Iterative satellite internet confrontation method based on momentum

Abstract

The invention discloses an iterative satellite internet confrontation method based on momentum, and mainly solves the problem of low success rate of black box migration attack in the existing method. According to the method, a momentum item is introduced in an iterative optimization process of adversarial sample generation and is used for recording a historical direction of gradient updating. According to the momentum iteration method, the gradient updating direction in the adversarial sample generation process can be more stable, meanwhile, the adversarial sample is prevented from falling into a local extreme point of an optimization problem, the mutual restriction of the white box attack effect and the migration capability of the adversarial sample generated by the existing method is effectively relieved, and the black box migration attack success rate is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of black box attacks, and in particular to an iterative satellite Internet countermeasure method based on momentum. Background Art

[0002] Deep learning models can be easily deceived by adversarial samples maliciously constructed by attackers. Many adversarial attack methods can generate adversarial samples based on the model structure and parameters. These methods can be roughly divided into three categories: methods based on single-step gradient updates, methods based on multi-step gradient iterations, and methods based on optimization. Specifically, the method based on single-step gradient updates generates adversarial samples by calculating the gradient once, and its typical example is the Fast Gradient Sign Method (FGSM); the method based on multi-step gradient iteration generates adversarial samples by calculating multiple gradient iterations, and its typical example is the basic iteration method; the optimization-based method directly solves the unconstrained optimization problem to generate adversarial samples, and its typical example is the method proposed by Carlini and Wagner. These adversarial attack methods all need to calculate the gradient of the attack target function with respect to the input data in the process of generating adversarial samples, so they are called white-box attacks.

[0003] Adversarial samples also have an important feature called transferability, that is, adversarial samples generated for one model can also successfully deceive other models. In this way, attackers can generate adversarial samples for locally constructed alternative models to deceive black-box models without obtaining the structure and parameter information of the black-box model, making black-box attacks possible. In practical applications, it is difficult for attackers to obtain information about the model, so black-box attacks are more realistic than white-box attacks and will also pose a more serious security threat to the practical application of deep learning. The reason why adversarial samples have transferability is that different deep learning models will learn similar decision boundaries during the training process due to the similarity of structure and training data, which makes it possible for adversarial samples generated for one of the models to successfully deceive the remaining models.

[0004] Despite this, the success rate of black-box transfer attacks of existing adversarial attack methods is low, especially when the black-box model has a certain defense mechanism, the black-box model cannot be effectively broken. In order to successfully break the black-box model, the adversarial sample needs to meet two conditions at the same time: one is that the adversarial sample can successfully deceive the white-box model adopted; the second is that the adversarial sample can successfully break the black-box model based on the transfer ability. Although the transfer ability of adversarial samples generated by the single-step gradient update method is very strong, its attack success rate on the white-box model is low. The existing methods based on multi-step gradient iteration and optimization have good white-box attack effects on adversarial samples, but their transfer ability is poor. In summary, the white-box attack effect of adversarial samples generated by existing attack methods and their transfer ability are mutually constrained, resulting in the problem of low success rate of black-box transfer attacks in these methods. Summary of the invention

[0005] The purpose of the present invention is to provide an iterative satellite Internet countermeasure method based on momentum, which mainly solves the problem of low success rate of black box migration attack in existing methods.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is as follows:

[0007] A momentum-based iterative satellite Internet countermeasure method comprises the following steps:

[0008] S1, input satisfies ||x * -x|| ∞ Adversarial examples x with ≤ε * , where ε is the perturbation scale, x is the original sample, || || ∞ is the infinite norm of the matrix;

[0009] S2, will Input classifier f and calculate the gradient of the model loss function with respect to the input In the formula, J is the loss function, and y is the true category corresponding to the input data x;

[0010] S3, according to the formula:

[0011]

[0012] Update the accumulated gradient direction; where μ represents the momentum decay coefficient; || ||1 represents the 1-norm of the matrix, g t Represents the direction of the accumulated gradient in the tth round of iteration;

[0013] S4, in each iteration, uses the formula:

[0014]

[0015] Update the sign of the adversarial sample to achieve momentum iterative adversarial attack; where, T is the number of iterations.

