A high-frequency feature guidance-based generative adversarial sample generation method

Abstract

The application provides a generative adversarial sample generation method based on high-frequency feature guidance. The method comprises the following steps: obtaining an original image sample and a corresponding true category index, processing the original image sample, and extracting a high-frequency feature component of the original image sample; splicing the original image sample and the corresponding high-frequency feature component in the channel dimension to obtain multi-channel fusion data; inputting the multi-channel fusion data into a generative adversarial network model, wherein the model comprises a generator and a discriminator; the generator is used for generating an adversarial sample; the discriminator is used for generating category output values of the original image sample and the adversarial sample, and mapping a difference between the category output values of the original image sample and the adversarial sample into a category probability distribution; based on the category probability distribution and the true category index of the original image sample, a relative cross-entropy loss function is obtained; by maximizing the relative cross-entropy loss function, the network parameters of the generator are updated by using back propagation, so that an optimized generator is obtained.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security technology, specifically to a generative adversarial sample generation method, system, device, and storage medium based on high-frequency feature guidance. Background Technology

[0002] With the rapid development of artificial intelligence (AI) technology, deep learning, in particular, has achieved remarkable success in tasks such as image recognition, speech recognition, and natural language processing. Despite these breakthroughs, the inherent vulnerabilities of deep learning models pose serious security risks to image recognition tasks. Researchers have discovered that adding minute, visually imperceptible perturbations to the input images of deep learning models can lead to incorrect recognition results; this phenomenon is known as adversarial attacks, and the resulting novel image data is called adversarial examples.

[0003] However, existing methods are mainly divided into two categories: white-box attacks and black-box attacks. In white-box attacks, the attacker knows all the details of the target model, including its structure and parameters. Black-box attacks, due to the inability to obtain the internal structure and parameter information of the target model, still face significant technical bottlenecks in practical applications. Specifically, this manifests as weak cross-model transferability of adversarial examples and low attack effectiveness. Research shows that deep learning models are significantly sensitive to high-frequency features. Traditional methods are mostly based on pixel-level perturbation optimization, failing to fully explore the influence of high-frequency image components (such as edges and textures) on model decisions. Existing methods lack effective mechanisms to guide high-frequency feature learning, resulting in perturbations that lack specificity in frequency domain distribution, thus limiting attack effectiveness. For example, gradient-based iterative methods (such as Fast Gradient Descent (FGSM) and Gradient Projection (PGD)) only focus on global errors and do not establish the correlation between high-frequency features and perturbation generation, making it difficult to generate highly penetrating adversarial examples.

[0004] Therefore, it is important to study how to develop an adversarial example generation method to address the problems of insufficient utilization of high-frequency features and weak generalization of loss functions in existing adversarial attack methods. Summary of the Invention

[0005] This application provides a generative adversarial sample generation method, system, device, and storage medium based on high-frequency feature guidance to solve the problems of insufficient utilization of high-frequency features and weak generalization of loss functions in existing adversarial attack methods.

[0006] To achieve the above objectives, this application adopts the following technical solution:

[0007] In a first aspect, this application provides a generative adversarial sample generation method based on high-frequency features. The method includes: S1, obtaining the original image sample and the true class index of the original image sample, performing high-pass filtering on the original image sample, and extracting the high-frequency feature components of the original image sample.

[0008] S2. The high-frequency feature components of the original image samples are concatenated along the channel dimension to obtain multi-channel fused data.

[0009] S3. Input the multi-channel fused data into the generative adversarial network model, wherein the generative adversarial network model includes a generator and a discriminator;

[0010] The generator is used to generate adversarial examples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial examples is limited to a preset threshold.

[0011] The discriminator is used to generate class output values ​​for the original image samples and adversarial samples, and the Softmax function is used to map the difference between the class output values ​​of the original image samples and adversarial samples to a class probability distribution. Based on the class probability distribution and the true class index of the original image samples, the relative cross-entropy loss function is obtained.

