Confrontation sample construction method

Abstract

The invention discloses an adversarial sample construction method comprising the following steps: S1, obtaining a target image, segmenting the target image, and obtaining a segmentation mask; s2, inputting the target image into a generator, and obtaining current global confrontation disturbance; s3, based on the target image, in combination with the segmentation mask and the current global adversarial disturbance, obtaining a current adversarial sample; s4, inputting the current adversarial sample and the target image into an agent model, and obtaining the total loss of the image; s5, inputting the total image loss into the generator, and obtaining new global confrontation disturbance in combination with the target image; and S6, returning to S3 until the current optimal adversarial sample is obtained. An image segmentation module is introduced, and a key area is identified. Secondly, disturbance is added only for the key area, and an adversarial sample is constructed under the condition of less disturbance;

Description

Technical Field

[0001] The present invention belongs to the technical field of machine learning, and in particular relates to a method for constructing adversarial samples. Background Art

[0002] With the development of deep learning theory, deep neural networks (DNN) have made a series of breakthroughs, with outstanding performance in image classification, target detection, semantic segmentation, face recognition, etc., and have been applied to smart medical care, autonomous driving, smart security, etc. Taking the medical field as an example, deep learning models have been widely used in lesion identification, disease diagnosis, organ positioning, brain-computer interface, etc., and have achieved ideal results.

[0003] However, deep learning network models are vulnerable to attacks by carefully crafted adversarial samples, that is, by adding perturbations to the input samples, the model gives an erroneous result with high confidence. In addition, adversarial samples may reveal sensitive information about the internal structure of the model, which attackers can use to commit potential crimes. These issues have raised security concerns about the application of deep learning in key areas, especially in the medical field, which is closely related to life and health. Because the misclassification of medical samples by neural network models will not only lead to reputational and economic losses for hospitals and patients, but also have serious life-threatening effects on patients due to misdiagnosis of diseases.

[0004] Adversarial sample attacks on image processing models are more targeted at conventional applications such as object classification and face recognition. However, with the in-depth application of image processing technology in the medical field, some adversarial sample attack methods for natural images have been transferred to the field of medical image processing. Ma et al. used four conventional adversarial attack methods to attack DNNs used for medical classification and found that even the most advanced medical classifiers are extremely vulnerable and very susceptible to attacks that are difficult for humans to detect. Although such conventional attack methods have significant attack effects in the image field, it should be noted that these attack methods are not developed for medical images, and there is still room for improvement in attack concealment and success rate. First, most attack methods usually construct adversarial samples based on the entire image, rather than the key areas in the medical image (such as the lesion area), which can easily cause large-scale disturbances outside the key areas and reduce the concealment of adversarial samples. Second, medical images often have obvious textures, but existing attacks have not fully utilized such features and have not fully protected such features, resulting in poor attack effects and large modifications to the image. Third, most existing attack schemes assume that the neural network model used for medical image classification is known (white-box attack), which will result in less than ideal results for attacks on unknown models (black-box attack), that is, the transferability of the attack is poor. This is because the interpretability of deep neural networks is not ideal. If it is impossible to know whether two different models have learned similar features on the same data set, the transferability of the attack is poor. Fourth, most existing attack schemes target binary classification models, while medical images are diverse and often require diversified classification based on disease severity, diseased area, etc., which leads to poor applicability of existing attack schemes.

[0005] Goodfellow et al. used adversarial sample training to greatly reduce the misclassification rate on adversarial samples. At the same time, they found that selecting adversarial samples generated by the original model as training data can train a model with higher resistance. In addition, they also found that for misclassified adversarial samples, the confidence of the model obtained by adversarial training is still very high. In other words, adversarial training can improve the anti-interference ability of deep learning to adversarial samples. Therefore, studying efficient adversarial sample construction methods can provide a data basis for adversarial training of models with high anti-interference ability, which is generally conducive to the overall progress of the field of machine learning. Summary of the invention

[0006] In order to solve the above technical problems, the present invention proposes a method for constructing adversarial samples. By dividing the target image into key areas and non-key areas, and focusing on the key areas to achieve noise injection, the constructed adversarial samples can distract the attention of the deep learning model to other non-important areas, reducing its decision-making ability, and have good transferability. At the same time, with the help of the newly designed loss function, the visual features of the target image are effectively maintained, making the adversarial samples have good concealment.