[0016] Furthermore, the present invention also includes fusing the logits layers of different models between step S1 and step S2; wherein the expression of the fusion of the logits layers is:

[0017]

[0018] In the formula, represents the logits layer output of the kth model, ω k Represents the weight of the k-th model; then the softmax function is used to Convert to And through the formula:

[0019] J(f(x),y):=-logf(x)y

[0020] Calculating Losses

[0021] Furthermore, in the present invention, in the expression of logits layer fusion, ω k Satisfaction: k ≥0 and

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] (1) The present invention introduces a momentum term in the iterative optimization process of adversarial sample generation to record the historical direction of gradient updates. The momentum iteration method can make the gradient update direction in the adversarial sample generation process more stable, while preventing the adversarial sample from falling into the local extreme point of the optimization problem, effectively alleviating the mutual restriction between the white-box attack effect of the adversarial sample generated by the existing method and its migration ability, and improving the success rate of the black-box migration attack.

[0024] (2) The present invention further proposes a strategy for fusing multiple model logits layers. On the ImageNet dataset, the attack results of multiple normal training and ensemble adversarial training models verify the effectiveness of the momentum iteration method. Compared with existing attack methods, the momentum iteration method increases the success rate of black-box transfer attacks by about one-fold. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is the cosine similarity of the gradient update direction when the Inc-v3 model is attacked using BIM and MIM in Example 1 of the present invention.

[0026] Figure 2The attack success rate of the adversarial samples generated by Example 1 of the present invention under different values ​​of the momentum attenuation coefficient μ on Inc-v3, Inc-v4, IncRes-v2 and Res-152

[0027] Figure 3 It is the attack success rate of the adversarial samples generated in Example 1 of the present invention with different numbers of iterations on Inc-v3, Inc-v4, IncRes-v2 and Res-152.

[0028] Figure 4 It is the attack success rate of the adversarial samples generated in Example 1 of the present invention under different perturbation scales on the white-box Inc-v3 model and the black-box Res-152 model. DETAILED DESCRIPTION

[0029] The present invention is further described below in conjunction with the accompanying drawings and embodiments. The embodiments of the present invention include but are not limited to the following embodiments.

[0030] Example 1

[0031] The invention discloses an iterative satellite Internet countermeasure method based on momentum, comprising the following steps:

[0032] S1, input satisfies ||x * -x|| ∞ Adversarial examples x with ≤ε * , where ε is the perturbation scale, x is the original sample, || || ∞ is the infinite norm of the matrix;

[0033] S2, will Input classifier f and calculate the gradient of the model loss function with respect to the input In the formula, J is the loss function, and y is the true category corresponding to the input data x;

[0034] S3, according to the formula:

[0035]

[0036] Update the accumulated gradient direction; where μ represents the momentum decay coefficient; || ||1 represents the 1-norm of the matrix, g t Represents the direction of the accumulated gradient in the tth round of iteration;

[0037] S4, in each iteration, uses the formula:

[0038]

[0039] Update the sign of the adversarial sample to achieve momentum iterative adversarial attack; where, T is the number of iterations.

[0040] This example conducts experiments on the ImageNet image classification dataset and demonstrates the effectiveness of the momentum iteration method compared to existing attack methods.

[0041] For the target model being attacked, this section selects seven models pre-trained on the ImageNet data set for experiments. Four of the models are models obtained by normal training, including Inceptionv3 (denoted as Inc-v3), Inceptionv4 (denoted as Inc-v4), InceptionResNetv2 (denoted as IncRes-v2) and ResNetv2152 (denoted as Res-152). The other three models are models obtained by ensemble adversarial training, denoted as Inc-v3ens3, Inc-v3ens4 and IncRes-v2ens respectively. These models are very typical and well-performing models in the ImageNet image classification task, and are provided by the TensorFlow algorithm library, so the experiment of this embodiment is representative.

[0042] For the selection of test data, this section randomly selects one picture from each of the 1000 predicted categories in the ImageNet validation set, forming a data set containing 1000 pictures, and these pictures can be correctly classified by the seven image classification models studied. The reason for this setting is that if the original picture cannot be correctly classified by the model, the untargeted attack can directly use the original picture to achieve the attack target, and its effect will lose its meaning.

