Data-free black box countermeasure attack method based on memory bank and neural network search

Abstract

A data-free black-box adversarial attack method based on memory bank and neural network search belongs to the field of adversarial attacks, and comprises the following steps: iteratively training a generator to generate a synthetic sample, and calculating cross entropy loss through a substitution model to update the generator; a memory bank mechanism is introduced to optimize a generator training process; taking the latest substitution model as a main director and endowing 50% of guidance weight, and taking a plurality of substitution models subjected to black box attack as auxiliary directors and sharing 50% of guidance weight; performing knowledge distillation on the substitution model; the black box target model carries out reasoning on a mixed data set containing an original synthetic sample and a newly generated adversarial sample to obtain an output label; iterative search and distillation are carried out in a specified model search space through an NNI frame to obtain a more optimized alternative model architecture. The method optimizes the generation quality of the adversarial sample, improves the success rate of the black box attack, accelerates the model convergence, improves the training efficiency, and enhances the robustness of the adversarial attack.

Description

Technical Field

[0001] This invention belongs to the field of adversarial attack technology, specifically relating to a dataless black-box adversarial attack method based on memory bank and neural network search. Background Technology

[0002] Adversarial attacks are methods that exploit vulnerabilities in models such as deep neural networks (DNNs). The core of these attacks lies in applying subtle, carefully designed perturbations—imperceptible to the human eye—to benign input samples, thereby generating malicious inputs, known as adversarial examples, to induce the model to produce incorrect or unexpected outputs. These perturbations added to the original samples are called adversarial perturbations. Given the widespread application of deep neural networks in critical fields such as autonomous driving and facial recognition, adversarial attacks have become a significant and undeniable security issue, posing a serious challenge to the robustness and reliability of models.

[0003] Based on the attacker's understanding of the target model's internal parameters, adversarial attacks can be categorized into white-box attacks and black-box attacks. White-box attacks involve the attacker having complete knowledge of the target model's structure and internal parameters; black-box attacks, on the other hand, involve the attacker only interacting with the model through its input-output interface, unable to access its internal structure and parameters. Existing adversarial attack methods targeting white-box scenarios typically achieve good performance. However, in black-box settings, especially when the target model possesses defensive mechanisms, the effectiveness of most attack methods significantly decreases. In black-box attack settings, mainstream methods primarily include query-based and transferability-based approaches. Query-based methods usually require extensive queries to the target model to approximate its gradients, making them difficult to implement effectively when the target model has query limitations or is costly. Transferability-based methods offer a more practical approach to black-box attacks. They generate highly transferable adversarial examples by training a surrogate model, thereby attacking the target model.

[0004] Furthermore, based on the generation mechanism of adversarial examples, adversarial attacks can be further divided into generative and iterative methods. In generative methods, attackers utilize generative models (such as Generative Adversarial Networks, GANs) to generate adversarial examples. As long as the distribution of benign examples remains unchanged, the effectiveness of the adversarial examples highly depends on the training method of the generator. Many existing studies have focused on training powerful generators that map the distribution of clean images to an adversarial example distribution that can generalize across different black-box models. However, training such generators often requires enormous computational resources and time costs, making them very expensive in practical applications. Iterative methods can generate adversarial perturbations for specific samples, enabling targeted attacks. Compared to generative methods, iterative methods do not require pre-investing huge resources in training generators for specific categories, thus making them more feasible in practical applications. Although such methods perform well in white-box attack scenarios, the transferability of the adversarial examples they generate is limited in black-box scenarios. To improve transferability, existing work is inspired by the model training process, such as introducing momentum terms to stabilize optimization or using Nesterov to accelerate gradient adaptation for iterative attacks. Furthermore, data augmentation methods (such as applying random transformations or mixing input images with images from other categories) have been shown to effectively improve transferability. Other methods focus on improving the transferability of adversarial examples by appropriately modifying the source model, such as utilizing skip connections or backpropagation processes.

