Dynamic confrontation sample generation method and device based on non-convex optimization

Abstract

The invention discloses a dynamic confrontation sample generation method and device based on non-convex optimization, and relates to the technical field of artificial intelligence safety and confrontation machine learning, and the method comprises the steps: training to obtain a pre-training model; applying noise to the original sample image to generate an initial confrontation sample, inputting the initial confrontation sample into the pre-training model to obtain model prediction output, and calculating a loss function value; applying symmetric differential disturbance in the neighborhood of the adversarial sample along a random orthogonal direction, estimating an interpolation gradient norm according to a loss function value, and optimizing disturbance and updating the adversarial sample along a gradient symbol direction to obtain a current adversarial sample; projecting the current adversarial sample to a legal disturbance space; judging whether the current disturbance update is valid or not based on a line search condition, and if yes, accepting the current disturbance update and entering the next round of iteration; if not, the dynamic projection range is dynamically adjusted until the iteration stop condition is met, the final adversarial sample is generated, and the efficiency and stability of adversarial sample generation are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence security and adversarial machine learning, and particularly relates to a dynamic adversarial sample generation method and device based on non-convex optimization. BACKGROUND

[0002] Adversarial sample generation technology is a core tool for evaluating model robustness and driving adversarial training by adding a small perturbation to input data to make a deep neural network produce an error output. This technology has important application value in safety-critical fields, such as adversarial road sign recognition in autonomous driving and misjudgment defense in medical image diagnosis. Existing methods usually formulate adversarial sample generation as a min-max saddle point problem in a non-convex optimization framework, that is, generate adversarial perturbations through an internal maximization problem and optimize model parameters through an external minimization problem. However, the non-convex objective function leads to a large number of saddle points and local extrema in the optimization process, which seriously restricts the efficiency and stability of adversarial sample generation. SUMMARY

[0003] The purpose of the present application is to provide a dynamic adversarial sample generation method and device based on non-convex optimization, which can improve the efficiency and stability of adversarial sample generation.

[0004] To achieve the above purpose, the present application provides the following solutions:

[0005] In a first aspect, the present application provides a dynamic adversarial sample generation method based on non-convex optimization, comprising:

[0006] Training a target neural network model using a sample set to obtain a pre-trained model; the sample set includes a plurality of original sample images and a true classification label corresponding to each original sample image;

[0007] Applying noise to the original sample images to generate initial adversarial samples, inputting the initial adversarial samples into the pre-trained model to obtain model prediction outputs, and calculating a loss function value according to the model prediction outputs and the true classification label corresponding to the initial adversarial samples;

[0008] Applying a symmetric difference perturbation along a random orthogonal direction within an adversarial sample neighborhood, estimating an interpolation gradient norm based on the loss function value, and optimizing the perturbation to update the adversarial sample along the gradient sign direction to obtain a current adversarial sample;

[0009] Projecting the current adversarial sample into a legal perturbation space and controlling the total perturbation amplitude of the current adversarial sample based on a dynamic projection range;

[0010] The line search condition is determined by the loss function value.

[0011] In a second aspect, the present application provides a non-convex optimization-based dynamic adversarial sample generation device, comprising:

[0012] A model training module is configured to train a target neural network model using a sample set to obtain a pre-trained model, wherein the sample set comprises a plurality of original sample images and a true classification label corresponding to each original sample image.

[0013] A loss function value calculation module is configured to apply noise to the original sample images to generate initial adversarial samples, input the initial adversarial samples into the pre-trained model to obtain model prediction outputs, and calculate a loss function value based on the model prediction outputs and the true classification labels corresponding to the initial adversarial samples.

[0014] An adversarial sample updating module is configured to apply symmetric differential perturbation along a random orthogonal direction within an adversarial sample neighborhood, estimate an interpolation gradient norm based on the loss function value, and optimize the perturbation updated adversarial sample along the gradient sign direction to obtain a current adversarial sample.

[0015] A projection module is configured to project the current adversarial sample into a legal perturbation space and control the total perturbation amplitude of the current adversarial sample based on a dynamic projection range.