[0043] Table 1 shows the attack success rates of different attack methods against seven target models. Among them, adversarial samples are generated by FGSM, BIM and MIM attack methods for Inc-v3, Inc-v4, IncRes-v2 and Res-152 respectively. The attack success rate is the classification error rate calculated when the corresponding model takes the adversarial sample as input data. In all experiments, the maximum perturbation scale is set to ε = 16, and the image pixel value range is [0,255]. The number of iterations of BIM and MIM is set to T = 10. The momentum decay coefficient of MIM is set to μ = 1.0. The results marked with * in Table 1 represent the white-box attack success rate, and the rest are the black-box migration attack success rates.

[0044] Table 1 Comparison of the success rate (%) of untargeted attacks on a single model by different attack methods under the restriction of l∞ norm

[0045]

[0046] The following conclusions can be drawn from the results shown in Table 1. First, the white-box attack effect of MIM is similar to that of BIM, and both can achieve an attack success rate close to 100%. Second, compared with FGSM, BIM reduces the success rate of black-box migration attacks. However, by adding the momentum term, the black-box migration attack success rate of MIM is significantly higher than that of FGSM and BIM. In most cases, the black-box migration attack success rate of MIM is more than twice that of BIM, which verifies the effectiveness of the proposed method.

[0047] It is worth noting that although MIM greatly improves the success rate of black-box migration attacks, the success rate of attacks on models obtained by integrated adversarial training is still very low. For example, the success rate of black-box migration attacks on IncRes-v2ens under different conditions is less than 16%. To address this problem, Example 2 shows that adversarial attacks that fuse multiple models can further improve the success rate of black-box migration attacks on integrated adversarial training models. The following will analyze the differences between MIM and BIM through comparative experiments to further explain why MIM performs better in black-box migration attacks.

[0048] In order to explain why MIM has better black box migration attack capabilities than BIM, this section analyzes the gradient update directions of these two attack methods during the iteration process. Specifically, the experiment calculates the cosine similarity of the gradient update directions of different methods in two adjacent iterations. Figure 1 The cosine similarity of the gradient update direction when attacking the Inc-v3 model using BIM and MIM is shown. It can be seen that the gradient update direction of MIM shows a higher cosine similarity. Therefore, MIM updates the direction more smoothly than BIM during the multi-step gradient iteration process of generating adversarial samples, which also confirms the advantage of momentum method in the optimization process.

[0049] The transferability of adversarial samples comes from the fact that different deep learning models have learned similar decision boundaries in the input space. Although the decision boundaries of different models have certain similarities, due to the nonlinear structure of deep neural networks, it is difficult for the decision boundaries of different models to be exactly the same. Some models may have some abnormal decision areas in the input space. Similar abnormal areas may not exist or exist in different locations in other models. These areas correspond to poor local extreme points in the optimization problem, so BIM can easily fall into these areas, resulting in poor transferability of the generated adversarial samples. On the other hand, through Figure 1It can be observed that MIM obtains a smoother gradient update direction, which helps MIM get rid of these abnormal areas, so that the generated adversarial samples have better migration ability. In addition, the smooth update direction will increase the l2 norm of the perturbation, which may make the adversarial samples have better migration ability, which is also an explanation for the better performance of MIM than BIM.

[0050] For the appropriate value of the momentum decay coefficient μ. The experiment uses MIM to attack the Inc-v3 model, and sets the maximum perturbation scale to ε = 16 and the number of iterations to T = 10. The momentum decay coefficient is set to a range of [0.0, 2.0], and the granularity of the change is 0.1. Figure 2 The attack success rates of adversarial samples generated under different values ​​of momentum decay coefficient μ on Inc-v3, Inc-v4, IncRes-v2 and Res-152 are shown. For black-box models, the attack success rate usually reaches the maximum value around μ = 1.0. When μ = 1.0, another understanding of gt in the formula is that it simply adds all the gradients in the previous iteration to update the adversarial sample.

[0051] The number of iterations also has an important impact on the attack results in the adversarial attack, which is further analyzed in this embodiment. The experiment uses the BIM and MIM attack methods to attack the Inc-v3 model, where the parameters are set to ε=16 and μ=1.0. The number of iterations is set to 1 to 10. Figure 3 The attack success rates of adversarial samples generated with different numbers of iterations on Inc-v3, Inc-v4, IncRes-v2, and Res-152 are shown.

