Adversarial sample generation method and evaluation method for evaluating robustness of AIGI detector

Abstract

The invention discloses an adversarial sample generation method and an evaluation method for robustness evaluation of an AIGI detector, and relates to the technical field of robustness evaluation. A pre-trained substitution model is selected and comprises a feature extractor and a classifier, K additional models are added behind the feature extractor in parallel, and a Bayesian model is constructed and used for simulating an attacked model; performing frequency domain attack on the Bayesian model by using the adversarial sample, during each attack, adding disturbance to the spatial domain of the original adversarial sample, converting the original adversarial sample from the spatial domain to the frequency domain, performing random spectrum transformation, and according to an attack optimization target, calculating a frequency domain gradient for updating the adversarial sample; furthermore, the frequency domain attack and the space domain attack are mixed, the space domain gradient is calculated during each attack, the frequency domain gradient and the space domain gradient are added and averaged to obtain a uniform gradient direction, the gradient direction is used to update the adversarial sample, and the final adversarial sample is obtained after the set iteration attack times. According to the method, an adversarial sample is generated by using a frequency-based post-training Bayesian attack (FPBA), so that high-quality attacks with certain generalization ability are performed on the AIGI detector, and the robustness of the AIGI detector is evaluated under white-box attacks and black-box attacks.

Description

Technical Field

[0001] This invention relates to the field of robustness evaluation technology, and in particular to adversarial example generation and evaluation methods for robustness evaluation of AIGI detectors. Background Technology

[0002] In recent years, with the rapid development of image synthesis techniques such as Generative Adversarial Networks (GANs) and diffusion models, public concerns about the spread of misinformation have intensified. To address this issue, many detectors targeting AI-generated images (AIGI) have been proposed and have achieved significant results in identifying forged images. However, AIGI detectors are vulnerable to adversarial examples, where fake images are classified as real images to mislead the detector. Currently, however, systematic research on the adversarial robustness of AIGI detectors is lacking.

[0003] While AIGI detectors can effectively identify most forged images, their vulnerability to adversarial attacks has not been fully studied. In both white-box and black-box attack scenarios, detector performance often drops significantly, making it possible forged images to evade detection.

[0004] Systematically evaluating the robustness of deepfake detectors (AIGI detectors) can inspire researchers to develop more powerful and secure detection technologies, drive technological innovation and progress, and provide guidance for the detection and defense of deepfake content. Robustness evaluation of deepfake detectors is of significant value in comprehensively understanding the security performance of AIGI detectors and improving their robustness.

[0005] While existing AIGI detectors (some classifiers based on deep neural networks) have achieved good accuracy on multiple datasets and generative models, they are not robust enough against adversarial examples and are susceptible to simple attack methods.

[0006] Existing technologies lack systematic research on adversarial attacks. Many evaluation methods focus only on specific attack types or scenarios, emphasize specific types of generative models (such as GANs), fail to cover a wider range of image synthesis techniques, and do not comprehensively evaluate the robustness of AIGI detectors in the face of various possible adversarial samples.

[0007] Meanwhile, when evaluating the robustness of existing technologies against deepfake detectors, some evaluation methods require a large amount of computational resources and time to generate adversarial samples or conduct tests, making them difficult to apply to large-scale system evaluations.

[0008] In summary, while existing robustness evaluation methods for deepfake detectors can reveal vulnerabilities to some extent, they still have many shortcomings. Therefore, there is an urgent need for a systematic evaluation method that can assess the robustness of deepfake detectors under various attack environments, thereby providing theoretical and practical basis for further improvements to the detectors. Summary of the Invention

[0009] To overcome the shortcomings of the prior art, this invention provides an adversarial example generation method and evaluation method for robustness evaluation of AIGI detectors. The adversarial examples are generated using frequency-based post-training Bayesian attack (FPBA) to perform high-quality attacks on AIGI detectors with certain generalization capabilities, thereby evaluating the robustness of AIGI detectors under both white-box and black-box attacks.

[0010] To achieve the above objectives, the present invention adopts the following technical solution, including:

[0011] Adversarial example generation methods for robustness evaluation of AIGI detectors include:

[0012] Construct a Bayesian model to simulate the attacked model;

[0013] Adversarial examples are used to attack Bayesian models in the frequency domain. The number of attack iterations is set. In each attack, a perturbation is added to the spatial domain of the original adversarial example to transform it from the spatial domain to the frequency domain and perform a random spectrum transformation. According to the attack optimization target, the frequency domain gradient is calculated to update the adversarial example. After the set number of attack iterations, the final adversarial example is obtained.

[0014] Preferably, the Bayesian model is constructed by using a pre-trained alternative model, which is generated by the feature extractor f. θ and classifier Composition, in feature extractor f θ Then, K additional models are added in parallel to obtain the Bayesian model; where the pre-trained model parameters Θ = [θ, θ c ],θ,θ c The feature extractors f are respectively θ and classifier The parameters, the parameters of the K additional models θ′={θ′1,...,θ′ k ,...,θ′ K}, θ′ k These are the parameters of the k-th additional model.

