Deep signature network based on triple attention mechanism and distribution-dependent attack
By using a triple attention mechanism and a deep signature network with distribution-related attacks, adversarial examples that can penetrate simple defenses are generated, solving the problem that adversarial examples are easily resisted in existing technologies and achieving efficient attack assessment of signature authentication systems.
Patent Information
- Application Number
- CN202511026558.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-24
- Publication Date
- 2025-11-07
AI Technical Summary
Adversarial samples generated by existing adversarial attack methods are easily defended by simple defense mechanisms and cannot effectively verify the security of signature authentication systems.
We employ a deep signature network based on a triple attention mechanism and distribution-related attacks. It captures signature features through cross-dimensional interaction and generates adversarial perturbations using the projection gradient descent algorithm, thus generating adversarial examples that can penetrate simple defenses.
The generated adversarial examples can effectively penetrate simple defenses such as the OTSU algorithm, achieving high success rates in both targeted and untargeted attacks, and evaluating the robustness of the signature authentication system.
Smart Images
Figure CN120913280A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of character recognition in the field of computer pattern recognition security, more particularly to a deep signature network based on triple attention mechanism and distribution-related attack. BACKGROUND
[0002] In the field of machine learning system security, carefully constructed adversarial perturbations can cause machine learning classifiers to make mistakes. Handwritten signature, as an important form of biometric authentication, plays a key role in identity verification, and the misclassification of signature verification system will bring serious risks to personal privacy and identity security.
[0003] Therefore, it has become an important research topic to evaluate the security of signature authentication system through attack methods. However, the adversarial samples generated by traditional attack algorithms are easily resisted by simple defense mechanisms such as Otsu algorithm, and it is difficult to effectively evaluate the robustness of signature verification network. SUMMARY
[0004] The present application is to provide a black-box attack method from the perspective of data distribution to carry out adversarial attack research, which solves the problem that the adversarial samples generated by the existing adversarial attack method are easily resisted by simple defense mechanisms and cannot effectively verify the security of the signature authentication system.
[0005] To achieve the above purpose, the present application provides a deep signature network based on triple attention mechanism and distribution-related attack, comprising the following steps:
[0006] S1 obtains an original image of offline handwritten signature;
[0007] S2 converts the original signature image to Numpy format data through data format conversion;
[0008] S3 performs Gaussian filtering and OTSU algorithm preprocessing based on the above signature image;
[0009] S4 loads the proxy model and the pre-trained model;
[0010] S5 integrates the triple attention mechanism into the proxy model;
[0011] S6 the triple attention mechanism is composed of three branches, which respectively capture the cross-dimensional interaction between (C, H), (C, W), (H, W) of the features of the offline handwritten signature image; wherein C represents the channel dimension, H represents the height dimension, and W represents the width dimension; wherein, the working principle of the triple attention mechanism is as follows:
[0012] S7 given the feature map of the signature image, each branch applies a similar conversion sequence to calculate the attention;
[0013] S8 In the first branch, attention is built between H and C;
[0014] S9 Rotate the feature map 90 degrees counterclockwise along the H axis to generate the feature Figure 1 ;
[0015] S10 Reduce the dimension to (2, H, W) by extracting key features through Z-pool;
[0016] S11 Based on the above-mentioned reduced representation, subsequent convolutional layers, batch normalization and Sigmoid activation are performed to generate attention weights;
[0017] S12 The above-mentioned weights are assigned to the feature Figure 1 , and then rotated 90 degrees clockwise to restore the original shape;
[0018] S13 The second branch is responsible for capturing the dependency between C and W, and attention is built between C and W;
[0019] S14 Rotate the feature map 90 degrees counterclockwise along the W axis to generate the feature Figure 2 ;
[0020] S15 Reduce the dimension to (2, C, W) by extracting key features through Z-pool;