[0052] from Figure 3 As can be seen in the figure, the success rate of BIM's migration attack on the black-box model gradually decreases with the number of iterations, while the success rate of MIM's black-box migration attack does not decrease significantly with the number of iterations. This result verifies that the adversarial samples generated by BIM can easily "overfit" the white-box model and show poor migration ability. However, MIM helps to reduce the mutual constraints between the white-box attack effect and the migration ability, thereby showing a stronger attack capability against white-box and black-box models.

[0053] Finally, this embodiment counteracts the influence of disturbance scale ε on the attack success rate. The experiment uses FGSM, BIM and MIM to attack the Inc-v3 model, where the disturbance scale ε is set to increase from 1 to 40. The step size α of BIM and MIM is set to 1, so the number of iterations changes linearly with the disturbance scale ε. The momentum attenuation coefficient of MIM is set to μ = 1.0. Figure 4 The attack success rate of adversarial samples generated with different perturbation scales on the white-box Inc-v3 model and the black-box Res-152 model is shown.

[0054] For white-box attacks, the two methods based on multi-step gradient iterations, BIM and MIM, can quickly reach a 100% attack success rate. However, when the perturbation scale is large, the white-box attack success rate of FGSM based on single-step gradient update will decrease. The main reason for this phenomenon is that when the perturbation scale is large, the assumption that the model loss function is linear in FGSM no longer holds. For black-box migration attacks, although the attack success rates of these three methods gradually increase with the perturbation scale, the black-box migration attack success rate of MIM increases faster. In other words, in order to achieve the same migration attack success rate for the black-box model, MIM can use a smaller perturbation scale, so that the generated adversarial samples are more difficult to distinguish.

[0055] Example 2

[0056] In actual scenarios, attackers can often attack multiple white-box models at the same time to increase the success rate of black-box transfer attacks. The reason behind this method is that in order to deceive multiple white-box models at the same time, adversarial samples will find and use perturbations that are generally effective for these models. This perturbation is likely to deceive unknown black-box models, achieving better black-box transfer attack results.

[0057] Therefore, different model fusion strategies can be used to attack multiple white box models at the same time. That is, based on Example 1, between step S1 and step S2, the logits layers of different models are fused; wherein the expression of logits layer fusion is:

[0058]

[0059] In the formula, represents the logits layer output of the kth model, ω k represents the weight of the k-th model; ω k Satisfaction: k ≥0 and Then use the softmax function to Convert to And through the formula:

[0060] J(f(x),y):=-logf(x)y

[0061] Calculating Losses

[0062] Based on this fusion strategy, the attacker can use the fused model It is regarded as an integrated white box model and attacked using the adversarial attack algorithm. In addition to the strategy of fusing multiple model logits layers, this embodiment also introduces two other model fusion strategies for comparison. One is to fuse the predicted probability distribution of K models, as shown below:

[0063]

[0064] where f k (x) represents the predicted probability distribution of the kth model for the input data x. The second is to fuse the loss functions of the K models, as shown below:

[0065]

[0066] Since the above three strategies select different positions when fusing multiple models, there will be great differences in the attack effects.

[0067] Different strategies for fusing multiple models in adversarial attacks. Inc-v3, Inc-v4, IncRes-v2, and Res-152 were selected as target models in the experiment. One of the four models was selected as a black-box model in each group of experiments, and the remaining three models were attacked as white-box models. For example, "-Inc-v3" means that Inc-v4, IncRes-v2, and Res-152 were selected as white-box models, and Inc-v3 was used as a black-box model. The strategies for fusing the three white-box models include fusing the logits layer, fusing the predicted probability distribution, and fusing the loss function. The fusion weights of the three models are all set to 1 / 3. The experiment also uses three attack methods, FGSM, BIM, and MIM, for attack. The perturbation scale is set to ε=16, the number of iterations of BIM and MIM is set to T=10, and the momentum decay coefficient in MIM is set to μ=1.0.

