An adversarial sample generation method, system, device and storage medium combining intra-sample perturbation evolution and perturbation amplitude normalization

Abstract

The application discloses an adversarial sample generation method and system combining intra-sample disturbance evolution and disturbance amplitude normalization, a device and a storage medium, and belongs to the technical field of artificial intelligence security, and comprises the following steps: 1, obtaining an input image and a corresponding label and initializing each hyperparameter and a disturbance tensor; 2, in each disturbance iteration, intra-disturbance evolution is performed based on a separated copy of the current disturbance; 3, performing uniform scaling processing on the gradient obtained by the intra-disturbance evolution; 4, updating the final disturbance tensor by using the scaled gradient; 5, repeating steps 2 to 4 until a set number of disturbance iterations is reached, and generating a final adversarial sample; by introducing intra-sample disturbance evolution and external disturbance amplitude normalization, the disturbance effect and stability of the adversarial sample are effectively improved, and the application has wide application value in safety evaluation and robustness testing of an artificial intelligence model.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to a method, system, device, and storage medium for generating adversarial examples that combines in-sample perturbation evolution and perturbation amplitude normalization. Background Technology

[0002] With the widespread application of deep learning models in fields such as image classification, object detection, speech recognition, and natural language processing, their security issues have become increasingly prominent. Research shows that deep neural networks are highly sensitive to small perturbations in the input. By generating adversarial examples through carefully designed perturbations, models can be misled into making incorrect predictions, thereby affecting the stability and security of artificial intelligence systems in critical scenarios such as autonomous driving, financial risk control, and intelligent security.

[0003] To improve the robustness of deep learning models, various adversarial attack methods have been proposed in existing technologies. Among them, transfer attacks, as a black-box attack method that does not require access to the target model's structure and parameters, have become an important indicator for measuring the model's generalization robustness. Traditional attack methods such as FGSM, PGD, and MI-FGSM perform well in white-box scenarios, but their transfer performance in black-box environments still needs improvement.

[0004] In recent years, some attack strategies based on gradient enhancement and path optimization have attempted to enhance the directionality and generalization of perturbations through momentum accumulation and multi-model ensembles, but two main bottlenecks still exist:

[0005] First, existing methods often employ a uniform step size strategy during the perturbation generation process, neglecting fine-grained modeling of the perturbation trajectory of individual samples, resulting in limited perturbation evolution paths and insufficient directional changes.

[0006] Secondly, although some improved methods have strengthened the gradient utilization intensity, they have not adjusted the amplitude of the strong gradient generated by the internal trajectory during the external perturbation update stage, causing the perturbation amplitude to deviate from the original budget, thereby affecting the quality and stability of adversarial examples.

[0007] To address the aforementioned issues, there is an urgent need for an adversarial perturbation method that can dynamically adapt to the perturbation direction while also taking into account gradient magnitude control, thereby significantly improving the transferability and stability of adversarial examples while maintaining perturbation efficiency. Summary of the Invention

[0008] To address the problems mentioned in the background art, this invention proposes an adversarial example generation method, system, device, and storage medium that combines intra-sample perturbation evolution and perturbation amplitude normalization. By combining the intra-sample perturbation trajectory evolution mechanism with the external perturbation amplitude normalization strategy, the internal gradient is evolved in multiple steps and momentum is integrated. Furthermore, by uniformly scaling to control the advancement amplitude of the external perturbation, the perturbation capability and migration robustness of the adversarial examples are significantly improved.

[0009] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0010] An adversarial example generation method combining in-sample perturbation evolution and perturbation amplitude normalization includes the following steps:

[0011] Step 1: Obtain the input image and its corresponding label, and initialize the hyperparameters and perturbation tensors;

[0012] Step 2: In each round of perturbation iteration, perform internal perturbation evolution based on the separated copy of the current perturbation;

[0013] Step 3: Perform uniform scaling on the gradients obtained from the evolution of internal perturbations;

[0014] Step 4: Update the final perturbation tensor using the scaled gradient;

[0015] Step 5: Increment the t index and repeat steps 2 to 4 until the set number of perturbation iterations is reached to generate the final adversarial example.

