Non-data general adversarial attack method based on adaptive truncation proportion maximization

Abstract

The invention relates to a data-free general adversarial attack method based on adaptive truncation proportion maximization, and the method comprises the following steps: employing uniform distribution to initialize disturbance, generating an artificial image in combination with the number of iterations, carrying out the superposition of the disturbance and the artificial image, and carrying out the training in combination with a data enhancement input model; introducing truncation weights of positive and negative activation values of a convolutional layer in each round of training, dynamically adjusting based on loss feedback, and combining EMA to fuse historical information; calculating the maximum activation value loss by using the updated truncation weight so as to update disturbance, and introducing variance to reduce the loss so as to uniformly activate response; and evaluating the ASR of the current disturbance on the verification set every a preset number of rounds, and if the number of substandard times exceeds a threshold value or reaches the maximum number of iterations, outputting the final general adversarial disturbance. According to the method, the general adversarial disturbance with high attack performance and good mobility can be generated under the condition of no real data, and the method is suitable for scenes such as black box attack and cross-model migration.

Description

Technical Field

[0001] The present invention relates to the fields of deep learning and adversarial attacks, and in particular to a data-free universal adversarial attack method based on maximizing adaptive truncation ratio. Background Art

[0002] Existing adversarial attack research primarily focuses on improving the transferability of adversarial perturbations under ideal conditions, that is, attacking publicly available test sets while being able to use a large number of existing datasets as training samples. However, in practice, attackers often struggle to obtain high-quality data in specific domains, limiting the effectiveness of existing adversarial attack methods in real-world security scenarios. To address this issue, Moosavi-Dezfooli et al. proposed the concept of Universal Adversarial Perturbation (UAP), which aims to generate universal perturbations independent of specific input images. Unlike traditional attacks targeting a single sample, UAP can be superimposed on any sample, rapidly generating a large number of adversarial examples. It can also effectively attack other deep neural network (DNN) models trained on the same dataset, significantly improving the efficiency and threat of the attack.

[0003] However, existing UAP generation methods generally rely on well-annotated datasets as prior knowledge. Acquiring such datasets is extremely challenging in practical applications, especially in data-scarce domains. To this end, data-free universal adversarial perturbation (DAP) methods have been proposed in recent years. These methods do not rely on real data and instead simulate inputs using random noise to update the adversarial perturbation. Limited by the lack of real data, current DAP methods primarily guide perturbation optimization by maximizing the feature activation values ​​of convolutional neural networks. However, most of these methods suffer from over-reliance on proxy models and insufficient perturbation transferability.

[0004] Existing methods typically perform perturbation updates across all convolutional layers and focus only on positive activations, which can easily lead to overfitting to specific proxy models. To alleviate this problem, some studies have proposed strategies to improve transferability by truncating high-level activations. However, existing truncation methods are inefficient and fail to fully improve the generalization ability of perturbations. Summary of the Invention

[0005] In view of the above problems existing in the prior art, the technical problem to be solved by the present invention is to solve the problem that the manually set truncation strategy is difficult to achieve the best effect and is inefficient.

[0006] To solve the above technical problems, the present invention adopts the following technical solution: a data-free universal anti-attack method based on maximizing the adaptive truncation ratio, comprising the following steps:

[0007] S1: Using random uniform distribution Generate a uniform noise as the initial perturbation v, then improve the data input strategy based on the course learning and generate an artificial image in combination with the number of iterations t. When the number of iterations reaches the threshold, a new high-complexity artificial image x is obtained. Linearly superimpose v and x to obtain the initial data x+v;

[0008] S2: Perform data augmentation on x+v, and then use the data augmented x+v as the input of the convolutional layer in the proxy model. The convolutional layer outputs the universal adversarial perturbation v′;

[0009] S3: Set the maximum number of training rounds to T and construct the optimization objective function Here are the steps:

[0010] Assume the original loss function is exist Based on the introduction of sparse loss Truncated Prior Loss and variance reduction loss Get the loss function used to update v′

[0011] in, Used to remove redundant activation values, To improve training efficiency, It is used to reduce the variance between the positive and negative activation responses of the intermediate layer after v′ passes through the proxy model;

[0012] Set the perturbation threshold and interval threshold, use x+v as the input of the convolution layer in the proxy model, and use And update v′ in reverse by gradient descent, if the saturation rate of v′ is R sat If it is greater than the disturbance threshold, the disturbance needs to be compressed. Otherwise, let v′=v and continue to the next round of iterative training.