[0012] S4. Update the generator's network parameters using backpropagation by maximizing the relative cross-entropy loss function;

[0013] S5. Repeat steps S3-S4 until the preset number of iterations is reached to obtain the optimized generator.

[0014] Secondly, this application provides a generative adversarial example generation system based on high-frequency feature guidance, the system comprising:

[0015] The acquisition module and the processing module are used to acquire the original image samples and the true class index of the original image samples, perform high-pass filtering on the original image samples, and extract the high-frequency feature components of the original image samples.

[0016] The stitching module is used to stitch together the original image samples and their high-frequency feature components along the channel dimension to obtain multi-channel fused data.

[0017] The Generative Adversarial Network (GAN) model module is used to input multi-channel fused data into the GAN model, which includes a generator and a discriminator.

[0018] The generator is used to generate adversarial examples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial examples is limited to a preset threshold.

[0019] The discriminator is used to generate class output values ​​for the original image samples and adversarial samples, and the Softmax function is used to map the difference between the class output values ​​of the original image samples and adversarial samples to a class probability distribution. Based on the class probability distribution and the true class index of the original image samples, the relative cross-entropy loss function is obtained.

[0020] The optimization module is used to update the generator's network parameters using backpropagation by maximizing the relative cross-entropy loss function.

[0021] Thirdly, a generative adversarial example generation apparatus based on high-frequency features is provided, the generative adversarial example generation apparatus based on high-frequency features includes a module for performing the method of the first aspect described above.

[0022] In one possible design, the high-frequency feature-guided generative adversarial example generation device of the third aspect may further include a transceiver. This transceiver can be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the high-frequency feature-guided generative adversarial example generation device of the third aspect and other devices.

[0023] In one possible design, the high-frequency feature-guided generative adversarial example generation apparatus of the third aspect may further include a memory. This memory may be integrated with the processor or disposed separately. The memory may be used to store instructions related to the method of the first aspect.

[0024] Fourthly, a generative adversarial example generation apparatus based on high-frequency feature guidance is provided. The high-frequency feature-guided generative adversarial example generation apparatus includes: a processor coupled to a memory, the processor executing instructions stored in the memory to cause the high-frequency feature-guided generative adversarial example generation apparatus to perform the method of the first aspect.

[0025] In one possible design, the high-frequency feature-guided generative adversarial example generation apparatus of the fourth aspect may further include a transceiver. This transceiver can be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the high-frequency feature-guided generative adversarial example generation apparatus of the fourth aspect and other devices.

[0026] Fifthly, a generative adversarial example generation apparatus based on high-frequency feature guidance is provided, comprising: a processor and a memory; the memory is used to store instructions, which, when executed by the processor, cause the generative adversarial example generation apparatus based on high-frequency feature guidance to perform the method of the first aspect.

[0027] In one possible design, the high-frequency feature-guided generative adversarial example generation apparatus of the fifth aspect may further include a transceiver. This transceiver can be a transceiver circuit or an interface circuit. The transceiver can be used for communication between the high-frequency feature-guided generative adversarial example generation apparatus of the fifth aspect and other devices.

[0028] In a sixth aspect, a computer-readable storage medium is provided, the computer-readable storage medium including a computer program or instructions that, when the computer program or instructions are run, cause the generative adversarial example generation method of the first aspect based on high-frequency features to be executed.

[0029] In this embodiment, high-frequency feature components (such as edges and textures) of the image are extracted using high-pass filtering and concatenated with the original image sample in the channel dimension to form multi-channel fused data. This achieves a dynamic association between high-frequency features and spatial semantics, guiding the generator to focus on the model's sensitive regions. Simultaneously, based on the relative cross-loss function, the difference between the adversarial sample and the original image sample's output values ​​on the discriminator is calculated. The Sofmax function is used to map this difference to a probability distribution, optimizing the generator to maximize the distance between this probability distribution and the true label distribution. This forces the generator to learn the essential feature shift patterns rather than local decision boundaries, mitigating the overfitting problem caused by the traditional cross-entropy loss method's over-reliance on training data.

