Method for generating adversarial sample by means of multi-level multi-head attention and self-adaptive query

Abstract

The invention relates to a method for generating an adversarial sample by means of multi-level multi-head attention and self-adaptive query, which is used for effectively reducing the query overhead while remarkably improving the attack success rate in a semi-white box or black box scene, and provides a brand new thought and method for solving the problem.

Description

Technical Field

[0001] The present invention belongs to the technical field of counterattacks and relates to the security research field of deep learning, and specifically to a method for generating adversarial samples by using multi-level multi-head attention and adaptive query. Background Art

[0002] In today's digital age, deep learning models, with their powerful data analysis and pattern recognition capabilities, have found widespread application in numerous key areas, including image recognition and natural language processing. From image recognition technology that accurately identifies suspects in intelligent security systems to natural language processing tools that enable real-time communication across multiple languages, deep learning models are profoundly changing the way we live and work.

[0003] However, as applications continue to deepen, the security issues of deep learning models have become increasingly prominent. Numerous studies have clearly demonstrated that models are extremely vulnerable to adversarial examples during the inference phase. An attacker can simply impose subtle but targeted perturbations on the original input data to cause a previously well-performing model to produce severe classification errors. For example, in image recognition, a model designed to recognize cats can misclassify them as dogs by subtly adjusting an image's pixels. Similarly, in natural language processing, subtle word substitutions in text can mislead sentiment analysis models.

[0004] The dangers of this adversarial attack cannot be underestimated. On a theoretical level, it ruthlessly exposes the internal fragility of deep networks, making us aware of the potential flaws within seemingly powerful models. In practical applications, it poses enormous potential risks to industries such as finance, healthcare, and autonomous driving, which require extremely high security and accuracy. In finance, malicious attacks can lead to misassessments and turmoil in financial markets; in healthcare, they can cause misdiagnosis and endanger patients' lives; and in autonomous driving, they can cause serious traffic accidents.

[0005] In the field of deep learning security research, adversarial attacks are a core and highly concerned topic, which can generally be divided into three distinct scenarios: white-box, semi-white-box, and black-box.

[0006] In a white-box attack scenario, the attacker possesses the internal blueprints of the target model, directly accessing its structure and weights. This is like building a house: knowing not only the overall structure but also the precise position and properties of each building block. This unique advantage allows the attacker to optimize the loss function with efficiency and precision, as if on a smooth path. They can tailor their attack strategy based on the model's internal parameters, quickly finding the optimal perturbation to induce misclassification.

[0007] In stark contrast, the black-box attack scenario presents a target model like a mysterious black box to the attacker. Only the inputs and outputs can be observed, but its internal mechanisms are obscured. The attacker is limited in their interaction with the target model, groping in the dark. To obtain relevant information about the model, the attacker typically needs to frequently query the model's predictions for gradient estimation or distillation. This process is like trying different operations and observing the machine's responses to infer its workings without understanding its internal structure. This is not only time-consuming and labor-intensive, but also often incurs significant overhead. Each query consumes computing resources and time, and the cost of the attack increases dramatically with the number of queries. To alleviate the query pressure in black-box scenarios, numerous researchers have devised strategies based on surrogate models or distilled models. Surrogate models act as "stand-ins" for the target model, mimicking its behavior to provide the attacker with useful information, thereby reducing reliance on the actual black-box model. Distillation models extract knowledge from the target model and condense it into a smaller model to aid attackers in their attacks. However, while these strategies have alleviated query pressure to a certain extent, many problems remain in practical applications. For example, selecting the most representative and valuable query samples from massive amounts of data is like searching for the most precious pearls in a vast ocean – an extremely difficult task. Furthermore, there is a lack of mature solutions to the extent to which adversarial perturbations can be stylized to effectively attack the target model while not being easily detected due to overt perturbations.

