Feature truncation unrestricted attack method based on stable diffusion model

Abstract

The invention discloses a feature truncation unlimited attack method based on a stable diffusion model, and belongs to the technical field of computer vision, and the method comprises the following steps: S1, carrying out the preprocessing of an original sample: carrying out the size adjustment, channel conversion, type conversion and coding processing of the original sample; s2, acquiring global depth features and local key features: inputting an original sample into a GDFE module to extract the global depth features, and inputting the sample into a CLFE module to extract the local key features so as to improve the mobility of an adversarial sample; s3, forward inference and unconditional coding optimization of the diffusion model; s4, performing de-noising attack on the diffusion model; s5, MLF loss is calculated, and the gradient direction is updated; and S6, performing repeated iteration to obtain a final adversarial sample: performing inverse coding according to the potential features to obtain the adversarial sample. According to the method, the transferability of the adversarial sample can be improved and the visual imperceptibility can be maintained.

Description

Technical Field

[0001] The invention belongs to the technical field of computer vision, and in particular relates to a feature truncation unrestricted attack method based on a stable diffusion model. Background Art

[0002] In today's era of rapid technological development, artificial intelligence (AI) systems have become an important part of all walks of life. However, with the widespread application of AI technology, its security issues have become increasingly prominent. In practical applications, AI systems may be exploited by malicious attackers, resulting in system output errors or unpredictable behaviors. Adversarial sample attacks are a type of attack against AI systems. Attackers make minor modifications to input data to deceive the judgment of AI systems and cause them to produce incorrect outputs. This type of adversarial sample attack poses a serious threat to the security of AI systems.

[0003] In order to improve the security of the system, people began to explore the defense methods of adversarial sample attacks to improve the stability and robustness of the system. Compared with the adversarial samples of limited attacks, the adversarial samples generated by the unrestricted attack method have better visual imperceptibility. At present, there are few research methods in the field of unrestricted attack of adversarial samples, which are mainly concentrated in two parts: color space-based and text-based guidance. The color space-based method is to achieve imperceptibility and transferability by minimizing the color perception of the sample, such as PerC-AL, NCF, etc. The text-based guidance is to use the ability of the diffusion model Vincent graph to generate sample perturbations in the denoising process to achieve the purpose of unrestricted attack, such as the ACA method. Although the above methods have achieved certain success in improving the transferability and imperceptibility of adversarial samples, there are still some problems that need to be solved. For example, when generating adversarial samples, the existing methods optimize a single feature and the feature is not fully utilized, which limits the transferability. For example, in the field of adversarial attacks, the prediction results of the classifier have a great influence on the transferability. In addition, in order to achieve better visual effects, the perturbation needs to be reduced as much as possible.

[0004] Therefore, there is a need for a feature truncation unrestricted attack method based on a stable diffusion model that can improve the transferability of adversarial samples and maintain visual imperceptibility. Summary of the invention

[0005] The purpose of the present invention is to provide a feature truncation unrestricted attack method based on a stable diffusion model, which can improve the transferability of adversarial samples and maintain visual imperceptibility.

[0006] To achieve the above object, the technical solution adopted by the present invention is:

[0007] A feature truncation unrestricted attack method based on a stable diffusion model comprises the following steps:

[0008] Step S1: preprocessing the original sample, including resizing, channel transformation, type conversion and encoding the original sample;

[0009] Step S2: Obtain global deep features and local key features: Input the original sample into the GDFE module to extract global deep features, and input the sample into the CLFE module to extract local key features to improve the transferability of the adversarial sample;

[0010] Step S3: diffusion model forward inference and unconditional coding optimization;

[0011] Step S4: Diffusion model denoising attack;

[0012] Step S5: Calculate the MLF loss and update the gradient direction. The MLF loss includes the attack loss, excitation loss, cross-attention loss, and self-attention loss generated by the diffusion model denoising process. The attack loss, excitation loss, and cross-attention loss can improve the transferability of adversarial samples, and the self-attention loss can maintain imperceptibility.

[0013] Step S6: Iterate repeatedly to obtain the final adversarial sample: the adversarial sample is obtained by de-encoding the potential features.

[0014] A further improvement of the technical solution of the present invention is that in step S1, the encoding process is to encode and sample the samples using an encoder of a stable diffusion model.

