Regularized logit calibration and truncation feature mixing-based strong mobility directional attack countermeasure algorithm
By introducing regularized logit calibration and truncated feature hybrid strategies into the directional adversarial attack algorithm, the problem of insufficient migration of directed adversarial samples is solved, and higher migration and versatility are achieved, and it is suitable for a variety of white box models.
Patent Information
- Application Number
- CN202411647669.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2025-04-11
AI Technical Summary
In the prior art, the migration of directional adversarial samples is insufficient, especially different logit calibration methods are required for different models, which leads to insufficient universality and it is difficult to effectively utilize clean sample features to improve migration.
A directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing is designed. By building the truncated feature mixing strategy module and regularized logit calibration module, the parameters of the directed adversarial sample are optimized to improve migration.
This algorithm significantly improves the migration of directional adversarial samples, is suitable for a variety of white box models, and is experimentally verified to confirm its effectiveness, which is better than other comparison methods.
Smart Images
Figure CN119808881A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence security technology, and specifically refers to a strong migration directional adversarial attack algorithm based on regularized logit calibration and truncated feature mixing. Background Art
[0002] Deep neural networks have performed well in computer vision tasks such as image classification, object detection, and image segmentation. However, deep neural networks are highly sensitive to adversarial examples, and slight perturbations can cause the model to make incorrect predictions.
[0003] Since adversarial examples pose a significant threat to deep models in practical applications such as speech recognition, face verification, and image classification, studying the vulnerability of adversarial examples has become a hot topic in the field of artificial intelligence security, aiming to provide support for improving the robustness of network models.
[0004] There are many attack methods for generating adversarial samples. These attacks are divided into white-box attacks and black-box attacks. In the former, the attacker knows the model structure and parameters, while in the latter, this information is not available. In real applications, attackers usually cannot obtain information about the target network, so it is necessary to improve the transferability of adversarial samples in order to optimize the generated samples on the known white-box model and attack the unknown black-box model. In addition, according to the misclassification category of the adversarial sample, the attack can be divided into directed and non-directed attacks. Non-directed attacks only need to misclassify the adversarial sample as any incorrect category, while directed attacks require that the adversarial sample be misclassified as a specific category, which faces greater challenges.
[0005] In order to improve the transferability of directed adversarial samples, there are four main methods:
[0006] (1) Attack methods based on optimization: Adversarial samples with weak transferability are prone to fall into the local maximum of the source model, so an optimization method is proposed to improve the transferability of adversarial samples. I-FGSM iteratively adds perturbations in the gradient direction with small steps. MI-FGSM introduces a momentum term based on I-FGSM to accumulate historical update directions to improve mobility. The 2021 Variance Tuning (VT) method adjusts the update direction of the current iteration through neighborhood gradient information. In order to avoid the local optimum caused by the unchanged step size, the 2023 GRA method uses the attenuation indicator to dynamically adjust the step size, and uses dot product attention to calculate the gradient correlation and refine the update direction.
[0007] (2) Data augmentation attack method: This method improves the transferability of adversarial samples by applying data augmentation strategies. The 2019 DI method performs random resizing and padding in each iteration. The 2020 SIM method found that shrinking the input image can maintain loss invariance, and improves transferability by shrinking the input multiple times and averaging the gradient. The 2021 Admix method was inspired by Mixup and adds random image parts to the original image to increase input diversity. The 2022 ODI method improves robustness by projecting the image onto a three-dimensional object, including a frequency domain data augmentation method based on random spectral transformation, combined with Gaussian noise and Hadamard product.
[0008] (3) Loss function-based method: This method aims to propose a new loss function to enhance the mobility of oriented samples and alleviate the gradient saturation problem in traditional cross entropy loss. Currently, there is an introduction of Poincare distance as a similarity measure, which dynamically amplifies the gradient amplitude through triple loss. There is also Logit loss to ensure the gradient consistency of the target category. The logit difference between the target category and the non-target category is increased, but the optimal strategy varies depending on the white box model and has limited practical utility.
[0009] (4) Feature-based methods: This method uses the intermediate features of adversarial samples to improve the transferability of targeted samples. The FDA method improves transferability by training class-specific auxiliary classifiers and using the intermediate feature distribution extracted by convolutional neural networks. The 2023 CFM method effectively simulates competitive noise by randomly mixing stored clean features to improve the transferability of targeted adversarial samples.
