Cross-modal migration attack method and system based on attention mechanism

Abstract

The invention provides a cross-modal migration attack method and system based on an attention mechanism, and relates to the technical field of artificial intelligence. According to the method, the migration-based black box attack is carried out on the image model pre-trained only on the ImageNet to explore the confrontation migration between the image model and the video model, and a space attention mechanism is introduced when the cross-modal attack model extracts the feature space, so that the model can be automatically focused on key space regions in the image and the video; generating an adversarial sample from the image model by using the feature space to attack the black box video model, thereby improving the success rate of the adversarial sample in attacking the black box model; according to the method, the technical problem that the attack effect is limited due to the fact that the challenge of insufficient mobility is faced in resisting the black box attack of the sample and the intra-frame space semantic information is neglected in the prior art is solved, so that researchers can better identify and repair the security vulnerability of the model, and the robustness of the model is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a cross-modal transfer attack method and system based on an attention mechanism. Background Art

[0002] As human society accelerates its digitalization, a vast amount of data is generated. Artificial intelligence models trained on this vast amount of data have been widely used in various scenarios, such as image recognition, video classification, and natural language understanding. At the same time, security issues with these models are gradually emerging.

[0003] Adversarial example attacks are highly concealed, especially the recently discovered transferability of adversarial examples across different models, significantly lowering the barrier for attackers and making black-box attacks possible. Specifically, attackers use fully accessible models (also known as white-box models) to generate adversarial examples and then attack potentially deployed models (also known as black-box models) that only have access to their outputs. This is known as a transfer attack.

[0004] Compared to images, videos have a temporal dimension, making black-box attacks in this domain more complex. Furthermore, existing video adversarial attack methods generally ignore the spatial semantic information within video frames, resulting in insufficient transferability of generated adversarial examples.

[0005] Therefore, the present invention provides a cross-modal transfer attack method and system based on the attention mechanism to solve the technical problems faced by the existing technology in black-box attacks on adversarial samples, such as insufficient transferability, ignoring the spatial semantic information within the frame, and resulting in limited attack effects. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a cross-modal transfer attack method and system based on the attention mechanism. It aims to carry out research around video transfer attacks, enhance the portability of cross-modal attacks by introducing a spatial attention mechanism, and improve the effectiveness of perturbations by focusing on key areas, so that researchers can better identify and repair security vulnerabilities of the model, thereby improving the robustness of the model.

[0007] To achieve the above objectives, this application proposes a cross-modal transfer attack method based on the attention mechanism for performing video attacks on black-box models, including the following steps: Step 1: Select a clean sample as the input video frame and input it into the image model; Step 2: Obtain the features of the input video frame in the middle layer of the image model to obtain the middle layer features; Step 3: Introduce the attention mechanism to focus the image model on the key areas of the video frame; Step 4: Generate adversarial frames by minimizing the weighted cosine similarity of the intermediate layer features, and conduct video attacks on the black box model through adversarial samples.

[0008] As a further solution, in step 1, the image model is an ImageNet pre-trained image model.

[0009] As a further solution, in step 3, the image model focuses on the key areas of the video frame by: Identify scenes based on video actions and determine key areas of video frames; Calculate the corresponding spatial attention matrix based on the key areas of the video frame; Weight the spatial attention matrix and the intermediate layer features of the image model to obtain the weighted features; The weighted features are used to generate adversarial frames to enhance key spatial regions and weaken non-critical regions.

[0010] As a further solution, the spatial attention matrix is ​​obtained by the following steps: Perform global average pooling on the intermediate layer features to obtain vector ; Through the fully connected layer and Activation function pair vector Process and get the output result ; Use the sigmoid function to Map to interval, get the spatial attention weight matrix .

[0011] As a further solution, the fully connected layer includes a first fully connected layer and a second fully connected layer; wherein, the vector Perform dimensionality reduction and reduce the number of parameters, and pass After activation function, the output is ; The output after dimensionality reduction is converted through the second fully connected layer Remap back to the channel dimension to get the output result .

[0012] As a further solution, in step 4, the adversarial perturbation is optimized by minimizing the cosine similarity of the intermediate layer features of the adversarial sample and the clean sample. , using the Adam optimizer to iteratively update, the calculation formula is: in, Representation sample No. frame, is the number of channels, is the height, is the width, represents the spatial attention weight matrix, Represents the middle layer features, represents the weighted features; is the learning rate, which controls the update step size of the adversarial perturbation in each iteration; Indicates the first Adversarial perturbation of the frame, function It is calculated and The cosine similarity between them is used to measure the similarity between the intermediate layer features of the adversarial sample and the clean sample.

[0013] As a further solution, initialize the adversarial perturbation And iteratively update the Adam optimizer, through the updated adversarial perturbation Generate adversarial examples: for The number of optimizer iterations, Indicates that Projection to Nearby and satisfying , represents adversarial samples, represents the adversarial frame, and T represents the total number of adversarial video frames.

[0014] On the other hand, the present invention also provides a cross-modal transfer attack system based on an attention mechanism, which generates adversarial samples and uses them to perform video attacks on black box models through a cross-modal transfer attack method based on an attention mechanism as described in any of the above items.

