Multi-layer attention-guided block shuffling confrontation sample generation method, system and terminal

Abstract

The invention discloses a multi-layer attention-guided block shuffling confrontation sample generation method, system and terminal, and belongs to the technical field of deep learning. Inputting the original image into a replacement or target neural network, and extracting and fusing multiple layers of attention mappings from the kth layer to the (k + p) th layer based on GradCAM to form an attention thermodynamic diagram; determining a key feature region R according to the thermodynamic diagram; randomly extracting one or more distribution disturbances from the disturbance pool D and superposing the distribution disturbances on the key feature region of the original image to generate a disturbance image set; averagely dividing each disturbance image into a plurality of blocks, applying random permutation to a block sequence, and re-splicing to generate a shuffled image; and inputting the shuffled image into the model to calculate a gradient, multiplying the gradient with the attention thermodynamic diagram element by element to obtain an attention guide gradient, and after aggregation, carrying out iterative updating and projection constraint based on a gradient symbol to generate a final confrontation sample. According to the method, multi-layer attention guidance, various disturbances in a key region and a gradient aggregation strategy of block shuffling are combined, and the migration performance of the generative adversarial sample on the black box model is remarkably improved while the disturbance controllability is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of image processing, and particularly relates to a multi-layer attention-guided block mixed shuffling adversarial sample generation method and system and a terminal. BACKGROUND

[0002] With the rapid development of deep learning, deep neural networks (DNN) have been widely applied in image classification, object detection, face recognition, autonomous driving, medical imaging, etc. and have shown superior performance. However, research shows that DNN is highly sensitive to carefully designed small perturbations. By adding imperceptible perturbations to the input, high-confidence false predictions can be induced, thus exposing the security vulnerability of the model.

[0003] According to the degree of information that the attacker masters about the target model, the adversarial attack can be divided into white-box attack and black-box attack. In white-box attack, the model structure and gradient information can be directly used to achieve high success rate attack, but the white-box condition is often not available in actual scenarios and can easily lead to overfitting of the target model, reducing the transferability on the black-box model. Black-box attack (including query-based and transfer-based attack) is closer to the actual threat scenario. The query-based method usually has large computational and time overhead and may trigger defense detection, while the transfer-based method relies on generating adversarial samples that can be transferred to the target model on the substitute model, so improving the transferability of adversarial samples has become a key problem in black-box attack research.

[0004] Existing research on improving transferability mainly focuses on input enhancement (such as image translation, scaling, cropping, etc.) and advanced gradient techniques (such as momentum, gradient aggregation, variance adjustment, etc.). Input enhancement methods are mostly based on the invariance assumption of the model, but often only consider basic geometric invariance, ignoring the multi-layer representation information across models; advanced gradient methods can expand the search path but usually have large computational overhead, are prone to overfitting of the source model, and have limited transfer improvement.

[0005] On the other hand, attention-based or intermediate feature-based attack methods have been gradually proposed to more specifically destroy model discriminative features, but how to use multi-layer attention information to locate key regions and design perturbation strategies in the region to improve cross-model transferability is still insufficient; at the same time, local statistical perturbation methods such as block replacement can change the local distribution of the input, but when used alone, they are difficult to effectively combine with the internal representation of the model to produce stable transferability improvement effect.

[0006] Currently, perturbation design is mostly single distribution (e.g. uniform or Gaussian) or a small number of variants, and the search diversity brought by the combination of multiple statistical distributions is not fully utilized; in addition, the systematic combination of mixed multiple perturbation distributions, multi-layer attention information, and block mixed shuffling strategy is still insufficient, resulting in limited transferability of adversarial samples on complex defenses or target models with large structural differences.

[0007] In summary, the prior art has the following deficiencies in black box migration attacks:

[0008] 1. The extraction and fusion of multi-layer attention information and the strategy for accurately selecting key feature regions are not clear.

[0009] 2. The disturbance distribution type is single, and the disturbance is only applied under the whole image or simple transformation, without increasing the path search in the key area through multi-distribution combination.