[0005] In the context of the widespread application of deep learning, knowledge distillation (KD) has become a mainstream paradigm for model compression and knowledge transfer. Its core objective is to train a lightweight student model using a well-trained teacher model, facilitating the deployment of the student model on resource-constrained edge devices. However, traditional knowledge distillation methods typically rely on two assumptions: first, users have direct access to the teacher model's raw training data; and second, the teacher model is considered a white-box model, meaning its model parameters and structural information are fully available. But in practical applications, especially in scenarios like commercial cloud services, teacher models are usually provided by third parties, and their training data and detailed model parameters are often private and inaccessible. Furthermore, these APIs typically only return hard labels for the query samples (i.e., the highest probability class index), rather than complete logits, and each query incurs a cost, making query budget a significant consideration. To address these issues, a series of studies on knowledge distillation in data-free and black-box settings have emerged in recent years. Among them, the IDEAL method proposed by Zhang et al. in 2022 (Zhang J, Chen C, Lyu L. Ideal: Query-efficient data-free learning from black-box models[J]. arXiv preprint arXiv:2205.11158,2022.) is the closest implementation to this invention. The IDEAL method aims to train a high-performance student model in a query-efficient manner, solely through the API interface of the black-box model, without any real data. This method divides the student model training process into two main stages: the Data Generation Stage and the Model Distillation Stage. By strictly controlling the query budget, the IDEAL method aims to solve the problems of excessive query counts, high costs, and impracticality inherent in traditional black-box data-irrelevant knowledge distillation. However, despite the significant progress made by the IDEAL method in query efficiency, there is still room for improvement in the quality of its generated data and the deep structural matching between the alternative model and the target model when facing complex datasets and deeper model adaptation requirements.

[0006] Although existing black-box attack methods, represented by IDEAL, have made significant progress in addressing data privacy and model parameter inaccessibility issues, and have attempted to reduce the number of queries to black-box model APIs, they still face the following significant drawbacks in practical applications:

[0007] 1. Insufficient Quality and Diversity of Synthetic Data: Existing black-box attack methods typically rely solely on immediate loss signals for optimization during the data generation phase. This single-source or localized guidance mechanism makes it difficult for the generator to consistently and stably produce high-quality synthetic data with sufficient diversity. Especially when dealing with complex datasets, the generated samples may not adequately cover the feature space of the real data. This results in the subsequent student model struggling to effectively learn all the knowledge from the black-box teacher model during the distillation process, thus limiting the final performance of the student model.

[0008] 2. Poor architectural matching between the surrogate and target models limits the success rate of black-box attacks: Existing black-box attack methods mainly focus on making the student model approximate the target model at the data distribution level, but often ignore the differences between the surrogate and target models at the deep network architecture level. This architectural mismatch may lead to the surrogate model failing to fully capture the inherent complex features and decision boundaries of the target model even if the data distribution is similar, thus limiting the success rate of black-box attacks and the transferability of adversarial examples. During the training process of the surrogate model, because only the data-level fitting is focused on, it may overfit the current synthetic data and fail to fully generalize to the true intrinsic characteristics of the target model.

[0009] 3. Bottlenecks in Model Convergence Speed ​​and Training Efficiency: Due to the volatility of generated data quality and the lack of multi-dimensional and continuous guidance information, existing black-box attack methods may be inefficient in the training and convergence process of student models, requiring long training cycles and significant computational resources to achieve the desired performance. This not only increases R&D costs but also limits the deployment and application efficiency of methods in real-world scenarios. Summary of the Invention

[0010] To address the issues of low success rate and excessive attack overhead in existing black-box attack methods when no data is available, this invention provides a data-free black-box adversarial attack method based on memory and neural network search. This invention focuses on improving the transferability of adversarial examples to enhance the success rate of black-box attacks, offering advantages such as higher efficiency and greater robustness.

