High-transferability confrontation sample generation method and device based on model amplification

Abstract

The invention discloses a high-transferability adversarial sample generation method and device based on model amplification, and the method comprises the steps: training an obtained network model to obtain an agent model; constructing an input transformation operator set and a random disturbance set, and amplifying the proxy model according to the input transformation operator set or the random disturbance set to generate a neighbor model of the proxy model in the hypothesis space; building a stochastic optimization problem according to the neighbor model, and solving the stochastic optimization problem by using a gradient ascending method based on momentum to generate a confrontation sample; therefore, the proxy model is amplified in the hypothesis space, the solvable migration attack target is constructed, and the random optimization algorithm based on operator-disturbance is adopted for solving, so that the generated adversarial sample has the characteristics of low overhead, high efficiency and high expandability.

Description

Technical Field

[0001] The present application relates to the technical fields of computer vision and adversarial learning, and particularly relates to a method for generating highly transferable adversarial samples based on model amplification and a device for generating highly transferable adversarial samples based on model amplification. Background Art

[0002] In related technologies, deep neural networks have established superior performance in many tasks and become solutions for many real-world applications. However, the existence of adversarial samples reveals the vulnerability of these networks. Adversarial samples are carefully designed input data that mislead the model into making incorrect predictions by adding tiny, imperceptible perturbations to the original data, posing serious security problems. To improve the credibility of deep neural networks in critical applications, the adversarial attack and defense of deep neural networks have received increasing attention. Among them, the transferability of adversarial samples - adversarial samples generated for a specific model can also be used to attack an unknown target model - shows the attack potential in the black-box scenario and has become one of the core issues in research.

[0003] Currently, transfer attack techniques based on the transferability of adversarial samples mainly improve the attack success rate of transferable adversarial samples by designing input diversity, optimizing gradient stability, or introducing regularization constraints, etc., but still have the following defects more or less: (1) Limited transferability improvement: Existing methods have designed many different mechanisms around the complex interaction between data and models, but the improvement brought is relatively limited. (2) High generation cost: Many methods require much more or even several times the video memory during runtime than during model training, and often take a long time to complete the generation of adversarial samples. (3) Modal dependence: Methods based on input diversity have achieved the best results on images, but it is difficult to extend to other modalities due to the strong correlation between the input transformations used and the data modality. Summary of the Invention

[0004] The present application aims to at least solve one of the technical problems in the above technologies to some extent. To this end, one objective of the present application is to propose a method for generating highly transferable adversarial samples based on model amplification, which constructs a solvable transfer attack target by amplifying the surrogate model in the hypothesis space and uses a random optimization algorithm based on operator-perturbation to solve it, thus having the characteristics of low overhead, high efficiency, and strong scalability.

[0005] The second objective of the present application is to propose a device for generating highly transferable adversarial samples based on model amplification.

[0006] To achieve the above object, an embodiment of the first aspect of the present application provides a method for generating highly transferable adversarial samples based on model amplification, including training the obtained network model to obtain a surrogate model; constructing an input transformation operator set and a random perturbation set, and amplifying the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space; constructing a stochastic optimization problem based on the neighbor models, and solving the stochastic optimization problem using the momentum-based gradient ascent method to generate adversarial samples.

[0007] According to the method for generating highly transferable adversarial samples based on model amplification of the embodiments of the present application, first, train the obtained network model to obtain a surrogate model; then, construct an input transformation operator set and a random perturbation set, and amplify the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space; finally, construct a stochastic optimization problem based on the neighbor models, and solve the stochastic optimization problem using the momentum-based gradient ascent method to generate adversarial samples; thus, by amplifying the surrogate model in the hypothesis space, constructing a solvable transfer attack target, and using an operator-perturbation-based stochastic optimization algorithm to solve, it has the characteristics of low overhead, high efficiency, and strong scalability.

[0008] In addition, the method for generating highly transferable adversarial samples based on model amplification proposed in the above embodiments of the present application may also have the following additional technical features:

[0009] Optionally, constructing the input transformation operator set includes: collecting simple input transformations to obtain a basic operator set; generating a higher-order extended set from the basic operator set using a composite operation; randomly sampling input transformation operators in each selected extended set to obtain an input transformation operator set, where the number of sampled operators of different orders is equal.