[0021] S16 Based on the above-mentioned reduced representation, subsequent convolutional layers, batch normalization and Sigmoid activation are performed to generate attention weights;
[0022] S17 The above-mentioned weights are assigned to the feature Figure 2 , and then rotated 90 degrees clockwise to restore the original shape;
[0023] S18 The third branch models the interaction between the H dimension and the W dimension, and the feature map does not need to be rotated;
[0024] S19 Based on the above, Z-pool, convolution and Sigmoid activation are applied directly;
[0025] S20 Finally, the optimized attention tensors of the three branches are averaged to generate a shape (C, H, W) that maintains the original input shape;
[0026] S21 Based on the above, by capturing the dependencies between the (C, H), (C, W) and (H, W) dimensions of the input tensor, the features of the signature such as strokes, curves and writing style are accurately captured;
[0027] S22 Based on the above, the training set of the preprocessed signature image data is input into the agent model that has integrated the triple attention module;
[0028] S23 In the training process, for each signature user, define the user's real signature as the user's real signature, and all the user's skilled fake signature image data and signature image data not belonging to the user as the user's fake signature;
[0029] S24 Since the number of fake signature image data of each user is much larger than the number of real signature image data of each user, it is a serious sample imbalance problem, and the signature image is trained by adjusting the weights of real signature and fake signature and increasing the punishment of real signature;
[0030] S25 Fine-tune the substitute model to adapt to the binary classification task according to the characteristics of signature identification as a binary classification task;
[0031] S26 Introduce a distribution-related attack method to train the signature image data set, so that the substitute model can fit the image data of the signature to be attacked, thereby generating efficient adversarial perturbations;
[0032] S27 For offline handwritten signature images, realize the targetless attack (real signature->fake signature) and targeted attack (skilled fake signature / random fake signature->real signature) of signature images;
[0033] S28 Based on S26, the signature images of each user are divided into three categories: real signature, skilled fake signature, and random fake signature. Real signature refers to the signature written by the user himself; skilled fake signature refers to the signature written by the imitator after a large amount of imitation training on the user's real signature; and the real and skilled fake signatures of other users can be classified as random fake signatures of the user;
[0034] S29 The targetless attack refers to maximizing the loss between the adversarial sample and the original sample, and the targeted attack refers to minimizing the loss between the adversarial sample and the target sample;
[0035] S30 Based on the generated adversarial perturbation, apply the projected gradient descent algorithm to add the generated adversarial perturbation to the original signature image;
[0036] S31 The generated adversarial sample is subjected to the same operation as step S3 to obtain the adversarial sample after defense measures;
[0037] S32 Evaluate the attack effect of the adversarial sample after the OTSU algorithm defense operation;
[0038] S33 Input the signature image of the training data set (which is disjoint with the original data set of the adversarial sample) into the target model to extract features and learn the features of the real signature, skilled fake signature and random fake signature of each user, and obtain a pre-trained model;
[0039] S34 Obtain the above pre-trained model, extract the classification features of the model full connection layer, and train the SVM model to obtain the pre-trained SVM;
[0040] S35 Use the pre-trained SVM to perform batch offline signature authentication on the adversarial samples generated in S30;
[0041] S36 Signature authentication needs to evaluate the results of non-target attacks and targeted attack results;
[0042] S37 For non-target attacks in the signature task, it means that by adding a small perturbation, the classifier will identify the user's real signature as a fake signature (skilled fake signature / random fake signature);
[0043] S38 For targeted attacks in the signature task, it means that by adding a small perturbation, the classifier will misclassify the user's skilled fake signature (or random fake signature) as a real signature;
[0044] S39 Statistics will identify the probability of identifying a real signature as a fake signature, the probability of identifying a skilled fake signature as a real signature, and the probability of identifying a random fake signature as a real signature, and evaluate the attack success rate.