[0011] The technical solution adopted by this invention to solve the technical problem is as follows:

[0012] This invention provides a data-free black-box adversarial attack method based on memory bank and neural network search, which specifically includes the following steps:

[0013] S1: Efficient data generation stage;

[0014] The generator is trained iteratively to generate synthetic samples. Cross-entropy loss is calculated using these synthetic samples through alternative models to update the generator. A synthetic sample dataset is constructed, and a memory mechanism is introduced to optimize the generator's training process. The memory constructs a dynamic mixed guidance set by retaining the distillation results of multiple rounds of alternative models. The latest alternative model is used as the primary guide, assigned 50% of the guidance weight. Multiple alternative models that have undergone black-box attacks are used as auxiliary guides, sharing 50% of the guidance weight. The internal weights of each auxiliary guide are weighted according to their respective historical attack success rates. The final update of the generator is jointly guided by the primary and auxiliary guides.

[0015] S2: Knowledge distillation stage of alternative models;

[0016] The synthetic sample dataset obtained in step S1 is used to perform knowledge distillation on the surrogate model so that its classification ability can approximate the black-box target model as closely as possible.

[0017] S3: Neural network architecture search phase;

[0018] The black-box target model infers on a hybrid dataset containing original synthetic samples and newly generated adversarial samples to obtain its output labels. The hybrid dataset and the latest and best-performing alternative models are then connected to the NNI framework. The NNI framework iteratively searches and distills the alternative model architecture within a specified model search space to obtain a more optimized alternative model architecture.

[0019] Furthermore, the loss function of the generator is defined as:

[0020]

[0021] Where N is the batch size, C is the number of categories, and S(x) syn ) is the alternative model S for the synthetic sample x syn The predicted probability, y rand The labels are randomly generated. Let be the value of the one-hot label vector randomly assigned to the i-th synthetic sample in class c. To replace the synthetic sample with the alternative model S Predicted probability for category c.

[0022] Furthermore, in each batch, the generator undergoes multiple rounds of iterative training, and the data generated in each round is saved as part of the synthetic sample dataset.

[0023] Furthermore, the internal weights of each auxiliary instructor are weighted and allocated using softmax normalization based on their respective historical attack success rates:

[0024]

[0025] Where τ is the temperature parameter, To improve the historical attack success rate of instructor i, This is to assist instructor j in assessing the historical attack success rate.

[0026] Furthermore, the final update of the generator is jointly guided by the primary mentor and the assistant mentor, and its total loss is expressed as:

[0027]

[0028] Among them, w main =0.5, representing the guidance weight of the primary instructor; L G S is the loss function of the generator; new This is the latest alternative model; The internal weights of the assistant instructor j; This is an alternative model that has already been subjected to black-box attacks.

[0029] Furthermore, in step S2, the synthetic sample dataset is first augmented, and the augmented synthetic sample is simultaneously input into the surrogate model and the black-box target model. The black-box target model returns the corresponding label or probability through its API, while the surrogate model generates its own logical value.

[0030] Furthermore, in step S2, the difference between the output of the alternative model and the black-box target model is measured by calculating the weighted sum of the distillation loss and the counter-loss.

[0031] Furthermore, the total loss function of the alternative model is:

[0032] L S =L dis (P S ,y T )+α·L adv

[0033] Among them, L dis This represents distillation loss; P S For the prediction of alternative model S; y T α represents the output of the black-box target model T; α is the weight parameter of the adversarial loss; L adv To combat the losses;

[0034] The distillation loss is typically represented by the cross-entropy loss function, which indicates the difference between the predictions of the alternative model and the output of the black-box target model.

[0035]

[0036] Where M is the batch size and C is the number of categories. For the black-box target model T, the synthetic sample x'syn i Output for category c;

[0037] By minimizing this comprehensive loss L S The weights of the alternative model S are updated, enabling it to learn the classification decision boundaries and patterns of the black-box target model T.

[0038] Furthermore, utilizing the latest and best-performing alternative model S best For the generated synthetic sample dataset D syn Perform white-box adversarial attacks to generate a new dataset D of adversarial examples. adv The adversarial sample dataset D adv It contains newly generated adversarial examples, which are subsequently integrated into the existing synthetic sample dataset D. syn middle.