[0016] An iteration module is configured to determine whether the current perturbation update is effective based on a line search condition, accept the current perturbation update and enter the next iteration if the current perturbation update is effective, dynamically adjust the dynamic projection range if the current perturbation update is ineffective, return to the step of applying symmetric differential perturbation along a random orthogonal direction within an adversarial sample neighborhood and estimating an interpolation gradient norm based on the loss function value, until an iteration stopping condition is reached, and generate a final adversarial sample. The line search condition is determined by the loss function value.

[0017] In a third aspect, the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned non-convex optimization-based dynamic adversarial sample generation method.

[0018] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the above-mentioned non-convex optimization-based dynamic adversarial sample generation method.

[0019] In a fifth aspect, the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the non-convex optimization-based dynamic adversarial sample generation method described above.

[0020] According to the specific embodiments provided by the present application, the following technical effects are disclosed:

[0021] The present application provides a non-convex optimization-based dynamic adversarial sample generation method and device, which applies symmetric difference perturbation along a random orthogonal direction within the adversarial sample neighborhood, estimates the interpolation gradient norm according to the loss function value, optimizes the perturbation update adversarial sample along the gradient sign direction, obtains the current adversarial sample, projects the current adversarial sample to the legal perturbation space, controls the total perturbation amplitude of the current adversarial sample based on the dynamic projection range, and improves the stability, attack robustness and stealth of the adversarial sample generation by combining interpolation gradient estimation, dynamic step mechanism, composite constraint projection (projecting the current adversarial sample to the legal perturbation space) and cross-model attack verification. By judging whether the current perturbation update is effective based on the line search condition, iterative optimization is performed, the interference of high-dimensional noise on the gradient direction is effectively reduced, falling into the saddle point or local extreme value is avoided, the generation efficiency is improved by balancing the attack strength and stealth, and the risk of detection of the adversarial sample is reduced. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0023] Figure 1 An application environment diagram of a non-convex optimization-based dynamic adversarial sample generation method in an embodiment of the present application.

[0024] Figure 2 A flowchart of a non-convex optimization-based dynamic adversarial sample generation method provided by an embodiment of the present application.

[0025] Figure 3 A specific process diagram of a non-convex optimization-based dynamic adversarial sample generation method provided by an embodiment of the present application.

[0026] Figure 4 A variation image of an interpolation gradient norm related function provided by an embodiment of the present application.

[0027] Figure 5A functional module schematic diagram of a non-convex optimization-based dynamic adversarial sample generation device provided by an embodiment of the present application is provided.

[0028] Figure 6 A structural schematic diagram of a computer device provided by an embodiment of the present application is provided. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0030] The classic adversarial sample generation algorithm, projected gradient descent (PGD), iteratively updates the perturbation through the gradient ascent strategy and combines the projection operation to limit the range of the perturbation. Although PGD is widely used, it still has some significant shortcomings: first, the fixed step size and projection range are difficult to adapt to the dynamic changes of non-convex functions, and it is easy to fall into saddle points or suboptimal local extrema; second, gradient calculation is easily disturbed by high-dimensional noise, causing the perturbation direction to deviate from the optimal path; finally, the fixed perturbation constraint cannot dynamically balance the attack strength and concealment, which may result in poor attack effect or detection.

[0031] Existing improved methods attempt to alleviate the above problems through adaptive step size adjustment or noise suppression, but still have limitations: most methods rely on single gradient estimation, and the problem of gradient oscillation caused by high-dimensional noise has not been systematically solved; dynamic step size strategy lacks targeted design for non-convex objective function characteristics, making it difficult to balance between escaping saddle points and convergence speed; the perturbation range control mostly uses linear constraints, which cannot adapt to the nonlinear change trend of the interpolation gradient norm, resulting in perturbation being too large (easy to be detected) or too small (gradient disappearance).

