Adversarial sample generation method, system, device and medium based on attention disturbance

Abstract

The present invention provides a method, system, device and medium for generating adversarial samples based on attention disturbance, which belongs to the field of artificial intelligence technology. The method comprises the following steps: inputting an input sample into a deep learning model to obtain a class activation map matrix of the output result; dividing the class activation map matrix into a plurality of square subgraphs, and sorting them according to the size of the sum of their element values, swapping the positions of the square subgraphs with larger and smaller sums of element values to obtain an attention disturbance class activation map matrix; t The input samples of the first round are corrected, and the corrected input samples are fused with the class activation map matrix of the attention disturbance to obtain the enhanced samples; the enhanced samples are subjected to adversarial perturbation calculation to generate adversarial samples; the generation and segmentation process of the class activation map matrix and the adversarial sample generation process are repeated until T rounds of adversarial sample generation are completed to obtain the final adversarial sample. The present invention can improve the transferability of adversarial samples to different depth models.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and specifically relates to a method, system, device and medium for generating adversarial samples based on attention disturbance. Background Art

[0002] In recent years, deep learning models have achieved remarkable results in fields such as computer vision and natural language processing. However, research has shown that deep learning models are vulnerable to adversarial attacks. Deep learning models exhibit vulnerability to adversarial attacks, posing serious security risks in real-world applications. By using adversarial example generation algorithms to conduct adversarial attacks on deep learning models, we can identify risk points and provide a basis for strengthening the robustness of deep learning models.

[0003] Transfer attacks leverage the transferability of adversarial examples to launch black-box attacks against deep learning models. Due to their flexibility, they have become a common black-box attack method. Input transformation, a common method for improving the transferability of adversarial examples, enriches the search space for adversarial perturbations by increasing data diversity, thereby improving the transferability of adversarial examples. However, existing input transformation methods ignore the differences in how deep learning models focus on different regions of the input data. They often enhance the data by randomly flipping, patching, and merging input samples. This makes it difficult for adversarial examples generated by existing input transformation methods to be effectively transferred to robust deep learning models. Summary of the Invention

[0004] In order to overcome the shortcomings of the above-mentioned prior art, the present invention provides an adversarial sample generation method based on attention perturbation, comprising the following steps:

[0005] Get the t Input samples of the round;

[0006] The first t Input the input samples of the round into the deep learning model, obtain the output results of the deep learning model, and use the neural network visualization method to calculate the class activation map matrix of the output results;

[0007] Mask the class activation map matrix, and perform the masked class activation map on the first t The input samples of the round are corrected;

[0008] The class activation map matrix is divided into multiple square subgraphs with a side length of s. The multiple square subgraphs are sorted according to the size of the sum of their element values, and some square subgraphs are randomly extracted in proportion. Among the extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest sum of element values is swapped with the square subgraph with the second smallest sum of element values. This process is repeated until all the extracted square subgraphs are swapped to obtain the class activation map matrix with disturbed attention.

[0009] The attention-perturbed class activation map matrix is fused with the modified sample enhancement to obtain the enhanced sample; the enhanced sample is subjected to adversarial perturbation calculation to generate the first t Round of adversarial examples;

[0010] The generated t The adversarial sample of the first round is t +1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process is performed until T rounds of adversarial sample generation process are completed to obtain the final adversarial sample.

[0011] Preferably, the class activation map matrix is divided into multiple square subgraphs with a side length of s, specifically: when the side length of the class activation map matrix is divisible by s, the entire class activation map matrix is divided into multiple square subgraphs with a side length of s; when the side length of the class activation map matrix is not divisible by s, the central area of the class activation map matrix that is divisible by s is divided into multiple square subgraphs with a side length of s, and the peripheral area of the class activation map matrix remains unchanged.