[0039] Furthermore, the optimization objective of the neural network architecture search is expressed as minimizing the neural network architecture search loss:

[0040] L NAS =ArchitectureSearchLoss(S arch D mix ,y mix )

[0041] Among them, L NAS S is the optimization objective loss function for neural network architecture search. arch D is the alternative model architecture to be searched. mix For a mixed dataset containing original synthetic samples and newly generated adversarial samples, y mix For output labels.

[0042] The beneficial effects of this invention are:

[0043] 1. Optimizing the quality and efficiency of adversarial example generation and enhancing the diversity of adversarial examples: The method proposed in this invention, based on a memory bank mechanism, constructs a more accurate, richer, and more instructive hybrid guidance set by dynamically integrating and utilizing the historical distillation results of multiple rounds of alternative models. This aims to provide more stable, rich, and accurate guidance signals for the data generation process, thereby significantly improving the quality and diversity of adversarial examples generated by the generator, and providing a better data foundation for the training of student models. Simultaneously, the application of this memory bank mechanism effectively improves the accuracy of the generator's guidance during the data generation stage, ensuring higher quality and effectiveness of the generated adversarial examples. Furthermore, to further enhance the effectiveness and transferability of synthetic examples in distillation, this invention applies corresponding enhancement processing to the synthetic images, further expanding the data space and enabling the generator to more comprehensively explore the training data distribution of the black-box target model and its potential classification space.

[0044] 2. Achieving deep network architecture approximation between the substitute model and the black-box target model, significantly improving the success rate and generalization ability of black-box attacks: This invention effectively overcomes the limitation of traditional substitute models that only approximate the black-box target model in terms of data distribution by introducing a model architecture distillation method based on Neural Architecture Search (NAS). This ensures that the substitute model is highly consistent with the black-box target model not only in terms of data distribution but also in terms of model architecture, thereby more accurately capturing the characteristics of the black-box target model and effectively improving the success rate of black-box adversarial attacks. Specifically, this invention utilizes NAS technology to deeply explore and approximate the internal architecture of the black-box target model by combining a specific dataset synthesized by the generator, after the substitute model has basically converged. By enabling the substitute model to approximate the black-box target model at the deep network architecture level, this invention can generate adversarial examples with stronger targeting and higher transferability, thereby significantly improving the attack success rate and generalization ability of adversarial examples on unknown black-box target models.

[0045] 3. Accelerate model convergence and improve training efficiency: Thanks to the hybrid guidance of multi-source and dynamic weight allocation provided by the memory mechanism, this invention can provide more stable and efficient guidance signals for the data generation process. This not only effectively shortens the training cycle of the entire black-box adversarial attack model and significantly accelerates the model convergence speed, but also reduces the computational resource consumption of model training, thereby significantly improving the overall attack efficiency and the practicality of the method.

[0046] 4. Enhanced Robustness and Practicality of Adversarial Attacks: Combining the advantages mentioned above, the adversarial examples generated by this invention not only have a high success rate but also exhibit stronger robustness against different black-box models. The approximate matching of the alternative model's architecture and the high-quality generated data make the method of this invention more practical, providing a more effective tool for research and defense against adversarial attacks in real-world scenarios. Attached Figure Description

[0047] Figure 1 The flowchart of a dataless black-box adversarial attack method based on memory bank and neural network search provided by the present invention is shown. Detailed Implementation

[0048] The present invention will be further described in detail below with reference to the accompanying drawings.

[0049] To address the shortcomings of existing dataless black-box adversarial attack methods in terms of synthetic data quality, matching degree of alternative model architecture, and training efficiency, this invention proposes an innovative dataless black-box adversarial attack method based on a memory bank mechanism and neural network architecture search.

[0050] This invention provides a data-free black-box adversarial attack method based on memory bank and neural network search. Its technical solution highly integrates three core modules: efficient data generation, alternative model knowledge distillation, and neural network architecture search. It aims to overcome the limitations of existing black-box attack methods through collaborative optimization and significantly improve the transferability of adversarial examples and the success rate of attacks.