[0010] In order to solve the problem of the lack of universality caused by different logit calibration methods for different models and how to more effectively use clean sample features to further improve the transferability of directed adversarial samples, a directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing is urgently needed to generate strong transferable adversarial samples. Summary of the invention
[0011] The technical problem to be solved by the present invention is to solve the lack of universality caused by the need to use different logit calibration methods for different models, and how to more effectively use clean sample features to improve the mobility of targeted adversarial samples. To this end, a targeted adversarial attack algorithm based on regularized logit calibration and truncated feature mixing is designed, starting from two strategies at the loss function and feature level to improve the mobility of targeted attacks.
[0012] To solve the above technical problems, the technical solution provided by the present invention is: a strong transferable directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing, comprising the following steps: S1: constructing a truncated feature mixing strategy module, a regularized logit calibration module, obtaining a data set, a white box model, and optimizing the parameters of the directed adversarial sample; S2: sampling images from the data set, and using clean images to initialize the adversarial sample and the number of iterations; S3: executing the truncated feature mixing strategy module to obtain the output result logit at the last layer; S4: executing the regularized logit calibration module to obtain the regularized cross entropy loss function; S5: iteratively adding perturbations in the gradient direction based on the optimized attack MI-FGSM method to update the adversarial sample; S6: if the number of iterations does not reach the set value, go to step S5, otherwise output the adversarial sample of the last iteration.
[0013] Preferably, the truncated feature mixing strategy module includes removing significant features and performing feature fusion, and the regularized logit calibration module includes outputting a final regularized cross entropy loss function.
[0014] Preferably, the data set is an ImageNet-Compatible data set, and the white box model includes any one of ResNet-50, DenseNet-121, Inception-v3, and ResNet-50.
[0015] Preferably, removing the significant features comprises calculating the original feature map from the convolution layer by passing the clean sample through the white box model, decomposing the features by singular value decomposition, calculating the significant features associated with the maximum singular value, and removing the significant features from the original feature map;
[0016] The feature fusion includes calculating the adversarial sample corresponding to the clean sample, obtaining a feature map from the convolution layer through a white box model, and fusing the adversarial sample and the feature map in the same convolution layer;
[0017] The output result logit includes feature fusion of each convolution layer, the fused features are used as the input of the current layer, and the output result of the current layer propagated forward is used as the input of the next layer, so as to obtain the output result logit of the last layer.
[0018] Preferably, the regularized logit calibration module includes obtaining unprocessed Logit values, increasing the Logit gap between the target category and the non-target category after standardizing the Logit distribution, calculating a calibration factor and applying it to the logit value of each sample, and calculating a regularized cross entropy loss function.
[0019] Preferably, the setting value of the number of iterations is 300.
[0020] Preferably, the images are sampled from the data set, wherein 20 images form a batch.
[0021] Compared with the prior art, the advantages of the present invention are: a regularized logit calibration method is proposed, which generates a directed adversarial sample by comprehensively considering the logit variance of each sample and the logit difference between the target category and other non-target categories, and the method is applicable to a variety of different white box models to perform directed adversarial attacks;
[0022] A truncated feature mixing strategy is proposed, which can provide further improvement for increasing the transferability of targeted attacks by removing the significant features associated with the largest singular value.
[0023] Experiments on data sets have confirmed the effectiveness of the present invention, which is significantly better than other comparative methods. The present invention can also be integrated with various attack benchmark methods to improve the overall directed adversarial attack performance. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] Figure 1 It is a step diagram of the algorithm described in the present invention;
[0025] Figure 2 This is a framework flow chart of the truncated feature hybrid strategy module (TFM) proposed in the present invention.
[0026] Figure 3 It is a schematic diagram of simulation content and results. DETAILED DESCRIPTION
[0027] The present invention is further described in detail below in conjunction with the accompanying drawings.
[0028] Combined with Figure 1-2 As shown in the figure, a regularized logit calibration method is proposed to generate directed adversarial samples by comprehensively considering the logit variance of each sample and the logit difference between the target category and other non-target categories; in addition, truncated feature mixing is further introduced to remove significant features from the original clean features, thereby reducing the influence from the white-box model used for training to some extent, further improving the transferability of directed adversarial samples.
[0029] The specific implementation of the regularized logit calibration module (NCE) includes the following steps:
[0030] S1: Get the logit value z={z1, z2, ..., z} of the adversarial sample x′ after it passes through the last classifier in the white-box model f without being processed by the softmax function. C}, where C is the total number of categories, z i represent
[0031] Output for each class i.
[0032] S2: Since different adversarial samples have different logit distributions, we need to regard the logit distribution of each adversarial sample as a Gaussian distribution to reduce the gap between different adversarial samples. Therefore, we need to calculate the mean and variance μ and σ of z.