[0045] Preferably, the specific manner in S3 is:
[0046] S3.1 Read data from the Numpy format data;
[0047] S3.2 Perform Gaussian filtering on the Numpy data corresponding to each image to remove image noise and make the image smoother to obtain a noise-removed image;
[0048] S3.3 The above denoised image is processed using the OTSU algorithm (maximum inter-class variance method) to divide it into background and foreground based on image gray scale characteristics; Since variance is an important indicator of gray scale distribution uniformity, the greater the inter-class variance between background and foreground, the more significant the difference between the two parts of the image; If the foreground and background are misclassified, the difference between the two classes will decrease; Through this method, the preprocessed offline handwritten signature image dataset is finally obtained.
[0049] Preferably, the attack method related to distribution in S26 includes two steps:
[0050] S26.1 Fine-tune the substitute model using cross-entropy loss and DCG loss to make its gradient approximate the real distribution of the signature image data to be attacked;
[0051] S26.2 The fine-tuned proxy model generates adversarial perturbations based on the gradient information of the approximate real data distribution.
[0052] Preferably, the projection gradient descent algorithm in S30 specifically comprises the following steps:
[0053] S30.1 Randomly initialize an initial perturbation that meets the constraint condition and add it to the original signature image;
[0054] S30.2 Repeat the following operations within a preset number of iterations:
[0055] Forward propagation: input the first step generated adversarial sample into the substitute model, calculate the cross-entropy loss, and measure the deviation of the adversarial sample from the original sample;
[0056] Back propagation: take the gradient of the input through the loss function; for untargeted attacks, obtain the gradient direction that maximizes the loss; for targeted attacks, obtain the gradient direction that minimizes the loss between the adversarial sample and the target sample;
[0057] Update perturbation: update the adversarial perturbation along the gradient direction;
[0058] S30.3 After each perturbation update, limit the perturbation within the allowed range through the projection operation to ensure the legality of the adversarial sample;
[0059] S30.4 End of iteration, generate the final adversarial sample.
[0060] Compared with the prior art, the present application has the following advantages:
[0061] For the above technical method, the adversarial sample generated by the present application can effectively deal with simple defense measures. Compared with other existing technologies, the perturbation in the adversarial sample generated by the present application will not be completely removed by the OTSU algorithm and other defense measures, and the adversarial sample after the OTSU algorithm still has the ability to deceive deep neural networks, and both untargeted attacks and targeted attacks can achieve a relatively high attack success rate. BRIEF DESCRIPTION OF DRAWINGS
[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.
[0063] Figure 1 The accompanying drawings are flowcharts of the present application.
[0064] Figure 2 The accompanying drawings are comparison diagrams of the adversarial sample generated by the present application after the OTSU algorithm defense measure and the original sample. DETAILED DESCRIPTION
[0065] Embodiments of the present application are described in detail below with reference to examples illustrated in the accompanying drawings, in which the same or similar components or components having the same or similar functions are denoted by the same or similar reference numerals throughout. The embodiments described below by reference to the drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.
[0066] The present application provides a black-box attack method for researching adversarial attacks from the perspective of data distribution, which solves the problem that the adversarial samples generated by the existing adversarial attack method are easily resisted by simple defense mechanisms and cannot effectively verify the security of the signature identification system.
[0067] To achieve the above-mentioned goal, the present application designs an offline handwritten signature attack method based on a triple attention module and distribution correlation. Specifically, the method first integrates the triple attention module into the proxy model, calculates the attention of the channel and spatial dimension by means of cross-dimension interaction operation, and then accurately captures the key features (such as stroke thickness, curvature, and writing style for distinguishing real and fake signatures) that the model pays attention to when classifying offline handwritten signatures. Subsequently, the proxy model is fine-tuned using the distribution-related attack method to accurately capture the data distribution of real signature images (known), skilled fake signature images (known), and random fake signature images (known), so as to approximate the true data distribution of the signature image to be attacked (unknown due to the characteristics of black-box attack). Then, relying on the fine-tuned proxy model, generate adversarial perturbations under the guidance of the approximate true data distribution, and generate adversarial samples through the projected gradient descent algorithm. The adversarial samples generated by the present application cannot be resisted by simple defense methods such as Otsu algorithm.
