Frequency Domain-Based Feature Space Adversarial Sample Attack Method and System

Abstract

This invention discloses a frequency domain-based feature space adversarial example attack method and system. The method includes: acquiring an image dataset and constructing training data; preprocessing the images in the training data and then constructing a generator network using the PyTorch deep learning framework; decomposing and reconstructing the images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples; inputting the generated adversarial examples into a target model for training, constructing a loss function using the image features extracted by the target model, and obtaining the final adversarial examples; and completing the adversarial example attack process based on the final adversarial examples. This invention ensures that the adversarial examples maintain excellent imperceptibility while achieving good attack results, and can be widely applied in the field of computer technology.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method and system for adversarial sample attacks based on frequency domain feature space. Background Technology

[0002] Computer vision is a crucial application area for deep neural network (DNN) technology, which has achieved groundbreaking performance in this field. However, DNNs also face a series of security challenges in computer vision. Among these, adversarial example attacks have attracted widespread attention. Adversarial example attacks involve adding tiny, almost imperceptible perturbations to the original image, which can cause the DNN to produce incorrect classification results. This attack method, which subtly modifies the original input to induce differences in the neural network's output, is called an adversarial example attack. With the increasing prevalence of adversarial example attacks, the vulnerability of deep neural networks to such attacks has become apparent, prompting in-depth discussions and research into the robustness and security of deep learning models.

[0003] Currently, adversarial attack methods can be categorized into black-box attacks and white-box attacks based on whether the attacker understands the target network's structure and parameters. White-box attacks occur when the attacker understands the target network's structure and parameters, while black-box attacks occur when the attacker is unaware of the target network's structure, parameters, or training data domain. In the field of white-box attacks, many methods achieve excellent attack performance, but there is still room for improvement in the image quality of adversarial examples. Therefore, enhancing the image imperceptibility of adversarial examples has become a research direction in the field of white-box attacks.

[0004] Since image classification networks classify images in the spatial domain, most researchers have explored this approach from a spatial perspective, achieving some success in improving attack success rates. Specifically, these methods either increase the feature differences between the adversarial example and the original image in the spatial domain, or make the features of the adversarial example and the target image more similar, while keeping the perturbation cost within a certain range. Although these methods have achieved good results, some problems still require further exploration and solutions. These methods are often plagued by the poor visual quality of adversarial examples, a problem that significantly affects the feasibility of adversarial attack algorithms in practical applications. Summary of the Invention

[0005] The main objective of this invention is to propose a frequency domain-based feature space adversarial sample attack method and system, ensuring that adversarial samples achieve good attack results while maintaining excellent imperceptibility.

[0006] To achieve the above objectives, one aspect of this invention proposes a method for adversarial sample attacks based on feature space in the frequency domain, comprising the following steps:

[0007] Obtain the image dataset and construct the training data;

[0008] After preprocessing the images in the training data, a generator network is built using the PyTorch deep learning framework;

[0009] Based on the generator network, the images in the training data are decomposed and reconstructed using wavelet transform to obtain initialized adversarial examples;

[0010] The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples.

[0011] Based on the final adversarial sample, the adversarial attack process is completed.

[0012] In some embodiments, the generator network obtained by preprocessing the images in the training data and building it using the PyTorch deep learning framework includes the following steps:

[0013] The dataset images are preprocessed and cropped to a uniform size. Specifically, first, `transforms.Resize` is used to adjust the shorter side of the image to 256 pixels while maintaining the aspect ratio; then, `transforms.CenterCrop` is used to crop a 224×224 square region from the center of the image; finally, `transforms.ToTensor()` is used to convert the image data to tensor format.

[0014] A generator network is built using the PyTorch deep learning framework. The model structure of the generator network includes a downsampling module, a residual module, and an upsampling module; specifically, given an input image X∈R... H×W×C Where H and W are the spatial resolutions of the input image, and C is the number of channels in the input image; the initial perturbation of the output is X. adv ∈R H×W×C ;

[0015] The input image first passes through a downsampling module consisting of three downsampling blocks. Each downsampling block consists of a convolutional layer, a BatchNorm layer, and a ReLU activation function. The downsampling module performs image downsampling operations. Each residual block consists of two convolutional layers, two BatchNorm layers, a ReLU activation function, and a Dropout layer. The residual module performs feature extraction and computation on the downsampled image. The upsampling block consists of a deconvolutional layer, a BatchNorm layer, and a ReLU activation function. The upsampling module restores the image to its original size, thus obtaining the initialized adversarial perturbation.