[0016] As a preferred option, the specific implementation process in step 1 is as follows:

[0017] Initialize the original input image and their corresponding tags , obtain A set of alternative models Using the cross-entropy loss function Initialize all hyperparameters, including the perturbation norm. Disruption budget Total number of iterations Total number of inner iterations external step size Attenuation factor scaling factor .

[0018] As a preferred option, the specific implementation process in step 2 is as follows:

[0019] Step 2.1: Construct a separated copy of the perturbed image Used for internal perturbation evolution, where Let represent the initial adversarial sample in round t;

[0020] Step 2.2, in the internal iteration step In the middle, select a surrogate model f and input the current perturbation into the image. Input the model and calculate the gradient of the loss function with respect to the input;

[0021] Step 2.3: Use the momentum mechanism to weight and merge the current gradient with the previous gradient information to obtain the cumulative gradient;

[0022] Step 2.4: Use scaling factor Scale the accumulated gradient and update the perturbation;

[0023] Step 2.5: Increment the k index and repeat steps 2.2 to 2.4 until the internal perturbation evolution iteration is completed, and obtain the final evolution gradient.

[0024] Preferably, in step 2.2, the specific implementation process is as follows:

[0025] The specific formula for calculating the gradient of the loss function with respect to the input is as follows:

[0026] ,

[0027] in, This represents the gradient calculation operation; J represents the cross-entropy loss function. For model f, the input... Model output at that time; This represents the initial adversarial sample in the current round t. y represents the cumulative perturbation tensor within the first k iterations; y represents the target label.

[0028] J is the cross-entropy loss function, and its calculation formula is:

[0029] ,

[0030] Where x represents the input image, Indicates the target label, p y Let f represent the predicted probability of model f for the target label y of x, and C represent the total number of labels; This represents the logit output of model f with respect to the true class y given input x; This represents the logit output of model f for the k-th class given input x.

[0031] Preferably, in step 2.3, the specific implementation process is as follows:

[0032] The cumulative gradient obtained in the kth inner iteration The specific calculation formula is as follows:

[0033] ,

[0034] in, Indicates the attenuation factor; This represents the cumulative gradient obtained in the (k-1)th iteration; For model f, the input... The model output at that time; J represents the cross-entropy loss function, This indicates that the gradient of the cross-entropy loss function J is calculated; Indicates the target label, This represents the sum of the absolute values ​​of all elements in the vector.

[0035] As a preferred option, the specific implementation process in step 3 is as follows:

[0036] Extracting the final gradient direction of the internal evolution ,right Perform maximum magnitude normalization operation, and use it as the gradient of the outer t-th round. ;

[0037] external gradient in round t The specific calculation formula is as follows:

[0038] ,

[0039] in, This indicates the budget for disturbances. Represents the minimum stability factor. Represents the maximum absolute value in a vector; This indicates the direction of the final evolution gradient.

[0040] Preferably, in step 4, the specific implementation process is as follows:

[0041] Step 4.1: Apply momentum superposition to the scaled gradient direction using an external momentum term;

[0042] Step 4.2: Update the perturbation tensor by performing the update operation using the preset step size factor;

[0043] Step 4.3: Limit the perturbation range and image constraints.

[0044] An adversarial example generation system combining intra-sample perturbation evolution and perturbation amplitude normalization is provided to implement the adversarial example generation method combining intra-sample perturbation evolution and perturbation amplitude normalization described in any of the above items. The system includes an input and initialization module, an intra-sample perturbation evolution module, a gradient amplitude normalization module, a perturbation tensor update module, and an iteration control and result output module.

[0045] Input and initialization module: Obtain the original input image and its corresponding label, determine the set of alternative models, select the cross-entropy loss function, and complete the initialization of multiple hyperparameters and perturbation tensors;

[0046] Intrasample perturbation evolution module: Based on the initial adversarial sample of each round of external iteration, a separate copy is constructed. In the internal iteration, a surrogate model is selected to calculate the gradient of the loss function. The gradient is weighted and merged through the momentum mechanism to obtain the cumulative gradient. After scaling by the scaling factor, the perturbation is updated. The iteration is repeated until the internal evolution is completed and the final evolution gradient is obtained.

