Image interference method based on novel chaos PGD algorithm

Abstract

The invention discloses an image interference method based on a novel chaos PGD algorithm, and relates to the technical field of image interference. On the basis of the PGD algorithm, in combination with the pseudo-randomness, bounded ergodicity and complex dynamic characteristics of a chaotic system, by introducing chaotic initial disturbance and chaotic variable step size, in combination with the characteristics of no target attack, and by adding a PSNR mechanism, the chaotic PGD algorithm overcomes the parameter limitation in the traditional PGD algorithm, the algorithm performance is remarkably improved, and compared with the traditional PGD algorithm, the algorithm performance is improved. The chaos PGD algorithm has the advantages that after interference is applied to the same input image, a target detection model can generate the same error detection result, but different prediction probabilities are output, and even completely different error detection results are caused.

Description

[0001] The present invention relates to the technical field of image interference, and particularly to an image interference method based on a novel chaotic PGD algorithm. Background Art

[0002] With the rapid development of artificial intelligence technology, deep learning has made remarkable progress in tasks such as image recognition, object detection, intelligent monitoring, and autonomous driving. However, deep learning faces various security threats throughout its entire life cycle, including data poisoning, reverse attacks, information theft, and adversarial attacks. These security challenges are particularly prominent in fields such as autonomous driving, intelligent monitoring, and medical diagnosis. Because once the deep learning model is attacked, it may lead to incorrect decisions, resulting in property losses or even casualties. For example, an attacker can fine-tune a road sign image to cause the autonomous driving system to misidentify the road sign information, leading the vehicle to make incorrect decisions and increasing the risk of traffic accidents. In a face recognition or voice recognition system, an attacker can add adversarial perturbations to prevent the authentication system from correctly identifying the user's identity, or even misidentifying a legitimate user as someone else, thereby achieving illegal purposes. In addition, an attacker may also make adversarial modifications to images or videos to avoid monitoring and detection. These attack methods seriously affect the security and reliability of deep learning systems in practical applications.

[0003] Among these security threats, adversarial attacks have become an important means to explore the vulnerability of deep learning due to their simplicity and high automation. Adversarial attacks cause deep learning models to misclassify or make incorrect decisions by imposing subtle and usually imperceptible perturbations on the original data. These perturbations may be very small, even imperceptible to the naked eye, but are sufficient to cause significant deviations in the model. The original data with added perturbations is called an adversarial sample.

[0004] In 2018, Madry et al. proposed the Projected Gradient Descent (PGD) algorithm. By initializing adversarial samples with uniformly distributed perturbations within the constraint space during multiple restarts, this method enables the attack to be launched from different starting points and achieves relatively excellent attack effects. However, the PGD algorithm still has two limitations. First, although random initialization helps avoid getting stuck in a fixed initial solution, it may still cause the optimization process to stay at a local optimal solution, especially when there are multiple local extrema in the original data. Second, the PGD algorithm uses a fixed step size, which is not always applicable when dealing with different types of problems. If the step size is too large, especially when approaching the optimal solution, the gradient update may be excessive, resulting in skipping the optimal solution or even causing the algorithm to diverge. On the contrary, a too small step size may lead to an overly slow convergence rate or even fail to reach an effective solution within a limited number of iterations. When dealing with complex problems, the change in the objective function may be relatively drastic, and the fixed step size cannot be dynamically adjusted according to this change, thus limiting the performance of the algorithm in complex optimization scenarios.

[0005] Therefore, the present invention proposes an image interference method based on a novel chaotic PGD algorithm. This algorithm is based on the PGD algorithm and combines the pseudo-randomness, bounded ergodicity, and complex dynamic characteristics of the chaotic system. By introducing chaotic initial perturbations and chaotic variable step sizes, and combining the characteristics of untargeted attacks and adding the PSNR mechanism, the chaotic PGD algorithm overcomes the parameter limitations in the traditional PGD algorithm and significantly improves the algorithm performance. Compared with the traditional PGD algorithm, the advantage of the chaotic PGD algorithm is that it can cause the classifier to produce the same misclassification result but output different prediction probabilities, or even lead to completely different misclassification results after interfering with the same input image. Moreover, no additional parameter settings are required, making it more versatile. This characteristic gives the chaotic PGD algorithm higher diversity and unpredictability, thereby improving its concealment and effectiveness in adversarial attacks. Summary of the Invention

[0006] The object of the present invention is to provide an image interference method based on a novel chaotic PGD algorithm to solve the above problems.