[0008] In the design of network architectures for generating adversarial examples, the multi-head attention mechanism initially achieved significant success in natural language processing tasks. In natural language processing, it acts like a sharp language analyst, its parallelized attention heads able to simultaneously focus on different parts of a text, accurately capturing features from different subspaces of the input. For example, when analyzing an article, it can simultaneously focus on multiple aspects, such as the article's topic, sentiment, and grammatical structure. However, when multi-head attention is introduced into image generation, the situation becomes more complex. Images and text have different characteristics, containing rich spatial information and semantic layers. If multi-head attention is introduced without sophisticated multi-level fusion and style control, it would be like scribbling on a beautiful painting. Not only would the advantages of the attention mechanism be lost, but it could even destroy the original structure and semantics of the image. Furthermore, typical adversarial perturbation generators employ only a single convolutional or deconvolutional architecture. This single architecture acts like a master key, attempting to unlock all locks but failing to adapt to the diverse categories or semantic requirements of target models. Different target models may have different requirements for perturbations. Some require more delicate spatial perturbations, while others require more complex semantic perturbations. A single structure is obviously difficult to meet these complex and changing requirements. Summary of the Invention

[0009] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a method for generating adversarial samples by using multi-level multi-head attention and adaptive query. In semi-white-box or black-box scenarios, it significantly improves the attack success rate while effectively reducing the query overhead, providing a new idea and method for solving this problem.

[0010] In order to achieve the above object, the technical solution adopted by the present invention is:

[0011] 1. A method for generating adversarial samples using multi-level multi-head attention and adaptive query, characterized by comprising the following steps:

[0012] Step 1: Model initialization and preparation;

[0013] Determine the generator and discriminator architectures based on the task and select the dataset for the attack experiment. The generator is used to generate adversarial samples, while the discriminator is responsible for distinguishing between real and fake samples. The generator architecture must be adapted to the subsequent multi-level multi-head attention module embedding and support feature mapping processing at different levels. Initialize the generator and discriminator parameters, define the generative adversarial network training loss function, and add L1 or L2 auxiliary losses between the generated samples and the real samples to ensure that the content of the generated samples is similar to the real samples, making the adversarial samples more reasonable.

[0014] Step 2: Data preprocessing;

[0015] Load data from the training set; read image data using PIL or OpenCV and convert it to tensors; normalize the loaded data to accelerate model training and help it converge; increase data diversity and improve model generalization by randomly flipping, rotating, scaling, and cropping images, so that the generated adversarial examples still have good attack effects under different data changes;

[0016] Step 3: Multi-level multi-head attention style embedding;

[0017] A multi-head attention module is inserted into each encoding and decoding layer of the generator network, and one or more "style vectors" are attached to control the perturbation appearance; let Fl represent the feature map of the lth layer of the network, s represents the learnable style vector, and map s to the same channel dimension as Fl through linear projection, and then use the multi-head attention mechanism:

[0018] ;

[0019] By repeating this operation at each layer, the generator can dynamically embed style information at different semantic levels;

[0020] Step 4: Adaptive query strategy;

[0021] For the black-box scenario, an adaptive few-shot query mechanism is introduced: Assuming that the training set batch size is: In each training iteration, the uncertainty of the distillation model's prediction for all samples is calculated, such as

[0022] ;

[0023] Where pj(xi) is the predicted probability of the jth class on sample xi by the distillation model; according to the order of u(xi) from high to low, the first ρ×B samples are selected for real black-box query; ρ is the dynamically adjusted query ratio. If the current attack success rate does not increase enough, ρ is increased; if the success rate increases significantly, ρ is reduced accordingly, thus achieving a balance between attack effectiveness and query cost.

[0024] Step 5: Adversarial training process;

[0025] The generator generates adversarial samples based on the noise vector and processed style information. The noise vector increases sample diversity. During generation, a multi-level multi-head attention mechanism integrates the style vector into feature maps at different levels. Combined with adaptive query sample information, it optimizes the characteristics of the adversarial samples to make them more consistent with the characteristics of the target black-box model and improve the attack success rate. The generated adversarial samples and real samples are input into the discriminator, which outputs the probability that the sample is a real sample. The generator is trained and optimized using the GAN Loss (Generative Adversarial Network Loss function). By continuously adjusting the generator parameters, the generated adversarial samples can more effectively attack the target model, improving the attack success rate.

