Attack resisting method based on perceptual loss and attack inspiration
Through the PAIA method, combined with perceptual loss and attack inspiration, the generator and discriminator models are constructed, which solves the problem of insufficient generalization ability of the GAN generator and achieves the effect of efficient, stable and strong generalization ability of adversarial sample generation.
Patent Information
- Application Number
- CN202510693918.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-27
- Publication Date
- 2025-09-26
AI Technical Summary
Existing GAN methods for generating adversarial samples have weak generalization capabilities of the generator, making it difficult to cope with attack requirements of different target categories, and have poor effects on complex datasets.
A perceptual loss and attack-inspired adversarial attack method (PAIA) is adopted. By constructing generator and discriminator models, combined with perceptual loss and attacker, joint training is performed. The generator adopts a deep separable convolutional structure to learn the distribution of adversarial perturbations and adapt to the attack requirements of different target categories.
The efficiency and stability of adversarial sample generation are improved, making the generated adversarial samples visually imperceptible, and having good generalization ability across different target categories, reducing computational complexity.
Smart Images
Figure CN120706498A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of anti-attack technology, and in particular to an anti-attack method based on perceptual loss and attack inspiration. Background Art
[0002] In recent years, deep neural networks have achieved breakthroughs in fields such as computer vision and natural language processing, and are widely used in areas such as autonomous driving, facial recognition, and medical diagnosis. However, as deep learning models gain popularity, researchers have discovered serious security vulnerabilities: they are susceptible to adversarial examples. Adversarial examples are attacks created by adding carefully crafted perturbations to the original input, causing the model's predictions to err. These perturbations are typically imperceptible to the human eye. This phenomenon has sparked widespread interest in the robustness of deep learning models and has led to the proposal of various adversarial attack and defense methods.
[0003] At present, a variety of adversarial attack methods have been proposed, among which optimization-based methods dominate. They mainly use gradient information to find perturbations that can maximize the probability of model misclassification. For example, FGSM generates adversarial samples by calculating the gradient of the input sample with respect to the loss function and applying small perturbations along the gradient direction. BIM and PGD attacks introduce iterative optimization based on FGSM to make the attack more effective. The C&W attack method uses optimization technology to directly minimize the perturbation L p norm to generate more covert adversarial samples. Although these methods have excellent attack success rates, they are usually computationally complex and require access to the parameters or gradient information of the target model during the attack process.
[0004] Compared to optimization-based methods, adversarial attack methods based on generative adversarial networks (GANs) have garnered widespread attention in recent years. GANs consist of a generator and a discriminator that compete with each other to produce realistic data samples. Researchers leverage GANs' data generation capabilities to enable them to learn the distribution of samples and directly generate adversarial examples. For example, AdvGAN trains the generator to generate adversarial perturbations and uses the target classifier as part of the discriminator, enabling the generated perturbations to effectively deceive the classifier.
[0005] Compared to optimization-based methods, adversarial examples generated by GANs are computationally cheaper, can quickly generate high-quality attack samples, and can improve the imperceptibility of attacks to a certain extent. However, existing GAN generation methods still suffer from key issues such as weak generalization capabilities of the generators, difficulty in adapting to attacks on different target categories, and poor performance on complex datasets. Summary of the Invention
[0006] This paper proposes a perceptual loss-attack-inspired attack method (PAIA) based on perceptual loss and attack inspiration.
[0007] In order to solve the above technical problems, the technical solutions of the present invention are as follows:
[0008] An adversarial attack method based on perceptual loss and attack inspiration includes the following steps:
[0009] Step 1, data set selection:
[0010] Select public datasets as training data and test data;
[0011] Step 2, discriminator model construction:
[0012] (2a) Use a deep convolutional neural network model to build a discriminator model;
[0013] (2b) Construct three different loss functions and combine them into the loss function of the discriminator model;
[0014] Step 3, generator model construction:
[0015] (3a) Use the encoder module, residual module, and decoder module to build a generator model to generate perturbation noise;
[0016] (3b) Construct three different loss functions and combine them with the perceptual loss as the loss function of the generator model;
[0017] Step 4: Attacker and target model selection:
[0018] Select the current mainstream attack model as the attacker, and use the model to be attacked as the target model;
[0019] Step 5: Generator model and discriminator model training:
[0020] The training set of the selected dataset is input into the attacker and the generator to obtain adversarial samples generated by the attacker and the generator, respectively. The adversarial samples generated by the attacker are then input into the discriminator, and the adversarial samples generated by the generator are input into the target model and the discriminator, respectively. The generator and the discriminator are trained based on the output information of the target model and the discriminator combined with the loss function of the generator and the discriminator.
