An adversarial sample construction method

Abstract

The application discloses a kind of methods for constructing adversarial samples, comprising: S1, obtaining target image, the target image is segmented, and obtains segmentation mask;S2, the target image is input into generator, and current global adversarial perturbation is obtained;S3, based on the target image, the segmentation mask and current global adversarial perturbation are combined, and current adversarial sample is obtained;S4, the current adversarial sample and target image are input into proxy model, and image total loss is obtained;S5, the image total loss is input into the generator, and the new global adversarial perturbation is obtained in combination with the target image;S6, return S3 until the current optimal adversarial sample is obtained.The application introduces image segmentation module, and identifies key area.Secondly, only for key area adds disturbance, and constructs adversarial sample under the condition of less disturbance.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of machine learning, and particularly relates to an adversarial sample construction method. BACKGROUND

[0002] With the development of deep learning theory, deep neural networks (DNN) have made a series of breakthroughs, and have performed outstandingly in image classification, target detection, semantic segmentation, face recognition, etc., and have been applied to intelligent medical treatment, automatic driving, intelligent security, etc. For example, in the medical field, deep learning models have been widely applied to lesion recognition, disease diagnosis, organ positioning, brain-computer interface, etc., and have achieved ideal results.

[0003] However, deep learning network models are vulnerable to carefully crafted adversarial samples, i.e., by adding perturbations to the input samples, the model gives a wrong result with high confidence. In addition, adversarial samples can reveal sensitive information about the internal structure of the model, which can be used by attackers to commit potential criminal acts. These problems have caused people's security concerns about the application of deep learning in critical fields, especially in the medical field closely related to life and health. Because the wrong classification of neural network models for medical samples will not only cause the loss of reputation and economic loss of hospitals and patients, but also have a serious impact on the life of patients due to misdiagnosis of diseases.

[0004] The adversarial sample attack on image processing models is more targeted at general applications such as object classification and face recognition. However, as image processing technology is applied in the medical field, some adversarial sample attack methods for natural images have been migrated to the medical image processing field. Ma et al. used four conventional adversarial attack methods to attack DNNs for medical classification and found that even the most advanced medical classifiers are extremely vulnerable and very susceptible to attacks that are difficult for humans to detect. Although such conventional attack methods have a significant effect on image field attacks, it should be noted that these attack methods are not developed for medical images and there is still room for improvement in attack stealth, success rate, etc. First, most attack methods are usually based on the entire image to construct adversarial samples, rather than the key areas (such as lesion areas) in medical images, which are easy to cause large-scale disturbance outside the key areas and reduce the stealth of adversarial samples. Second, medical images often have obvious textures, but existing attacks do not fully utilize or protect such features, resulting in poor attack effectiveness and large image modifications. Third, most existing attack schemes assume that the neural network model used for medical image classification is known (white-box attack), which can result in less than ideal attack effects on unknown models (black-box attack), i.e., poor attack transferability. This is because the explainability of deep neural networks is not ideal, and if it is not known whether two different models have learned similar features on the same data set, the attack transferability is poor. Fourth, most existing attack schemes are targeted at binary classification models, while medical images have diversity and often need to be classified based on disease severity, affected site, etc., resulting in poor applicability of existing attack schemes.

[0005] Goodfellow et al. found that the misclassification rate on adversarial samples was greatly reduced by training with adversarial samples. At the same time, they found that selecting adversarial samples generated by the original model as training data can train a model with higher resistance. In addition, they also found that for misclassified adversarial samples, the confidence of the model obtained by adversarial training is still very high. In other words, adversarial training can improve the anti-interference ability of deep learning for adversarial samples. Therefore, researching an efficient adversarial sample construction method can provide a data basis for adversarial training of models with high anti-interference ability, and overall is conducive to the overall progress of the field of machine learning. SUMMARY

[0006] To solve the above technical problems, the application provides an adversarial sample construction method, which divides a target image into a key region and a non-key region, and realizes noise injection by focusing on the key region, so that the constructed adversarial sample can disperse the attention of a deep learning model to other non-important regions, so that the decision-making ability is reduced, and the adversarial sample has good migration property. At the same time, with the help of a newly designed loss function, the visual features of the target image are effectively maintained, so that the adversarial sample has good concealment.

