Variable-length combined semantic perturbation method based on multi-objective evolutionary algorithm

Abstract

The invention discloses a variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm. The variable-length combined semantic perturbation method comprises the following steps: initializing the length of a combined semantic attack sequence; randomly sampling from the semantic attack search space to obtain a plurality of combined semantic attack sequences; selecting a disturbance value from the disturbance interval corresponding to each semantic attack to obtain a plurality of combined semantic attack sequences with determined disturbance values; and adding combined semantic attacks in the sample image according to the combined semantic attack sequences to obtain a combined semantic adversarial sample corresponding to each combined semantic attack sequence, inputting a plurality of adversarial samples into the deep neural network model to obtain a model output result, and based on the plurality of combined semantic attack sequences and the model output, outputting the model output result. And optimizing the length and sequence of the combined semantic attack sequence by using a genetic algorithm based on non-dominated sorting and neighborhood search, and searching to obtain an optimal combined semantic attack sequence. According to the method, the combined semantic perturbation for robustness evaluation of the deep neural network model can be efficiently generated.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to a variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm. Background Art

[0002] In recent years, with the continuous advancement and development of machine learning theory and technology, especially the breakthrough progress in computer vision and multimedia, machine learning has been widely used in technical fields such as autonomous driving, target detection, medical image processing, biological image recognition, and face recognition.

[0003] At present, most computer vision technologies are based on artificial intelligence technologies based on deep learning. However, the fragility of deep learning models has planted immeasurable security risks for the practical application of computer vision. In 2014, the concept of adversarial examples was first proposed by Szegedy et al., which opened up a new direction for the research of computer vision technology. Adversarial examples refer to adding subtle interference to samples through careful human design, causing the model to give an erroneous output with high confidence. For example, a picture of a giant panda with carefully designed noise perturbations was mistakenly identified as a gibbon by the model. This security threat will seriously affect the application of computer vision technology. Therefore, it has become an important research direction in the field of computer vision to evaluate the robustness of deep learning models by designing more powerful adversarial attack algorithms and then improve the models based on the evaluation results.

[0004] According to the magnitude of the perturbation, existing adversarial attacks can be divided into L-based p norm attack method and unrestricted attack method, the former requires the perturbation L added to the original image (also called the clean image) p The norm cannot exceed a certain threshold. The latter has no limit on the perturbation amplitude, but it is necessary to ensure that the semantics of the original image cannot be changed. Therefore, the latter is often also called semantic attack. Due to the good naturalness and physical feasibility of semantic perturbation, semantic attack has become an important research direction in the field of adversarial attack technology.

[0005] In order to improve the success rate of semantic attacks, the existing technology "L.Hsiung, Y.-Y.Tsai, P.-Y.Chen, T.-Y.Ho, CARBEN: Composite Adversarial Robustness Benchmark, in: Proceedings of theThirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, International Joint Conferences on Artificial Intelligence Organization, 2022" proposed to achieve integrated attacks by integrating five types of semantic perturbations. However, in order to achieve a better attack effect, it is necessary to manually and carefully design a better order of semantic perturbations, which is time-consuming and laborious; and with the development of defense technologies such as combined adversarial training, the combined semantic perturbations generated by the above existing methods to deal with the attack effects of various defense models are still not very good and need to be improved. Summary of the invention

[0006] In order to solve some or all of the technical problems existing in the above-mentioned prior art, the present invention provides a variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm.

[0007] The technical solution of the present invention is as follows:

[0008] A variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm is provided, including:

[0009] Initialize the length of the combined semantic attack sequence, where the length of the combined semantic attack sequence represents the number of semantic attacks contained in the combined semantic attack sequence;

[0010] Randomly sample from a predefined semantic attack search space to obtain multiple combined semantic attack sequences;

[0011] Selecting a specific disturbance value of each semantic attack included in the combined semantic attack sequence from the disturbance interval corresponding to each predefined semantic attack, and obtaining a plurality of combined semantic attack sequences with determined disturbance values;

[0012] A sample image is obtained, and combined semantic attacks are added to the sample image according to the combined semantic attack sequence to obtain the combined semantic adversarial samples corresponding to each combined semantic attack sequence. Multiple combined semantic adversarial samples are respectively input into the deep neural network model to be evaluated to obtain the detection results output by the deep neural network model. Based on multiple combined semantic attack sequences and the output of the deep neural network model, the length and order of the combined semantic attack sequence are optimized using a genetic algorithm based on non-dominated sorting and a neighborhood search to search for the optimal combined semantic attack sequence.

