Method for enhancing target attack mobility based on source image target label selection, terminal equipment and storage medium
By selecting appropriate source images and target tags in target attacks and determining target tags using proxy models and statistical methods, the problem of differences in the migration of adversarial samples in the prior art is solved, and an adversarial sample generation with higher migration and robustness is achieved.
Patent Information
- Application Number
- CN202411608830.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-12
- Publication Date
- 2025-03-28
AI Technical Summary
The prior art ignores the effect of the selection of source images and target labels on the migrationability of adversarial samples in target attacks, resulting in significant differences in the migrationability of generated adversarial samples between different models.
By filtering images that can be identified by all test models from the source dataset, using the proxy model to obtain the Top-2 prediction tag frequency set of each image, counting the Rank-2 tags of different classes, and calculating the similarity between classes through different statistical methods to determine the target tags, thereby generating adversarial samples with higher mobility and robustness.
This method can significantly improve the migration and robustness of target-adversarial samples while maintaining low perceptibility, which is better than the traditional method of randomly selecting target tags.
Smart Images
Figure CN119723153A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence security, and specifically designs a target adversarial sample generation method based on source image\target label selection to enhance transferability. Background Art
[0002] Deep neural networks (DNNs) perform well in tasks such as image recognition and object detection, but are vulnerable to adversarial examples (AEs), where small changes in input can lead to prediction errors. A key feature of adversarial examples is their transferability between different models, which makes even black-box models with unknown architectures and parameters vulnerable to attacks. Generating highly transferable adversarial examples has become a research hotspot, and non-targeted black-box attacks have achieved some success.
[0003] However, targeted attacks (i.e., guiding the model to predict a specific category) remain a major challenge. Previous targeted attack methods have improved the transferability of adversarial samples by enhancing feature information, improving generation techniques, or adopting competitive strategies. Previous studies often focus on optimizing the "intermediate process" from original samples to target labels to improve cross-model transferability. Although understanding this process is crucial to improving the effectiveness and generality of adversarial samples, a more fundamental question has been overlooked: Do the source images and corresponding target labels we select for targeted attacks truly optimize transferability? When performing targeted attacks on the same source dataset, the transferability of the generated adversarial samples varies significantly when the selected target labels are different. Current methods for evaluating attack performance usually randomly select a small number of target labels and take the average of their targeted attack success rates as the final result. However, this approach may not accurately reflect the optimal potential of the attack method. Summary of the invention
[0004] The technical problem to be solved by the present invention is to provide a method, a terminal device and a storage medium for enhancing the transferability of target attacks based on source image\target label selection, in view of the shortcomings of the prior art, so as to explore the potential attack performance of existing attack methods and generate adversarial samples with higher transferability and robustness.
[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a method for enhancing the transferability of target attack based on source image\target label selection, comprising the following steps:
[0006] S1. Filter out M images from the source dataset that can be recognized by all test models.
[0007] S2, input the filtered images into the proxy model to obtain the Top-2 predicted label frequency set of each image;
[0008] S3, count the Rank-2 labels corresponding to each class in the statistical data set, calculate the similarity of the Top-2 label frequency sets between different classes through different statistical methods, calculate the distance between different classes in the feature space, and determine the target labels corresponding to different classes respectively;
[0009] S4. For images of different categories in the source dataset, attack the corresponding target labels respectively to generate adversarial samples.
[0010] Among them, the specific steps of S1 are to input the source data sets into different test models respectively, intersect and extract the clean images correctly recognized by all test models, and extract 200 images for each of the ten data sets.
[0011] Further, step S2 includes the following sub-steps:
[0012] 1) Send the images of each class in the dataset to the proxy model to obtain the predicted label of each image;
[0013] 2) Get the first two prediction results for each image and count the number of times each image of each class is identified into each of the ten classes;
[0014] 3) Count the number of times all images of each class are identified as each category, and obtain the Top-2 predicted label frequency set corresponding to each class.