[0030] Other features and advantages of this application will be described in detail in the following detailed description section. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A flowchart illustrating the generative adversarial example generation method based on high-frequency features provided in this application embodiment;

[0033] Figure 2 This application provides a schematic diagram illustrating the generation of unconstrained perturbation adversarial samples and constrained perturbation adversarial samples using different classification discriminators and subsequent generators.

[0034] Figure 3 A schematic diagram of the structure of the generative adversarial example generation device based on high-frequency feature guidance provided in the embodiments of this application. Figure 1 ;

[0035] Figure 4A schematic diagram of the structure of the generative adversarial example generation device based on high-frequency feature guidance provided in the embodiments of this application. Figure 2 . Detailed Implementation

[0036] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. At the same time, in the description of the embodiments of this application, the terms "first," "second," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0037] Figure 1 This is a flowchart illustrating the generative adversarial example generation method based on high-frequency features provided in this application embodiment.

[0038] The process of this generative adversarial example generation method based on high-frequency features is as follows:

[0039] Step S1: Obtain the original image sample and the true class index of the original image sample, perform high-pass filtering on the original image sample, and extract the high-frequency feature components of the original image sample.

[0040] The true class index of the original image sample can be understood as the position index of the actual class corresponding to the image in the class set. That is, if there is a class set C = {c1, c2, c3, ..., cn}, and the original image sample belongs to the second class c2 in the class set, then the true class index of the original image sample is {0, 1, 0, ..., 0}. For specific applications, please refer to the following description, which will not be elaborated here.

[0041] High-pass filtering of the original image samples to extract high-frequency feature components can be understood as performing spatial domain convolution operations on the original image samples using a preset high-pass convolution kernel to extract high-frequency feature components. The extraction expression is as follows:

[0042] H(x, y) = I(x, y) * K hp

[0043] Where H(x,y) represents the high-frequency feature components of the original image sample, I(x,y) represents the original image sample, (x,y) represents the pixel position in the original image sample, and Khp This indicates a preset high-pass convolution kernel, and * indicates a convolution operation.

[0044] For example, for the input raw image sample I(x, y) ∈ R H×W×3 Spatial domain high-pass filtering is performed on the height (H), width (W), and RGB three channels. Specifically, a preset Laplacian convolution kernel K is used. hp Perform a two-dimensional convolution operation on the original image to extract the high-frequency feature components H(x, y) ∈ R. H×W×3 .

[0045] The Laplacian convolution kernel is specifically expressed as follows:

[0046] The convolution operation is specifically expressed as: Where (x, y) represents the pixel position, and c∈{R, G, B} represents the channel index.

[0047] This operation significantly enhances rapidly changing areas in the image (such as edges, textures, and other high-frequency details) while suppressing low-frequency background information.

[0048] Step S2: The original image sample and its high-frequency feature components are concatenated along the channel dimension to obtain multi-channel fused data.

[0049] In other words, the RGB three-channel data of the original image sample and the three-channel data of the high-frequency feature components of the original image sample are concatenated along the channel dimension to obtain multi-channel fused data. The RGB three-channel data of the original image sample contains the color information of the original image sample, and the three-channel data of the high-frequency feature components of the original image sample contains the detailed features of the original image sample.

[0050] For example, the 3-channel data of the original image I(x,y) and the 3-channel data of the high-frequency component H(x,y) are concatenated along the channel dimension to form a 6-channel fused input matrix, the expression of which is X. fuse =Concat(I, H)∈R H×W×6 .

[0051] It is understandable that step S2 above extracts high-frequency components from image data through Laplacian convolution kernels, which can accurately capture local detail features (such as object edges and texture change regions) that the model decision depends on. The multi-channel fusion mechanism enables the network to adaptively learn the correlation between high-frequency features and original image samples, thereby guiding the subsequent generator to focus on the sensitive areas of the model and enhancing the targeted attack capability and cross-model transferability of adversarial examples.