[0007] To achieve the above object, the technical solution adopted by the present invention is as follows: It includes means for interfering with a target image, characterized in that, based on a chaotic system that can generate at most four-scroll attractors through equilibrium point migration, a stable double-scroll chaotic system is constructed by combining the Julia fractal process, and chaotic initial perturbations and chaotic variable step sizes are generated using the stable double-scroll chaotic system. The specific steps are as follows:

[0008] S1: Establish a new three-dimensional chaotic system. The new three-dimensional chaotic system includes a non-linear term and six linear terms, and its mathematical equation is as follows:

[0009]

[0010] Where, are state variables, are system parameters;

[0011] S2: Through the migration of the equilibrium point, the new three-dimensional chaotic system can generate up to four-scroll attractors at most;

[0012] S3: Then, take the capacitor voltage as the state variable in Equation (1), and use the resistance ratio as the system parameter in Equation (1), and directly transform it into an analog circuit through a mathematical expression.

[0013] Let , and perform a time-scale transformation on Equation (1), where is the time-scale transformation factor, and Equation (2) can be obtained:

[0014]

[0015] Take , and substitute the parameter , and Equation (3) can be obtained:

[0016]

[0017] Use Equation (3) to construct an analog circuit corresponding to Equation (1);

[0018] S4: After establishing Equation (1), introduce the Julia fractal into Equation (1), and replace in Equation (1) with , and Equation (4) can be obtained:

[0019]

[0020] After passing through the Julia fractal, the new three-dimensional chaotic system becomes a stable double-scroll chaotic system;

[0021] S5: Then generate chaotic initial perturbations and chaotic variable step sizes through the double-scroll chaotic system;

[0022] S6: Substitute the obtained chaotic initial perturbations and chaotic variable step sizes into the improvement of the original classical PGD algorithm to obtain the chaotic PGD algorithm;

[0023] S7: Interfere with the target image using the chaotic PGD algorithm.

[0024] Furthermore, the Julia fractal process in S4 is described as follows:

[0025]

[0026] Among them

[0027]

[0028]

[0029]

[0030] Among them, is a complex constant, , substituting Equation (6) and Equation (7) into Equation (5), the relationship shown in Equation (9) can be obtained:

[0031]

[0032] Apply the Julia fractal process in some dimensions of Equation (4) to achieve variable substitution, as shown in Equation 10:

[0033]

[0034] Differentiating both sides of Equation (10) gives Equation (11):

[0035]

[0036] Among them,

[0037]

[0038] From Equation (11), it can be obtained that:

[0039]

[0040] Among them,

[0041]

[0042] Combining Equation (4) and Equation (10), Equation (15) can be obtained

[0043]

[0044] Combining Equation (13) and Equation (15), the chaotic system generated by the combination of the Julia fractal and the new three-dimensional chaotic system can be obtained as follows:

[0045]

[0046] where, is the state variable, is the system parameter,

[0047] Furthermore, the generation steps of the chaotic initial perturbation are as follows:

[0048] Step 1: Use an ODE solver to solve the numerical solution of Equation (16),

[0049]

[0050] Step 2: Scalar normalization, perform min-max normalization on ;

[0051]

[0052] Step 3: Generate the chaotic initial perturbation, randomly select 150528 values from and rearrange them into a tensor with shape (1, 3, 224, 224);

[0053]

[0054] The generation steps of the chaotic variable step size are as follows:

[0055] Step 1: Use an ODE solver to solve the numerical solution of Equation (16);

[0056]

[0057] Step 2: Perform min-max normalization on ;

[0058]

[0059] Step 3: Randomly select 1 value from as the step size in this iteration process:

[0060]

[0061] Furthermore, the core of the chaotic PGD algorithm is as follows:

[0062]

[0063]

[0064]

[0065]

[0066]

[0067] Among them, represents the original sample, represents the adversarial sample, represents the adversarial sample after t iterations, represents the chaotic initial perturbation generated by Equation (16), represents the adversarial perturbation, represents the chaotic variable step size generated by Equation (16), represents the sign function, represents the gradient of, represents the loss function, represents the classifier model parameters, represents the label of the original sample, represents the label of the adversarial sample, and PSNR represents the peak signal-to-noise ratio between the two samples.