[0015] Compared with related technologies, the cross-modal transfer attack method and system based on the attention mechanism provided by the present invention have the following advantages: The present invention introduces a spatial attention mechanism when extracting feature space, allowing the model to focus on key spatial areas in images and videos to improve the attack effect, and then uses the feature space to generate adversarial samples from the image model to attack the black-box video model, thereby improving the success rate of adversarial samples in attacking the black-box model; solving the technical problem that the existing technology faces the challenge of insufficient transferability in black-box attacks of adversarial samples, ignoring the spatial semantic information within the frame, resulting in limited attack effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1 The overall flow chart of the cross-modal transfer attack method based on the attention mechanism provided by the present invention; Figure 2 Schematic diagram of migration attack; Figure 3 Schematic diagram of the spatial attention module; Figure 4 Schematic diagram of cosine similarity analysis of intermediate layer features of the image model and video model provided by the present invention on clean samples and adversarial samples; Figure 5 Schematic diagram of the activation amplitude change of the channel of the adversarial samples generated on SlowFast-101 and Resnet-101 provided by the present invention; Figure 6 This is a comparison chart of attack performance using NL-101 as a white box model under the UCF-101 dataset provided by the present invention; Figure 7 This is a comparison chart of attack performance using SlowFast-101 as a white box model under the UCF-101 dataset provided by the present invention; Figure 8 This is a comparison chart of attack performance using TPN-101 as a white box model under the UCF-101 dataset provided by the present invention; Figure 9 This is a comparison chart of attack performance using NL-101 as a white-box model on the Kinetics-400 dataset provided by the present invention; Figure 10 This is a comparison chart of attack performance using SlowFast-101 as a white box model on the Kinetics-400 dataset provided by the present invention; Figure 11 This is a comparison chart of attack performance using TPN-101 as a white-box model on the Kinetics-400 dataset provided by the present invention; Figure 12 Schematic diagram of the results of the perturbation layer of the image model under different step sizes and iteration numbers provided by the present invention; Figure 13This is a schematic diagram of the average attack success rate of the CMTA-SAM attack with different numbers of attack layers under different image models provided by the present invention.

[0019] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0021] See also Figure 1 , an embodiment of the present application provides a cross-modal transfer attack method based on an attention mechanism, which is used to perform video attacks on a black box model, including the steps of: Step 1: Select a clean sample as the input video frame and input it into the image model; Step 2: Obtain the features of the input video frame in the middle layer of the image model to obtain the middle layer features; Step 3: Introduce the attention mechanism to focus the image model on the key areas of the video frame; Step 4: Generate adversarial frames by minimizing the weighted cosine similarity of the intermediate layer features, and conduct video attacks on the black box model through adversarial samples.

[0022] It's important to note that in the field of machine learning security, transfer attacks are a type of attack targeting machine learning models. Their core approach involves leveraging one model (typically a white-box model that's easily accessible and manipulable) to generate adversarial examples. These adversarial examples are capable of inducing erroneous outputs in another model (the target model, often a black-box model whose internal structure and parameters the attacker has limited knowledge of). Specifically, transfer attacks exploit similarities or commonalities between different models in terms of feature extraction and decision boundaries. When adversarial examples constructed on one model are carefully designed to carry perturbations that induce similar erroneous responses in other models, they can attack the target model, even if the attacker lacks direct access to or detailed internal knowledge of the target model.

[0023] Research on transferability reveals that adversarial attacks are not limited to targeting specific models. Even if attackers lack direct access to the target model's internal details, they can still generate adversarial examples based on accessible alternative models and then apply these examples to the target model to launch an attack. This form of attack significantly lowers the barrier to effective attack because attackers no longer need to possess precise model information to achieve their attack objectives.

[0024] During a migration attack, the attacker's first task is to select or build a replacement model with similar characteristics to the target model. The attacker then launches a white-box attack on the replacement model. In a white-box attack scenario, the attacker has full access to the replacement model, including key elements such as model parameters, architecture, and training data. FGSM is one of the most common attack methods. This method generates adversarial samples by calculating the gradient of the loss function relative to the input data, and then performing a single, small modification operation on the input data along the gradient direction. The generated adversarial sample will then be applied to another black-box model whose internal information is unknown to the attacker, causing the black-box model to make incorrect judgments. The schematic diagram of the migration attack is shown in the figure below. Figure 2 shown.

[0025] Transfer attacks pose a real and significant threat to real-world deep learning applications. Attackers can launch attacks simply by observing the model's output, without requiring detailed knowledge of the target system. In-depth research on transfer attacks can help more accurately assess the robustness of deep neural networks—that is, their ability to withstand various attacks and interferences. Furthermore, transfer attacks reveal common weaknesses across different models, providing a unique perspective for exploring the underlying principles of deep learning models and helping researchers gain a deeper understanding of their operating mechanisms and potential risks.

[0026] In the field of computer vision, the study of video adversarial examples plays a crucial role, and the study of their transferability is a key issue. Compared to image adversarial examples, video adversarial examples introduce increased complexity due to the inclusion of a temporal dimension. This not only significantly increases the difficulty of attack design and implementation, but also greatly expands the potential impact of an attack.