[0032] In recent years, methods based on interpolation gradient estimation and adaptive optimization have gradually attracted attention, such as using symmetric difference method to reduce noise influence, or combining line search criterion to improve step size adaptability. However, existing schemes have not realized the coordinated optimization of gradient estimation, step size adjustment, and perturbation control, resulting in low efficiency of adversarial sample generation in non-convex scenarios, and it is difficult to balance attack success rate and concealment.

[0033] To solve the above challenges, the application provides a dynamic adversarial sample generation method and device based on non-convex optimization. Through the closed-loop linkage mechanism of interpolation gradient estimation, improved Armijo line search criterion and disturbance range control, the problems of saddle point stagnation, local extremum trap and high-dimensional noise interference are systematically solved, and efficient and reliable technical support is provided for model robustness evaluation and adversarial training in safety-sensitive fields.

[0034] The above purposes, features and advantages of the application will be more apparent and understandable. The application is further described in detail below with reference to the drawings and specific embodiments.

[0035] The non-convex optimization-based dynamic adversarial sample generation method provided by the embodiments of the application can be applied in an application environment as shown in Figure 1 The terminal 102 communicates with the server 104 through the network. The data storage system can store the data required to be processed by the server 104. The data storage system can be separately arranged, integrated on the server 104, or placed on the cloud or other servers. The terminal 102 can send a sample set to the server 104. After receiving the sample set, the server 104 trains a pre-training model using the sample set, generates an initial adversarial sample by applying noise to an original sample image, inputs the initial adversarial sample into the pre-training model to obtain a model prediction output, and calculates a loss function value. A symmetric difference perturbation is applied along a random orthogonal direction within the adversarial sample neighborhood, the interpolation gradient norm is estimated according to the loss function value, and the adversarial sample is updated along the gradient sign direction to obtain a current adversarial sample. The current adversarial sample is projected into a legal perturbation space, and it is judged whether the current perturbation update is effective based on the line search condition. If it is effective, the current perturbation update is accepted and the next iteration is entered. If it is not effective, the dynamic projection range is dynamically adjusted until the iteration stopping condition is reached, and the final adversarial sample is generated. The server 104 can feed back the final adversarial sample obtained to the terminal 102. In addition, in some embodiments, the non-convex optimization-based dynamic adversarial sample generation method can also be implemented by the server 104 or the terminal 102 alone, such as directly generating an adversarial sample by the terminal 102, or obtaining a sample set from the data storage system by the server 104 and generating an adversarial sample.

[0036] The terminal 102 can be, but is not limited to, various desktop computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things device can be a smart speaker, a smart television, a smart air conditioner, a smart vehicle device, etc. The portable wearable device can be a smart watch, a smart bracelet, a head-mounted device, etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers, and can also be a cloud server.

[0037] In one exemplary embodiment, as shown in Figure 2 A non-convex optimization-based dynamic adversarial sample generation method is provided, which is executed by a computer device, specifically by a terminal or a server, or by both a terminal and a server. In the embodiments of the present application, the method is applied to the server 104 in the system 100. Figure 1 The method includes the following steps 201 to 205.

[0038] Step 201: training a target neural network model using a sample set to obtain a pre-trained model; the sample set includes a plurality of original sample images and a true classification label corresponding to each original sample image.

[0039] Step 202: applying noise to the original sample images to generate initial adversarial samples, inputting the initial adversarial samples into the pre-trained model to obtain model prediction output, and calculating a loss function value according to the model prediction output and the true classification label corresponding to the initial adversarial samples.

[0040] Step 203: applying symmetric difference perturbation in a random orthogonal direction within an adversarial sample neighborhood, estimating an interpolation gradient norm according to the loss function value, and optimizing the perturbation to update the adversarial sample in the gradient sign direction to obtain a current adversarial sample.

[0041] Step 204: projecting the current adversarial sample to a legal perturbation space, and controlling the total perturbation amplitude of the current adversarial sample based on a dynamic projection range.