[0052] It should also be noted that, after step S2 and before step S3, the method further includes:

[0053] The multi-channel fused data is spatially augmented to obtain the processed multi-channel fused data. Correspondingly, step S3, which inputs the multi-channel fused data into the generative adversarial network model, is replaced by inputting the processed multi-channel fused data into the generative adversarial network model. The data augmentation process includes size normalization, center cropping, random horizontal flipping, and random rotation. For example, the image size is linearly interpolated and scaled to 225×225 for size normalization, a 224×224 pixel region is cropped from the center of the scaled image for center cropping, a random horizontal flipping operation is performed with a probability p=0.5, a random rotation operation is performed within the range of [-15°, +15°], the augmented image is converted into a floating-point tensor, and normalized to the range of [0, 1].

[0054] In the following steps, only the input of multi-channel fused data into the generative adversarial network model is described. The specific method of inputting the processed multi-channel fused data into the generative adversarial network model is the same and can be referred to for understanding, so it will not be repeated here.

[0055] Step S3: Input the multi-channel fused data into the generative adversarial network model, wherein the generative adversarial network model includes a generator and a discriminator.

[0056] The generator is used to generate adversarial examples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial examples is limited to a preset threshold.

[0057] It can be understood that, within a preset threshold, adversarial examples are generated through generator mapping. The expression for generating adversarial examples with high-frequency sensitive characteristics is as follows:

[0058]

[0059] Where x′ represents the adversarial sample, and x represents the original image sample. This represents the generator's processing of the original image samples, where ∈ is a preset threshold, and clip() represents a clipping function used to constrain the pixel values ​​of adversarial examples to the range of 0 to 1. Constraining pixel values ​​to the range of 0 to 1 through the clipping function ensures the normalization of image pixel values.

[0060] In addition, the preset threshold is to control the perturbation amplitude of the generated adversarial examples. The specific threshold should be set according to the actual situation and is not limited here.

[0061] Furthermore, the generator employs a residual structure design, consisting of cascaded residual modules. Each residual module comprises a 1×1 convolutional layer, a 3×3 convolutional layer, and a skip connection branch. The input multi-channel fused data undergoes channel dimension compression and expansion through a 1×1 convolutional layer, spatial features are extracted through a 3×3 convolutional layer, and skip connections are introduced to add the multi-channel fused data to the convolutional output to form residual connections. This effectively alleviates problems such as gradient vanishing during training and also facilitates dynamic updates of the generator's weight parameters through backpropagation in subsequent steps.

[0062] The discriminator generates class output values ​​for the original image samples and adversarial samples, and uses the Softmax function to map the difference between the class output values ​​of the original image samples and adversarial samples into a class probability distribution. Based on the class probability distribution and the true class index of the original image samples, the relative cross-entropy loss function is obtained.

[0063] Specifically, this can be understood as:

[0064] The discriminator generates class output values ​​for the original image samples and adversarial samples, and calculates the difference between the class output values ​​of the original image samples and adversarial samples. The expression for the difference value is:

[0065] ΔD ψ =D ψ (x′)-D ψ (x),

[0066] Where, ΔD ψ This represents the difference between the category output values ​​of the original image sample and the adversarial sample. These represent the class output values ​​of the adversarial sample and the original image sample, respectively.

[0067] For example, suppose the original image sample is a picture of a cat. The discriminator's class output value for the original image sample is [0.7, 0.3], indicating a 70% probability that it is a cat and a 30% probability that it is a dog. For the adversarial example discriminator, the class output value is [0.3, 0.7]. In this case, ΔD... ψ The range is [-0.4, 0.4].

[0068] The Softmax function is used to map the difference between the class output values ​​of the original image samples and the adversarial samples to a class probability distribution. The expression for the class probability distribution is as follows:

[0069]

[0070] Where k represents the target category index, n represents the total number of categories, h represents the index of the n categories traversed in the summation symbol, σ() represents the Softmax function, and σ(ΔD) ψ ,k) represents the relative probability of the k-th target category index.

[0071] For example, in this application, the total number of categories is 2. When k=1, the general category of cat is calculated; when k=2, the general category of dog is calculated.