[0012] Preferably, the class activation map matrix is masked, and the masked class activation map matrix is used to t The input samples of the first round are corrected, specifically: the element values in the class activation map matrix that are greater than their q quantiles are set to 0, and the remaining elements are set to -1, and the set element values are multiplied by the dot product with the class activation map matrix, and the areas in the class activation map matrix that have a key impact on the output results of the deep learning model are masked to obtain the masked class activation map matrix; based on the masked class activation map matrix and the first t -1 round of momentum gradient is used to correct the input sample.

[0013] Preferably, the enhanced sample is subjected to anti-disturbance calculation to generate the first t The adversarial examples of the round include the following steps:

[0014] Set different extraction ratios , according to different extraction ratios Performing different degrees of enhancement on the corrected samples to obtain an enhanced picture set;

[0015] The pixel values of each image in the enhanced image set are scaled according to different proportions to obtain multiple scaled images. The adversarial perturbation is calculated based on the average gradient information of the scaled images to generate the first t Round of adversarial examples.

[0016] The present invention also provides an adversarial sample generation system based on attention perturbation, comprising:

[0017] Data acquisition module, used to obtain the t Input samples of the round;

[0018] The class activation map matrix acquisition module is used to t Input the input samples of the round into the deep learning model, obtain the output results of the deep learning model, and use the neural network visualization method to calculate the class activation map matrix of the output results;

[0019] The correction module is used to mask the class activation map matrix and correct the t The input samples of the round are corrected;

[0020] The attention perturbation module is used to divide the class activation map matrix into multiple square subgraphs with a side length of s; the multiple square subgraphs are sorted according to the size of the sum of their element values, and some square subgraphs are randomly extracted according to a proportion. Among the extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest sum of element values is swapped with the square subgraph with the second smallest sum of element values. And so on, the positions of all the extracted square subgraphs are swapped to obtain the attention perturbed class activation map matrix;

[0021] The sample enhancement module is used to fuse the attention-perturbed class activation map matrix with the corrected sample enhancement to obtain the enhanced sample; the enhanced sample is subjected to adversarial perturbation calculation to generate the first t Round of adversarial examples;

[0022] The sample generation module is used to generate t The adversarial sample of the first round is t +1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process is performed until T rounds of adversarial sample generation process are completed to obtain the final adversarial sample.

[0023] The present invention also provides a computer device, comprising a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the attention perturbation-based adversarial sample generation method.

[0024] The present invention also provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for loading by a processor to execute the attention perturbation-based adversarial sample generation method.

[0025] The adversarial sample generation method based on attention perturbation provided by the present invention has the following beneficial effects:

[0026] The present invention can evaluate the degree of attention paid by the deep learning model to different pixels in the input sample by obtaining the class activation map matrix of the output result of the deep learning model; by dividing the class activation map matrix into multiple square sub-graphs with a side length of s; by sorting the multiple square sub-graphs according to the size of the sum of their element values, the area with a larger sum of element values is the area (attention area) that the deep learning model pays more attention to, and by swapping the square sub-graphs with a larger sum of element values with the square sub-graphs with a smaller sum of element values according to the extraction ratio, the attention-disturbed class activation map matrix can be obtained; by fusing the corrected sample with the attention-disturbed class activation map matrix, an enhanced sample can be obtained. This process can perform differentiated data enhancement on different attention areas of the input sample; by performing adversarial perturbation calculation on the enhanced sample, an adversarial sample can be generated.

[0027] In the process of adversarial sample generation, the method of the present invention can add targeted perturbations to the attention area of the deep learning model for the input sample, thereby improving the transferability of the generated adversarial samples to different types of deep learning models. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] To more clearly illustrate the embodiments of the present invention and its design, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive effort.

[0029] Figure 1 Flowchart of a method for generating adversarial samples based on attention perturbation according to an embodiment of the present invention;

[0030] Figure 2 Schematic diagram of the principle of adversarial sample generation method based on attention perturbation;

[0031] Figure 3 Schematic diagram of the principle of data augmentation. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the technical solution of the present invention and to be able to implement it, the present invention is described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention and are not intended to limit the scope of protection of the present invention.