[0015] A further improvement of the technical solution of the present invention is that step S2 includes the following steps:

[0016] Step S201: Establish a GDFE module, which includes three convolutional layers with Instant normalization and Relu activation functions, four Residual blocks, three Transpose convolutional layers with Instant normalization and Relu activation functions, one ordinary Transpose convolutional layer, and one Tanh function layer, wherein the first three Instant convolutional layers are connected by residual structure channels;

[0017] Step S202: input the original sample into the GDFE module. After receiving the sample, the GDFE module downsamples the sample, then upsamples and fuses the features, and finally outputs the global depth features of the sample.

[0018] Step S203: establishing a CLFE module, where the CLFE module includes a deep neural network analysis model Grad-CAM;

[0019] Step S204: After the sample is input into the CLFE module and analyzed by Grad-CAM, the attention activation map region M is output, and then the attention region M is redefined as R through the mapping function T to extract the local key features of the sample.

[0020] A further improvement of the technical solution of the present invention is that in step S202, the GDFE module obtains the global depth feature in the following manner:

[0021] x g =GDFE(x,y)

[0022] In the formula, GDFE(·) represents the network layer function performed by the GDFE module, x represents the original sample feature, y represents the true category label of the original sample, and x g Represents the extracted global deep feature information.

[0023] A further improvement of the technical solution of the present invention is that in step S204, the CLFE module obtains local key features in the following manner:

[0024] x l =CLFE(x,y)

[0025] In the formula, CLFE(·) represents the network layer function performed by the CLFE module, x represents the original sample feature, y represents the true category label of the original sample, and x l Represents the extracted local key feature information.

[0026] A further improvement of the technical solution of the present invention is that in step S204, the operation mechanism inside the CLFE module is as follows:

[0027] M = CAM (x, y)

[0028] R=T(M)

[0029] x l =Resize(Crop(R, x))

[0030] Where CAM(·) represents the analysis method of the neural network to obtain the sample attention map, M represents the attention map, T(·) represents the attention area mapping function, R represents the redefined attention map, Crop(·) represents the cropping function, and Resize(·) represents the resizing function.

[0031] A further improvement of the technical solution of the present invention is that the attention region mapping function T divides the feature activation values ​​of the input data into different regions through different strategies, and the segmentation region mapping strategy specifically includes:

[0032] Highest activation area HAR:

[0033] The lowest activation value area LAR:

[0034] Center Mean Activation Region (CMAR):

[0035] Marginal Mean Activation Region (EMAR)

[0036] Adaptive Activation Region AAR:

[0037] Where M i,j represents the value of row i and column j of the attention map, t represents the cutoff value, max(·) and min(·) represent the maximum and minimum functions, and sum(·) represents the sum function.

[0038] A further improvement of the technical solution of the present invention is that the step S3 includes the following steps:

[0039] Step S301: The global depth feature obtained in step S2 is used to perform feature truncation on the original sample. The method of truncation of the global depth feature is shown in the following formula:

[0040]

[0041] In the formula, Represents the weight of the global deep feature;

[0042] Step S302: Input the truncated sample features and the local key features obtained in step S2 into the stable diffusion model to perform forward inference, and save the potential features of all time steps to pave the way for subsequent disturbance optimization;

[0043] Step S303: Optimize the unconditional coding to improve the imperceptibility of the adversarial sample so that it has a better visual effect.

[0044] A further improvement of the technical solution of the present invention is that step S4 includes the following steps:

[0045] Step S401: for the potential features of all time steps obtained in step S3, only the second half of the denoising process is perturbed;

[0046] Step S402: design a disturbance probability, and perform local key feature truncation with the probability to prevent excessive disturbance. The local key feature truncation method is shown in the following formula:

[0047] x t '=x f t -λ·x l

[0048] In the formula, λ represents the weight parameter of the local key feature, ranging from [0,1], x f t Represents x f Feature information at time step t.

