Practical Boxless Adversarial Attack Method via Untrained Mixed Image Transformation

Abstract

The present application discloses a practical boxless adversarial attack method based on untrained mixed image transformation, which belongs to the security field of computer vision and machine learning. The present application first draws three basic patterns, and adjusts their sizes and tiles as basic adversarial patches to generate noisy high-frequency segments; secondly, an approximately simple Gaussian low-pass transformer is used to extract the low-frequency segments of the original image and the high-frequency segments of the adversarial patches; finally, the two parts of the results are mixed to generate an adversarial mixed image. The present application is a boxless adversarial attack with excellent performance, which is better than traditional black-box attacks and current boxless attacks, and can even be comparable to mainstream transfer-based black-box attacks, and the attack scheme does not require training, which greatly reduces the time cost and improves the attack efficiency and performance.

Description

Technical Field

[0001] The present application relates to the security field of computer vision and machine learning, and in particular to a practical box-free adversarial attack method based on untrained hybrid image transformation. Background Art

[0002] At present, mainstream adversarial attacks are mainly divided into white box and black box. For white box, the attacker needs to fully understand the target model, such as model parameters and the distribution of training data sets, which is obviously not in line with the actual situation, so it is usually used to evaluate the robustness of the model to reveal its weakest point, and will not be used as an actual attack.

[0003] When the attacker does not need to fully understand the target model, i.e., backpropagation on the target model is prohibited, this threat model is called query-based black-box attack. However, this branch usually involves resource-intensive problems in terms of query cost and time, which inevitably arouses suspicion of the target of the attack because of repeated queries on the model of almost the same adversarial images. To alleviate this problem, another branch of the black-box threat model, transfer-based attack, was proposed. In this branch, adversarial examples are made by means of a substitute model pre-trained in the same domain of the target model. However, transferability depends largely on how big the gap is between the substitute model and the target model. In practice, due to security and privacy issues, the structure and training techniques of the target model are usually not publicly available, so the gap is large. So it can be considered that both white-box attacks and black-box attacks are difficult to be considered the most practical attacks.

[0004] The most practical attacks should meet two conditions: first, they do not rely on pre-trained substitute models or target models for backpropagation or forward query only; second, they do not rely on the distribution of the training dataset, which is called box-free attack. A recent work attempts to perform such an attack in a loose sense. Specifically, the method attempts to train a substitute model by adopting a classic autoencoder model. In general, in order to attack a certain sample, the method includes three steps: (1) collecting a small number of images; (2) training a substitute model; (3) white-box attack on the substitute model. Admittedly, in most cases, collecting a small number of auxiliary samples may not be difficult, but it is still infeasible in some security-sensitive applications. In addition, if new samples need to be attacked, especially samples from different categories, the above process needs to be repeated. Therefore, this method is resource-intensive and there is still a lot of room for optimization and improvement. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a practical box-free adversarial attack method based on untrained hybrid image transformation, which adopts a new hybrid image transformation method (HIT for short) to combine the low-frequency components (LFC) of the original image and the high-frequency components (HFC) of the adversarial patch to destroy useful features and add strong irrelevant noise features, so as to significantly improve the efficiency of the box-free attack.

[0006] In order to achieve the above-mentioned invention object, the technical solution adopted by the present invention is:

[0007] A practical box-free adversarial attack method based on untrained mixed image transformation includes the following steps:

[0008] Step 1: Input the original image x and draw an adversarial patch x with the same image size as the original image x p ,The adversarial patch is used to generate noisy high-frequency segments;

[0009] Among them, the adversarial patch is a concentric pattern composed of multiple unit patterns of different sizes and arranged in a centrally symmetrical manner;

[0010] Preferably, the intervals between adjacent unit patterns in the concentric patterns are the same;

[0011] Preferably, the line colors of the unit graphics in the concentric graphics include multiple types and / or line shapes include multiple types; they can be drawn in different line colors according to the situation; and different line shapes can be used, etc.

[0012] Preferably, the unit graphics in the concentric graphics are circles, squares or rhombuses, that is, the preferred concentric graphics can be drawn as concentric circles, concentric squares and concentric rhombuses, etc.;

[0013] Step 2, extract the low frequency segmentation (LFC) of the original image x and the high frequency segmentation (HFC) of the adversarial patch;

[0014] In step 3, the extracted low-frequency segments are mixed with the high-frequency segments to generate an adversarial mixed image.