[0010] Optionally, constructing the random perturbation set includes: randomly sampling random perturbations in open balls of different radii to obtain a random perturbation set, where the number of sampled random perturbations in open balls of different radii is equal.

[0011] Optionally, the stochastic optimization problem constructed based on the neighbor models includes:

[0012]

[0013] s.t.||x adv -x ori || ∞ <ε

[0014] where D represents the random perturbation set, denotes the set of input transformation operators, δ denotes a random perturbation, and op denotes an input transformation operator. denotes the cross - entropy loss function, f θ denotes the surrogate model with learnable parameters θ, x ori denotes the clean sample with the true label y, x adv denotes at x ori of searching for adversarial samples that can mislead f within the neighborhood of θ , where ε represents the radius, i.e., the attack budget.

[0015] Optionally, use the momentum - based gradient ascent method to solve the stochastic optimization problem to generate adversarial samples, including: initializing the step size, momentum, and perturbation; in each iteration, randomly sample from the set of input transformation operators and the set of random perturbations to construct a neighbor model, calculate the gradient of the loss function on it and accumulate it to the initial gradient, and calculate the average value to obtain the average gradient; update the momentum according to the average gradient, and update the perturbation according to the updated momentum until the maximum number of iterations is reached and then stop iterating to obtain the final perturbation; generate adversarial samples according to the final perturbation.

[0016] To achieve the above object, an embodiment of the second aspect of the present application proposes a highly transferable adversarial sample generation device based on model amplification, including a training module for training the obtained network model to obtain a surrogate model; a construction module for constructing a set of input transformation operators and a set of random perturbations, and amplifying the surrogate model according to the set of input transformation operators or the set of random perturbations to generate neighbor models of the surrogate model in the hypothesis space; an adversarial sample generation module for constructing a stochastic optimization problem according to the neighbor models and using the momentum - based gradient ascent method to solve the stochastic optimization problem to generate adversarial samples.

[0017] In addition, the highly transferable adversarial sample generation device based on model amplification proposed in the above embodiment of the present application may also have the following additional technical features:

[0018] Optionally, the construction module is further configured to collect a basic operator set through simple input transformation; generate a higher - order extended set from the basic operator set by using composite operations; randomly sample input transformation operators in each selected extended set to obtain a set of input transformation operators, where the number of sampled operators of different orders is equal.

[0019] Optionally, the construction module is further configured to randomly sample random perturbations in open balls of different radii to obtain a set of random perturbations, where the number of sampled random perturbations in open balls of different radii is equal.

[0020] Optionally, the stochastic optimization problem constructed according to the neighbor model includes:

[0021]

[0022] s.t.||x adv -x ori || ∞ <ε

[0023] where D represents the set of random perturbations, represents the set of input transformation operators, δ represents a random perturbation, op represents an input transformation operator, represents the cross-entropy loss function, f θ represents the surrogate model with learnable parameters θ, x ori represents the clean sample with the true label y, x adv represents searching for adversarial samples that can mislead f ori within the neighborhood of x θ and ε represents the radius, i.e., the attack budget.

[0024] Optionally, the adversarial sample generation module is further configured to initialize the step size, momentum, and perturbation; in each iteration, randomly sample from the set of input transformation operators and the set of random perturbations to construct a neighbor model, calculate the gradient of the loss function on it and accumulate it to the initial gradient, and calculate the average value to obtain the average gradient; update the momentum according to the average gradient, and update the perturbation according to the updated momentum until the maximum number of iterations is reached and the iteration stops to obtain the final perturbation; generate an adversarial sample according to the final perturbation. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a schematic flowchart of a method for generating highly transferable adversarial samples based on model amplification according to an embodiment of the present application;

[0026] Figure 2 is a schematic iterative update flowchart of solving a stochastic optimization problem to generate adversarial samples according to a specific embodiment of the present application;

[0027] Figure 3 is a visualization of the evaluation results of the adversarial attack method according to an embodiment of the present application;

[0028] Figure 4 is a visualization of the adversarial samples generated on image data according to an embodiment of the present application;

[0029] Figure 5 is a visualization of the adversarial samples generated on point cloud data according to an embodiment of the present application;

[0030] Figure 6 Schematic block diagram of a high transferability adversarial sample generation device based on model amplification according to an embodiment of the present application. Detailed implementation manners

[0031] The embodiments of the present application will be described in detail below. Examples of the embodiments are shown in the drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present application, and should not be construed as a limitation to the present application.