[0015] The preferred method for training a Bayesian model is as follows:

[0016] Using a post-training Bayesian strategy, given the pre-trained model parameters Θ=[θ,θc and training dataset In the case of the posterior distribution of the additional model parameters In the sampling process, an additional model is used, which is a small neural network. The parameters of the additional model are to be trained, while the parameters Θ of the pre-trained model are frozen.

[0017] K additional models are randomly initialized. In each iteration, the parameters of each additional model are... Perform the following operations:

[0018] S11, extract a mini-batch dataset. For each image x in the dataset, use the feature extractor f of the pre-trained model. θ Extract image features and feed them into the classifier of the pre-trained model. and the kth additional model θ′ currently being optimized k The feature, after being processed by both methods, yields a specific numerical value, denoted as [value 1] and [value 2] respectively. and g θ′ (f θ (x)), adding the two together gives logits is the output that takes into account the anti-spoofing performance of the additional model and the original pre-trained model. The larger the logits value, the greater the likelihood that the alternative model considers the image to be fake.

[0019] S12, use the sigmoid(·) function to convert the logits values ​​into probabilities. probability This represents the probability that image x is a fake, and the probability is expressed as follows: The loss function is obtained using binary cross-entropy loss. Where y represents the true label of image x, when y = 1 it means that the image is a fake image, and when y = 0 it means that the image x is a real image;

[0020] S13, the training objective is to improve the probability that the model's prediction is the true label of the input image, which is achieved by minimizing its negative log-likelihood. Where p(y|x,Θ,θ′) k ) represents a given input image x, fixed pre-trained model parameters Θ, and the k-th additional model parameter θ′. k At that time, the model predicts the probability that image x belongs to its true class y; calculate the batch average loss function with respect to the k-th additional model parameter θ′. k gradient Where B represents the number of samples in the current batch, y j Let x represent the true label of the j-th sample in the current batch. j This indicates that the j-th sample in the current batch is the input image. This means to calculate the expression within the parentheses with respect to θ′. k Partial derivatives;

[0021] S14, using the stochastic gradient adaptive Hamiltonian Monte Carlo method for the parameters θ′ of each additional model. k Perform sampling and updating based on the calculated gradient. For parameter θ′ k Multiple sampling iterations are performed, and the update formula is as follows:

[0022]

[0023] Where, θ′ t+1 Here are the parameters for the (t+1)th step; θ′ t σ represents the parameter at step t; σ is the update step size. It is the final gradient of the t-th step of the additional model optimization; F is the friction coefficient, used to adjust the intensity of the noise term; N represents a Gaussian distribution; The coefficient is θ′ t The covariance matrix is ​​used to smooth gradient changes; yes The inverse matrix; yes The square root of the inverse matrix; τ is a time constant used to control the update rate of the covariance matrix;

[0024] After T iterations, the parameters of the additional model are updated, while the parameters of the original pre-trained model remain unchanged.

[0025] Preferably, the attack on the Bayesian model is based on the frequency domain. The number of attack iterations is set to I. During the i-th attack, the following operations are performed to update the adversarial sample:

[0026] S21, the original adversarial sample as input. Adding Gaussian noise ξ, the adversarial example after adding Gaussian noise

[0027] S22, the adversarial example with Gaussian noise added. Transform to the frequency domain and compare with the random mask matrix Construct the Hadamard product; specifically, through the discrete cosine transform. Adversarial examples with added Gaussian noise Transforming from the spatial domain to the frequency domain yields the transformed frequency domain matrix. Using a random mask matrix With the transformed frequency domain matrix Dot product yields the final form of the random spectrum transform, which is the image after the random spectrum transform. in, This indicates that the frequency domain matrix after masking is subjected to inverse discrete cosine transform, and converted back to the spatial domain.

[0028] S23, the attack optimization objective is: to find a small perturbation δ added to the original adversarial sample in the current iteration. The above yields the iteratively updated adversarial examples. This enables the iteratively updated adversarial examples The image obtained after random spectrum transformation is It is more likely to be misclassified by the model, and the attack optimization formula is:

[0029]

[0030] in, This represents the iteratively updated adversarial sample obtained after adding perturbations; This indicates that the Bayesian model transforms the adversarial examples into a spectrum. The probability of classifying a character as the true label y is the target of the attack optimization; ||δ|| p ≤∈ represents the L of the applied perturbation δ. p The norm is restricted to the perturbation budget ∈ to ensure the imperceptibility of the perturbation;

[0031] S24, the optimized algorithm for iterative attacks is: calculate the frequency domain gradient and update the original adversarial sample for the current iteration using gradient descent. Specifically,

[0032] Define the inner layer as N iterations. In each inner layer iteration, the original adversarial sample input is processed. Perform a random spectrum transformation This is then fed into the Bayesian model, and a predicted probability is obtained for each additional model. The logarithm of this probability is then used as the loss function L. In the nth stochastic spectral transformation, the resulting loss function is...