[0033] Example 1

[0034] The present invention provides an adversarial sample generation method based on attention perturbation. The method first uses a deep neural network visualization method to calculate the class activation map matrix, thereby evaluating the degree of attention of the deep learning model to different pixels in the input sample; then, the area in the class activation map matrix that has a greater impact on the model output result is masked, and the input sample is corrected in combination with historical gradient information; thereafter, data enhancement is performed by swapping the areas with a greater and lesser impact on the model output result of the class activation map matrix and fusing them with the corrected data; subsequently, the enhanced image is copied multiple times, and the pixel values of each copy are scaled according to different proportions; finally, the adversarial perturbation is calculated based on the average gradient information of the scaled image, thereby generating an adversarial sample. The present invention improves the transferability of the generated adversarial samples by the angle of the deep learning model's attention area for the input sample, and has the characteristics of good cross-model migration effect.

[0035] The flow chart and principle diagram of the adversarial sample generation method based on attention disturbance of the present invention are as follows: Figure 1 and Figure 2 As shown, the specific implementation process is as follows:

[0036] S1: Parameter initialization.

[0037] Based on the original image with a shape of 299×299×3 First, initialize the perturbation step size in the adversarial sample generation process , the momentum gradient in the first round of generation , input sample , where the perturbation step size is is a fixed constant, is the maximum disturbance amplitude, set to , The number of generation rounds is set to 10.

[0038] S2: Model attention area mining.

[0039] Get the t The input sample of the round tInput samples of the round are input into the deep learning model, and the output results of the deep learning model are obtained. The deep learning model is used to calculate the output results of the input samples using related neural network visualization methods such as Grad-CAM. The output of y The class activation map matrix , specifically through the following formula:

[0040] ;

[0041] Where, is the output matrix of the last convolutional layer of the deep learning model; for The number of channels; Relu is the activation function; H is the interpolation function used to map the class activation map matrix to the input sample Same shape; is the fusion coefficient, which is calculated as follows:

[0042] ;

[0043] Where, Z for The product of the length and width of for of The value of the element at position; is the output of the deep learning model.

[0044] S3: Attention-driven data correction.

[0045] First, the class activation matrix The middle is greater than its The element values of the quantiles are all set to 0, and the rest are set to -1, and compared with Perform dot product multiplication to mask some areas in the class activation map matrix that have a greater impact on the model prediction results, and obtain the masked class activation map matrix , as follows:

[0046] ;

[0047] Where, is the masked class activation map matrix; is the class activation map matrix; is the class activation matrix Quantile; is a symbolic function.

[0048] Then, combine the masked class activation map matrix and the momentum gradient in the previous round For input samples Correction is obtained , as follows:

[0049] ;

[0050] Where, is the perturbation step length; For the t Input samples of the round; is the masked class activation map matrix; For the t -1 round momentum gradient, in addition, if the current round is round 1, then Initialize parameters for momentum gradient .

[0051] S4: Data augmentation based on attention perturbation.

[0052] First, the class activation matrix Divide into square subgraphs with side length s, if If the side length is divisible by s, the entire class activation map matrix is split, otherwise only The middle area is divisible by s, and the outer area remains unchanged. Specifically, Figure 3 As shown, the class activation map matrix Center 275 The 275-pixel area is divided into square sub-images with a side length of s = 55 pixels, resulting in a total of 5 × 5 = 25 square sub-images, and the outer area remains unchanged.

[0053] Then, sort the square subgraphs according to the sum of their element values. The square subgraph with the larger sum of its element values is the one that the deep learning model can use for the input sample. For the area of more concern, some square subgraphs are randomly extracted according to the proportion. Among the extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest element value is swapped with the square subgraph with the second smallest element value. Specifically, the present invention has a total of 25 square subgraphs, and the ratio is set to 0.5. Then 14 square subgraphs are extracted from the 25 square subgraphs. For the 14 extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest element value is swapped with the second smallest square subgraph. And so on, the positions of all the extracted square subgraphs are swapped, thereby obtaining the class activation map matrix of attention disturbance. , and then the class activation map matrix of the attention perturbation With the corrected sample Fusion, to obtain enhanced data, is calculated as follows:

[0054] ;

[0055] Where, For the enhanced data; is the corrected sample; is the fusion coefficient, ; is random noise that obeys the normal distribution; in addition, since the class activation map matrix is a single-channel grayscale image, in order to enrich the diversity of data enhancement results, the present invention introduces the amplitude in the results Random noise between ,in, is the maximum perturbation size of the adversarial sample.