[0032] To better understand the above technical solutions, the exemplary embodiments of the present application will be described in more detail below with reference to the drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0033] To better understand the above technical solutions, the above technical solutions will be described in detail below in conjunction with the drawings of the specification and specific implementation manners.

[0034] Figure 1 Flow schematic diagram of a high transferability adversarial sample generation method based on model amplification according to an embodiment of the present application. As Figure 1 shown, the high transferability adversarial sample generation method based on model amplification includes the following steps:

[0035] S101, training the obtained network model to obtain a surrogate model.

[0036] That is to say, training the network model using a publicly available dataset, and saving the best surrogate model after training for subsequent transfer attacks.

[0037] S102, constructing an input transformation operator set and a random perturbation set, and amplifying the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space.

[0038] Among them, the hypothesis space is a set including all possible models; in this hypothesis space, each model can be regarded as a point; the surrogate model and the target model are both points in the hypothesis space, and the neighbor models are neighboring points of the surrogate model in the hypothesis space.

[0039] It should be noted that the neighbor models of the surrogate model are model variants obtained by slightly perturbing or transforming the surrogate model; these neighbor models are adjacent to the surrogate model in the hypothesis space and are used to simulate the characteristics of the target model, thereby improving the transferability of adversarial examples; by means of input transformation operators and random perturbations, multiple neighbor models can be generated to increase the diversity of the models and improve the attack success rate of adversarial examples.

[0040] S103. Construct a stochastic optimization problem based on the neighbor models and solve the stochastic optimization problem using the momentum-based gradient ascent method to generate adversarial examples.

[0041] It should be noted that the model used by the attacker to produce adversarial examples is called the surrogate model, and the model being attacked is called the target model; the goals of adversarial examples include two parts: (1) Adversarial: The adversarial example x adv can mislead the target model. (2) Imperceptibility: It is difficult for humans to perceive that the input given by the attacker is an adversarial example.

[0042] Among them, in the white-box attack, the surrogate model and the target model are the same model; the attacker usually formulates the adversarial example generation problem in this scenario as a box-constrained problem as follows:

[0043]

[0044] s.t.||x adv -x ori || ∞ <ε

[0045] Among them, f θ is the surrogate model with learnable parameters θ, represents the cross-entropy loss function, x ori is the clean sample with the true label y; the goal of the attacker is to search within the ori neighborhood of x for the adversarial example x θ that can mislead f adv , so the radius ε is also called the attack budget.

[0046] In actual operation, the perturbation Δ = x adv -x ori is usually used as the optimization variable, and the above problem is solved by iteratively updating the perturbation. For example, the perturbation iteration formula in the classic I-FGSM is:

[0047]

[0048] Among them, Clip εIt means that the part of the perturbation exceeding the attack budget ε is clipped to the size of ε. α is the iteration step size. For the iterative process of T steps, usually α = ε / T.

[0049] Among them, in the black-box transfer attack paradigm, the surrogate model and the target model are different models, and usually the latter is not limited to one; denoting the set of target models as V = {f1, f2,...}, the attack objective defined in the white-box attack can be reformulated as the following form:

[0050]

[0051] s.t.||x adv -x ori || ∞ <ε

[0052] The problem here is that the attacker cannot obtain the information of the target model set V. Therefore, the above optimization problem is intractable. This application proposes to approximate the above attack objective by model amplification by analogy with few-shot learning in model generalization research and drawing on the application of data augmentation in few-shot learning, so as to construct a solvable optimization problem.

[0053] Specifically, taking images as an example, a neural network designed for M-class classification can be represented as a function h: x → z, where, represents the input image, and its distribution is given by p(x). represents the prediction confidence of h for each class; this application defines the hypothesis set as the set of all functions in this form, and further defines the functional to quantify the performance of each hypothesis h under the given data distribution. On this basis, the pseudo-metric is introduced to measure the difference between two hypotheses. Finally, for any hypothesis h, the neighborhood open ball centered at h with radius r is defined as It can be proved that such a neighborhood system derives a topological structure, so that the hypothesis set becomes a pseudo-metric space, that is, the hypothesis space.