[0033] By taking the inverse derivative, the log-likelihood of the predicted probability is calculated for the image after the nth random spectral transformation. gradient

[0034] By averaging the gradients obtained in each of these N inner iterations, the frequency domain gradient for the k-th additional model can be obtained. The formula is expressed as:

[0035]

[0036] Where y represents the true label of the image; Γ(·) represents the adversarial example obtained by the nth random spectral transformation in the i-th outer iteration; Γ(·) represents the random spectral transformation function. It is the gradient operator, which means to calculate the gradient with respect to the following function logp(·) with respect to the input variable. The gradient;

[0037] The average frequency domain gradients of the K additional models are taken, and their sign is used as the update direction for the adversarial examples. This is then combined with the original adversarial examples of the current iteration using a fixed step size. The update is performed using the following formula:

[0038]

[0039] in, This represents the original adversarial example in the current iteration. This represents the target adversarial example for this iteration, α is the attack step size, used to control the magnitude of each iteration update, and sign{·} is the sign function, used to determine the gradient direction, which points in the direction of the fastest increase in function value.

[0040] Preferably, it also includes: mixing frequency domain attacks and spatial domain attacks to further improve the attack effect; specifically, during each attack, the spatial domain gradient is also calculated, the frequency domain gradient and the spatial domain gradient are summed and averaged to obtain a unified gradient direction, and the adversarial sample is updated using the gradient direction. After a set number of iterative attacks, the final adversarial sample is obtained.

[0041] Preferably, the specific methods for hybrid frequency domain attacks and spatial domain attacks are as follows:

[0042] During the i-th attack, the frequency domain gradient of the k-th additional model is calculated. Then, its spatial domain gradient was calculated.

[0043] The frequency domain gradients and spatial domain gradients calculated by K different additional models are summed and averaged to obtain the average combined gradient. The gradient direction of the average combined gradient is used to guide the update of adversarial examples. The formula for the average combined gradient is:

[0044]

[0045] Using the obtained average combined gradient, update the original adversarial sample for the current iteration using the gradient sign method. Generate adversarial examples for the next iteration using the following update formula:

[0046]

[0047] After the outer layer iteration, i.e., attack iteration I times, the final adversarial sample is obtained.

[0048] The present invention also provides an evaluation method for robustness assessment of AIGI detectors, which uses adversarial examples to perform white-box or black-box attacks on AIGI detectors to evaluate their robustness; the adversarial examples are obtained using the adversarial example generation method for robustness assessment of AIGI detectors.

[0049] The present invention also provides a computer program product comprising a computer program / instructions that, when executed by a processor, implement the adversarial example generation method for robustness evaluation of the AIGI detector.

[0050] The present invention also provides a readable storage medium having a computer program stored thereon, which, when executed, implements the adversarial example generation method for robustness evaluation of the AIGI detector.

[0051] The present invention also provides an electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the adversarial example generation method for robustness evaluation of the AIGI detector.

[0052] The advantages of this invention are:

[0053] (1) This invention utilizes frequency-based post-trained Bayesian attack (FPBA) to generate adversarial examples, thereby launching high-quality attacks on AIGI detectors with certain generalization capabilities. It also evaluates the performance and robustness of AIGI detectors under adversarial attacks under white-box attacks and more practical black-box attacks, thereby revealing the weaknesses of existing AIGI detectors and providing a reference for their improvement.

[0054] (2) Based on the obvious difference between real images and fake images in the frequency domain, this invention proposes a new attack method, namely frequency-based post-trained Bayesian attack (FPBA). FPBA has a significant advantage over existing methods in attacking various AIGI detectors (SOTAAIGI detector, cross-generator image detection, defense model).

[0055] (3) Innovatively, a post-training Bayesian strategy is introduced. By attaching some Bayesian components to the pre-trained alternative model, a single alternative model is transformed into a Bayesian model. Multiple target models can be simulated without retraining, thereby improving the generalization ability of the attack.

[0056] (4) The AIGI detector’s response to adversarial attacks was analyzed in both white-box and black-box environments, revealing its potential security vulnerabilities.

[0057] (5) FPBA can provide successful black-box attacks across models, generators, and defense methods, and can even evade cross-generator detection, providing a crucial real-world detection scenario. Attached Figure Description

[0058] Figure 1 This is a flowchart of the adversarial example generation method for robustness evaluation of the AIGI detector according to the present invention.

[0059] Figure 2 This is a schematic diagram of the process of frequency-based post-training Bayesian attack (FPBA).

[0060] Figure 3 This is a frequency domain saliency plot. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] The relevant terms in this invention are explained as follows:

[0063] Adversarial attacks: Using adversarial examples to cause the AIGI detector to misclassify.

[0064] Robustness: The accuracy of the AIGI detector when facing adversarial examples.

