Adversarial sample generation method and system based on dynamic variance reduction

Abstract

The invention discloses an adversarial sample generation method and system based on dynamic variance reduction. The method comprises the following steps: traversing an integrated model list in an external loop, calculating gradients of external samples of each model, and taking a mean value of the gradients as an integrated gradient; in the internal circulation, randomly selecting a model to calculate the gradient of an internal sample, and dynamically and reversely adjusting the internal sample according to the loss to obtain an adjusted sample; calculating a mean value of gradients of the adjustment sample and the internal sample, and reducing gradient variance in combination with the integrated gradient and the historical gradient to obtain an internal gradient for updating the internal sample; and after the internal circulation is finished, generating and cutting disturbance by utilizing an internal gradient mean value, adding the disturbance to an external sample, and after the external circulation is finished, outputting a final external sample as an adversarial sample. According to the method, gradient information of a plurality of models can be effectively integrated, and gradient variances among the models are reduced, so that the attack effect and the mobility of the generated confrontation sample are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of artificial intelligence security and adversarial sample generation, and in particular to an adversarial sample generation method and system based on dynamic variance reduction. Background Art

[0002] With the wide application of deep learning in fields such as unmanned driving, security monitoring, and medical image analysis, the decision-making results of deep learning models have become crucial in practical scenarios. Among them, Convolutional Neural Network (CNN) and Vision Transformer (ViT) have become the mainstream models for image recognition and classification tasks due to their powerful feature extraction capabilities and high accuracy. However, while these models bring efficient recognition and classification, they also face certain security risks. Since deep learning models rely on large-scale data training and have complex internal structures, they are vulnerable to external minute perturbations and may exhibit obvious classification errors without being easily noticed.

[0003] In response to this potential risk, adversarial sample generation methods have begun to receive extensive attention. Adversarial samples are a class of carefully crafted inputs whose perturbations, although almost imperceptible to humans, may cause the model to make incorrect classification predictions. For example, after subtle pixel modifications, a normal image of a cat may be misclassified as a dog. The existence of such adversarial samples deeply reveals the vulnerability of the model. Due to their imperceptibility to the human eye, the importance of adversarial samples in practical applications is increasing day by day. On the one hand, if a deep learning model is interfered with by malicious adversarial samples in critical scenarios, it may cause significant security hazards, such as an autonomous driving vehicle misidentifying a road sign or an intelligent security system misjudging a person's identity. On the other hand, adversarial sample generation methods are also of crucial significance for enhancing the robustness and defense capabilities of the model. They can be used to study how to enhance the robustness and anti-interference capabilities of the model and also help discover the weak links of the model and improve the security mechanism.

[0004] Existing adversarial sample generation methods usually rely on a surrogate model to provide gradient information and, based on this, use minute perturbations to "fool" the target model. However, with the continuous progress of deep learning models in terms of scale and structure, this approach that relies on a single surrogate model has gradually revealed limitations: when there are obvious differences in the network architectures between the target model and the surrogate model, the adversarial samples originally generated for the surrogate model often fail to achieve the same effect on the target model, resulting in insufficient transferability of the adversarial samples. Therefore, there is an urgent need for a method to generate adversarial samples with higher transferability by integrating the gradient information of multiple models to effectively improve their applicability in various complex practical applications. Summary of the Invention

[0005] Objective of the Invention: The objective of the present invention is to provide a method and system for generating adversarial samples based on dynamic variance reduction. By combining an outer loop and an inner loop, the gradients calculated by integrated gradients and randomly selected models are used to enhance the diversity of perturbations. At the same time, by dynamically adjusting the samples and combining historical gradient information to optimize the gradient direction, the gradient variance is reduced, thereby improving the transferability of the generated adversarial samples across model architectures.