[0013] In some optional implementations, randomly sampling from a predefined semantic attack search space to obtain a plurality of combined semantic attack sequences further includes:

[0014] According to the length of the initialized combined semantic attack sequence, a corresponding number of semantic attacks are randomly sampled from a predefined semantic attack search space to obtain a combined semantic attack sequence;

[0015] Repeat the above process multiple times to obtain multiple combined semantic attack sequences.

[0016] In some optional implementations, the semantic attack search space includes: hue attack, saturation attack, brightness attack, rotation attack, and contrast attack.

[0017] In some optional embodiments, based on the output of the multiple combined semantic attack sequences and the deep neural network model, the length and order of the combined semantic attack sequences are optimized using a genetic algorithm based on non-dominant sorting and a neighborhood search, further comprising:

[0018] Step 41, taking multiple combined semantic attack sequences as the initial population;

[0019] Step 42, according to the detection results output by the deep neural network model, calculate the optimization target value corresponding to each combined semantic attack sequence in the current population, and the optimization target value corresponding to the combined semantic attack sequence is defined as the robust accuracy obtained by the combined semantic attack sequence attacking the deep neural network model and the time required to complete the entire attack;

[0020] Step 43, based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences;

[0021] Step 44, merging the current population and the intermediate population, and performing non-dominated sorting and crowding distance calculation on the merged population;

[0022] Step 45, selecting a new generation population from the merged population according to the calculation results of the non-dominated sorting and the crowding distance;

[0023] Step 46, randomly selecting a combined semantic attack sequence on the first Pareto front in the new generation population, and performing a neighborhood search dimension by dimension in the sequence length direction based on the selected combined semantic attack sequence to obtain the neighborhood of the combined semantic attack sequence in each dimension, and sequentially evaluating each combined semantic attack sequence in the neighborhood using a deep neural network model for each neighborhood, and replacing the currently selected combined semantic attack sequence with a combined semantic attack sequence with a better evaluation result;

[0024] Step 47, after completing the neighborhood search and evaluation replacement under the current sequence length, the sequence length is increased by one, and based on the selected combined semantic attack sequence, a neighborhood search is performed dimension by dimension in the direction of the sequence length to obtain the neighborhood of the combined semantic attack sequence in each dimension, and each combined semantic attack sequence in the neighborhood is evaluated using a deep neural network model for each neighborhood in turn, and the currently selected combined semantic attack sequence is replaced with a combined semantic attack sequence with a better evaluation result;

[0025] Step 48, iterating the loop of step 47 until the preset first termination condition is reached and then proceeding to the next step;

[0026] Step 49, determine whether the preset second termination condition is met. If not, use the latest determined population as the current population and return to step 42 to continue the loop iteration. If so, use the deep neural network model to evaluate each combined semantic attack sequence in the latest determined population and output the combined semantic attack sequence with the best evaluation result.

[0027] In some optional implementations, based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences, further comprising:

[0028] Step 431, performing a mutation operation based on the current population to obtain multiple mutant individuals;

[0029] Step 432, performing a crossover operation based on the current population and its corresponding mutant individuals to obtain a descendant population corresponding to the current population;

[0030] Step 433, based on the current population and its corresponding offspring population, a selection operation is performed with the goal of minimizing the optimization target value corresponding to the individual to obtain an intermediate population;

[0031] Wherein, the individuals represent combined semantic attack sequences.

[0032] In some optional embodiments, when selecting a new generation population from the merged population, priority is given to combined semantic attack sequences with smaller non-dominated sorting numbers. When the non-dominated sorting numbers of multiple combined semantic attack sequences are the same, priority is given to combined semantic attack sequences with smaller congestion.