[0054] This application points out that the surrogate model f θ and the target model f i ∈V both perform well in the classification task. Therefore, they are included in a set where a is a relatively small value. Therefore Therefore, "enhancing the transferability of adversarial samples within the neighborhood of the surrogate model" can be used as a reasonable approximation of the transfer attack objective established above. Specifically, the attack objective above is replaced with the following form:

[0055]

[0056] such that ||x adv -x ori || ∞ < ε

[0057] This form avoids the dependence on the target model set V = {f1, f2, …}, thus having theoretical solvability.

[0058] However, although the above optimization problem has theoretical solvability, in practice, further approximation is still required because it is difficult to directly sample the hypothesis space. This application proposes to perturb the surrogate model f θ in the hypothesis space to obtain its neighbor f′ as the augmented model. Specifically, this application first constructs a set of input transformation operators and a set of random perturbations Then, the surrogate model f θ is combined with an input transformation operator or a random perturbation to obtain a new model f′. By controlling the intensity of the transformation and perturbation, make small enough, that is, make f′ in the neighborhood of the surrogate model, so as to achieve model augmentation. Therefore, the stochastic optimization problem can be constructed as follows:

[0059]

[0060] s.t.||x adv -x ori || ∞ < ε

[0061] where D represents the set of random perturbations, represents the set of input transformation operators, δ represents a random perturbation, op represents an input transformation operator, represents the cross-entropy loss function, f θ represents the surrogate model with learnable parameters θ, x ori represents the clean sample with the true label y, x adv represents searching for adversarial samples that can mislead f ori within the neighborhood of x , ε represents the radius, that is, the attack budget. θ

[0062] As an example, constructing the set of input transformation operators includes: collecting simple input transformations to obtain the basic operator set; generating higher-order extended sets from the basic operator set using composite operations; randomly sampling input transformation operators in each selected extended set to obtain the set of input transformation operators, where the number of sampled operators of different orders is equal.

[0063]

[0063] Specifically, consider a neighbor model in the form of where is an input transformation operator, and represents a composite operation. To construct the set of input transformation operators First, select a batch of transformation operators that cause less perturbation to the surrogate model to form a basic operator set Then, obtain some extended sets through composite operations to increase the number of optional operators. Define the k - th order extended set of as:

[0064]

[0065] In particular, define Obviously, the higher the order, the more optional operators there are, and the greater the perturbation of the operators to the surrogate model. To maintain relatively uniform sampling, this application controls the number of operators of different orders to be equal to maintain a balance at the hierarchical level. Through an integer list K list specify the order of each extended set, and randomly sample operators in each selected extended set to form

[0066] Here, the notation S(A, n) is introduced to represent randomly sampling n times from set A. Then, the finally constructed set can be written as:

[0067]

[0068] It should be noted that the input data can be rotated at a random angle, scaled at a random ratio, translated by random pixels, the color of the input data can be randomly adjusted, the input data can be randomly cropped, and the input data can be flipped horizontally or vertically to obtain transformation operators. Among them, the selection and combination of basic transformation operators can be adjusted according to the characteristics of the data and the task requirements. For example, for image data, rotation, scaling, and translation are common transformation operators; for point cloud data, rotation and translation may be more important.

[0069] As an example, construct a random perturbation set, including: randomly perturbing and sampling in open balls with different radii to obtain a random perturbation set, where the number of random perturbations sampled in open balls with different radii is equal.

[0070] Specifically, consider a neighbor model in the form of f′(x) = f θ (x + δ), where δ is a random perturbation, and this form has better properties. In fact, it can be proved that if f θ (x) satisfies the Lipschitz condition, then there is d(f θ, f′) ≤ Cδ, where C is a fixed constant. Construct a set of random perturbations is similar to the above. Uniformly sample the same number of perturbations in a series of open balls with different radii to form a perturbation set. Denote the number of samples in the open ball as N e , and at the same time introduce a list R list to specify the radii of the open ball sequence, then can be expressed as:

[0071]

[0072] It should be noted that the random perturbations are generated by adding random noise to the input data. These noises can be Gaussian noise, uniform noise, Laplace noise, salt-and-pepper noise, etc. By normalizing the perturbations, it can be ensured that their magnitudes are within a reasonable range, thus playing an important role in adversarial sample generation and model robustness testing.

