A deep neural network attack method based on important neurons

Abstract

The application relates to the field of trusted artificial intelligence and computer vision technology, in particular to a deep neural network attack method based on important neurons, which comprises the following steps: setting corresponding running parameters for a source model; when the iteration number matches the running parameters, calculating the importance scores of all neurons in the source model when the iteration number reaches the pre-set running parameters, generating a binary mask, and obtaining a mask model after the mask; outputting an adversarial sample, calculating the cross-entropy loss of the adversarial sample and the corresponding true label through the mask model and the source model respectively, and correspondingly obtaining the first gradient and the second gradient of the cross-entropy loss with respect to the adversarial sample, and weighting the first gradient and the second gradient to obtain a total gradient; updating the iteration adversarial sample according to the total gradient in sequence until the iteration ends, and generating a final version of the adversarial sample; important features of the corresponding image category can be better positioned, and the success rate of the adversarial sample facing different attack target models can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of trusted artificial intelligence and computer vision technology, in particular to a deep neural network attack method based on important neurons. BACKGROUND

[0002] In recent years, the field of computer vision has focused on the problem of generating adversarial samples. Small image perturbations can attack deep neural networks, raising concerns about the security of neural networks. Black-box transfer attacks, in which the attacker does not know the information of the target model, attack the target model through the source model, have high transferability, are difficult to defend, and are helpful in discovering defects in neural networks in practical applications and guiding network performance improvement. The phenomenon of adversarial samples has prompted a rethinking of the reliability and security of artificial intelligence, and exploring methods for explaining neural networks and analyzing the mechanisms of adversarial samples has become a key research topic. Furthermore, the explainable method based on network path attribution, as an important branch of understanding the decision-making process of neural networks, has attracted much attention because it can visually display the path nodes that affect decision-making. However, there is still a lack of unified framework in the aspects of attribution visualization and evaluation criteria, and the relevant work of network path explainable method in adversarial attack problem is still very little, resulting in poor performance in balancing the timeliness and transferability of adversarial attack.

[0003] Unlike the new perspective based on network path, the mainstream black-box transfer attack scheme includes data perspective and optimization perspective. The data perspective is inspired by data augmentation techniques in the field of machine learning, and a series of established transformations such as scaling, cropping, and rotating are used to reduce the overfitting of adversarial samples to the source model. The optimization perspective relies on traditional numerical algorithms to use a fine iterative process to ensure that the algorithm seeks transferable adversarial samples. Typically, a momentum-based gradient optimization attack method is used. Regardless of the data perspective or the optimization perspective, the corresponding adversarial attack scheme lacks a credible mechanism, especially without explicitly involving the decision-making process of the neural network, which undoubtedly increases the uncertainty of the adversarial attack effect. SUMMARY

[0004] In order to solve the technical problems of poor timeliness and transferability of existing network path-based adversarial attacks, lack of credible mechanism support for black-box transfer attacks, and high uncertainty of adversarial attack effect, the purpose of the present application is to provide a deep neural network attack method based on important neurons. The technical solution adopted is as follows:

[0005] Prepare the data set and the source model in sequence. The data set includes input samples and corresponding true labels, and the source model is set with corresponding running parameters. The data set is iterated, and when the number of iterations reaches the pre-set running parameter, the importance score of all neurons in the source model is calculated, a binary mask is generated, and a masked model is obtained after masking.

[0006] After the number of iterations reaches the preset running parameters, adversarial examples are output. The cross-entropy loss between the adversarial examples and the corresponding real labels is calculated using the mask model and the source model, respectively. The first and second gradients of the cross-entropy loss with respect to the adversarial examples are obtained. The total gradient is obtained by weighting the first and second gradients.

[0007] The adversarial examples are updated sequentially based on the total gradient until the iteration ends, generating the final version of the adversarial examples.

[0008] Preferably, the operating parameters include total number of iterations, maximum allowable distortion, momentum factor, mask ratio, number of mask iterations, balance parameter, step size, and update cycle, wherein the calculation formula for the update cycle is:

[0009]

[0010] in, Indicates the update cycle; Indicates the total number of iterations; Indicates the number of times the mask has been applied.