[0042] Step 205: judging whether the current perturbation update is valid based on a line search condition, if valid, accepting the current perturbation update and entering the next iteration; if invalid, dynamically adjusting the dynamic projection range, returning to the step of applying symmetric difference perturbation in a random orthogonal direction within an adversarial sample neighborhood, estimating an interpolation gradient norm according to the loss function value, and optimizing the perturbation to update the adversarial sample in the gradient sign direction to obtain a current adversarial sample, until an iteration stopping condition is reached, and a final adversarial sample is generated; the line search condition is determined by the loss function value.

[0043] In view of the problems of saddle point stagnation, local extremum trap and high-dimensional noise interference of existing adversarial sample generation algorithms in a non-convex optimization scene, the steps 201 to 205 are implemented, and an interpolation optimization strategy is combined with a classic PGD framework. On the one hand, the method reconstructs the gradient direction by using the high stability of the interpolation gradient estimation, significantly alleviates the gradient shock problem caused by high-dimensional noise, and ensures the robustness of the adversarial noise generation; on the other hand, the method quickly escapes from the saddle point and avoids the local extremum trap in the non-convex optimization scene through the dynamic synergy mechanism of adaptive step adjustment and disturbance range control, so that the adversarial sample has high attack efficiency and concealment. The present application takes gradient-driven optimization as the core, proposes a dynamic adversarial sample generation method based on non-convex optimization, systematically improves the generation efficiency and robustness of the adversarial sample through the synergy mechanism of interpolation gradient estimation and disturbance range control, and is related to the robustness evaluation and adversarial attack defense of the deep neural network. The transferability of the adversarial sample on different models is verified, the generalization ability of the algorithm is ensured, and therefore the algorithm has strong practicability and reliability in multiple application scenarios.

[0044] Load the original sample image and the label corresponding to the original sample image on the computing device, and pre-train the target neural network model to obtain a pre-trained model.

[0045] Model pre-training and initialization. The target neural network model is trained on a clean sample set to provide a benchmark model for adversarial sample generation. Specifically, the original image dataset (i.e., the sample set) is input into the computing device, the target neural network model is pre-trained, and the model parameters are obtained. For example, the original image dataset can be CIFAR-10 or ImageNet, and the target neural network model can be ResNet or VGG. The loss function value is calculated by using a cross-entropy loss function, and the pre-training process uses a cross-entropy loss function, which is defined as:

[0046]

[0047] wherein, is the cross-entropy loss function; f i (x) is the predicted probability of the target neural network model for class i; i = 1, 2, 3, …, C, C is the total number of classes, y i is the one-hot encoding of the real classification label. The cross-entropy loss function is used to measure the model classification performance and provide a gradient optimization target for subsequent adversarial disturbance generation. The network structure of the pre-trained model is configured according to the task requirements, and the present application uses ResNet-50, which contains 50 residual blocks and is suitable for complex datasets. After the model training is completed, the parameters are fixed as a benchmark for adversarial attack, so that the input disturbance is optimized during the generation of the adversarial sample, and the model weights are not modified.

[0048] An initial adversarial sample is generated by applying noise to the original sample image. The pre-trained model is used to predict the adversarial sample, obtain the model prediction output, and obtain the loss function value loss,

[0049] Adversarial sample initialization: random noise is applied to the original input sample (original input sample, i.e. original sample image) x to generate an initial adversarial sample x adv And set the optimization parameters:

[0050] x adv = x + Δx init ,Δx init ~ U(-ε,ε) (2);

[0051] Where Δx init is noise; U represents uniform distribution; At the same time, set the maximum number of iterations T and the convergence error threshold σ, and the perturbation threshold ε is the preset threshold of the perturbation range. After initialization, the adversarial sample x adv satisfies the concealment constraint, providing a starting point for subsequent gradient optimization.

[0052] Based on the pre-trained model, the current adversarial sample is predicted and the loss function value is calculated. By applying symmetric difference perturbation in the neighborhood of the adversarial sample along the random orthogonal direction, the gradient norm is estimated, and the sample is updated along the gradient sign direction, while the high-dimensional noise interference is suppressed by averaging multiple orthogonal direction perturbations.