[0027] Image adversarial attacks typically focus on applying subtle, often imperceptible perturbations to a single static image. While small, these perturbations are sufficient to mislead the model, causing it to incorrectly classify or predict the image. Generating image adversarial examples is relatively straightforward because only a single static image needs to be modified. In contrast, video adversarial examples involve modifying a series of temporally correlated consecutive image frames. This requires the attacker to not only cleverly introduce perturbations into each individual frame, but also maintain consistency across the entire video sequence, ensuring the attack remains effective throughout video playback and successfully disrupts the model's understanding and judgment of the video content.

[0028] In the video domain, the transferability of video adversarial examples is particularly critical. Video content contains extremely rich information and exhibits complex dynamic changes. When processing videos, video classification models must not only interpret the static information contained in a single frame but also grasp the motion and changing trends between frames. Given this, transfer attacks against video adversarial examples must fully consider these time-dependent characteristics. The perturbations imposed by the attacker must not only mislead the model's judgment within a single frame but also continuously interfere with the model's understanding of the video content across the entire time dimension of the video, ensuring that the attack is effective throughout the entire video playback process.

[0029] Transferring adversarial examples from images to videos is a challenging endeavor because there are no white-box video models for generating video adversarial examples. There are two main obstacles to transferring adversarial perturbations generated on image models to attack video models. First, in addition to the domain gap between image and video data, video data contains additional temporal information, which leads to differences in the learned features between image and video models. This difference makes it difficult to transfer adversarial perturbations from images to videos. Second, existing transfer-based attacks on homomodal models (such as image models) are not applicable to cross-modal attack scenarios. Unlike existing transfer-based attacks on images, during the adversarial perturbation generation process, image labels can be used to optimize a task-specific loss function (such as cross-entropy loss), while in cross-modal image-to-video attacks, there are no available labels for video frames.

[0030] In image classification tasks, the attention mechanism, a powerful tool, has been widely used to improve models' image perception and classification capabilities. In traditional image classification models, every input feature is treated as equally important and is used indiscriminately for model calculations. However, in real-world data, different features may contribute different information to different tasks. By dynamically assigning attention weights, the attention mechanism enables the model to autonomously select and focus on important features, thereby improving model performance and generalization. The most typical attention mechanisms include self-attention, spatial attention, and temporal attention.

[0031] The principle of the spatial attention mechanism is based on the basic idea of ​​the attention mechanism: by weighting the features of different spatial locations in the input data, the model can focus on the features of key areas. The core idea of ​​the spatial attention mechanism is to allow the network to learn which spatial regions are important for the current task. This is typically achieved by calculating an attention weight for each spatial location. The larger the weight, the more attention the model pays to the information at that location. This mechanism enables the model to more accurately capture the features that are critical to the task when processing complex data.

[0032] The spatial attention module in the spatial attention mechanism is a key component in the field of image processing. The spatial attention module dynamically adjusts the spatial weights of feature maps to enable the model to use visual information more efficiently and improve the model's utilization of spatial information. Figure 3 Demonstrates the operation of the spatial attention module.

[0033] To address the above situation, this embodiment proposes a cross-modal transfer attack method based on an attention mechanism, which studies the cross-modal transferability of adversarial examples. Specifically, a transfer-based black-box attack is performed on an image model pre-trained solely on ImageNet to explore the adversarial transferability between image and video models. The core purpose of introducing a spatial attention mechanism into the cross-modal attack model is to enable the model to automatically focus on key spatial regions in images and videos, thereby more accurately generating adversarial examples and enhancing the effectiveness of cross-modal attacks.

[0034] The spatial attention mechanism calculates the attention weight of each spatial position and gives higher weight to the features of these key areas, thereby highlighting the importance of these areas. Its specific implementation usually relies on calculating the correlation of feature maps in the spatial dimension.

[0035] Taking images as an example, similarities are calculated between different pixel positions within an image. Regions with high similarity are considered more semantically related and deserve more attention. In video scenarios, not only the spatial relationships between pixels within the same frame are considered, but also information from adjacent frames is combined to determine key spatial regions. This mechanism enables the model to more specifically perturb the features of key regions when generating adversarial examples, improving the effectiveness of adversarial examples and enabling more efficient attacks on video recognition models.

[0036] The goal of the method is to interfere with the intermediate layer features of the ImageNet pre-trained image model to create adversarial video frames to attack the video recognition model; given a video sample , the true label ,in 、 、 、 Represents the number of frames, height, width and number of channels respectively, Indicates the number of classes.

[0037] set up Represents the ImageNet pre-trained image model (such as ResNet, VGG), Represents the video recognition model. This embodiment uses Represents the prediction result of the model. Vector represents the channel dimension of global average pooling, represents the spatial attention weight matrix.

[0038] Therefore, the proposed attack method aims to Generate adversarial examples , the sample can be The video classification model Deception ,in represents adversarial perturbation.

[0039] To ensure resistance to disturbances It is imperceptible. In order to make the disturbance difficult for humans to detect, it is necessary to To limit the size of the disturbance, express norm, this embodiment will Set to .