[0006] Technical Solution: To achieve the above objective of the invention, the present invention adopts the following technical solutions:

[0007] A method for generating adversarial samples based on dynamic variance reduction, comprising the following steps:

[0008] In the outer loop, traverse the list of integrated models, calculate the gradients of each model for the outer samples. After the traversal is completed, use the mean of the gradients of the outer samples under different models as the integrated gradient, and use it for gradient update in the inner loop;

[0009] In the inner loop, randomly select a model from the list of integrated models, calculate the gradient of the inner samples under this model to enhance the diversity of perturbation generation. Subsequently, calculate the dynamic step size according to the loss of the current inner samples, and adjust the samples to move backward towards the decision boundary, thereby generating new adjusted samples;

[0010] To obtain a more accurate gradient optimization direction, calculate the gradient of the adjusted samples and combine it with the gradient of the inner samples. Subsequently, use historical gradient information to reduce the gradient variance, thereby obtaining the inner gradient and using it to update the inner samples;

[0011] When the inner loop reaches the specified update frequency, calculate the mean of the inner gradients to generate perturbations, and perform perturbation clipping according to the perturbation threshold. Subsequently, add the perturbations to the outer samples. After the outer loop iteration is completed, output the final outer samples as adversarial samples.

[0012] Further, the method for calculating the integrated gradient is:

[0013] In the outer loop, traverse the list of integrated models containing N models, and calculate the gradients of the outer samples under each model, and take their mean to obtain the integrated gradient and use it for updating the inner gradient. This gradient integrates the information of multiple models, which is beneficial to enhancing the transferability of the samples. The calculation formula is as follows:

[0014]

[0015] where J(·) represents the loss function corresponding to each model, and t represents the t-th iteration. is an external sample of the t-th iteration, and y is the corresponding true label.

[0016] Furthermore, the method for dynamically adjusting samples is as follows:

[0017] First, to increase the diversity of generated perturbations, randomly select one model from N models and obtain its corresponding loss function J n , and then calculate the gradient of the internal samples under this model The calculation formula is as follows:

[0018]

[0019] where m represents the m-th internal update, is the internal sample of the m-th update;

[0020] Subsequently, calculate the dynamic step size according to the loss of the internal sample Since the loss value may show large fluctuations at different stages, directly using its original value may lead to drastic changes in the step size, thus affecting the stability of gradient optimization. Therefore, its square root is used for smoothing to reduce the impact of extreme loss values on the step size, thereby enhancing the stability of gradient updates during the optimization process. The calculation formula is as follows:

[0021]

[0022] where α represents a fixed perturbation step size. When the loss value is large, it indicates that the internal sample is already close to the misclassification region. At this time, a smaller dynamic step size can be used to fine-tune near the decision boundary, thereby reducing unnecessary perturbations and improving the stability of the gradient optimization direction; on the contrary, when the loss value is small, it indicates that the internal sample is still close to the correct classification region. At this time, a larger dynamic step size is used to enable the sample to explore the gradient direction within a larger range and avoid falling into local optima;

[0023] Finally, to guide the sample closer to the decision boundary, combine the dynamic step size to adjust the sample along the opposite direction of the current gradient direction to generate an adjusted sample so as to explore richer gradient information. The specific calculation formula is as follows:

[0024]

[0025] where, to avoid too large a difference in the gradient magnitudes of different pixels, for the gradient Perform standardization processing. Here, the gradients of each sample are standardized so that the mean of their absolute values is 1.0.

[0026] Furthermore, the method for reducing the gradient variance is as follows:

[0027] For the internal samples and the adjusted samples calculate the mean of their gradients to obtain the adjusted gradient This mean operation can balance the information in different gradient directions, ensure that the gradient optimization direction is more accurate, and thus improve the stability and effectiveness of adversarial sample generation; during the gradient optimization process, the gradient directions between different models vary greatly, resulting in a significant increase in gradient variance. If the currently calculated gradient is directly used for updating, it may cause instability in the optimization process and affect the effectiveness of adversarial samples. Therefore, combine the current gradient with historical gradient information to reduce the gradient variance, make the gradient update smoother, and thus avoid drastic fluctuations in the gradient direction. The internal gradient The calculation formula is as follows:

[0028]

[0029] where is the gradient of the internal sample in the (m - 1)-th update, is the internal gradient in the (m - 1)-th update, which is used to reduce the gradient variance. Subsequently, use the internal gradient to update the internal sample to obtain the internal sample

[0030] An adversarial sample generation system based on dynamic variance reduction, comprising:

[0031] An integrated gradient calculation module, which is used to calculate the integrated gradient in the outer loop, traverse the integrated model list, calculate the gradients generated by each model for the current external sample, and after completing the gradient calculation of all models, take their average as the integrated gradient, which is then used for the gradient update in the inner loop;

[0032] A dynamic sample adjustment module, which is used to dynamically adjust the sample to move backward towards the decision boundary, randomly select a model from the integrated model list, calculate the gradient of the internal sample under this model, and calculate the dynamic step size according to the loss of the current internal sample, and adjust the sample backward according to the dynamic step size to generate a new adjusted sample;

[0033] A gradient variance reduction module, which is used to combine the current gradient and historical gradient information to reduce the gradient variance between models, calculate the mean of the gradient of the current adjusted sample and the gradient of the internal sample, and use the gradient information of the previous internal update to reduce the gradient variance, so as to obtain the internal gradient and use it to update the internal sample;

[0034] And an adversarial sample generation module, which is used to generate the final adversarial sample after the external loop is completed. When the internal loop reaches the maximum update frequency, it calculates the mean of the internal gradients to generate perturbations, clips the perturbations according to the set perturbation threshold, adds the clipped perturbations to the external samples to update the external samples, and outputs the final external samples as adversarial samples after the external loop ends.

[0035] A computer system includes a memory, a processor, and a computer program / instructions stored in the memory and executable on the processor. When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction are implemented.

[0036] A computer program product includes computer program / instructions. When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction are implemented.

[0037] Beneficial effects: The present invention proposes an adversarial sample generation method based on dynamic variance reduction. By combining an external loop and an internal loop, it effectively integrates the gradient information of multiple models to generate adversarial samples with high transferability. In the external loop, the benign samples are used as the initial external samples, and the integrated gradients are calculated as the basis for the gradient update in the internal loop. In the internal loop, the current external samples are used as the initial internal samples, and a model is randomly selected to calculate the gradients of the internal samples, thereby increasing the diversity of the perturbations generated by the model. The dynamic step size is calculated according to the loss of the internal samples, and the samples are adjusted to move backward towards the decision boundary to generate new adjusted samples. By combining the gradient information of the current internal samples and the adjusted samples, the gradient direction is optimized, and based on this gradient direction, the integrated gradients of the external loop, and the historical gradient information, the gradient update is performed, thereby reducing the gradient variance between models and stabilizing the gradient update. Perturbations are generated based on the internal gradients to update the internal samples. After the internal update ends, the mean of the internal gradients is used to update the external samples, and the final external samples are output as adversarial samples. Because the present invention adopts the above technical solutions, the adversarial samples generated on the CIFAR-10, CIFAR-100, and ImageNet datasets can all achieve a high attack success rate and effectively achieve high transferability between models with different architectures. Description of the Drawings

[0038] Figure 1 It is a schematic diagram of the overall process of an embodiment of the present invention.

[0039] Figure 2 It is a flowchart of dynamically adjusting samples in an embodiment of the present invention.

