A principal component analysis-based convolutional neural network adversarial sample generation method

Abstract

The application discloses a kind of based on principal component analysis's convolutional neural network adversarial sample generation method, comprising: obtaining original image data;The original image data is input into convolutional neural network model, and the gradient matrix of the original image data is obtained, and the balance value of the gradient matrix is calculated using principal component analysis;Based on the balance value, mask matrix is obtained;According to the mask matrix, the tamperable pixel in the original image data is determined;According to the tamperable pixel, adversarial sample is obtained.The tamper strategy proposed in the application can provide more accurate tamper guidance for tamper operation, can effectively balance tamper strength and tamper quantity, can obtain a relatively weak tamper strength in the case of less tamper quantity, and generate an adversarial sample more similar to the original image.

Description

Technical Field

[0001] This invention belongs to the field of image classification technology, and in particular relates to a method for generating adversarial examples based on principal component analysis using convolutional neural networks. Background Technology

[0002] In the field of image classification, Convolutional Neural Networks (CNNs), as a superior deep network with self-learning capabilities, have become one of the key technologies in this field due to their powerful feature extraction capabilities and excellent versatility in handling complex images. Currently, with the continuous expansion of the application scope of CNNs, researchers have implemented various image classification models with high classification performance to meet different scenario requirements, such as AlexNet, VGGNet, GoogLeNet, ResNet, DenseNet, and MobileNet.

[0003] Generally, a well-trained convolutional neural network (CNN) model often exhibits superior classification performance in testing environments. However, in the field of CNN model security research, Szegedy et al. have clearly pointed out that adding a small amount of attack information, imperceptible to the human visual system, to the input image can mislead the CNN model into making an incorrect classification result. In real-world applications, input images are likely to be subject to various unpredictable interferences such as varying lighting intensity, angle changes, and occlusion by small objects. These intertwined factors significantly increase the risk of the model making incorrect decisions. Therefore, to ensure reliable operation of the model in practical applications, the developed model needs to meet necessary security requirements before deployment to address various potential interferences.

[0004] White-box attack methods for convolutional neural network (CNN) models have become a key technology for effectively improving model security due to their significant practical value in real-world applications. For example, they can help developers promptly identify potential vulnerabilities in the model and further enhance its robustness through generated adversarial examples. White-box attacks on CNN models refer to attacks launched by attackers who have complete knowledge of the target model's internal structure, weights, and other information. Currently, researchers have proposed various white-box attack methods based on different attack strategies. Existing white-box attack methods show that if constraints on the tampering, such as the number of tampered pixels, the average or maximum tampering intensity, are not strongly limited, existing white-box attack methods such as C&W, PGD, and MI-FGSM can achieve a stable and high success rate against different CNN models. However, existing white-box attack methods lack a mechanism to determine whether tampered pixels are a necessary feature for constituting an adversarial example, resulting in generated adversarial examples that still differ significantly from the original input image. This deficiency means that the generated adversarial examples often fail to accurately reveal the target model's minimum decision boundary for the input image, making it difficult for the developed models to cope with complex and ever-changing application environments. Currently, in the field of white-box attack research on convolutional neural network models, a key scientific problem that urgently needs to be solved is: how to generate an adversarial example that is more similar to the original input image while ensuring a stable attack success rate.

[0005] Existing iterative attack methods such as PGD, MI-FGSM, and C&W can achieve stable and high success rates on different CNN models, but the generated adversarial examples differ significantly from the original images. The main technical bottlenecks include: (i) In the process of iteratively modifying the input image, the intensity of pixel modification is relatively weak, but the number of pixel modifications is relatively large, which often leads to poor similarity between the generated adversarial examples and the original images; (ii) In the process of iteratively modifying the input image, the intensity of pixel modification is relatively strong, which also often leads to poor similarity between the generated adversarial examples and the original images. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a convolutional neural network adversarial example generation method based on principal component analysis, which can improve the similarity between adversarial examples and the original images.

[0007] This invention proposes a method for generating adversarial examples using convolutional neural networks based on principal component analysis, comprising:

[0008] Obtain the raw image data;

[0009] The original image data is input into a convolutional neural network model to obtain the gradient matrix of the original image data, and the balance value of the gradient matrix is ​​calculated using principal component analysis.