[0021] Step 6: Test the adversarial attack method based on perceptual loss and attack inspiration:
[0022] Input the test set of the selected dataset into the generator to generate adversarial samples, and then input the generated adversarial samples into the target model for testing;
[0023] In step 1, a public dataset is selected as training data and test data;
[0024] In step (2a), the discriminator model consists of three 4*4 regular convolutional layers, one 1*1 regular convolutional layer, three LeakyReLU activation layers, and one InstanceNorm2d normalization layer;
[0025] In step (2b), the loss function used to train the discriminator is defined as:
[0026]
[0027] in:
[0028]
[0029]
[0030]
[0031] t is the target category of the adversarial attack, X adv represents the adversarial sample generated by the attacker, X pert Denotes the adversarial sample generated by the generator, X real represents the real sample, and y represents the category label of the real sample. adv ) represents the probability that the discriminator determines that the adversarial sample generated by the attacker belongs to category t, P(C=t|X pert ) represents the probability that the discriminator determines that the adversarial sample generated by the generator belongs to category t. P(S=real|X real ) and P(S=pert|X pert ) represent the probability that the discriminator determines that its input is a true sample without adding perturbations and the probability that it is a generated adversarial sample with added perturbations, L pert and L adv The goal of the loss function is to allow the adversarial samples generated by the generator and the adversarial samples generated by the attacker to be classified into the target category by the discriminator, L s The goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed.
[0032] In step (3a), the generator model consists of an encoder module, a decoder module, and an intermediate residual block;
[0033] The encoder module in step (3a) consists of one 3*3 depth convolution, one 1*1 point-by-point convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and two GELU activation layers;
[0034] The decoder module in step (3a) consists of three 3*3 transposed convolutions, two group normalization GroupNorm layers, two GELU activation layers, and one Tanh activation layer;
[0035] The intermediate residual block in step (3a) consists of one 3*3 dilated convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and two GELU activation layers;
[0036] In step (3b), the loss function used to train the generator model is defined as:
[0037]
[0038] in:
[0039]
[0040]
[0041]
[0042]
[0043] P(D=y|X adv ) represents the probability that the category information obtained by inputting the adversarial sample generated by the attacker into the discriminator is the same as y, P(D=y|X pert ) represents the probability that the category information obtained by inputting the adversarial sample generated by the generator into the target model is the same as y, L D(adv) It is used to calculate the category discrimination probability information of the adversarial sample generated by the attacker and input to the discriminator, L D(pert) Used to calculate the category discrimination probability information of the adversarial samples generated by the generator and input into the target model, is the feature map of the real image, Feature maps of adversarial samples generated by the generator, is the weight parameter, ||·||2 is the 2-norm, L s The goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed. perce The introduction of the perceptual loss function can make the adversarial samples generated by the generative model closer to the real samples;
[0044] In step 4, the current mainstream attack model is selected as the attacker; the model to be attacked is the target model.
[0045] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention proposes an adversarial attack method (PAIA) based on perceptual loss and attack inspiration. Specifically, the PAIA method combines the attacker to jointly train the generator and the discriminator, so that the generator can more effectively learn the distribution of adversarial perturbations and adapt to the attack requirements of different target categories. In the PAIA framework, a deep separable convolution is used to optimize the generator structure, which greatly reduces the amount of calculation and improves the efficiency of adversarial sample generation. Secondly, PAIA combines perceptual loss (Perceptual Loss) in the training process, making the generated adversarial samples more stable and more visually difficult to detect. In addition, PAIA introduces the gradient information of the target classifier, so that the generator can more accurately generate adversarial samples for different target categories without the need to train a separate model for each target category, thereby improving the generalization ability of the method. The present invention provides a new idea for the study of adversarial attack methods. BRIEF DESCRIPTION OF THE DRAWINGS
[0046] Figure 1 Flowchart of the counter-attack method based on perceptual loss and attack inspiration in Example 1
[0047] Figure 2 This is the structure diagram of the adversarial attack model based on perceptual loss and attack inspiration in Example 1
[0048] Figure 3 This is the discriminator model structure diagram of Example 1
[0049] Figure 4 This is the generator model structure diagram of Example 1
[0050] Figure 5 The generator of Example 1 generates perturbation result graphs based on the MNIST and Cifar10 datasets respectively
[0051] Figure 6 The generator of Example 1 generates adversarial sample results based on the MNIST and Cifar10 datasets respectively. DETAILED DESCRIPTION
[0052] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0053] Reference Figure 1 and Figure 2 The implementation steps of the present invention are described in further detail.