[0040] Adversarial attacks can be divided into targeted attacks and non-targeted attacks. For targeted attacks, the attacker's goal is to make the model Misclassifying input as attacker-specified.

[0041] The untargeted attack is to simply let the model The input error is classified as any target, rather than a specific category. This embodiment is a non-targeted attack. The goal of the non-targeted adversarial attack can be expressed as follows: (4.1) in Video classification model However, in this embodiment, the attacker cannot access the information about The proposed attack method exploits the knowledge from Generated adversarial samples attack video classification models under black box models .

[0042] Before introducing this method, this example first empirically analyzes the correlation between image and video models. Previous work has demonstrated that using an ImageNet pre-trained image model to generate adversarial perturbations requires fewer queries to attack a black-box video recognition model. This suggests that the mid-level features between the image and video models may be similar to some extent. Therefore, perturbing the mid-level feature maps of the image model will affect the mid-level feature maps of the video model. To verify this hypothesis, we analyzed the similarity of the mid-level features of normal and adversarial frames using cosine similarity between the image and video models.

[0043] In Kinetics-400, we extract intermediate layer features from 400 randomly selected videos and then average them to calculate cosine similarity. For all video models, intermediate layer features are extracted from the first 3D-ResNet block, while for different image models, features are extracted from different intermediate layers. Different intermediate layers are selected for different image models to maximize the similarity between image and video features.

[0044] from Figure 4 As can be seen in Figure 2, the intermediate layer features extracted from the image and video models show a certain degree of similarity, regardless of whether they are clean or adversarial examples. This is primarily because the convolution operations in the image and video models are somewhat similar. It is worth noting that the cosine similarities obtained from the clean and adversarial examples are very similar. This essentially demonstrates that adversarial perturbations have little effect on the similarity in the feature space between the image and video models. Similar trends can be observed when using other intermediate layers of the video model. Figure 4 The cosine similarity of mid-level features between the image and video models is shown.

[0045] To demonstrate that the adversarial perturbations on feature maps are transferable between video and image models, we further compare the magnitude changes in channel activations of image and video models before and after adding the same adversarial perturbations to video frames. Figure 5 As shown in Figure 2, the adversarial examples generated on SlowFast-101 not only perturb the channel activation amplitudes of SlowFast-101, but also those of Resnet-101. Since each feature channel captures a specific pattern of the object and contributes differently to the final classification, the size variation of image and video models may lead to incorrect predictions, which suggests the possibility of transferring adversarial perturbations between image and video models.

[0046] Research has shown that the underlying feature spaces between images and video frames are similar. Therefore, interfering with the intermediate feature maps of the image model will affect the intermediate feature maps of the video model, indicating that adversarial perturbations can be transferred between the image and video models. To further improve the transferability of video attacks, this example proposes a cross-modal transfer attack method based on an attention mechanism, fully considering the spatial semantic information within the video frame.

[0047] The main purpose of this method is to determine that there are similar feature spaces between image and video models, and introduce a spatial attention mechanism when extracting the feature space, so that the model focuses on the key spatial areas in the image and video, thereby improving the attack effect. Then, the feature space is used to generate adversarial samples from the image model to attack the black box video model, thereby improving the success rate of adversarial samples in attacking the black box model. From the above analysis, it can be seen that this embodiment proposes a cross-modal transfer attack algorithm based on the attention mechanism. The overall process of the algorithm is as follows: Figure 1 shown.

[0048] Based on the above observations, this embodiment proposes a cross-modal transfer attack based on the attention mechanism, which generates video adversarial samples from the ImageNet pre-trained image model to improve the transferability of different modal models and attack video models in the black-box model environment.

[0049] First, in the middle layer of the image model, the features of the input video frame, i.e., the middle layer features, are obtained.

[0050] Then, an attention mechanism is introduced to allow the image model to focus on the key areas of the video frame. The calculated spatial attention matrix is ​​weighted with the intermediate layer features of the image model. Since the weighted features highlight the key areas more, the model will perturb these areas more specifically.

[0051] Finally, the adversarial frames are generated by minimizing the weighted cosine similarity of the intermediate layer features, thereby generating more effective adversarial samples to attack the black-box model.

[0052] Specifically, when performing feature extraction operations, the ImageNet pre-trained image model is used For the input video frame Processing to obtain the intermediate layer features .

[0053] in, Indicates the selected middle layer of the image model. Different image models select different middle layers. The selected middle layers are explained later. The purpose is to maximize the similarity between image features and video features.

[0054] These intermediate layer features contain rich spatial information of the image and are the basis for subsequent attention mechanism calculations.

[0055] Next, the spatial attention weights are calculated.

[0056] For the middle layer features Perform global average pooling operation. Assume that, The size is ( is the number of channels, is the height, is width), and is pooled in the spatial dimension ( ) to obtain a channel-dimensional vector The calculation formula is: (4.2) The resulting vector Through two fully connected ( )and Activation function is used for processing.