[0026] Step 6: Effect evaluation

[0027] The effectiveness of AdvGAN is evaluated based on the original AdvGAN attack success rate (Original ASR) and the improved AdvGAN attack success rate (Improved ASR). ASR (Attack Success Rate) indicates the proportion of samples in the test set that are successfully attacked into the specified target_class; a higher value indicates a more successful attack. The attack success rate ASR is calculated as follows:

[0028] ;

[0029] Numerator of the formula The statistics are the number of samples in the entire test dataset that were successfully attacked into the specified target category; the denominator N is the total number of samples in the test dataset; dividing the two and multiplying by 100% gives the attack success rate (ASR) presented as a percentage; the higher the ASR, the greater the proportion of samples in the test set that can be successfully attacked into the specified target category, which means that the adversarial attack method is more successful; conversely, the lower the ASR, the worse the attack effect, and the attack method is less capable of misclassifying samples into the specified target category.

[0030] The beneficial effects of the present invention are:

[0031] First, the necessity of multi-level multi-head attention: In the process of generating adversarial perturbations, each layer of feature mapping carries semantic information at different levels. If style fusion is only performed in the last layer or a fixed layer, the opportunity to fully regulate early or mid-term features may be missed; multi-head attention can process information from different channels or different regions in parallel, improving the ability to capture complex image spaces.

[0032] Second, the importance of adaptive querying: In black-box scenarios, large-scale calls to the target model can incur high costs or delays. By implementing adaptive strategies to prioritize real-world queries for samples that are most valuable for attacks or have the least predictive certainty, the total number of queries can be significantly reduced while ensuring perturbation quality. This is crucial in practical applications, especially given the limitations of commercial or online systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Flowchart of the present invention.

[0034] Figure 2 This is an example diagram.

[0035] Figure 3 This is an example diagram. DETAILED DESCRIPTION

[0036] Model initialization and preparation;

[0037] 1. Select a dataset;

[0038] Assume that the CIFAR-10 dataset is used as the data source for the attack experiment. This dataset contains 50,000 training samples and 10,000 test samples. Each sample is a color image of size 32×32 pixels, covering 10 different categories.

[0039] 2. Determine the architecture;

[0040] Generator: Given that CIFAR-10 images are 32×32×3 (RGB channels), the generator uses a convolutional neural network (CNN) architecture to accommodate subsequent multi-level multi-head attention module embedding. The generator consists of multiple convolutional transpose layers, which take a random noise vector as input and output image data of the same size as the CIFAR-10 image. For example, the input layer receives a 100-dimensional noise vector and passes it through multiple convolutional transpose layers. For example, a convolutional transpose layer with a kernel size of 4, a stride of 2, and padding of 1 increases the number of channels from 1 to 512. Similar operations are then repeated to gradually adjust the number of channels and image size until the output is a 3-channel, 32×32 image.

[0041] The discriminator also uses a CNN architecture to distinguish generated adversarial examples from real CIFAR-10 samples. The input is a 32×32×3 image, which is passed through multiple convolutional layers to output a scalar value representing the probability that the sample is real. For example, the input layer uses a convolutional layer with a kernel size of 4, a stride of 2, and a padding of 1, increasing the number of channels from 3 to 64. Subsequently, multiple convolutional layers are used to gradually process the data, resulting in a single neuron at the output layer.

[0042] Parameter initialization;

[0043] Using the PyTorch framework, the parameters of the generator and discriminator are initialized with the torch.nn.init.normal_() function so that the parameters obey a normal distribution with a mean of 0 and a standard deviation of 0.02.

[0044] Define the loss function;

[0045] We use the binary cross-entropy loss function (BCEWithLogitsLoss), commonly used in generative adversarial networks, as GANLoss. We also add an L1 auxiliary loss between the generated and real samples, implemented using the torch.nn.L1Loss() function. This ensures that the generated adversarial examples are pixel-wise similar to the real samples, improving their plausibility.

[0046] Step 2: Data preprocessing;

[0047] Use the dataset loading tools provided by PyTorch or TensorFlow to load data from the CIFAR-10 training set. Then, use PIL or OpenCV to read the image data and convert it to a tensor. Normalize the loaded data, scaling the image pixel values to an appropriate range, such as [-1, 1] or [0, 1], to accelerate model training and aid convergence. By randomly flipping, rotating, scaling, and cropping the images, you increase data diversity and improve the model's generalization capabilities.