[0040] Figure 3 It is a flowchart of reducing gradient variance in an embodiment of the present invention. Specific Embodiment

[0041] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0042] As Figure 1 shown, a method for generating adversarial samples based on dynamic variance reduction provided by an embodiment of the present invention includes the following steps:

[0043] (1) Calculate the integrated gradient, traverse the list of integrated models, calculate the gradients of the external samples under each model, and take their mean as the integrated gradient for updating the gradient in the inner loop;

[0044] (2) Dynamically adjust the samples, randomly select a model from the list of integrated models, calculate the gradient of the model on the internal samples, and calculate the dynamic step size using the loss of the model on the internal samples. Reverse-adjust the internal samples according to the dynamic step size to obtain the adjusted samples;

[0045] (3) Reduce the gradient variance, calculate the mean of the adjusted sample gradient and the internal sample gradient as the adjusted gradient, and reduce the gradient variance between models according to the adjusted gradient, the integrated gradient, and the historical gradient information to obtain the internal gradient, and update the internal samples using the internal gradient;

[0046] (4) Generate adversarial samples. After the inner loop ends, generate perturbations and clip the perturbations according to the mean of the internal gradients, and add the perturbations to the external samples. When the maximum number of iterations of the outer loop is reached, output the final external samples as adversarial samples.

[0047] In step (1), the specific steps for calculating the integrated gradient are as follows:

[0048] In the outer loop, the benign sample x is used as the initial external sample. By traversing the list of integrated models containing N models and calculating the gradients of the external samples under each model, the mean is taken to obtain the integrated gradient for updating the internal gradient. This gradient integrates the information of multiple models, which is beneficial to enhancing the transferability of the samples. The calculation formula is as follows:

[0049]

[0050] where J(·) represents the loss function corresponding to each model, t represents the t-th iteration, is the external sample at the t-th iteration, and y is the corresponding true label.

[0051] In step (2), the process of dynamically adjusting the samples is as Figure 2 shown, and the specific steps are as follows:

[0052] (a) In the inner loop, using the current external sample as the initial inner sample, to increase the diversity of the generated perturbations, randomly select one model from the N models in the ensemble model list and obtain its corresponding loss function J n , and then calculate the gradient of the inner sample under this model The calculation formula is as follows:

[0053]

[0054] Among them, m represents the m-th inner update, is the inner sample of the m-th update;

[0055] (b) Calculate the dynamic step size according to the loss of this model on the inner sample Since the loss value may show large fluctuations at different stages, directly using its original value may lead to drastic changes in the step size, thus affecting the stability of gradient optimization. Therefore, its square root is used for smoothing processing to reduce the impact of extreme loss values on the step size, thereby enhancing the stability of gradient update during the optimization process. The calculation formula is as follows:

[0056]

[0057] Among them, α represents a fixed perturbation step size. When the loss value is large, it indicates that the inner sample is already close to the misclassification area. At this time, a smaller dynamic step size can be used for fine-tuning near the decision boundary, thereby reducing unnecessary perturbations and improving the stability of the gradient optimization direction; on the contrary, when the loss value is small, it indicates that the inner sample is still close to the correct classification area. At this time, a larger dynamic step size enables the sample to explore the gradient direction within a larger range and avoid falling into local optima;

[0058] (c) Combine the dynamic step size to adjust the sample along the opposite direction of the current gradient direction to generate an adjusted sample By guiding the sample closer to the decision boundary, more abundant gradient information can be explored. The specific calculation formula is as follows:

[0059]

[0060] To avoid excessive differences in the gradient magnitudes of different pixels, standardize the gradient Here, standardize the gradient of each sample so that the mean of its absolute value is 1.0.

[0061] In step (3), the process of reducing the gradient variance is as follows Figure 3 and the specific steps are as follows:

[0062] (a) Calculate the mean of the gradients of the internal samples and the adjustment samples to obtain the adjusted gradient This mean operation can balance the information in different gradient directions, ensure that the gradient optimization direction is more accurate, and thus improve the stability and effectiveness of the generation of adversarial samples. The calculation formula is as follows:

[0063]

[0064] (b) During the gradient optimization process, the gradient directions between different models vary greatly, resulting in a significant increase in the gradient variance. If the currently calculated gradient is directly used for update, it may cause instability in the optimization process and affect the effectiveness of the adversarial samples. Therefore, combining the current gradient and the historical gradient information to reduce the gradient variance and make the gradient update smoother, thus avoiding drastic fluctuations in the gradient direction. The internal gradient The calculation formula is as follows:

[0065]

[0066] where is the gradient of the internal sample in the (m - 1)-th update, is the internal gradient in the (m - 1)-th update (the internal gradient in the first iteration is the integrated gradient), which is used to reduce the gradient variance. Subsequently, use the internal gradient to generate perturbations and clip the perturbations, and add the perturbations to the internal samples to update the internal samples, obtaining the internal samples and input this internal sample into the next internal loop for update.

