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and an existing method MI-FGSM;

[0026] Fig. 9It is a sixth implementation comparison diagram of the convergence of a momentum counterattack method using an adaptive strategy provided by an embodiment of the present invention and an existing method MI-FGSM; DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Whether it is a convolutional neural network or the current hot Transformer network and diffusion model, they are all vulnerable to adversarial examples, which lead to model prediction errors, thus restricting the popularization and use of artificial intelligence systems. Therefore, studying the adversarial attack methods in deep learning is of great significance to building a secure and trustworthy artificial intelligence system. Figure 3 This is a diagram of adversarial sample generation and transfer attack, which shows the adversarial attack process for image data. It is divided into two stages: one is adversarial sample generation, and the other is black box transfer attack. Due to the unknown hyperparameters of the black box model, the second stage is the reason why the success rate of current adversarial attack methods is not high.

[0029] In the embodiment of the present invention, Figure 1 , a momentum adversarial attack method using an adaptive strategy is provided, the method comprising the following steps:

[0030] S101: training samples according to selected data;

[0031] When a device detects that it needs to update its firmware or software, it initiates an update request. The device sends an update request message to a remote server via the network, which contains a unique identifier of the device, such as a device ID.

[0032] Server responds to the request: After receiving the update request, the server checks whether the device's unique identifier is in the list of devices allowed to update.

[0033] If the device is authorized to update, the server selects a challenge message (Challenge) from the pre-stored challenge-response database and sends the string together with the server's certificate to the device.

[0034] S102: preprocessing the trained samples;

[0035] S103: Based on the preprocessed samples, a neural network model is selected to obtain a momentum model;

[0036] S104: introducing an adaptive step size matrix, and obtaining an adversarial sample model according to the momentum model and the adaptive step size matrix;

[0037] S105: Obtaining an adversarial attack success rate according to the adversarial sample model.

[0038] The momentum model comprises:

[0039]

[0040] Among them, g t is the gradient accumulated in the first t iterations, μ t is the momentum coefficient μ t >0;x adv is the adversarial sample generated by adding noise to the original sample x, and y is the label of the original sample. It represents the gradient operation at x.

[0041] The adaptive step size matrix is:

[0042]

[0043] Among them, V t =diag(v t ),

[0044] I is the identity matrix, δ is a constant coefficient, g j is the gradient accumulated in the first j iterations, v t It is to calculate the arithmetic average of the square of the accumulated gradient g.

[0045] Adversarial sample models; including:

[0046]

[0047] P is the projection operation, represents the adversarial sample image generated in the tth step, represents the adversarial sample image generated in step t+1; α t is the step size, α t >0;g t+1 is the accumulated gradient in the first t+1 iterations.

[0048] Obtaining the adversarial attack success rate according to the adversarial sample model includes:

[0049] A known white-box model is used to generate adversarial samples, which are then used to attack an unknown black-box model, thereby achieving transferable adversarial attacks.

[0050] The present invention also provides a device remote update device based on PUF security, such as Figure 2 As shown, including:

[0051] A training unit 21, used for training samples according to selected data;

[0052] A processing unit 22, used for preprocessing the trained samples;

[0053] A calculation unit 23, configured to select a neural network model to obtain a momentum model based on the preprocessed samples;

[0054] A construction unit 24 is used to introduce an adaptive step size matrix, and obtain an adversarial sample model according to the momentum model and the adaptive step size matrix;

[0055] The output unit 25 is used to obtain the adversarial attack success rate according to the adversarial sample model.

[0056] Momentum models, including:

[0057]

[0058] Among them, g t is the gradient accumulated in the first t iterations, μ t is the momentum coefficient μ t >0;x adv is the adversarial sample generated by adding noise to the original sample x, and y is the label of the original sample. It represents the gradient operation at x.

[0059] The adaptive step size matrix is:

[0060]

[0061] Among them, V t =diag(v t ),

[0062] I is the identity matrix, δ is a constant coefficient, g j is the gradient accumulated in the first j iterations, v t It is to calculate the arithmetic average of the square of the accumulated gradient g.

[0063] Adversarial sample models; including:

[0064]

[0065] P is the projection operation, represents the adversarial sample image generated in the tth step, represents the adversarial sample image generated in step t+1; α t is the step size, α t >0;gt+1 is the accumulated gradient in the first t+1 iterations.