[0015] Furthermore, in step 2, the low-frequency segmentation and adversarial patch of the original image x are extracted, and the high-frequency segmentation specifically includes:

[0016] Extract low-frequency segments of the original image x through a Gaussian low-pass filter;

[0017] The low-frequency segment of the adversarial patch, is extracted through a Gaussian low-pass filter, and then the low-frequency segment is subtracted from the adversarial patch, to obtain the high-frequency segment of the adversarial patch,.

[0018] Furthermore, the Gaussian kernel size of the Gaussian low-pass filter is set to (4k+1)*(4k+1), wherein the parameter k is a preset value, and its value is greater than 0, such as 0.5, 1, 2, 3, etc.

[0019] Furthermore, in step 3, the generated adversarial mixed image is:

[0020] x adv =clip i,j (x LFC +x p HFC )

[0021] Among them, x LFC is the low-frequency segment of the original image x, x p HFC To counter the patch x p The high-frequency segmentation, λ is the preset weight factor used to balance the low-frequency segmentation and the high-frequency segmentation, clip i,j () is used to generate the adversarial mixed image x adv Constrained to 1 of the original image x ∞ In the ε-ball of the space, (i, j) represents the pixel coordinates of the image. The ε-ball is used to represent a sphere with a radius of ε centered on the original image x, and ε is used to represent the preset perturbation.

[0022] Furthermore, the value range of the parameter ε is preferably [2.5, 25.5], such as 10, 16, 25.5, etc.

[0023] The technical solution provided by this application brings at least the following beneficial effects:

[0024] 1) The present invention realizes a box-free adversarial attack with excellent performance, and the attack scheme does not require training, which greatly reduces the time cost and improves the attack efficiency and performance.

[0025] 2) In the process of studying deep neural networks, the present invention pays attention to what types of features deep neural networks are sensitive to, and proposes a new angle to deal with adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0027] Figure 1 A flowchart of a practical box-free adversarial attack method based on untrained mixed image transformation provided in an embodiment of the present application.

[0028] Figure 2 Schematic diagram of three basic adversarial patches drawn in the embodiments of the present application. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions of the embodiments of the present application will be described in detail and completely in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described with reference to the drawings are exemplary and are intended to be used to explain the present application, and cannot be understood as limiting the present application.

[0030] The embodiment of the present application provides a practical box-free adversarial attack method based on untrained mixed image transformation. To address the defects of existing box-free attacks, the present application analyzes the more sensitive disturbances of deep neural networks and uses a Gaussian low-pass filter to split the original image into two parts. Based on the finding that when the kernel size gradually increases, the high-frequency segmentation will gradually be larger than the low-frequency segmentation for the classification results of the deep neural network, the present application uses high-frequency segmentation to generate adversarial samples; however, the high-frequency segmentation performance of many original images is always unsatisfactory, so the present application designs an adversarial high-frequency segmentation with strong irrelevant features, which has regional uniformity, repetition, and density. It is found that such high-frequency segmentation has obvious disturbances to the deep neural network.

[0031] In one embodiment, see Figure 1 , the practical box-free adversarial attack method based on untrained mixed image transformation provided by this application comprises the following steps:

[0032] Step S101, draw (i.e., no training required) the adversarial patch x p To generate noisy high-frequency segments;

[0033] Among them, three simple regional uniform prototype patterns can be considered as basic adversarial patches, including: concentric circles, concentric squares and concentric diamonds, such as Figure 2 As shown in Figure 2, the effect of the concentric circle pattern is to make the generated high-frequency segments dense while also ensuring that the region is uniform. In order to satisfy the repetitive property, the size and tiling of these adversarial patches are further adjusted.

[0034] Among the three basic adversarial patches, the concentric circle one works best based on experimental verification.

[0035] Step S102: extracting the low frequency segment (LFC) of the original image and the high frequency segment (HFC) of the adversarial patch.

[0036] In this step, several methods can be used to extract high-frequency segments and low-frequency segments of the image, such as Fourier transform.

[0037] Exemplarily, using an approximately simple Gaussian low-pass filter G, whose size is (4k+1)*(4k+1), to obtain low-frequency segmentation, the process can be expressed as:

[0038]

[0039] Among them, σ=k determines the width of G. The larger σ is, the more high-frequency segments are filtered out. k is a preset value greater than 0. (i, j) represents the pixel coordinates of the image, and e is the natural base.

[0040] For simplicity, the embodiment of the present application does not intend to introduce a new Gaussian filter, but only obtains the high-frequency segment through G, that is, obtains its high-frequency segment by subtracting the low-frequency segment of the adversarial patch.