[0068] Compared with the prior art, the present invention has the following beneficial effects:

[0069] 1. The adversarial images generated by the chaotic PGD algorithm can cause the classifier to misclassify into multiple categories, revealing that there may be intersections and ambiguities in the decision boundaries of the classifier between different categories. This indicates that the perturbations of the chaotic PGD algorithm cover a wider range in the search space and can explore more potential perturbation methods, thereby revealing the potential characteristics and vulnerabilities of the classifier on the multi-class decision boundary. The diversity of this perturbation distribution not only reveals the vulnerable points of the classifier but also can identify more potential weaknesses, rather than just focusing on a specific vulnerable point. Introducing the chaotic mechanism makes the generation path of the adversarial image more complex, prompting the attack algorithm to avoid the explicit gradient direction, thus generating samples that are difficult to explain. This complexity provides new ideas for designing stronger defense mechanisms

[0070] 2. The adversarial images generated by the chaotic PGD algorithm can not only make the classifier misclassify into multiple categories, but also have a low confidence level, indicating that the classification results of the classifier for these samples are not stable. The low confidence level means that the adversarial images generated by the chaotic PGD algorithm can more effectively disrupt the discriminative ability of the classifier, resulting in confusion among multiple categories for the classifier. In contrast, although the classical PGD algorithm can cause misclassification by the classifier, the classifier still maintains a high confidence level, indicating that the classifier has a strong inertia in misjudging specific adversarial images. This inertia may make it easier for the defense mechanism to identify and counteract. The low confidence level is of great significance to the defense mechanism because low-confidence samples can prompt the defense mechanism to strengthen learning or optimization near the classification boundary, thereby improving the overall robustness of the classifier. In addition, due to the high discreteness and diversity of the distribution of low-confidence samples, the detection difficulty is relatively high. The defense strategy for these samples needs to be more meticulous and flexible to effectively cope with the challenges from chaotic perturbations.

[0071] 3. The "single-class high-confidence error" generated by the classical PGD algorithm may be applicable to the evaluation of specific defense mechanisms, while the "multi-class low-confidence error" generated by the chaotic PGD algorithm is more closely related to the complex distribution of adversarial attack scenarios in the actual situation. The chaotic PGD algorithm simulates a wider and more realistic attack scenario, so it has greater practical significance in improving the robustness of the classifier in complex environments. In practical applications, the distribution of adversarial images is usually complex and diverse. Adversarial attacks with diversity can more comprehensively reveal the potential weaknesses of the classifier, rather than just focusing on a specific vulnerability. If a defense mechanism performs well on the adversarial images generated by the classical PGD, but has poor performance on the adversarial images generated by the chaotic PGD algorithm, this indicates that the defense mechanism may be overfitted to a certain type of attack. Therefore, the low-confidence samples generated by the chaotic PGD algorithm can be used as a new standard for robustness evaluation, providing guidance for the development of more general and robust defense methods. By studying the low-confidence and diverse-distribution adversarial samples, the defense mechanism can more effectively cope with complex and variable attack scenarios, thereby improving the anti-interference ability of the classifier in various real scenarios.

[0072] 4. The classical PGD algorithm can quickly generate high-confidence error samples, mainly applicable to evaluating the vulnerability of classifiers under specific categories; while the chaotic PGD algorithm generates adversarial images with diversity, low confidence, and cross-category errors by introducing complex chaotic dynamic behaviors, thus being able to more comprehensively evaluate the robustness of classifiers. The comparison between the two not only provides a deeper perspective for the evaluation of classifier robustness but also offers important inspirations for the improvement of adversarial defense strategies and future algorithm innovations. The diversity and unpredictability of the chaotic PGD algorithm endow it with unique advantages in simulating complex attack scenarios, providing a richer basis for the design and optimization of defense mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is the phase diagram of the system equation (1) of the present invention;