[0057] The first fully connected layer is defined as , which is used to vector Perform dimensionality reduction to reduce the number of parameters and extract more representative features. The weight matrix is , the bias is , then after and Output after activation function for: (4.3) The second fully connected layer is defined as , Remap the reduced features back to the channel dimension, and its weight matrix is , the bias is , output for: (4.4) According to the above output , use the sigmoid function to Map to interval, get the spatial attention weight matrix , the calculation formula is: (4.5) in, is the sigmoid function, that is , The size and The space dimensions are the same ( ), each element represents the importance of the corresponding spatial position. The closer the value is to 1, the more important the position is, and the closer it is to 0, the less important it is.

[0058] Through the mapping of the sigmoid function, The output of is converted into interpretable attention weights for subsequent weighted operations on the original feature map.

[0059] The calculated spatial attention weight matrix and the intermediate layer features of the image model Perform element-by-element multiplication to obtain weighted features ,Through feature weighting, the features of the key spatial regions are ,enhanced, while the features of the non-key regions are relatively ,weakened.

[0060] In video action recognition scenarios, the features of key action areas such as the hands and feet of a person will be more prominent after weighting. The calculation formula is: (4.6) Finally, the weighted features Used for the subsequent adversarial sample generation process. Optimize the adversarial perturbation by minimizing the cosine similarity of the intermediate layer features of the adversarial sample and the clean sample. , using the Adam optimizer to iteratively update, the calculation formula is: (4.7) in, is the learning rate, which controls the update step size of the adversarial perturbation in each iteration; express No. Frame, function It is calculated and The cosine similarity between them is used to measure the similarity between the intermediate layer features of the adversarial sample and the clean sample. The specific calculation formula for minimizing the cosine similarity is: (4.8) In this way, minimizing the cosine similarity makes it possible to optimize adversarial examples with characteristics orthogonal to those of clean examples.

[0061] set up is the output of the penultimate layer, let represents the weight of the classification layer, so and Highly consistent, allowing for realistic predictions. Utilizing minimization: (4.9) when and With unit length, it can be minimized .

[0062] because and Highly consistent, minimization of cosine similarity leads to The value of is greatly reduced, thus deceiving the image model Make wrong predictions.

[0063] When updating the adversarial perturbation, since the weighted features highlight the key areas more, the model will perturb these areas more specifically.

[0064] Based on the similarity of feature space between image and video models, the generated video samples The video model can be fooled with high probability by interfering with the intermediate layer features of the video.

[0065] Use a small constant value Initialize adversarial perturbations and use The optimizer solves Equation 4.7 and updates .in for The number of optimizer iterations, Indicates that Projection to Nearby to meet .

[0066] After multiple iterations, the adversarial perturbation is projected into the specified range to obtain the adversarial frame , and finally combine all adversarial frames to generate video adversarial samples .

[0067] The attack method proposed in this embodiment is implemented through an algorithm and recorded as CMTA-SAM. The overall description of the attention-based cross-modal transfer attack algorithm (CMTA-SAM) is as follows: To further validate the attention-based cross-modal transfer attack algorithm proposed in this example, we used the Kinetics-400 and UCF-101 datasets, both of which are widely used in video classification tasks. UCF-101 contains 13,320 videos from 101 action categories. Kinetics-400 contains approximately 240,000 videos from 400 human action categories.

[0068] ImageNet pre-trained image model In this experiment, we selected four of the most commonly used image classification models: AlexNet, RestNet-101, SqueezeNet 1.1, and Vgg-16. SqueezeNet 1.1 uses 2.4 times less computation and parameters than SqueezeNet 1.0 without sacrificing accuracy.

[0069] AlexNet consists of eight weighted layers, five of which are convolutional and three are fully connected. It takes as input a 227×227×3 RGB image, which is gradually converted into meaningful predictions at each layer. Restnet-101 is a landmark image classification model in deep learning. Its core contribution lies in the design of residual connections, which address the vanishing gradient and degradation issues in deep network training by allowing information to be transferred directly across layers. It also increases the network depth to 101 layers, comprising convolutional layers, residual modules, global average pooling, and fully connected layers. SqueezeNet, a lightweight convolutional neural network proposed by a Stanford University team in 2016, aims to achieve image classification performance comparable to AlexNet with fewer parameters and computational overhead. Its improved version, SqueezeNet 1.1, further optimizes the structure, reducing model complexity while maintaining accuracy, becoming a classic paradigm for lightweight model design. VGG-16 is a classic image classification model proposed by a team from Oxford University in 2014. Its core contribution is that by stacking small-size convolution kernels (3×3) and deepening the network structure, it proves the key role of depth in model performance and becomes an important paradigm of modern convolutional neural networks.

[0070] Video Classification Model In this experiment, three current mainstream video classification models, namely Non-Local (NL), SlowFast and TPN, were selected and studied in combination with two different backbone networks.

[0071] The I3DCNN proposed by Carreira et al. can effectively capture the spatiotemporal information in videos by expanding the 2D convolution kernel to 3D. The Non-Local network performs well in capturing long-distance and short-distance dependencies in videos. During the experiment, five Non-Local modules were embedded in the I3D model to construct a video classification model that combines the characteristics of the two. In subsequent experiments, this model will be referred to as NL. The SlowFast model is designed for efficient processing of action classification tasks in videos, especially when dealing with tasks that require understanding long-term and short-term dynamics in videos. It shows excellent performance. TPN processes video information of different time scales by constructing a temporal pyramid structure, allowing the model to more efficiently capture and integrate actions and events of different durations, thereby improving video understanding capabilities.