[0047] Gradient magnitude normalization module: Extracts the final evolution gradient direction obtained from the in-sample perturbation evolution, performs maximum magnitude normalization on it, and calculates the external gradient of the t-th round by combining the perturbation budget and the minimum stability factor;

[0048] Perturbation Tensor Update Module: The module uses an external momentum term to perform momentum superposition on the scaled gradient direction, updates the perturbation tensor according to a preset step size factor, clips the perturbation to within the budget, and performs pixel-by-pixel cropping on the perturbation image to ensure that it is within the legal range of the image domain.

[0049] Iteration control and result output module: Determine whether the set number of perturbation iterations has been reached. If not, return to the in-sample perturbation evolution module to repeat the process. If the set number of iterations has been reached, output the final generated adversarial example.

[0050] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the adversarial example generation method combining intra-sample perturbation evolution and perturbation amplitude normalization as described above.

[0051] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the adversarial example generation method combining intra-sample perturbation evolution and perturbation amplitude normalization as described in any of the preceding claims.

[0052] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0053] (1) This invention proposes an adversarial sample generation method that combines intra-sample perturbation evolution and perturbation amplitude normalization. In each perturbation iteration, an intra-sample perturbation evolution mechanism is introduced. Through multi-step trajectory updates and momentum fusion, the optimal path in the perturbation space is effectively mined, enhancing the expressive power and adaptability of the perturbation direction. Compared to traditional methods that rely solely on single-step gradients or fixed perturbation structures, this invention achieves stronger directional guidance capabilities and improves the efficiency and stability against perturbations by fine-grained modeling of the perturbation evolution process of individual samples.

[0054] (2) This invention introduces a unified perturbation amplitude normalization strategy in the external perturbation update stage to uniformly regulate the high-amplitude perturbations generated by internal evolution. While maintaining a controllable perturbation budget, it avoids problems such as gradient explosion or perturbation non-convergence, ensuring a balance between the usability of generated samples and the perturbation intensity. This method takes into account the evaluation effects of perturbation quality, perturbation transferability, and robustness without introducing additional model parameters. It is particularly suitable for the efficient adversarial sample generation task of deep learning models in security testing, black-box evaluation, and transfer perturbation scenarios, filling the research gap in the current adversarial perturbation methods on the integration of dynamic modeling of perturbation trajectories and amplitude regulation mechanisms. Attached Figure Description

[0055] Figure 1 This is a flowchart of the adversarial sample generation method that combines in-sample perturbation evolution and perturbation amplitude normalization according to the present invention. Detailed Implementation

[0056] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0057] like Figure 1 As shown, the adversarial example generation method combining in-sample perturbation evolution and perturbation amplitude normalization provided in this embodiment has the following specific steps:

[0058] Step 1: Obtain the input image and its corresponding label, and initialize the hyperparameters and perturbation tensors.

[0059] Initialize input image and their corresponding tags , obtain A set of alternative models Using the cross-entropy loss function Initialize the hyperparameters, including the perturbation norm. Disruption budget Total number of iterations Total number of inner iterations Step length (and satisfy ), attenuation factor scaling factor .

[0060] Step 2: In each perturbation iteration, perform in-sample perturbation evolution based on the separated copy of the current perturbation.

[0061] Step 2.1: Construct a separated copy of the perturbed image Used for internal perturbation evolution, where Let represent the initial adversarial sample in round t;

[0062] Step 2.2, in the internal iteration step In the middle, select a proxy model Input the current disturbance into the image. Input the model and calculate the gradient of the loss function with respect to the input;

[0063] The specific formula for calculating the gradient of the loss function with respect to the input is as follows:

[0064]

[0065] in, This represents the gradient calculation operation; J is the cross-entropy loss function. To represent the input for model f Model output at that time; This is the initial adversarial sample for the current round t. y represents the cumulative perturbation tensor of the first k-1 iterations; k represents the index of the current iteration number; y represents the target label.

[0066] J is the cross-entropy loss function, and its calculation formula is:

[0067]

[0068] Where x represents the input image, Indicates the target label, p y Let f represent the predicted probability of model f for the target label y of x, and C represent the total number of labels. This represents the logit output of model f with respect to the true class y given input x; This represents the logit output of model f for the k-th class given input x.

[0069] Step 2.3: Use the momentum mechanism to weight and merge the current gradient with the previous gradient information to obtain the cumulative gradient;

[0070] The cumulative gradient in the k-th iteration The specific calculation formula is as follows:

[0071]

[0072] in, Indicates the attenuation factor; This represents the cumulative gradient obtained in the (k-1)th iteration; For model f, the input... The model output at that time; J represents the cross-entropy loss function, This indicates that the gradient of the cross-entropy loss function J is calculated; Indicates the target label, This represents the sum of the absolute values ​​of all elements in the vector.