[0065] Adversarial examples: Adversarial examples are a type of carefully designed input data that attackers generate to mislead AIGI detectors, causing them to incorrectly classify fake images as real ones.

[0066] AIGI Detectors: Artificial Intelligence Generative Image Detectors are a class of machine learning models designed to identify and verify the authenticity of images. AIGI detectors use deep neural networks to classify input images to distinguish between real images and fake images generated by generative adversarial networks (GANs) or diffusion models.

[0067] Bayesian model: Bayesian statistics treats the model parameters themselves as random variables, meaning that the parameters are not a single, fixed value, but follow a probability distribution.

[0068] Attack transferability refers to the extent to which adversarial examples generated for a specific alternative model can successfully deceive one or more different target models with unknown specific parameters.

[0069] Image spatial domain: The physical spatial representation of an image, that is, the form of a pixel grid.

[0070] Image frequency domain: Decomposes an image into a representation of its constituent frequencies, which consists of frequency coefficients of different frequencies.

[0071] Example 1

[0072] The adversarial example generation method for robustness evaluation of AIGI detectors in this invention aims to generate adversarial examples capable of effectively attacking AIGI detectors. Furthermore, these adversarial examples should possess good transferability across different architecture models. Figure 1 and Figure 2 As shown, the specific process of the present invention is as follows:

[0073] 1. Construct a Bayesian model to simulate the attacked model.

[0074] In this invention, a post-trained Bayesian strategy is employed. First, a pre-trained alternative model is used, which mainly consists of two parts: a feature extractor f... θ and classifier Pre-trained model parameters Θ=[θ,θ c ],θ,θ c These are feature extractors f θ and classifier The parameters.

[0075] Subsequently, given the pre-trained model parameters Θ and the training dataset... In the case of the posterior distribution of the additional model parameters In the sampling additional model, through the feature extractor f θ Then, K smaller additional models {θ′1,θ′2,...,θ′} are added in parallel. K The model is an additional neural network, which approximates the complete posterior distribution of the model. The parameters of the additional model need to be trained, while the parameters of the pre-trained model are frozen and not used in training. This solves the problem of excessive sampling overhead during training of Bayesian models in high dimensions.

[0076] First, randomly initialize these K additional models {θ′1,θ′2,...,θ′}. K}

[0077] In each iteration, for each of these K additional models... Perform the following processing:

[0078] S11, extract a mini-batch dataset, and for each image x in this dataset, use the feature extractor f of the pre-trained model.θ Extract the features from the image, and then feed these features into the classifier of the pre-trained model. and the kth additional model θ′ currently being optimized k In the process, after processing by both methods, a specific numerical value is obtained, denoted as follows: and g θ′ (f θ Adding the two together, we get:

[0079]

[0080] Here, logits represents the output that comprehensively considers the anti-spoofing performance of the additional model and the original pre-trained model; it is stipulated that the larger the logits value, the greater the likelihood that the alternative model considers the image x to be fake.

[0081] S12, first use the sigmoid() function to convert the logits value into a probability.

[0082]

[0083] in, The sigmoid function represents the probability that the image x is a fake. It can map a value of any size to a value between 0 and 1, thus representing the probability.

[0084] Since the anti-counterfeiting task of this invention is a binary classification problem, binary cross-entropy loss is used to obtain the loss function L:

[0085]

[0086] Where y represents the true label of the image, y=1 indicates that the image is fake, and y=0 indicates that the image is real. This indicates the probability that the image is fake.

[0087] S13, When training the model parameters, it is desired that the model's predictions are as accurate as possible. Therefore, the training objective is to increase the probability that the model's predictions are the true labels of the input images, i.e., to increase p(y|x,Θ,θ′). k Specifically, this is achieved by minimizing its negative log-likelihood:

[0088]

[0089] Where y is the true label of the input image x, and Θ represents the parameters of the pre-trained model, including the feature extractor f. θ With classifier The parameter, θ′ kp(y|x,Θ,θ′) represents the parameters of the kth additional model currently being trained. k ) represents a given input image x, fixed pre-trained model parameters, and the k-th additional model parameter θ′. k At that time, the model predicts the probability that image x belongs to its true class y.

[0090] Calculate the average loss function for this batch with respect to the k-th additional model parameter θ′. k gradient

[0091]

[0092] Where B represents the number of samples in the current batch, y j Let x represent the true label of the j-th sample in the current batch. j The j-th sample in the current batch is the input image, Θ represents the pre-trained model parameters, θ′ k This represents the parameters of the k-th additional model currently being trained. This means to calculate the expression within the parentheses with respect to θ′. k Partial derivatives.

[0093] S14 uses the stochastic gradient adaptive Hamiltonian Monte Carlo method to apply the parameter θ′ to each additional model. k Perform sampling and updating.