[0007] To achieve the above object, the present invention provides an adversarial sample construction method, comprising:

[0008] S1. Acquire a target image, segment the target image, and obtain a segmentation mask;

[0009] S2. Input the target image into the generator to obtain the current global adversarial disturbance;

[0010] S3. Based on the target image, combining the segmentation mask and the current global adversarial perturbation, obtaining a current adversarial sample;

[0011] S4, inputting the current adversarial sample and the target image into the proxy model to obtain the total image loss;

[0012] S5, inputting the total image loss into the generator, combining it with the target image, and obtaining a new global adversarial perturbation;

[0013] S6. Return to S3 until the current optimal adversarial sample is obtained.

[0014] Optionally, segmenting the target image to obtain a segmentation mask includes:

[0015] An image segmentation model is used to identify key areas in the target image, and the target image is segmented by outputting a binary segmentation mask of the key areas.

[0016] Optionally, based on the target image, in combination with the segmentation mask and the current global adversarial perturbation, obtaining the current adversarial sample includes:

[0017] Obtaining a local adversarial perturbation based on the segmentation mask and the current global adversarial perturbation;

[0018] The local adversarial perturbation is injected into the target image to obtain the current adversarial sample.

[0019] Optionally, a method for obtaining the current adversarial sample is:

[0020]

[0021] Among them, x advis an adversarial sample, x is the target image, M k is the key area in the target image, is the non-critical area in the target image, G θ (x) is the global adversarial perturbation, ⊙ is the Hadamard product, and ⊕ is the pixel-by-pixel addition of the image.

[0022] Optionally, inputting the current adversarial sample and the target image into the proxy model to obtain the total image loss includes:

[0023] Input the current adversarial sample and the target image into the proxy model to obtain classification labels, texture features, and class activation maps;

[0024] According to the classification label, texture feature and class activation map, classification loss, texture loss and class activation loss are obtained respectively;

[0025] The total image loss is obtained based on the classification loss, texture loss and class activation loss.

[0026] Optionally, the method for obtaining the classification loss is:

[0027] L adv =J(F(x adv ),y)

[0028] Among them, L adv is the classification loss, J() is the cross entropy loss, y is the true label of the target image, and F() is the classification model;

[0029] The method for obtaining the texture loss is:

[0030] L LBP =||LBP(x adv )-LBP(x)||2

[0031] Among them, L LBP is the texture loss, LBP(x adv ) is the texture feature of the adversarial sample, LBP(x) is the texture feature of the target image, and ∥∥2 is the norm;

[0032] The method to obtain the class activation loss is:

[0033] L CAM =||CAM k (x,y)-CAM k (x adv ,y)||2

[0034] Among them, L CAM is the class activation loss, CAM k (x,y) is the feature importance of x to y, CAM k (xadv ,y) is x adv The feature importance for y.

[0035] Optionally, the method for obtaining the total loss of the image is:

[0036] L=-L adv -λ CAM L CAM +λ LBP L LBP

[0037] Among them, L is the total image loss, L adv is the classification loss, L LBP is the texture loss, L CAM is the class activation loss, λ CAM and λ LBP are all weight coefficients.

[0038] Optionally, obtaining the current optimal adversarial sample includes:

[0039] When the local adversarial disturbance reaches a preset disturbance size, the current optimal adversarial sample is obtained in combination with the target image.

[0040] Compared with the prior art, the present invention has the following advantages and technical effects:

[0041] 1. The present invention first introduces an image segmentation module to identify the key areas in the target image that have a greater impact on the classification results. Secondly, perturbations are added only to the key areas, and the deep features of the model are fully utilized to construct adversarial samples with less perturbations.