[0067] In step (4), the specific steps for generating adversarial samples are as follows:

[0068] After reaching the maximum update frequency M of the internal loop, calculate the mean G t of the internal gradients, and use G t to update the external samples to obtain the external samples and input this external sample into the next external loop for update. The calculation formula is as follows:

[0069]

[0070] where t represents the number of iterations, represents the external sample in the t-th iteration, and Clip x,ε{·} represents restricting the perturbation within the perturbation range ε of the benign sample x, α represents the perturbation step size, and when the maximum number of iterations T of the outer loop is reached, the adversarial sample is obtained.

[0071] For convenience of description, we evaluate the effect of the present invention using the CIFAR-10, CIFAR-100, and ImageNet image datasets for the classical CNN architecture and ViT architecture models. The process is as follows:

[0072] (1) Collect and process the dataset, download the dataset from the CIFAR-10, CIFAR-100, and ImageNet image dataset websites, and perform operations such as cropping and normalization on it;

[0073] (2) Select models, select the ResNet-18 (Res18) and Inception v3 (Inc-v3) models based on the CNN architecture, and the ViT-Tiny (ViT-T) and DeiT-Tiny (DeiT-T) models based on the ViT architecture as surrogate models, and put them into the integrated model list for generating adversarial samples. Select the ResNet-50 (Res-50), WideResNet-101 (WRN-101), BiT-M-R50×1 (BiT-50), ViT-Base (ViT-B), DeiT-Base (DeiT-B), and Swin-Small (Swin-S) models as target models to test the attack effect of the generated adversarial samples;

[0074] (3) Calculate the integrated gradient, divide the processed dataset into batches and use it as the initial external sample to enter the outer loop. Input the external sample into the models in the integrated model list, calculate the gradient of the external sample under each model and take the mean as the integrated gradient;

[0075] (4) Dynamically adjust the sample, use the current external sample as the internal sample to enter the inner loop, randomly select a model from the integrated model list, calculate the gradient of the internal sample under this model, and calculate the dynamic step size according to the loss of the internal sample, adjust the sample to move backward close to the decision boundary, thereby generating a new adjusted sample;

[0076] (5) Reduce the gradient variance, calculate the mean of the adjusted sample gradient and the internal sample gradient as the adjusted gradient, reduce the gradient variance according to the adjusted gradient, the integrated gradient, and the gradient information of the previous internal update to obtain the internal gradient, use the internal gradient to generate perturbations and crop the perturbations, and add the perturbations to the internal sample to update the internal sample, and input this internal sample into the next inner loop for update;

[0077] (6) Generate adversarial examples. After the inner loop ends, generate perturbations and clip the perturbations based on the mean of the inner gradients, and add the perturbations to the outer examples. When the maximum number of iterations of the outer loop is reached, output the final outer example as the adversarial example.

[0078] Through the above steps, adversarial examples with high transferability are generated, and their attack effects are tested on the target model. The results are shown in Table 1. Among them, ASR (Attack Success Rate) represents the attack success rate of the adversarial examples. The higher the ASR, the stronger the transferability of the adversarial examples.