[0073] As an example, use the momentum-based gradient ascent method to solve the stochastic optimization problem to generate adversarial samples, including: initializing the step size, momentum, and perturbation; in each iteration, randomly sample from the input transformation operator set and the random perturbation set to construct a neighbor model, calculate the gradient of the loss function on it and accumulate it to the initial gradient, and calculate the average value to obtain the average gradient; update the momentum according to the average gradient, and update the perturbation according to the updated momentum until the maximum number of iterations is reached and then stop the iteration to obtain the final perturbation; generate adversarial samples according to the final perturbation.

[0074] Specifically, as Figure 2 shown, first, set the initial momentum m0 to zero; then, in each round of iterative update, calculate the initial gradient sample N e , N p elements from the input transformation operator set and the random perturbation set respectively, traverse all combinations of (δ i , op j ) they form, and calculate the gradient of and accumulate it to g; finally, take the average gradient as the gradient direction of this round of update. This process can be expressed as:

[0075]

[0076] Subsequently, update the momentum according to the gradient of this round. The update formula is as follows:

[0077]

[0078] where μ is the momentum update weight, usually taking μ = 1.0.

[0079] Finally, update the adversarial perturbation Δ according to the gradient and momentum of this round:

[0080] Δ i+1 = Δ i + Clip ∈ {α·Sign(m i+1 )}

[0081] In summary, after T steps of iteration, apply the obtained adversarial perturbation to the original sample, and finally generate an adversarial sample: x adv = x ori + Δ T .

[0082] As Figure 3 shown, the comparison results between the adversarial attack method proposed in this application and the existing methods are shown. All methods launch attacks under the cross-architecture setting, generate 1000 adversarial samples on ResNet-18, and count their attack success rates on ViT. Each bubble represents a different attack algorithm, the size of the bubble represents the maximum video memory overhead used during the entire attack process, the x-axis represents the running time of the algorithm, and the y-axis represents the attack success rate of the generated results.

[0083] As Figure 4 and Figure 5 shown, the visualization results of the adversarial samples generated by the adversarial attack method proposed in this application on images and point cloud data are shown.

[0084] In summary, the high-transferability adversarial sample generation method based on model amplification in this application starts from the hypothesis space, points out that both the surrogate model and the target model are hypothesis points in the hypothesis space, and the latter is located in the neighborhood of the former. Therefore, first compound the surrogate model with the input transformation operator (or with a random perturbation) to obtain a neighbor of the surrogate model in the hypothesis space as the amplified model, and finally use the obtained neighbor model to construct a random optimization problem, and generate more transferable adversarial samples by solving this problem; it has the following advantages: (1) Low overhead: Only requires a small amount of video memory to run, close to the video memory overhead during model training. (2) High efficiency: Can achieve a higher attack success rate in the same time, and show a higher attack success rate under the longest acceptable time setting. (3) Scalability: Can adapt to different modalities such as images and 3D point clouds.

[0085] To implement the above embodiments, an embodiment of this application proposes a high-transferability adversarial sample generation device based on model amplification, as Figure 5 shown, the high-transferability adversarial sample generation device based on model amplification includes: a training module 10, a construction module 20, and an adversarial sample generation module 30.

[0086] Among them, the training module 10 is used to train the obtained network model to obtain a surrogate model; the construction module 20 is used to construct an input transformation operator set and a random perturbation set, and amplify the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space; the adversarial sample generation module 30 is used to construct a stochastic optimization problem based on the neighbor models and solve the stochastic optimization problem using the momentum-based gradient ascent method to generate adversarial samples.

[0087] Optionally, the construction module 20 is further used to collect a basic operator set by simple input transformation; generate a higher-order extended set from the basic operator set by composite operations; randomly sample input transformation operators in each selected extended set to obtain the input transformation operator set, where the number of sampled operators of different orders is equal.

[0088] Optionally, the construction module 20 is further used to randomly sample random perturbations in open balls of different radii to obtain the random perturbation set, where the number of randomly sampled perturbations in open balls of different radii is equal.