[0042] 2. The present invention proposes a loss function that takes into account both class activation loss and texture feature loss. Class activation loss can disrupt the agent model's attention to the image in the classification space and enhance the transferability of adversarial samples. Texture feature loss can reduce the damage to the non-semantic features of the image and improve the concealment of adversarial samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 This is a flow chart of a method for constructing an adversarial sample according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0046] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0047] The present invention proposes a method for constructing adversarial samples. Figure 1 As shown, the specific steps include:

[0048] S1. Acquire a target image, segment the target image, and obtain a segmentation mask;

[0049] S2. Input the target image into the generator to obtain the current global adversarial disturbance;

[0050] S3, based on the target image, combining the segmentation mask and the current global adversarial perturbation, obtaining a current adversarial sample;

[0051] S4, inputting the current adversarial sample and the target image into the proxy model to obtain the total image loss;

[0052] S5, inputting the total image loss into the generator, combining it with the target image, and obtaining a new global adversarial perturbation;

[0053] S6. Return to S3 until the current optimal adversarial sample is obtained.

[0054] The adversarial sample construction method proposed in the present invention divides the target image into key areas and non-key areas, and injects noise by focusing on the key areas. The constructed adversarial samples can distract the attention of the deep learning model to other non-important areas, reduce its decision-making ability, and have good mobility. At the same time, with the help of the newly designed loss function, the visual features of the target image are effectively maintained, so that the adversarial sample has good concealment. In general, the adversarial sample construction method proposed in the present invention can construct adversarial samples with better effects at a relatively low cost.

[0055] Furthermore, segmenting the target image to obtain a segmentation mask includes:

[0056] An image segmentation model is used to identify key areas in the target image, and the target image is segmented by outputting a binary segmentation mask of the key areas.

[0057] Specifically, the adversarial sample construction method proposed in the present invention uses an image segmentation model to identify the key area in the target image, and identifies the key area T in the image by outputting a binary segmentation mask, while protecting the non-key area in the image

[0058] Specifically, given a target image x of size w*h (width w, height h), then T = x⊙M k , Among them, M k and are the binary segmentation masks of the key and non-key regions in x, respectively, with sizes of w*h and elements taking values ​​of 0 or 1, and ⊙ represents the Hadamard product.

[0059] Further, based on the target image, in combination with the segmentation mask and the current global adversarial perturbation, obtaining the current adversarial sample includes:

[0060] Obtaining a local adversarial perturbation based on the segmentation mask and the current global adversarial perturbation;

[0061] The local adversarial perturbation is injected into the target image to obtain the current adversarial sample.

[0062] Specifically, in the adversarial sample generation process, the generator G first randomly initializes the adversarial perturbation, and then cooperates with the proxy model to optimize the perturbation while satisfying the constraints (i.e., G θ (x)) in order to construct adversarial samples whose perturbations are not easily noticeable and have strong transfer capabilities.

[0063] In order to reduce the modification of the sample, the adversarial sample construction method proposed in the present invention only modifies the sample corresponding to the binary segmentation mask M k , rather than the entire image.

[0064] Furthermore, the method for obtaining the current adversarial sample is:

[0065]

[0066] Among them, x adv is an adversarial sample, x is the target image, M k is the key area in the target image, is the non-critical area in the target image, G θ (x) is the global adversarial perturbation, ⊙ is the Hadamard product, It is the pixel-by-pixel addition of the image.

[0067] Furthermore, the current adversarial sample and the target image are input into the proxy model to obtain the total image loss, wherein the proxy model is a white-box classification model, which consists of an input layer, a hidden layer, and an output layer, including:

[0068] Input the current adversarial sample and the target image into the proxy model to obtain classification labels, texture features, and class activation maps;

[0069] According to the classification label, texture feature and class activation map, classification loss, texture loss and class activation loss are obtained respectively;

[0070] The total image loss is obtained based on the classification loss, texture loss and class activation loss.

[0071] Specifically, in Figure 1 In the process of adversarial sample generation, the CAM module obtains the class activation map from the proxy model, and improves the transferability of adversarial samples by maximizing the class activation loss between adversarial samples and target samples. The generator G obtains the output labels of the target samples and adversarial samples on the proxy model and the LBP features describing the texture features, minimizing the impact of adversarial perturbations on image quality and ensuring the imperceptibility of perturbations.