[0079] Table 1 Experimental Results (Measured by ASR)

[0080] dataset Res-50 WRN-101 BiT-50 ViT-B DeiT-B Swin-S CIFAR-10 70.09 40.83 30.68 34.32 66.31 69.78 CIFAR-100 81.18 67.69 62.29 53.55 79.32 84.87 ImageNet 45.95 52.69 52.57 45.03 58.91 37.10

[0081] Based on the same inventive concept, an embodiment of the present invention provides an adversarial example generation system based on dynamic variance reduction, including: a computing integrated gradient module, configured to compute the integrated gradient in the outer loop, traverse the integrated model list, compute the gradient generated by each model for the current outer example, and after completing the gradient computation of all models, use their average value as the integrated gradient, which is subsequently used for the gradient update of the inner loop; a dynamically adjusting example module, configured to dynamically adjust the example to move backward close to the decision boundary, randomly select a model from the integrated model list, compute the gradient of the inner example under this model, and compute the dynamic step size according to the loss of the current inner example, and adjust the example backward according to the dynamic step size to generate a new adjusted example; a reducing gradient variance module, configured to combine the current gradient and historical gradient information to reduce the gradient variance between models, compute the mean of the gradient of the current adjusted example and the gradient of the inner example, and use the gradient information of the previous inner update to reduce the gradient variance, so as to obtain the inner gradient and use it to update the inner example; and a generating adversarial example module, configured to generate the final adversarial example after the outer loop is completed. When the maximum update frequency of the inner loop is reached, compute the mean of the inner gradients to generate perturbations, clip the perturbations according to the set perturbation threshold, add the clipped perturbations to the outer example to update the outer example, and output the final outer example as the adversarial example after the outer loop ends.

[0082] Regarding the detailed working processes of the above modules, reference can be made to the corresponding steps in the foregoing method embodiment, which will not be elaborated here. The division of the modules is only a form of logical function, and different division strategies can be adopted in actual implementation, such as integrating multiple modules or integrating them into different systems.

[0083] Based on the same inventive concept, an embodiment of the present invention provides a computer system, including a memory, a processor, and a computer program / instructions stored on the memory and executable on the processor. When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction are implemented.

[0084] Based on the same inventive concept, an embodiment of the present invention provides a computer program product, including a computer program / instructions. When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction are implemented.

[0085] Those skilled in the art can recognize that the technical solution of the present invention, in essence or in terms of its contribution to the prior art, can be presented in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions that can cause a computer system (such as a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiments of the present invention. The storage medium includes, but is not limited to, various media that can store computer programs, such as USB flash drives, mobile hard disks, read-only memory ROM, random access memory RAM, magnetic disks, and optical discs.

[0086] Although the present invention has been illustrated and described with respect to preferred embodiments, those skilled in the art should understand that various changes and modifications can be made to the present invention as long as they do not exceed the scope defined by the claims of the present invention.

Claims

1. An adversarial sample generation method based on dynamic variance reduction, characterized in that, The method includes the following steps: In the outer loop, traverse the list of ensemble models, calculate the gradients of each model for the external samples. After the traversal is completed, use the mean of the gradients of the external samples under different models as the ensemble gradient, which is used for gradient update in the inner loop; In the inner loop, randomly select a model from the list of ensemble models, calculate the gradient of the internal samples under this model to enhance the diversity of the generated perturbations. Subsequently, calculate the dynamic step size according to the loss of the current internal samples, and adjust the samples to move backward towards the decision boundary, thereby generating new adjusted samples; To obtain a more accurate gradient optimization direction, calculate the gradient of the adjusted samples and combine it with the gradient of the internal samples. Subsequently, use the historical gradient information to reduce the gradient variance, thereby obtaining the internal gradient, which is used to update the internal samples; When the inner loop reaches the specified update frequency, calculate the mean of the internal gradients to generate perturbations, and perform perturbation clipping according to the perturbation threshold. Subsequently, add the perturbations to the external samples. After the outer loop iteration is completed, output the final external samples as adversarial samples.