[0011] Preferably, when the number of iterations reaches the preset running parameters, the importance scores of all neurons in the source model are calculated, a binary mask is generated, and a masked model is obtained, including:

[0012] When the number of iterations reaches the update cycle, the importance scores of all neurons in the source model are obtained using the neuron importance calculation method.

[0013] The neurons in each layer are sorted in descending order based on their importance scores, and the binary mask is determined layer by layer by the mask ratio.

[0014] The mask model is obtained by combining the binary mask with the source model. The corresponding calculation formula is as follows:

[0015]

[0016] in, Represents the mask model; Represent the source model; This represents the element-wise product between the neuron and the binary mask. This represents a binary mask.

[0017] Preferably, the importance scores of all neurons in the source model are obtained using a neuron importance calculation method, and the corresponding calculation formula is as follows:

[0018]

[0019] in, Indicates the first The first layer a neuron for an input sample importance score of the input sample; an input sample representing a data set output by a network of a source model; an input sample representing and the neuron activation response tends to 0, the network output; an activation response value of the layer.

[0020] Preferably, the adversarial sample is output after the number of iterations reaches the pre-set running parameter, the cross-entropy loss of the adversarial sample and the corresponding true label is calculated by the mask model and the source model respectively, and the first gradient and the second gradient of the cross-entropy loss with respect to the adversarial sample are obtained correspondingly, and the total gradient is obtained by weighting the first gradient and the second gradient, including:

[0021] When the number of iterations reaches the pre-set running parameter, the adversarial sample after the corresponding number of iterations is output , and the corresponding true label

[0022] The cross-entropy loss of the adversarial sample and the corresponding true label calculated by the mask model is , and the cross-entropy loss of the adversarial sample and the corresponding true label calculated by the source model is .

[0023] The first gradient and the second gradient are obtained in turn according to the back propagation method according to the cross-entropy loss respectively, and the total gradient is obtained by weighting the first gradient and the second gradient through the balance parameter.

[0024] Preferably, the first gradient and the second gradient are obtained in turn according to the back propagation method according to the cross-entropy loss respectively, and the corresponding calculation formula is:

[0025]

[0026]

[0027] , wherein represents the first gradient; represents the second gradient; represents the gradient operator;

[0028] The total gradient is obtained by weighting the first gradient and the second gradient through the balance parameter, and the corresponding calculation formula is:

[0029]

[0030] , wherein represents the total gradient;​ represents the balance parameter.

[0031] Preferably, the iterative adversarial sample is updated according to the total gradient in turn until the iteration ends, and the final version of the adversarial sample is generated, comprising:

[0032] According to the total gradient, the adversarial sample is iteratively updated by using momentum, and the adversarial sample of the adjacent iteration is generated.

[0033] The iteration is continued for the adversarial sample of the adjacent iteration until the total number of iterations is reached, the iteration ends, and the final version of the adversarial sample is generated.

[0034] Preferably, according to the total gradient, the adversarial sample is iteratively updated by using momentum, and the adversarial sample of the adjacent iteration is generated, and the corresponding calculation formula is:

[0035]

[0036]

[0037] wherein, represents the adversarial sample of the adjacent iteration, namely the iteration; represents the adversarial sample of the iteration; represents a truncation function for satisfying the infinite norm constraint of the adversarial noise; represents the maximum perturbation; represents the step length of each iteration; represents a sign function; represents the momentum in the iteration; represents a momentum factor; represents the momentum in the iteration; represents the total gradient; represents a one-norm operation.

[0038] The present application has the following beneficial effects:

[0039] The adversarial attack method provided in the application improves the effect of adversarial sample transferability from the perspective of the explainability method of neural network path attribution, that is, analyzing a data set, when the number of iterations reaches an update period, calculating the importance score of important neurons through neuron contribution degree to determine a binary mask to effectively generate a mask model that is helpful to transfer attack, then calculating the cross-entropy loss of the adversarial sample and the corresponding true label through the mask model and the source model respectively, obtaining the first gradient and the second gradient, and obtaining the total gradient by weighting, that is, introducing the loss to ensure that the generated adversarial sample has strong robustness, and finally updating and iterating the adversarial sample to generate a final version of the adversarial sample; compared with the existing method, the important features of the corresponding image category can be better positioned, the success rate of adversarial attack of the adversarial sample to different attack target models is improved, that is, the deep neural network provides a reliable mechanism support, ensures the technical effect of the deep neural network used for adversarial attack, effectively issues a safety warning about the deep neural network model to the researchers or users, and helps to improve the safety of artificial intelligence research and application. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0041] Figure 1 An implementation flowchart of a deep neural network adversarial attack method based on important neurons provided by an embodiment of the present application;