[0007] To achieve the above object, the application provides an adversarial sample construction method, comprising:

[0008] S1, obtaining a target image, segmenting the target image, and obtaining a segmentation mask;

[0009] S2, inputting the target image into a generator to obtain a current global adversarial perturbation;

[0010] S3, based on the target image, combining the segmentation mask and the current global adversarial perturbation, and obtaining a current adversarial sample;

[0011] S4, inputting the current adversarial sample and the target image into a proxy model to obtain an image total loss;

[0012] S5, inputting the image total loss into the generator, combining the target image, and obtaining a new global adversarial perturbation;

[0013] S6, returning to S3 until the current optimal adversarial sample is obtained.

[0014] Optionally, segmenting the target image to obtain a segmentation mask comprises:

[0015] Using an image segmentation model to identify a key region in the target image, and segmenting the target image by outputting a binary segmentation mask of the key region.

[0016] Optionally, based on the target image, combining the segmentation mask and the current global adversarial perturbation to obtain the current adversarial sample comprises:

[0017] Based on the segmentation mask and the current global adversarial perturbation, a local adversarial perturbation is obtained;

[0018] Injecting the local adversarial perturbation into the target image to obtain the current adversarial sample.

[0019] Optionally, the method for obtaining the current adversarial sample is:

[0020]

[0021] wherein, x advFor the adversarial sample, x is the target image, M k For the key region in the target image, For the non-key region in the target image, G θ (x) is the global adversarial perturbation, is the Hadamard product, is the pixel-wise addition of the image.

[0022] Optionally, the current adversarial sample and the target image are input into the agent model to obtain the image total loss, which includes:

[0023] The current adversarial sample and the target image are input into the agent model to obtain the classification label, the texture feature and the class activation map;

[0024] According to the classification label, the texture feature and the class activation map, the classification loss, the texture loss and the class activation loss are respectively obtained;

[0025] Based on the classification loss, the texture loss and the class activation loss, the image total loss is obtained.

[0026] Optionally, the method for obtaining the classification loss is:

[0027] L adv = J (F (x adv ), y)

[0028] Wherein, L adv is the classification loss, J() is the cross-entropy loss, y is the real label of the target image, F() is the classification model;

[0029] The method for obtaining the texture loss is:

[0030] L LBP = ||LBP (x adv )-LBP (x)||2

[0031] Wherein, L LBP is the texture loss, LBP(x adv ) is the texture feature of the adversarial sample, LBP(x) is the texture feature of the target image, and || ||2 is the norm.

[0032] The method for obtaining the class activation loss is:

[0033] L CAM = ||CAM k (x,y)-CAM k (x adv ,y)||2

[0034] Wherein, L CAM is the class activation loss, CAM k (x,y) is the feature importance of x to y, and CAM k (xadv y) is x adv The feature importance for y.

[0035] Optionally, the method for obtaining the total image loss comprises:

[0036] L = -L adv -λ CAM L CAM +λ LBP L LBP

[0037] Wherein, L is the total image loss, L adv is the classification loss, L LBP is the texture loss, L CAM is the class activation loss, λ CAM and λ LBP are weight coefficients.

[0038] Optionally, the method for obtaining the current optimal adversarial sample comprises:

[0039] When the local adversarial perturbation reaches the preset perturbation size, the current optimal adversarial sample is obtained in combination with the target image.

[0040] Compared with the prior art, the present application has the following advantages and technical effects:

[0041] 1. The present application first introduces an image segmentation module to identify the key area in the target image that has a greater impact on the classification result. Secondly, only the key area is added with perturbation, and the deep features of the model are fully utilized to construct the adversarial sample under the condition of less perturbation.