[0053] Calculate the interpolation gradient and update the perturbation: first, reconstruct the gradient direction by interpolation gradient estimation. The interpolation method estimates the norm of the gradient by calculating the symmetric difference in the neighborhood of the original sample image, thereby avoiding the interference of noise on the direction in traditional gradient calculation. The interpolation gradient norm is defined as:

[0054]

[0055] Where, represents the interpolation gradient norm; L(x) represents the loss function of the target neural network model; x represents the input of the target neural network model; v is a unit directional vector; δ is the perturbation amplitude.

[0056] The method effectively reduces the influence of noise in high-dimensional space on gradient estimation, thereby improving the stability of the generated perturbation. Based on the interpolation gradient estimation result (interpolation gradient estimation result, i.e. interpolation gradient norm), the adversarial perturbation is generated along the gradient sign direction, and the adversarial sample is updated. Anti-noise: Through multi-directional perturbation averaging, the influence of single-direction noise on gradient estimation is reduced. In terms of anti-noise, through multi-directional perturbation averaging, the influence of single-direction noise on gradient estimation is reduced. In terms of stability, the symmetric difference method is used to avoid the gradient deviation caused by traditional one-sided difference, and the gradient shock problem is alleviated. Finally, in terms of attack focus, the update is performed along the direction in which the loss function rises fastest, thereby improving the attack efficiency of the adversarial sample. At the same time, the method seamlessly connects with the subsequent projection range control module, ensuring that the perturbation meets the concealment constraint.

[0057] The total perturbation amplitude of the adversarial sample is controlled by dynamic projection range control to constrain it within the legal perturbation space to ensure concealment. Projection range control projects the current adversarial sample to the legal perturbation space S to constrain it to meet the concealment requirement.

[0058] The current adversarial sample is projected to the legal perturbation space, which is represented as follows:

[0059]

[0060] where, is the adversarial sample after the k+1th iteration; η represents the step size, controlling the perturbation update amplitude of each iteration; ∏ S (·) is the projection constraint function that maps the current adversarial sample to the legal perturbation space S; S is the legal perturbation space; is the adversarial sample after the kth iteration; sign(·) represents the sign function; represents the corresponding gradient.

[0061] The legal perturbation space is represented as follows:

[0062] S = { δ || | | δ || ≤ ε} (5) ;

[0063] where ε represents the perturbation radius, which is the maximum allowed threshold for perturbation amplitude, used to constrain the difference between the current adversarial sample and the original sample image.

[0064] Line search condition verification and dynamic parameter adjustment. Based on the adaptive step size verification mechanism, it is judged whether the current perturbation update is effective: if the loss function of the adversarial sample satisfies the preset condition (balance convergence speed and perturbation intensity), the update is accepted and the next iteration is entered; otherwise, the projection constraint parameter is dynamically adjusted-the perturbation threshold is shrunk by a nonlinear penalty ratio of the gradient norm to expand the search range and enhance the perturbation intensity, and then the gradient estimation and optimization iteration in step 203 are restarted until the convergence precision or the maximum number of iterations is reached. The adaptive step size verification mechanism considers attack efficiency and stealthiness through feedback adjustment to ensure stable escape from local extrema in non-convex scenarios. The preset condition refers to the loss function value reaching a preset threshold.

[0065] Line search verification and projection range update. This application considers that in the gradient ascent process, the value of the objective function will generally increase, and the norm of the gradient will gradually become flat. Therefore, the algorithm adjusts the perturbation range to adapt to this trend under the initial random perturbation. The gradient norm related function is defined as.

[0066]

[0067] In the formula, y is the output of the gradient norm related function, and x is the input of the gradient norm related function.

[0068] The variation image of the gradient norm related function is shown in Figure 4 A nonlinear penalty mechanism is introduced in the case of large gradient, which suppresses excessive perturbation. This nonlinear penalty mechanism can more finely adjust the size of the perturbation compared to directly using the square of the gradient or a conventional linear factor, which helps to improve the robustness of adversarial sample generation. At the same time, by introducing nonlinear adjustment to the gradient norm, the formula (6) can avoid the problem of too small step size due to too small gradient, ensuring that the perturbation can be reasonably controlled within a certain range even in the case of small gradient, avoiding the problem of gradient disappearance.