[0042] Figure 2 An example flowchart of an adversarial sample single iteration algorithm of a deep neural network adversarial attack method based on important neurons provided by an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined invention purpose, the specific implementation, structure, features and effects of a deep neural network adversarial attack method based on important neurons according to the present application are described in detail as follows by combining with the drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0045] The application provides a specific scheme of an important neuron-based deep neural network adversarial attack method.

[0046] Please refer to Figure 1 , which shows a step flowchart of an important neuron-based deep neural network adversarial attack method provided by an embodiment of the application, and the method comprises the following steps.

[0047] Step S1: sequentially prepare a data set and a source model, the data set comprises input samples and corresponding real labels, and corresponding running parameters are set for the source model; the data set is iterated, and when the number of iterations reaches the pre-set running parameter, the importance scores of all neurons in the source model are calculated, a binary mask is generated, and a masked mask model is obtained.

[0048] Step S2: based on the output of the adversarial sample after the number of iterations reaches the pre-set running parameter, the cross-entropy loss of the adversarial sample and the corresponding real label is calculated through the mask model and the source model respectively, and the first gradient and the second gradient of the cross-entropy loss with respect to the adversarial sample are obtained, and the first gradient and the second gradient are weighted to obtain a total gradient.

[0049] Step S3: sequentially update the iteration adversarial sample according to the total gradient until the iteration ends, and generate a final version of the adversarial sample.

[0050] For better illustration, in a deep learning model, when facing an input of a small perturbation or a malicious construction, i.e., an adversarial sample, an error prediction is usually made, which leads to a model error. To solve this problem, an adversarial sample is generated to simulate the attack means of a potential attacker on the model, the robustness of the deep learning model is tested and evaluated, the weaknesses of the model are found and strengthened, and the stability and defense ability of the model are improved. The generation of the adversarial sample can reveal whether the performance of the model will sharply decrease when facing a specific type of perturbation. If the model is easily affected by a specific adversarial sample, it indicates that the generalization ability of the model is insufficient. That is, through the generation and attack of the adversarial sample, the defense mechanism of the model can be tested and improved, so that the potential security threats can be better coped with in practical applications, and the sustainable development of AI (Artificial Intelligence) can be promoted.

[0051] It can be understood that the data set and the source model are prepared in sequence, the data set includes input samples and corresponding real labels, and the source model is an initial model for training the data set; in the embodiment, the input samples are images in an ImageNet-compatible data set, which includes clean color images of different subjects and the same size taken by a camera device, and the real labels are the names of the subjects in the clean color images, that is, a csv file; preferably, 1000 clean color images are selected from the data set as the input samples in the embodiment; the convolutional neural network architecture, that is, DenseNet121 (a specific model in the DenseNet family), SqueezeNet1_0 (a lightweight convolutional neural network architecture), and MobileNetV3-L (v3 version in the MobileNet model) are respectively used as the source model for implementing the adversarial attack, and the running parameters provided by PyTorch are used as the running parameters of the source model.

[0052] Further, in step S1, the running parameters include the total number of iterations, the maximum allowed distortion, the momentum factor, the mask proportion, the mask number, the balance parameter, the step length, and the update period, and the corresponding calculation formula of the update period is:

[0053]

[0054] wherein, represents the update period; represents the total number of iterations; represents the mask number.