[0056] In order to disrupt the deep learning model's attention area for the input sample to the greatest extent, the present invention sets different extraction ratios ,right Perform different degrees of enhancement to obtain enhanced picture sets , which is expressed as follows:

[0057] ;

[0058] ;

[0059] Where, =1,2, 10; For different extraction ratios; is the enhanced data obtained at different extraction ratios; For the enhanced picture collection, the capacity of the picture collection .

[0060] S5: Data scaling.

[0061] In order to further enhance the transferability of generated adversarial samples, this paper combines the scale-invariant method SIM (Scale-Invariant Method) to set the enhanced image set. The pixel value of each picture in becomes 1, 1 / 2, 1 / 4, 1 / 8, and 1 / 16 of the original picture, thus The capacity is expanded 5 times, resulting in 5×10=50 copies of images.

[0062] S6: Adversarial perturbation calculation based on gradient direction.

[0063] First, based on the acquired enhanced data, the back propagation of the loss function is used to calculate the Wheel gradient , calculated as follows:

[0064] ;

[0065] Where, For the t The gradient of the wheel; is the corrected sample; is the enhanced data obtained at different extraction ratios; is the loss function; are the parameters of the model; is the loss function right Derivative; is the output of the deep learning model.

[0066] Then, the momentum accumulation algorithm is used to calculate the accumulated momentum gradient of the current round. The details are as follows:

[0067] ;

[0068] Where, is 1 norm; For the t The gradient of the wheel, is the attenuation coefficient hyperparameter, with a value of 1.0; For the t -1 round momentum gradient; In addition, if the current round is round 1, then Initialize parameters for momentum gradient ,

[0069] Subsequently, based on the Momentum gradient of the wheel Calculate the adversarial perturbation in the direction of and generate the adversarial sample of the current round (i.e. t +1 round of input samples), as follows:

[0070] ;

[0071] Where, For the t Input samples of the round; is the perturbation step size; Sign is the sign function, For the The momentum gradient of the wheel.

[0072] The generated t The adversarial sample of the first round is t+1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process, until T rounds of adversarial sample generation process are completed. After the first round of adversarial sample generation process is completed, the final adversarial sample can be obtained.

[0073] In this embodiment, the deep learning model used can be a deep convolutional neural network such as ResNet (Residual Network), VGG (Visual Geometry Group), Inception-V3, Inception-V4, etc.

[0074] The present invention also provides an adversarial sample generation system based on attention perturbation, comprising a data acquisition module, a class activation map matrix acquisition module, a correction module, an attention perturbation module, a sample enhancement module and a sample generation module. The data acquisition module is used to obtain the first t The class activation map matrix acquisition module is used to obtain the input sample of the first round. t The input samples of the first round are input into the deep learning model to obtain the output results of the deep learning model, and the class activation map matrix of the output results is calculated using the neural network visualization method; the correction module is used to mask the class activation map matrix, and the masked class activation map matrix is used to correct the first t The input samples of the round are corrected; the attention perturbation module is used to divide the class activation map matrix into multiple square sub-graphs with a side length of s; the multiple square sub-graphs are sorted according to the size of the sum of their element values, and some square sub-graphs are randomly extracted according to the proportion. Among the extracted square sub-graphs, the square sub-graph with the largest sum of element values is swapped with the square sub-graph with the smallest sum of element values, and the square sub-graph with the second largest element value is swapped with the square sub-graph with the second smallest element value, and so on, to complete the position swap of all the extracted square sub-graphs to obtain the attention perturbed class activation map matrix; the sample enhancement module is used to fuse the attention perturbated class activation map matrix with the corrected sample enhancement to obtain the enhanced sample; the enhanced sample is subjected to adversarial perturbation calculation to generate the first t The sample generation module is used to generate the adversarial samples of the first round. t The adversarial sample of the first round is t +1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process is performed until T rounds of adversarial sample generation process are completed to obtain the final adversarial sample.