[0010] Based on the balance value, obtain the mask matrix;

[0011] Based on the mask matrix, determine the tamperable pixels in the original image data;

[0012] Based on the tamperable pixels, adversarial examples are obtained.

[0013] Optionally, the original image data is input into a convolutional neural network model to obtain the gradient matrix of the original image data, including:

[0014] The original image data is processed by a convolutional neural network model to obtain the gradient matrix of the loss function of the convolutional neural network model in different RGB channels.

[0015] Optionally, calculating the equilibrium value of the gradient matrix using principal component analysis includes:

[0016] Calculate the covariance matrix based on the gradient matrix;

[0017] The covariance matrix is ​​subjected to eigenvalue decomposition to obtain the eigenvector matrix and eigenvalue matrix;

[0018] The number of tamperable channels is obtained based on the eigenvalue matrix and the preset variance explanation rate;

[0019] Based on the feature vector matrix, the number of tamperable channels, and the gradient matrix, the principal component space of the gradient matrix is ​​obtained;

[0020] Based on the principal component space, the projection intensity of pixels in the original image data is obtained;

[0021] The balance value is obtained based on the projection intensity.

[0022] Optionally, the method for calculating the covariance matrix based on the gradient matrix is ​​as follows:

[0023]

[0024] Where G is the gradient matrix, Let n be the absolute value matrix of the gradient, and n be the number of pixels in a single channel. Let G be the mean matrix of the gradient matrix G, and let i be the index of an element in the gradient matrix G. i Let be the element at the i-th position in the gradient matrix G, C be the covariance matrix, and T be the matrix transpose operation.

[0025] Optionally, the method for obtaining the projection intensity of pixels in the original image data based on the principal component space is as follows:

[0026]

[0027] Among them, P j Z represents the projection intensity of the j-th pixel. ij The element at the corresponding position in the principal component space, where k is the number of tamperable channels.

[0028] Optionally, obtaining the mask matrix based on the balance value includes:

[0029] Based on the balance value, obtain the target pixel set;

[0030] Using the target pixel set as position marker information, obtain the gradient target value in each channel of the gradient matrix corresponding to the target pixel set;

[0031] Based on the gradient target value, obtain the collaborative value of different RGB channels;

[0032] The mask matrix is ​​obtained based on the cooperative value.

[0033] Optionally, the gradient target value is the minimum absolute value of the gradient in each channel.

[0034] Optionally, the method for obtaining the mask matrix based on the cooperative value is as follows:

[0035]

[0036] Where is the element at the corresponding position in the mask matrix M, and G ij Let be the element at the corresponding position in the gradient matrix G, and r be the cooperative value.

[0037] Compared with the prior art, the present invention has the following advantages and technical effects:

[0038] The advantages of the balanced tampering strategy based on principal component analysis (PCA) proposed in this invention are as follows: by using the covariance matrix to capture the coordinated change direction of gradient data in multiple channels of the input image, the tampering strategy proposed in this invention can provide more accurate tampering guidance for tampering operations, effectively balance the tampering intensity and the number of tamperings, and obtain a relatively weak tampering intensity with a smaller number of tamperings, generating an adversarial sample that is more similar to the original image. Attached Figure Description

[0039] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0040] Figure 1 This is a flowchart of a convolutional neural network adversarial example generation method based on principal component analysis according to an embodiment of the present invention. Detailed Implementation

[0041] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0043] To address the shortcomings of existing white-box attack methods, this embodiment proposes a convolutional neural network adversarial example generation method based on principal component analysis (PCA). Using 1000 samples from different classes in various PyTorch models such as AlexNet, ResNet, DenseNet, GoogLeNet, and ImageNet datasets, this embodiment systematically evaluates the performance of the proposed attack method, PCAI-FGSM, within different norm Lp constraints. Specifically, the Structural Similarity Index Measure (SSIM) and Peak Signal-to-Noise Ratio (PSNR), widely used to measure image similarity, are used to accurately evaluate the similarity between the generated adversarial examples and the original images.