[0074] Figure 2 It is the periodically varying parameter of the present invention and The schematic diagram of the four-scroll chaotic attractor generated;

[0075] Figure 3 It is the simulation circuit of the system equation 1 of the present invention;

[0076] Figure 4 It is the phase diagram of the system equation (16) of the present invention;

[0077] Figure 5 It is the statistical characteristic diagram of generating chaotic initial perturbation and chaotic variable step size using the chaotic system equation (16) of the present invention;

[0078] Figure 6 It is the schematic diagram of the chaotic PGD algorithm of the present invention;

[0079] Figure 7 It is the misclassification result of the classifier caused by the adversarial images generated by the chaotic PGD algorithm and the classical PGD algorithm of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0080] To make the technical means, creative features, achieved purposes, and effects of the present invention easy to understand, the present invention will be further described below in conjunction with specific embodiments.

[0081] The present invention first proposes a new type of three-dimensional chaotic system, which only contains one non-linear term and six linear terms, and its mathematical equation form is very simple, as shown below:

[0082]

[0083] Wherein, is the state variable, is a system parameter. When the system parameter , the phase diagram at the system initial value is as follows, as shown in Figure 1 :

[0084] Figure 1 is the phase diagram of a single-scroll chaotic system. Among them, (a) is the x-y plane, (b) is the x-z plane, and (c) is the y-z plane.

[0085] When using a set of parameters and where the positive and negative values change periodically, as shown in Figure 2 (a)(b) to replace the fixed parameters and in Equation (55), the four-scroll attractor shown in Figure 2 (c) can be obtained. In addition, we also list six ways to generate the four-scroll attractor in Table 1. The six four-scroll attractors are all generated by migrating the equilibrium points of the single-scroll attractor, and they have the same appearance of the four-scroll attractor, but the migration order of the equilibrium points is completely different, greatly enhancing the complexity of the four-scroll system.

[0086] Table 1. Six ways to generate the four-scroll chaotic attractor

[0087]

[0088] By taking the capacitor voltage as the state variable in Equation (55) and using the resistance ratio to describe the system parameters, the mathematical expression can be directly transformed into an analog circuit.

[0089] Let , and perform a time-scale transformation on Equation (55), where is the time-scale transformation factor, and Equation (56)

[0090]

[0091] Take , and substitute the parameter , and Equation (57) can be obtained.

[0092]

[0093] According to Equation (57), the circuit design of Equation (55) is as shown in Figure 3 . Among them, the operational amplifier is TL082CP, the multiplier is AD633, the positive power supply voltage VDD is 15V, and the negative power supply voltage VEE is -15V.

[0094] (1) Design of Multi-scroll Chaotic Attractor Based on Julia Fractal

[0095] Equation (55) has the advantages of simple mathematical expression and simple circuit structure. However, the control of the number of scrolls depends on the switching of the control switch, which makes its adjustment process relatively cumbersome. Therefore, Julia fractal is introduced into the single-scroll chaotic system.

[0096] For the convenience of subsequent analysis, in Equation (55), is replaced by , and the system (58) is obtained

[0097]

[0098] The Julia fractal process can be expressed as follows:

[0099]

[0100] where

[0101]

[0102]

[0103]

[0104] where, is a complex constant. In the present invention, it is uniformly set that . Substituting Equation (60) and Equation (61) into Equation (59), the relationship shown in Equation (63) can be obtained

[0105]

[0106] Applying the Julia fractal process in some dimensions of Equation (58) to achieve variable substitution, as shown in Equation (64):

[0107]

[0108] Taking the derivative of both sides of Equation (58) gives Equation (65)

[0109]

[0110] where

[0111]

[0112] From equation (65), we can obtain

[0113]

[0114] where

[0115]

[0116] Combining equation (68) and equation (64), we can obtain equation (69)

[0117]

[0118] Combining equation (67) and equation (69), we can obtain the chaotic system generated by the combination of the Julia fractal and the single-scroll chaotic system, as follows:

[0119]

[0120] where is the state variable, is the system parameter. When the system parameter , the initial value of the system , the phase diagram of equation (70) is as shown in Figure 4 . It is not difficult to find that after the Julia fractal, the single-scroll chaotic system becomes a stable double-scroll chaotic system.