[0016] In some embodiments, the step of decomposing and reconstructing images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples includes the following steps:

[0017] Wavelet transform is used to decompose and reconstruct the image; specifically, the wavelet transform decomposes the image x into four parts, including one low-frequency component and three high-frequency components, namely x... ll x lh x hl and x hh ;

[0018] The original image is reconstructed using all four components through the inverse transform method, thereby removing high-frequency components and using low-frequency components to reconstruct the image.

[0019] By decomposing and reconstructing the original image, high-frequency components in the original image are removed.

[0020] The reconstructed image is superimposed with the original perturbation generated by the generator network to obtain the initialized adversarial example.

[0021] In some embodiments, the loss function consists of two parts: the first part is the image feature part, and the second part is the frequency domain constraint.

[0022] The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, constructs a loss function using the image features extracted by the target model, and obtains the final adversarial samples, including the following steps:

[0023] In the first part, adversarial examples are generated from the perspective of feature similarity. By minimizing the Euclidean distance between different categories while maximizing the distance within the same category, the classification neural network maps the adversarial examples to different feature spaces.

[0024] In the second part, wavelet transform tools are used to decompose and reconstruct the original image and the adversarial sample respectively, remove the high-frequency components of the image, and use only the low-frequency components to reconstruct the image, thus establishing a new perturbation constraint.

[0025] Based on the processing in the first part and the processing in the second part, the adversarial sample is iteratively optimized using a frequency domain-based feature space attack method to obtain the final adversarial sample.

[0026] In some embodiments, the generation of adversarial examples from the perspective of feature similarity in the first part involves minimizing the Euclidean distance between different categories while maximizing the distance within the same category, so that the classification neural network maps the adversarial examples to different feature spaces, including the following steps:

[0027] Given a batch of original images X, which contains N original images x, the original image X is expressed as X = [x1, x2, ..., x...]. N ], where the i-th adversarial example is optimized. The formula is expressed as:

[0028]

[0029] in,[] + This represents max(.,0), x i ′ This is an adversarial example being optimized, initialized to x. i , of which s i, ′ i =sim(f(x′) i ),f(x i )), s′ i,j =sim(f(x′) i ),f(x j f(x) represents the similarity between images. The goal is to minimize the similarity between the adversarial example and the original image, and maximize the similarity between the adversarial example and images of a certain category. j () represents the original output value obtained after image x is input into classification network f;

[0030] The expression for similarity is:

[0031] Based on the similarity expression, the optimization formula for adversarial examples is updated, and in the non-targeted attack scenario, it is expressed as: Where j is the random category image number that is different from the original image category;

[0032] In a target attack scenario, this can be represented as: Where t is the image index of the target category.

[0033] In some embodiments, in the second part, wavelet transform tools are used to decompose and reconstruct the original image and the adversarial sample respectively, remove high-frequency components of the image, and reconstruct the image using only low-frequency components to establish a new perturbation constraint, including the following steps:

[0034] The wavelet transform tool is used to decompose and reconstruct the original image and the adversarial sample respectively, removing high-frequency components and using only low-frequency components to reconstruct the image. The expression for this process is:

[0035] By decomposing and reconstructing the original image, high-frequency components are removed while retaining the main information, thus establishing a new perturbation constraint: Where x is the original image and x′ is the adversarial example;

[0036] By minimizing D(x,x′), the adversarial disturbance is confined to the high-frequency range;

[0037] in, Represents an image reconstructed from low-frequency components; L represents a low-pass filter; x ll It represents a low-frequency component.

[0038] In some embodiments, the optimization formula used in the step of iteratively optimizing the adversarial sample using a frequency domain-based feature space attack method according to the processing in the first part and the processing in the second part to obtain the final adversarial sample is as follows:

[0039] Loss=λD(x i ,x′ i )+[s′ i,i -s′ i,t ] +

[0040]

[0041] Where λ is the hyperparameter and Loss represents the loss function.