[0044] In the field of research related to the security of convolutional neural network models, perturbations that may occur in the input image in the real environment, such as changes in light intensity and angle, and occlusion by small objects, are often addressed using different norms L with constraints η. p Such as L0≤η, L2≤η or L ∞ Simulation and characterization are performed with a threshold of η. Generally, as the constraints η, such as the number of pixel tamperings, the average tampering intensity, or the maximum tampering intensity, are relaxed, the more tampering information that attack methods, such as white-box and black-box attack methods, can impose on the original input image X, the easier it is for the attack method to generate an adversarial example that can successfully attack the target model. However, if the generated adversarial examples Because these adversarial examples differ significantly from the original input image X, they often have limited value in improving the security of convolutional network models in practical applications because they cannot accurately reveal the decision boundaries of the target model for input images with subtle perturbations. Therefore, a key objective of attack methods in generating adversarial examples is to obtain a minimized adversarial example that most closely resembles the original input image X while simultaneously increasing the attack success rate. In the formulas below, l and l' represent the original input image X and the corresponding adversarial sample, respectively. The classification labels obtained in the target model. Furthermore, based on different attack objectives, attack methods are divided into targeted and untargeted attacks. Untargeted attacks refer to attacks where the target model receives adversarial examples. Incorrectly classifying an image into any category inconsistent with the original input image X label is sufficient. Conversely, a targeted attack refers to an attacker's desire for the target model to misclassify adversarial examples. It was incorrectly classified into a specified attack category.

[0045]

[0046] Attack method principle:

[0047] Based on the idea of ​​iterative refinement, the basic principle of white-box untargeted attacks is shown in the following equation. In the following equation, X t The range of values ​​for X is usually defined as X t ∈[0,1],X t =0 represents the original input image, X t+1 For the input image X t The image generated after the t-th iteration of manipulation, J(X) t ,l) is the input image X t In the target model f(X), a loss function corresponding to label l that aims to minimize adversarial examples, such as the cross-entropy loss function, is used. For the input image X t In the target model f(X), with respect to the loss function J(X) t The gradient of the target model f(X), where sign is the sign function and λ is the iteration step size. White-box untargeted attacks take the original input image X0 as input and, based on the gradient of the input image X in the target model f(X), move towards the loss function J(X). t The input image X is iteratively modified in the direction of increase, and it is expected that after a finite number of iterations, an adversarial example will be generated to mislead the target model f(X) into making incorrect judgments. Compared to untargeted attacks, as shown in the following formula, white-box targeted attacks anchor a specified attack label l', using the input image X. t gradient information Towards the loss function J(X)t The direction of decrease of l') is relative to the input image X t Iterative modifications are performed.

[0048]

[0049] Currently, in the field of white-box attack research, researchers have proposed various attack methods with optimization strategies, aiming to generate minimal adversarial examples. For example, the PGD method aims to find the most aggressive and covert adversarial examples and introduces a projection operation to eliminate overflowing tampering information in the images generated by iterative manipulation. Compared to the PGD method, the MI-FGSM method integrates momentum into the iterative manipulation calculation process to overcome the problem that the manipulation calculation may get trapped in local maximization, leading to an increase in tampering information. To simultaneously minimize adversarial examples and increase attack success rate, the C&W method proposes various multi-objective loss functions with optimization conditions to optimize the strength and range of the manipulation calculation. Compared to attack methods that rely on loss functions, the JSMA method first uses the Jacobian matrix to obtain the degree of influence of pixels in the input image on the target model's output value. Then, during iterative manipulation, it selectively selects pixels in the input image that have a greater impact on the model's output value for priority manipulation, thereby achieving the goal of minimizing adversarial examples.

[0050] This embodiment proposes a convolutional neural network-based adversarial example generation method based on principal component analysis, such as... Figure 1 As shown, the specific steps include:

[0051] Obtain the raw image data;

[0052] The original image data is input into the convolutional neural network model to obtain the gradient matrix of the original image data. Principal component analysis is then used to calculate the balance value of the gradient matrix.

[0053] Obtain the mask matrix based on the balance value;

[0054] Based on the mask matrix, determine the tamperable pixels in the original image data;

[0055] Based on the tamperable pixels, obtain adversarial examples.