[0121] Figure 4 In (a) is the x-y plane, and in (b) is the x-z plane.

[0122] (2) Chaotic PGD algorithm

[0123] The core of the chaotic PGD algorithm can be described as follows:

[0124]

[0125]

[0126]

[0127]

[0128]

[0129] where Denote the original sample, Denote the adversarial sample, Denote the adversarial sample after t iterations, Denote the chaotic initial perturbation generated by Equation (70), Denote the adversarial perturbation, Denote the chaotic variable step size generated by Equation (70), Denote the sign function, Denote The gradient of Denote the loss function, Denote the classifier model parameters, Denote the label of the original sample, Denote the label of the adversarial sample, and PSNR represents the peak signal-to-noise ratio between the two samples.

[0130] Among them, the chaotic initial perturbation and the chaotic variable step size are generated by the double-scroll chaotic system.

[0131] The generation steps of the chaotic initial perturbation are as follows:

[0132] Step 1: Solve the chaotic equation. Use an ODE solver to solve the numerical solution of Equation (70).

[0133]

[0134] Step 2: Scalar normalization. Perform min-max normalization on

[0135]

[0136] Step 3: Generate the chaotic initial perturbation. Randomly select 150528 values (with replacement) from and rearrange them into a tensor with shape (1, 3, 224, 224).

[0137]

[0138] From The frequency distribution of randomly selecting 150528 values (with replacement) is as shown in Figure 5 (a).

[0139] The generation steps of the chaotic variable step size are as follows:

[0140] Step 1: Solve the chaotic equation. Use an ODE solver to solve the numerical solution of Equation (70).

[0141]

[0142] Step 2: Scalar normalization. For perform min-max normalization.

[0143]

[0144] Step 3: Generate chaotic variable step size. Randomly select 1 value (with replacement) from as the step size in this iteration process.

[0145]

[0146] From the frequency distribution of randomly selecting 150528 values (with replacement) is as Figure 5 shown in (b).

[0147] The overall process of the chaotic PGD algorithm can be described as Figure 6 shown, and the dashed line represents that this process is only executed once at the beginning of the algorithm iteration.

[0148] Figure 7 shows the results of adversarial images generated using the chaotic PGD algorithm and the classical PGD algorithm respectively. It should be particularly noted that the adversarial images generated by the classical PGD algorithm usually cause the classifier to misclassify with extremely high confidence as a fixed category, while the adversarial images generated by the chaotic PGD algorithm can cause the classifier to misclassify with relatively low confidence as multiple categories, and the quality of the generated adversarial images is higher. Figure 7 shows three results of adversarial images generated by the chaotic PGD algorithm. Due to space limitations, only partial results are shown. In fact, the chaotic PGD algorithm can generate more adversarial images, and the misclassification categories and confidence distributions of each image are more diverse.

[0149] Figure 7 In, a1, b1, c1, d1, e1 are the misclassification results of the classifier caused by the adversarial images generated by the classical PGD algorithm, and a2, a3, a4, b2, b3, b4, c2, c3, c4, d2, d3, d4, e2, e3, e4 are the misclassification results of the classifier caused by the adversarial images generated by the chaotic PGD algorithm.

[0150] In addition, in a large number of experiments, we also found a set of special experimental results, such as Figure 7(c1)-(c4) as shown. In this set of experiments, adversarial images generated using the chaotic PGD algorithm and the classical PGD algorithm both caused the classifier to misclassify as a fixed category with extremely high confidence. This phenomenon indicates that under specific conditions, the perturbations generated by the two algorithms may produce similar attack effects, although in most cases, the chaotic PGD algorithm exhibits more diverse misclassification results.

[0151] The environmental configuration implemented by the present invention is shown in Table 2. The datasets used are the ImageNet ISLVRC2012 and the Animal Image Dataset (90 Different Animals) provided by Sourav Banerjee on the Kaggle platform [2] A mixed dataset of the two. The image classification models used include classic models such as VGG16, VGG19, ResNet18, and ResNet50. During the experiment, all image classification models used the pre-trained versions and no modifications or improvements were made. The image data in the experiment was randomly selected from the datasets and no preprocessing (such as data augmentation, illumination correction, denoising, or smoothing) was performed to ensure the objectivity and effectiveness of the results.

