Adversarial sample updating method and device for video model in boundary black box scene

Abstract

The invention discloses an adversarial sample updating method and device for a video model in a boundary black box scene. The method comprises the following steps: firstly, constructing a recursive geometric progression based on the demand of a test scene; generating a temporary adversarial sample based on the current update frequency and the recursive geometric progression; determining a classification label of the temporary confrontation sample based on a video model; and finally, when the classification label is consistent with a preset label, taking the corresponding temporary adversarial sample as a final adversarial sample, so that the high-quality adversarial sample can be quickly generated. And the adversarial sample updating efficiency is improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and specifically relates to a method and device for updating adversarial samples for a video model in a boundary black box scenario. Background Art

[0002] In recent years, neural networks have been widely used in video models. However, they are inherently susceptible to adversarial examples, which can significantly interfere with the classification predictions of video models and lead to serious deviations in prediction results. Therefore, research in this area is of great significance. In bounded black-box testing, adversarial examples are generated by continuously querying the final classification labels of the video model. This has high practical significance. In bounded black-box testing, adversarial examples must be continuously updated. However, existing technologies do not accurately update these adversarial examples, which affects the efficiency of generating bounded black-box adversarial examples.

[0003] Therefore, how to accurately generate adversarial samples in boundary black box scenarios is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] The purpose of this invention is to address the technical problem of inaccurate sample updates in boundary black box scenarios.

[0005] To achieve the above technical objectives, on the one hand, the present invention provides an adversarial sample updating method for a video model in a boundary black box scenario, the method comprising: Build a decreasing geometric progression based on the requirements of the test scenario; Generate a temporary adversarial sample based on the current update number and the scaling geometric progression; Determining a classification label for the temporary adversarial sample based on a video model; When the classification label is consistent with the preset label, the corresponding temporary adversarial sample is used as the final adversarial sample.

[0006] Furthermore, the preset number of cycles and the restriction state are determined according to the scenario requirements. The restriction state includes restriction and non-restriction. When the restriction state is restriction and the current number of updates is not less than the maximum number of cycles, the adversarial sample update is terminated.

[0007] Furthermore, temporary adversarial samples are generated using the following formula: , Where, is a temporary adversarial sample, is the video used for gradient estimation, is the jth parameter in the decreasing geometric sequence, is the estimated gradient.

[0008] Furthermore, when the classification label is inconsistent with the preset label, the current update number is increased by 1 and when the current update number after the increase by 1 is less than the preset cycle number, the j+1th parameter in the shrinking geometric progression is selected to generate a temporary adversarial sample.

[0009] Furthermore, after generating the temporary adversarial sample, the method further includes: Determine whether the current update number is greater than the preset cycle number; If so, the temporary adversarial sample is deleted; if not, the classification label of the temporary adversarial sample is determined.

[0010] On the other hand, the present invention also provides an adversarial sample updating device for a video model in a boundary black box scenario, the device comprising: A construction module for constructing a decreasing geometric progression based on the requirements of the test scenario; A generation module, configured to generate a temporary adversarial sample based on the current update number and the scaling geometric progression; A classification module, configured to determine a classification label of the temporary adversarial sample based on a video model; The determination module is used to use the corresponding temporary adversarial sample as the final adversarial sample when the classification label is consistent with the preset label.

[0011] The present invention provides a method and device for updating adversarial samples for video models in a boundary black-box scenario. Compared with existing technologies, this method first constructs a decreasing geometric progression based on the test scenario's requirements; then generates a temporary adversarial sample based on the current update count and the decreasing geometric progression; then determines the classification label of the temporary adversarial sample based on the video model; and finally, when the classification label matches a preset label, uses the corresponding temporary adversarial sample as the final adversarial sample. This method can quickly generate high-quality adversarial samples, improving the efficiency of adversarial sample updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0013] Figure 1 1 is a flow chart of a method for updating adversarial samples for a video model in a boundary black box scenario according to an embodiment of this specification; Figure 2The figure shows a schematic diagram of the structure of an adversarial sample updating device for a video model in a boundary black box scenario provided by an embodiment of this specification. DETAILED DESCRIPTION

[0014] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of this application.