[0094] Based on the gradient calculated earlier For parameter θ′ k Multiple sampling and iterative updates are performed, as shown in the following formula:

[0095]

[0096] Where, θ′ t+1 Here are the parameters for the (t+1)th step; θ′ t σ represents the parameter at step t; σ is the update step size. It is the final gradient of the t-th step of the additional model optimization; F is the friction coefficient, used to adjust the intensity of the noise term; N represents a Gaussian distribution; The coefficient is θ′ t The covariance matrix is ​​used to smooth gradient changes; yes The inverse matrix; yes The square root of the inverse matrix; τ is a time constant used to control the update rate of the covariance matrix.

[0097] The parameters of the additional model are updated after T iterations.

[0098] During this process, the original pre-trained model parameters Θ remain unchanged; only the parameters {θ′1,θ′2,...,θ′} of the additional model are changed. K It will be trained and updated.

[0099] 2. Use adversarial examples to perform frequency domain attacks on the Bayesian model and update the adversarial examples.

[0100] Research has revealed significant differences in frequency domain features between real images and AI-generated fake images. Furthermore, different AIGI detectors (such as EfficientNet, ResNet, and ViT) focus on different frequency components when processing input images.

[0101] Based on this, the present invention aims to push the image away from its original frequency distribution by adding perturbations in the frequency domain of the image, thereby causing the AIGI detector to misclassify it. At the same time, the random spectrum transformation can also simulate a variety of alternative models, improving the transferability of the attack.

[0102] An alternative model for frequency domain attacks is the Bayesian model trained in the previous step, which can further improve the transferability of attacks.

[0103] A frequency domain attack is performed on the Bayesian model. The number of attack iterations I is set. During each attack, the input original adversarial sample is subjected to random spectral transformation, a Hadamard product with a random mask matrix, the attack optimization objective is calculated, and the frequency domain gradient is calculated. The adversarial sample is updated through gradient descent.

[0104] During the i-th attack, perform the following operations to update the adversarial sample:

[0105] S21, to further introduce randomness, simulate different alternative models, providing the original adversarial samples as input. Adding Gaussian noise ξ, the adversarial example after adding Gaussian noise in, Let ξ represent the original adversarial sample during the i-th iteration attack, and let the distribution of the Gaussian noise ξ follow the pattern of... This represents a normal distribution. The first parameter, 0, indicates that the mean of the distribution is 0, and the second parameter is the covariance matrix, which is used to control the overall intensity of the noise.

[0106] Adding Gaussian noise to the original adversarial example makes the transformed image's spectral characteristics more unpredictable, thus enabling the simulation of alternative models that focus on different frequency domain features. The processing effect.

[0107] S22, the adversarial example with Gaussian noise added. Transform to the frequency domain and compare with the random mask matrix The Hadamard product is the product of the values ​​at corresponding positions in two matrices.

[0108] Through Discrete Cosine Transform Adversarial examples with added Gaussian noise Transforming from the spatial domain to the frequency domain, i.e. The image matrix before transformation stores pixel value information, while the frequency domain matrix after transformation stores various frequency coefficients of the image, that is, the amplitude or energy of various frequencies.

[0109] The area near the upper left corner mainly stores low-frequency information, that is, the area in the original image space domain where color changes slowly; the area near the lower right corner mainly stores high-frequency information, that is, the area in the original image space domain where color changes relatively quickly, mainly the edge areas, etc.

[0110] Using a random mask matrix Each element in the uniform distribution The sample is obtained from the middle sample, where p is set to 0.5, which is the random mask matrix. Each element in the array is a random value between 0.5 and 1.5.

[0111] By randomly scaling the amplitude at different frequencies, it is possible to simulate different detectors focusing on different frequency details. If, during the random scaling process, With random mask matrix After performing the Hadamard product, the image was randomly enlarged. The low-frequency amplitude is reduced while the high-frequency amplitude is reduced, thus simulating the prediction result of the adversarial example by the AIGI detector, which is more sensitive to low-frequency information.

[0112] The transformed frequency domain matrix Dot product of random mask matrix The final form of the random spectrum transformation is obtained:

[0113]

[0114] in, The shape of is the same as that of the frequency domain matrix; ⊙ represents the Hadamard product, which multiplies the two values ​​at corresponding positions of the two matrices; This means performing an inverse discrete cosine transform on the frequency domain representation after masking, converting it back to the spatial domain, and obtaining the image after spectral transformation. This is because neural networks can only receive information in the spatial domain as input and cannot directly process information in the frequency domain.

[0115] S23, the attack optimization objective based on spectral transformation is to find a small perturbation δ to add to the original adversarial sample in the current iteration. The above yields the iteratively updated adversarial examples. The image obtained after the iteratively updated adversarial sample undergoes a random spectral transformation is... It is more easily misclassified by the model. Therefore, its attack optimization formula can be derived as follows:

[0116]

[0117] in, This represents the iteratively updated adversarial example obtained after adding a carefully designed perturbation; Θ represents the parameters of the pre-trained model, θ. ' Indicates additional model parameters. This indicates that the Bayesian model transforms adversarial examples from random spectra. The probability of classifying a character as its true label y is the target of the attack; ||δ|| p ≤∈ represents the L of the applied perturbation δ. p The norm is restricted to the perturbation budget ∈ to ensure the imperceptibility of the perturbation.