[0072] Based on the class probability distribution and the true class index of the original image samples, the relative cross-entropy loss function is obtained. The expression for the relative cross-entropy loss function is as follows:

[0073]

[0074] Where k represents the target category index, n represents the total number of categories, and Q(k) takes the value 1 or 0. Q(k) is 1 when the k-th target category index matches the true category index of the original image sample; otherwise, Q(k) is 0. σ(ΔD) ψ ,k) represents the relative probability of the k-th target category index.

[0075] In this application, L rce It can also be represented by the function CrossEntropy(), but the actual meaning is the same. For details, please refer to the existing technology for understanding, and I will not go into details here.

[0076] In addition, the above discriminator parameters It is fixed and does not participate in gradient updates; it is used only as a classifier.

[0077] Step S4: Update the generator's network parameters using backpropagation by maximizing the relative cross-entropy loss function.

[0078] That is, by maximizing the relative cross-entropy loss function, the generator's network parameters are updated using backpropagation, as expressed in the following expression:

[0079]

[0080] in, Function representation L rce The mathematical calculation process of the generator's weight parameters when the maximum value is obtained, θ * L represents rce The generator's weight parameters when the maximum value is obtained.

[0081] Step S5: Repeat steps S3-S4 until the preset number of iterations is reached to obtain the optimized generator.

[0082] The preset number of iterations can be determined according to the actual situation and is not limited.

[0083] It should also be noted that the discriminators mentioned above can be Inception-v3, VGG19, and ResNet18, respectively. The discriminators require image preprocessing during processing. The subsequent parameter updates to the generator may differ slightly depending on the classification discriminator used; the choice should be made based on the specific circumstances. Figure 2 As shown, this diagram illustrates the generation of unconstrained perturbation adversarial samples and constrained perturbation adversarial samples using different classifiers and discriminators.

[0084] For example, this application obtains a total of 1000 categories and 100,000 images. The generator optimization stage uses the Adam optimizer, with an initial step size set to 0.0002, and the exponential decay rates of the first and second moments set to 0.5 and 0.999, respectively, and 50 iterations.

[0085] This application trains the generator on proxy models using Inception-v3, ResNet18, and VGG19 as discriminators, and generates adversarial examples for any image on the trained generator. The generated adversarial examples are then used to conduct attack experiments on pre-trained models such as Inception-v3 (Incv3), VGG19, ResNet18, ResNet152, Densenet201 (Dense201), and Squeezenet (Sqz).

[0086] Table 1 shows the attack success rate (%) of generators trained with different proxy models generating adversarial examples, and Table 2 shows the fooling success rate (%) of generators trained with different proxy models generating adversarial examples.

[0087]

[0088] Table 1

[0089]

[0090] Table 2

[0091] Experiments show that adversarial examples generated using Incv3 and ResNet18 as surrogate models generally have better cross-model transferability than those generated using VGG19 as a surrogate model. The choice can be made based on the actual situation.

[0092] In summary, in this embodiment, high-frequency feature components (such as edges and textures) of the image are extracted using high-pass filtering and concatenated with the original image sample in the channel dimension to form multi-channel fused data. This achieves a dynamic association between high-frequency features and spatial semantics, guiding the generator to focus on the model's sensitive regions. Simultaneously, based on the relative cross-loss function, the difference between the adversarial sample and the original image sample's output values ​​on the discriminator is calculated. The Sofmax function is used to map this difference to a probability distribution, optimizing the generator to maximize the distance between this probability distribution and the true label distribution. This forces the generator to learn the essential feature shift patterns rather than local decision boundaries, mitigating the overfitting problem caused by the traditional cross-entropy loss method's over-reliance on training data.

[0093] The above combination Figures 1-2 This application provides a detailed description of the generative adversarial example generation method based on high-frequency features, which is used to implement the generative adversarial example generation system based on high-frequency features provided in this application.

[0094] The system specifically includes: an acquisition module, a processing module, a splicing module, a generative adversarial network model module, and an optimization module, as shown below.

[0095] The acquisition module and the processing module are used to acquire the original image samples and the true class index of the original image samples, perform high-pass filtering on the original image samples, and extract the high-frequency feature components of the original image samples.