[0041] Step S103: Combine the two results to generate an adversarial mixed image x adv :

[0042] x adv =clip i,j (x*G+λ·(x p -x p *G))

[0043] Among them, x represents the original image, x p "*" indicates convolution operation, λ is the weight factor for balancing low-frequency segments and high-frequency segments, and clip i,j () is used to restrict the generated adversarial examples to the original image l ∞ In the ε-ball of the space, (i, j) represents the pixel coordinates of the image. The ε-ball is used to represent a sphere with a radius of ε centered on the original image, that is, all points in the sphere "ε-ball" are no more than ε away from the original image, that is, the difference between each pixel of the original image and the corresponding pixel of the new image is within ε (i.e., perturbation). This approach ensures that these perturbations are below the threshold of human visual perception, making the adversarial samples almost visually indistinguishable from the original samples, thereby achieving the purpose of covert attack.

[0044] In order to better illustrate the technical effect of the solution proposed in this application, it is verified based on simulation experiments. The attack behavior is performed on the ImageNet dataset and compared with the performance of existing box-free attacks, traditional black-box attacks, practical black-box attacks, and white-box attacks.

[0045] The experimental conditions in this example are as follows: System: Ubuntu 20.04, Software: Python 3.8, Processor: CPU E5-2678 v3@2.50GHz×2, memory: 512GB.

[0046] In order to more accurately evaluate the attack performance of the present invention, this embodiment conducts image classification attack experiments on the ImageNet dataset, considering 10 well-known normally trained classification models: VGG19, Inception-v3 (incc-v3), ResNet-152 (Res152), WideResNet-101 (WRN), DenseNet-121 (Dense), SENet, PNASNet (PNA), ShuffleNet-v2 (Shuffle), SqueezeNet (Squeeze) and MobileNet-v2 (Mobile) as the target models of this embodiment. For fine-grained classification, the DCL framework and three different backbones are used: ResNet50 (Res-50), SENet and SE-ResNet101 (SE-Res101).

[0047] For ImageNet classification, 10,000 images are selected from the ImageNet validation set. Each class contains about 10 images, which are resized to 299×299×3 beforehand and are correctly classified by all normally trained networks. For fine-grained classification, the test datasets (448×448×3) of CUB200-2011, Stanford Cars, and FGVC Aircraft are evaluated.

[0048] In the experiment of this embodiment, l ∞The perceptibility of adversarial noise is measured by the norm, and the maximum ε is set according to the default settings of the comparison method. For the unframed threat model, the parameters of the maximum perturbation ε is set to 25.5 (0.1×255) follow their default settings. For the scheme of this application (HIT), the size of the Gaussian kernel G is 17×17 (ie, k=4), the weight factor λ is set to 1.0, and the density of the prototype pattern is set to 12. For the sample size, unless specified, it is set to 50×50, that is, the sample scheme is 6×6. For the traditional black-box threat model, the iteration T is set to 10, the maximum perturbation ε=16, and the step size α is 1.6. In addition, the default attenuation factor μ=1.0 is used for MI-FGSM. This embodiment sets the transformation probability of DI2-FGSM to 0.7. The Gaussian kernel length of TI-FGSM is 15. For PI-FGSM, the project kernel length is 3, the amplification factor β, and the project factor γ are 10.0 and 16.0, respectively. For S2I-FGSM, the number of spectral transformations N=20. For practical black-box threat models, the maximum perturbation ε is set to 10. For CDA and BIA, the generated generators are trained on the 1.2 million ImageNet training dataset (using the Adam optimizer with a learning rate of 2e-4) for an epoch with a batch size of 16. For DR and SSP, the step size α=4 and iteration T=100 are set. For DR, SSP and BIA that perturb low-level features, the output of Maxpool.3 of VGG-19 and the output of Conv3_8 of Res-152 are attacked. Table 1 is a performance comparison table of cosine similarity of low-level features of different mode models of this application in this embodiment, where the maximum perturbation ε=16. The bold values ​​indicate the lowest similarity.

[0049] Table 1

[0050]

[0051] In Table 1, Model 1 – concentric squares, Model 2 – concentric diamonds, Model 3 – concentric circles, and the bold values ​​indicate the lowest similarity.

[0052] From Table 1, we can find that the adversarial patch with concentric circles has the best effect and the lowest similarity.