[0066] The output unit comprises:

[0067] It is used to use a known white-box model to generate adversarial samples, and then use the generated adversarial samples to attack unknown black-box models, thereby achieving transferable adversarial attacks.

[0068] The advantages of the present invention are: the present invention effectively improves the mobility of the adversarial attack, can achieve the highest attack success rate of the existing momentum-based attack method, and more importantly, proves that the method has the optimal convergence rate in the general convex case, filling the gap in theoretical analysis in this field. The adaptive step size matrix proposed by the present invention can be combined with the existing adversarial attack method as a general strategy to effectively improve the mobility and stability of the black box attack.

[0069] The above technical solution of the embodiment of the present invention is described in detail below in conjunction with specific application examples. For technical details not introduced during the implementation process, please refer to the relevant description in the previous text.

[0070] Embodiment 1:

[0071] The present invention provides a momentum adversarial attack method using an adaptive strategy, that is, a momentum adversarial attack method with optimal convergence. Adversarial attacks can be divided into targeted attacks and non-targeted attacks, where targeted attacks are adversarial samples generated to make the category of the model output a specified label, that is, f(x adv )=y * Here, x adv is the adversarial sample generated by adding noise to the original sample x, y * is the target label specified by the attacker, y is the label of the original sample and y * ≠y. In contrast, untargeted attacks only need to generate adversarial samples to make the model output an incorrect label. That is, f(x adv )≠y. In order to ensure the quality of generated adversarial samples, the amount of perturbation added is usually constrained: ||x adv -x|| p ≤∈.

[0072] The process of generating adversarial samples is actually a problem of maximizing loss under constraints.

[0073] max J(x adv ,y),st||x adv -x|| ∞ ≤ε,

[0074] Where J(x adv,y) is expressed as a first-order differentiable loss function.

[0075] In the field of adversarial attacks, the momentum-based iterative fast gradient sign method MI-FGSM has become the mainstream method. The update rule is described as follows:

[0076] g0=0,

[0077]

[0078] Among them, G t is the accumulated gradient in the previous t iterations, and μ is the momentum coefficient. The MI-FGSM method adds momentum terms and accumulates historical gradient information, so it can stably update the direction and easily skip local extreme points. However, studies have shown that since MI-FGSM contains signed gradient operations, the algorithm lacks theoretical analysis in terms of convergence analysis and stability. In order to fill this gap, the present invention takes MI-FGSM as an example, and uses an adaptive strategy momentum counterattack method on this basis, namely AdaMI.

[0079] g0=0,

[0080]

[0081] V t =diag(v t ),

[0082]

[0083] It can be seen that AdaMI introduces an adaptive step size matrix and no longer contains symbolic gradient operations. This method can obtain the expected theoretical convergence results. AdaMI specifically includes the following steps:

[0084] Select experimental data, set random seeds, and extract 1000 training samples.

[0085] Input image sample data x, perform necessary preprocessing, and reset the image size to 3×224×244;

[0086] A neural network model is selected, including a white-box model and a black-box model. The AdaMI algorithm proposed in the present invention will be used in the following steps to generate adversarial samples using a known white-box model, and then these samples are used to attack other unknown black-box models, thereby achieving transferable adversarial attacks.

[0087] Initialize adversarial perturbation ∈, step size α t>0, momentum coefficient μ t >0, momentum g0=0, initialize adaptive step size matrix V0=0 d×d ;

[0088] Calculating Momentum

[0089] Compute the adaptive step size matrix V t =diag(v t ),

[0090] Iterative output of generated adversarial samples: Where P is the projection operation, represents the adversarial sample image generated in the tth step, Represents the adversarial sample image generated at step t+1.

[0091] Calculate the success rate of adversarial attacks;

[0092] Visualize the output adversarial samples and attack effects;

[0093] The present invention proposes a general adaptive strategy, which can be combined with the current momentum-based adversarial attack to form a new algorithm, such as combining with MI-FGSM to form AdaMI, combining with NI-FGSM method to form AdaNI, and combining with PGN method to form AdaPGN.