[0075] The present invention also provides a computer device comprising a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the attention perturbation-based adversarial sample generation method.

[0076] The present invention also provides a computer-readable storage medium, which stores a computer program, and the computer program is suitable for loading by a processor to execute the attention perturbation-based adversarial sample generation method.

[0077] Example 2

[0078] In order to verify the method of the present invention, the following comparative test was carried out, and the specific process is as follows:

[0079] (1) Test dataset.

[0080] One image is selected from each of the 1000 categories of the ImageNet dataset to form a test dataset. The size of each image in the dataset is uniformly adjusted to 299×299×3.

[0081] (2) Attack model.

[0082] The deep learning models selected for testing include four normally trained deep convolutional neural networks Inc-V3 (Inception-V3), Inc-V4 (Inception-V4), IncResV2 (Inception-ResNet-V2), Res-101 (ResNet-v2-101) and three deep learning models Inc-V3 reinforced by adversarial training. ens3 、Inc-V3 ens4 、IncRes-V2 ens .

[0083] (3) Baseline comparison method.

[0084] The baseline comparison methods (attack methods) of the present invention respectively select the variance network invariant fast gradient sign method VNI-FGSM (Variance Network Invariant Fast Gradient Sign Method), the hybrid method Admix, the learned iterative fast gradient sign method LI-FGSM (Learned Iterative Fast Gradient Sign Method), the spatial contextual manipulation and perturbation method SCM-P (Spatial Contextual Manipulation with Perturbation), the mixed class activation mapping method MixCAM (Mixed Class Activation Mapping) and the method of the present invention.

[0085] (4) Test method.

[0086] Adversarial samples were generated for Inc-V3 and Inc-V4 models using the selected baseline method and the method of the present invention, respectively, and then the attack success rate of the generated adversarial samples against the selected models was verified. Table 1 shows the attack success rates of all models for adversarial samples generated by the present invention and the selected baseline method based on Inc-V3 and Inc-V4 models, respectively. It can be seen that since the method of the present invention generates adversarial samples by disrupting the angle of the model's focus on the data area, the attack success rate of the generated adversarial samples against known models is comparable to that of other methods (data marked with stars in the table), and the attack success rate against unknown models is better than that of other baseline comparison methods (data not marked with stars in the table). In summary, the method of the present invention can significantly improve the cross-model transferability of the generated adversarial samples without reducing the success rate of white-box attacks.

[0087] Table 1 Comparison of attack success rates of different models between the method of the present invention and the baseline comparison method

[0088]

[0089] The above-described embodiments are only preferred specific implementation methods of the present invention, and the protection scope of the present invention is not limited thereto. Any simple changes or equivalent replacements of the technical solutions that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention fall within the protection scope of the present invention.

Claims

1. A method for generating adversarial samples based on attention perturbation, characterized in that: The steps include: Get the t Input samples of the round; The first t Input the input samples of the round into the deep learning model, obtain the output results of the deep learning model, and use the neural network visualization method to calculate the class activation map matrix of the output results; Mask the class activation map matrix, and perform the masked class activation map on the first t The input samples of the round are corrected; The class activation map matrix is divided into multiple square subgraphs with a side length of s. The multiple square subgraphs are sorted according to the size of the sum of their element values, and some square subgraphs are randomly extracted in proportion. Among the extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest sum of element values is swapped with the square subgraph with the second smallest sum of element values. This process is repeated until all the extracted square subgraphs are swapped to obtain the class activation map matrix with disturbed attention. The attention-perturbed class activation map matrix is fused with the corrected sample enhancement to obtain the enhanced sample; Perform adversarial perturbation calculation on the enhanced samples to generate the t Round of adversarial examples; The generated t The adversarial sample of the first round is t +1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process, until T rounds of adversarial sample generation process are completed to obtain the final adversarial sample; The class activation map matrix is divided into a plurality of square subgraphs with a side length of s, specifically: when the side length of the class activation map matrix is divisible by s, the entire class activation map matrix is divided into a plurality of square subgraphs with a side length of s; when the side length of the class activation map matrix is not divisible by s, the central area of the class activation map matrix that is divisible by s is divided into a plurality of square subgraphs with a side length of s, and the peripheral area of the class activation map matrix remains unchanged.