[0056] Specifically, existing methods for generating adversarial examples mainly fall into two categories: methods based on global manipulation and methods based on local manipulation. While methods based on global manipulation result in weaker pixel manipulation intensity during iterative manipulation of the input image, the number of manipulated pixels is relatively large. Conversely, methods based on local manipulation, although involving fewer pixel manipulations, exhibit stronger manipulation intensity. This often leads to poor similarity between adversarial examples generated by both global and local manipulation methods and the original image. In essence, when generating minimal adversarial examples, manipulation intensity and manipulation quantity are mutually exclusive. Therefore, the key to generating an adversarial example more similar to the original image lies in determining a balance between manipulation intensity and manipulation quantity. To determine this balance, this embodiment proposes a balanced manipulation strategy based on the principle of Principal Component Analysis (PCA).

[0057] The balanced tampering strategy proposed in this embodiment uses an iterative tampering approach to generate adversarial examples. During the iterative tampering process, this strategy first uses the gradient matrix of an input image in a target model as input, then uses PCA to calculate the balance value of the gradient matrix. Next, a mask matrix is ​​calculated based on the balance value, and finally, the mask matrix is ​​used to determine the tamperable pixels in the input image and generate an adversarial example. The attack method PCAI-FGSM proposed in this embodiment uses L... ∞ The calculation process for generating targetless adversarial examples using the norm as a constraint is shown in Table 1.

[0058] Table 1

[0059]

[0060] Furthermore, the original image data is input into the convolutional neural network model to obtain the gradient matrix of the original image data, which includes:

[0061] The original image data is processed by a convolutional neural network model to obtain the gradient matrix of the loss function of the convolutional neural network model in different RGB channels.

[0062] Furthermore, the equilibrium value of the gradient matrix is ​​calculated using principal component analysis, including:

[0063] Calculate the covariance matrix based on the gradient matrix;

[0064] Perform eigenvalue decomposition on the covariance matrix to obtain the eigenvector matrix and eigenvalue matrix;

[0065] Based on the eigenvalue matrix and the preset variance explanation rate, obtain the number of tamperable channels;

[0066] Based on the eigenvector matrix, the number of tamperable channels, and the gradient matrix, obtain the principal component space of the gradient matrix;

[0067] Based on the principal component space, obtain the projection intensity of pixels in the original image data;

[0068] Obtain the equilibrium value based on the projection intensity.

[0069] Specifically, Principal Component Analysis (PCA), as a classic unsupervised learning technique, can effectively reveal the intrinsic structure of data and provide an effective means for extracting key features from multidimensional data. This embodiment uses the gradient information of an input image X in the target model f(X) with respect to the loss function as input. PCA is used to determine the feature regions in the input image that have a significant impact on the model's decision-making behavior as tamperable regions, thereby generating adversarial examples with less tampering information. The calculation of determining the tamperable regions involves two steps: Principal Component Analysis Balance (PCAB) and calculating the mask matrix (CM). The PCAB calculation process is as follows: First, using the gradient matrix G of the input image X in the convolutional neural network model f(X) with respect to the loss function (such as the cross-entropy loss function) in different RGB channels as input, the covariance matrix C of the gradient matrix G is calculated;

[0070]

[0071] Where G is the gradient matrix, Let n be the absolute value matrix of the gradient, and n be the number of pixels in a single channel. Let G be the mean matrix of the gradient matrix G, and let i be the index of an element in the gradient matrix G. i Let be the element at the i-th position in the gradient matrix G, C be the covariance matrix, and T be the matrix transpose operation.

[0072] The second step is to perform eigenvalue decomposition on the calculated covariance matrix C to obtain an eigenvector matrix V and an eigenvalue matrix V'. Based on the eigenvalue matrix V', the number of tamperable channels k in the input image is determined according to the set variance contribution rate (VCR), such as 0.9.

[0073] G=VV′V T

[0074] Where V′=diag(λ1,λ2,λ3) is the eigenvalue matrix, V=[v1,v2,v3] is the eigenvector matrix, and satisfies λ1≥λ2≥λ3≥0.

[0075]

[0076] The third step involves taking the eigenvector matrix V, the determined number of tamperable channels k, and the gradient matrix G as inputs, and performing a dot product between the transpose of V and G to obtain the principal component space Z of G.