[0033] In some optional implementations, evaluating the combined semantic attack sequence using a deep neural network model includes the following steps:

[0034] A specific disturbance value of each semantic attack included in the combined semantic attack sequence is selected from the disturbance interval corresponding to each pre-defined semantic attack to obtain a combined semantic attack sequence with a determined disturbance value; a combined semantic attack is added to a sample image according to the combined semantic attack sequence to obtain a combined semantic adversarial sample corresponding to the combined semantic attack sequence; the combined semantic adversarial sample is input into a deep neural network model to obtain a detection result output by the deep neural network model; and based on the detection result output by the deep neural network model, an optimization target value corresponding to the combined semantic attack sequence is calculated as an evaluation result corresponding to the combined semantic attack sequence.

[0035] The main advantages of the technical solution of the present invention are as follows:

[0036] The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm of the present invention optimizes the length and order of the combined semantic attack sequence by using a genetic algorithm based on non-dominant sorting and a neighborhood search on the basis of allowing the same type of semantic attack to be executed multiple times and the length of the combined semantic attack sequence to be variable. It can obtain the optimal combined semantic attack sequence, thereby making the combined semantic adversarial samples generated according to the combined semantic attack sequence have better attack effects, so as to better evaluate the robust performance of the deep neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the embodiments of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0038] Figure 1 A flowchart of a variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0040] The technical solution provided by the embodiments of the present invention is described in detail below with reference to the accompanying drawings.

[0041] refer to Figure 1 The embodiment of the present invention provides a variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm, the method comprising the following steps:

[0042] Step 1, initialize the length of the combined semantic attack sequence;

[0043] In the embodiment of the present invention, the length of the combined semantic attack sequence represents the number of semantic attacks included in the combined semantic attack sequence.

[0044] Step 2: randomly sample from the predefined semantic attack search space to obtain multiple combined semantic attack sequences;

[0045] In an embodiment of the present invention, according to the length of the initialized combined semantic attack sequence, a corresponding number of semantic attacks are randomly sampled from a predefined semantic attack search space to obtain a combined semantic attack sequence, and the above process is repeated multiple times to obtain multiple combined semantic attack sequences.

[0046] Step 3, selecting a specific disturbance value of each semantic attack included in the combined semantic attack sequence from the disturbance interval corresponding to each predefined semantic attack, to obtain a plurality of combined semantic attack sequences with determined disturbance values;

[0047] In an embodiment of the present invention, for each combined semantic attack sequence, a specific disturbance value of each semantic attack included in the combined semantic attack sequence is selected from a predefined disturbance interval corresponding to each semantic attack to obtain a combined semantic attack sequence with a determined disturbance value.

[0048] It should be noted that the disturbance interval corresponding to each semantic attack is set according to actual needs.

[0049] Step 4: obtain a sample image, add a combined semantic attack to the sample image according to the combined semantic attack sequence, obtain a combined semantic adversarial sample corresponding to each combined semantic attack sequence, input multiple combined semantic adversarial samples into the deep neural network model to be evaluated, and obtain the detection result output by the deep neural network model. Based on multiple combined semantic attack sequences and the output of the deep neural network model, use the non-dominated sorting genetic algorithm (NSGA-Ⅱ) and neighborhood search to optimize the length and order of the combined semantic attack sequence, and search for the optimal combined semantic attack sequence.

[0050] It should be noted that the deep neural network model to be evaluated is specifically set according to actual needs, and the deep neural network model to be evaluated is a deep neural network model that has completed training or has actually been put into use.

[0051] The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm provided in an embodiment of the present invention can obtain the optimal combined semantic attack sequence by optimizing the length and order of the combined semantic attack sequence using a genetic algorithm based on non-dominant sorting and a neighborhood search on the basis of allowing the same type of semantic attacks to be executed multiple times and the length of the combined semantic attack sequence to be variable. The combined semantic adversarial samples generated according to the combined semantic attack sequence have better attack effects, so as to better evaluate the robust performance of the deep neural network model.

[0052] Furthermore, in the embodiment of the present invention, the semantic attack search space is specifically set according to actual needs. In the embodiment of the present invention, the semantic attack search space includes: hue attack, saturation attack, brightness attack, rotation attack, and contrast attack.

[0053] In the embodiment of the present invention, the hue attack represents adjusting the hue of the image, the saturation attack represents adjusting the saturation of the image, the brightness attack represents adjusting the brightness of the image, the rotation attack represents adjusting the angle of the image, and the contrast attack represents adjusting the contrast of the image.