[0042] Another aspect of this invention provides a frequency domain-based feature space adversarial sample attack system, comprising:

[0043] The first module is used to acquire the image dataset and construct the training data.

[0044] The second module is used to preprocess the images in the training data and then build a generator network using the PyTorch deep learning framework.

[0045] The third module is used to decompose and reconstruct the images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples.

[0046] The fourth module is used for frequency domain-based feature space attack methods. It inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples.

[0047] The fifth module is used to complete the adversarial attack process based on the final adversarial sample.

[0048] To achieve the above objectives, another aspect of the present invention provides an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0049] To achieve the above objectives, another aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0050] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0051] The embodiments of this invention include at least the following beneficial effects: This invention provides a frequency domain-based feature space adversarial example attack method and system. This scheme acquires an image dataset and constructs training data; after preprocessing the images in the training data, a generator network is built using the PyTorch deep learning framework; based on the generator network, wavelet transform is used to decompose and reconstruct the images in the training data to obtain initialized adversarial examples; the frequency domain-based feature space attack method inputs the generated adversarial examples into a target model for training, utilizes the image features extracted by the target model to construct a loss function, and obtains the final adversarial examples; based on the final adversarial examples, the adversarial example attack process is completed. The embodiments of this invention can ensure that the adversarial examples maintain excellent imperceptibility while achieving good attack effects. Attached Figure Description

[0052] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present invention;

[0053] Figure 2This is a flowchart of the overall steps provided in the embodiments of the present invention;

[0054] Figure 3 This is a flowchart illustrating the specific implementation process provided in the embodiments of the present invention;

[0055] Figure 4 This is a schematic diagram of the generator network structure provided in an embodiment of the present invention;

[0056] Figure 5 This is a schematic diagram illustrating the decomposition and reconstruction of an image using wavelet transform, provided by an embodiment of the present invention.

[0057] Figure 6 This is a schematic diagram of a feature space attack provided in an embodiment of the present invention;

[0058] Figure 7 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.

[0060] It is understood that the terms “first,” “second,” etc., used in this invention may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to determination” as used herein may be interpreted as “when…” or “when…” or “in response to determination.”

[0061] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.

[0062] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.

[0063] The frequency domain-based feature space adversarial sample attack method and system provided in this invention relates to the field of computer technology. The frequency domain-based feature space adversarial sample attack method provided in this invention can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the frequency domain-based feature space adversarial sample attack method, but is not limited to the above forms.

[0064] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This invention can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0065] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0066] Server 101 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0067] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0068] Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc. It can also be a vehicle-mounted terminal of the various device types described above, but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0069] Exemplary based on Figure 1 The implementation environment shown in this embodiment of the invention provides a frequency domain-based feature space adversarial sample attack method. The following description uses the application of this frequency domain-based feature space adversarial sample attack method in server 101 as an example. It can be understood that this method can also be applied to terminal 102.

[0070] Reference Figure 2 , Figure 2 The flowchart illustrates a frequency-domain-based feature space adversarial sample attack method for servers, provided in this embodiment of the invention. The execution entity of this method can be any of the aforementioned computer devices (including servers or terminals). (Refer to...) Figure 2 The method may include the following steps:

[0071] Obtain the image dataset and construct the training data;

[0072] After preprocessing the images in the training data, a generator network is built using the PyTorch deep learning framework;

[0073] Based on the generator network, the images in the training data are decomposed and reconstructed using wavelet transform to obtain initialized adversarial examples;

[0074] The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples.

[0075] Based on the final adversarial sample, the adversarial attack process is completed.

[0076] In some embodiments, the generator network obtained by preprocessing the images in the training data and building it using the PyTorch deep learning framework includes the following steps:

[0077] The dataset images are preprocessed and cropped to a uniform size. Specifically, first, `transforms.Resize` is used to adjust the shorter side of the image to 256 pixels while maintaining the aspect ratio; then, `transforms.CenterCrop` is used to crop a 224×224 square region from the center of the image; finally, `transforms.ToTensor()` is used to convert the image data to tensor format.