2. The method for generating adversarial samples based on attention perturbation according to claim 1, characterized in that The class activation map matrix is masked, and the class activation map matrix is masked based on the masked class activation map matrix. t The input samples of the first round are corrected, specifically: the element values in the class activation map matrix that are greater than their q quantiles are set to 0, and the remaining elements are set to -1, and the set element values are multiplied by the dot product with the class activation map matrix, and the areas in the class activation map matrix that have a key impact on the output results of the deep learning model are masked to obtain the masked class activation map matrix; based on the masked class activation map matrix and the first t -1 round of momentum gradient is used to correct the input sample.

3. The method for generating adversarial samples based on attention perturbation according to claim 1, characterized in that The enhanced samples are subjected to anti-perturbation calculation to generate the t The adversarial examples of the round include the following steps: Set different extraction ratios , according to different extraction ratios Performing different degrees of enhancement on the corrected samples to obtain an enhanced picture set; The pixel values of each image in the enhanced image set are scaled according to different proportions to obtain multiple scaled images. The adversarial perturbation is calculated based on the average gradient information of the scaled images to generate the first t Round of adversarial examples.

4. A system for generating adversarial samples based on attention perturbation, characterized in that: include: Data acquisition module, used to obtain the t Input samples of the round; The class activation map matrix acquisition module is used to t Input the input samples of the round into the deep learning model, obtain the output results of the deep learning model, and use the neural network visualization method to calculate the class activation map matrix of the output results; The correction module is used to mask the class activation map matrix and correct the t The input samples of the round are corrected; The attention perturbation module is used to divide the class activation map matrix into multiple square subgraphs with a side length of s; the multiple square subgraphs are sorted according to the size of the sum of their element values, and some square subgraphs are randomly extracted according to a proportion. Among the extracted square subgraphs, the square subgraph with the largest sum of element values is swapped with the square subgraph with the smallest sum of element values, and the square subgraph with the second largest sum of element values is swapped with the square subgraph with the second smallest sum of element values. And so on, the positions of all the extracted square subgraphs are swapped to obtain the attention perturbed class activation map matrix; The sample enhancement module is used to fuse the attention-perturbed class activation map matrix with the corrected sample enhancement to obtain the enhanced sample; Perform adversarial perturbation calculation on the enhanced samples to generate the t Round of adversarial examples; The sample generation module is used to generate t The adversarial sample of the first round is t +1 round of input samples, input deep learning model, repeat the generation process of class activation map matrix, segmentation process and the first t +1 round of adversarial sample generation process, until T rounds of adversarial sample generation process are completed to obtain the final adversarial sample; The method of dividing the class activation map matrix into multiple square subgraphs with a side length of s is as follows: when the side length of the class activation map matrix is divisible by s, the entire class activation map matrix is divided into multiple square subgraphs with a side length of s; when the side length of the class activation map matrix is not divisible by s, the central area of the class activation map matrix that is divisible by s is divided into multiple square subgraphs with a side length of s, and the peripheral area of the class activation map matrix remains unchanged.

5. A computer device, characterized in that: It includes a memory and a processor; the memory stores a computer program, and the processor is used to run the computer program in the memory to execute the adversarial sample generation method based on attention perturbation according to any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which is suitable for loading by a processor to execute the attention perturbation-based adversarial sample generation method according to any one of claims 1 to 3.

Images