[0068] Please refer to the accompanying Figures 1-2 The present application discloses a deep signature network based on a triple attention mechanism and distribution-related attack, comprising the following steps:
[0069] S1, obtaining an original image of offline handwritten signature;
[0070] S2, performing data format conversion on the original signature image to obtain Numpy format data;
[0071] S3, performing Gaussian filtering and OTSU algorithm preprocessing on the signature image, and the specific method is:
[0072] S4, reading data from the Numpy format data;
[0073] S5, performing Gaussian filtering on the Numpy data corresponding to each image to remove image noise and make the image smoother, and obtaining the image after removing noise;
[0074] S6 The OTSU algorithm (maximum between-class variance method) is used to process the above denoised image, which is divided into background and foreground based on the image gray scale characteristics. Since variance is an important indicator of the uniformity of gray scale distribution, the greater the variance between the background and the foreground, the more significant the difference between the two parts of the image; if the foreground and the background are misclassified, the difference between the two classes will decrease. Through this method, the preprocessed offline handwritten signature image dataset is finally obtained.
[0075] S7 Load the agent model and the pre-trained model;
[0076] S8 Integrate the triple attention mechanism into the agent model;
[0077] S9 The triple attention mechanism consists of three branches, which capture the cross-dimensional interaction between (C, H), (C, W), and (H, W) of the offline handwritten signature image features. Among them, C represents the channel dimension, H represents the height dimension, and W represents the width dimension;
[0078] Among them, the working principle of the triple attention mechanism is as follows:
[0079] S10 Given the feature map of the signature image, each branch applies a similar conversion sequence to calculate the attention;
[0080] S11 In the first branch, the attention is established between H and C;
[0081] S12 Rotate the feature map 90 degrees counterclockwise along the H axis to generate the feature Figure 1 ;
[0082] S13 Extract key features by Z-pool to reduce the dimension to (2, H, W);
[0083] S14 Based on the above obtained reduced representation, then pass through the convolution layer, batch normalization and Sigmoid activation to generate the attention weight;
[0084] S15 Assign the above weight to the feature Figure 1 , and then rotate it 90 degrees clockwise to restore the original shape;
[0085] S16 The second branch is responsible for capturing the dependency between C and W, and the attention is established between C and W;
[0086] S17 Rotate the feature map 90 degrees counterclockwise along the W axis to generate the feature Figure 2 ;
[0087] S18 Extract key features by Z-pool to reduce the dimension to (2, C, W);
[0088] S19 Based on the above obtained dimension reduction representation, subsequent convolution layer, batch normalization and Sigmoid activation are performed to generate attention weight;
[0089] S20 The above weight is assigned as a feature Figure 2 Then, rotate 90 degrees clockwise to restore the original shape:
[0090] S21 The third branch models the interaction between H dimension and W dimension, and the feature map does not need to be rotated;
[0091] S22 Based on the above, Z-pool, convolution and Sigmoid activation are directly applied;
[0092] S23 Finally, the optimized attention tensors of the three branches are averaged to generate a tensor maintaining the original input shape (C, H, W);
[0093] S24 Based on the above, by capturing the dependence between (C, H), (C, W) and (H, W) dimensions of the input tensor, the features such as the strokes, curves and writing styles of the signature are accurately captured;
[0094] S25 Based on the above, the preprocessed training set of signature image data is input into the surrogate model which has integrated the triple attention module;
[0095] S26 During the training process, for each signature user, the real signature of the user is defined as the real signature of the user, and the skilled forged signature image data of the user and the signature image data not belonging to the user are all regarded as the forged signature of the user;
[0096] S27 Since the number of forged signature image data of each user is much larger than the number of real signature image data of the user, it is a serious sample imbalance problem, and the signature image is trained by adjusting the weights of real signature and forged signature and increasing the punishment of real signature;
[0097] S28 In view of the characteristics of the signature identification as a binary classification task, the surrogate model is fine-tuned to adapt to the binary classification task;
[0098] S29 The attack method related to the distribution is introduced to train the signature image data set, so that the surrogate model can fit the image data of the signature to be attacked, thereby generating efficient adversarial perturbations; The attack method related to the distribution includes two steps:
[0099] S30 The first step is to fine-tune the surrogate model using cross-entropy loss and DCG loss, so that the gradient of the surrogate model approximates the real distribution of the signature image data to be attacked;
[0100] S31, the second step, the fine-tuned proxy model generates adversarial perturbations based on the gradient information approximating the real data distribution;
[0101] S32, for offline handwritten signature images, the signature images are implemented for target-free attack (real signature -> forged signature) and targeted attack (skilled forged signature / random forged signature -> real signature).