[0068] Table 2 shows the success rate of untargeted attacks on multiple models by different attack methods. In each set of experiments, the table reports the attack success rates for white-box models and black-box models respectively. It can be seen that in the white-box and black-box migration attack scenarios, the strategy of fusing the logits layer has better attack effects and achieves higher attack success rates than the strategies of fusing the predicted probability distribution and fusing the loss function. Such experimental phenomena are common in various attack methods. It can also be observed from Table 2 that the adversarial samples generated by MIM have very strong migration capabilities, showing a strong black-box migration attack effect. For example, by fusing the three models Inc-v4, IncRes-v2 and Res-152 and attacking them using MIM, the generated adversarial samples can achieve a migration attack success rate of 87.9% on the black-box Inc-v3 model, verifying the vulnerability of normally trained deep neural networks under black-box migration attacks.

[0069] Table 2 Comparison of the success rate (%) of untargeted attacks on multiple models by different attack methods under the restriction of l∞ norm

[0070]

[0071] This embodiment further conducts adversarial attack experiments on integrated adversarial training models with defense mechanisms. The experiment selects all seven image classification models. In order to perform black-box migration attacks on each integrated adversarial training model, the remaining six models are selected as white-box models. The strategy for fusing the white-box model is to fuse the logits layer, where the weights of different white-box models are all 1 / 6. The perturbation scale is set to ε=16, the number of iterations of BIM and MIM is set to T=20, and the momentum decay coefficient in MIM is set to μ=1.0. Table 3 shows the attack success rates of white-box models and black-box models. It can be seen that under stronger attack methods, the defense mechanism of integrated adversarial training cannot effectively defend against black-box migration attacks. For example, using MIM to attack multiple white-box models, the generated adversarial samples can achieve a migration attack success rate of more than 40% for the black-box Inc-v3ens4 model, verifying the vulnerability of the defense mechanism of integrated adversarial training under black-box migration attacks.

[0072] Table 3 Comparison of the success rate (%) of untargeted attacks of different attack methods against the integrated adversarial training model under the restriction of l∞ norm

[0073]

[0074] This example also shows the results of the momentum iteration method in other attack scenarios. Based on previous experimental analysis, the effect of attacking multiple models is significantly better than that of attacking a single model, so the experiment in this example only includes the results of attacking multiple models in different scenarios.

[0075] The experiment first considers untargeted attacks under the l2 norm restriction. Since the l2 distance is related to the dimension of the sample, the scale of the adversarial perturbation is set to Where D represents the dimension of the adversarial perturbation, and D is also the dimension of the model input image. The experiment selects seven models, Inc-v3, Inc-v4, IncRes-v2, Res-152, Inc-v3ens3, Inc-v3ens4 and IncRes-v2ens, as target models. In each group of experiments, one of the models is selected as the black-box model, and the remaining six models are attacked as white-box models. The experiment adopts the strategy of fusing the logits layer of the six models, where the fusion weights of different models are 1 / 6. Table 4 shows the success rate of black-box migration attacks on different models using three attack methods: FGM, BIM and MIM. Similar to the attack results under the l∞ norm restriction, MIM can significantly improve the success rate of black-box migration attacks on different models, verifying the effectiveness of the proposed method. At the same time, MIM can achieve a black-box migration attack success rate of about 60% for the integrated adversarial training model, which also illustrates the lack of robustness of integrated adversarial training under l2 norm perturbations.

[0076] Table 4 Comparison of the success rate (%) of non-targeted attacks of different attack methods under the restriction of l2 norm

[0077] Attack Methods Inc-v3 Inc-v4 IncRes-v3 Res-152 <![CDATA[Inc-v3 ens3 ]]> <![CDATA[Inc-v3 ens4 ]]> <![CDATA[IncRes-v2 ens ]]> FGM 52.7 49.3 50.4 46.6 35.4 37.5 32.4 BIM 65.3 56.7 54.3 44.7 29.5 36.4 19.9 MIM 89.7 88.0 86.1 81.4 59.8 66.5 56.4

[0078] Targeted attacks require the model to misclassify adversarial samples into specified target categories, so they are more difficult than untargeted attacks. In particular, for the ImageNet image classification task, which contains a total of 1,000 prediction categories, it is difficult for targeted attacks to successfully deceive the target model in a black-box scenario. This section further verifies the effectiveness of the momentum iteration method in a targeted attack scenario. Similar to the previous experimental settings, the targeted attack experiment still selects all seven models as target models, and uses the strategy of fusing the logits layer to attack six of the models, thereby evaluating the attack success rate of the generated adversarial samples on the black-box model. In a targeted attack scenario, the attack success rate is the proportion of adversarial samples that the target model misclassifies into specified target categories. The attack target category of each image is selected by random sampling. Under the limit of the l∞ norm, the perturbation scale is set to ε=48. Under the limit of the l2 norm, the perturbation scale is set to Where D still represents the dimension of the adversarial perturbation. The number of iterations of BIM and MIM is set to T = 20. The momentum decay coefficient in MIM is set to μ = 1.0.