[0089] Optionally, the stochastic optimization problem constructed according to the neighbor models includes:

[0090]

[0091] s.t.||x adv -x ori || ∞ <ε

[0092] Where represents the random perturbation set, represents the input transformation operator set, δ represents a random perturbation, op represents an input transformation operator, represents the cross-entropy loss function, f θ represents the surrogate model with learnable parameters θ, x ori represents a clean sample with the true label y, x adv represents searching for adversarial samples that can mislead f ori in the neighborhood of x θ and ε represents the radius, i.e., the attack budget.

[0093] Optionally, the adversarial sample generation module 30 is further configured to initialize the step size, momentum, and perturbation; in each iteration, randomly sample from the input transformation operator set and the random perturbation set to construct a neighbor model, calculate the gradient of the loss function on it and accumulate it to the initial gradient, and calculate the average value to obtain the average gradient; update the momentum according to the average gradient, and update the perturbation according to the updated momentum until the maximum number of iterations is reached and the iteration stops to obtain the final perturbation; generate an adversarial sample according to the final perturbation.

[0094] It should be noted that the above description of Figure 1 the high transferability adversarial sample generation method based on model amplification in also applies to the high transferability adversarial sample generation device based on model amplification, and will not be elaborated here.

[0095] In summary, for the high transferability adversarial sample generation device based on model amplification according to the embodiments of the present application, the training module trains the obtained network model to obtain a proxy model; the construction module constructs an input transformation operator set and a random perturbation set, and amplifies the proxy model according to the input transformation operator set or the random perturbation set to generate neighbor models of the proxy model in the hypothesis space; the adversarial sample generation module constructs a random optimization problem according to the neighbor models and uses the gradient ascent method based on momentum to solve the random optimization problem to generate adversarial samples; thus, by amplifying the proxy model in the hypothesis space, constructing a solvable transfer attack target, and using an operator-perturbation-based random optimization algorithm to solve, it has the characteristics of low overhead, high efficiency, and strong scalability.

[0096] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] The present application is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of the processes and / or blocks in the flowchart and / or block diagram can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate for implementing in the process Figure 1 each process or multiple processes and / or blocksFigure 1 means for the functions specified in one or more boxes.

[0098] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction means that implements the functions specified in one Figure 1 one or more processes and / or boxes Figure 1 or more boxes.

[0099] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, such that a series of operational steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one Figure 1 one or more processes and / or boxes Figure 1 or more boxes.

[0100] It should be noted that, in the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In a unit claim listing several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not denote any order. These words may be interpreted as names.

[0101] Although the preferred embodiments of the present application have been described, additional changes and modifications can be made by those skilled in the art once they learn the basic inventive concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0102] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

[0103] In the description of the present application, it should be understood that the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the present application, "a plurality of" means two or more, unless otherwise specifically defined.

[0104] In the present application, unless otherwise clearly defined and limited, the terms such as "mounted", "connected", "coupled", "fixed", etc. shall be construed in a broad sense. For example, it may be a fixed connection, a detachable connection, or integrated; it may be a mechanical connection or an electrical connection; it may be directly connected or indirectly connected through an intermediate medium, and it may be the internal connection of two components or the interaction relationship between two components. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to specific circumstances.

[0105] In the present application, unless otherwise clearly defined and limited, the first feature being "on" or "under" the second feature may be that the first and second features are in direct contact, or the first and second features are indirectly in contact through an intermediate medium. Moreover, the first feature being "above", "over" and "on top of" the second feature may be that the first feature is directly above or obliquely above the second feature, or merely indicates that the first feature has a higher horizontal height than the second feature. The first feature being "under", "beneath" and "underneath" the second feature may be that the first feature is directly below or obliquely below the second feature, or merely indicates that the first feature has a lower horizontal height than the second feature.

[0106] In the description of this specification, the descriptions with reference to terms such as "an embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic descriptions of the above terms should not be understood as necessarily referring to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0107] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A method for generating highly transferable adversarial samples based on model amplification, characterized in that Including the following steps: Training the obtained network model to obtain a surrogate model; Constructing an input transformation operator set and a random perturbation set, and augmenting the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space; Constructing a stochastic optimization problem based on the neighbor models and solving the stochastic optimization problem using a momentum-based gradient ascent method to generate adversarial samples.