[0069] Steps 203 to 205 are executed in a loop to continuously optimize the adversarial sample until the loss function converges to a preset threshold or reaches a maximum number of iterations T, and finally outputs an adversarial sample that meets the attack requirements

[0070] In the kth iteration, the perturbation range of this application uses the following line search condition:

[0071]

[0072] wherein, represents the loss function value of the adversarial sample after the k+1th iteration; represents the loss function value of the adversarial sample after the kth iteration; η kdenotes the step size of the kth iteration. If the line search condition is met, the current dynamic projection range is accepted, and the next iteration is entered. If the condition is not met, the dynamic projection range is increased, and steps 203 to 205 are re-executed until the line search condition is met or the maximum number of iterations is reached. The iteration stopping condition is that the loss function value converges to a preset threshold or the current iteration number reaches the maximum number of iterations.

[0073] When the line search condition cannot be met after q consecutive iterations, the system will shrink the perturbation threshold e through a nonlinear penalty mechanism, multiply the perturbation threshold e by a relevant coefficient to obtain the shrunk perturbation threshold, and continue until a set minimum value is reached, thereby effectively controlling unnecessary perturbations. This mechanism can prevent excessive perturbation updates, ensure that the perturbation range of the adversarial sample is within a reasonable range, and improve the stability and efficiency of the attack. The relevant coefficient is a number between 0 and 1.

[0074] In another exemplary embodiment of the present application, as shown in Figure 3 the original sample (i.e., the original sample image) is first input; initialization, superimpose random perturbation, i.e., superimpose noise on the original sample image to generate an initial adversarial sample; update input, i.e., update the adversarial sample to obtain an updated input, calculate the interpolation gradient norm according to formula (3); projection operation, project the updated input to the effective range (the effective range refers to the legal perturbation space) according to formula (4); determine whether the line search condition of formula (7) is met or the maximum number of iterations has been reached, if yes, output the current adversarial sample as the final adversarial sample, if no, multiply the projection range by the relevant coefficient, i.e., shrink the perturbation threshold e through a nonlinear penalty mechanism, and loop again, return to the step of "update input, calculate the interpolation gradient norm according to formula (3)"; end.

[0075] As shown in Table 1, the comparison effect of the dynamic adversarial sample generation method based on non-convex optimization of the present application with the original PGD algorithm and other common algorithms. Through the adversarial sample generation method based on dynamic step size and interpolation gradient estimation adopted by the present application, compared with the traditional PGD, although the generation efficiency is slightly reduced, but this is due to the improvement in complexity of the present application, especially the introduction of more precise step size control and perturbation direction optimization mechanism. Therefore, although the generation speed is slower, the method provided by the present application performs better in perturbation accuracy, image quality and similarity. It can be seen that the present application improves the quality of adversarial sample generation while ensuring the generation efficiency, and has obvious advantages and innovation in generation effect and practical application.

[0076] Table 1 Comparison effect of the dynamic adversarial sample generation method based on non-convex optimization of the present application with the original PGD algorithm and other common algorithms

[0077]

[0078]

[0079] The method in Table 1 refers to the non-convex optimization-based dynamic adversarial sample generation method provided in the present application.

[0080] The present application also provides an application scenario, which applies the above-mentioned non-convex optimization-based dynamic adversarial sample generation method. Specifically, the non-convex optimization-based dynamic adversarial sample generation method provided in the present embodiment can be applied in an adversarial sample generation scenario. The adversarial sample generation scenario includes a content production link and a content processing link. A sample set enters the content processing link from the content production link and obtains a final adversarial sample through human-computer collaborative mode. The non-convex optimization-based dynamic adversarial sample generation method provided in the present embodiment belongs to the content processing link. Specifically, in the process of the content processing link for the sample set, a pre-training model can be obtained by training the sample set, an initial adversarial sample can be generated by applying noise to an original sample image, a model prediction output can be obtained by inputting the initial adversarial sample into the pre-training model, a loss function value can be calculated, a symmetric difference perturbation can be applied along a random orthogonal direction within an adversarial sample neighborhood, an interpolation gradient norm can be estimated according to the loss function value, an adversarial sample can be updated by optimizing the perturbation along a gradient sign direction, a current adversarial sample can be obtained, the current adversarial sample can be projected into a legal perturbation space, and it is determined whether the current perturbation update is effective based on a line search condition. If the current perturbation update is effective, the current perturbation update is accepted and the next iteration is entered. If the current perturbation update is not effective, the dynamic projection range is dynamically adjusted until an iteration stopping condition is reached, and a final adversarial sample is generated.