[0015] like Figure 1 The flowchart of the adversarial sample update method for the video model in the boundary black box scenario provided by the embodiment of this specification is shown. Although this specification provides the method operation steps or device structure shown in the following embodiments or drawings, the method or device may include more or fewer operation steps or module units after partial merger based on routine or no creative labor. In the steps or structures that do not have a necessary causal relationship logically, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or drawings of this specification. When the method or module structure is applied in actual devices, servers or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or drawings (for example, in a parallel processor or multi-threaded processing environment, or even in a distributed processing or server cluster implementation environment).

[0016] Bounded black-box adversarial sample generation is an algorithm that generates samples by testing a model. It mainly consists of four steps: Step 1: Find boundary adversarial samples: In short, the algorithm finds a sample that makes the model more sensitive. For example, if you want to find a boundary adversarial sample for a cat picture, you can take a dog picture and add some pixels from the dog picture to the cat picture. In this way, the modified picture has both cat and dog features. The model is more sensitive to this sample and produces an "ambiguous" feeling. Step 2: Gradient estimation: The algorithm randomly adds some noise to the boundary adversarial examples. At this time, the model's classification of the noisy samples will randomly change. Sometimes it is classified as a cat, and sometimes it is classified as a dog. After repeated testing, the algorithm knows in which direction to add noise to make the model classify the image as a dog. This direction is the gradient. Step 3: Sample update: Based on the gradient calculated in the second step, the boundary adversarial sample generated in the first step can be updated. The updated sample is called an adversarial sample. After the update, the adversarial sample will make the model more inclined to classify it as a dog.

[0017] Step 4: Repeat steps 1 to 3 until the generated adversarial example looks very much like a cat, but the model classifies it as a dog. Then the algorithm achieves its goal.

[0018] This application solution is an improvement to the sample update in step three.

[0019] The adversarial sample update method for the video model in the boundary black box scenario provided in the embodiment of this description can be applied to terminal devices such as clients and servers, such as Figure 1 As shown, the method specifically includes the following steps: Step S101: construct a decreasing geometric progression based on the requirements of the test scenario.

[0020] Specifically, before constructing a decreasing geometric progression, loop control parameters F, t, and T are also set, where F indicates whether the number of loops is limited, i.e., the limit state. If F is true, i.e., non-limited, it indicates that the number of loops needs to be limited by t and T. Otherwise, it indicates that there is no limit, i.e., the limit state is limited. The initial value of t is 0, indicating the number of times the algorithm executes the loop. T is the maximum number of times the algorithm executes the loop, i.e., the preset number of loops. t and T are only valid when F is true. The requirements of the test scenario can be directly set by those skilled in the art, or they can be determined based on the number of video frames required in the test scenario, i.e., each video frame number corresponds to a geometric parameter.

[0021] Select a geometric parameter q, which is used to construct a geometric progression that controls the update step size. If q<1, the update step size becomes smaller and smaller, otherwise the step size becomes larger and larger. In the scenario based on the decision black box video model, we set q<1 and construct a regressive geometric progression based on q. : , In this sequence, the latter term is always smaller than the former term, which means that the update step size is getting smaller and smaller.

[0022] Step S102: Generate a temporary adversarial sample based on the current update number and the scaling geometric progression.

[0023] Specifically, before generating a temporary adversarial sample, when the restriction state is restricted and the current update number is not less than the maximum number of cycles, the adversarial sample update is terminated. When the restriction state is restricted and the current update number is less than the maximum number of cycles, or when the restriction state is unrestricted, the jth item in the sequence is selected. As an update parameter, generate a new adversarial video That is, a temporary adversarial sample (j=0 when the adversarial sample is first updated): , in and represent the video used for gradient estimation and the estimated gradient respectively. It is a temporary adversarial video generated during the operation of the algorithm. Whether it is the final adversarial video depends on its classification in the video model. The video can be the initial adversarial video or the previous adversarial sample.

[0024] Step S103: Determine a classification label of the temporary adversarial sample based on the video model.