[0053] Table 2

[0054]

[0055]

[0056] The maximum perturbation ε=25.5 in Table 2, Sup. represents the supervision mechanism, and the bold value represents the best transferability. It can be seen that compared with the state-of-the-art box-free attack, the performance of the proposed scheme (HIT) is significantly superior.

[0057] Table 3

[0058]

[0059]

[0060] In Table 3, the maximum perturbation ε=16, "*" indicates white-box attack, and the bold value indicates the best transferability. Compared with the traditional black-box attack, the performance of the present application solution (HIT) is significantly better.

[0061] Table 4

[0062]

[0063] In Table 4, the maximum perturbation ε=10, the leftmost column is the ImageNet pre-trained alternative model, and the bold value indicates the best transferability. From Table 4, it can be seen that the performance of the box-free attack of the present application scheme (HIT) is comparable to that of the actual black-box attack.

[0064] By comparing traditional black box attacks, practical black box attacks, and existing boxless attacks, it can be seen that the method proposed in this application has excellent performance while greatly reducing the time cost and improving the current level of development of adversarial attacks. At the same time, through the above data analysis and comparison, it can be seen that this application is better than other adversarial attack methods. These results verify the effectiveness and superiority of the present invention.

[0065] In summary, the practical boxless adversarial attack method based on untrained mixed image transformation provided by the present application realizes a practical boxless adversarial attack based on untrained mixed image transformation. The present application first draws three basic patterns, and adjusts their sizes and tiles as basic adversarial patches to generate noisy high-frequency segments; secondly, an approximately simple Gaussian low-pass transformer is used to extract the low-frequency segments of the original image and the high-frequency segments of the adversarial patch; finally, the two parts of the results are mixed to generate an adversarial mixed image. The present application realizes a boxless adversarial attack with excellent performance, which is better than traditional black-box attacks and current boxless attacks, and can even be comparable to mainstream transfer-based black-box attacks, and the attack scheme does not require training, which greatly reduces the time cost and improves the attack efficiency and performance.

[0066] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0067] Any process or method description described in a flowchart or otherwise in this specification may be understood to represent a module, fragment or portion of code that includes one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0068] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0069] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

[0071] The above are only some embodiments of the present application. For those skilled in the art, several modifications and improvements can be made without departing from the creative concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A practical box-free adversarial attack method based on untrained mixed image transformation, characterized in that The following steps are involved: Step 1: Input the original image x and draw an adversarial patch x with the same image size as the original image x p ; where the adversarial patch x p A concentric figure composed of a plurality of unit figures of different sizes arranged in a centrally symmetrical manner; Step 2: Extract low-frequency segments and adversarial patches x of the original image x p High frequency segmentation; In step 3, the extracted low-frequency segments are mixed with the high-frequency segments to generate an adversarial mixed image.

2. The method according to claim 1, characterized in that The intervals between adjacent unit graphics in the concentric graphics are the same.

3. The method according to claim 1, characterized in that The line colors and / or line shapes of the unit graphics in the concentric graphics include a plurality of types.

4. The method according to claim 3, characterized in that The line color of each unit shape in the concentric shapes is different.

5. The method according to claim 1, characterized in that The unit shapes in the concentric shapes are circles, squares or rhombuses.

6. The method according to any one of claims 1 to 5, characterized in that: In step 2, the low-frequency segments of the original image x and the adversarial patch x are extracted p The high frequency segments include: Extract low-frequency segments of the original image x through a Gaussian low-pass filter; Extract the adversarial patch x through a Gaussian low-pass filter p The low-frequency segmentation, and then from the adversarial patch x p Subtract the low-frequency segment to obtain the adversarial patch x p High frequency segmentation.

7. The method according to claim 6, characterized in that The Gaussian kernel size of the Gaussian low-pass filter is set to (4k+1)*(4k+1), where the parameter k is a preset value, and its value is greater than 0.

8. The method according to any one of claims 1 to 5, characterized in that In step 3, the generated adversarial mixed image is: x adv =clip i,j (x LFC +x p HFC ) Among them, x LFC is the low-frequency segment of the original image x, x p HFC To counter the patch x p The high-frequency segmentation, λ is the preset weight factor used to balance the low-frequency segmentation and the high-frequency segmentation, clip i,j () is used to generate the adversarial mixed image x adv Restricted to the original image x ∞ In the ε-ball of the space, (i, j) represents the pixel coordinates of the image. The ε-ball is used to represent a sphere with a radius of ε centered on the original image x, and ε is used to represent the preset perturbation.

9. The method according to claim 8, characterized in that The value range of parameter ε is [2.5, 25.5].

Images