[0048] Step 3: Select the attack target model and attack strategy;

[0049] In this critical step, we need to carefully determine the target model type and carefully select the appropriate attack method based on the specific experimental requirements and scenario characteristics.

[0050] (1) Select the target model to attack;

[0051] First, it's crucial to clarify whether the attack is targeting a semi-white-box model or a black-box model. In a semi-white-box attack scenario, the attacker can obtain key information about the target model, such as its architecture, some parameters, or characteristics of the training data. This partial information provides the attacker with a certain advantage, allowing them to make more targeted adjustments to their attack strategy, potentially increasing the efficiency and success rate of their attack.

[0052] Black-box model attacks, however, present even greater challenges. In these attacks, attackers have little access to key information, such as the target model's internal structure and parameters. They can only attempt to launch attacks by inputting samples into the model and observing its output. In this scenario, attackers must employ more sophisticated and versatile attack strategies to overcome the challenges posed by this lack of information.

[0053] (2) Select the attack method;

[0054] Next, we need to make a decision on the attack method. We have three main options: we can use the multi-level multi-head attention style embedding strategy alone, the adaptive query strategy alone, or a combination of the two.

[0055] The multi-level multi-head attention style embedding strategy is a powerful technical approach. It cleverly inserts a multi-head attention module into each encoding and decoding layer of the generator network and introduces one or more learnable "style vectors" to finely control the perturbation appearance. Specifically, for the feature map Fl of layer l of the network and the learnable style vector s, s is mapped to the same channel dimension as Fl through linear projection. Then, using a multi-head attention mechanism, style information is dynamically embedded at different semantic levels. This strategy enables the generated adversarial examples to better integrate into the feature space of the target model, thereby improving the stealth and success rate of the attack.

[0056] The adaptive query strategy is primarily used in black-box attack scenarios. It introduces an adaptive few-shot query mechanism to strike an optimal balance between attack effectiveness and query cost. In each training iteration, the uncertainty of the distillation model's predictions for all samples is first calculated. For example, the uncertainty u(xi) for each sample is calculated using the formula, where pj(xi) is the probability of the distillation model's prediction of the jth class for sample xi. The samples are then sorted from high to low based on u(xi), and the top ρ×B samples are selected for true black-box queries, where ρ is a dynamically adjusted query ratio. If the current attack success rate is insufficient, ρ is increased to increase the number of query samples, thereby more comprehensively exploring the characteristics of the target model. If the success rate increases significantly, ρ is reduced accordingly to reduce unnecessary query costs.

[0057] We can flexibly choose the appropriate attack strategy based on the actual situation. If the target model is structurally complex and has high requirements for the semantic features of the attack sample, then the multi-level multi-head attention style embedding strategy may be more suitable. If it is a black-box attack scenario, where efficient attack is required within a limited number of queries, then the adaptive query strategy will play a key role. And when facing complex attack scenarios that require comprehensive consideration of multiple factors, combining the multi-level multi-head attention style embedding strategy with the adaptive query strategy may achieve more ideal attack results.

[0058] Choose whether to attack a semi-white-box model or a black-box model, and choose whether to use multi-level multi-head attention style embedding and adaptive query strategy, or both.

[0059] Step 5: Adversarial Training Process

[0060] The generator generates adversarial samples based on the noise vector and processed style information. The noise vector can be generated using random noise to increase sample diversity. A multi-level multi-head attention mechanism integrates the style vector into feature maps at different levels. Combined with adaptive query sample information, it optimizes the features of the adversarial sample, making it more consistent with the characteristics of the target black-box model and improving the attack success rate.

[0061] Generated adversarial examples and real examples are fed into the discriminator, which outputs the probability that the example is real. The generator is trained and optimized using the GAN Loss (Generative Adversarial Network) loss function. By continuously adjusting the generator's parameters, the generated adversarial examples can more effectively attack the target model, increasing the success rate of the attack.