[0073] Step 2.4: Use scaling factor Scale the accumulated gradient and update the perturbation;

[0074] The updated formula is:

[0075]

[0076] in, This represents the cumulative perturbation tensor within the first k iterations; This represents the cumulative perturbation tensor within the first k-1 iterations; This indicates that the updated perturbation will be clipped to the perturbation budget. Internal satisfaction constraint. This represents the cumulative gradient obtained in the k-th iteration.

[0077] Step 2.5: Increment the k index (k=k+1), repeat steps 2.2 to 2.4 until the internal perturbation evolution iteration is completed, and obtain the final evolution gradient direction. .

[0078] In this embodiment, It is the cumulative gradient when k=K in step 2.3.

[0079] Step 3: Perform uniform scaling on the gradients obtained from the evolution of internal perturbations;

[0080] Extracting the final gradient direction of the internal evolution ,right Perform maximum magnitude normalization operation, and use it as the gradient of the outer t-th round. ;

[0081] external gradient in round t The specific calculation formula is as follows:

[0082]

[0083] in, This indicates the budget for disturbances. Indicates the minimum stability factor to prevent division by zero. This represents the maximum absolute value in the vector. This indicates the direction of the final evolution gradient.

[0084] Step 4: Update the final perturbation tensor using the scaled gradient;

[0085] Step 4.1: To further improve the consistency of the disturbance direction and the stability across the wheel, an external momentum term is used. For scaled gradients Perform momentum superposition;

[0086] The superposition formula is:

[0087]

[0088] in, This represents the external momentum term in the current round t. This represents the external momentum term of the previous round, i.e., the (t-1)th round; As the attenuation factor, This indicates that it is initialized to a zero tensor. Let be the gradient of the external t-th round, which is the gradient obtained in step 3.

[0089] Step 4.2: Update the perturbation tensor using the preset step size factor. Perform the update operation;

[0090] Specifically:

[0091]

[0092] in, This represents the total perturbation tensor of the first t wheels; Indicates according to The norm clips the perturbation to Within the limits; This represents the total perturbation tensor of the first t-1 rounds; This represents the external momentum term in the current round t. This indicates the external step size, controlling the intensity of each round of perturbation propulsion. .

[0093] Step 4.3: Limit the perturbation range and image constraints;

[0094] Apply legality constraints to the perturbed image to ensure it remains within the legal range of the image domain. Inside, specifically:

[0095]

[0096] in, This is the adversarial sample for the (t+1)th round; This indicates a pixel-by-pixel cropping operation. This represents the original input image; This represents the total perturbation tensor of the first t wheels; This represents the image after the t-th round of perturbation, i.e., the original input image. Adding the total perturbation tensor of the front T-wheel ; Represents the legal range of the image domain, is the lowest threshold, is the highest threshold. Generally, after normalizing the image pixel values, the legal range is [0, 1].

[0097] Step 5: Increment the t index (t + 1), and repeat Steps 2 to 4 until the set perturbation iteration number is reached to generate the final adversarial sample.

[0098] Within the set number of rounds T (t < T), after completing K times of Steps 2.1 to 2.4 in each round, continue to execute Steps 3 and 4 until the last round is completed to obtain which is the final adversarial sample for the input image generated.

[0099] In this embodiment, there are a total of T rounds in the outer loop. Use t to represent the outer loop index. The adversarial sample , will be obtained at the end of the current round t, that is, the sample when t + 1 = T, and this is the final sample at this time. [[ID=!]]

[0100] For example: If T = 10, a total of 10 rounds of outer loop are performed (Steps 2 to 4 will be executed in each round of outer loop), then t = 0, …, 9. The sample generated when t = 9 is , and this sample is the final sample. Therefore, Step 5 is to repeat Steps 2 to 4 until the set perturbation iteration number T is reached, and the generated sample is the final adversarial sample.

[0101] To verify the effectiveness of the proposed solution of the present invention, the following experiments are carried out.

[0102] The experimental platform of the present invention is as follows: Intel Xeon Gold 6226R CPU, 314 GiB RAM, and NVIDIA A10 GPU.