[0042] 2. The present application proposes a loss function that takes into account the class activation loss and the texture feature loss. The class activation loss can disturb the attention of the proxy model to the image in the classification space, enhancing the transferability of the adversarial sample. The texture feature loss can reduce the damage to the non-semantic features of the image, improving the concealment of the adversarial sample. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which form a part of this application, are included to provide a further understanding of the application and are incorporated in and constitute a part of this application. The embodiments of this application and their description together with the drawings serve to explain the application. In the drawings:

[0044] Figure 1 is a flow chart of an adversarial sample construction method according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] It should be noted that the embodiments and features in the present application can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0046] It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from here.

[0047] The present application proposes an adversarial sample construction method, as shown in the formula: Figure 1 Specifically, the method comprises the following steps:

[0048] S1, obtaining a target image, segmenting the target image, and obtaining a segmentation mask;

[0049] S2, inputting the target image into the generator to obtain a current global adversarial perturbation;

[0050] S3, based on the target image, combining the segmentation mask and the current global adversarial perturbation, and obtaining a current adversarial sample;

[0051] S4, inputting the current adversarial sample and the target image into the agent model to obtain an image total loss;

[0052] S5, inputting the image total loss into the generator, combining the target image, and obtaining a new global adversarial perturbation;

[0053] S6, return to S3 until the current optimal adversarial sample is obtained.

[0054] The adversarial sample construction method proposed by the present application divides the target image into key regions and non-key regions, and realizes noise injection by focusing on the key regions. The adversarial sample constructed can disperse the attention of the deep learning model to other non-important regions, so that the decision-making ability is reduced, and has good transferability. At the same time, with the help of the newly designed loss function, the visual features of the target image are effectively maintained, so that the adversarial sample has good concealment. Overall, the adversarial sample construction method proposed by the present application can construct good adversarial samples at a small cost.

[0055] Further, the segmentation of the target image to obtain a segmentation mask comprises:

[0056] The key region in the target image is identified by using an image segmentation model, and the target image is segmented by outputting a binary segmentation mask of the key region.

[0057] Specifically, the adversarial sample construction method proposed by the present application uses an image segmentation model to identify the key region in the target image, and identifies the key region T in the image by outputting a binary segmentation mask, while protecting the non-key region in the image

[0058] Specifically, given a target image x with size w*h (width w and height h), T=x k , where M k and are binary segmentation masks of key regions and non-key regions in x respectively, both with size w*h and elements taking value 0 or 1, and

[0059] Further, based on the target image, the current global adversarial perturbation and the segmentation masks, the current adversarial sample is obtained by:

[0060] obtaining a local adversarial perturbation based on the segmentation masks and the current global adversarial perturbation;

[0061] injecting the local adversarial perturbation into the target image to obtain the current adversarial sample.

[0062] Specifically, in the process of generating an adversarial sample, the generator G first randomly initializes an adversarial perturbation, and then optimizes the perturbation in coordination with the proxy model under the condition of satisfying the constraint condition (i.e., G θ (x)), so as to construct an adversarial sample which is not easy to be perceived and has strong migration ability.

[0063] To reduce the modification of the sample, the adversarial sample construction method proposed by the present application only modifies the region corresponding to the binary segmentation mask M k , instead of the entire image.

[0064] Further, the method for obtaining the current adversarial sample is:

[0065]

[0066] where x adv is an adversarial sample, x is a target image, M k is a key region in the target image, is a non-key region in the target image, G θ (x) is a global adversarial perturbation, is a Hadamard product, is pixel-wise addition of an image.

[0067] Further, the current adversarial sample and the target image are input into the proxy model to obtain the image total loss, wherein the proxy model is a white-box classification model composed of an input layer, a hidden layer and an output layer, and includes:

[0068] the current adversarial sample and the target image are input into the proxy model to obtain a classification label, a texture feature and a class activation map;

[0069] According to the classification label, the texture feature and the class activation map, a classification loss, a texture loss and a class activation loss are respectively obtained;

[0070] Based on the classification loss, the texture loss and the class activation loss, the total loss of the image is obtained.