[0015] Step S3 includes the following statistical methods:
[0016] Directly use the label with the largest number of occurrences in the predicted label set of each class except the original label as the Rank-2 label of the class, that is, the attack label corresponding to the class;
[0017] By calculating the cosine similarity, Euclidean distance, and Jaccard similarity coefficient between the Top-2 predicted label frequency sets of different classes, the values of these coefficients are used to determine the similar classes of each class at the meaning level of the coefficients. The larger the cosine similarity and Jaccard similarity coefficient values, the more similar they are, and the smaller the Euclidean distance, the more similar they are. After determining the similar classes, the labels of the similar classes are used as the corresponding attack labels.
[0018] The distribution differences between different classes are quantified by reducing data dimension and calculating decision boundary distance, and the classes with similar distributions are determined, and the labels of similar classes are used as corresponding attack labels.
[0019] The formulas for cosine similarity, Euclidean distance, and Jaccard similarity coefficient are:
[0020]
[0021]
[0022]
[0023] Among them, c1 and c2 are two classes in the data set. They are the Top-k predicted label frequency sets of categories c1 and c2 respectively.
[0024] Data dimensionality reduction includes the following steps:
[0025] 1) Generate dimensionality reduction plots of the dataset using principal component analysis (PCA) and t-distributed stochastic neighbor embedding (t-SNE);
[0026] 2) Calculate the distance between different categories in the dimensionality reduction graph and determine the closest class to each class in the original feature space.
[0027]
[0028] Among them, f y (x t ) indicates that the proxy model will input sample x t The prediction is the logits output of category y, f tg (x t ) means that the input sample x t The prediction is the logits output of the target class tg, Represents the logits output of the surrogate model for category y relative to the input x t The gradient of Represents the logits output of the surrogate model for category tg relative to the input x t gradient.
[0029] Furthermore, existing targeted attack methods use IFGSM, DIM, SIA, and CFM.
[0030] As an inventive concept, the present invention also provides a terminal device, including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the steps of the above method.
[0031] As an inventive concept, the present invention also provides a computer-readable storage medium having a computer program / instruction stored thereon; the computer program / instruction implements the steps of the above method when executed by a processor.
[0032] As an inventive concept, the present invention also provides a computer program product, including a computer program / instruction; when the computer program / instruction is executed by a processor, the steps of the above method are implemented.
[0033] Compared with the prior art, the present invention has the following beneficial effects:
[0034] 1) The existing methods randomly select target labels, which limits the transferability to a certain extent. The present invention provides a method for enhancing the transferability of target attacks based on source image\target label selection, which can explore and improve the potential attack performance of any method, greatly improve the transferability and robustness of target adversarial samples, and at the same time maintain low perceptibility.
[0035] 2) The present invention provides a method for enhancing the transferability of target attacks based on source image\target label selection, which shows better attack effects when attacking defense models compared with the traditional method of randomly selecting target labels. BRIEF DESCRIPTION OF THE DRAWINGS
[0036] Figure 1 A schematic diagram of a process of an embodiment of the present invention;
[0037] Figure 2 A schematic diagram of the process of obtaining the Top-2 predicted label frequency set by the method according to an embodiment of the present invention;
[0038] Figure 3 A comparison chart of adversarial samples and clean samples generated by different similarity strategies according to the method of an embodiment of the present invention. DETAILED DESCRIPTION
[0039] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0040] Example 1
[0041] like Figure 1 As shown, a method for enhancing the transferability of target attack based on source image\target label selection includes the following steps:
[0042] S1. Input the source dataset into different test models (ResNet101, RegNet, VGG16, DenseNet161) respectively, extract the clean images correctly recognized by all test models, and extract 200 images for each of the ten categories of datasets;
[0043] S2, input the selected high-quality source class images into the proxy model (ResNet101, RegNet, VGG16, DenseNet161) to obtain the Top-2 predicted label frequency set for each image;
[0044] Specifically, step S2 includes the following sub-steps:
[0045] 1) Send the images of each class in the dataset to the proxy model to obtain the predicted label results for each image;
[0046] 2) Get the first two predicted label results for each image, and count the number of times each image of each class is identified into each of the ten classes;
[0047] 3) Count the number of times all images of each class are identified as each category, and obtain the Top-2 predicted label frequency set corresponding to each class.