[0103] The experimental steps are as follows:

[0104] 1. Determine the initial experimental settings

[0105] The present invention evaluates the transferability of adversarial samples on the ImageNet-1K public image classification dataset. The ImageNet-1K dataset is the ILSVRC 2012 dataset, which contains 1,000 object categories.

[0106] Two models are used in the experiment: ResNet18 (18-layer residual network), Swin-T (sliding window vision Transformer - tiny) as white-box models for integrated perturbation, and the parameter settings are: ; where [[ID=!]]Represents the perturbation budget, Indicates the attenuation factor. Indicates the scaling factor. Indicates the outer step size.

[0107] This invention compares the success rates of three state-of-the-art methods (SVRE (Simplified Stochastic Variance Ensemble), SMER (Ensemble Reweighted Stochastic Mini-Batch Black Box), and AdaEA (Adaptive Ensemble)) with the proposed method on seven black box models: Inception-v3 (a third-generation deep learning model based on the Inception architecture), ConvIT-B (Convolutional Visual Transformer - Basic Version), WRN101 (Generalized Residual Network - 101 Layers), DenseNet121 (Densely Connected Network - 121 Layers), ViT-B (Visual Transformer - Basic Version), DeiT-B (Data-Efficient Visual Transformer - Basic Version), and Swin-B (Sliding Window Visual Transformer - Basic Version).

[0108] Success Rate (ASR): This is the proportion of traffic that the model correctly classifies based on the total number of categories. The higher the value, the better the performance.

[0109]

[0110] Where N represents the total number of samples; This represents the i-th adversarial example; This indicates its true label; The model represents the disturbance; This represents an exponential function, which is 1 if the condition is true, and 0 otherwise.

[0111] 2. Adversarial example generation;

[0112] The prepared dataset is input sequentially according to the combination of (original sample, corresponding label). Based on SVRE, AdaEA, SMER and the generation method proposed in this invention, small perturbations are added to the original image iteratively. After the perturbation is completed, adversarial samples are output sequentially and saved to 4 different folders according to the generation method.

[0113] 3. Disturbance and verification;

[0114] Perturbation: The four sets of different adversarial examples are saved and input into seven black-box models: Inception-v3, ConvIT-B, WRN101, DenseNet121, ViT-B, Deit-B, and Swin-B for classification.

[0115] Validation: Calculate and output the success rate of each set of adversarial examples against the 7 models.

[0116] 4. Analysis of experimental results;

[0117] Success rate data of this method and three selected comparison methods were collected and analyzed on seven black-box models. The table below shows the success rate comparison of different perturbation methods on different models on the ImageNet-1K dataset, with the best value indicated in bold.

[0118] Table 1. Success rates of different perturbation methods for different models on the ImageNet-1K dataset.

[0119]

[0120] Experimental Results Analysis: The experimental results show that the adversarial example generation method proposed in this invention achieves a higher transfer success rate than the three comparative methods. Specifically, the success rate of this invention is on average 3% to 10% higher, and even higher on some models. For example, for the DeiT-B model, the success rate of this invention reaches 50.7%, far exceeding the success rate of the comparative methods; for the Swin-B model, the success rate of this invention reaches 80.5%, also significantly higher than the comparative methods. The transferability of adversarial examples is further improved. These data fully demonstrate that the method proposed in this invention has achieved a significant breakthrough in the transferability of adversarial examples, capable of generating more universal adversarial examples that are easier to transfer between different models. This is of great significance for improving the efficiency and effectiveness of adversarial perturbations, and also provides a more challenging benchmark for subsequent research on adversarial defense, thereby promoting further development in this field.

[0121] Based on the above method, this application provides an adversarial example generation system that combines in-sample perturbation evolution and perturbation amplitude normalization. The system includes an input and initialization module, an in-sample perturbation evolution module, a gradient amplitude normalization module, a perturbation tensor update module, and an iterative control and result output module.

[0122] Input and initialization module: This module is responsible for acquiring the original input image to be processed and its corresponding labels, determining the set of alternative models used to assist in the generation of adversarial examples, selecting the cross-entropy loss function, and setting key hyperparameters such as perturbation norm, perturbation budget, number of internal and external iterations, as well as the initial perturbation tensor, to provide basic data and parameter support for subsequent adversarial example generation.