[0013] Whenever the number of iterations reaches t%H==0, an ASR test is performed on v′. If the number of unqualified ASR tests reaches the interval threshold or the training reaches the maximum number of iterations, the training is stopped and the final universal adversarial perturbation v″ is obtained.

[0014] Among them, the saturation rate R sat The calculation formula is as follows:

[0015]

[0016] Where N = H × W × C, which represents the total number of channels, H, W, and C are the height, width, and number of channels of the perturbation tensor v, and v′ jrepresents the jth element in the current universal adversarial perturbation tensor, 1(·) is an indicator function, which is 1 if the condition is met and 0 otherwise, and ∈ represents the maximum allowed amplitude of the perturbation. A clipping function is introduced during training to ensure that the universal adversarial perturbation is within the amplitude threshold.

[0017] Preferably, the process of obtaining the new high-complexity artificial image x in S1 is as follows:

[0018] S11: Use course learning to improve the data input strategy. The calculation formula is as follows:

[0019]

[0020] θ t =θ t-1 +Δθ

[0021]

[0022] Where t represents the iteration round, and t∈{1,2,3,...,T}; D t The artificial image x represents the complexity corresponding to the iteration round t t , Represents an artificial image x t The probability distribution of θ t represents the distribution parameter that gradually increases with the number of iterations t, and Δθ represents a fixed increment to control the growth of complexity;

[0023] S12: Obtain a new high-complexity artificial image x through iterative progression.

[0024] As a preference, the perturbation total loss function is constructed in S3 The process is as follows:

[0025] S31: Build and The expression is as follows:

[0026]

[0027]

[0028] in, and They represent the weights corresponding to the positive activation values ​​and negative activation values ​​from the i-th convolutional layer to the L-th convolutional layer, st||v′|| ∞ ≤∈,w + ≥0,w - ≥0; and represents the positive and negative activation values ​​of the i-th convolutional layer; φ + =[1(1) ,...,1 (l′) ,0 (l′+1) ,...,0 (L) ],φ - =[1 (1) ,...,1 (l″) ,0 (l″+1) ,...,0 (L) ] represents the optimal direct truncation coefficient, l′ represents the truncation termination layer in the positive activation truncation strategy, l″ represents the truncation termination layer in the negative activation truncation strategy, and F represents a formula; wherein, represents the truncation coefficient used for variance reduction loss calculation in the i-th iteration, is the non-zero mean of the positive activation value, nnz(·) represents the non-zero number, represents the positive activation of the i-th convolutional layer;

[0029] S32: Exploitation and Build The calculation expression is as follows:

[0030]

[0031] Among them, λ pos and λ neg represents a hyperparameter that controls the relative importance of positive and negative activations, and Represents positive and negative activation loss functions, respectively, λ rv′ To adjust the hyperparameter of the activation value variance penalty, μ s represents the hyperparameter that controls the degree of sparsity, μ p represents a hyperparameter that controls the weight of the truncated prior guide, where and The expression is as follows:

[0032]

[0033]

[0034] in, and Represents the positive and negative activation values ​​of the i-th convolutional layer;

[0035] Will and Substitution The final perturbation total loss function is obtained as follows:

[0036]

[0037] Preferably, in S2, the proxy model is a convolutional neural network.

[0038] Preferably, in S3, the amplitude threshold range is [-10 / 255, 10 / 255].

[0039] As a preference, in said S3, the original optimization objective function as follows:

[0040]

[0041] Here, α′ represents a hyperparameter.

[0042] Compared with the prior art, the present invention has at least the following advantages:

[0043] 1. The present invention effectively solves the problem that the traditional manual setting of the truncation ratio easily leads to unstable optimization or poor results by introducing dynamic truncation weights and truncation prior losses. The exponential moving average (EMA) is used to update the truncation weights of each layer activation, and the truncation method is adaptively adjusted based on the loss feedback mechanism, so that the truncation process can be flexibly optimized according to the training stage and disturbance characteristics. This method avoids the training oscillation caused by the drastic fluctuation of the weights, and improves the disturbance convergence speed and attack effect. At the same time, the truncation prior guides the reasonable distribution of weights while ensuring flexibility, taking into account the selective update of positive and negative activation differences, making the optimization more stable and efficient, and breaking through the problem that traditional fixed truncation is difficult to adapt to complex model structures.