[0054] Example 1
[0055] Step 1, data set selection:
[0056] The public datasets MNIST and CIFAR10 are selected as the datasets for Example 1;
[0057] Step 2, discriminator model construction:
[0058] (2a) Use a deep convolutional neural network model to build a discriminator model;
[0059] The discriminator model structure described in step (2a) is as follows Figure 3 As shown, it consists of three 4*4 regular convolutional layers, one 1*1 regular convolutional layer, three LeakyReLU activation layers, and one InstanceNorm2d normalization layer;
[0060] (2b) Construct three different loss functions and combine them into the loss function of the discriminator model;
[0061] The loss function used to train the discriminator in step (2b) is defined as:
[0062]
[0063] in:
[0064]
[0065]
[0066]
[0067] t is the target category of the adversarial attack, X adv represents the adversarial sample generated by the attacker, X pert Denotes the adversarial sample generated by the generator, X real represents the real sample, and y represents the category label of the real sample. adv ) represents the probability that the discriminator determines that the adversarial sample generated by the attacker belongs to category t, P(C=t|X pert ) represents the probability that the discriminator determines that the adversarial sample generated by the generator belongs to category t. P(S=real|X real ) and P(S=pert|X pert ) represent the probability that the discriminator determines that its input is a true sample without adding perturbations and the probability that it is a generated adversarial sample with added perturbations, L pert and L adv The goal of the loss function is to allow the adversarial samples generated by the generator and the adversarial samples generated by the attacker to be classified into the target category by the discriminator, L sThe goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed.
[0068] Step 3, generator model construction:
[0069] (3a) Use the encoder module, residual module, and decoder module to build a generator model;
[0070] The generator model structure described in step (3a) is as follows Figure 4 As shown, it consists of 1 encoder module, 1 residual module, and 1 decoder module to generate disturbance information;
[0071] The encoder module described in step (3a) consists of one 3*3 depthwise convolution, one 1*1 pointwise convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and two GELU activation layers;
[0072] The decoder module described in step (3a) consists of three 3*3 transposed convolutions, two group normalization GroupNorm layers, two GELU activation layers, and one Tanh activation layer;
[0073] The intermediate residual block described in step (3a) consists of one 3*3 dilated convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and one GELU activation layer;
[0074] (3b) Construct three different loss functions and combine them with the perceptual loss as the loss function of the generator model;
[0075] The loss function used to train the generator model described in step (3b) is defined as:
[0076]
[0077] in:
[0078]
[0079]
[0080]
[0081]
[0082] P(D=y|X adv ) represents the probability that the category information obtained by inputting the adversarial sample generated by the attacker into the discriminator is the same as y, P(D=y|X pert) represents the probability that the category information obtained by inputting the adversarial sample generated by the generator into the target model is the same as y, L D(adv) It is used to calculate the category discrimination probability information of the adversarial sample generated by the attacker and input to the discriminator, L D(pert) Used to calculate the category discrimination probability information of the adversarial samples generated by the generator and input into the target model, is the feature map of the real image, Feature maps of adversarial samples generated by the generator, is the weight parameter, ||·||2 is the 2-norm, L s The goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed. perce The introduction of the perceptual loss function can make the adversarial samples generated by the generative model closer to the real samples;
[0083] Step 4: Attacker and target model selection:
[0084] The PGD method is selected as the attacker; the target model in the C&W method is selected as the target model of this embodiment; other models (such as the target model in the integrated adversarial training method and the ResNet32 and WRN34 models) can also be selected as the target models to be attacked;
[0085] Step 5: Generator model and discriminator model training:
[0086] 60,000 images from the MNIST training dataset are selected as inputs to the attacker and generator, and adversarial samples generated by the attacker and generator are obtained respectively. The adversarial samples generated by the attacker are then input into the discriminator, and the adversarial samples generated by the generator are input into the target model and discriminator. The generator and discriminator are trained based on the output information of the target model and discriminator combined with the loss functions of the generator and discriminator. The same process can be performed on other datasets (such as the CIFAR10 dataset).