[0055] Preferably, in the embodiment, the total number of iterations is set to 1000, the maximum allowed distortion is set to 0.1, the momentum factor is set to 0.9, the mask number is set to 10, the balance parameter is set to 0.5, the step length, that is, the step length of each iteration of the source model, is set to 0.01, and the update period is determined by the calculation formula, It can be explained that the mask proportion is set differently for different source models, that is, the mask proportions of DenseNet121, SqueezeNet1_0, and MobileNetV3-L are 20%, 15%, and 15%, respectively.

[0056] Please refer to Figure 2 which shows an example flowchart of a single-iteration algorithm for generating an adversarial sample in the method for implementing an adversarial attack on a deep neural network based on important neurons according to an embodiment of the present application.

[0057] Further, in step S1, when the number of iterations reaches the preset running parameters, the importance scores of all neurons in the source model are calculated, a binary mask is generated, and the masked model is obtained, including:

[0058] Step S11: When the number of iterations reaches the update cycle, the importance scores of all neurons in the source model are obtained using the neuron importance calculation method.

[0059] Specifically, when the number of iterations Reaching the mask model update cycle At that time, based on the input sample Each time, an image and its corresponding ground truth label are input into a different source model, and the corresponding ground truth label is... The importance scores of all neurons in the source model are obtained using a neuron importance calculation method.

[0060] Further, in step S11, the importance scores of all neurons in the source model are obtained using a neuron importance calculation method. The corresponding calculation formula is as follows:

[0061]

[0062] in, Indicates the first The first layer The neurons are related to the input sample. Importance score; Represents the input samples of the dataset The network output from the source model; Indicates input sample And neuronal activation response Network output when it approaches 0; Indicates the first The first layer The activation response value of a neuron.

[0063] Provide an explanation Indicates input sample And neuronal activation response Network output when it approaches 0; Indicates the first The first layer The neurons are related to the input sample. Importance score, i.e., the importance score of a neuron to the input sample The degree of contribution to decision-making; The first-order Taylor approximation expansion representing the importance score not only improves computational efficiency but also helps to intuitively understand the contribution of each neuron to the source model's decision.

[0064] Step S12: ranking the neurons of each layer in descending order based on the importance score, and determining the binary mask layer by layer through the mask proportion.

[0065] It is explained that the binary mask refers to the binary processing of the activation response value of each neuron, that is, according to the preset mask proportion, the important neurons with higher importance score are retained, and the activation response value of the unimportant neurons with lower importance score is set to 0, so as to highlight the important neurons with greater contribution to the source model decision, and ignore the neurons with smaller contribution, which is beneficial to more accurately positioning and utilizing the key neurons in the subsequent adversarial attack.

[0066] Specifically, the neurons are ranked in descending order layer by layer according to the importance score, and the binary mask is generated layer by layer through the mask proportion, and the corresponding logical expression is:

[0067]

[0068] According to different source models, the corresponding mask proportion Different, so for different source models, the important neurons and unimportant neurons obtained are also different.

[0069] Step S13: obtaining the masked model after masking the source model according to the binary mask, and the corresponding calculation formula is:

[0070]

[0071] Wherein, represents the masked model; represents the source model; represents the element-wise multiplication between the neuron and the binary mask; represents the binary mask.

[0072] It is explained that the masked model refers to the model obtained by evaluating the importance score of the important neurons of the source model, and according to the preset mask proportion, the activation response value of the important neurons with higher importance score is retained, and the activation response value of the unimportant neurons with lower importance score is set to 0.

[0073] Further, in step S2, it includes:

[0074] Step S21: when the number of iterations reaches the pre-set running parameter, output the adversarial sample after iteration corresponding to the number of iterations , and the corresponding true label .

[0075] It can be understood that when the number of iterations reaches the set running parameter, that is, the mask model reaches the set update period, the importance scores of all neurons are obtained at this time, and the adversarial samples generated after the corresponding number of iterations are based , that is, the adversarial samples after the th iteration, and the corresponding true labels are obtained .

[0076] Step S22: the cross-entropy loss of the adversarial sample and the corresponding true label is calculated by the mask model ; the cross-entropy loss of the adversarial sample and the corresponding true label is calculated by the source model .