[0044] 2. In response to the problems of large feature noise and unstable perturbations in existing data-free UAP methods during cross-model migration, this invention innovatively introduces sparsification loss and variance reduction loss. Sparsification loss forces the truncation weights to be concentrated in a few key convolutional layers, reducing interference from irrelevant features and increasing the decision-making influence of perturbations; variance reduction loss further unifies the activation responses of each layer, reducing randomness and noise accumulation between features, thereby significantly improving the success rate of perturbation migration attacks between different models and tasks. The collaborative optimization of the two not only enhances the generalization ability of the generated perturbations, but also effectively suppresses the risk of overfitting a single model structure, providing more stable and reliable support for data-free cross-model attacks.

[0045] 3. In the perturbation generation process, the present invention combines the idea of ​​course learning and proposes an input strategy that dynamically increases the complexity of artificial images with the number of iterations. By gradually increasing the difficulty or diversity of the synthesized images, it is possible to quickly learn the basic perturbation direction in the early stage, and gradually explore complex feature patterns in the later stage, thereby accelerating the optimization convergence of the perturbation. Compared with the traditional method of using fixed images or randomly generated images, this method can adaptively adjust the input challenge, so that the perturbation can fully learn richer feature changes at different stages, greatly shortening the training time and improving the optimization efficiency. At the same time, gradually increasing the image complexity can also increase the aggressiveness of the final perturbation when facing complex natural images.

[0046] 4. In order to balance the perturbation amplitude control and attack performance, the present invention designs an overall loss function, which weightedly fuses five types of loss terms: positive activation maximization, negative activation minimization, sparsification, truncation guidance, and variance reduction, to form a unified optimization framework. During the optimization process, the perturbation is updated under the guidance of multiple objectives through back propagation, and after each round, the perturbation compression is dynamically adjusted through amplitude clipping and saturation rate detection to prevent amplitude accumulation or saturation. This not only ensures that the perturbation is always controlled within the set amplitude range, but also significantly improves the visual imperceptibility of the perturbation while ensuring the attack success rate, overcoming the problem of perturbation being prone to oversaturation and attack failure in existing methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is a simplified flow chart of the method of the present invention.

[0048] Figure 2 Adaptive truncation weight map for introducing truncation prior.

[0049] Figure 3 Visual comparison of data-free universal adversarial perturbations (Data-free UAP). DETAILED DESCRIPTION

[0050] The present invention is described in further detail below.

[0051] See also Figure 1-Figure 3 , a data-free universal adversarial attack method based on maximizing adaptive truncation ratio, comprising the following steps:

[0052] S1: Using random uniform distribution Generate a uniform noise as the initial perturbation v. Here, the initial perturbation is obtained using uniform noise in the absence of data, that is, to generate a random tensor with a shape of 1*3*width*height in a uniformly distributed interval; then improve the data input strategy based on course learning and generate artificial images in combination with the number of iterations t. When the number of iterations reaches the threshold, a new high-complexity artificial image x is obtained. Linearly superimpose v and x to obtain the initial data x+v; a fixed number of rounds to increase the complexity of the artificially synthesized image, such as 400 rounds, 1600 rounds, and 3200 rounds. Random uniform distribution and course learning are both existing technologies, and the complexity of the artificial image is gradually improved by relying on course learning;

[0053] The process of obtaining a new high-complexity artificial image x in S1 is as follows:

[0054] S11: Use course learning to improve the data input strategy. The improvement method is to adjust the original disordered input of images to input according to the complexity of the images from simple to complex. The calculation formula is as follows:

[0055]

[0056] θ t =θ t-1 +Δθ

[0057]

[0058] Where t represents the iteration round, and t∈{1,2,3,...,T}; D t The artificial image x represents the complexity corresponding to the iteration round t t , Represents an artificial image x t The probability distribution of θ t represents the distribution parameter that gradually increases with the number of iterations t, and Δθ represents a fixed increment to control the growth of complexity;

[0059] S12: Obtain a new highly complex artificial image x through iterative progression;

[0060] S2: Perform data augmentation on x+v, and then use the augmented x+v as the input to the convolutional layer in the proxy model. The convolutional layer outputs the universal adversarial perturbation v′; v can also be passed into the model alone as input. The data augmentation process refers to flipping, cropping, scaling, and other operations on the image to increase the complexity of the image and achieve the purpose of data augmentation;

[0061] In S2, the proxy model is a convolutional neural network, which is a prior art.