[0081] Based on the same inventive concept, the present embodiment also provides a non-convex optimization-based dynamic adversarial sample generation device for implementing the above-mentioned non-convex optimization-based dynamic adversarial sample generation method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, and therefore the specific limitations in one or more non-convex optimization-based dynamic adversarial sample generation device embodiments provided below can be referred to the limitations of the non-convex optimization-based dynamic adversarial sample generation method described above, which will not be repeated here.

[0082] In one exemplary embodiment, as shown in Figure 5 a non-convex optimization-based dynamic adversarial sample generation device is provided, which includes the following modules.

[0083] A model training module T1 is configured to train a target neural network model using a sample set to obtain a pre-training model. The sample set includes a plurality of original sample images and a true classification label corresponding to each original sample image.

[0084] The loss function value calculation module T2 is configured to apply noise to the original sample image to generate an initial adversarial sample, input the initial adversarial sample into the pre-trained model to obtain a model prediction output, and calculate a loss function value according to the model prediction output and a true classification label corresponding to the initial adversarial sample.

[0085] The adversarial sample updating module T3 is configured to apply symmetric difference perturbation in a random orthogonal direction within a neighborhood of the adversarial sample, estimate an interpolation gradient norm according to the loss function value, and update the adversarial sample in a gradient sign direction to obtain a current adversarial sample.

[0086] The projection module T4 is configured to project the current adversarial sample into a legal perturbation space and control a total perturbation amplitude of the current adversarial sample based on a dynamic projection range.

[0087] The iteration module T5 is configured to determine whether the current perturbation update is valid based on a line search condition. If the current perturbation update is valid, the current perturbation update is accepted and a next round of iteration is entered. If the current perturbation update is invalid, the dynamic projection range is dynamically adjusted, and the step of applying symmetric difference perturbation in a random orthogonal direction within a neighborhood of the adversarial sample is returned to until an iteration stop condition is reached to generate a final adversarial sample. The line search condition is determined by the loss function value.

[0088] In an exemplary embodiment, a computer device can be provided, which can be a server or a terminal. An internal structure diagram of the computer device can be as shown in Figure 6 The computer device includes a processor, a memory, an input / output interface (I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The database of the computer device is configured to store adversarial sample generation data. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to communicate with external terminals through network connection. The computer program is executed by the processor to implement a dynamic adversarial sample generation method based on non-convex optimization.

[0089] Those skilled in the art can understand that, Figure 6The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0090] In an exemplary embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, and the processor implementing the steps in the above method embodiments when executing the computer program.

[0091] In an exemplary embodiment, a computer readable storage medium is provided, storing a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0092] In an exemplary embodiment, a computer program product is provided, including a computer program, and the computer program implementing the steps in the above method embodiments when executed by a processor.

[0093] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0094] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0095] The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a blockchain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0096] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, they should be considered as the scope of the present application.