[0077] The fourth step is to calculate the square root of the sum of the squares of the values ​​of each pixel on the h principal components of the principal component space Z, and then obtain the projection intensity p of the pixel. The projection intensity p reflects the comprehensive influence of the pixel on the h principal components in the principal component space.

[0078]

[0079] Among them, V f = [v1, v2, ..., v f ] is a matrix composed of the first f eigenvectors. It is the principal component score matrix after projection.

[0080]

[0081] Among them, P j Z represents the projection intensity of the j-th pixel. ij The elements at corresponding positions in the principal component space are represented by h principal components, the first f eigenvectors, and the number of tamperable channels k.

[0082] Finally, based on the mean μ and standard deviation σ of the projection intensity p of all pixels, the equilibrium value b of the gradient matrix G is calculated.

[0083]

[0084] b = μ P +4σ P

[0085] Where, μ P and σ P These are the mean and standard deviation of the projected intensity, respectively.

[0086] Furthermore, based on the balance value, obtaining the mask matrix includes:

[0087] Based on the balance value, obtain the target pixel set;

[0088] Using the target pixel set as position marker information, obtain the gradient target value in each channel of the gradient matrix corresponding to the target pixel set;

[0089] Based on the gradient target value, obtain the collaborative value of different RGB channels;

[0090] Obtain the mask matrix based on the co-occurrence value.

[0091] Specifically, the calculation of CM uses the equilibrium value b obtained by PCAB as input. The calculation process is as follows: First, in the principal component space Z, elements with projection intensity p exceeding the equilibrium value b are selected, and the selected elements form a significant pixel set I.

[0092] I = {j|P j ≥b}

[0093] The second step is to use the salient pixel set I as the location marker information to calculate the minimum absolute value of the gradient in each channel of the gradient matrix G corresponding to the salient pixel set I.

[0094] R I ={G 1j |j∈I}

[0095] G I ={G 2j |j∈I}

[0096] B I ={G 3j |j∈I}

[0097] m R =min(R) I )

[0098] m G =min(G I )

[0099] m B =min(B I )

[0100] The third step is to calculate the synergistic value r of multiple channels by squaring the minimum absolute value of the gradient in each channel of the gradient matrix G, summing the results, and then taking the square root.

[0101]

[0102] The fourth step is to construct a mask matrix M based on the cooperative value r, where: when the element g in the gradient matrix G is greater than or equal to the cooperative value r, the value of m ∈ M at the corresponding position of g is 1; conversely, when the element g in the gradient matrix G is less than the cooperative value r, the value of m ∈ M at the corresponding position of g is 0.

[0103]

[0104] Finally, the gradient matrix G is masked using the mask matrix M, and the positions of the tamperable pixels are obtained.

[0105] Ω = GM

[0106] Following the above calculation process, in generating adversarial examples, this embodiment uses the cross-entropy loss function as the function for obtaining gradient information, and uses the formula as shown. or The tampering method modifies the input image to generate an adversarial sample with or without a target.

[0107] In the field of white-box attack research on convolutional neural network models, the main contribution of this embodiment is: This embodiment uses the covariance matrix to capture the direction of coordinated change of gradient data in multiple channels of the input image. The tampering strategy proposed in this embodiment can provide more accurate tampering guidance for tampering operations, effectively balance the tampering intensity and the number of tamperings, and obtain a relatively weak tampering intensity with a smaller number of tamperings, generating an adversarial example that is more similar to the original image.

[0108] More specifically, generating minimal adversarial examples essentially involves balancing the number of pixel tamperings with the intensity of pixel tampering. This requires considering different norms L of the given constraint η. p To generate minimum adversarial examples, the PCAI-FGSM method proposed in this embodiment employs multiple schemes to handle different norms. As shown in Table 1, this embodiment has fully considered the balance between the number of pixel tamperings and the intensity of pixel tampering. Therefore, relative to L... ∞ For the L2 ≤ η norm, the proposed PCAI-FGSM method uses the same computational process as Alg.1 when generating adversarial examples under the constraint of L2 ≤ η. Furthermore, to obtain a minimized adversarial example even under the L0 norm constraint, the tampering scheme used is as follows: based on the absolute value of the gradient of the input image, the top η pixels with the largest gradients are selected for tampering. This scheme can be easily implemented by modifying lines 6 and 7 of Alg.1.