[0062] S3: Set the maximum number of training rounds to T and construct the optimization objective function Here are the steps:

[0063] Assume the original loss function is exist Based on the introduction of sparse loss Truncated Prior Loss and variance reduction loss Get the loss function used to update v′

[0064] in, Used to remove redundant activation values, To improve training efficiency, It aims to reduce the variance between the positive and negative activation responses of the intermediate layer after v′ passes through the proxy model; This achieves the goal of fine-grained adaptive adjustment of the truncation strategy;

[0065] Set the perturbation threshold and interval threshold, use x+v as the input of the convolution layer in the proxy model, and use And update v′ in reverse by gradient descent, if the saturation rate of v′ is R sat If the value is greater than the perturbation threshold, the perturbation needs to be compressed. The compression means dividing v′ by 2 or multiplying it by a positive number less than 1, which is actually multiplying a scaling factor. Otherwise, let v′=v and continue to the next round of iterative training.

[0066] Whenever the number of iterations reaches t%H==0, an ASR test is performed on v′. If the number of ASR test failures reaches the interval threshold or the training reaches the maximum number of iterations, training is stopped, and the final universal adversarial perturbation v″ is obtained. ASR testing is an existing technology. ASR takes one thousand images from a real dataset, such as ImageNet, and then superimposes the universal adversarial perturbation after a fixed number of iterations on them. The images are then input into the proxy model to evaluate how many of them are misclassified. A failed ASR test means that the current test score is lower than the previous ASR test maximum.

[0067] Among them, the saturation rate R sat The calculation formula is as follows:

[0068]

[0069] Where N = H × W × C, which represents the total number of channels, H, W, and C are the height, width, and number of channels of the perturbation tensor v, and v′ j represents the jth element in the current universal adversarial perturbation tensor, 1(·) is an indicator function, which is 1 if the condition is met and 0 otherwise, and ∈ represents the maximum allowed amplitude of the perturbation. A clipping function is introduced during training to ensure that the universal adversarial perturbation is within the amplitude threshold. The clipping function is an existing technology.

[0070] The perturbation total loss function is constructed in S3 The process is as follows:

[0071] S31: Build and The expression is as follows:

[0072]

[0073] in, and They represent the weights corresponding to the positive activation values ​​and negative activation values ​​from the i-th convolutional layer to the L-th convolutional layer, st||v′|| ∞ ≤∈,w + ≥0,w - ≥0; and Represents the positive and negative activation values ​​of the i-th convolutional layer; the sparsification loss is mainly used to reduce the truncation weight; φ + =[1 (1) ,...,1 (l′) ,0 (l′+1) ,...,0 (L) ],φ - =[1 (1) ,...,1 (l″) ,0 (l″+1) ,...,0 (L) ] represents the optimal direct truncation coefficient, l′ represents the truncation termination layer in the positive activation truncation strategy, l″ represents the truncation termination layer in the negative activation truncation strategy, and F represents a formula; using effective truncation prior to help update the truncation weight and improve optimization stability; where, represents the truncation coefficient used for variance reduction loss calculation in the i-th iteration, which is obtained by element-wise product of positive and negative truncation weight vectors. is the non-zero mean of the positive activation value, nnz(·) represents the non-zero number, represents the positive activation of the i-th convolutional layer;

[0074] Introducing sparse loss to focus on layers that have a large impact on the results and reduce redundant activation values, thereby improving the transferability of perturbations;

[0075] By introducing variance reduction loss to reduce the variance of activation values, the activation values ​​of each convolutional layer are made more uniform, thereby improving the migration of disturbances.

[0076] Activation maximization tends to increase the activation value and truncation weight, while the sparsification loss promotes the reduction of the truncation weight. The two compete with each other in the optimization process to obtain a better truncation weight.

[0077] S32: Exploitation and Build The calculation expression is as follows:

[0078]

[0079] Among them, λ pos and λ neg represents a hyperparameter that controls the relative importance of positive and negative activations, and Represents positive and negative activation loss functions, respectively, λ rv′ To adjust the hyperparameter of the activation value variance penalty, λ rv′ The main function is to more flexibly control the importance of each part of the loss; μ s represents the hyperparameter that controls the degree of sparsity, μ p represents a hyperparameter that controls the weight of the truncated prior guide, where and The expression is as follows:

[0080]

[0081]

[0082] in, and Represents the positive and negative activation values ​​of the i-th convolutional layer;

[0083] Will and Substitution The final perturbation total loss function is obtained as follows:

[0084]

[0085] In S3, the amplitude threshold range is [-10 / 255, 10 / 255];