[0096] The stitching module is used to stitch together the original image samples and their high-frequency feature components along the channel dimension to obtain multi-channel fused data.

[0097] The Generative Adversarial Network (GAN) model module is used to input multi-channel fused data into the GAN model, which includes a generator and a discriminator.

[0098] The generator is used to generate adversarial examples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial examples is limited to a preset threshold.

[0099] The discriminator is used to generate class output values ​​for the original image samples and adversarial samples, and the Softmax function is used to map the difference between the class output values ​​of the original image samples and adversarial samples to a class probability distribution. Based on the class probability distribution and the true class index of the original image samples, the relative cross-entropy loss function is obtained.

[0100] The optimization module is used to update the generator's network parameters using backpropagation by maximizing the relative cross-entropy loss function.

[0101] Furthermore, the specific implementation of the above system is basically similar to the method implementation, so the description is relatively simple. For relevant details, please refer to the description of the method implementation. Moreover, it should be noted that in the various modules of the system of this application, the components are logically divided according to the functions they are to perform. However, this application is not limited to this and can re-divide or combine the components as needed.

[0102] The above describes the generative adversarial example generation method and system based on high-frequency feature guidance provided in the embodiments of this application. The following, in conjunction with... Figures 3-4 This document describes in detail the generative adversarial sample generation apparatus based on high-frequency features provided in the embodiments of this application.

[0103] Figure 3 This is a schematic diagram of the structure of the generative adversarial example generation device based on high-frequency feature guidance provided in the embodiments of this application. Figure 1 For example, such as Figure 3 As shown, the generative adversarial example generation device 300 based on high-frequency feature guidance includes: a transceiver module 301 and a processing module 302. For ease of explanation, Figure 3 Only the main components of this generative adversarial sample generation device guided by high-frequency features are shown.

[0104] The transceiver module 301 is used to perform the transceiver function of the above-mentioned generative adversarial example generation method based on high-frequency features, and the processing module 302 is used to perform other functions of the above-mentioned generative adversarial example generation method based on high-frequency features, excluding the transceiver function.

[0105] Optionally, the transceiver module 301 may include a sending module ( Figure 3 (not shown in the image) and receiving module ( Figure 3 (Not shown in the image). The transmitting module is used to implement the transmitting function of the generative adversarial sample generation device 300 guided by high-frequency features, and the receiving module is used to implement the receiving function of the generative adversarial sample generation device 300 guided by high-frequency features.

[0106] Optionally, the generative adversarial example generation device 300 based on high-frequency features may also include a storage module. Figure 3 (Not shown in the image), the storage module stores programs or instructions. When the processing module 302 executes the program or instructions, the generative adversarial sample generation device 300 based on high-frequency features can execute the generative adversarial sample generation method based on high-frequency features in the embodiments of this application.

[0107] The following is combined with Figure 4Each component of the generative adversarial example generation device 400 guided by high-frequency features will be described in detail:

[0108] The processor 401 is the control center of the generative adversarial sample generation device 400 guided by high-frequency features. It can be a single processor or a collective term for multiple processing elements. For example, the processor 401 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0109] Optionally, the processor 401 can execute various functions of the high-frequency feature-guided generative adversarial sample generation device 400 by running or executing software programs stored in the memory 402 and calling data stored in the memory 402, such as executing the high-frequency feature-guided generative adversarial sample generation method in the embodiments of this application.

[0110] In a specific implementation, as one example, processor 401 may include one or more CPUs, for example... Figure 4 CPU0 and CPU1 are shown in the diagram.

[0111] In a specific implementation, as one example, the generative adversarial example generation device 400 based on high-frequency feature guidance may also include multiple processors, for example... Figure 4 The processors 401 and 404 are shown in the diagram. Each of these processors can be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, "processor" can refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). The memory 402 is used to store the software program executing the scheme of this application, and its execution is controlled by the processor 401. Specific implementation methods can be found in the above method embodiments, and will not be repeated here.