[0071] Specifically, in the CAM module, the class activation map is obtained from the proxy model in the process of generating the adversarial sample, and the transferability of the adversarial sample is improved by maximizing the class activation loss between the adversarial sample and the target sample. The generator G minimizes the influence of the adversarial perturbation on the image quality by obtaining the output label of the target sample and the LBP feature describing the texture feature on the proxy model, and ensures the imperceptibility of the perturbation. Figure 1

[0072] In the process of constructing the adversarial sample, the encoder and the decoder based on U-Net are used to perform multiple down-sampling and up-sampling operations on the input image x, to generate feature maps that gradually increase in size, and finally the adversarial perturbation is optimized through convolution and Tanh() activation function.

[0073] Further, the method for obtaining the classification loss is:

[0074] L adv =J(F(x adv ),y)

[0075] Wherein, L adv is the classification loss, J() is the cross-entropy loss, y is the real label of the target image, F() is the classification model, and F(x) represents the output of the input image x;

[0076] The method for obtaining the texture loss is:

[0077] L LBP =||LBP(x adv )-LBP(x)||2

[0078] Wherein, L LBP is the texture loss, LBP(x adv ) is the texture feature of the adversarial sample x adv , LBP(x) is the texture feature of the target image x, and || ||2 is the norm.

[0079] ​Specifically, in the process of constructing the adversarial sample, the disturbance may greatly destroy the image and produce easily perceptible changes. In order to reduce the difference between the adversarial sample and the target image, the LBP is used to maintain the visual consistency thereof. The LBP is an effective texture feature description method, which has the advantages of rotation invariance and gray scale invariance. The LBP operator is usually defined in a window with equal length and width, and the texture features of the entire image are obtained by comparing the gray scale values of the center pixel and its adjacent pixels.

[0080]

[0081]

[0082] In the above formula, c represents the center pixel of the image in the window, q represents the qth adjacent pixel of c, Q represents all adjacent pixels of c, I() represents the gray scale value of the pixel point, and s() is a sign function.

[0083] The LBP operator in the present application is defined in a 3*3 window. By comparing the gray scale values of the 8 pixels around the center pixel of the window with the gray scale value of the center pixel as a threshold, an 8-bit binary number can be obtained. Further converting the binary number into a decimal LBP code can reflect the texture features of the image. In the training process, the gray scale images of x and x adv are obtained respectively, which are used to generate LBP(x) and LBP(x adv ).

[0084] The method for obtaining the class activation loss is:

[0085] L CAM =||CAM k (x,y)-CAM k (x adv ,y)||2

[0086] wherein L CAM is the class activation loss, CAM k (x,y) is the feature importance of the image x for y, and CAM k (x adv ,y) is the feature importance of x adv for y.

[0087] Specifically, in order to improve the transferability of the adversarial sample, the present application focuses on the key regions which are more important for the model classification and the features which play a decisive role in the model decision.

[0088] For a target image x with a size of w*h (width w and height h), the feature importance is defined as:

[0089]

[0090] where l y represents the logit output relative to the true label y, A k represents the activation value of the k-th layer feature map, represents the neuron importance weight obtained by globally average pooling the gradient backpropagated to the model in the height and width dimensions (indexed by i, j).

[0091] From the above formula, it can be seen that the importance of a feature is proportional to its influence on the model decision. Therefore, the generator G disturbs the deep features that have a positive effect on the decision in the model based on the feature importance, specifically by maximizing the following image total loss during training.

[0092] Further, the method for obtaining the image total loss is:

[0093] L = -L adv - λ CAM L CAM + λ LBP L LBP

[0094] where L is the image total loss, L adv is the classification loss, L LBP is the texture loss, L CAM is the class activation loss, λ CAM and λ LBP are weight coefficients.

[0095] Further, obtaining the current optimal adversarial sample includes:

[0096] When the local adversarial perturbation reaches the preset perturbation size, the current optimal adversarial sample is obtained in combination with the target image.