[0118] S24, the optimized algorithm for iterative attacks is: calculate the frequency domain gradient and update the original adversarial sample for the current iteration using gradient descent. This is because the gradient points in the direction in which the function value increases the fastest.

[0119] Specifically, the inner layer is defined to iterate N times. In each inner layer iteration, the original adversarial sample input is processed... Perform random spectrum transformation This is then input into the Bayesian model. For each of the K additional models, a predicted probability is obtained, and its logarithm is used as the loss function L. In the nth stochastic spectral transformation, the resulting loss function L is:

[0120]

[0121] By taking the inverse derivative, the log-likelihood of the predicted probability is calculated for the image after the nth random spectral transformation. gradient

[0122] By averaging the gradients obtained in each of these N inner iterations, the frequency domain gradient for the k-th additional model can be obtained. Its formula is expressed as:

[0123]

[0124] in, Γ(·) represents the adversarial example obtained by the nth random spectral transformation in the i-th outer layer iteration; Γ(·) represents the random spectral transformation function; Θ represents the pre-trained model parameters; θ 'k This represents the k-th additional model parameter; It is the gradient operator, which means to calculate the gradient with respect to the following function logp(·) with respect to the input variable. The gradient. The direction of the gradient points in the direction in which the function value increases the fastest.

[0125] With this frequency domain gradient This results in a frequency-domain-guided adversarial example update direction. The average frequency-domain gradients of the K additional models are taken, and their sign is used as the update direction of the adversarial example. Combined with a fixed small step size, the adversarial example in the current iteration is updated. The specific update method is as follows:

[0126]

[0127] in, This represents the original adversarial example in the current iteration step. Let represent the target adversarial example in this iteration, α be the attack step size (learning rate) controlling the magnitude of each iteration update, and sign{·} be the sign function, taking the direction of the gradient, which points in the direction of the fastest increase in function value. The entire formula means that a small modification is made to the current adversarial example along the direction of the average gradient that makes the model more likely to misclassify.

[0128] Figure 3 For frequency domain saliency plot, Figure 3 In the diagram, (a) shows the result of analyzing the input image after performing a random spectral transformation (N=10) on the input image using the EfficientNet model. Figure 3 (b), (c), and (d) in the figure represent the sensitivity analysis results of different AIGI detectors (EfficientNet, ResNet, and ViT) on the input image. It can be seen that different AIGI detectors focus on different frequency regions when processing the input image; some focus more on high-frequency information, while others are more sensitive to low-frequency details. The color value represents the absolute gradient value of the model loss function after min-max normalization. The warmer the color (leaning towards yellow or red), the larger the absolute gradient, indicating that the frequency component has a greater impact on the model's final judgment.

[0129] 3. Hybrid frequency domain attacks and spatial domain attacks further improve attack effectiveness and update adversarial samples.

[0130] Some detectors also extract and rely on features in the spatial domain of the image. If they rely only on frequency domain attacks, their effectiveness may be limited when facing detectors that mainly rely on spatial domain features.

[0131] Therefore, to further improve the transferability of adversarial examples, this invention can also combine attack gradients from the frequency domain and the spatial domain to make the generated adversarial examples more transferable. It can simultaneously disrupt the model's judgments in two dimensions.

[0132] S31, in step 2, during the i-th attack, calculate the frequency domain gradient of the k-th additional model of the Bayesian model. Then, the spatial domain gradient was calculated. Spatial domain gradient It is a direct target of the original adversarial example in the current iteration. The calculation is performed without any spectral transformation. For the k-th additional model, its spatial domain gradient is... The calculation formula is:

[0133]

[0134] Where y represents the true label of the image. Let θ represent the original adversarial sample in the i-th iteration of the adversarial attack, Θ represent the pre-trained model parameters, and θ represent the parameters of the model. ' k This represents the k-th additional model parameter. It is the gradient operator, which means to calculate the gradient with respect to the following function logp(·) with respect to the input variable. The gradient. The direction of the gradient points in the direction in which the function value increases the fastest.

[0135] S32, K different additional models {θ ' 1,θ ' 2,...,θ ' K The frequency domain gradient and spatial domain gradient calculated separately are summed and averaged to obtain a unified gradient direction, which is used to guide the updating of adversarial examples. The formula is as follows:

[0136]

[0137] S33, Update adversarial examples

[0138] Use the average combined gradient obtained in step S32 to update the original adversarial sample for the current iteration. Generate adversarial examples for the next iteration That is, the target adversarial sample in this iteration

[0139] The goal is to make a small modification to the current adversarial example along the average gradient direction that makes the model more likely to misclassify the image, using gradient signification for updating:

[0140]

[0141] in, This represents the original adversarial example in the current iteration. Let α represent the target adversarial example for this iteration, α be the attack step size (learning rate) that controls the magnitude of each iteration update, and sign{·} be the sign function that takes the direction of the gradient, which points in the direction of the fastest increase in function value.