[0077] It is explained that the cross-entropy loss of the adversarial sample and the corresponding true label is calculated by the mask model and the source model respectively, which can evaluate the performance difference of the mask model and the source model on the adversarial sample ; according to the cross-entropy loss between the two, it can be judged whether the mask model successfully retains the key features of the source model, and realizes the sparsification of important neurons while maintaining the model performance; if the cross-entropy loss of the mask model is similar to or lower than that of the source model, it means that the mask model maintains good model performance while reducing the number of important neurons, and this setting can reduce the complexity of the mask model.

[0078] Step S23: the first gradient and the second gradient are obtained by the back propagation method according to the cross-entropy loss respectively, and the total gradient is obtained by weighting the first gradient and the second gradient by the balance parameter.

[0079] It is explained that the first gradient refers to the gradient of the cross-entropy loss of the mask model with respect to the adversarial sample , which reflects the gradient of the prediction error of the mask model on the adversarial sample ; similarly, the second gradient refers to the gradient of the cross-entropy loss of the source model with respect to the adversarial sample , which reflects the gradient of the prediction error of the source model on the same adversarial sample ; the total gradient obtained by weighting the two gradients based on the balance parameter considers both the ability of the mask model to maintain model performance and the key feature retention of the source model, so that the subsequently generated adversarial samples can maintain good attack effect when attacking the mask model, and can also try to retain the key features of the source model, thereby realizing neuron sparsification while not significantly reducing the performance of the model.

[0080] Preferably, a MIM (Momentum Iterative Fastest Descent) optimizer is set based on gradient back propagation, which can accelerate the generation process of the adversarial sample and improve the efficiency of the adversarial attack, that is, by introducing a momentum term, the gradient direction can be accumulated to speed up the convergence speed, so that the adversarial sample can approach the optimal solution faster; and the MIM optimizer can also enhance the robustness of the adversarial attack, so that the generated adversarial sample is more stable and effective when facing model defense mechanisms.

[0081] Further, in step S23, the first gradient and the second gradient are obtained in sequence according to the cross-entropy loss by the back propagation method, and the corresponding calculation formula is:

[0082]

[0083]

[0084] wherein, represents the first gradient; represents the second gradient; represents the gradient operator;

[0085] The total gradient is obtained by balancing the first gradient and the second gradient, and the corresponding calculation formula is:

[0086]

[0087] wherein, represents the total gradient; represents the balance parameter.

[0088] Further, in step S3, it includes:

[0089] Step S31: updating the adversarial sample by using momentum iteration according to the total gradient to generate an adjacent iteration of the adversarial sample.

[0090] It is explained that the iteration update by using the momentum iteration method can accelerate the convergence and improve the attack efficiency, and in the momentum iteration process, by accumulating the gradient information of the previous iteration, the gradient direction can be smoothed, the shock can be reduced, the adversarial sample can approach the optimal solution faster, which helps to jump out of the local optimal solution, explore a wider solution space, and thus enhance the diversity and success rate of the adversarial attack.

[0091] Further, in step S31, the corresponding calculation formula is:

[0092]

[0093]

[0094] wherein, denotes the adversarial sample of the adjacent iteration, i.e., the iteration; denotes the adversarial sample of the adjacent iteration, i.e., the iteration; denotes a truncation function for satisfying the constraint of infinite norm of the adversarial noise; denotes the maximum perturbation; denotes the step size of each iteration; denotes a sign function; denotes the momentum in the iteration; denotes a momentum factor; denotes the momentum in the iteration; denotes the total gradient; denotes a one-norm operation.

[0095] Step S32: Continue iteration for the adversarial sample of the adjacent iteration until the total number of iterations is reached, and the iteration is ended to generate the final version of the adversarial sample.

[0096] Specifically, until the total number of iterations is reached, in this embodiment, it means that the number of iterations reaches , stop iteration, and generate the final version of the adversarial sample, i.e. .