[0097] The overall workflow of constructing an adversarial sample in the present application is shown in Algorithm 1.

[0098]

[0099] In the above algorithm, line 3 realizes the identification of the key region. Line 4 realizes the generation of the adversarial perturbation. Lines 5-6 limit the adversarial perturbation within the key region by calculating the Hadamard product of the adversarial perturbation and the key region mask M k . In addition, the Clip() function realizes the clipping of the adversarial sample, avoiding large changes in pixel values in the image. Lines 7-8 calculate the training loss and update the generator parameters by the gradient descent method, where lr is the learning rate.

[0100] The application provides a thought for improving the safety and reliability of deep learning in the image field by exploring the adversarial sample construction technology in the image field. The adversarial sample construction method provided by the application divides a target image into a key region and a non-key region, and realizes noise injection by focusing on the key region, so that the attention of the deep learning model is dispersed to other non-important regions, and the decision-making ability is reduced; at the same time, the visual features of the target image are effectively maintained by means of a newly designed loss function. Overall, an ideal adversarial sample is constructed at a small cost, especially with good transferability and concealment.

[0101] The above is only a preferred specific embodiment of the application, but the protection scope of the application is not limited to this, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the application, which should be covered in the protection scope of the application. Therefore, the protection scope of the application should be subject to the protection scope of the claims.

Claims

1. A method for constructing adversarial samples, characterized in that: include: S1. Acquire a target image, segment the target image, and obtain a segmentation mask; S2. Input the target image into the generator to obtain the current global adversarial perturbation; S3. Based on the target image, combining the segmentation mask and the current global adversarial perturbation, obtaining a current adversarial sample; Acquiring the current adversarial sample based on the target image, in combination with the segmentation mask and the current global adversarial perturbation includes: Obtaining a local adversarial perturbation based on the segmentation mask and the current global adversarial perturbation; Injecting the local adversarial perturbation into the target image to obtain the current adversarial sample; The method for obtaining the current adversarial sample is: x adv =x⊙ k ⊕(x⊕G θ (x))⊙M k Among them, x adv is an adversarial sample, x is the target image, M k is the key area in the target image, k is the non-critical area in the target image, G θ (x) is the global adversarial perturbation, ⊙ is the Hadamard product, and ⊕ is the pixel-by-pixel addition of the image; S4. Input the current adversarial sample and the target image into the proxy model to obtain the total image loss; Inputting the current adversarial sample and the target image into the proxy model to obtain the total image loss includes: Input the current adversarial sample and the target image into the proxy model to obtain classification labels, texture features, and class activation maps; Texture features are obtained through the LBP operator; According to the classification label, texture feature and class activation map, classification loss, texture loss and class activation loss are obtained respectively; Obtaining the total image loss based on the classification loss, texture loss, and class activation loss; The method for obtaining the classification loss is: in, is the classification loss, J( ) is the cross entropy loss, y is the true label of the target image, and F( ) is the classification model; The method for obtaining the texture loss is: in, is the texture loss, is the texture feature of the adversarial sample, is the texture feature of the target image, ǁ ǁ2 is the norm; The method to obtain the class activation loss is: in, is the class activation loss, is the feature importance of x to y, for The feature importance of y; The method for obtaining the total loss of the image is: in, is the total image loss, is the classification loss, is the texture loss, is the class activation loss, λ CAM and λ LBP All are weight coefficients; S5. Input the total image loss into the generator, and combine it with the target image to obtain a new global adversarial perturbation; The generator maximizes the total loss during training; S6. Return to S3 until the current optimal adversarial sample is obtained.

2. The method for constructing an adversarial sample according to claim 1, wherein: Segmenting the target image to obtain a segmentation mask includes: An image segmentation model is used to identify key areas in the target image, and the target image is segmented by outputting binary segmentation masks of the key areas.

3. The method for constructing an adversarial sample according to claim 1, wherein: Obtaining the current optimal adversarial example includes: When the local adversarial perturbation reaches a preset perturbation size, the current optimal adversarial sample is obtained in combination with the target image.

Images