2. The adversarial sample generation method based on dynamic variance reduction according to claim 1, wherein, The method for calculating the ensemble gradient is: In the outer loop, iterate through the list of ensemble models containing N models, calculate the gradients of the external samples under each model, and take their mean to obtain the ensemble gradient and use it to update the internal gradient. This gradient fuses the information of multiple models, which is beneficial to enhancing the transferability of samples. The calculation formula is as follows: Among them, J(·) represents the loss function corresponding to each model, t represents the t-th iteration, is the external sample at the t-th iteration, and y is the corresponding true label.

3. A method for generating adversarial samples based on dynamic variance reduction according to claim 1, characterized in that The method for dynamically adjusting the samples is: First, to increase the diversity of the generated perturbations, a model is randomly selected from N models, and its corresponding loss function J is obtained n , and then the gradient of the internal samples under this model is calculated The calculation formula is as follows: where m represents the m-th internal update, is the internal sample of the m-th update; Subsequently, according to the internal samples calculate the dynamic step size based on the loss Since the loss value may exhibit large fluctuations at different stages, directly using its original value may lead to drastic changes in the step size, thereby affecting the stability of gradient optimization. Therefore, its square root is used for smoothing to reduce the impact of extreme loss values on the step size, thereby enhancing the stability of gradient updates during the optimization process. The calculation formula is as follows: Among them, α represents a fixed perturbation step size. When the loss value is large, it indicates that the internal samples are already close to the misclassification region. At this time, a smaller dynamic step size can be used to make fine-tuning near the decision boundary, thereby reducing unnecessary perturbations and improving the stability of the gradient optimization direction; on the contrary, when the loss value is small, it indicates that the internal samples are still close to the correct classification region. At this time, a larger dynamic step size is used to enable the samples to explore the gradient direction in a larger range and avoid falling into local optima; Finally, to guide the samples closer to the decision boundary, a dynamic step size is combined The samples are adjusted in the opposite direction of the current gradient direction to generate adjusted samples Thereby, richer gradient information is explored. The specific calculation formula is as follows: Among them, in order to avoid excessive differences in the gradient magnitudes of different pixels, the gradient is normalized. Here, the gradient of each sample is normalized so that the mean of its absolute value is 1.

0.

4. A method for generating adversarial examples based on dynamic variance reduction according to claim 1, characterized in that The method for reducing the gradient variance is: For internal samples and adjustment samples Take the mean of the gradients to obtain the adjustment gradient This mean operation can balance the information in different gradient directions, ensure that the gradient optimization direction is more accurate, and thus improve the stability and effectiveness of adversarial sample generation; during the gradient optimization process, the gradient directions between different models vary greatly, resulting in a significant increase in gradient variance. If the currently calculated gradient is directly used for update, it may cause instability in the optimization process and affect the effectiveness of adversarial samples. Therefore, combine the current gradient with historical gradient information to reduce the gradient variance, make the gradient update smoother, and thus avoid large fluctuations in the gradient direction. Internal gradient The calculation formula is as follows: wherein, is the gradient of the internal samples in the (m - 1)-th update, is the internal gradient in the (m - 1)-th update, which is used to reduce the gradient variance. Subsequently, the internal gradient is used to update the internal samples to obtain the internal samples 5. An adversarial sample generation system based on dynamic variance reduction, characterized in that, It includes: An ensemble gradient calculation module, which is used to calculate the ensemble gradient in the outer loop, traverse the list of ensemble models, calculate the gradients generated by each model for the current external samples. After the gradient calculations of all models are completed, use their average value as the ensemble gradient, which is then used for gradient update in the inner loop; A dynamic sample adjustment module, which is used to dynamically adjust the samples to move backward towards the decision boundary, randomly select a model from the list of ensemble models, calculate the gradient of the internal samples under this model, and calculate the dynamic step size according to the loss of the current internal samples, and adjust the samples backward according to the dynamic step size, thereby generating new adjusted samples; A gradient variance reduction module, which is used to combine the current gradient and historical gradient information to reduce the gradient variance between models, calculate the mean of the gradient of the current adjusted samples and the gradient of the internal samples, and use the gradient information of the previous internal update to reduce the gradient variance, thereby obtaining the internal gradient, which is used to update the internal samples; And an adversarial sample generation module, which is used to generate the final adversarial samples after the outer loop is completed. When the inner loop reaches the maximum update frequency, calculate the mean of the internal gradients to generate perturbations, and perform clipping on the perturbations according to the set perturbation threshold, add the clipped perturbations to the external samples to update the external samples, and output the final external samples as adversarial samples after the outer loop ends.