[0094] The evaluation criteria for adversarial sample generation are mainly measured by the success rate of adversarial attacks. The higher the success rate of black-box attacks, the better the transferability of adversarial attack methods. In addition, the quality of adversarial attack algorithms is mainly represented by the convergence rate.

[0095] To verify the effect, Figure 4 , Figure 5 , Figure 6 , Figure 7 , Figure 8 , Fig. 9 As shown, the present invention selects ILSVRC2012 as a data set for algorithm verification. Model selection is divided into two categories: convolutional neural network (CNN) and visual transformer network (ViT), among which CNN models include ResNet (Res34) and Inception (Inc_v3), and ViT models include Visformer (Vis_s) and Swin (Swin_s). The evaluation of the quality of the adversarial attack is expressed by the attack success rate. The higher the rate, the better the attack effect and the more effective the attack method. Figure 6 and Figure 7It can be explained that as the number of algorithm iterations increases, the method using the adaptive strategy of the present invention shows better stability and can still maintain a high attack success rate, while the attack success rate of MI-FGSM decreases.

[0096] As a general strategy, the adaptive strategy can be combined with the existing momentum attack to form a new adversarial attack method. The results are shown in Table 1. The adaptive strategy proposed in this invention can effectively improve the attack success rate of the corresponding original algorithm. It can be seen that AdaI is better than I-FGSM, AdaMI is better than MI-FGSM, and AdaNI is better than NI-FGSM. Among the new methods generated after the combination, AdaPGN has the best attack success rate (transferability) among the current momentum-based adversarial attack methods.

[0097] Table 1 Comparison of attack success rates of momentum attack methods (%)

[0098]

[0099]

[0100] The present invention effectively improves the mobility of adversarial attacks and can achieve the highest attack success rate of existing momentum-based attack methods. More importantly, it proves that this method has the optimal convergence rate in general convex situations, filling the gap in theoretical analysis in this field. The adaptive step-size matrix proposed in the present invention can be combined with existing adversarial attack methods as a general strategy to effectively improve the mobility and stability of black-box attacks.

[0101] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process can be rearranged without departing from the scope of protection of the present disclosure. The attached method claims present the elements of the various steps in an exemplary order and are not intended to be limited to the specific order or hierarchy described.

[0102] In the above detailed description, various features are grouped together in a single embodiment to simplify the disclosure. This method of disclosure should not be interpreted as reflecting an intention that the embodiments of the claimed subject matter require more features than are clearly stated in each claim. On the contrary, as reflected in the appended claims, the invention is in a state of having less than all the features of the disclosed individual embodiments. Therefore, the appended claims are hereby expressly incorporated into the detailed description, with each claim standing on its own as a separate preferred embodiment of the invention.

[0103] The disclosed embodiments are described above to enable any person skilled in the art to implement or use the present invention. Various modifications of these embodiments are obvious to those skilled in the art, and the general principles defined herein may also be applied to other embodiments without departing from the spirit and scope of the present disclosure. Therefore, the present disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0104] The above description includes examples of one or more embodiments. Of course, it is impossible to describe all possible combinations of components or methods for the purpose of describing the above embodiments, but it should be recognized by those skilled in the art that the various embodiments may be further combined and arranged. Therefore, the embodiments described herein are intended to cover all such changes, modifications and variations that fall within the scope of protection of the appended claims. In addition, with respect to the term "comprising" used in the specification or claims, the word is covered in a manner similar to the term "including", just as "including," is explained as a transitional word in the claims. In addition, any term "or" used in the specification of the claims is intended to mean "non-exclusive or".

[0105] Those skilled in the art may also understand that the various illustrative logical blocks, units, and steps listed in the embodiments of the present invention may be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units, and steps described above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and the design requirements of the entire system. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the scope of protection of the embodiments of the present invention.

[0106] The various illustrative logic blocks or units described in the embodiments of the present invention can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic, a discrete hardware component, or any combination of the above. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any conventional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of computing devices, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, or any other similar configuration.

[0107] The steps of the method or algorithm described in the embodiments of the present invention can be directly embedded in hardware, a software module executed by a processor, or a combination of the two. The software module can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or other storage media of any form in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a user terminal. Optionally, the processor and the storage medium can also be arranged in different components in the user terminal.