[0033] S3: In order to increase the gap between the target category logit and other non-target category logits to improve transferability, it is necessary to calculate the difference z between the target category logit and the logit mean t -μ. During the iteration process, when the adversarial sample is misclassified as the target category, the first logit obtained by sorting z in descending order corresponds to the target category Therefore z t Can be used Alternative.
[0034] S4: Calculate the calibration factor based on the logit variance and the logit gap between the target category and other non-target categories. Where T is the temperature parameter.
[0035] S5: Calculate the calibrated logit value S6: After calibrating the logit of each sample, calculate the final regularized cross entropy loss function
[0036] The truncated feature mixing strategy module mainly includes two steps: removing significant features and feature fusion:
[0037] (1) Remove salient features
[0038] S1: Calculate the clean sample x through the white box model f to get the feature map from the lth layer
[0039] S2: Use singular value decomposition (SVD) to decompose feature X = USV T , where S is the diagonal singular value matrix, U is the left orthogonal singular vector matrix, and V is the right orthogonal singular vector matrix.
[0040] S3: Calculate the significant features associated with the largest singular value s1 S4: Remove salient features from the original feature X
[0041] (2) Feature Fusion
[0042] S1: Calculate the adversarial sample x′ corresponding to the clean sample x and obtain the feature map from the lth layer through the white box model f
[0043] S2: In the same convolutional layer of layer l, X′ and Feature Fusion where α∈R C×1×1 is the channel-level mixing scale factor, ranging from uniform distribution α to U(0,α max ) and satisfy 0≤α max ≤1
[0044] (3) Get the output result logit of the last layer classifier
[0045] S1: The white box model can be described as a series of continuous functions
[0046] S2: Perform feature fusion operation at each convolutional layer The fused features is the current layer f (l) The input of the current layer is the output result of the forward propagation is the input for the next layer.
[0047] S3: Finally, we get the output result logit of the last layer.
[0048] The final optimization to generate directed adversarial samples includes the following steps:
[0049] S1: Get the dataset D, the white-box model f, and other parameters to optimize the directed adversarial samples;
[0050] S2: Sample image x from dataset D
[0051] S3: Initialize the adversarial sample with a clean image and initialize the number of iterations Iter = 0
[0052] S4: Based on steps S2 and S3, the truncated feature mixing strategy module is executed to obtain the output result logit at the last layer
[0053] S5: Based on step S4, execute the regularized logit calibration module to obtain the regularized cross entropy loss function
[0054] S6: Based on step S5, the optimization attack based MI-FGSM method is used to iteratively add perturbations in the gradient direction with small steps to update the adversarial sample.
[0055] S7: Iter = Iter + 1
[0056] S8: If the number of iterations Iter does not reach the set value, go to step S4; otherwise, directly output the adversarial sample.
[0057] Preferably, the anti-attack method of the present invention can also be combined with RDI based on the data augmentation attack method.
[0058] In specific implementation:
[0059] Step S1: Dataset D is a widely used ImageNet-Compatible dataset, in which each image has a corresponding target category t. The white-box model can be ResNet-50, DenseNet-121, Inception-v3, or adversarially trained ResNet-50 (adv-ResNet-50). In addition, other training parameters: the channel-level mixing ratio α in the truncated feature mixing strategy module is randomly sampled from U(0, 0.75), the temperature factor in the regularized logit calibration module is set to T=2, the total number of training iterations is set to 300, and the rest of the settings are the same as the 2023 CFM method settings. In addition, the white-box model can be described as a series of continuous functions The parameters of each layer can be written as W = (w K , w k-1 ,…,w1) Step S2: Sample a batch of clean images x from the dataset with a batch size of 20.
[0060] Step S3: Initialize the adversarial sample x′0=x, and initialize the current number of iterations Iter=0
[0061] Step S4: Start training iterations, perform truncation feature fusion operations at each convolutional layer, first remove the clean sample x at each convolutional layer f (l) The salient features of the sample are obtained, and the truncated features X' are obtained. Then, the truncated features X' are compared with the adversarial sample x'. i Features at the corresponding layer Perform feature fusion Then the fused features is the current layer f (l) The input of the current layer is the output result of the forward propagation is the input of the next layer, and finally the output result of the last layer is z={z1,z2,...,z C Step S5: Based on step S4, execute the regularized logit calibration module to calculate the loss function. First calculate the mean and variance μ, σ of z; calculate the maximum value of z Calculate the calibration factor Calculate the calibrated logit value , and finally get the loss function Step S6: Using the optimization attack MI-FGSM method, iteratively add perturbations in the gradient direction with a small step size β to update the adversarial sample Step S7: Iteration number Iter=Iter+1
[0062] Step S8: If the number of iterations Iter does not reach 300, go to step S4; otherwise, the loop ends and the final adversarial sample x′ is output 300 .