[0142] After I iterations in the outer layer, the final adversarial sample can be obtained.

[0143] Example 2

[0144] The evaluation method for robustness testing of AIGI detectors in this invention utilizes the adversarial examples generated in Example 1. Robustness evaluation of the AIGI detector is performed under both white-box and black-box attack environments. A white-box attack allows the attacker access to the detector's model parameters and structure, while a black-box attack prevents the attacker from obtaining the detector's model parameters and structure, allowing only attacks based on the output. The adversarial examples generated in this invention... It still exhibits good attack migration capability under the black-box AIGI detector.

[0145] The above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An adversarial example generation method for robustness evaluation of AIGI detectors, characterized in that, include: Construct a Bayesian model to simulate the attacked model; Adversarial examples are used to attack Bayesian models in the frequency domain. The number of attack iterations is set. In each attack, a perturbation is added to the spatial domain of the original adversarial example to transform it from the spatial domain to the frequency domain and perform a random spectrum transformation. According to the attack optimization target, the frequency domain gradient is calculated to update the adversarial example. After the set number of attack iterations, the final adversarial example is obtained.

2. The adversarial example generation method for robustness evaluation of AIGI detectors according to claim 1, characterized in that, The Bayesian model is constructed by using a pre-trained alternative model, which is generated by the feature extractor f. θ and classifier Composition, in feature extractor f θ Then, K additional models are added in parallel to obtain the Bayesian model; Wherein, the pre-trained model parameters Θ=[θ,θ c ],θ,θ c The feature extractors f are respectively θ and classifier The parameters, the parameters of the K additional models θ′={θ′1,...,θ′ k ,...,θ′ K }, θ′ k These are the parameters of the k-th additional model.

3. The adversarial example generation method for robustness evaluation of AIGI detectors according to claim 2, characterized in that, The training method for a Bayesian model is as follows: Using a post-training Bayesian strategy, given the pre-trained model parameters Θ=[θ,θ c and training dataset In the case of the posterior distribution of the additional model parameters In the sampling process, an additional model is used, which is a small neural network. The parameters of the additional model are to be trained, while the parameters Θ of the pre-trained model are frozen. K additional models are randomly initialized. In each iteration, the parameters of each additional model are... Perform the following operations: S11, extract a mini-batch dataset. For each image x in the dataset, use the feature extractor f of the pre-trained model. θ Extract image features and feed them into the classifier of the pre-trained model. and the kth additional model θ′ currently being optimized k The feature, after being processed by both methods, yields a specific numerical value, denoted as [value 1] and [value 2] respectively. and g θ′ (f θ (x)), adding the two together gives logits is the output that takes into account the anti-spoofing performance of the additional model and the original pre-trained model. The larger the logits value, the greater the likelihood that the alternative model considers the image to be fake. S12, use the sigmoid(·) function to convert the logits values ​​into probabilities. probability This represents the probability that image x is a fake, with respect to the probability... The loss function is obtained using binary cross-entropy loss. Where y represents the true label of image x, when y = 1 it means that the image is a fake image, and when y = 0 it means that the image x is a real image; S13, the training objective is to improve the probability that the model's prediction is the true label of the input image, which is achieved by minimizing its negative log-likelihood. Where p(y|x,Θ,θ′) k ) represents a given input image x, fixed pre-trained model parameters Θ, and the k-th additional model parameter θ′. k At that time, the model predicts the probability that image x belongs to its true class y; calculate the batch average loss function with respect to the k-th additional model parameter θ′. k gradient Where B represents the number of samples in the current batch, y j Let x represent the true label of the j-th sample in the current batch. j This indicates that the j-th sample in the current batch is the input image. This means to calculate the expression within the parentheses with respect to θ′. k Partial derivatives; S14, using the stochastic gradient adaptive Hamiltonian Monte Carlo method for the parameters θ′ of each additional model. k Perform sampling and updating based on the calculated gradient. For parameter θ′ k Multiple sampling iterations are performed, and the update formula is as follows: Where, θ′ t+1 Here are the parameters for the (t+1)th step; θ′ t σ represents the parameter at step t; σ is the update step size. It is the final gradient of the t-th step of the additional model optimization; F is the friction coefficient, used to adjust the intensity of the noise term; N represents a Gaussian distribution; The coefficient is θ′ t The covariance matrix is ​​used to smooth gradient changes; yes The inverse matrix; yes The square root of the inverse matrix; τ is a time constant used to control the update rate of the covariance matrix; After T iterations, the parameters of the additional model are updated, while the parameters of the original pre-trained model remain unchanged.