[0054] In the embodiment of the present invention, the attack threshold corresponding to each semantic attack, that is, the disturbance interval, is specifically set according to actual needs.

[0055] Furthermore, in an embodiment of the present invention, based on the output of multiple combined semantic attack sequences and the deep neural network model, the length and order of the combined semantic attack sequences are optimized using a genetic algorithm based on non-dominant sorting and a neighborhood search, further comprising the following steps:

[0056] Step 41, taking multiple combined semantic attack sequences as the initial population;

[0057] In the embodiment of the present invention, a combined semantic attack sequence is taken as an individual to obtain an initial population including multiple individuals.

[0058] Step 42, calculating the optimization target value corresponding to each combined semantic attack sequence in the current population according to the detection result output by the deep neural network model;

[0059] In an embodiment of the present invention, the optimization target value corresponding to the combined semantic attack sequence is defined as the robust accuracy obtained by the combined semantic attack sequence attacking the deep neural network model and the time required to complete the entire attack.

[0060] Step 43, based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences;

[0061] In an embodiment of the present invention, based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences, further comprising the following steps:

[0062] Step 431, performing a mutation operation based on the current population to obtain multiple mutant individuals;

[0063] Step 432, performing a crossover operation based on the current population and its corresponding mutant individuals to obtain a descendant population corresponding to the current population;

[0064] Step 433, based on the current population and its corresponding offspring population, a selection operation is performed with the goal of minimizing the optimization target value corresponding to the individual to obtain an intermediate population.

[0065] It should be noted that the above individuals refer to combined semantic attack sequences.

[0066] Specifically, set the current population to:

[0067]

[0068] Among them, P t represents the current population, that is, the tth generation population, P t (i) represents the population P t The i-th individual in represents the value range of the individual variable, N represents the total number of individuals in the population, and T represents the total number of iterations, where the upper and lower bounds of all variables are [0,1].

[0069] The mutation operation is expressed as:

[0070] P M (i) = P t(r1)+F(P t (r2)-P t (r3))r1≠r2≠r3≠i;

[0071] Among them, P M (i) represents individual P t (i) The corresponding variant individual, F represents the mutation factor, P t (r1),P t (r2) and P t (r3) respectively represent the population P t The r1th individual, r2th individual and r3th individual in , r1, r2 and r3 represent individual indexes, satisfying the inequality constraint.

[0072] The crossover operation is expressed as:

[0073]

[0074] Among them, P C (i) represents the population P t The corresponding offspring population P C The i-th individual in N individuals P C (i) (i = 1, 2, ..., N) constitutes the offspring population P C , C r represents the mutation probability, and rand represents random sampling from the interval [0,1].

[0075] The selection operation is represented as:

[0076]

[0077] Among them, P t+1 (i) represents the population P of the t+1th generation t+1 The i-th individual in f(P t (i)) represents individual P t (i) The corresponding optimization target value, f(P C (i)) represents individual P C (i) A corresponding optimization target value, which is determined according to the above definition.

[0078] Step 44, merging the current population and the intermediate population, and performing non-dominated sorting and crowding distance calculation on the merged population;

[0079] It should be noted that non-dominated sorting and crowding distance calculation are commonly used processing methods in existing multi-objective evolutionary algorithms and will not be described in detail here.

[0080] Step 45, selecting a new generation population from the merged population according to the calculation results of the non-dominated sorting and the crowding distance;

[0081] In the embodiment of the present invention, the number of combined semantic attack sequences included in different generations of populations remains the same, that is, the number of combined semantic attack sequences included in the new generation population is the same as the number of combined semantic attack sequences included in the initial population.

[0082] In an embodiment of the present invention, when selecting a new generation population from the merged population, a combined semantic attack sequence with a smaller non-dominated sorting number is preferentially selected; when the non-dominated sorting numbers of multiple combined semantic attack sequences are the same, a combined semantic attack sequence with a smaller congestion degree is preferentially selected.