[0048] S3, count the Rank-2 labels corresponding to each class, calculate the similarity of the Top-2 label frequency sets between different classes through different statistical methods, calculate the distance between different classes in the feature space, and determine the target labels corresponding to different source classes respectively;
[0049] Specifically, step S3 includes the following statistical methods:
[0050] 1) Directly take the label with the largest number of occurrences in the predicted label set of each class except the original label as the Rank-2 label of the class, that is, the attack label corresponding to the class;
[0051] 2) By calculating the cosine similarity, Euclidean distance, and Jaccard similarity coefficient between the Top-2 predicted label frequency sets of different classes, the values of these coefficients are used to determine the similar classes of each class at the meaning level of the coefficients. The larger the cosine similarity and Jaccard similarity coefficient values, the more similar they are, and the smaller the Euclidean distance, the more similar they are. After determining the similar classes, the labels of the similar classes are used as the corresponding attack labels;
[0052] 3) Quantify the distribution differences between different classes by reducing data dimension and calculating decision boundary distance, determine the classes with similar distributions, and use the labels of similar classes as corresponding attack labels.
[0053] The formulas for cosine similarity, Euclidean distance, and Jaccard similarity coefficient are:
[0054]
[0055]
[0056]
[0057] Among them, c1 and c2 are two classes in the data set. They are the Top-k predicted label frequency sets of categories c1 and c2 respectively.
[0058] Data dimensionality reduction includes the following steps:
[0059] 1) Generate dimensionality reduction plots of the dataset using principal component analysis (PCA) and t-distributed stochastic neighbor embedding (t-SNE);
[0060] 2) Calculate the distance between different categories in the dimensionality reduction graph and determine the closest class to each class in the original feature space.
[0061]
[0062] Among them, f y (x t ) indicates that the source model will input sample x t The prediction is the logits output of category y, f tg (x t ) indicates that the source will input sample x t The prediction is the logits output of the target class tg, They represent the corresponding output relative to the input x t gradient.
[0063] S4. For different types of images in the source dataset, attack the corresponding target labels respectively, and use the existing target attack method to generate adversarial samples.
[0064] After completing the above steps, this embodiment performs multiple tests:
[0065] In order to verify the effectiveness of the proposed similarity strategies, this embodiment is tested on the CIFAR10 dataset and multiple baseline methods. As shown in Table 1, for each strategy, the performance of attacking similar labels is always better than that of random label attacks, where *Sim-R2 pic Often have the best effect, so we finally chose *Sim-R2 pic , *Sim-TPk cos , *Dst p2h(p) As a representative strategy for further results. Table 2 shows the attack results of different strategies of the embodiments of the present invention on various deep learning models (such as ResNet101, VGG16, etc.) on different baseline methods, and the best attack effect is achieved in all cases. These results show that the method of the embodiment of the present invention can further explore the potential attack performance of the existing method and improve the transferability of the generated target adversarial samples.
[0066] Table 1 Attack results of different similarity strategies in the embodiments of the present invention under CIFAR10
[0067]
[0068] Table 2 Attack results of the method in the embodiment of the present invention under different depth models
[0069]
[0070] In order to verify the effectiveness of the proposed similarity strategy for the defense method, this embodiment uses the adversarial training method to train five models (ResNet18, ResNet50, ResNet101, MobileNet-v2, WideResNet34-10. Table 3 shows the target attack success rate of the adversarial samples produced by the strategy proposed in the embodiment of the present invention. Although the overall value is reduced, our strategy still achieves better transferability than the baseline method in all defense models. Table 4 shows the perceptual quality scores of the adversarial samples generated by the similarity strategy proposed in the present invention, in which three evaluation indicators are used: structural similarity (SSIM), peak signal-to-noise ratio (PSNR), and learning-perceptual image block similarity (LPIPS). The results show that the superior attack performance of the similarity strategy is not at the expense of perceptibility.
[0071] Table 3 Average target attack success rates of different similarity strategies in five adversarial training defense models according to the method of the embodiment of the present invention
[0072]
[0073] Table 4 Perceptual quality scores of adversarial samples generated by different similarity strategies according to the method of the embodiment of the present invention
[0074]
[0075] Example 2
[0076] Embodiment 2 of the present invention provides a terminal device corresponding to the above-mentioned embodiment 1. The terminal device may be a processing device for a client, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the method of the above-mentioned embodiment.