[0086] In S3, the original optimization objective function as follows:

[0087]

[0088] st||v′|| ∞ ≤∈

[0089] Here, α′ represents a hyperparameter that controls the relative importance of positive and negative activations. Specific embodiments

[0091] In this example, an initial perturbation v is first generated using random initialization uniformly distributed within the perturbation amplitude range ([-10 / 255, 10 / 255]). A curriculum learning strategy is then introduced to generate artificial images, and the complexity of the artificial images is gradually increased based on the current iteration round. Artificial images are generated primarily in two ways: Gaussian noise images and puzzle images. Gaussian noise images are generated by sampling pixel values ​​from a normal distribution with different standard deviations. The larger the standard deviation, the more complex the image. Puzzle images divide the input image into several non-overlapping grid regions, each filled with random pixels. The greater the number of grids, the higher the complexity. Here, Gaussian images are selected as artificial images during training, and the curriculum learning strategy is used to increase the standard deviation value and the number of artificial image samples in the batch at fixed rounds (800, 1600, 3200) to control image complexity.

[0092] The initial perturbation v is then superimposed on the generated Gaussian noise image x to form the initial input x+v. This input is then processed by data augmentation (including rotation, scaling, cropping, etc.) and input into any convolutional neural network model. Here, the VGG16 model is taken as an example. The initial input is input into the model, and then the activation value output of the middle layer is extracted. The goal is to maximize the activation value response of the middle convolution layer under the input. To this end, the target loss function is defined To maximize the activation value. The gradient of the loss function with respect to the perturbation v is calculated by backpropagation, and the perturbation v is updated using the gradient direction.

[0093] After each round of iterative update, the perturbation amplitude is clipped to limit it to the range of [-10 / 255, 10 / 255]. At the same time, the saturation rate of the current perturbation (i.e. the proportion of pixels that reach the amplitude boundary) is calculated. If the saturation rate exceeds the preset threshold, The specific compression strategy is as follows: if the number of ASR failures since the last ASR optimal value does not exceed the interval threshold, the disturbance v is reduced to 1 / 2 of its original value; otherwise, it is reduced to 0.8 of its original value.

[0094] Furthermore, to determine whether the perturbation has converged, an ASR test is performed every fixed number of rounds (e.g., 400 rounds) during training. If the ASR of the current perturbation in the test is better than the historical best, the best value is updated; otherwise, a "failed round" is recorded. If the number of consecutive failed rounds exceeds a set threshold, or the total number of training rounds reaches an upper limit (e.g., 10,000 rounds), training is terminated early, and the final output is the universal adversarial perturbation v″.

[0095] The ultimately generated universal adversarial perturbation v″ can cause the target model to produce incorrect predictions on a large number of samples without the need for individual optimization for each image. Specifically, adversarial samples can be generated by adding the trained universal perturbation v″ to a real clean image. When these adversarial samples are input into the model, even if the image itself has not participated in the perturbation training, the model may still output incorrect results, showing obvious vulnerability. This perturbation is widely used to evaluate model robustness, conduct transfer attack experiments, perform black-box attack tests, and is used as an enhanced sample in adversarial training to enhance the general defense capability of the model. It also exhibits strong versatility and perturbation capabilities in downstream tasks such as target detection and semantic segmentation. Compared with existing baseline methods, the data-free universal adversarial attack method based on maximizing the adaptive truncation ratio proposed in the present invention performs better in both attack performance and transferability.

[0096] Experimental results and analysis

[0097] Dataset and model selection: The selection of the dataset is consistent with the experimental settings of the existing data-free general attack method, and the adaptive truncation ratio maximization method proposed in this invention is evaluated on the validation set of ImageNet. The present invention selects five classic CNN models as proxy models to produce universal adversarial perturbations, including AlexNet, VGG16, VGG19, ResNet152, and GoogleNet. In order to verify the transferability of UAP, the present invention adopts a cross-validation method, that is, when one of them is a proxy model, the other models are target black-box models. Similarly, considering the differences between CNNs and ViTs, in order to verify the cross-model attack performance of UAP on ViTs, the present invention uses 8 ViTs models as target models, including ViT-B / 16, PiT-B, CaiT-S / 24, Visformer-S, DeiT-B, TNT-S, LeViT-256 and ConViT-B. To verify the attack capability of UAP in cross-task scenarios, the target models selected for the target detection task are: Mask-RCNN, Faster-RCNN, SSD, RetinaNet and FCOS, and the target models for the semantic segmentation task are: FCN-ResNet101 (FCN-RN101), FCN-ResNet50 (FCN-RN50), DeeplabV3-RN101 (DeV3-RN101), DeeplabV3-MobileV3 (DeV3-MoV3) and LRASPP.