[0078] A generator network is built using the PyTorch deep learning framework. The model structure of the generator network includes a downsampling module, a residual module, and an upsampling module; specifically, given an input image X∈R... H×W×C Where H and W are the spatial resolutions of the input image, and C is the number of channels in the input image; the initial perturbation of the output is X. adv ∈R H×W×C ;

[0079] The input image first passes through a downsampling module consisting of three downsampling blocks. Each downsampling block consists of a convolutional layer, a BatchNorm layer, and a ReLU activation function. The downsampling module performs image downsampling operations. Each residual block consists of two convolutional layers, two BatchNorm layers, a ReLU activation function, and a Dropout layer. The residual module performs feature extraction and computation on the downsampled image. The upsampling block consists of a deconvolutional layer, a BatchNorm layer, and a ReLU activation function. The upsampling module restores the image to its original size, thus obtaining the initialized adversarial perturbation.

[0080] In some embodiments, the step of decomposing and reconstructing images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples includes the following steps:

[0081] Wavelet transform is used to decompose and reconstruct the image; specifically, the wavelet transform decomposes the image x into four parts, including one low-frequency component and three high-frequency components, namely x... ll x lh x hl and x hh ;

[0082] The original image is reconstructed using all four components through the inverse transform method, thereby removing high-frequency components and using low-frequency components to reconstruct the image.

[0083] High-frequency components in the original image are removed by decomposing and reconstructing it.

[0084] The reconstructed image is superimposed with the original perturbation generated by the generator network to obtain the initialized adversarial example.

[0085] In some embodiments, the loss function consists of two parts: the first part is the image feature part, and the second part is the frequency domain constraint.

[0086] The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, constructs a loss function using the image features extracted by the target model, and obtains the final adversarial samples, including the following steps:

[0087] In the first part, adversarial examples are generated from the perspective of feature similarity. By minimizing the Euclidean distance between different categories while maximizing the distance within the same category, the classification neural network maps adversarial examples to different feature spaces.

[0088] In the second part, wavelet transform tools are used to decompose and reconstruct the original image and the adversarial sample respectively, remove the high-frequency components of the image, and use only the low-frequency components to reconstruct the image, thus establishing a new perturbation constraint.

[0089] Based on the processing in the first part and the processing in the second part, the adversarial sample is iteratively optimized using a frequency domain-based feature space attack method to obtain the final adversarial sample.

[0090] In some embodiments, the generation of adversarial examples from the perspective of feature similarity in the first part involves minimizing the Euclidean distance between different categories while maximizing the distance within the same category, so that the classification neural network maps the adversarial examples to different feature spaces, including the following steps:

[0091] Given a batch of original images X, which contains N original images x, the original image X is expressed as X = [x1, x2, ..., x...]. N ], where the i-th adversarial example is optimized. The formula is expressed as:

[0092]

[0093] in,[] + This represents max(.,0), x i ′This is an adversarial example being optimized, initialized to x. i , of which s i, ′ i =sim(f(x′) i ),f(x i )), s′ i,j =sim(f(x′) i ),f(x j f(x) represents the similarity between images. The goal is to minimize the similarity between the adversarial example and the original image, and maximize the similarity between the adversarial example and images of a certain category. j () represents the original output value obtained after image x is input into classification network f;

[0094] The expression for similarity is:

[0095] Based on the similarity expression, the optimization formula for adversarial examples is updated, and in the non-targeted attack scenario, it is expressed as: Where j is the random category image number that is different from the original image category;

[0096] In a target attack scenario, this can be represented as: Where t is the image index of the target category.

[0097] In some embodiments, in the second part, wavelet transform tools are used to decompose and reconstruct the original image and the adversarial sample respectively, remove high-frequency components of the image, and reconstruct the image using only low-frequency components to establish a new perturbation constraint, including the following steps:

[0098] The wavelet transform tool is used to decompose and reconstruct the original image and the adversarial sample respectively, removing high-frequency components and using only low-frequency components to reconstruct the image. The expression for this process is:

[0099] By decomposing and reconstructing the original image, high-frequency components are removed while retaining the main information, thus establishing a new perturbation constraint: Where x is the original image and x′ is the adversarial example;

[0100] By minimizing D(x,x′), the adversarial disturbance is confined to the high-frequency range;

[0101] in, Represents an image reconstructed from low-frequency components; L represents a low-pass filter; x ll It represents a low-frequency component.