[0062] Step 6: Effect Evaluation

[0063] The effectiveness of AdvGAN is evaluated based on the original AdvGAN attack success rate (Original ASR) and the improved AdvGAN attack success rate (Improved ASR). A higher ASR indicates a greater proportion of samples in the test set that can be successfully misclassified as the designated target class, indicating a more successful adversarial attack method. Conversely, a lower ASR indicates a poorer attack effect, indicating a weaker ability to misclassify samples as the designated target class. The ASR clearly demonstrates that using multi-level multi-head attention style embedding and adaptive query improves the attack success rate in both semi-white-box and black-box scenarios, with the improvement being particularly significant in the black-box scenario.

[0064] Step 7: Generate Results

[0065] Figure 1 The original advgan model effect Figure 2 This is the effect of using multi-level multi-head attention style embedding and adaptive query. It is obvious to the naked eye that this method has less impact on perception than the original advgan model.

[0066] .

Claims

1. A method for generating adversarial samples using multi-level multi-head attention and adaptive query, characterized by: The following steps are involved: Step 1: Model initialization and preparation; Determine the generator and discriminator architectures based on the task and select the dataset for the attack experiment. The generator is used to generate adversarial samples, while the discriminator is responsible for distinguishing between real and fake samples. The generator architecture must be adapted to the subsequent multi-level multi-head attention module embedding and support feature mapping processing at different levels. Initialize the generator and discriminator parameters, define the generative adversarial network training loss function, and add L1 or L2 auxiliary losses between the generated samples and the real samples to ensure that the content of the generated samples is similar to the real samples, making the adversarial samples more reasonable. Step 2: Data preprocessing; Load data from the training set; Image data is read using PIL or OpenCV and converted into tensors; the loaded data is normalized to accelerate model training and help it converge; By randomly flipping, rotating, scaling, and cropping images, we increase data diversity and improve the generalization ability of the model, so that the generated adversarial samples can still have good attack effects under different data changes. Step 3: Multi-level multi-head attention style embedding; Insert a multi-head attention module into each encoding and decoding layer of the generator network, and attach one or more "style vectors" to control the perturbation appearance; let Fl denote the feature map of the lth layer of the network, s denote the learnable style vector, and map s to the same channel dimension as Fl through linear projection, and then use the multi-head attention mechanism: ； By repeating this operation at each layer, the generator can dynamically embed style information at different semantic levels; Step 4: Adaptive query strategy; For the black-box scenario, an adaptive few-shot query mechanism is introduced: Assuming that the training set batch size is: In each training iteration, the uncertainty of the distillation model's prediction for all samples is calculated, such as ； Where pj(xi) is the predicted probability of the jth class on sample xi by the distillation model; according to the order of u(xi) from high to low, the first ρ×B samples are selected for real black-box query; ρ is the dynamically adjusted query ratio. If the current attack success rate does not increase enough, ρ is increased; if the success rate increases significantly, ρ is reduced accordingly, thus achieving a balance between attack effectiveness and query cost. Step 5: Adversarial training process; The generator generates adversarial samples based on the noise vector and processed style information. The noise vector increases sample diversity. During generation, a multi-level multi-head attention mechanism integrates the style vector into feature maps at different levels. Combined with adaptive query sample information, it optimizes the characteristics of the adversarial samples to make them more consistent with the characteristics of the target black-box model and improve the attack success rate. The generated adversarial samples and real samples are input into the discriminator, which outputs the probability that the sample is a real sample. The generator is trained and optimized using the GAN Loss (Generative Adversarial Network Loss function). By continuously adjusting the generator parameters, the generated adversarial samples can more effectively attack the target model, improving the attack success rate. Step 6: Effect evaluation The effectiveness of AdvGAN is evaluated based on the original AdvGAN attack success rate (Original ASR) and the improved AdvGAN attack success rate (Improved ASR). ASR (Attack Success Rate) indicates the proportion of samples in the test set that are successfully attacked into the specified target_class; a higher value indicates a more successful attack. The attack success rate ASR is calculated as follows: ； Numerator of the formula The statistics are the number of samples in the entire test dataset that were successfully attacked into the specified target category; the denominator N is the total number of samples in the test dataset; dividing the two and multiplying by 100% gives the attack success rate (ASR) presented as a percentage; the higher the ASR, the greater the proportion of samples in the test set that can be successfully attacked into the specified target category, which means that the adversarial attack method is more successful; conversely, the lower the ASR, the worse the attack effect, and the attack method is less capable of misclassifying samples into the specified target category.

Images