[0072] In the process of constructing adversarial samples, the U-Net-based encoder and decoder are used to perform multiple downsampling and upsampling operations on the input image x to generate gradually larger feature maps. Finally, the adversarial perturbation is optimized through convolution and Tanh() activation function.

[0073] Furthermore, the method for obtaining the classification loss is:

[0074] L adv =J(F(x adv ),y)

[0075] Among them, L adv is the classification loss, J() is the cross entropy loss, y is the true label of the target image, F() is the classification model, and F(x) represents the output of the input image x;

[0076] The method for obtaining the texture loss is:

[0077] L LBP =||LBP(x adv )-LBP(x)||2

[0078] Among them, L LBP is the texture loss, LBP(x adv ) is the adversarial sample x adv The texture feature of the target image x, LBP(x) is the texture feature of the target image x, and ∥∥2 is the norm;

[0079] Specifically, in the process of constructing adversarial samples, perturbations may destroy the image on a large scale and produce easily noticeable changes. In order to reduce the difference between the adversarial sample and the target image, the present invention uses LBP to maintain its visual consistency. LBP is an effective texture feature description method, which has the advantages of rotation invariance and grayscale invariance. The LBP operator is usually defined in a window of equal length and width, and obtains the texture features of the entire image by comparing the grayscale values ​​of the central pixel with its adjacent pixels.

[0080]

[0081]

[0082] In the above formula, c represents the central pixel of the image in the window, q represents the qth adjacent pixel of c, Q represents all adjacent pixels of c, I() represents the grayscale value of the pixel, and s() is the sign function.

[0083] The LBP operator in the present invention is defined in a 3*3 window. Taking the gray value of the pixel in the center of the window as the threshold, the gray value of the 8 pixels around the pixel is compared to obtain an 8-bit binary number. The binary number is further converted into a decimal LBP code, which can reflect the texture characteristics of the image. In the training process, x and x are obtained respectively. adv Grayscale image, used to generate LBP(x) and LBP(x adv ).

[0084] The method to obtain the class activation loss is:

[0085] L CAM =||CAM k (x,y)-CAM k (x adv ,y)||2

[0086] Among them, L CAM is the class activation loss, CAM k (x,y) is the feature importance of image x to y, CAM k (x adv ,y) is x adv The feature importance for y.

[0087] Specifically, in order to improve the transferability of adversarial samples, the present invention focuses on key areas that are more important for model classification and features that play a decisive role in model decision-making.

[0088] For a target image x of size w*h (width w, height h), the feature importance is defined as:

[0089]

[0090] Among them l y Represents the logit output relative to the true label y, A k represents the activation value of the k-th layer feature map, Represents the neuron importance weights obtained by globally averaging the gradients returned by the model over the height and width dimensions (indexed by i and j).

[0091] From the above formula, it can be concluded that the importance of a feature is proportional to its impact on the model decision. Therefore, the generator G perturbs the deep features in the model that have a positive effect on the decision based on the feature importance, specifically by maximizing the following total image loss during the training process.

[0092] Furthermore, the method for obtaining the total loss of the image is:

[0093] L=-L adv -λ CAM L CAM +λ LBP L LBP

[0094] Among them, L is the total image loss, L adv is the classification loss, L LBP is the texture loss, L CAM is the class activation loss, λ CAM and λ LBP are all weight coefficients.

[0095] Furthermore, obtaining the current optimal adversarial sample includes:

[0096] When the local adversarial disturbance reaches a preset disturbance size, the current optimal adversarial sample is obtained in combination with the target image.

[0097] The overall workflow of adversarial sample construction in the present invention is shown in Algorithm 1.

[0098]

[0099] In the above algorithm, line 3 realizes the recognition of key areas. Line 4 realizes the generation of adversarial perturbations. Lines 5-6 calculate the adversarial perturbations and the key area mask M. k The Hadamard product of limits the adversarial perturbation to the critical area. In addition, the Clip() function implements the clipping of adversarial samples to avoid large changes in pixel values ​​in the image. Lines 7-8 calculate the training loss and update the generator parameters by gradient descent, where lr is the learning rate.