[0049] A further improvement of the technical solution of the present invention is that in step S5, calculating the MLF loss and updating the gradient direction includes the following steps:

[0050] Step S501: define the AdamW optimizer and set the learning rate;

[0051] Step S502: Calculate the attack loss L attack As shown below:

[0052] L attack =CE(y p ,y)

[0053] In the formula, CE(·) represents the Cross-Entropy classification loss function, y p represents the prediction result of the alternative model, and y represents the true label of the image;

[0054] Step S503: Calculate the excitation loss L incentice As shown below:

[0055] L incentive =max(sort(y p ))

[0056] In the formula, sort(·) and max(·) represent the sorting function and the maximum value function respectively;

[0057] Step S504: Calculate the cross attention loss L cross-attention As shown below:

[0058] L cross-attention =V(A(C(x t ,P,t,SDM))

[0059] Where V(·) and A(·) represent the variance and mean of the calculated input values; C(·) represents the calculation function of the attention map, t represents the current time step, and x t represents the potential features of the current time step, P represents the text prompt word of the current sample, and SDM represents the stable diffusion model;

[0060] Step S505: Calculate the self-attention loss L self-attention As shown below:

[0061] L self-attention =||S to -S t || 2

[0062] In the formula, S t o and S t Respectively represent the attention map of the original sample and the attention map after perturbation at the current time step;

[0063] Step S506: Calculate the total loss and execute the gradient update strategy, as shown in the following formula:

[0064] L=αL attack +βL incentive +γL cross-attention +δL self-attention

[0065] Where α, β, γ, and δ represent the weights of each part of the loss respectively.

[0066] Due to the adoption of the above technical solution, the technical progress achieved by the present invention is:

[0067] The feature truncation unrestricted attack method of the present invention is based on the stable diffusion model. By utilizing the principle of the diffusion model and the ability of generating discrimination, global deep feature truncation and key local feature truncation are performed during the perturbation process. The MLF loss is used in the optimization to guide the gradient update direction, and adversarial samples are generated iteratively step by step, so as to achieve the purpose of improving the transferability of adversarial samples and maintaining visual imperceptibility.

[0068] Based on the generation and discrimination capabilities of the diffusion model, the present invention introduces the stable diffusion model into the field of unrestricted attacks and achieves relatively excellent attack performance.

[0069] Based on the idea of ​​feature truncation, the present invention constructs GDFE and CLFE feature extraction modules to extract the global depth features and local key features of the samples respectively. By truncating the original sample features, the transferability is improved and the perturbation diversity is enriched.

[0070] The present invention introduces incentive loss and attention mechanism in diffusion attack, and proposes MLF loss to balance the conflict between transferability and imperceptibility, providing a precise direction for perturbation optimization of unrestricted attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is a flow chart of the feature truncation unrestricted attack method based on the stable diffusion model of the present invention;

[0072] Figure 2 It is a principle diagram of the feature truncation unrestricted attack method based on the stable diffusion model of the present invention;

[0073] Figure 3 It is a schematic diagram of the GDFE module in the attack method of the present invention;

[0074] Figure 4 It is a schematic diagram of the CLFE module in the attack method of the present invention. DETAILED DESCRIPTION

[0075] The present invention is further described in detail below in conjunction with embodiments:

[0076] like Figure 1 and Figure 2 As shown, the present invention provides an unrestricted attack method for feature truncation based on a stable diffusion model. The directional attack method used mainly includes three aspects: GDFE module, CLFE module and MLF loss. The GDFE and CLFE modules receive the original samples and extract the global depth features and local key features respectively, paving the way for subsequent global / local feature truncation. The MLF loss includes the L generated by the diffusion model denoising process. attack , L incentive , L cross-attention and L self-attention Loss, providing a more appropriate gradient update direction for the current iteration.

[0077] Specifically, the feature truncation unrestricted attack method based on the stable diffusion model of the present invention mainly includes the following steps:

[0078] Step S1: preprocessing the original samples, including resizing, channel conversion, type conversion, and encoding processing of the original samples, to lay the foundation for subsequent disturbance optimization. Since the diffusion model is used as a way to optimize the disturbance, encoding processing is required. Specifically, the encoding processing is to encode and sample the samples using an encoder of a stable diffusion model;

[0079] Step S2: Obtaining global deep features and local key features: Input the original sample into the GDFE module to extract global deep features, and input the sample into the CLFE module to extract local key features to improve the transferability of the adversarial sample, which specifically includes the following steps:

[0080] Step S201: Establish a GDFE module, such as Figure 3 As shown in the figure, the GDFE module includes three convolutional layers with instant normalization and Relu activation functions, four residual blocks, three transpose convolutional layers with instant normalization and Relu activation functions, one ordinary transpose convolutional layer and one Tanh function layer. The first three instant convolutional layers use residual structure channel connection to more effectively extract sample depth features. Figure 3"k×k×m@n" means the convolution kernel is k×k, m is the number of channels, and n is the step size;