[0097] Understandably, the adversarial attack method provided in the present application starts from the perspective of the explainability method of neural network path attribution, improves the effect of adversarial sample transferability; that is, analyzing the data set, when the number of iterations reaches the update period, the importance score of important neurons is calculated by neuron contribution degree, the binary mask is determined, and the mask model which is helpful for the migration attack is effectively generated, and then the cross-entropy loss of the adversarial sample and the corresponding true label is calculated through the mask model and the source model respectively, the first gradient and the second gradient are obtained, and the total gradient is obtained by weighting, that is, the loss is introduced to ensure that the generated adversarial sample has strong robustness; finally, the adversarial sample is updated and iterated to generate the final version of the adversarial sample; compared with the existing method, the important features of the corresponding image category can be better positioned, the success rate of adversarial attack of the adversarial sample to different attack target models is improved, that is, the deep neural network provides credible mechanism support, ensures the technical effect of deep neural network used for adversarial attack, effectively issues a safety warning about the deep neural network model to the researchers or users, and helps to improve the safety of artificial intelligence research and application.

[0098] For better illustration, a transfer attack experiment is adopted to intuitively compare the actual performance of different source models acting on the adversarial attack method, so as to evaluate the effect of the adversarial attack method provided in the application; preferably, in the embodiment, based on the source model, VGG16, ResNet-50 (Res-50), ResNet152 (Res-152), DN121, DenseNet161 (DN162) and SqueezeNet1_1 (SN1_1) are selected as target models for attack, the success rate of transfer attack is tested respectively, and the average success rate is counted; and the classical method of transfer adversarial attack Y. Dong, et al. Boosting adversarial attacks with momentum. IEEE CVPR, 2018, pp. 9185-9193 is used as a benchmark method for comparison, and the transfer attack success rates of different methods are shown in Table 1.

[0099] Table 1 Transfer attack success rate of important neuron-based deep neural network adversarial attack method compared with benchmark method

[0100]

[0101] It is explained that the important neuron-based deep neural network adversarial attack method provided in the application is superior to the transfer attack success rate of the benchmark method according to the difference of the source model, which shows that the adversarial attack method of the application can effectively improve the transfer attack success rate of different models.

[0102] It can be explained that through the ablation experiment, it is determined whether the attack success rate of the adversarial attack method provided in the application is affected by different mask proportions, so as to determine the feasibility of the adversarial attack method.

[0103] Table 2 Mask proportion Ablation experiment on DenseNet121

[0104]

[0105] Table 3 Mask proportion Ablation experiment on SqueezeNet1_0

[0106]

[0107] Table 4 Mask proportion Ablation experiment on MobileNetV3-L

[0108]

[0109] It is to be noted that, with the increase of the mask proportion, the attack success rate shows a trend of first rising and then falling. At a low mask proportion, the attack success rate is relatively low, which may be because the low mask proportion leads to excessive shielding of key information, which indirectly affects the generation effect of the adversarial sample. With the increase of the mask proportion, the attack success rate shows a rising trend, indicating that a proper mask proportion helps to improve the effect of the adversarial attack. However, when the mask proportion is too high, the attack success rate shows a downward trend, which may be because too much information is shielded, causing the adversarial sample to lose the effective simulation of the initial adversarial sample and reducing the success rate of the attack. That is, for a lightweight source model with fewer network parameters, the attack success rate is highest when the mask proportion is between 15% and 25%; for a source model with a larger amount of network parameters, the attack success rate is highest when the mask proportion is between 20% and 30%; therefore, in actual application, according to the demand for different source models, different mask proportions can be selected to maximize the success rate of the adversarial attack.

[0110] It should be noted that the above-mentioned order of the embodiments of the application is only for description, and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multi-task processing and parallel processing are also possible or may be advantageous.

[0111] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each embodiment mainly describes the difference from other embodiments.