2. The method for generating highly transferable adversarial samples based on model amplification according to claim 1, wherein Constructing an input transformation operator set includes: Collecting simple input transformations to obtain a basic operator set; Generating a higher-order extended set from the basic operator set using a composite operation; Randomly sampling input transformation operators in each selected extended set to obtain an input transformation operator set, where the number of sampled operators of different orders is equal.

3. The method for generating highly transferable adversarial samples based on model amplification according to claim 2, wherein Constructing a random perturbation set includes: Randomly sampling random perturbations in open balls of different radii to obtain a random perturbation set, where the number of sampled random perturbations in open balls of different radii is equal.

4. The method for generating highly transferable adversarial samples based on model amplification according to claim 3, wherein The stochastic optimization problem constructed based on the neighbor models includes: s.t.||x adv -x ori || ∞ <ε Among them, D represents the set of random perturbations, P represents the set of input transformation operators, δ represents a random perturbation, and op represents an input transformation operator. represents the cross-entropy loss function, and f θ represents the surrogate model with learnable parameters θ, and x ori represents the clean sample with the true label y, and x adv represents searching for adversarial samples that can mislead f ori within the l ∞ neighborhood of x, and ε represents the radius, that is, the attack budget. θ ​ 5. The method for generating highly transferable adversarial samples based on model amplification according to claim 4, characterized in that Solving the stochastic optimization problem using a momentum-based gradient ascent method to generate adversarial samples, including: Initializing the step size, momentum, and perturbation; In each iteration, randomly sampling from the input transformation operator set and the random perturbation set to construct a neighbor model, calculating the gradient of the loss function on it and accumulating it to the initial gradient, and calculating the average value to obtain the average gradient; Updating the momentum according to the average gradient, and updating the perturbation according to the updated momentum until the maximum number of iterations is reached and the iteration stops to obtain the final perturbation; Generating adversarial samples according to the final perturbation.

6. A highly transferable adversarial sample generation device based on model amplification, characterized in that, Including A training module for training the obtained network model to obtain a surrogate model; A construction module for constructing an input transformation operator set and a random perturbation set, and augmenting the surrogate model according to the input transformation operator set or the random perturbation set to generate neighbor models of the surrogate model in the hypothesis space; An adversarial sample generation module for constructing a stochastic optimization problem based on the neighbor models and solving the stochastic optimization problem using a momentum-based gradient ascent method to generate adversarial samples.

7. The high-transferability adversarial sample generation device based on model amplification according to claim 6, wherein The construction module is further configured to collect simple input transformations to obtain a basic operator set; Generating a higher-order extended set from the basic operator set using a composite operation; randomly sampling input transformation operators in each selected extended set to obtain an input transformation operator set, where the number of sampled operators of different orders is equal.

8. The high-transferability adversarial sample generation device based on model amplification according to claim 7, wherein, The construction module is further configured to randomly sample random perturbations in open balls of different radii to obtain a random perturbation set, where the number of sampled random perturbations in open balls of different radii is equal.

9. The device for generating highly transferable adversarial samples based on model amplification according to claim 8, wherein, The stochastic optimization problem constructed based on the neighbor models includes: Among them, represents the set of random perturbations, represents the set of input transformation operators, δ represents a random perturbation, and op represents an input transformation operator. represents the cross - entropy loss function, f θ represents the surrogate model with learnable parameters θ, x ori represents the clean sample with the true label y, x adv represents searching for adversarial samples that can mislead f ori in the l ∞ neighborhood of x, and ε represents the radius, i.e., the attack budget. θ ​ 10. The high-transferability adversarial sample generation device based on model amplification according to claim 9, characterized in that, The adversarial sample generation module is further configured to initialize the step size, momentum, and perturbation; in each iteration, randomly sample from the input transformation operator set and the random perturbation set to construct a neighbor model, calculate the gradient of the loss function on it and accumulate it to the initial gradient, and calculate the average value to obtain the average gradient; update the momentum according to the average gradient, and update the perturbation according to the updated momentum until the maximum number of iterations is reached and the iteration stops to obtain the final perturbation; generate an adversarial sample according to the final perturbation.

Images