[0051] This invention provides a data-free black-box adversarial attack method based on memory and neural network search, which mainly includes three closely linked stages: Efficient Data Generation, Substitute Model Distillation, and Neural Architecture Search. Specifically, this invention first iteratively performs the Efficient Data Generation stage and the Substitute Model Distillation stage until the substitute model tends to converge. Based on this, the Neural Architecture Search stage is finally initiated to further optimize the substitute model and improve the attack effect.

[0052] See Figure 1 As shown, the present invention provides a data-free black-box adversarial attack method based on memory bank and neural network search, the specific implementation process of which is as follows:

[0053] S1: Efficient Data Generation Stage;

[0054] like Figure 1 As shown, this stage aims to efficiently generate high-quality synthetic sample datasets without requiring extensive queries to the black-box target model. The core of this stage is the training of the generator, guided by a substitute model.

[0055] S1.1: First, in each training iteration of the generator G, batch noise is used as input to generate synthetic samples x through the generator G. syn = G(z), where z is random noise. These synthetic samples are then fed into the current alternative model S (which serves as a guiding model for judging the quality of the synthetic samples at this stage). The alternative model S calculates the cross-entropy loss (L) based on the generated synthetic samples. ce This loss is used as an optimization signal to update the parameters of the generator G.

[0056] Specifically, the loss function of the generator G is defined as:

[0057]

[0058] Where N is the batch size, C is the number of categories, and S(x) syn ) is the alternative model S for the synthetic sample x syn The predicted probability, y rand Random labels are generated. Let be the value of the one-hot label vector randomly assigned to the i-th synthetic sample in class c. To replace the synthetic sample with the alternative model S Predicted probability for category c.

[0059] S1.2: Secondly, to ensure the efficiency and quality of the data generation process, each batch undergoes multiple rounds (e.g., 10 training iterations) of generation on the generator G side, generating 256 images per round, resulting in a total of 2560 images per batch. Subsequently, the 256 images generated in the best-performing round are selected and saved as part of the synthetic sample dataset (Saved Data) to ensure data quality in the subsequent knowledge distillation stage of the alternative model.

[0060] S1.3: Furthermore, based on this, the present invention innovatively introduces a memory bank mechanism to further improve the sample generation quality of the generator G, thereby optimizing generator training and accelerating model convergence. The present invention optimizes the generator training guidance process by introducing a memory bank mechanism. This mechanism can provide more stable and accurate gradient signals, effectively stabilizing the gradient descent process of generator training, significantly accelerating the convergence speed of the entire adversarial attack model, and ultimately improving the success rate of black-box attacks. The memory bank constructs a dynamic hybrid guidance set by retaining the distillation results (or storing the model state) of the replacement model S from recent multiple rounds (e.g., the last 5 rounds).

[0061] Specifically, after a certain number of training cycles (e.g., every 5 rounds), the system evaluates the 5 newly generated alternative models S. k (k = 1, ..., 5) is the attack success rate (ASR) of the black-box target model T on the latest synthetic sample dataset (e.g., 256 synthetic images). k This is used as an indicator to measure its guidance capabilities.

[0062] S1.4: Finally, at each data generation stage, the latest alternative model S new Designated as the primary mentor and given 50% of the mentoring weight. main =0.5. Meanwhile, the memory bank stores alternative models that have undergone black-box attacks in the aforementioned five rounds. (j = 1, ..., 5) act as auxiliary instructors, sharing the remaining 50% of the instructor weights. Internal weights of the auxiliary instructors. Based on their respective historical attack success rates Perform a weighted allocation.

[0063] Specifically, softmax normalization can be used for weighted allocation:

[0064]

[0065] Where τ is the temperature parameter, Let be the historical success rate of the assistant mentor i. The final update of generator G is jointly guided by the main mentor and the assistant mentor, and its total loss can be expressed as:

[0066]

[0067] Through this guidance mechanism involving the combined action of a primary and secondary instructor with dynamically adjusted weights, this invention provides more precise and stable guidance to the generator G, effectively avoiding gradient instability issues, significantly improving the accuracy of guidance, and accelerating the convergence speed of the entire adversarial attack model. Simultaneously, the synthetic sample dataset also serves as implicit guidance, influencing the training of the generator G through a memory mechanism.