[0081] Step S202: Input the original sample into the GDFE module. After receiving the sample, the GDFE module downsamples the sample first, then upsamples and fuses the features, which plays the role of a feature extractor, and finally outputs the global depth feature of the sample. The way in which the GDFE module obtains the global depth feature is shown in the following formula:

[0082] x g =GDFE(x,y)

[0083] In the formula, GDFE(·) represents the network layer function performed by the GDFE module, x represents the original sample feature, y represents the true category label of the original sample, and x g Represents the extracted global deep feature information;

[0084] Step S203: Establish a CLFE module, such as Figure 4 As shown, the CLFE module includes a deep neural network analysis model Grad-CAM;

[0085] Step S204: After the sample is input into the CLFE module and analyzed by Grad-CAM, the attention activation map region M is output, and then the attention region M is redefined as R through the mapping function T to extract the local key features of the sample; the way in which the CLFE module obtains the local key features is shown in the following formula:

[0086] x l =CLFE(x,y)

[0087] In the formula, CLFE(·) represents the network layer function performed by the CLFE module, x represents the original sample feature, y represents the true category label of the original sample, and x l Represents the extracted local key feature information;

[0088] The internal operation mechanism of the CLFE module is as follows:

[0089] M = CAM (x, y)

[0090] R=T(M)

[0091] x l =Resize(Crop(R, x))

[0092] Where CAM(·) represents the analysis method of the neural network to obtain the sample attention map, M represents the attention map, T(·) represents the attention area mapping function, R represents the redefined (mapped) attention map, Crop(·) represents the cropping function, and Resize(·) represents the resizing function;

[0093] Among them, the attention region mapping function T divides the feature activation values ​​of the input data into different regions through different strategies, so as to better understand the behavior of the model and make more accurate predictions. The specific segmentation region mapping strategies include:

[0094] Highest Activation Region (HAR): These values ​​are the areas that best match the true category of the sample;

[0095] Lowest Activation Region (LAR): Although these values ​​do not correspond to the true category of the sample, they may have a significant impact on the prediction of other categories;

[0096] Central Mean Activation Region (CMAR): These values ​​are defined as a boundary, and for CMAR, the part within the boundary is the most influential;

[0097] Marginal Mean Activation Region (EMAR): In contrast to the above CMAR, these values ​​are defined as data outside a limit, and the parts outside the limit are considered to have a greater impact;

[0098] Adaptive Activation Region (AAR): Similar to HAR, but HAR requires manually defined hyperparameters, while AAR is adaptively calculated from the attention map of the current sample, which is more practical;

[0099] Where M i,j represents the value of row i and column j of the attention map, t represents the cutoff value, max(·) and min(·) represent the maximum and minimum functions, and sum(·) represents the sum function;

[0100] Step S3: Diffusion model forward inference and unconditional coding optimization, specifically including the following steps:

[0101] Step S301: The global depth feature obtained in step S2 is used to perform feature truncation on the original sample. The method of truncation of the global depth feature is shown in the following formula:

[0102]

[0103] In the formula, Represents the weight of the global deep feature;

[0104] Step S302: Input the truncated sample features and the local key features obtained in step S2 into the stable diffusion model to perform forward inference, and save the potential features of all time steps to pave the way for subsequent disturbance optimization;

[0105] Step S303: Optimizing unconditional coding to improve the imperceptibility of adversarial samples so as to achieve better visual effects;

[0106] Step S4: Diffusion model denoising attack, specifically including the following steps:

[0107] Step S401: For the potential features of all time steps obtained in step S3, since perturbation attack on all denoising steps will excessively interfere with the image structure, only the second half of the denoising process is perturbed;

[0108] Step S402: Design a disturbance probability and perform local key feature truncation with the probability to prevent excessive disturbance. The local key feature truncation method is shown in the following formula:

[0109] x t '=x f t -λ·x l

[0110] In the formula, λ represents the weight parameter of the local key feature, ranging from [0,1], x f t Represents x f Feature information at time step t;

[0111] Step S5: Calculate MLF loss and update gradient direction: After the current iteration is completed, calculate MLF loss and update gradient direction. MLF loss includes attack loss, excitation loss, cross attention loss and self-attention loss generated by the diffusion model denoising process. Attack loss, excitation loss and cross attention loss can improve the transferability of adversarial samples, and self-attention loss can maintain imperceptibility.