[0102] In some embodiments, the optimization formula used in the step of iteratively optimizing the adversarial sample using a frequency domain-based feature space attack method according to the processing in the first part and the processing in the second part to obtain the final adversarial sample is as follows:

[0103] Loss=λD(x i ,x′ i )+[s′ i,i -s′ i,t ] +

[0104]

[0105] Where λ is the hyperparameter and Loss represents the loss function.

[0106] The specific implementation process of this invention will be described in detail below using a specific application scenario as an example:

[0107] The purpose of this invention is to ensure that adversarial examples maintain excellent imperceptibility while achieving good attack results. It provides a feature space attack method based on the frequency domain, such as... Figure 3 As shown, the specific steps include:

[0108] Step 1: Obtain the image dataset and input the training data.

[0109] Step 2: Preprocess the dataset images by cropping them to a uniform size to enhance the extraction of useful information. First, use `transforms.Resize(256)` to adjust the shorter side of the image to 256 pixels, maintaining the aspect ratio. Second, use `transforms.CenterCrop(224)` to crop a 224×224 square region from the center of the image. Finally, use `transforms.ToTensor()` to convert the image data to tensor format.

[0110] Step 3: Build a generator network using the PyTorch deep learning framework. The structure of this network model is as follows: Figure 4 As shown. This network model mainly includes a downsampling module, a residual module, and an upsampling module. Specifically, given an input image X∈R... H×W×C Where H and W are the spatial resolutions of the input image, and C is the number of channels in the input image. The corresponding initial perturbation for the output is X. adv ∈R H×W×CThe input image first passes through a downsampling module consisting of three downsampling blocks. Each downsampling block comprises a convolutional layer (Conv), a batchNorm layer, and a ReLU activation function. The downsampling module performs image downsampling. Each residual block consists of two convolutional layers (Conv), two batchNorm layers, a ReLU activation function, and a dropout layer. The residual module performs feature extraction and computation on the downsampled image. The upsampling block consists of a deconvolutional layer (Transposed Convolution), a batchNorm layer, and a ReLU activation function. The upsampling module restores the image to its original size, obtaining the initialized adversarial perturbation.

[0111] Step 4: This invention uses Discrete Wavelet Transform (DWT) to decompose and reconstruct the image. Wavelet transform is a time-frequency analysis tool that can decompose an image x into four parts, including one low-frequency component and three high-frequency components, namely: x ll x lh x hl and x hh .

[0112] x ll =LxL T ,x lh =HxL T ,x hl =LxH T ,x hh =HxH T (1)

[0113] Where L and H are the low-pass and high-pass filters in wavelet transform. For example... Figure 5 As shown, x ll The low-frequency components of the original image were preserved, while the other three high-frequency components retained the high-frequency components of the original image.

[0114] In the Inverse Discrete Wavelet Transformation (IDWT), all four components are typically used to reconstruct the original image. In this work, however, high-frequency components are removed, and only low-frequency components are used to reconstruct the image. As shown below:

[0115]

[0116] By decomposing and reconstructing the original image, high-frequency components in the original image are removed, and only the main information of the original image is retained.

[0117] The reconstructed image is superimposed with the original perturbation generated by the generator network to obtain the initialized adversarial example.

[0118] Step 5: Input the generated adversarial examples into the target model, which is a pre-trained classification model imported into the PyTorch framework, such as ResNet-50.

[0119] Step 6: Use adversarial examples for training and construct a loss function using the image features extracted by the target model.

[0120] The loss function consists of two parts, the first being the image feature part. Traditional white-box attack methods typically generate adversarial examples by maximizing the classification loss, while feature space attacks aim to make images of different categories appear very similar to the classification neural network. A common approach for these methods is to directly minimize the Euclidean distance between the intermediate layer features of the original and target images in the target neural network. Traditional white-box attack methods usually generate adversarial examples by maximizing the classification loss, pushing the adversarial examples as far away from their true category as possible. In contrast, this invention generates adversarial examples from the perspective of feature similarity, minimizing the Euclidean distance between different categories while maximizing the distance within the same category, and designing a more flexible optimization scheme. This approach misleads the classification neural network into mapping adversarial examples to different feature spaces. The specific framework is as follows: Figure 6 As shown.