[0072] This example uses ResNet50 and ResNet101 as the backbone networks, respectively, and conducts experiments using the three video classification models mentioned above. For ease of explanation, the following text will use the format "Network-50 / 101" to represent the combination of the three models and different backbone networks.

[0073] Experimental setup The method proposed in this example is evaluated on three different video recognition model architectures: Non-local (NL), SlowFast, and TPN. NL, SlowFast, and TPN use 3D Resnet-50 / 101 as the backbone network. We train these video classification models and datasets Kinetics-400 and UCF-101 from scratch. All models are trained in the RGB domain. For Kinetics 400, every other frame is skipped from 64 randomly selected consecutive frames to construct the input clip, that is, 32 frames. For UCF-101, we use 32 consecutive frames as the input clip. The size of each video frame is 224*224.

[0074] The experiment uses the Attack Success Rate (ASR) as a metric to measure transfer attacks. It represents the probability of misclassification by the black-box model. A higher ASR indicates a higher success rate for the transfer attack, indicating a stronger transferability of the adversarial example. Unless otherwise specified, the Average Attack Success Rate (AASR) is the average ASR across all black-box models. Videos correctly classified by six models (NL-50, NL-101, SlowFast-50, SlowFast-101, TPN-50, and TPN-101) were selected from the Kinetics-400 and UCF-101 test sets as clean samples.

[0075] For the cross-modal transfer attack algorithm based on the attention mechanism, the convolution layer in the spatial attention module sets the convolution kernel size (kernel) to , stride is 2, padding is SamePadding, the number of neurons in the fully connected layer is set to 128, and the maximum perturbation is set to .

[0076] Performance Comparison Since cross-modal model transferability has rarely been explored, this example compares the proposed attack method CMTA-SAM with DR and I2V. DR was originally proposed to enhance cross-task transferability. DR minimizes the standard deviation of intermediate layer features, thereby reducing image recognizability. We extend DR to optimize adversarial examples on ImageNet pre-trained image models and use the same settings as the CMTA-SAM attack. I2V is the first to explore the transferability of adversarial perturbations between image and video models, opening up a new direction for cross-modal adversarial attack research. This example also uses the same settings as the CMTA-SAM attack.

[0077] The results of the attacks on the UCF-101 and Kinetics-400 datasets are shown in Tables 1 and 2, respectively. The following observations emerge from these results. First, the proposed CMTA-SAM attack achieves significantly higher ASR than DR. For example, compared to DR, CMTA-SAM improves AASR by over 64.43% on UCF-101 and 43.62% on Kinetics-400, respectively. Second, the CMTA-SAM attack using Resnet-101 as the white-box image model outperforms all other attacks, indicating that the 2D Resnet-101 and 3D Resnet-101 in the video model backbone share more similar feature spaces than other 2D image models. Third, CMTA-SAM further improves the attack success rate, achieving an average attack success rate (AASR) of 67.61% on the UCF101 dataset and 79.12% on the Kinetics-400 dataset. This demonstrates the effectiveness of attention-based cross-modal transfer attacks. In summary, the method of this embodiment takes into account spatial attention weights, allowing the model to focus on key areas of the image, minimizing the cosine similarity between features from adversarial examples and clean examples, and consistently outperforming DR. Compared to I2V, CMTA-SAM improves AASR by 1.24% on UCF-101 and 1.05% on Kinetics-400, respectively. In most cases, CMTA-SAM is more effective than the I2V method, with a higher attack success rate. This is because the introduction of the spatial attention mechanism allows these image preprocessing models to focus more on the core areas of the image. However, when TPN is a black-box model, the attack success rate of the method of this embodiment is lower than that of I2V. This may be because the TPN model focuses on multi-scale temporal feature fusion and hierarchical temporal modeling, while the method proposed in this embodiment does not consider temporal information, resulting in a lower attack success rate than I2V. The following experiments verify the effectiveness of the proposed CMTA-SAM attack.

[0078] Table 3 summarizes the top-1 verification accuracy of the six models NL-50, NL-101, SlowFast-50, SlowFast-101, TPN-50, and TPN-101 on UCF-101 and Kinetics-400.

[0079] Table 1 ASR of video recognition models on UCF-101 Table 2 ASR of video recognition models on Kinetics-400 Table 3. Top-1 verification accuracy of video recognition models on UCF-101 and Kinetics-400 This embodiment further compares the proposed CMTA-SAM attack with several existing transfer-based attacks, which are designed for homomorphic models (e.g., image models or video models). It is worth mentioning that this comparison is unfair because existing transfer-based attacks require a white-box video recognition model to generate adversarial perturbations. For comparison, this embodiment uses several transfer-based attacks such as FGSM, BIM, MI, DI, TI, SIM, SGM, TAP, ATA, TT as benchmarks, and also compares with the I2V method. For the baseline model, NL-101, SlowFast-101, and TPN-101 are used as white-box models. It has been shown in the study of ILA that the transferability of the generated adversarial samples can be further improved by the proposed fine-tuning methods ILAP and ILAF. Compared with ILAP, Under the norm, ILAF achieves better performance by maintaining the existing adversarial direction and increasing the size of the feature perturbation. Therefore, for the comparison baseline method, this embodiment uses ILAF to fine-tune the generated adversarial samples. Figure 6 , Figure 7 , Figure 8 , Figure 9 , Figure 10 , Figure 11 The comparison results are shown.