[0079] Table 5 shows the success rate of black-box transfer attacks for targeted attacks on different models by the three attack methods FGSM, BIM and MIM under the restriction of l∞ norm. Similarly, Table 6 shows the success rate of black-box transfer attacks for targeted attacks on different models by the three attack methods FGM, BIM and MIM under the restriction of l2 norm. From the experimental results, it can be found that the FGSM or FGM methods based on single-step gradient update are difficult to break the black-box model in a targeted attack scenario, and their black-box transfer attack success rate is less than 1%. MIM can improve the success rate of black-box transfer attacks in this scenario, but its success rate is still very low compared to untargeted attacks. Especially for the integrated adversarial training model, the success rate of targeted black-box transfer attacks is no more than 2%. Therefore, how to improve the success rate of black-box transfer attacks in targeted attacks is still a challenging research problem.

[0080] Table 5 Comparison of targeted attack success rates (%) of different attack methods under the restriction of l∞ norm

[0081] Attack Methods Inc-v3 Inc-v4 IncRes-v3 Res-152 <![CDATA[Inc-v3 ens3 ]]> <![CDATA[Inc-v3 ens4 ]]> <![CDATA[IncRes-v2 ens ]]> FGSM 0.5 0.4 0.2 0.5 0.1 0.1 0.1 BIM 9.0 7.0 7.3 3.3 0.4 0.1 0.1 MIM 17.6 15.6 16.1 11.4 0.5 0.9 0.2

[0082] Table 6 Comparison of targeted attack success rates (%) of different attack methods under the restriction of l2 norm

[0083] Attack Methods Inc-v3 Inc-v4 IncRes-v3 Res-152 <![CDATA[Inc-v3 ens3 ]]> <![CDATA[Inc-v3 ens4 ]]> <![CDATA[IncRes-v2 ens ]]> FGM 0.4 0.5 0.7 0.4 0.2 0.2 0.4 BIM 17.8 15.2 16.4 9.2 0.7 1.7 0.5 MIM 21.0 21.8 21.7 17.4 1.6 2.0 1.9

[0084] The above embodiment is only one of the preferred implementation modes of the present invention and should not be used to limit the protection scope of the present invention. Any changes or modifications that are made to the main design concept and spirit of the present invention and have no substantive significance, and the technical problems they solve are still consistent with the present invention, should be included in the protection scope of the present invention.

Claims

1. A momentum-based iterative satellite Internet countermeasure method, characterized in that: The following steps are involved: S1, input satisfies ||x * -x|| ∞ Adversarial examples x with ≤ε * , where ε is the perturbation scale, x is the original sample, || || ∞ is the infinite norm of the matrix; S2, will Input classifier f and calculate the gradient of the model loss function with respect to the input In the formula, J is the loss function, and y is the true category corresponding to the input data x; S3, according to the formula: Update the accumulated gradient direction; where μ represents the momentum decay coefficient; || ||1 represents the 1-norm of the matrix, g t Represents the direction of the accumulated gradient in the tth round of iteration; S4, in each iteration, uses the formula: Update the sign of the adversarial sample to achieve momentum iterative adversarial attack; where, T is the number of iterations.

2. The momentum-based iterative satellite Internet countermeasure method according to claim 1, characterized in that: It also includes fusing the logits layers of different models between step S1 and step S2; wherein the expression of the fusion of the logits layers is: In the formula, represents the logits layer output of the kth model, ω k Represents the weight of the k-th model; then the softmax function is used to Convert to And through the formula: J(f(x),y):=-logf(x)y Calculating Losses 3. The momentum-based iterative satellite Internet countermeasure method according to claim 2, characterized in that: In the expression of logits layer fusion, ω k Satisfaction: k ≥0 and

Images