[0112] Optionally, the memory 402 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 402 may be integrated with the processor 401 or may exist independently, and may be connected via the interface circuit of the generative adversarial sample generation device 400 guided by high-frequency features. Figure 4 (Not shown in the image) is coupled to processor 401, and this embodiment of the application does not specifically limit this.

[0113] Transceiver 403 is used for communication with other communication devices. For example, if the generative adversarial example generation device 400 guided by high-frequency features is the first device, transceiver 403 can be used to communicate with a second device or a third device.

[0114] Alternatively, transceiver 403 may include a receiver and a transmitter. Figure 4 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the sending function.

[0115] Optionally, the transceiver 403 can be integrated with the processor 401 or exist independently, and can be connected to the interface circuit of the generative adversarial example generation device 400 guided by high-frequency features. Figure 4 (Not shown in the image) is coupled to processor 401, and this embodiment of the application does not specifically limit this.

[0116] Understandable Figure 4 The structure of the high-frequency feature-guided generative adversarial sample generation device 400 shown does not constitute a limitation on the high-frequency feature-guided generative adversarial sample generation device. The actual high-frequency feature-guided generative adversarial sample generation device may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0117] Furthermore, the technical effects of the generative adversarial sample generation device 400 based on high-frequency features can be referred to the technical effects of the method described in the above method embodiments, and will not be repeated here.

[0118] It should be understood that the processor in the embodiments of this application can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0119] It should also be understood that the memory in the embodiments of this application can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0120] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

Claims

1. A generative adversarial example generation method based on high-frequency feature guidance, characterized in that, The method includes: S1. Obtain the original image sample and the true category index of the original image sample, perform high-pass filtering on the original image sample, and extract the high-frequency feature components of the original image sample; S2. The original image sample and its high-frequency feature components are concatenated along the channel dimension to obtain multi-channel fused data. This concatenation includes: concatenating the RGB three-channel data of the original image sample with the three-channel data of its high-frequency feature components along the channel dimension to obtain multi-channel fused data. The RGB three-channel data of the original image sample contains the color information of the original image sample, and the three-channel data of its high-frequency feature components contains the detailed features of the original image sample. S3. Input the multi-channel fused data into the generative adversarial network model, wherein the generative adversarial network model includes a generator and a discriminator; The generator is used to generate adversarial samples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial samples is limited to a preset threshold. The discriminator is used to generate class output values ​​for the original image sample and the adversarial sample, and uses the Softmax function to map the difference between the class output values ​​of the original image sample and the adversarial sample into a class probability distribution. Based on the class probability distribution and the true class index of the original image sample, the relative cross-entropy loss function is obtained. S4. Update the network parameters of the generator by maximizing the relative cross-entropy loss function using backpropagation; S5. Repeat steps S3-S4 until the preset number of iterations is reached to obtain the optimized generator.

2. The generative adversarial example generation method based on high-frequency feature guidance according to claim 1, characterized in that, The step of performing high-pass filtering on the original image samples to extract the high-frequency feature components of the original image samples includes: The original image samples are subjected to spatial domain convolution operations using a preset high-pass convolution kernel to extract high-frequency feature components. The extraction expression is as follows: Among them, the The high-frequency feature components of the original image sample are represented by the following: The original image sample is represented by the original image sample. This indicates the pixel position in the original image sample. This represents a preset high-pass convolution kernel, the... This indicates a convolution operation.

3. The generative adversarial example generation method based on high-frequency feature guidance according to claim 1, characterized in that, After step S2 and before step S3, the method further includes: The multi-channel fused data is subjected to spatial domain data augmentation processing to obtain the processed multi-channel fused data. Correspondingly, step S3, which inputs the multi-channel fused data into the generative adversarial network model, is replaced by inputting the processed multi-channel fused data into the generative adversarial network model. The data augmentation process includes size normalization, center pruning, random horizontal flipping, and random rotation.