[0121] Given a batch of original images X, which contains H original images x, i.e.: X = [x1, x2, ..., x...] N ] Optimize the i-th adversarial example The formula is expressed as:

[0122]

[0123] in,[] + This represents max(.,0), x i ′ is the adversarial example being optimized, initialized to x. i , of which s i, ′ i =sim(f(x′) i ),f(x i )), s′ i,j =sim(f(x′) i ),f(x j The similarity between images is expressed as: (The goal is to minimize the similarity between the adversarial example and the original image, and maximize the similarity between the adversarial example and images of a certain category.) In this method, this similarity formula is expressed as:

[0124]

[0125] Combining the above formulas, the optimization formula for adversarial examples can be updated, and expressed as follows in non-targeted attack scenarios:

[0126]

[0127] Where j is the random category image number that is different from the original image category.

[0128] In a target attack scenario, this can be represented as:

[0129]

[0130] Where t is the image index of the target category.

[0131] The second part of the loss function is the frequency domain constraint. Although the aforementioned feature space attack algorithm can generate adversarial examples with a high success rate, it also has a potential risk: adversarial perturbations may be concentrated in salient areas of the target object, making them easily perceptible to humans. Such perceptible perturbations may not only affect the stealth of the adversarial attack but may also be subject to more robust defenses in practical applications. Furthermore, traditional adversarial attack algorithms typically use norm constraints to limit the magnitude of the perturbation. While this can control the size of the perturbation to some extent, the randomness of norm constraints often leads to the perturbation being randomly distributed across different regions of the image, failing to effectively avoid interfering with salient areas. To address these issues, this invention proposes a novel perturbation constraint mechanism designed to restrict adversarial perturbations to subtle, imperceptible details of the object.

[0132] Using the wavelet transform tool mentioned above, images can be decomposed and reconstructed. This invention uses the wavelet transform tool to decompose and reconstruct the original image and the adversarial sample separately, removing high-frequency components and using only low-frequency components to reconstruct the image. As shown below:

[0133]

[0134] By decomposing and reconstructing the original image, high-frequency components are removed, retaining only the main information. Simultaneously, a new perturbation constraint can be established using the above process.

[0135]

[0136] Here, x represents the original image, and x′ represents the adversarial example. By minimizing D(x,x′), the adversarial perturbation is restricted to the high-frequency part, thereby ensuring that the adversarial perturbation is not easily perceived.

[0137] Combining the two parts mentioned above, the optimization formula for the frequency domain-based feature space attack method proposed in this invention is as follows:

[0138] Loss=λD(x i ,x′ i )+[s′ i,i -s′ i,t ] + (9)

[0139]

[0140] Here, λ is a hyperparameter. This formula aims to achieve a high attack success rate for adversarial examples while limiting adversarial perturbations to the high-frequency region, keeping them as imperceptible as possible. The magnitude of the hyperparameter λ affects whether the loss function leans more towards feature loss or frequency domain control.

[0141] The loss function is used to iteratively optimize the adversarial examples to obtain the final adversarial examples.

[0142] Step 7: After training, use test set images to perform a final performance test on the attack method. Evaluate the attack effectiveness based on evaluation metrics, which include: Attack Success Rate (ASR), L2 norm (l2), and L2 norm (ln2). ∞ ( ) and low-frequency component distortion (LF). The calculation formulas for each evaluation index can be found in Equations 11 to 14.

[0143]

[0144] Where NS represents the number of images successfully attacked, and T represents the total number of images. The L2 norm and the infinity norm are used to quantify the difference between the adversarial example and the original image, and LF is used to quantify the difference between the low-frequency components of the original image and the adversarial example. The larger the ASR, the better the attack performance; the smaller the L2 norm, the infinity norm, and LF, the better the imperceptibility of the adversarial example.

[0145] In summary, this invention addresses the adversarial example attack task in image classification systems, aiming to improve the attack performance and enhance the imperceptibility of adversarial examples by providing a feature space attack method based on the frequency domain. Previous methods have largely explored the spatial domain, achieving some success in improving attack success rates. However, these methods are often hampered by the poor visual quality of adversarial examples, a problem that significantly impacts the feasibility of adversarial attack algorithms in practical applications. To address these issues, this invention's adversarial example attack method makes two innovations:

[0146] (1) By combining the generator network with iterative optimization in the feature space, the model can improve overall efficiency while maintaining a high attack success rate.