[0087] The specific process of generating adversarial samples in step 5 is as follows: input the training image into the attacker to obtain the adversarial sample X generated by the attacker. adv , input the training image into the generator to obtain the generated perturbation information, such as Figure 5 As shown, the perturbation is then combined with the training image to obtain the adversarial sample X generated by the generator pert ,like Figure 6 As shown;
[0088] The specific process of training the discriminator described in step 5 is: adv and X pert The adversarial sample is input into the discriminator to obtain the classification information of the discriminator, and the classification information is combined with the loss function to optimize the discriminator;
[0089] The specific process of training the generator described in step 5 is: pert Input the target model to get the prediction information, and pert The classification information obtained by the input discriminator is combined with the loss function to optimize the generator;
[0090] Step 6: Test the PAIA method based on the test set of the selected dataset;
[0091] We select 10,000 images from the MNIST test dataset for testing, attack the target model, and finally obtain the attack success rate. The same process can be performed on other datasets (such as the CIFAR10 dataset).
[0092] The specific experimental environment and parameter settings for this embodiment are as follows: All experiments were conducted on a computer configured with an Intel (R) Silver4210R@2.40GHz 2.39GHz, an RTX 3090Ti (12GB) GPU, and a Windows 10 system. The PAIA model was built based on the PyTorch framework and trained using the Adam optimizer. The batch size was set to 128, the learning rate was 0.0001, and the size of the adversarial perturbation was limited to 0.3 on MNIST and 8 / 255 on CIFAR-10. A total of 120 epochs were trained, and the model performance was evaluated at the end of each epoch, and the optimal model weights were saved, as shown in Table 1.
[0093] Table 1 Experimental environment and parameter settings
[0094]
[0095] In order to better illustrate the technical effects of the present invention, in this embodiment, the method proposed in the present invention is subjected to the following quantitative comparison and qualitative analysis with the existing attack methods.
[0096] This example compares this method with the mainstream AdvGAN and AI-GAN methods based on two benchmark datasets, MNIST and Cifar10. The target models used in this example are the target model (Model A) from the C&W method and the target model (Model B) from the ensemble adversarial training method on the MNIST dataset. ResNet32 and WRN34 are used as target models on the Cifar10 dataset. It is worth noting that these four target models were defended using different adversarial defense methods: Adversarial Training (Adv), Ensemble Adversarial Training (Ens), and Iterative Adversarial Training (Iter.Adv). Attack Success Rate (ASR) and attack efficiency were used as evaluation metrics.
[0097] The attack success rates of different adversarial attack methods (FGSM, C&W, PGD, AdvGAN, AIGAN, and PAIA) for different models (Model A and Model B) under different defense mechanisms (Adv, Ens, and Iter.Adv) on the MNIST dataset are demonstrated. PAIA achieved higher attack success rates than AIGAN and AdvGAN in all experimental environments. Specifically, on Model A after applying the Adv defense, PAIA achieved an attack success rate of 24.37%. Furthermore, PAIA demonstrated strong attack capabilities under the Ens and Iter.Adv defense mechanisms, further validating its generalization and stability. Overall, PAIA performed well in terms of attack success rate, demonstrating its effectiveness and adaptability under different defense mechanisms.
[0098] Table 2 Attack success rates of different attack methods on the MNIST dataset in defense scenarios
[0099]
[0100] Table 3 shows the attack success rates of different adversarial attack methods (FGSM, C&W, PGD, AdvGAN, AIGAN, and PAIA) for different models (ResNet32 and WRN34) under different defense mechanisms (Adv, Ens, Iter.Adv) on the CIFAR-10 dataset. PAIA's attack success rate is significantly improved compared to traditional methods, especially maintaining strong attack capabilities under complex defense mechanisms. Compared to the MNIST dataset, CIFAR-10 has higher image complexity. Traditional optimization attack methods have difficulty finding effective perturbation directions in high-dimensional space, resulting in lower attack success rates. However, PAIA, through the combined application of a generator, discriminator, and attacker, learns a more robust adversarial perturbation distribution, resulting in superior attack capabilities against AdvGAN and AIGAN on both ResNet32 and WRN34 models.
[0101] Table 3 Attack success rates of different attack methods on the CIFAR10 dataset in defense scenarios
[0102]
[0103] Table 4 shows experimental comparisons of the attack efficiency of different adversarial attack methods. As can be seen from the table, the C&W method requires multiple iterations during the attack, so it takes significantly longer than other methods. However, due to different optimization methods, the attack efficiency of other methods is significantly improved. Furthermore, the PAIA method uses depthwise separable convolution instead of traditional convolution, reducing the model's computational complexity, resulting in significantly higher efficiency compared to other methods.
[0104] Table 4 Comparison of attack efficiency
[0105]
[0106] The above description is merely a specific embodiment of the present invention and is not intended to limit the manner in which the present invention is to be practiced. However, those skilled in the art will recognize that any modification, equivalent substitution, or improvement that violates the spirit and principles of the present invention is prohibited. Any modification, equivalent substitution, or improvement that is within the spirit and principles of the present invention is intended to be within the scope of protection of the present invention.