[0025] Specifically, Input into the video model f to obtain the classification label y: , Step S104: When the classification label is consistent with the preset label, the corresponding temporary adversarial sample is used as the final adversarial sample.

[0026] Specifically, after generating the temporary adversarial sample, it is determined whether the current update number is greater than the preset cycle number; if so, the temporary adversarial sample is deleted; if not, the classification label of the temporary adversarial sample is determined.

[0027] In a specific application scenario, if F is not true, it means that there is no need to limit the number of loop executions of the algorithm. If F is true, t becomes t+1, and the new t is compared to see if it is greater than T. If it is greater, the update of the adversarial sample is stopped. If it is not greater, the classification label of the temporary adversarial sample is determined. If y is equal to the preset label, If they are equal, it means that the adversarial video is generated successfully, that is, This is the final adversarial video, and the algorithm exits directly. Otherwise, it means that due to the step length Too big, pass Failed to generate adversarial video.

[0028] This application combines the design idea of ​​geometric progression to achieve the purpose of progressively generating adversarial videos by gradually reducing the step size, thereby ensuring the quality of the generated adversarial videos as much as possible.

[0029] Based on the above-mentioned adversarial sample update method for video models in the boundary black box scenario, one or more embodiments of this specification also provide a platform and terminal for adversarial sample update for video models in the boundary black box scenario. The platform or terminal may include devices, software, modules, plug-ins, servers, clients, etc. that use the methods described in the embodiments of this specification and are combined with necessary implementation hardware devices. Based on the same innovative concept, the system in one or more embodiments provided in the embodiments of this specification is as described in the following embodiments. Since the implementation scheme and method for solving the problem of the system are similar, the implementation of the specific system in the embodiments of this specification can refer to the implementation of the aforementioned method, and the repetitions will not be repeated. The terms "unit" or "module" used below can implement a combination of software and / or hardware with predetermined functions. Although the system described in the following embodiments is preferably implemented in software, hardware and a combination of software and hardware are also possible and conceived.

[0030] Specifically, Figure 2 This is a schematic diagram of the module structure of an embodiment of the adversarial sample update device for the video model in the boundary black box scenario provided in this specification, such as Figure 2 As shown, the adversarial sample updating device for the video model in the boundary black box scenario provided in this specification includes: A construction module 201 is used to construct a decreasing geometric progression based on the requirements of the test scenario; A generation module 202, configured to generate a temporary adversarial sample based on the current update number and the scaling geometric progression; A classification module 203 is configured to determine a classification label of the temporary adversarial sample based on a video model; The determination module 204 is configured to use the corresponding temporary adversarial sample as the final adversarial sample when the classification label is consistent with the preset label.

[0031] It should be noted that the above-mentioned system may also include other implementation methods according to the description of the corresponding method embodiment. The specific implementation methods can refer to the description of the above-mentioned corresponding method embodiment, and will not be described one by one here.

[0032] An embodiment of the present application further provides an electronic device, including: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the method provided in the above embodiment.

[0033] The electronic device provided by the embodiment of the present application stores executable instructions of the processor in a memory. When the processor executes the executable instructions, it can first construct a decreasing geometric progression based on the requirements of the test scenario; then generate a temporary adversarial sample based on the current update number and the decreasing geometric progression; then determine the classification label of the temporary adversarial sample based on the video model; finally, when the classification label is consistent with the preset label, the corresponding temporary adversarial sample is used as the final adversarial sample, which can quickly generate high-quality adversarial samples. This improves the efficiency of adversarial sample updates.

[0034] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0035] The methods or devices described in the above embodiments of this specification can implement business logic through computer programs and record them on storage media. The storage media can be read and executed by a computer to achieve the effects of the solutions described in the embodiments of this specification, such as: Build a decreasing geometric progression based on the requirements of the test scenario; Generate a temporary adversarial sample based on the current update number and the scaling geometric progression; Determining a classification label for the temporary adversarial sample based on a video model; When the classification label is consistent with the preset label, the corresponding temporary adversarial sample is used as the final adversarial sample.