[0123] Intra-sample perturbation evolution module: Based on the initial adversarial sample of each external iteration, a separate copy is constructed. During the internal iteration process, the module performs operations such as selecting a surrogate model to calculate the loss gradient, using momentum mechanism to fuse gradient information, and scaling gradient to update perturbations. This enables fine-grained evolution of the sample perturbation trajectory, uncovers better perturbation directions, and enhances perturbation adaptability.

[0124] Gradient magnitude normalization module: Processes the final gradient direction obtained from the in-sample perturbation evolution, calculates the external gradient of round t by normalizing the maximum magnitude and combining the perturbation budget and the minimum stability factor; and controls the gradient magnitude within a reasonable range to avoid gradient explosion or perturbation deviating from the budget, thus ensuring the stability of subsequent perturbation updates.

[0125] The perturbation tensor update module introduces an external momentum term to optimize gradient direction consistency, updates the perturbation tensor with a preset step size, and controls the perturbation within the budget through norm clipping. It also performs pixel-by-pixel legal range constraints on the perturbed image to ensure that the generated intermediate adversarial examples meet the image domain requirements and maintain the usability of the samples.

[0126] The iteration control and result output module is responsible for monitoring the number of external iterations. If the set number of iterations has not been reached, it drives the system to repeatedly execute processes such as internal perturbation evolution, gradient normalization, and perturbation update. When the iteration is completed, it outputs the final generated adversarial sample, thus completing the entire adversarial sample generation task.

[0127] In this embodiment of the application, an electronic device is also provided, including: at least one processor; and a memory communicatively connected to the at least one processor, the memory storing a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform any of the above-described adversarial example generation methods combining intra-sample perturbation evolution and perturbation amplitude normalization.

[0128] In practical applications, a processor may include one or more processing cores. The processor executes or runs computer instructions, computer programs, code sets, or instruction sets stored in memory, calls data stored in memory, and performs various functions and processes data as described in this application. The processor may be at least one of a specific application integrated circuit, digital signal processor, digital signal processing device, programmable logic device, field-programmable gate array, central processing unit, controller, microcontroller, and microprocessor. Understandably, for different devices, the electronic devices used to implement the above-described processor functions may also be other types. The memory may be used to store computer instructions, computer programs, code sets, or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and programs for implementing adversarial example generation methods combining intra-sample perturbation evolution and perturbation amplitude normalization; the data storage area may store data involved in the adversarial example generation methods combining intra-sample perturbation evolution and perturbation amplitude normalization.

[0129] In the embodiments of this application, a computer-readable storage medium is also provided for storing a computer program for causing a computer to execute any of the above-described adversarial example generation methods combining intra-sample perturbation evolution and perturbation amplitude normalization.

[0130] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for generating adversarial examples that combines in-sample perturbation evolution and perturbation amplitude normalization, characterized in that, Includes the following steps: Step 1: Obtain the input image and its corresponding label, and initialize the hyperparameters and perturbation tensors; Step 2: In each perturbation iteration, perform internal perturbation evolution based on the separated replicas of the current perturbation. The sub-steps of Step 2 are as follows: Step 2.1: Construct a separated copy of the perturbed image Used for internal perturbation evolution, where Let represent the initial adversarial sample in round t; Step 2.2, in the internal iteration step In the middle, select a surrogate model f and input the current perturbation into the image. Input the model and calculate the gradient of the loss function with respect to the input; Step 2.3: Use the momentum mechanism to weight and merge the current gradient with the previous gradient information to obtain the cumulative gradient; Step 2.4: Use scaling factor Scale the accumulated gradient and update the perturbation; Step 2.5: Increment the k index and repeat steps 2.2 to 2.4 until the internal perturbation evolution iteration is completed, and obtain the final evolution gradient; Step 3: Perform uniform scaling on the gradients obtained from the evolution of internal perturbations. The specific content of step 3 is as follows: Extracting the final gradient direction of the internal evolution ,right Perform maximum magnitude normalization operation, and use it as the gradient of the outer t-th round. ; external gradient in round t The specific calculation formula is as follows: ， in, This indicates the budget for disturbances. Represents the minimum stability factor. Represents the maximum absolute value in a vector; Indicates the direction of the final evolution gradient; Step 4: Update the final perturbation tensor using the scaled gradient; Step 5: Increment the t index and repeat steps 2 to 4 until the set number of perturbation iterations is reached to generate the final adversarial example.