[0147] (2) Introducing frequency domain constraints into adversarial sample generation allows the generated adversarial samples to achieve good attack effects while maintaining excellent imperceptibility.

[0148] Another aspect of this invention provides a frequency domain-based feature space adversarial sample attack system, comprising:

[0149] The first module is used to acquire the image dataset and construct the training data.

[0150] The second module is used to preprocess the images in the training data and then build a generator network using the PyTorch deep learning framework.

[0151] The third module is used to decompose and reconstruct the images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples.

[0152] The fourth module is used for frequency domain-based feature space attack methods. It inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples.

[0153] The fifth module is used to complete the adversarial attack process based on the final adversarial sample.

[0154] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0155] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned frequency domain-based feature space adversarial sample attack method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0156] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0157] See also Figure 7 , Figure 7 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0158] The processor 701 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0159] The memory 702 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 702 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 702 and is called and executed by the processor 701 to execute the frequency domain-based feature space adversarial sample attack method of the embodiments of this invention.

[0160] The input / output interface 703 is used to implement information input and output;

[0161] The communication interface 704 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0162] Bus 705 transmits information between various components of the device (e.g., processor 701, memory 702, input / output interface 703, and communication interface 704);

[0163] The processor 701, memory 702, input / output interface 703, and communication interface 704 are connected to each other within the device via bus 705.

[0164] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described frequency domain-based feature space adversarial sample attack method.

[0165] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0166] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0167] It should be noted that in various specific embodiments of the present invention, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of the present invention require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to a confirmation page. Only after obtaining the user's separate permission or consent is the necessary user-related data for the normal operation of the embodiments of the present invention acquired.

[0168] The embodiments described in this invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of this invention, and do not constitute a limitation on the technical solutions provided by the embodiments of this invention. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this invention are also applicable to similar technical problems.

[0169] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present invention, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0170] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0171] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0172] The terms "first," "second," "third," "fourth," etc. (if present) in the specification and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0173] It should be understood that in this invention, "at least one (item)" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0174] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0175] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0176] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0177] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0178] The preferred embodiments of the present invention have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and spirit of the present invention should be within the scope of the claims of the present invention.

Claims

1. A method for adversarial sample attacks based on feature space in the frequency domain, characterized in that, Includes the following steps: Obtain the image dataset and construct the training data; After preprocessing the images in the training data, a generator network is built using the PyTorch deep learning framework; Based on the generator network, the images in the training data are decomposed and reconstructed using wavelet transform to obtain initialized adversarial examples; The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples. Based on the final adversarial sample, complete the adversarial sample attack process; The step of decomposing and reconstructing images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples includes the following steps: Wavelet transform is used to decompose and reconstruct images; specifically, wavelet transform transforms the image... x It can be decomposed into four parts, which include one low-frequency component and three high-frequency components, respectively. , , and ; The original image is reconstructed using all four components through the inverse transform method, thereby removing high-frequency components and using low-frequency components to reconstruct the image. High-frequency components in the original image are removed by decomposing and reconstructing it. The reconstructed image is superimposed with the original perturbation generated by the generator network to obtain the initialized adversarial sample; The loss function consists of two parts: the first part is the image feature part, and the second part is the frequency domain constraint. The frequency domain-based feature space attack method inputs the generated adversarial samples into the target model for training, constructs a loss function using the image features extracted by the target model, and obtains the final adversarial samples, including the following steps: In the first part, adversarial examples are generated from the perspective of feature similarity. By minimizing the distance between different categories while maximizing the distance within the same category, the classification neural network maps the adversarial examples to different feature spaces. In the second part, wavelet transform tools are used to decompose and reconstruct the original image and the adversarial sample respectively, remove the high-frequency components of the image, and use only the low-frequency components to reconstruct the image, thus establishing a new perturbation constraint. Based on the processing in the first part and the processing in the second part, the adversarial sample is iteratively optimized using a frequency domain-based feature space attack method to obtain the final adversarial sample.