[0036] The storage medium may include a physical device for storing information, typically digitizing the information and then storing it in a medium utilizing electrical, magnetic, or optical means. Examples of such storage media include: devices that store information electrically, such as various types of memory devices like RAM and ROM; devices that store information magnetically, such as hard disks, floppy disks, magnetic tapes, magnetic core memories, bubble memories, and USB flash drives; and devices that store information optically, such as CDs and DVDs. Of course, other types of readable storage media exist, such as quantum memories and graphene memories.

[0037] The embodiments of this specification are not limited to those that must comply with industry communication standards, standard computer resource data update and data storage rules, or the situations described in one or more embodiments of this specification. Certain industry standards or slightly modified implementation plans based on the implementation described in the embodiments using custom methods or embodiments can also achieve the same, equivalent, or similar implementation effects as the above embodiments, or the expected implementation effects after deformation. The embodiments obtained by applying these modified or deformed data acquisition, storage, judgment, processing methods, etc. can still fall within the scope of the optional implementation plans of the embodiments of this specification.

[0038] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel ATMEL AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also appreciate that, in addition to implementing the controller in pure computer-readable program code, the controller can also be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing various functions included therein can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0039] The device embodiments described above are merely illustrative. For example, the division of units described is merely a logical functional division. Actual implementations may employ alternative divisions, such as combining or integrating multiple units or plug-ins into another system, or omitting or disabling certain features. Furthermore, the coupling or direct coupling or communication connection shown or discussed between devices or units may be through interfaces, or indirect coupling or communication connection between devices or units may be electrical, mechanical, or otherwise.

[0040] These computer program instructions can also be loaded onto a computer or other programmable resource data updating device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0041] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referenced to the partial description of the method embodiment. In the description of this specification, reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in an appropriate manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification, as well as the features of different embodiments or examples, unless they are mutually inconsistent.

[0042] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in the present invention without departing from the essence of the present invention, and such variations and combinations are still within the scope of protection of the present invention.

Claims

1. The adversarial sample update method for video models in the boundary black box scenario is characterized by: The method comprises: Build a decreasing geometric progression based on the requirements of the test scenario; Generate a temporary adversarial sample based on the current update number and the scaling geometric progression; Determining a classification label for the temporary adversarial sample based on a video model; When the classification label is consistent with the preset label, the corresponding temporary adversarial sample is used as the final adversarial sample.

2. The adversarial sample updating method for a video model in a boundary black box scenario according to claim 1, characterized in that: The preset number of cycles and the restriction state are determined according to the scenario requirements. The restriction state includes restriction and non-restriction. When the restriction state is restriction and the current number of updates is not less than the maximum number of cycles, the adversarial sample update is terminated.

3. The adversarial sample updating method for a video model in a boundary black box scenario according to claim 2, characterized in that: Specifically, temporary adversarial samples are generated through the following formula: ， Where, is a temporary adversarial sample, is the video used for gradient estimation, is the jth parameter in the decreasing geometric sequence, is the estimated gradient.

4. The adversarial sample updating method for a video model in a boundary black box scenario according to claim 3 is characterized in that: When the classification label is inconsistent with the preset label, the current update number is increased by 1 and when the current update number after the increase of 1 is less than the preset cycle number, the j+1th parameter in the shrinking geometric progression is selected to generate a temporary adversarial sample.

5. The adversarial sample updating method for a video model in a boundary black box scenario according to claim 1, wherein: After generating the temporary adversarial sample, the method further includes: Determine whether the current update number is greater than the preset cycle number; If so, the temporary adversarial sample is deleted; if not, the classification label of the temporary adversarial sample is determined.

6. A device for updating adversarial samples for video models in a boundary black box scenario, characterized in that: The device comprises: A construction module for constructing a decreasing geometric progression based on the requirements of the test scenario; A generation module, configured to generate a temporary adversarial sample based on the current update number and the scaling geometric progression; A classification module, configured to determine a classification label of the temporary adversarial sample based on a video model; The determination module is used to use the corresponding temporary adversarial sample as the final adversarial sample when the classification label is consistent with the preset label.

Images