2. The adversarial sample generation method combining in-sample perturbation evolution and perturbation amplitude normalization according to claim 1, characterized in that, The specific implementation process in step 1 is as follows: Initialize the original input image and their corresponding tags , obtain A set of alternative models Using the cross-entropy loss function Initialize all hyperparameters, including the perturbation norm. Disruption budget Total number of iterations Total number of inner iterations external step size Attenuation factor scaling factor .

3. The adversarial sample generation method combining in-sample perturbation evolution and perturbation amplitude normalization according to claim 1, characterized in that, In step 2.2, the specific implementation process is as follows: The specific formula for calculating the gradient of the loss function with respect to the input is as follows: ， in, This represents the gradient calculation operation; J represents the cross-entropy loss function. For model f, the input... Model output at that time; This represents the initial adversarial sample in the current round t. y represents the cumulative perturbation tensor within the first k iterations; y represents the target label. J is the cross-entropy loss function, and its calculation formula is: ， Where x represents the input image, Indicates the target label, p y Let f represent the predicted probability of model f for the target label y of x, and C represent the total number of labels; This represents the logit output of model f with respect to the true class y given input x; This represents the logit output of model f for the k-th class given input x.

4. The adversarial sample generation method combining in-sample perturbation evolution and perturbation amplitude normalization according to claim 1, characterized in that, In step 2.3, the specific implementation process is as follows: The cumulative gradient obtained in the kth inner iteration The specific calculation formula is as follows: ， in, Indicates the attenuation factor; This represents the cumulative gradient obtained in the (k-1)th iteration; For model f, the input... The model output at that time; J represents the cross-entropy loss function, This indicates that the gradient of the cross-entropy loss function J is calculated; Indicates the target label, This represents the sum of the absolute values ​​of all elements in the vector.

5. The adversarial sample generation method combining in-sample perturbation evolution and perturbation amplitude normalization according to claim 1, characterized in that, In step 4, the specific implementation process is as follows: Step 4.1: Apply momentum superposition to the scaled gradient direction using an external momentum term; Step 4.2: Update the perturbation tensor by performing the update operation using the preset step size factor; Step 4.3: Limit the perturbation range and image constraints.

6. An adversarial example generation system combining intra-sample perturbation evolution and perturbation amplitude normalization, implementing the adversarial example generation method combining intra-sample perturbation evolution and perturbation amplitude normalization as described in any one of claims 1 to 5, characterized in that: The system includes an input and initialization module, an intra-sample perturbation evolution module, a gradient magnitude normalization module, a perturbation tensor update module, and an iterative control and result output module. Input and initialization module: Obtain the original input image and its corresponding label, determine the set of alternative models, select the cross-entropy loss function, and complete the initialization of multiple hyperparameters and perturbation tensors; Intrasample perturbation evolution module: Based on the initial adversarial sample of each round of external iteration, a separate copy is constructed. In the internal iteration, a surrogate model is selected to calculate the gradient of the loss function. The gradient is weighted and merged through the momentum mechanism to obtain the cumulative gradient. After scaling by the scaling factor, the perturbation is updated. The iteration is repeated until the internal evolution is completed and the final evolution gradient is obtained. Gradient magnitude normalization module: Extracts the final evolution gradient direction obtained from the in-sample perturbation evolution, performs maximum magnitude normalization on it, and calculates the external gradient of the t-th round by combining the perturbation budget and the minimum stability factor; Perturbation Tensor Update Module: The module uses an external momentum term to perform momentum superposition on the scaled gradient direction, updates the perturbation tensor according to a preset step size factor, clips the perturbation to within the budget, and performs pixel-by-pixel cropping on the perturbation image to ensure that it is within the legal range of the image domain. Iteration control and result output module: Determine whether the set number of perturbation iterations has been reached. If not, return to the in-sample perturbation evolution module to repeat the process. If the set number of iterations has been reached, output the final generated adversarial example.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the adversarial sample generation method that combines intra-sample perturbation evolution and perturbation amplitude normalization as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the adversarial sample generation method that combines intra-sample perturbation evolution and perturbation amplitude normalization as described in any one of claims 1 to 5.

Images