2. The method for adversarial sample attacks based on frequency domain feature space according to claim 1, characterized in that, After preprocessing the images in the training data, a generator network is built using the PyTorch deep learning framework, including the following steps: The dataset images are preprocessed and cropped to a uniform size. Specifically, first, `transforms.Resize` is used to adjust the shorter side of the image to 256 pixels while maintaining the aspect ratio; then, `transforms.CenterCrop` is used to crop a 224×224 square region from the center of the image; finally, `transforms.ToTensor()` is used to convert the image data to tensor format. A generator network is built using the PyTorch deep learning framework. The model structure of the generator network includes a downsampling module, a residual module, and an upsampling module; specifically, given an input image... ,in and The spatial resolution of the input image. The number of input image channels; the initial perturbation of the output is... ; The input image first passes through a downsampling module consisting of three downsampling blocks. Each downsampling block consists of a convolutional layer, a BatchNorm layer, and a ReLU activation function. The downsampling module performs image downsampling operations. Each residual block consists of two convolutional layers, two BatchNorm layers, a ReLU activation function, and a Dropout layer. The residual module performs feature extraction and computation on the downsampled image. The upsampling block consists of a deconvolutional layer, a BatchNorm layer, and a ReLU activation function. The upsampling module restores the image to its original size, thus obtaining the initialized adversarial perturbation.

3. The method for adversarial sample attacks based on frequency domain feature space according to claim 1, characterized in that, In the first part, adversarial examples are generated from the perspective of feature similarity. By minimizing the distance between different categories while maximizing the distance within the same category, the classification neural network maps the adversarial examples to different feature spaces. This includes the following steps: Given a batch of raw images , which includes Original image ， Original image The expression is Among them, the optimization of the first One adversarial example The formula is expressed as: ； in, This represents max(.,0). This is an adversarial example being optimized, initialized to... , among them , It represents the similarity between images, with the goal of minimizing the similarity between the adversarial sample and the original image, and maximizing the similarity between the adversarial sample and images of a certain category; Representative image Input to classification network The resulting original output value; The expression for similarity is: ; Based on the similarity expression, the optimization formula for adversarial examples is updated, and in the non-targeted attack scenario, it is expressed as: ,in, The image number is a random category that differs from the original image category; In a target attack scenario, this can be represented as: ,in, Image number representing the target category.

4. The method for adversarial sample attacks based on frequency domain feature space according to claim 1, characterized in that, In the second part, wavelet transform is used to decompose and reconstruct the original image and the adversarial sample, respectively. High-frequency components of the image are removed, and only low-frequency components are used to reconstruct the image, establishing a new perturbation constraint. This includes the following steps: The wavelet transform tool is used to decompose and reconstruct the original image and the adversarial sample respectively, removing high-frequency components and using only low-frequency components to reconstruct the image. The expression for this process is: ; By decomposing and reconstructing the original image, high-frequency components are removed while retaining the main information, thus establishing a new perturbation constraint: ;in, For the original image, For adversarial examples; Through the Minimize the disturbance to limit it to the high-frequency range; in, This represents an image reconstructed from low-frequency components; Represents a low-pass filter; It represents a low-frequency component.

5. A method for adversarial sample attacks based on frequency domain feature space according to any one of claims 1-4, characterized in that, In the step of iteratively optimizing the adversarial sample using a frequency domain-based feature space attack method based on the processing in the first part and the processing in the second part to obtain the final adversarial sample, the optimization formula used is as follows: in, For hyperparameters; This represents the loss function.

6. A system for implementing the frequency domain-based feature space adversarial sample attack method as described in any one of claims 1-5, characterized in that, include: The first module is used to acquire the image dataset and construct the training data. The second module is used to preprocess the images in the training data and then build a generator network using the PyTorch deep learning framework. The third module is used to decompose and reconstruct the images in the training data using wavelet transform based on the generator network to obtain initialized adversarial examples. The fourth module is used for frequency domain-based feature space attack methods. It inputs the generated adversarial samples into the target model for training, uses the image features extracted by the target model to construct a loss function, and obtains the final adversarial samples. The fifth module is used to complete the adversarial attack process based on the final adversarial sample.

7. An electronic device, characterized in that, Including the processor and memory; The memory is used to store programs; The processor executes the program to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The storage medium stores a program that is executed by a processor to implement the method as described in any one of claims 1 to 5.

Images