[0100] This invention provides ideas for improving the security and reliability of deep learning in the image field by exploring the adversarial sample construction technology for the image field. The adversarial sample construction method proposed in this invention divides the target image into key areas and non-key areas, and injects noise by focusing on the key areas, which distracts the attention of the deep learning model to other non-important areas, reducing its decision-making ability; at the same time, the visual features of the target image are effectively maintained by means of the newly designed loss function. Overall, an ideal adversarial sample is constructed at a relatively low cost, especially with good transferability and concealment.

[0101] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for constructing an adversarial sample, characterized in that: include: S1. Acquire a target image, segment the target image, and obtain a segmentation mask; S2. Input the target image into the generator to obtain the current global adversarial disturbance; S3, based on the target image, combining the segmentation mask and the current global adversarial perturbation, obtaining a current adversarial sample; S4, inputting the current adversarial sample and the target image into the proxy model to obtain the total image loss; S5, inputting the total image loss into the generator, combining it with the target image, and obtaining a new global adversarial perturbation; S6. Return to S3 until the current optimal adversarial sample is obtained.

2. The method for constructing an adversarial sample according to claim 1, characterized in that: Segmenting the target image to obtain a segmentation mask includes: An image segmentation model is used to identify key areas in the target image, and the target image is segmented by outputting a binary segmentation mask of the key areas.

3. The method for constructing an adversarial sample according to claim 1, characterized in that: Based on the target image, in combination with the segmentation mask and the current global adversarial perturbation, obtaining the current adversarial sample includes: Obtaining a local adversarial perturbation based on the segmentation mask and the current global adversarial perturbation; The local adversarial perturbation is injected into the target image to obtain the current adversarial sample.

4. The method for constructing an adversarial sample according to claim 3, characterized in that: The method for obtaining the current adversarial sample is: Among them, x adv is an adversarial sample, x is the target image, M k is the key area in the target image, is the non-critical area in the target image, G θ (x) is the global adversarial perturbation, ⊙ is the Hadamard product, and ⊕ is the pixel-by-pixel addition of the image.

5. The method for constructing an adversarial sample according to claim 4, characterized in that: Inputting the current adversarial sample and the target image into the proxy model, and obtaining the total loss of the image includes: Input the current adversarial sample and the target image into the proxy model to obtain classification labels, texture features and class activation maps; According to the classification label, texture feature and class activation map, respectively obtain classification loss, texture loss and class activation loss; The total image loss is obtained based on the classification loss, texture loss and class activation loss.

6. The method for constructing an adversarial sample according to claim 5, characterized in that: The method for obtaining the classification loss is: L adv =J(F(x adv ),y) Among them, L adv is the classification loss, J() is the cross entropy loss, y is the true label of the target image, and F() is the classification model; The method for obtaining the texture loss is: THE LBP =||LBP(x adv )-LBP(x)||2 Among them, L LBP is the texture loss, LBP(x adv ) is the texture feature of the adversarial sample, LBP(x) is the texture feature of the target image, and ∥∥2 is the norm; The method to obtain the class activation loss is: L CAM =||CAM k (x,y)-CAM k (x adv ,y)||2 Among them, L CAM is the class activation loss, CAM k (x,y) is the feature importance of x to y, CAM k (x adv ,y) is x adv The feature importance for y.

7. The method for constructing an adversarial sample according to claim 6, characterized in that: The method for obtaining the total loss of the image is: L=-L adv -l CAM L CAM +λ LBP L LBP Among them, L is the total image loss, L adv is the classification loss, L LBP is the texture loss, L CAM is the class activation loss, λ CAM and λ LBP are all weight coefficients.

8. The method for constructing an adversarial sample according to claim 3, characterized in that: Obtaining the current optimal adversarial sample includes: When the local adversarial disturbance reaches a preset disturbance size, the current optimal adversarial sample is obtained in combination with the target image.

Images