[0083] Step 46, randomly selecting a combined semantic attack sequence on the first Pareto front in the new generation population, and performing a neighborhood search dimension by dimension in the sequence length direction based on the selected combined semantic attack sequence to obtain the neighborhood of the combined semantic attack sequence in each dimension, and sequentially evaluating each combined semantic attack sequence in the neighborhood using a deep neural network model for each neighborhood, and replacing the currently selected combined semantic attack sequence with a combined semantic attack sequence with a better evaluation result;

[0084] In an embodiment of the present invention, the neighborhood of a combined semantic attack sequence in one dimension in the sequence length direction is composed of other combined semantic attack sequences whose semantic attack types in the current dimension are different from those of the current combined semantic attack sequence, but whose semantic attack types in other dimensions are the same as those of the current combined semantic attack sequence.

[0085] Step 47, after completing the neighborhood search and evaluation replacement under the current sequence length, the sequence length is increased by one, and based on the selected combined semantic attack sequence, a neighborhood search is performed dimension by dimension in the direction of the sequence length to obtain the neighborhood of the combined semantic attack sequence in each dimension, and each combined semantic attack sequence in the neighborhood is evaluated using a deep neural network model for each neighborhood in turn, and the currently selected combined semantic attack sequence is replaced with a combined semantic attack sequence with a better evaluation result;

[0086] Step 48, iterating the loop of step 47 until the preset first termination condition is reached and then proceeding to the next step;

[0087] In the embodiment of the present invention, the first termination condition is specifically set according to actual needs, for example, the number of loop iterations reaches a set number or the current evaluation result meets the set requirements.

[0088] Step 49, determine whether the preset second termination condition is met. If not, use the latest determined population as the current population and return to step 42 to continue the loop iteration. If so, use the deep neural network model to evaluate each combined semantic attack sequence in the latest determined population and output the combined semantic attack sequence with the best evaluation result.

[0089] In the embodiment of the present invention, the second termination condition is specifically set according to actual needs, for example, the number of loop iterations reaches a set number or the current evaluation result meets the set requirements.

[0090] In the above steps, the combined semantic attack sequence is evaluated using a deep neural network model, which specifically includes the following steps:

[0091] A specific disturbance value of each semantic attack included in the combined semantic attack sequence is selected from the disturbance interval corresponding to each pre-defined semantic attack to obtain a combined semantic attack sequence with a determined disturbance value; a combined semantic attack is added to a sample image according to the combined semantic attack sequence to obtain a combined semantic adversarial sample corresponding to the combined semantic attack sequence; the combined semantic adversarial sample is input into a deep neural network model to obtain a detection result output by the deep neural network model; and based on the detection result output by the deep neural network model, an optimization target value corresponding to the combined semantic attack sequence is calculated as an evaluation result corresponding to the combined semantic attack sequence.

[0092] In the embodiment of the present invention, the smaller the corresponding optimization target value is, the better the evaluation result is.

[0093] In an embodiment of the present invention, by optimizing the length and order of the combined semantic attack sequence using the above method, the optimal combined semantic attack sequence can be obtained, so that the combined semantic adversarial samples generated according to the combined semantic attack sequence have better attack effects, so as to better evaluate the robust performance of the deep neural network model.

[0094] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In addition, "front", "back", "left", "right", "upper" and "lower" in this article are all referenced to the placement state shown in the accompanying drawings.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm, characterized in that: The method comprises: Initialize the length of the combined semantic attack sequence, where the length of the combined semantic attack sequence represents the number of semantic attacks contained in the combined semantic attack sequence; Randomly sample from a predefined semantic attack search space to obtain multiple combined semantic attack sequences; Selecting a specific disturbance value of each semantic attack included in the combined semantic attack sequence from the disturbance interval corresponding to each predefined semantic attack, and obtaining a plurality of combined semantic attack sequences with determined disturbance values; A sample image is obtained, and combined semantic attacks are added to the sample image according to the combined semantic attack sequence to obtain the combined semantic adversarial samples corresponding to each combined semantic attack sequence. Multiple combined semantic adversarial samples are respectively input into the deep neural network model to be evaluated to obtain the detection results output by the deep neural network model. Based on multiple combined semantic attack sequences and the output of the deep neural network model, the length and order of the combined semantic attack sequence are optimized using a genetic algorithm based on non-dominated sorting and a neighborhood search to search for the optimal combined semantic attack sequence.

2. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 1 is characterized in that: Randomly sampling from a predefined semantic attack search space to obtain multiple combined semantic attack sequences, further comprising: According to the length of the initialized combined semantic attack sequence, a corresponding number of semantic attacks are randomly sampled from a predefined semantic attack search space to obtain a combined semantic attack sequence; Repeat the above process multiple times to obtain multiple combined semantic attack sequences.

3. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 1 or 2, characterized in that: The semantic attack search space includes: hue attack, saturation attack, brightness attack, rotation attack, and contrast attack.

4. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 1 is characterized in that: Based on multiple combined semantic attack sequences and the output of the deep neural network model, the length and order of the combined semantic attack sequences are optimized using a genetic algorithm based on non-dominated sorting and a neighborhood search, further comprising: Step 41, taking multiple combined semantic attack sequences as the initial population; Step 42, according to the detection results output by the deep neural network model, calculate the optimization target value corresponding to each combined semantic attack sequence in the current population, and the optimization target value corresponding to the combined semantic attack sequence is defined as the robust accuracy obtained by the combined semantic attack sequence attacking the deep neural network model and the time required to complete the entire attack; Step 43, based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences; Step 44, merging the current population and the intermediate population, and performing non-dominated sorting and crowding distance calculation on the merged population; Step 45, selecting a new generation population from the merged population according to the calculation results of the non-dominated sorting and the crowding distance; Step 46, randomly selecting a combined semantic attack sequence on the first Pareto front in the new generation population, and performing a neighborhood search dimension by dimension in the sequence length direction based on the selected combined semantic attack sequence to obtain the neighborhood of the combined semantic attack sequence in each dimension, and sequentially evaluating each combined semantic attack sequence in the neighborhood using a deep neural network model for each neighborhood, and replacing the currently selected combined semantic attack sequence with a combined semantic attack sequence with a better evaluation result; Step 47, after completing the neighborhood search and evaluation replacement under the current sequence length, the sequence length is increased by one, and based on the selected combined semantic attack sequence, a neighborhood search is performed dimension by dimension in the direction of the sequence length to obtain the neighborhood of the combined semantic attack sequence in each dimension, and each combined semantic attack sequence in the neighborhood is evaluated using a deep neural network model for each neighborhood in turn, and the currently selected combined semantic attack sequence is replaced with a combined semantic attack sequence with a better evaluation result; Step 48, iterating the loop of step 47 until the preset first termination condition is reached and then proceeding to the next step; Step 49, determine whether the preset second termination condition is met. If not, use the latest determined population as the current population and return to step 42 to continue the loop iteration. If so, use the deep neural network model to evaluate each combined semantic attack sequence in the latest determined population and output the combined semantic attack sequence with the best evaluation result.

5. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 4 is characterized in that: Based on the current population and the optimization target value corresponding to each combined semantic attack sequence in the current population, population mutation, crossover and selection operations are performed to obtain an intermediate population including multiple combined semantic attack sequences, further comprising: Step 431, performing a mutation operation based on the current population to obtain multiple mutant individuals; Step 432, performing a crossover operation based on the current population and its corresponding mutant individuals to obtain a descendant population corresponding to the current population; Step 433, based on the current population and its corresponding offspring population, a selection operation is performed with the goal of minimizing the optimization target value corresponding to the individual to obtain an intermediate population; Wherein, the individuals represent combined semantic attack sequences.

6. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 4 is characterized in that: When selecting a new generation of populations from the merged population, the combined semantic attack sequence with a smaller non-dominated sorting number is preferred. When the non-dominated sorting numbers of multiple combined semantic attack sequences are the same, the combined semantic attack sequence with a smaller crowding degree is preferred.

7. The variable-length combined semantic perturbation method based on a multi-objective evolutionary algorithm according to claim 4 is characterized in that: The combined semantic attack sequence is evaluated using a deep neural network model, which includes the following steps: A specific disturbance value of each semantic attack included in the combined semantic attack sequence is selected from the disturbance interval corresponding to each pre-defined semantic attack to obtain a combined semantic attack sequence with a determined disturbance value; a combined semantic attack is added to a sample image according to the combined semantic attack sequence to obtain a combined semantic adversarial sample corresponding to the combined semantic attack sequence; the combined semantic adversarial sample is input into a deep neural network model to obtain a detection result output by the deep neural network model; and based on the detection result output by the deep neural network model, an optimization target value corresponding to the combined semantic attack sequence is calculated as an evaluation result corresponding to the combined semantic attack sequence.

Images