4. The generative adversarial example generation method based on high-frequency feature guidance according to claim 1, characterized in that, The generator is used to generate adversarial samples with high-frequency sensitivity, wherein the perturbation amplitude of the adversarial samples is limited within a preset threshold, including: Within the preset threshold, adversarial examples are generated by the generator mapping. The expression for generating adversarial examples with high-frequency sensitive characteristics is: ， Among them, the The adversarial example is referred to as the adversarial example. The original image sample is represented by the original image sample. This describes the generator's processing of the original image samples. For the preset threshold, the This represents a clipping function used to constrain the pixel values ​​of the adversarial sample to the range of 0 to 1.

5. The generative adversarial example generation method based on high-frequency feature guidance according to claim 1, characterized in that, The discriminator generates class output values ​​for the original image sample and the adversarial sample, and uses a Softmax function to map the difference between the class output values ​​of the original image sample and the adversarial sample to a class probability distribution. Based on the class probability distribution and the true class index of the original image sample, a relative cross-entropy loss function is obtained, including: The discriminator generates category output values ​​for the original image sample and the adversarial sample, and calculates the difference value between the category output values ​​of the original image sample and the adversarial sample. The expression for the difference value is: ， Among them, the The difference between the category output values ​​of the original image sample and the adversarial sample is represented by the value of the difference. , These represent the category output value of the adversarial sample and the category output value of the original image sample, respectively. The Softmax function is used to map the difference between the class output values ​​of the original image sample and the adversarial sample into a class probability distribution, the expression of which is: ， Among them, the Indicates the target category index, the The total number of categories, the Represents traversal in the summation symbol The index of each category, the Represents the Softmax function, the Indicates the first The relative probability of each target category index; Based on the category probability distribution and the true category index of the original image samples, the relative cross-entropy loss function is obtained, and the expression of the relative cross-entropy loss function is as follows: ， Among them, the Indicates the target category index, the The total number of categories, the The value is 1 or 0, and it is used when the k-th target category index matches the true category index of the original image sample. The value is 1, otherwise The value is 0, the Indicates the first The relative probability of each target category index.

6. The generative adversarial example generation method based on high-frequency feature guidance according to claim 1, characterized in that, The step of updating the generator's network parameters using backpropagation by maximizing the relative cross-entropy loss function includes: By maximizing the relative cross-entropy loss function, the network parameters of the generator are updated using backpropagation, as expressed in: ， Among them, the The function represents the The mathematical calculation process of the generator's weight parameters at the maximum value, the Indicates the The weight parameters of the generator at the maximum value.

7. A generative adversarial example generation system guided by high-frequency features, characterized in that, The system includes: The acquisition module and the processing module are used to acquire the original image sample and the true class index of the original image sample, perform high-pass filtering on the original image sample, and extract the high-frequency feature components of the original image sample; The stitching module is used to stitch the original image sample and its high-frequency feature components along the channel dimension to obtain multi-channel fused data. The stitching of the original image sample and its high-frequency feature components along the channel dimension to obtain multi-channel fused data includes: stitching the RGB three-channel data of the original image sample with the three-channel data of the high-frequency feature components of the original image sample along the channel dimension to obtain multi-channel fused data. The RGB three-channel data of the original image sample contains the color information of the original image sample, and the three-channel data of the high-frequency feature components of the original image sample contains the detailed features of the original image sample. A generative adversarial network model module is used to input the multi-channel fused data into a generative adversarial network model, wherein the generative adversarial network model includes a generator and a discriminator; The generator is used to generate adversarial samples with high-frequency sensitive characteristics, wherein the perturbation amplitude of the adversarial samples is limited to a preset threshold. The discriminator is used to generate class output values ​​for the original image sample and the adversarial sample, and uses the Softmax function to map the difference between the class output values ​​of the original image sample and the adversarial sample into a class probability distribution. Based on the class probability distribution and the true class index of the original image sample, the relative cross-entropy loss function is obtained. An optimization module is used to update the network parameters of the generator by maximizing the relative cross-entropy loss function using backpropagation.

8. A generative adversarial example generation device based on high-frequency feature guidance, characterized in that, The apparatus includes a module for performing the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a computer program or instructions that, when executed, cause the method as described in any one of claims 1-6 to be performed.

Images