[0068] The primary key idea of ​​this invention lies in the introduction of a memory bank mechanism to optimize the generator's training guidance process and significantly improve the quality of synthetic samples. This memory bank mechanism dynamically integrates and utilizes the distillation results of recent multiple rounds of the substitution model to construct a more accurate and richer hybrid guidance set, thereby providing the generator with more stable and precise gradient signals. This method not only effectively stabilizes the gradient descent process during generator training, significantly accelerating the convergence speed of the entire adversarial attack model, but more importantly, by continuously providing higher-quality synthetic sample datasets, it significantly enhances the distillation effect of the substitution model learning knowledge from the black-box target model, thereby indirectly improving the attack performance of adversarial examples.

[0069] S2: Substitute Model Distillation Stage;

[0070] like Figure 1 As shown, the main task of this stage is to use the synthetic sample dataset obtained in the data generation stage to perform knowledge distillation on the alternative model S, so that its classification ability can be as close as possible to the black box target model T.

[0071] S2.1: First, this invention will process the generated synthetic sample dataset D. syn Perform data augmentation to generate an augmented dataset D'syn = Augment(Dsyn).

[0072] Specifically, data augmentation strategies such as random padding, random scaling and cropping, and random horizontal flipping can be applied. These data augmentation techniques help improve the diversity and generalization of synthetic data without increasing additional query costs, enabling the alternative model S to learn the robust features of the black-box target model T under different data perturbations, thereby helping to improve the transferability of adversarial examples.

[0073] S2.2: Next, the enhanced synthetic sample x'syn∈D'syn is simultaneously input into both the surrogate model S and the black-box target model T. The black-box target model T returns the corresponding label or probability y through its API. T =T(x'syn) (hard label or soft probability), while the alternative model S produces its own logistic value P. S =S(x'syn) (its output is an unnormalized prediction score vector (Logits). These Logits have different uses at different stages of this invention: in the alternative model knowledge distillation stage, they are used to compare with the output of the black-box target model to optimize the alternative model; while... Figure 1 The efficient data generation stage shown in the diagram has a core process where multiple alternative models in the memory bank output their respective Logits, and independent loss values ​​are calculated based on these Logits. Finally, these loss values ​​are aggregated and used to update the generator.

[0074] S2.3: Finally, this invention calculates the distillation loss (L... dis ) and optional adversarial loss (L adv The weighted sum of the values ​​is used to measure the difference between the output of the alternative model S and the black-box target model T.

[0075] Specifically, the total loss function of the alternative model S is defined as:

[0076] L S =L dis (P S ,y T )+α·L adv

[0077] Where α is the weighting parameter for the adversarial loss. Distillation loss L dis Cross-entropy loss is typically used to represent the prediction P of the alternative model S. S The output y of the black-box target model T T The difference between (whether hard labels or soft probability values):

[0078]

[0079] Where M is the batch size and C is the number of categories. For the black-box target model T, the synthetic sample x'syn i Output (hard label or soft probability) for category c.

[0080] By minimizing this comprehensive loss L SThe weights of the alternative model S are updated, enabling it to learn the classification decision boundaries and patterns of the black-box target model T. This process is performed once per training round and continues iteratively until the alternative model S converges.

[0081] This invention utilizes a memory bank mechanism to dynamically guide the generator in synthesizing high-quality samples. Furthermore, it incorporates data augmentation techniques. Before the synthesized data is used for distillation in the alternative model, various perturbations are applied, significantly expanding the diversity and generalization of the synthesized data without increasing query costs. This enables the alternative model to learn the robust characteristics of the black-box target model under different data perturbations, significantly enhancing the distillation effect of the alternative model learning knowledge from the black-box target model and reaching and simulating more areas of the black-box target model's decision boundary, thereby significantly improving the transferability of adversarial examples.