[0108] In one or more exemplary designs, the above functions described in the embodiments of the present invention can be implemented in hardware, software, firmware or any combination of the three. If implemented in software, these functions can be stored on a computer-readable medium, or transmitted in the form of one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media that facilitate the transfer of computer programs from one place to another. The storage medium can be any available medium that can be accessed by any general or special computer. For example, such computer-readable media can include but are not limited to RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and other forms that can be read by general or special computers, or general or special processors. In addition, any connection can be appropriately defined as a computer-readable medium, for example, if the software is transmitted from a website site, server or other remote resource through a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL) or wirelessly, such as infrared, wireless and microwave, it is also included in the defined computer-readable medium. The disk and disc include compact disk, laser disk, optical disk, DVD, floppy disk and blue-ray disk. Disks usually copy data magnetically, while discs usually copy data optically with lasers. The above combination can also be included in computer readable media.

[0109] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A momentum counterattack method using an adaptive strategy, characterized in that: The method comprises the following steps: Training samples based on selected data; Preprocess the trained samples; Based on the preprocessed samples, a neural network model is selected to obtain a momentum model; An adaptive step size matrix is ​​introduced, and an adversarial sample model is obtained according to the momentum model and the adaptive step size matrix; The adversarial attack success rate is obtained according to the adversarial sample model.

2. A momentum counterattack method using an adaptive strategy according to claim 1, characterized in that: The momentum model comprises: Among them, g t is the gradient accumulated in the first t iterations, μ t is the momentum coefficient μ t >0;x adv is the adversarial sample generated by adding noise to the original sample x, y is the label of the original sample, It represents the gradient operation at x.

3. A momentum counterattack method using an adaptive strategy according to claim 2, characterized in that: The adaptive step size matrix is ​​specifically: Among them, V t =diag(v t ), I is the identity matrix, δ is a constant coefficient, g j is the gradient accumulated in the first j iterations, v t It is to calculate the arithmetic average of the square of the accumulated gradient g.

4. A momentum counterattack method using an adaptive strategy according to claim 3, characterized in that: The adversarial sample model; include: P is the projection operation, represents the adversarial sample image generated in the tth step, represents the adversarial sample image generated in step t+1; α t is the step size, α t >0;g t+1 is the accumulated gradient in the first t+1 iterations.

5. A momentum counterattack method using an adaptive strategy according to claim 4, characterized in that: The obtaining the adversarial attack success rate according to the adversarial sample model includes: A known white-box model is used to generate adversarial samples, which are then used to attack an unknown black-box model, thereby achieving transferable adversarial attacks.

6. A momentum counterattack system using an adaptive strategy, characterized in that: include: A training unit, used for training samples according to selected data; A processing unit, used for preprocessing the trained samples; A computing unit, used for selecting a neural network model to obtain a momentum model based on the preprocessed samples; A construction unit, used for introducing an adaptive step size matrix, and obtaining an adversarial sample model according to the momentum model and the adaptive step size matrix; An output unit is used to obtain the success rate of the adversarial attack according to the adversarial sample model.

7. A momentum counterattack system using an adaptive strategy according to claim 6, characterized in that: The momentum model comprises: Among them, g t is the gradient accumulated in the first t iterations, μ t is the momentum coefficient μ t >0;x adv is the adversarial sample generated by adding noise to the original sample x, y is the label of the original sample, It represents the gradient operation at x.

8. A momentum counterattack system using an adaptive strategy according to claim 7, characterized in that: The adaptive step size matrix is ​​specifically: Among them, V t =diag(v t ), I is the identity matrix, δ is a constant coefficient, g j is the gradient accumulated in the first j iterations, v t It is to calculate the arithmetic average of the square of the accumulated gradient g.

9. A momentum counterattack system using an adaptive strategy according to claim 8, characterized in that: The adversarial sample model; include: P is the projection operation, represents the adversarial sample image generated in the tth step, represents the adversarial sample image generated in step t+1; α t is the step size, α t >0;g t+1 is the accumulated gradient in the first t+1 iterations.

10. A momentum counterattack system using an adaptive strategy according to claim 9, characterized in that: The output unit comprises: It is used to use a known white-box model to generate adversarial samples, and then use the generated adversarial samples to attack unknown black-box models, thereby achieving transferable adversarial attacks.

Images