[0098] Baseline Methods: This paper compares the current state-of-the-art dataless universal attack methods, including FFF, AAA, GD-UAP, PD-UA, Cosine-UAP, and TRM-UAP. Note that these methods do not fully transfer the comparison attacks. To ensure a fair comparison, this paper replicates their experimental results as closely as possible according to the paper settings of the comparison methods, and conducts comparative experiments with the present invention's ATR-UAP using a unified process.

[0099] Evaluation index and parameter setting: The basic parameter setting of the present invention is consistent with FFF and GD-UAP, and the perturbation amplitude is set to ∈=10. Saturation threshold of saturation scaling strategy The present invention introduces the positive activation φ of TRM-UAP + and negative activation φ - The truncation rate is used as the initial value of the adaptive strategy, and Set to the truncation rate of the smooth activation value strategy. Since the present invention introduces the adaptive truncation strategy and activation smoothing strategy, the present invention sets the appropriate loss weighting coefficient λ for different models. pos ,λ neg ,λ rv ,μ s ,μ p and the exponential moving average (EMA) parameter π + ,π - The maximum number of iterations T is set to 10000, and the convergence threshold of the sampling verification algorithm is set to F max =5.

[0100] Transferability evaluation: To evaluate the transferability of the proposed ATR-UAP method across different model architectures, we created UAPs on five proxy models and verified the attack performance of our method on the ImageNet validation set.

[0101] As shown in Table 1, the comparison results of the method ATR-UAP of the present invention and other data-free universal attacks are shown, and the "Avg" column represents the average value of the ASR of all proxy models. Among them, "Ours (w / o rv)" means that only the adaptive truncation strategy is set, and the activation variance reduction strategy is not added. Ours (ATR-UAP) represents the complete method proposed by the present invention, which combines the adaptive truncation strategy and the activation variance reduction strategy. It can be seen from the average ASR of all proxy models shown in the rightmost column of the table that the ATR-UAP method proposed by the present invention has achieved the best attack performance under the white box setting, and its average ASR has reached 88.38%. And Ours (w / o rv), which only adopts the adaptive truncation strategy, also has an average ASR of 87.39%, which is better than the current baseline method, indicating that the adaptive truncation mechanism of the present invention itself also has a significant effect of improving attack performance.

[0102] Table 1 Comparison of white-box attack performance of ATR-UAP method and other general attack methods

[0103]

[0104] In Table 2, we compare the transferability of ATR-UAP with other common attack methods. Please note that GD-UAP and Cosine-UAP are not compared on all proxy models. To make a fair comparison, we try to replicate their experimental settings as much as possible. bb The average ASR was calculated, but the proxy model was not included, only the attack results on all black-box models were included. The results show that the ATR-UAP method significantly improves the transferability of adversarial perturbations. Compared with the current best attack method, the ATR-UAP proposed in this paper improves the average ASR by 5.65% on five models, with a significant improvement of 14.54% on the AlexNet model. This is believed to be related to the perturbation pattern.

[0105] Table 2 Comparison of transferability of ATR-UAP method and other common attack methods

[0106]

[0107]

[0108] Table 3 Comparison of transferability of data-free universal adversarial perturbations on the ViTs model

[0109]

[0110]

[0111] To further compare the transferability of UAP, we used dataless UAP to attack the ViT model. Table 3 shows the attack performance of our method and other dataless attack methods on the ViT model. The rightmost column calculates the average ASR across all black-box ViTs models. Experimental results show that although the attack capabilities of UAPs generated based on the CNN architecture on the ViT model generally decline, the ATR-UAP method proposed in this paper demonstrates superior attack effectiveness on all target models and exhibits strong transferability. Among them, the ATR-UAP generated using GoogleNet as a proxy model achieves an average ASR of 35.66% on the ViT model, far exceeding the attack performance of other methods.