[0077] The terminal device of this embodiment includes a memory, a processor, and a computer program stored in the memory; the processor executes the computer program in the memory to implement the steps of the method in the above-mentioned embodiment 1.
[0078] In some implementations, the memory may be a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory.
[0079] In some other implementations, the processor may be a central processing unit (CPU), a digital signal processor (DSP), or other general-purpose processors of various types, which are not limited herein.
[0080] Example 3
[0081] Embodiment 3 of the present invention provides a computer-readable storage medium corresponding to the above embodiment 1, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method of the above embodiment 1 are implemented.
[0082] Computer readable storage media can be tangible devices that hold and store instructions used by instruction execution devices. Computer readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any combination thereof.
[0083] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.
[0084] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.
[0085] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.
[0086] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.
[0087] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.
Claims
1. A method for enhancing target attack transferability based on source image\target label selection, characterized in that: The following steps are involved: S1. Filter out M images from the source dataset that can be recognized by all test models. S2, input the filtered images into the proxy model to obtain the Top-2 predicted label frequency set of each image; S3, count the Rank-2 labels corresponding to each class in the statistical data set, calculate the similarity of the Top-2 label frequency sets between different classes through different statistical methods, calculate the distance between different classes in the feature space, and determine the target labels corresponding to different classes respectively; S4. For images of different categories in the source dataset, attack the corresponding target labels respectively to generate adversarial samples.
2. The method for enhancing target attack transferability based on source image\target label selection according to claim 1, characterized in that: Step S2 includes the following sub-steps: 1) Send the images of each class in the dataset to the proxy model to obtain the predicted label results for each image; 2) Get the first two predicted label results for each image, and count the number of times each image of each class is identified into each of the ten classes; 3) Count the number of times all images of each class are identified as each category, and obtain the Top-2 predicted label frequency set corresponding to each class.
3. The method for enhancing target attack transferability based on source image\target label selection according to claim 1, characterized in that: Step S3 includes the following statistical methods: Directly use the label with the largest number of occurrences in the predicted label set of each class except the original label as the Rank-2 label of the class, that is, the attack label corresponding to the class; By calculating the cosine similarity, Euclidean distance, and Jaccard similarity coefficient between the Top-2 predicted label frequency sets of different classes, the values of these coefficients are used to determine the similar classes of each class at the meaning level of the coefficients. The larger the cosine similarity and Jaccard similarity coefficient values, the more similar they are, and the smaller the Euclidean distance, the more similar they are. After determining the similar classes, the labels of the similar classes are used as the corresponding attack labels. The distribution differences between different classes are quantified by reducing data dimension and calculating decision boundary distance, and the classes with similar distributions are determined, and the labels of similar classes are used as corresponding attack labels.
4. The method for enhancing target attack transferability based on source image\target label selection according to claim 3 is characterized in that: The formulas for cosine similarity, Euclidean distance, and Jaccard similarity coefficient are: Among them, c1 and c2 are two classes in the data set. They are the Top-k predicted label frequency sets of categories c1 and c2 respectively.
5. The method for enhancing target attack transferability based on source image\target label selection according to claim 3, characterized in that: Data dimensionality reduction includes the following steps: 1) Generate a dimensionality reduction graph of the dataset using principal component analysis and t-distributed random neighbor embedding; 2) Calculate the distance between different categories in the dimensionality reduction graph and determine the other categories that are closest to each class in the original feature space.
6. The method for enhancing target attack transferability based on source image\target label selection according to claim 3, characterized in that: The formula for calculating the decision boundary distance is: Among them, f y (x t ) indicates that the proxy model will input sample x t The prediction is the logits output of category y, f tg (x t ) means that the input sample x t The prediction is the logits output of the target class tg, Represents the logits output of the surrogate model for category y relative to the input x t The gradient of Represents the logits output of the surrogate model for category tg relative to the input x t gradient.
7. A terminal device comprising a memory, a processor and a computer program stored in the memory; characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.
8. A computer-readable storage medium having a computer program / instruction stored thereon; characterized in that: When the computer program / instructions are executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.
9. A computer program product comprising a computer program / instructions; characterized in that: When the computer program / instructions are executed by a processor, the steps of the method of any one of claims 1 to 6 are implemented.