[0102] S33, based on S31, the signature images of each user are divided into three categories: real signature, skilled forged signature and random forged signature. The real signature refers to the signature written by the user himself; the skilled forged signature refers to the signature written by the imitator after a large number of imitation training on the real signature of the user; and the real and skilled forged signatures of other users can be classified as random forged signatures of the user;
[0103] S34, the target-free attack refers to maximizing the loss between the adversarial sample and the original sample, and the targeted attack refers to minimizing the loss between the adversarial sample and the target sample;
[0104] S35, based on the generated adversarial perturbations, the projection gradient descent algorithm is applied to add the generated adversarial perturbations to the original signature image. The projection gradient descent algorithm specifically includes the following steps:
[0105] S36, the first step, an initial perturbation satisfying the constraint condition is randomly initialized and added to the original signature image;
[0106] S37, the second step, within a predetermined number of iterations, the following operations are repeatedly performed:
[0107] Forward propagation: input the adversarial sample generated in the first step into the surrogate model, calculate the cross-entropy loss, and measure the deviation between the adversarial sample and the original sample;
[0108] Back propagation: calculate the gradient of the input through the loss function. For target-free attack, the gradient direction that maximizes the loss is obtained; for targeted attack, the gradient direction that minimizes the loss between the adversarial sample and the target sample is obtained;
[0109] Update perturbation: update the adversarial perturbation along the gradient direction;
[0110] S38, the third step, after each perturbation update, the perturbation is limited in the allowed range through the projection operation to ensure the legality of the adversarial sample;
[0111] S39, the fourth step, the iteration is ended, and the final adversarial sample is generated;
[0112] S40, the generated adversarial sample is subjected to the same operation as S3, S4, S5 and S6 to obtain the adversarial sample after the defense measures;
[0113] S41 evaluate the attack effect of the adversarial sample after the OTSU algorithm defense operation;
[0114] S42 input the signature image of the training data set (not intersected with the original data set of the adversarial sample) into the target model, perform feature extraction, learn the features possessed by the real signature, the skilled forged signature and the random forged signature of each user, and obtain a pre-trained model;
[0115] S43 obtain the pre-trained model, extract the classification features of the model full connection layer, perform SVM model training, and obtain a pre-trained SVM;
[0116] S44 use the pre-trained SVM to perform batch offline signature authentication on the adversarial sample generated in S39,
[0117] S45 signature authentication is to evaluate the results of the targetless attack and the targeted attack;
[0118] S46 for the targetless attack in the signature task, it refers to adding a small disturbance so that the classifier identifies the real signature of the user as a forged signature (skilled forged signature / random forged signature);
[0119] S47 for the targeted attack in the signature task, it refers to adding a small disturbance so that the classifier misclassifies the skilled forged signature (or random forged signature) of the user as a real signature;
[0120] S48 statistics the probability of identifying the real signature as a forged signature, the probability of identifying the skilled forged signature as a real signature, and the probability of identifying the random forged signature as a real signature, and evaluate the attack success rate. The original offline handwritten signature image after preprocessing is used as the input data of the present application, and the adversarial sample generated by the present application still has a relatively high attack success rate after the defense measures, whether it is a targetless attack or a targeted attack. The comparison chart of the original sample and the adversarial sample after the defense measures is shown in Figure 2 . In Figure 2 , we can observe that after the OTSU algorithm, some noise in the adversarial sample is not completely removed, on the other hand, some subtle strokes in the adversarial sample will be removed as noise after the adversarial operation and the OTSU algorithm defense measures, and the adversarial sample after the defense measures still has the ability to deceive the identification model.