[0112] Cross-task transferability evaluation: To improve the transferability of the ATR-UAP proposed in this paper in cross-task scenarios, a CNN model is used as a proxy model to generate a universal adversarial perturbation (UAP), and it is applied to target detection and semantic segmentation models with variable input size. Given that the input image size of such models is usually larger than the original UAP size, and direct resizing will destroy the perturbation structure, this paper proposes a "copy, splice, and crop" strategy: according to the width W of the UAP, uap and height H uap The original UAP is concatenated by replicating it horizontally i times and vertically j times to generate an enhanced perturbation UAP`, whose size satisfies UAP`.size ≥ x.size (where x is the dataset test image). Subsequently, the present invention uses a centered cropping operation to crop the UAP' to a perturbation map that matches the input image size. This ensures the structural integrity of the UAP while adapting to arbitrary inputs, effectively improving the generalization and transferability of the perturbation across different visual tasks.

[0113] This paper uses the validation set of the COCO dataset as test data, pre-defines the average precision (AP) and average recall (AR) corresponding to the IoU ratio [0.5:0.95] as evaluation metrics, and attacks multiple object detection models. The experimental results are shown in Table 4. ATR-UAP can significantly reduce the detection performance of each detection model under different proxy models, showing an attack effect that is superior to other methods. In particular, when VGG16 is used as the proxy model, the average AP and AR are reduced to 20.31% and 32.48%, respectively. The results show that the ATR-UAP proposed in this paper also exhibits strong versatility and perturbation capabilities in downstream tasks such as object detection.

[0114] Table 4 Comparison of the transferability of data-free universal adversarial perturbations across tasks on object detection models

[0115]

[0116]

[0117] For the segmentation task, the present invention uses the VOC2012 validation set as test data and uses the average intersection over union (mIoU) of all categories as the performance evaluation indicator. Table 5 shows the attack results comparison of the method of the present invention and the existing typical data-free general adversarial perturbation methods (GD-UAP, Cosine-UAP, TRM-UAP) on various semantic segmentation models (such as FCN, DeepLabV3, LRASPP, etc.). The experimental results show that under the conditions of AlexNet, VGG series, ResNet152 and GoogleNet as source models, the ATR-UAP method proposed in the present invention can effectively reduce the segmentation performance of the target model, significantly outperforming the existing methods, and showing stronger cross-model transfer ability and perturbation generalization ability. For example, when AlexNet is used as the source model, ATR-UAP reduces the average mIoU to 50.72%, which is more effective than GD-UAP (61.01%) and Cosine-UAP (60.32%), fully demonstrating the versatility and effectiveness of the present invention in semantic segmentation cross-task scenarios.

[0118] Table 5 Comparison of the transferability of data-free universal adversarial perturbations across tasks on semantic segmentation models

[0119]

[0120] Ablation experiments

[0121] (1) Activation value variance reduction parameter: In order to explore the effect of activation value reduction on the results, the present invention reduces the activation value variance by λ. rv Ablation experiments were conducted. The present invention keeps the other parameters of the ATR-UAP method as the parameters corresponding to "ATR-UAP". The experiment found that after adding the activation value variance reduction strategy, ASR will show a significant improvement on almost all proxy models. The present invention's experiment observed that the improvement using the VGG19 model is relatively small. The present invention believes that this is because the adaptive truncation weighting has made the activation value variance of VGG19 small enough. It can be seen that blindly increasing the weight of reducing the activation value variance will result in all activation values ​​not being effectively improved, thereby hindering the maximization of the activation value.

[0122] (2) Comparison of different perturbation amplitudes: In order to further verify the attack performance of the present invention under different perturbation intensities, the present invention sets the perturbation amplitude ε to 4, 8 and 16 respectively. To conduct comparative experiments. In this experiment, based on the proposed ATR-UAP method, the present invention generates UAP on three mainstream proxy models, AlexNet, VGG19 and GoogleNet, and conducts performance comparison analysis with three representative data-free attack methods in the prior art, namely GD-UAP, Cosine-UAP and TRM-UAP. The present invention's experiment observed that when the perturbation amplitude ε is small, the attack performance of all methods decreases; when ε is set to 16, the ATR-UAP method proposed by the present invention shows excellent migration attack capabilities on all proxy models, which is significantly better than the methods described in the prior art, further verifying the effectiveness and robustness of the present invention in improving the transferability of adversarial perturbations.