[0063] The effects of the present invention are further described below in conjunction with simulation experiments.
[0064] 1. Simulation experiment conditions:
[0065] The hardware platform of the simulation experiment of the present invention is: 1 GeForce GTX 3090, 20G video memory.
[0066] The Python version used in the simulation experiment of the present invention is Python 3.8.12, and the libraries and corresponding versions used are torch=1.4.0torchvision=0.5.0
[0067] 2. Simulation content and results:
[0068] We use white-box models ResNet-50, DenseNet-121, Inception-v3, or adversarially trained ResNet-50 to generate adversarial samples to attack the white-box models used for training and nine other unknown black-box models. The experimental results are shown in Figure 2. Figure 3 :
[0069] From the results in the table, it can be seen that the truncated feature fusion (TFM) of the present invention consistently outperforms all baseline methods and has a higher success rate on all source models. In addition, compared with CFM-RDI in 2023, which uses stored clean image features for mixing, the truncated feature mixing technology proposed in the present invention shows higher performance. For example, when adv-RN-50 is used as a source model, the average targeted attack success rate is improved from 78.4% to 80.4%.
[0070] The present invention further introduces a regularized logit calibration module (NCE) to obtain the final regularized cross entropy loss, which improves the attack efficiency in these four white-box model entropy experiments. Compared with TFM-RDI, the average targeted attack success rate of TFM-RDI+NCE is increased by 5.2%, 4.6% and 7.5% respectively, corresponding to RN-50, adv-RN-50 and DN-121; but the performance of TFM-RDI+NCE on Inc-v3 is similar to that of TFM-RDI.
[0071] It can be seen that the scheme of the present invention proposes a regularized logit calibration method, which generates a directed adversarial sample by comprehensively considering the logit variance of each sample and the logit difference between the target category and other non-target categories. At the same time, this method is applicable to a variety of different white-box models to perform directed adversarial attacks; further proposed a truncated feature mixing strategy, by removing the significant features related to the maximum singular value, can provide further improvement for increasing the mobility of the directed attack. The present invention has conducted experiments to verify the effectiveness of the scheme, which is significantly better than other comparison methods.
[0072] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.
Claims
1. A strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing, characterized by: The following steps are involved: S1: Construct the truncated feature mixing strategy module, regularized logit calibration module, obtain the data set, white box model, and optimize the parameters of the directed adversarial sample; S2: Sample images from the dataset and use clean images to initialize adversarial samples and the number of iterations; S3: Execute the truncated feature mixing strategy module to obtain the output result logit at the last layer; S4: Execute the regularized logit calibration module to obtain the regularized cross entropy loss function; S5: Based on the optimization attack MI-FGSM method, iteratively add perturbations in the gradient direction to update the adversarial sample; S6: If the number of iterations does not reach the set value, go to step S5, otherwise output the adversarial sample of the last iteration.
2. According to claim 1, a strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing, characterized in that: The truncated feature mixing strategy module includes removing significant features and performing feature fusion, and the regularized logit calibration module includes outputting a final regularized cross entropy loss function.
3. The strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing according to claim 1, characterized in that: The data set is an ImageNet-Compatible data set, and the white box model includes any one of ResNet-50, DenseNet-121, Inception-v3, and ResNet-50.
4. The strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing according to claim 2, characterized in that: The removing of the significant features comprises calculating the original feature map from the convolution layer by passing the clean sample through the white box model, decomposing the features by singular value decomposition, calculating the significant features associated with the maximum singular value, and removing the significant features from the original feature map; The feature fusion includes calculating the adversarial sample corresponding to the clean sample, obtaining a feature map from the convolution layer through a white box model, and fusing the adversarial sample and the feature map in the same convolution layer; The output result logit includes feature fusion of each convolution layer, the fused features are used as the input of the current layer, and the output result of the current layer propagated forward is used as the input of the next layer, so as to obtain the output result logit of the last layer.
5. The strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing according to claim 2, characterized in that: The regularized logit calibration module includes obtaining unprocessed Logit values, increasing the Logit gap between the target category and the non-target category after standardizing the Logit distribution, calculating the calibration factor and applying it to the logit value of each sample, and calculating the regularized cross entropy loss function.
6. The strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing according to claim 1, characterized in that: The setting value of the number of iterations is 300.
7. The strong transferability directed adversarial attack algorithm based on regularized logit calibration and truncated feature mixing according to claim 1, characterized in that: The images are sampled from the dataset, with 20 images forming a batch.