Claims

1. A method for adversarial attack on a deep neural network based on important neurons, characterized in that, The method comprises: sequentially preparing a data set and a source model, the data set comprising input samples and corresponding true labels, the input samples being images selected from an ImageNet-compatible data set, and the true labels being names of subjects in the corresponding images; and setting corresponding running parameters for the source model, and iterating the data set, when the number of iterations reaches the pre-set running parameters, calculating the importance scores of all neurons in the source model, generating a binary mask, and obtaining a masked model after the mask; The running parameters comprise a total number of iterations, a maximum allowed distortion, a momentum factor, a mask proportion, a number of masks, a balance parameter, a step size, and an update period, and the update period corresponds to a calculation formula: ； wherein, represents the update period; represents the total number of iterations; represents the number of masks; When the number of iterations reaches the pre-set running parameters, the importance scores of all neurons in the source model are calculated, a binary mask is generated, and a masked model after the mask is obtained, comprising: When the number of iterations reaches the update period, one image and the corresponding true label are input into the source model based on the input sample each time, and the importance scores of all neurons in the source model are obtained by using a neuron importance calculation method, and the corresponding calculation formula is: ； wherein, represents the importance score of the -th neuron of the -th layer with respect to an input sample ; represents the network output by the source model for an input sample ; represents the network output as the neuron activation response tends to 0; represents the activation response value of the -th neuron of the -th layer; Based on the importance scores, the neurons in each layer are sorted in descending order, and the binary mask is determined layer by layer through the mask proportion, and the corresponding logical expression is: ； wherein, represents the mask ratio; According to the binary mask and the source model, a masked model after the mask is obtained, and the corresponding calculation formula is: ； wherein, represents a mask model; represents a source model; represents an element-wise level-wise multiplication between neurons and binary masks; represents a binary mask; The masked model is obtained by evaluating the importance scores of important neurons of the source model, and according to the mask proportion, the important neurons are retained with their activation response values, and the unimportant neurons are set to 0 with their activation response values; After the number of iterations reaches the pre-set running parameters, the adversarial samples are output, the cross-entropy loss of the adversarial samples and the corresponding true labels is calculated through the masked model and the source model respectively, and the first gradient and the second gradient of the cross-entropy loss with respect to the adversarial samples are obtained, and the total gradient is obtained by weighting the first gradient and the second gradient. According to the total gradient, the iterative adversarial samples are updated in sequence until the iteration ends, and the final version of the adversarial samples is generated.

2. The method of claim 1, wherein, After the number of iterations reaches the pre-set running parameters, the adversarial samples are output, the cross-entropy loss of the adversarial samples and the corresponding true labels is calculated through the masked model and the source model respectively, and the first gradient and the second gradient of the cross-entropy loss with respect to the adversarial samples are obtained, and the total gradient is obtained by weighting the first gradient and the second gradient, comprising: output the adversarial sample after the corresponding number of iterations when the number of iterations reaches the pre-set running parameter , and the corresponding true label ; The cross-entropy loss of the adversarial sample and the corresponding true label calculated by the mask model is ; the cross-entropy loss of the adversarial sample and the corresponding true label calculated by the source model is ; The first gradient and the second gradient are obtained in sequence according to the cross-entropy loss by the back propagation method, and the total gradient is obtained by weighting the first gradient and the second gradient through the balance parameter.

3. The method of claim 2, wherein, The first gradient and the second gradient are obtained in sequence according to the cross-entropy loss by the back propagation method, and the corresponding calculation formula is: ； ； wherein denotes a first gradient; denotes a second gradient; denotes a gradient operator; The total gradient is obtained by weighting the first gradient and the second gradient through the balance parameter, and the corresponding calculation formula is: ； wherein represents the total gradient; represents the balance parameter.

4. The method of claim 1, wherein, According to the total gradient, the iterative adversarial samples are updated in sequence until the iteration ends, and the final version of the adversarial samples is generated, comprising: According to the total gradient, the adversarial samples are updated iteratively using momentum to generate the adversarial samples of the adjacent iterations; The iteration is continued for the adversarial samples of the adjacent iterations until the total number of iterations is reached, the iteration ends, and the final version of the adversarial samples is generated.

5. The method of claim 4, wherein, According to the total gradient, the momentum iterative update is used to update the adversarial sample, and the adversarial sample of the adjacent iteration is generated, and the corresponding calculation formula is: ； ； wherein, denotes the adversarial sample of the adjacent iteration, i.e., the adversarial sample of the adversarial sample of the adversarial sample of the denotes a truncation function for satisfying the adversarial noise infinity norm constraint; denotes the maximum perturbation; denotes the step size of each iteration; denotes a sign function; denotes the momentum in the adversarial sample of the denotes a momentum factor; denotes the momentum in the adversarial sample of the denotes the total gradient; denotes an one-norm operation.

Images