[0109] This embodiment evaluates the performance of the proposed white-box attack method PCAI-FGSM in the following aspects: under the constraint of 100% attack success rate, the similarity between the adversarial samples generated by the proposed method and the original input image is measured in different evaluation environments.

[0110] Target Models and Evaluation Data: AlexNet, a typical convolutional neural network model released by PyTorch, ResNet, a model with residual modules, DenseNet, a model with an attention mechanism, and GoogLeNet, a model using global average pooling, were selected as target models. Meanwhile, 1000 samples with different labels from the ImageNet (ilsvrc-2012) dataset were selected as evaluation data.

[0111] Adversarial Example Generation Method: Existing white-box attack methods often support different norms due to varying optimization objectives. In the experiments conducted, this embodiment selected representative existing methods as the methods for generating adversarial examples for different norms. For example: in L... ∞ In the L2 norm, PGD, MI-FGSM, C&W, AutoAttack, and FSA were selected as methods for generating adversarial examples; in the L2 norm, PGD, EADEN, C&W, and AutoAttack were selected as methods for generating adversarial examples; in the L0 norm, JSMA...

[20] and C&W

[17] These were selected as methods for generating adversarial examples.

[0112] L p Norm Constraints: The accuracy of generated adversarial examples is directly related to the iteration step size λ, often exhibiting the following pattern: the smaller the iteration step size λ, the higher the accuracy of the generated adversarial examples. In the evaluation experiments, to objectively obtain the similarity between the adversarial examples generated by various attack methods and the original input image, the iteration step size λ was set to λ = 0.001 in the PyTorch normalized space. Furthermore, in the similarity evaluation experiments, to ensure that the proposed method PCAI-FGSM and the contrasting methods can achieve a 100% attack success rate, a relatively relaxed constraint η was applied to each contrasting method. It is worth noting that the applied constraint η does not affect the accuracy of the generated adversarial examples, because under this constraint η, if a method successfully attacks the target model, its generated adversarial example must be a sample containing the least perturbation information. In addition, the number of perturbation pixels, perturbation intensity, structural similarity index (SSIM), and peak signal-to-noise ratio (PSNR) were used as metrics to evaluate similarity from multiple dimensions. Among them, the lower the perturbation number (Number) and perturbation intensity (Intensity) values, the higher the similarity; the higher the SSIM and PSNR values, the higher the similarity.

[0113] Hardware and software environment: Windows 11, PyTorch 2.0.1, Python 3.12; CPU 13th Gen Intel(R) Core(TM) i9-13900HX 2.60GHz, Memory 32GB, GPU NVIDIA GeForce RTX 4060.

[0114] In the untargeted attack evaluation experiments, the validation experiments did not restrict the category of the attack label. In contrast, in the targeted attack evaluation, the top-500 classification labels of the original input image in the target model were set as the attack category.

[0115] The existing similarity evaluation criteria for white-box attack methods are as follows: within the set tampering constraints, if an attack method uses an image from the evaluation data as input, the adversarial sample generated by that method is used as the basis for similarity evaluation against different metrics. Compared to existing white-box attack methods, the adversarial sample generated by the attack method PCAI-FGSM proposed in this embodiment achieves optimal SSIM and PSNR, and is currently at the highest level in the field of white-box attack research. However, due to the black-box nature of convolutional neural networks, the problem of minimizing the generation of adversarial samples is actually a combination problem with O(n!) time complexity concerning the tampering location and intensity of pixels. Therefore, determining whether the generated adversarial sample is the absolutely optimal adversarial sample is a very challenging problem. Although the adversarial samples generated by the attack method proposed in this embodiment often have a structural similarity index of ≥0.99 compared to the original image, it is still impossible to determine whether the generated adversarial sample is a minimum adversarial sample of the target model. If the goal is to generate an absolutely optimal adversarial example in a relatively short time, a feasible approach is to first give a small boundary for the location and intensity of pixel tampering, and then combine and generate and verify it.