[0097] The principles and implementation manners of the present application are described herein by using specific examples, and the above examples are only used to help understand the method of the present application and its core idea; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will have changes. In conclusion, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A dynamic adversarial sample generation method based on non-convex optimization, characterized in that: The dynamic adversarial sample generation method based on non-convex optimization includes: A target neural network model is trained using a sample set to obtain a pre-trained model; the sample set includes a plurality of original sample images and a true classification label corresponding to each of the original sample images; Applying noise to the original sample image to generate an initial adversarial sample, inputting the initial adversarial sample into the pre-trained model to obtain a model prediction output, and calculating a loss function value based on the model prediction output and the true classification label corresponding to the initial adversarial sample; Apply symmetric differential perturbations along random orthogonal directions within the neighborhood of the adversarial sample, estimate the interpolated gradient norm according to the loss function value, and optimize the perturbation along the gradient sign direction to update the adversarial sample to obtain the current adversarial sample; Project the current adversarial sample into the legal perturbation space and control the total perturbation amplitude of the current adversarial sample based on the dynamic projection range; Based on the line search condition, the validity of the current perturbation update is determined. If valid, the current perturbation update is accepted and the next round of iteration is entered. If invalid, the dynamic projection range is dynamically adjusted, and the process returns to the step of "applying symmetric differential perturbations along random orthogonal directions in the neighborhood of the adversarial sample and estimating the interpolated gradient norm based on the loss function value" until the iteration stopping condition is met to generate the final adversarial sample. The line search condition is determined by the loss function value.

2. The method for generating dynamic adversarial samples based on non-convex optimization according to claim 1, characterized in that: The interpolation gradient norm is expressed as follows: in, Represents the interpolation gradient norm; L(x) represents the loss function of the target neural network model; x represents the input of the target neural network model; v is the unit direction vector; δ is the disturbance amplitude.

3. The method for generating dynamic adversarial samples based on non-convex optimization according to claim 1, characterized in that: Projecting the current adversarial example into the legal perturbation space is expressed as follows: in, is the adversarial sample after the k+1th iteration; η represents the step size; ∏ S (·) is the projection constraint function; S is the legal perturbation space; is the adversarial sample after the kth iteration; sign(·) represents the sign function; express The corresponding gradient.

4. The method for generating dynamic adversarial samples based on non-convex optimization according to claim 1, characterized in that: The line search condition is expressed as follows: in, represents the loss function value of the adversarial sample after the k+1th iteration; represents the loss function value of the adversarial sample after the kth iteration; η k Indicates the step size of the kth iteration.

5. The method for generating dynamic adversarial samples based on non-convex optimization according to claim 1, characterized in that: The iteration stopping condition is that the loss function value converges to a preset threshold or the current number of iterations reaches the maximum number of cycles.

6. The method for generating dynamic adversarial samples based on non-convex optimization according to claim 1, characterized in that: The loss function value is calculated using the cross entropy loss function.

7. A dynamic adversarial sample generation device based on non-convex optimization, characterized in that: The dynamic adversarial sample generation device based on non-convex optimization includes: A model training module is used to train the target neural network model using a sample set to obtain a pre-trained model; the sample set includes a number of original sample images and a true classification label corresponding to each of the original sample images; a loss function value calculation module, configured to apply noise to the original sample image to generate an initial adversarial sample, input the initial adversarial sample into the pre-trained model to obtain a model prediction output, and calculate a loss function value based on the model prediction output and the true classification label corresponding to the initial adversarial sample; An adversarial sample update module is configured to apply symmetric differential perturbations along random orthogonal directions within the neighborhood of the adversarial sample, estimate the interpolated gradient norm based on the loss function value, and optimize the perturbation along the gradient sign direction to update the adversarial sample to obtain the current adversarial sample; The projection module is used to project the current adversarial sample into the legal perturbation space and control the total perturbation amplitude of the current adversarial sample based on the dynamic projection range; An iterative module is configured to determine whether the current perturbation update is valid based on the line search condition. If so, the current perturbation update is accepted and the next round of iteration is entered. If not, the dynamic projection range is dynamically adjusted and the algorithm returns to the step of "applying symmetric differential perturbations along random orthogonal directions within the neighborhood of the adversarial sample and estimating the interpolated gradient norm based on the loss function value" until the iteration stopping condition is met to generate the final adversarial sample. The line search condition is determined by the loss function value.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the dynamic adversarial sample generation method based on non-convex optimization according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating dynamic adversarial samples based on non-convex optimization according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method for generating dynamic adversarial samples based on non-convex optimization according to any one of claims 1 to 6 is implemented.

Images