[0121] The various embodiments described in this specification are implemented in a progressive manner, each embodiment focusing on the differences from other embodiments, and the same or similar parts between embodiments can be mutually referred to. For the apparatus disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method part.
[0122] The above description of disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A deep signature network based on triple attention mechanism and distribution related attack, characterized in that, The method comprises the following steps: S1 obtaining an offline handwritten signature original image; S2 performing data format conversion on the original signature image to obtain Numpy format data; S3 performing Gaussian filtering and OTSU algorithm preprocessing on the signature image; S4 loading a proxy model and a pre-training model; S5 integrating a triple attention mechanism into the proxy model; S6 the triple attention mechanism comprises three branches, which capture cross-dimension interactions between (C, H), (C, W) and (H, W) of the offline handwritten signature image feature map; wherein C represents a channel dimension, H represents a height dimension, and W represents a width dimension; wherein the working principle of the triple attention mechanism is as follows: S7 given a signature image feature map, each branch applies a similar conversion sequence to calculate attention; S8 in the first branch, attention is established between H and C; S9 the feature map is rotated counterclockwise by 90 degrees along the H axis to generate a feature map 1; S10 key features are extracted through Z-pool to reduce the dimension to (2, H, W); S11 the reduced representation obtained above is then subjected to a convolution layer, batch normalization and Sigmoid activation to generate attention weights; S12 after the above weights are assigned to the feature map 1, the original shape is restored by rotating 90 degrees clockwise; S13 the second branch is responsible for capturing the dependency between C and W, and attention is established between C and W; S14 the feature map is rotated counterclockwise by 90 degrees along the W axis to generate a feature map 2; S15 key features are extracted through Z-pool to reduce the dimension to (2, C, W); S16 the reduced representation obtained above is then subjected to a convolution layer, batch normalization and Sigmoid activation to generate attention weights; S17 after the above weights are assigned to the feature map 2, the original shape is restored by rotating 90 degrees clockwise; S18 the third branch models the interaction between the H dimension and the W dimension, and the feature map does not need to be rotated; S19 Z-pool, convolution and Sigmoid activation are directly applied based on the above; S20 the optimized attention tensors of the three branches are averaged to generate a shape (C, H, W) that maintains the original input shape; S21 based on the above, by capturing the dependency between the (C, H), (C, W) and (H, W) dimensions of the input tensor, the features such as strokes, curves and writing style of the signature are accurately captured; S22 based on the above, the training set of the preprocessed signature image data is input into the proxy model that has integrated the triple attention module; S23 during the training process, for each signature user, the real signature of the user is defined as the real signature of the user, and the skilled fake signature image data of the user and the signature image data not belonging to the user are all regarded as fake signatures of the user; S24 since the number of fake signature image data of each user is much larger than the number of real signature image data of the user, it is a serious sample imbalance problem, and the signature image is trained by adjusting the weights of the real signature and the fake signature and increasing the punishment for the real signature. S25, fine-tune the substitute model to adapt to the binary classification task according to the characteristics of the signature identification as a binary classification task; S26, introduce a distribution-related attack method to train the signature image dataset, so that the substitute model can fit the image data of the signature to be attacked, thereby generating efficient adversarial perturbations; S27, for offline handwritten signature images, realize the no-target attack (real signature -> fake signature) and the targeted attack (skilled fake signature / random fake signature -> real signature) on the signature image; S28, based on S26, the signature images of each user are divided into three categories: real signature, skilled fake signature, and random fake signature. The real signature refers to the signature written by the user himself; the skilled fake signature refers to the signature written by an imitator after a large amount of imitation training on the real signature of the