[0116] Evaluation experiments were conducted at L0, L2, and L... ∞ The experimental results for untargeted and targeted attacks in the norm are shown in Tables 2 to 7. Observing Tables 2 to 7, it can be seen that, compared to existing attack methods, the adversarial samples generated by the white-box attack method PCAI-FGSM proposed in this embodiment are more similar to the original input image, and show superior results in evaluation metrics such as average number of tamperings, intensity, SSIM, and PSNR.

[0117] Table 2

[0118]

[0119] Table 3

[0120]

[0121]

[0122] Table 4

[0123]

[0124] Table 5

[0125]

[0126] Table 6

[0127]

[0128] Table 7

[0129]

[0130] This embodiment proposes a novel white-box attack method, PCAI-FGSM, and systematically evaluates its performance. Results show that PCAI-FGSM achieves state-of-the-art performance in the field of white-box attacks, although the generated adversarial examples may not be the absolute minimum perturbation samples of the target model. Furthermore, we apply it to adversarial training. Experiments demonstrate that, in weakly perturbed environments, PCAI-FGSM helps improve the accuracy and robustness of CNN models.

[0131] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for generating adversarial examples using convolutional neural networks based on principal component analysis, characterized in that, include: Obtain the raw image data; The original image data is input into a convolutional neural network model to obtain the gradient matrix of the original image data, and the balance value of the gradient matrix is ​​calculated using principal component analysis. Calculating the equilibrium value of the gradient matrix using principal component analysis includes: Calculate the covariance matrix based on the gradient matrix; The covariance matrix is ​​subjected to eigenvalue decomposition to obtain the eigenvector matrix and eigenvalue matrix; The number of tamperable channels is obtained based on the eigenvalue matrix and the preset variance explanation rate; Based on the feature vector matrix, the number of tamperable channels, and the gradient matrix, the principal component space of the gradient matrix is ​​obtained; Based on the principal component space, the projection intensity of pixels in the original image data is obtained; The balance value is obtained based on the projection intensity; Based on the principal component space, the method for obtaining the projection intensity of pixels in the original image data is as follows: Where Pj represents the projection intensity of the j-th pixel. The element at the corresponding position in the principal component space, where k is the number of tamperable channels; Based on the balance value, obtain the mask matrix; Based on the mask matrix, determine the tamperable pixels in the original image data; Based on the tamperable pixels, adversarial examples are obtained.

2. The method for generating adversarial examples based on principal component analysis using convolutional neural networks according to claim 1, characterized in that, The original image data is input into a convolutional neural network model to obtain the gradient matrix of the original image data, including: The original image data is processed by a convolutional neural network model to obtain the gradient matrix of the loss function of the convolutional neural network model in different RGB channels.

3. The method for generating adversarial examples using convolutional neural networks based on principal component analysis according to claim 1, characterized in that, The method for calculating the covariance matrix based on the gradient matrix is ​​as follows: Where G is the gradient matrix, Let n be the absolute value matrix of the gradient, and n be the number of pixels in a single channel. Let G be the mean matrix of the gradient matrix. i The index of an element in the gradient matrix G. The gradient matrix G is the first... i The element at position 1 Let T be the covariance matrix, and T be the matrix transpose operation.

4. The method for generating adversarial examples using convolutional neural networks based on principal component analysis according to claim 1, characterized in that, Obtaining the mask matrix based on the balance value includes: Based on the balance value, obtain the target pixel set; Using the target pixel set as position marker information, obtain the gradient target value in each channel of the gradient matrix corresponding to the target pixel set; Based on the gradient target value, obtain the collaborative value of different RGB channels; The mask matrix is ​​obtained based on the cooperative value.

5. The method for generating adversarial examples using convolutional neural networks based on principal component analysis according to claim 4, characterized in that, The gradient target value is the minimum absolute value of the gradient in each channel.

6. The method for generating adversarial examples using convolutional neural networks based on principal component analysis according to claim 4, characterized in that, The method for obtaining the mask matrix based on the cooperative value is as follows: in, For the element at the corresponding position in the mask matrix M, Let be the element at the corresponding position in the gradient matrix G, and r be the cooperative value.

Images