[0112] Specifically, calculating the MLF loss and updating the gradient direction includes the following steps:

[0113] Step S501: define the AdamW optimizer and set the learning rate;

[0114] Step S502: Calculate the attack loss L attack As shown below:

[0115] L attack =CE(y p ,y)

[0116] In the formula, CE(·) represents the Cross-Entropy classification loss function, y p represents the prediction result of the alternative model, and y represents the true label of the image;

[0117] Step S503: Calculate the excitation loss L incenticeAs shown below:

[0118] L incentive =max(sort(y p ))

[0119] In the formula, sort(·) and max(·) represent the sorting function and the maximum value function respectively;

[0120] Step S504: Calculate the cross attention loss L cross-attention As shown below:

[0121] L cross-attention =V(A(C(x t ,P,t,SDM))

[0122] Where V(·) and A(·) represent the variance and mean of the calculated input values; C(·) represents the calculation function of the attention map, t represents the current time step, and x t represents the potential features of the current time step, P represents the text prompt word of the current sample, and SDM represents the stable diffusion model;

[0123] Step S505: Calculate the self-attention loss L self-attention As shown below:

[0124] L self-attention =||S t o -S t || 2

[0125] In the formula, S t o and S t Respectively represent the attention map of the original sample and the attention map after perturbation at the current time step;

[0126] Step S506: Calculate the total loss and execute the gradient update strategy, as shown in the following formula:

[0127] L=αL attack +βL incentive +γL cross-attention +δL self-attention

[0128] In the formula, α, β, γ, and δ represent the weights of each part of the loss respectively;

[0129] Step S6: Iterate repeatedly to obtain the final adversarial sample: the adversarial sample is obtained by de-encoding the potential features.

[0130] In summary, the present invention aims at the problem that the existing attack methods have a single disturbance and do not fully utilize the feature information and the prediction results of the classifier, and proposes a feature truncation unrestricted attack method based on a stable diffusion model. By implementing global / local feature truncation in the diffusion model, the good transferability of adversarial samples is achieved, and the gradient is updated in the MLF loss used in the current iteration, and the optimization is continuously iterated, and finally an adversarial sample is generated, which has the characteristics of strong transferability and visual imperceptibility. In general, the present invention has a deep understanding of the principles of the diffusion model, uses the powerful generation and discrimination capabilities of the diffusion model, and integrates the idea of ​​feature truncation to achieve a more complete and excellent unrestricted attack method.

[0131] It is to be understood that the present invention is described by some embodiments, and it is known to those skilled in the art that various changes or equivalent substitutions may be made to these features and embodiments without departing from the spirit and scope of the present invention. In addition, under the teachings of the present invention, these features and embodiments may be modified to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of this application are within the scope of protection of the present invention.

Claims

1. A feature truncation unrestricted attack method based on a stable diffusion model, characterized in that The following steps are involved: Step S1: preprocessing the original sample, including resizing, channel transformation, type conversion and encoding the original sample; Step S2: Obtain global deep features and local key features: Input the original sample into the GDFE module to extract global deep features, and input the sample into the CLFE module to extract local key features to improve the transferability of the adversarial sample; Step S3: diffusion model forward inference and unconditional coding optimization; Step S4: Diffusion model denoising attack; Step S5: Calculate the MLF loss and update the gradient direction. The MLF loss includes the attack loss, excitation loss, cross-attention loss, and self-attention loss generated by the diffusion model denoising process. The attack loss, excitation loss, and cross-attention loss can improve the transferability of adversarial samples, and the self-attention loss can maintain imperceptibility. Step S6: Iterate repeatedly to obtain the final adversarial sample: the adversarial sample is obtained by de-encoding the potential features.

2. According to claim 1, a feature truncation unrestricted attack method based on a stable diffusion model is characterized in that: In step S1, the encoding process is to encode and sample samples using an encoder of a stable diffusion model.

3. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 2 is characterized in that: The step S2 comprises the following steps: Step S201: Establish a GDFE module, which includes three convolutional layers with Instant normalization and Relu activation functions, four Residual blocks, three Transpose convolutional layers with Instant normalization and Relu activation functions, one ordinary Transpose convolutional layer, and one Tanh function layer, wherein the first three Instant convolutional layers are connected by residual structure channels; Step S202: input the original sample into the GDFE module. After receiving the sample, the GDFE module downsamples the sample, then upsamples and fuses the features, and finally outputs the global depth features of the sample. Step S203: establishing a CLFE module, where the CLFE module includes a deep neural network analysis model Grad-CAM; Step S204: After the sample is input into the CLFE module and analyzed by Grad-CAM, the attention activation map region M is output, and then the attention region M is redefined as R through the mapping function T to extract the local key features of the sample.

4. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 3 is characterized in that: In step S202, the GDFE module obtains the global depth feature in the following manner: x g =GDFE(x,y) In the formula, GDFE(·) represents the network layer function performed by the GDFE module, x represents the original sample feature, y represents the true category label of the original sample, and x g Represents the extracted global deep feature information.

5. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 4 is characterized in that: In step S204, the CLFE module obtains local key features in the following manner: x l =CLFE(x,y) In the formula, CLFE(·) represents the network layer function performed by the CLFE module, x represents the original sample feature, y represents the true category label of the original sample, and x l Represents the extracted local key feature information.

6. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 5, characterized in that: In step S204, the operation mechanism inside the CLFE module is as follows: M =CAM(x,y) R=T(M) x l =Resize(Crop(R,x)) Where CAM(·) represents the analysis method of the neural network to obtain the sample attention map, M represents the attention map, T(·) represents the attention area mapping function, R represents the redefined attention map, Crop(·) represents the cropping function, and Resize(·) represents the resizing function.

7. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 6 is characterized in that: The attention region mapping function T divides the feature activation values ​​of the input data into different regions through different strategies. The segmentation region mapping strategy specifically includes: Highest activation area HAR: The lowest activation value area LAR: Center Mean Activation Region (CMAR): Marginal Mean Activation Region EMAR: Adaptive Activation Region AAR: Where M i,j represents the value of row i and column j of the attention map, t represents the cutoff value, max(·) and min(·) represent the maximum and minimum functions, and sum(·) represents the sum function.

8. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 7, characterized in that: The step S3 comprises the following steps: Step S301: The global depth feature obtained in step S2 is used to perform feature truncation on the original sample. The method of truncation of the global depth feature is shown in the following formula: In the formula, Represents the weight of the global deep feature; Step S302: Input the truncated sample features and the local key features obtained in step S2 into the stable diffusion model to perform forward inference, and save the potential features of all time steps to pave the way for subsequent disturbance optimization; Step S303: Optimize unconditional coding to improve the imperceptibility of adversarial samples so that they have better visual effects.

9. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 8, characterized in that: The step S4 comprises the following steps: Step S401: for the potential features of all time steps obtained in step S3, only the second half of the denoising process is perturbed; Step S402: design a disturbance probability, and perform local key feature truncation with the probability to prevent excessive disturbance. The local key feature truncation method is shown in the following formula: x t '=x f t -λ·x l In the formula, λ represents the weight parameter of the local key feature, ranging from [0,1], x f t Represents x f Feature information at time step t.

10. The feature-truncated unrestricted attack method based on a stable diffusion model according to claim 9, characterized in that: In step S5, calculating the MLF loss and updating the gradient direction includes the following steps: Step S501: define the AdamW optimizer and set the learning rate; Step S502: Calculate the attack loss L attack As shown below: L attack =CE(y p ,y) In the formula, CE(·) represents the Cross-Entropy classification loss function, y p represents the prediction result of the alternative model, and y represents the true label of the image; Step S503: Calculate the excitation loss L incentice As shown below: L incentive =max(sort(y p )) In the formula, sort(·) and max(·) represent the sorting function and the maximum value function respectively; Step S504: Calculate the cross attention loss L cross-attention As shown below: L cross-attention =V(A(C(x t ,P,t,SDM)) Where V(·) and A(·) represent the variance and mean of the calculated input values; C(·) represents the calculation function of the attention map, t represents the current time step, and x t represents the potential features of the current time step, P represents the text prompt word of the current sample, and SDM represents the stable diffusion model; Step S505: Calculate the self-attention loss L self-attention As shown below: L self-attention =||S t o -S t || 2 In the formula, S t o and S t Respectively represent the attention map of the original sample and the attention map after perturbation at the current time step; Step S506: Calculate the total loss and execute the gradient update strategy, as shown in the following formula: L=αL attack +βL incentive +γL cross-attention +δL self-attention Where α, β, γ, and δ represent the weights of each part of the loss respectively.

Images