user; and the real signature and the skilled fake signature of other users can be classified as random fake signatures of the user; S29, the no-target attack refers to maximizing the loss between the adversarial sample and the original sample, and the targeted attack refers to minimizing the loss between the adversarial sample and the target sample; S30, based on the generated adversarial perturbations, apply the projected gradient descent algorithm to add the generated adversarial perturbations to the original signature image; S31, the generated adversarial sample is subjected to the same operation as in S3 to obtain an adversarial sample after defense measures; S32, evaluate the attack effect of the adversarial sample after the OTSU algorithm defense operation; S33, input the signature images of the training data set (which is disjoint with the original data set of the adversarial sample) into the target model to extract features and learn the characteristics of the real signature, skilled fake signature, and random fake signature of each user, to obtain a pre-trained model; S34, obtain the above pre-trained model, extract the classification features of the model full connection layer, and perform SVM model training to obtain a pre-trained SVM; S35, use the pre-trained SVM to perform batch offline signature identification on the adversarial sample generated in S30; S36, the signature identification needs to evaluate the results of the no-target attack and the targeted attack; S37, for the no-target attack in the signature task, a small perturbation is added to make the classifier identify the real signature of the user as a fake signature (skilled fake signature / random fake signature); S38, for the targeted attack in the signature task, a small perturbation is added to make the classifier misclassify the skilled fake signature (or random fake signature) of the user as a real signature; S39, statistics the probability of identifying the real signature as a fake signature, the probability of identifying the skilled fake signature as a real signature, and the probability of identifying the random fake signature as a real signature, and evaluate the attack success rate.
2. The deep signature network based on triple attention mechanism and distribution-related attack of claim 1, wherein, The specific way in S3 is: S3.1, read data from the Numpy format data; S3.2, perform Gaussian filtering on the Numpy data corresponding to each image to remove image noise and make the image smoother, to obtain an image without noise; S3.3 The OTSU algorithm (maximum between-class variance method) is used to process the above denoised image, which is divided into background and foreground based on the image gray level characteristics; since variance is an important indicator of measuring the uniformity of gray scale distribution, the greater the between-class variance of background and foreground, the more significant the difference between the two parts of the image; if the foreground and background are misclassified, it will lead to a decrease in the difference between the two classes; the pre-processed offline handwritten signature image dataset is finally obtained through this method.
3. The deep signature network based on triple attention mechanism and distribution-related attack of claim 1, wherein, The attack method related to distribution in S26 includes two steps: S26.1 Fine-tune the substitute model using cross-entropy loss and DCG loss, so that its gradient approximates the real distribution of the signature image data to be attacked; S26.2 The fine-tuned proxy model generates adversarial perturbations based on the gradient information of the approximated real data distribution.
4. The deep signature network based on triple attention mechanism and distribution-related attack of claim 1, wherein, The projected gradient descent algorithm in S30 specifically includes the following steps: S30.1 Randomly initialize an initial perturbation that meets the constraint condition and add it to the original signature image; S30.2 Within a predetermined number of iterations, repeat the following operations: Forward propagation: input the adversarial sample generated in the first step into the substitute model to calculate the cross-entropy loss and measure the deviation of the adversarial sample from the original sample; Backpropagation: take the gradient of the input through the loss function; for untargeted attacks, obtain the gradient direction that maximizes the loss; for targeted attacks, obtain the gradient direction that minimizes the loss between the adversarial sample and the target sample; Update perturbation: update the adversarial perturbation along the gradient direction; S30.3 After each perturbation update, limit the perturbation within the allowed range through the projection operation to ensure the legality of the adversarial sample; S30.4 The iteration is over, and the final adversarial sample is generated.