4. The adversarial example generation method for robustness evaluation of AIGI detectors according to claim 2 or 3, characterized in that, The Bayesian model is attacked based on the frequency domain. The number of attack iterations is set to I. During the i-th attack, the following operations are performed to update the adversarial sample: S21, the original adversarial sample as input. Adding Gaussian noise ξ, the adversarial example after adding Gaussian noise S22, the adversarial example with Gaussian noise added. Transform to the frequency domain and compare with the random mask matrix Construct the Hadamard product; specifically, through the discrete cosine transform. Adversarial examples with added Gaussian noise Transforming from the spatial domain to the frequency domain yields the transformed frequency domain matrix. Using a random mask matrix With the transformed frequency domain matrix Dot product yields the final form of the random spectrum transform, which is the image after the random spectrum transform. in, This indicates that the frequency domain matrix after masking is subjected to inverse discrete cosine transform, and converted back to the spatial domain. S23, the attack optimization objective is: to find a small perturbation δ to be added to the original adversarial sample in the current iteration. The above yields the iteratively updated adversarial examples. This enables the iteratively updated adversarial examples The image obtained after random spectrum transformation is It is more likely to be misclassified by the model, and the attack optimization formula is: in, This represents the iteratively updated adversarial sample obtained after adding perturbations; This indicates that the Bayesian model transforms the adversarial examples into a spectrum. The probability of classifying a character as the true label y is the target of the attack optimization; ||δ|| p ≤∈ represents the L of the applied perturbation δ. p The norm is restricted to the perturbation budget ∈ to ensure the imperceptibility of the perturbation; S24, the optimized algorithm for iterative attacks is: calculate the frequency domain gradient and update the original adversarial sample for the current iteration using gradient descent. Specifically, Define the inner layer as N iterations. In each inner layer iteration, the original adversarial sample input is processed. Perform a random spectrum transformation This is then fed into the Bayesian model, and a predicted probability is obtained for each additional model. The logarithm of this probability is then used as the loss function L. In the nth stochastic spectral transformation, the resulting loss function is... By taking the inverse derivative, the log-likelihood of the predicted probability is calculated for the image after the nth random spectral transformation. gradient By averaging the gradients obtained in each of these N inner iterations, the frequency domain gradient for the k-th additional model can be obtained. The formula is expressed as: Where y represents the true label of the image; Γ(·) represents the adversarial example obtained by the nth random spectral transformation in the i-th outer iteration; Γ(·) represents the random spectral transformation function. It is the gradient operator, which means to calculate the gradient with respect to the following function logp(·) with respect to the input variable. The gradient; The average frequency domain gradients of the K additional models are taken, and their sign is used as the update direction for the adversarial examples. This is then combined with the original adversarial examples of the current iteration using a fixed step size. The update is performed using the following formula: in, This represents the original adversarial example in the current iteration. This represents the target adversarial example for this iteration, α is the attack step size, used to control the magnitude of each iteration update, and sign{·} is the sign function, used to determine the gradient direction, which points in the direction of the fastest increase in function value.

5. The adversarial example generation method for robustness evaluation of AIGI detectors according to claim 4, characterized in that, Also includes: Hybrid frequency domain attacks and spatial domain attacks are used to further improve the attack effect. Specifically, during each attack, the spatial domain gradient is also calculated, and the frequency domain gradient and spatial domain gradient are summed and averaged to obtain a unified gradient direction. This gradient direction is then used to update the adversarial sample. After a set number of iterative attacks, the final adversarial sample is obtained.

6. The adversarial example generation method for robustness evaluation of AIGI detectors according to claim 5, characterized in that, The specific methods of hybrid frequency domain attacks and spatial domain attacks are as follows: During the i-th attack, the frequency domain gradient of the k-th additional model is calculated. Then, its spatial domain gradient was calculated. The frequency domain gradients and spatial domain gradients calculated by K different additional models are summed and averaged to obtain the average combined gradient. The gradient direction of the average combined gradient is used to guide the update of adversarial examples. The formula for the average combined gradient is: Using the obtained average combined gradient, update the original adversarial sample for the current iteration using the gradient sign method. Generate adversarial examples for the next iteration using the following update formula: After the outer layer iteration, i.e., attack iteration I times, the final adversarial sample is obtained.

7. A method for evaluating the robustness of AIGI detectors, characterized in that, Adversarial examples are used to perform white-box or black-box attacks on the AIGI detector to evaluate its robustness. The adversarial examples are obtained using the adversarial example generation method for robustness evaluation of AIGI detectors as described in any one of claims 1 to 6.

8. A computer program product, characterized in that, It includes a computer program / instruction that, when executed by a processor, implements the adversarial example generation method for robustness evaluation of the AIGI detector as described in any one of claims 1 to 6.

9. A readable storage medium, characterized in that, It stores a computer program that, when executed, implements the adversarial example generation method for robustness evaluation of AIGI detectors as described in any one of claims 1 to 6.

10. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the adversarial example generation method for robustness evaluation of AIGI detectors as described in any one of claims 1 to 6.

Images