[0152] Table 2. Device environment and related configurations.

[0153]

[0154] For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and without departing from the spirit or basic characteristics of the present invention, the present invention can be implemented in other specific forms. Therefore, in any regard, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be encompassed within the present invention. Any reference signs in the claims should not be regarded as limiting the claims involved.

[0155] In addition, it should be understood that although this specification is described according to embodiments, not every embodiment only contains an independent technical solution. This narrative manner of the specification is only for clarity. Those skilled in the art should regard the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. An image interference method based on a novel chaotic PGD algorithm, comprising interference with a target image, characterized in that: Based on the chaotic system that can generate up to four scroll attractors through equilibrium point migration, a stable double scroll chaotic system is constructed in combination with the Julia fractal process. The chaotic initial perturbation and chaotic variable step size are generated using the stable double scroll chaotic system. The specific steps are as follows: S1: Establish a new three-dimensional chaotic system. The new three-dimensional chaotic system includes one nonlinear term and six linear terms. Its mathematical equation form is as follows: in, is the state variable, is the system parameter; S2: Through equilibrium point migration, the new three-dimensional chaotic system can generate up to four scroll attractors; S3: Then the capacitor voltage is used as the state variable in equation (1), and the resistance ratio is used as the system parameter in equation (1), which is directly converted into an analog circuit through mathematical expressions; make , transform the time scale of equation (1), where is the time scale transformation factor, and equation (2) can be obtained: Pick , and substitute the parameters , we can get equation (3): Use equation (3) to construct the analog circuit corresponding to equation (1); S4: After establishing equation (1), the Julia fractal is introduced into equation (1) to replace Replace with , we get equation (4): After the Julia fractal, the new three-dimensional chaotic system becomes a stable double-scroll chaotic system; S5: Generate chaotic initial disturbance and chaotic variable step size through the double scroll chaotic system; S6: Substitute the obtained chaotic initial disturbance and chaotic variable step size into the improvement of the original classical PGD algorithm to obtain the chaotic PGD algorithm; S7: Use the chaotic PGD algorithm to interfere with the target image.

2. The image interference method based on the novel chaotic PGD algorithm according to claim 1 is characterized in that: The Julia fractal process in S4 is described as follows: in in, is a complex constant, , substituting equation (6) and equation (7) into equation (5), we can obtain the relationship shown in equation (9): Applying the Julia fractal process in some dimensions of equation (4) to achieve variable substitution is shown in equation 10: Taking the derivative of both sides of equation (10) yields equation (11): in, From equation (11), we can get: in, Combining equation (4) and equation (10), we can get equation (15) Combining equation (13) and equation (15), we can get the chaotic system generated by the combination of Julia fractal and the new three-dimensional chaotic system, as shown below: in, is the state variable, is the system parameter.

3. The image interference method based on the novel chaotic PGD algorithm according to claim 1 is characterized in that: In S5, the steps for generating the initial chaotic disturbance are as follows: Step 1: Use an ODE solver to find the numerical solution of equation (16). Step 2: Scalar normalization, Perform minimum-maximum normalization; Step 3: Generate the initial chaotic disturbance from Randomly select 150528 values ​​from and rearrange them into a tensor of shape (1,3,224,224); The steps for generating chaotic variable step size are as follows: Step 1: Use the ODE solver to find the numerical solution of equation (16); Step 2: Perform minimum-maximum normalization; Step 3: From A value is randomly selected as the step size in this iteration: 。 4. The image interference method based on the novel chaotic PGD algorithm according to claim 1 is characterized in that: The core of the chaotic PGD algorithm is as follows: in, represents the original sample, represents adversarial samples, represents the adversarial sample after t iterations, represents the chaotic initial disturbance generated by equation (16), represents the counter-perturbation, represents the chaotic variable step size generated by equation (16), represents the symbolic function, express The gradient of represents the loss function, represents the classifier model parameters, represents the label of the original sample, represents the label of the adversarial sample, and PSNR represents the peak signal-to-noise ratio between two samples.

Images