[0080] From the results, we can observe the following: In most cases, the CMTA-SAM method proposed in this example still performs much better than ILAF and is better than I2V. Figure 6 , Figure 7 , Figure 8 , Figure 9 As shown in Figure 2, on UCF-101 and Kinetics-400, CMTA-SAM significantly outperforms ILAF when using NL-101 or SlowFast-101 as white-box models. Secondly, when using TPN-101 as the white-box model on Kinetics-400, the CMTA-SAM attack proposed in this example performs worse than the baseline method ( Figure 11 This may be because Kinetics-400 contains richer motion information than UCF-101, which is less likely to be well captured by image models. In contrast, by fusing multiple layers of features, TPN-101 can better capture motion information. Therefore, interfering with motion information ( Figure 11 ) can achieve better performance.

[0081] Next, this embodiment analyzes the time complexity and GPU consumption. As can be seen from Table 4, a cost consumption statistic of the experimental baseline model and the model we proposed, in which some baseline models are selected for comparison. is the number of frames of the video sample, represents the number of iterations, are the corresponding model parameters, which are calculated based on the network framework model. Our proposed model CMTA-SAM is faster in inference time than other baseline models, shortening the entire adversarial sample generation time.

[0082] Table 4 Cost consumption statistics Ablation experiments This example studies the key parameters of the spatial attention mechanism: kernel size, padding, number of neurons in the fully connected layer, and step size. , number of iterations , and different attack layers Impact on Image Models. The evaluation is performed on a video classification model trained on Kinetics-400.

[0083] (1) Convolution kernel size In the ablation experiment, the convolution kernel size directly affects the ability of the spatial attention mechanism to focus on the image disturbance by controlling the receptive field range and feature extraction granularity, thereby significantly changing the attack success rate (ASR). As shown in Table 5, setting an appropriate convolution kernel size is crucial to improving the attack success rate. When the convolution kernel size is 5, the model's attack success rate is the highest. However, increasing the convolution kernel size decreases the attack success rate. In theory, increasing the convolution kernel size can cover a wider range of spatial information and enhance the perturbation resistance of adversarial samples. However, it also introduces redundant noise. A larger receptive field allows the perturbation to spread to a wider area, undermining the model's judgment of the overall structure. Reducing the convolution kernel size reduces the attack success rate. This is because local perturbations cannot easily shake the model's recognition of global semantics. The limited receptive field makes it difficult to model dependencies between distant pixels, resulting in insufficient global consistency of the adversarial perturbation.

[0084] Table 5 Convolution kernel size selection (2) Filling method In ablation experiments, the impact of padding on attack success rate is primarily reflected in the preservation of feature map size and boundary information. As shown in Table 6, the attack success rate is higher when using the same padding method. This is because same padding adds zeros around the input feature map, aligning the size of the feature map after the convolution operation with the input, thus avoiding the loss of boundary information. This helps the spatial attention mechanism more comprehensively capture the characteristics of the target area (including key information near the boundary), thereby generating more effective adversarial examples. However, the attack success rate is lower when using no padding (valid padding). No padding reduces the feature map size, resulting in cropping of boundary information. The spatial attention mechanism may lose key boundary features and fail to accurately locate the attack area, thus reducing the effectiveness of adversarial example generation.

[0085] Table 6 Filling method selection (3) Number of neurons in the fully connected layer In ablation experiments, the impact of the number of neurons in the fully connected layer on the attack success rate is primarily reflected in the balance between feature representation capability and model capacity. Controlling model capacity directly influences the spatial attention mechanism's ability to integrate features, which in turn determines the effectiveness of adversarial example generation. As shown in Table 7, the attack success rate is highest when the number of neurons in the fully connected layer is 128. When the number of neurons is insufficient, the attack success rate is lower. This is because the insufficient capacity of the fully connected layer prevents the full integration of the complex features extracted by the spatial attention mechanism, limiting the ability to generate adversarial examples. However, when the number of neurons is excessive, the attack success rate does not significantly improve, and may even reduce generalization due to overfitting. This may be because too many neurons may capture noise characteristics of the training data rather than true discriminative features, affecting the generalizability of adversarial examples.

[0086] Table 7 Selection of the number of neurons in the fully connected layer (4) Step size and number of iterations The equation for minimizing cosine similarity is solved by the Adam optimizer, which is subject to the step size and the number of iterations impact. Figure 12 The results of using Block-2 of Resnet-101 as the perturbation layer of the image model with different step sizes and iteration numbers are shown. We can see that due to underfitting, the smaller and has poor AASR. Instead, The bigger, The smaller the value, the better the AASR. =0.005, =60, the model achieves the best performance.