Claims
1. A counterattack method based on perceptual loss and attack inspiration, characterized in that The following steps are involved: Step 1, data set selection: Select public datasets as training data and test data; Step 2, discriminator model construction: (2a) Use a deep convolutional neural network model to build a discriminator model; (2b) Construct three different loss functions and combine them into the loss function of the discriminator model; Step 3, generator model construction: (3a) Use the encoder module, residual module, and decoder module to build a generator model to generate perturbation noise; (3b) Construct three different loss functions and combine them with the perceptual loss as the loss function of the generator model; Step 4: Attacker and target model selection: Select the current mainstream attack model as the attacker, and use the selected model to be attacked as the target model; Step 5: Generator model and discriminator model training: The training set of the selected dataset is input into the attacker and the generator to obtain adversarial samples generated by the attacker and the generator, respectively. The adversarial samples generated by the attacker are then input into the discriminator, and the adversarial samples generated by the generator are input into the target model and the discriminator, respectively. The generator and the discriminator are trained based on the output information of the target model and the discriminator combined with the loss function of the generator and the discriminator. Step 6: Test the adversarial attack method based on perceptual loss and attack inspiration: The test set of the selected dataset is input into the generator to generate adversarial samples, and then the generated adversarial samples are input into the target model for testing.
2. The method for countering attacks based on perceptual loss and attack inspiration according to claim 1, characterized in that: In step (2a), the discriminator model is constructed using the following method: In step (2a), the discriminator model consists of three 4*4 regular convolutional layers, one 1*1 regular convolutional layer, three LeakyReLU activation layers, and one InstanceNorm2d normalization layer.
3. The loss-aware and attack-inspired anti-attack method according to claim 1, characterized in that: In step (2b), the following three loss functions are used to construct the loss function of the discriminator model: ； ； ； Among them, t is the target category of the adversarial attack, X adv represents the adversarial sample generated by the attacker, X pert Denotes the adversarial sample generated by the generator, X real represents the real sample, y represents the category label of the real sample; P(C=t|X adv ) represents the probability that the discriminator determines that the adversarial sample generated by the attacker belongs to category t, P(C=t|X pert ) represents the probability that the discriminator determines that the adversarial sample generated by the generator belongs to category t; P(S=real|X real ) and P(S=pert|X pert ) represent the probability that the discriminator determines that its input is a real sample without adding perturbations and the probability that its input is a generated adversarial sample with adding perturbations, L pert and L adv The goal of the loss function is to allow the adversarial samples generated by the generator and the adversarial samples generated by the attacker to be classified into the target category by the discriminator, L s The goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed. The loss function of the discriminator model is finally expressed as: 。 4. The method for countering attacks based on perceptual loss and attack inspiration according to claim 1, characterized in that: In step (3a), the generator model is constructed using the following method: In step (3a), the generator model consists of an encoder module, a decoder module, and an intermediate residual block; The encoder module in step (3a) consists of one 3*3 depth convolution, one 1*1 point-by-point convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and two GELU activation layers; The decoder module in step (3a) consists of three 3*3 transposed convolutions, two group normalization GroupNorm layers, two GELU activation layers, and one Tanh activation layer; The intermediate residual block in step (3a) consists of one 3*3 dilated convolution, one 3*3 regular convolution, two group normalization GroupNorm layers, and one GELU activation layer.
5. The method for countering attacks based on perceptual loss and attack inspiration according to claim 1, characterized in that: In step (3b), the following four loss functions are used to construct the loss function of the generator model: ； ； ； ； Where P(D=y|X adv ) represents the probability that the category information obtained by inputting the adversarial sample generated by the attacker into the discriminator is the same as y, P(D=y|X pert ) represents the probability that the category information obtained by inputting the adversarial sample generated by the generator into the target model is the same as y, L D(adv) It is used to calculate the category discrimination probability information of the adversarial sample generated by the attacker and input to the discriminator, L D(pert) Used to calculate the category discrimination probability information of the adversarial samples generated by the generator and input into the target model, is the feature map of the real image, Feature maps of adversarial samples generated by the generator, is the weight parameter, ||·||2 is the 2-norm, L s The goal of the loss function is to enable the discriminator to accurately distinguish whether the input image has been perturbed. perce The introduction of the perceptual loss function can make the adversarial samples generated by the generative model closer to the real samples; The loss function of the generator model is finally expressed as: 。