6. The adversarial sample generation system based on dynamic variance reduction according to claim 5, wherein, The method for calculating the ensemble gradient is: In the outer loop, iterate through the list of ensemble models containing N models, calculate the gradients of the external samples under each model, and take their mean to obtain the ensemble gradient and use it to update the internal gradient. This gradient integrates information from multiple models and is beneficial for enhancing the transferability of samples. The calculation formula is as follows: Among them, J(·) represents the loss function corresponding to each model, t represents the t-th iteration, is the external sample at the t-th iteration, and y is the corresponding true label.

7. The adversarial sample generation system based on dynamic variance reduction according to claim 5, characterized in that The method for dynamically adjusting the samples is: First, to increase the diversity of generated perturbations, a model is randomly selected from N models, and its corresponding loss function J is obtained n , and then the gradient of the internal samples under this model is calculated The calculation formula is as follows: where m represents the m-th internal update, is the internal sample of the m-th update; Subsequently, based on the internal samples calculate the dynamic step size according to the loss Since the loss value may exhibit large fluctuations at different stages, directly using its original value may lead to drastic changes in the step size, thus affecting the stability of gradient optimization. Therefore, its square root is used for smoothing to reduce the impact of extreme loss values on the step size, thereby enhancing the stability of gradient update during the optimization process. The calculation formula is as follows: Among them, α represents a fixed perturbation step size. When the loss value is large, it indicates that the internal samples are already close to the misclassification region. At this time, a smaller dynamic step size can be used to fine-tune near the decision boundary, thereby reducing unnecessary perturbations and improving the stability of the gradient optimization direction. On the contrary, when the loss value is small, it indicates that the internal samples are still close to the correct classification region. At this time, a larger dynamic step size is used to enable the samples to explore the gradient direction in a larger range and avoid falling into local optima; Finally, to guide the samples closer to the decision boundary, a dynamic step size is combined The samples are adjusted in the opposite direction of the current gradient direction to generate adjusted samples Thereby exploring richer gradient information, and the specific calculation formula is as follows: Among them, in order to avoid excessive differences in the gradient magnitudes of different pixels, the gradient is normalized. Here, the gradient of each sample is normalized so that the mean of its absolute value is 1.

0.

8. A system for generating adversarial samples based on dynamic variance reduction according to claim 5, wherein The method for reducing the gradient variance is: For internal samples and adjustment samples calculate the mean of the gradients to obtain the adjustment gradient This mean operation can balance the information in different gradient directions, ensure that the gradient optimization direction is more accurate, and thus improve the stability and effectiveness of adversarial sample generation; during the gradient optimization process, the gradient directions between different models vary greatly, resulting in a significant increase in gradient variance. If the currently calculated gradient is directly used for update, it may cause instability in the optimization process and affect the effectiveness of adversarial samples. Therefore, combine the current gradient with historical gradient information to reduce gradient variance, make the gradient update smoother, and thus avoid drastic fluctuations in the gradient direction, internal gradient The calculation formula is as follows: Among them, is the gradient of the internal samples in the (m - 1)-th update, is the internal gradient in the (m - 1)-th update, which is used to reduce the gradient variance. Subsequently, the internal samples are updated using the internal gradient to obtain the internal samples 9. A computer system, comprising a memory, a processor, and a computer program / instructions stored on the memory and executable on the processor, characterized in that, When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction according to any one of claims 1-4 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, the steps of the adversarial sample generation method based on dynamic variance reduction according to any one of claims 1-4 are implemented.

Images