[0082] S3: Neural Architecture Search Stage;

[0083] This invention employs Neural Architecture Search (NAS) technology to achieve precise distillation of the black-box target model architecture. Specifically, it innovatively uses NAS to optimize the model architecture of alternative models. This method achieves effective distillation and approximation of the intrinsic model architecture of the black-box target model, ensuring that the alternative model maintains a high degree of consistency with the black-box target model at the model structure level, further enhancing the effectiveness of black-box attacks.

[0084] like Figure 1 As shown, when the alternative model S has undergone multiple rounds of iterative training and tends to converge, and its performance on the synthetic sample dataset reaches a certain level, this invention will initiate the Neural Architecture Search (NAS) phase to achieve a deeper approximation of the architecture of the black-box target model T. This phase aims to compensate for the shortcomings of only approximating the black-box target model T in terms of data distribution, so that the alternative model S can also approach the black-box target model T at the model architecture level.

[0085] S3.1: First, this stage uses the latest and best-performing alternative model, S. best and the generated synthetic sample dataset D syn As a foundation, to enable the alternative model to not only learn the correct classification behavior of the black-box target model T, but also to accurately capture its potential vulnerabilities or susceptible patterns, this invention introduces an innovative strategy at this stage: before initiating the neural network architecture search, it first utilizes the current state-of-the-art, state-of-the-art alternative model S. bestFor the generated synthetic sample dataset D syn Perform white-box adversarial attacks to generate a new dataset D of adversarial examples. adv Adversarial example dataset D adv The newly generated adversarial examples included were then integrated into the existing synthetic sample dataset, and it was expected that these newly generated adversarial examples would effectively induce the black-box target model T to misclassify.

[0086] S3.2: Next, the mixed dataset D containing the original synthetic samples and newly generated adversarial samples will be... mix =D syn ∪D adv The data is submitted to the black-box target model T for inference to obtain its output label y. mix =T(D mix The resulting dataset not only contains normal classification information, but more importantly, it carries the misclassification response information of the black-box target model T when facing adversarial examples.

[0087] S3.3: Again, the present invention will use the prepared hybrid dataset D as described above. mix And the latest, best-performing alternative model S best By integrating the NNI (Neural Network Intelligence) framework, this invention allows for a deeper exploration and optimization of the model architecture of the alternative model S. Through exploring the model architecture using data containing misclassification feedback from the black-box target model T, this invention aims to enable neural network architecture search to guide the alternative model S to learn and approximate the intrinsic structural characteristics of the more vulnerable parts of the black-box target model T, thereby achieving precise extraction of the "vulnerabilities" of the black-box target model T at the model architecture level.

[0088] Specifically, the optimization objective of neural network architecture search can be abstractly represented as minimizing the neural network architecture search loss:

[0089] L NAS =ArchitectureSearchLoss(S arch D mix ,y mix )

[0090] Among them, L NAS S is the optimization objective loss function for neural network architecture search. arch The alternative model architecture to be searched.

[0091] S3.4: Finally, by iteratively searching and distilling alternative model architectures within the specified model search space using the NNI framework, a more optimized model architecture can be obtained. After obtaining a better model, it can be further enhanced through training (i.e., repeating the alternative model knowledge distillation process in step S2 above), so that it can better adapt to the black-box target model T under the new architecture, thereby achieving a superior black-box attack effect.

[0092] Another key idea of ​​this invention is the innovative use of neural network architecture search technology to optimize the model architecture of the substitute model. This method aims to overcome the limitation of existing black-box attack methods where the substitute model and the black-box target model are only similar in data distribution. By combining a specific dataset synthesized by the generator with the substitute model, which has already converged, this invention delves into and approximates the internal architecture of the black-box target model. This allows the substitute model to maintain a high degree of consistency with the black-box target model not only in terms of training data distribution but also in terms of deep network architecture. The effective application of neural network architecture search technology enables accurate extraction of the architecture of the black-box target model, thereby significantly improving the effectiveness and success rate of black-box attacks.