[0087] (5) Middle layer selection For each image model, we select four layers from bottom to top (as shown in Table 8) to make adversarial perturbations. Figure 13 Results of performing attacks on different layers are shown.

[0088] Table 8 Middle layer selection The results show that attacking the middle layers (layers 2 or 3) of the image model is more effective than attacking the bottom or top layers. This is because image and video models share a similar feature space, particularly the middle layer features. By extracting middle layer features and calculating cosine similarity on randomly selected videos from the Kinetics-400 dataset, the study found that both clean and adversarial examples share a certain degree of similarity in the middle layer features of the image and video models. This similarity allows perturbations in the middle layers of the image model to affect the middle layer features of the video model, thereby disrupting the video model's predictions and improving the attack success rate. Middle layer features are representative and comprehensive, better reflecting key image information. Furthermore, attacking the middle layers helps balance the adversarial example's adaptability to a specific model and its generalizability across different models. The middle layers capture common model features while avoiding overfitting to a single model, ensuring that the generated adversarial examples are effective against different video recognition models. In Table 8, the highest average attack success rate for each model is highlighted in bold in the middle layer.

[0089] In summary, the present invention proposes a cross-modal transfer attack method based on the attention mechanism. This method introduces a spatial attention mechanism when extracting feature space, allowing the model to focus on the key spatial areas in the image and video to improve the attack effect, and then uses the feature space to generate adversarial samples from the image model to attack the black box video model, thereby improving the success rate of adversarial samples when attacking the black box model. The experiment trained 6 video classification models under the Kinetics-400 and UCF-101 data sets, and evaluated the CMTA-SAM algorithm proposed in this embodiment on these models. A large number of experiments have proved that the algorithm greatly improves the transferability of video adversarial samples. The migration attack method CMTA-SAM of the present invention further improves the attack success rate, which is 67.61% relative to the AASR of the UCF101 data set and 79.12% relative to the AASR of the Kinetics-400 data set.

[0090] The above are only some embodiments of the present application and are not intended to limit the patent scope of the present application. All equivalent structural transformations made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A cross-modal transfer attack method based on attention mechanism, used to attack black box models through video, characterized by: Including steps: Step 1: Select a clean sample as the input video frame and input it into the image model; Step 2: Obtain the features of the input video frame in the middle layer of the image model to obtain the middle layer features; Step 3: Introduce the attention mechanism to focus the image model on the key areas of the video frame; Step 4: Generate adversarial frames by minimizing the weighted cosine similarity of the intermediate layer features, and conduct video attacks on the black box model through adversarial samples.

2. A cross-modal transfer attack method based on an attention mechanism according to claim 1, characterized in that: In step 1, the image model is an ImageNet pre-trained image model.

3. A cross-modal transfer attack method based on attention mechanism according to claim 1, characterized in that: In step 3, the image model focuses on the key areas of the video frame by: Identify scenes based on video actions and determine key areas of video frames; Calculate the corresponding spatial attention matrix based on the key areas of the video frame; Weight the spatial attention matrix and the intermediate layer features of the image model to obtain the weighted features; The weighted features are used to generate adversarial frames to enhance key spatial regions and weaken non-critical regions.

4. A cross-modal transfer attack method based on an attention mechanism according to claim 3, characterized in that: The spatial attention matrix is ​​obtained by the following steps: Perform global average pooling on the intermediate layer features to obtain vector ; Through the fully connected layer and Activation function pair vector Process and get the output result ; Use the sigmoid function to Map to interval, get the spatial attention weight matrix .

5. A cross-modal transfer attack method based on an attention mechanism according to claim 4, characterized in that: The fully connected layer includes a first fully connected layer and a second fully connected layer; wherein, the vector Perform dimensionality reduction and reduce the number of parameters, and pass After activation function, the output is ; The output after dimensionality reduction is converted through the second fully connected layer Remap back to the channel dimension to get the output result .

6. A cross-modal transfer attack method based on an attention mechanism according to claim 4, characterized in that: In step 4, the adversarial perturbation is optimized by minimizing the cosine similarity between the intermediate layer features of the adversarial sample and the clean sample. , using the Adam optimizer to iteratively update, the calculation formula is: in, Representation sample No. frame, is the number of channels, is the height, is the width, represents the spatial attention weight matrix, Represents the middle layer features, represents the weighted features; is the learning rate, which controls the update step size of the adversarial perturbation in each iteration; Indicates the first Adversarial perturbation of the frame, function It is calculated and The cosine similarity between them is used to measure the similarity between the intermediate layer features of the adversarial sample and the clean sample.

7. A cross-modal transfer attack method based on attention mechanism according to claim 6, characterized in that: Initialize adversarial perturbations And iteratively update the Adam optimizer, through the updated adversarial perturbation Generate adversarial examples: for The number of optimizer iterations, Indicates that Projection to Nearby and satisfying , represents adversarial samples, represents the adversarial frame, and T represents the total number of adversarial video frames.

8. A cross-modal transfer attack system based on attention mechanism, characterized by: By using a cross-modal transfer attack method based on an attention mechanism as described in any one of claims 1 to 7, adversarial samples are generated and used to perform video attacks on black box models.

Images