[0123] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data-free universal adversarial attack method based on maximizing adaptive truncation ratio, characterized by: The steps include: S1: Using random uniform distribution Generate a uniform noise as the initial perturbation v, then improve the data input strategy based on the course learning and generate an artificial image in combination with the number of iterations t. When the number of iterations reaches the threshold, a new high-complexity artificial image x is obtained. Linearly superimpose v and x to obtain the initial data x+v; S2: Perform data augmentation on x+v, and then use the data augmented x+v as the input of the convolutional layer in the proxy model. The convolutional layer outputs the universal adversarial perturbation v′; S3: Set the maximum number of training rounds to T and construct the optimization objective function Here are the steps: Assume the original loss function is exist Based on the introduction of sparse loss Truncated Prior Loss and variance reduction loss Get the loss function used to update v′ in, Used to remove redundant activation values, To improve training efficiency, It is used to reduce the variance between the positive and negative activation responses of the intermediate layer after v′ passes through the proxy model; Set the perturbation threshold and interval threshold, use x+v as the input of the convolution layer in the proxy model, and use And update v′ in reverse by gradient descent, if the saturation rate of v′ is R sat If it is greater than the disturbance threshold, the disturbance needs to be compressed. Otherwise, let v′=v and continue to the next round of iterative training. Whenever the number of iterations reaches t%H==0, v′ is tested for ASR. If the number of unqualified ASR tests reaches the interval threshold or the training reaches the maximum number of iterations, the training is stopped. At this time, the final universal adversarial perturbation v is obtained. ″ ; Among them, the saturation rate R sat The calculation formula is as follows: Where N = H × W × C, which represents the total number of channels, H, W, and C are the height, width, and number of channels of the perturbation tensor v, and v′ j represents the jth element in the current universal adversarial perturbation tensor, 1(·) is an indicator function, which is 1 if the condition is met and 0 otherwise, and ∈ represents the maximum allowed amplitude of the perturbation. A clipping function is introduced during training to ensure that the universal adversarial perturbation is within the amplitude threshold.

2. The data-free universal counterattack method based on adaptive truncation ratio maximization according to claim 1, characterized in that: The process of obtaining a new high-complexity artificial image x in S1 is as follows: S11: Use course learning to improve the data input strategy. The calculation formula is as follows: i t =θ t-1 +Δθ Where t represents the iteration round, and t∈{1,2,3,...,T}; D t The artificial image x represents the complexity corresponding to the iteration round t t , Represents an artificial image x t The probability distribution of θ t represents the distribution parameter that gradually increases with the number of iterations t, and Δθ represents a fixed increment to control the growth of complexity; S12: Obtain a new high-complexity artificial image x through iterative progression.

3. The data-free universal anti-attack method based on adaptive truncation ratio maximization according to claim 2, characterized in that: The perturbation total loss function is constructed in S3 The process is as follows: S31: Build and The expression is as follows: in, and They represent the weights corresponding to the positive activation values ​​and negative activation values ​​from the i-th convolutional layer to the L-th convolutional layer, st||x′|| ∞ ≤∈,w + ≥0,w - ≥0; and represents the positive and negative activation values ​​of the i-th convolutional layer; φ + =[1 (1) ,...,1 (l′) ,0 (l′+1) ,...,0 (L) ],φ - =[1 (1) ,...,1 (l″) ,0 (l″+1) ,...,0 (L) ] represents the optimal direct truncation coefficient, l ′ represents the truncation termination layer in the truncation strategy, l ″ represents the truncation termination layer in the negative activation truncation strategy, and F represents a formula; wherein, represents the truncation coefficient used for variance reduction loss calculation in the i-th iteration, is the non-zero mean of the positive activation value, nnz(·) represents the non-zero number, represents the positive activation of the i-th convolutional layer; S32: Exploitation and Build The calculation expression is as follows: Among them, λ pos and λ neg represents a hyperparameter that controls the relative importance of positive and negative activations, and Represents positive and negative activation loss functions, respectively, λ rv′ To adjust the hyperparameter of the activation value variance penalty, μ s represents the hyperparameter that controls the degree of sparsity, μ p represents a hyperparameter that controls the weight of the truncated prior guide, where and The expression is as follows: in, and Represents the positive and negative activation values ​​of the i-th convolutional layer; Will and Substitution The final perturbation total loss function is obtained as follows:

4. The data-free universal counterattack method based on adaptive truncation ratio maximization according to claim 3, characterized in that: In S2, the proxy model is a convolutional neural network.

5. The data-free universal anti-attack method based on adaptive truncation ratio maximization according to claim 4, characterized in that: In S3, the amplitude threshold range is [-10 / 255, 10 / 255].

6. The data-free universal counterattack method based on adaptive truncation ratio maximization according to claim 5, characterized in that: In S3, the original optimization objective function as follows: s.t.||v′|| ∞ ≤∈ Among them, α ′ represents a hyperparameter.

Images