[0093] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data-free black-box adversarial attack method based on memory bank and neural network search, characterized in that, Includes the following steps: S1: Efficient data generation stage; The generator is trained iteratively to generate synthetic samples. The cross-entropy loss is then calculated using the synthetic samples through an alternative model to update the generator. A synthetic sample dataset is constructed, and a memory mechanism is introduced to optimize the generator training process. The memory constructs a dynamic mixed guidance set by retaining the distillation results of multiple rounds of alternative models. The latest alternative model is used as the primary guide and given 50% of the guidance weight. Multiple alternative models that have undergone black-box attacks are used as auxiliary guides and share 50% of the guidance weight. The internal weight of each auxiliary guide is weighted according to its historical attack success rate. The final update of the generator is jointly guided by the primary guide and auxiliary guides. S2: Knowledge distillation stage of alternative models; The synthetic sample dataset obtained in step S1 is used to perform knowledge distillation on the surrogate model so that its classification ability can approximate the black-box target model as closely as possible. S3: Neural network architecture search phase; The black-box target model infers on a hybrid dataset containing original synthetic samples and newly generated adversarial samples to obtain its output labels. The hybrid dataset and the latest and best-performing alternative models are then connected to the NNI framework. The NNI framework iteratively searches and distills the alternative model architecture within a specified model search space to obtain a more optimized alternative model architecture.

2. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, The loss function of the generator is defined as: Where N is the batch size, C is the number of categories, and S(x) syn ) is the alternative model S for the synthetic sample x syn The predicted probability, y rand The labels are randomly generated. Let be the value of the one-hot label vector randomly assigned to the i-th synthetic sample in class c. To replace the synthetic sample with the alternative model S Predicted probability for category c.

3. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, In each batch, the generator undergoes multiple rounds of iterative training, and the data generated in each round is saved as part of the synthetic sample dataset.

4. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, The internal weights of each assistant instructor are weighted and allocated based on their respective historical attack success rates using softmax normalization. Where τ is the temperature parameter, To improve the historical attack success rate of Instructor i, This is to assist instructor j in assessing the historical attack success rate.

5. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, The final update of the generator is jointly guided by the primary mentor and the assistant mentor, and its total loss is expressed as: Among them, w main =0.5, representing the guidance weight of the primary instructor; L G S is the loss function of the generator; new This is the latest alternative model; The internal weights of the assistant instructor j; This is an alternative model to those that have already been subjected to black-box attacks.

6. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, In step S2, the synthetic sample dataset is first augmented. The augmented synthetic sample is then input into both the surrogate model and the black-box target model. The black-box target model returns the corresponding label or probability through its API, while the surrogate model generates its own logical value.

7. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, In step S2, the difference between the output of the alternative model and the black-box target model is measured by calculating the weighted sum of the distillation loss and the counter-loss.

8. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 7, characterized in that, The total loss function of the alternative model is: L S =L dis (P S ,y T )+α·L adv Among them, L dis This represents distillation loss; P S For the prediction of alternative model S; y T α represents the output of the black-box target model T; α is the weight parameter of the adversarial loss; L adv To combat the losses; The distillation loss is typically represented by the cross-entropy loss function, which indicates the difference between the predictions of the alternative model and the output of the black-box target model. Where M is the batch size and C is the number of categories. For the black-box target model T, the synthetic sample x ' syn i Output for category c; By minimizing this comprehensive loss L S The weights of the alternative model S are updated, enabling it to learn the classification decision boundaries and patterns of the black-box target model T.

9. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, Using the latest and best-performing alternative model S best For the generated synthetic sample dataset D syn Perform white-box adversarial attacks to generate a new dataset D of adversarial examples. adv The adversarial sample dataset D adv It contains newly generated adversarial examples, which are subsequently integrated into the existing synthetic sample dataset D. syn middle.

10. The data-free black-box adversarial attack method based on memory bank and neural network search according to claim 1, characterized in that, The optimization objective of the neural network architecture search is expressed as minimizing the neural network architecture search loss: L NAS =ArchitectureSearchLoss(S arch ,D mix ,y mix ) Among them, L NAS S is the optimization objective loss function for neural network architecture search. arch D is the alternative model architecture to be searched. mix For a mixed dataset containing original synthetic samples and newly generated adversarial samples, y mix For output labels.

Images