[0010] 3. The local statistical disturbance such as block shuffle and the gradient aggregation of attention guidance have not formed a collaborative process, resulting in limited migration rate improvement on heterogeneous models or models with defense mechanisms. SUMMARY

[0011] The purpose of the present application is to overcome the problems of the prior art and provide a multi-layer attention guided block shuffle adversarial sample generation method, system and terminal.

[0012] The purpose of the present application is to realize a multi-layer attention guided block shuffle adversarial sample generation method, which specifically includes the following steps:

[0013] Input the original image into the target model;

[0014] Obtain the output of each layer of the original image input into the target model, and calculate the multi-layer attention heat map;

[0015] Obtain the multi-layer attention heat map by weighted aggregation;

[0016] According to the size of each pixel of the attention heat map, determine the key feature region of the original image;

[0017] Randomly extract n disturbances from the disturbance pool, which follow different distributions, superimpose the corresponding key feature region of the original image, and obtain a first converted image set;

[0018] Block shuffle each image in the first converted image set;

[0019] The block shuffle processing includes:

[0020] According to the number of images in the first converted image set, each image is divided into m blocks on average;

[0021] Randomly shuffle the m blocks, and then splice and combine to obtain a second converted image set;

[0022] Input the second converted image set into the model for feature extraction processing and output;

[0023] The gradient direction of the cross-entropy loss of the calculated classification label on each converted image is multiplied by all the gradients corresponding to the multi-layer attention respectively and summed to obtain the attention-guided aggregated gradient direction.

[0024] According to the momentum gradient method, noise is iteratively added to the original image to obtain a high-mobility adversarial sample.

[0025] In an example, the processing expression of the multi-layer attention heat map is.

[0026] .

[0027] wherein, denotes a regularization operation, k is the kth layer of the target model, is the attention of the sample to multiple levels in the target model.

[0028] In an example, the calculation expression of the key feature region R is.

[0029]

[0030] wherein, denotes a pixel size calculation operation, is the attention heat map, R is the key feature region of the original sample X, and is obtained by The pixel value is sorted and the first p% of the pixel connected region is taken.

[0031] Randomly select several random perturbations from the perturbation pool D and superimpose them on the key feature region of the input sample, and the calculation expression of D is:

[0032]

[0033] wherein Gaussian, Poisson, and Uniform represent random noise obeying Gaussian distribution, Poisson distribution, and uniform distribution respectively.

[0034] In an example, the optimization target of the adversarial sample process is.

[0035]

[0036] wherein, denotes an adversarial sample; denotes an original image; denotes the size of the second converted image set; denotes cross-entropy loss; denotes the true label value of the image input into the model; denotes a constraint condition; denotes the maximum value of the perturbation.

[0037] In an example, the expression of generating the adversarial sample with high transferability is.

[0038]

[0039] wherein, denotes the adversarial sample generated in the i-th iteration, denotes the adversarial sample generated in the i-th iteration, denotes the constraint of the maximum perturbation to , denotes the adversarial sample generated in the i-th iteration, denotes the attention-guided aggregated gradient in the i-th iteration.

[0040] It should be further explained that the technical features corresponding to each example of the above method can be combined or replaced to form new technical solutions.

[0041] The application also includes a storage medium having computer instructions stored thereon, wherein the computer instructions execute the steps of the adversarial sample generation method based on the channel enhanced joint transformation formed by any one example or multiple examples.

[0042] The application also includes a terminal comprising a memory and a processor, wherein the memory has computer instructions stored thereon that can be executed on the processor, and the processor executes the steps of the adversarial sample generation method based on the channel enhanced joint transformation formed by any one example or multiple examples.

[0043] Compared with the prior art, the application has the following beneficial effects:

[0044] The application finds the key feature area of the image through the multi-layer attention search model, that is, the model gives the area with the largest contribution to the correct prediction; the key feature area of the original sample is located through the multi-layer attention, a plurality of random perturbations conforming to a plurality of noise distributions are randomly extracted from the model pool, are superimposed on the key feature area, and are mixed through block mixing, so that the fitting degree of the adversarial sample to the target model is reduced; the multi-layer attention guided aggregated gradient is calculated, and the momentum strategy is used to iteratively generate the adversarial sample with high transferability; and the final adversarial example generated based on the attack method can improve the defense ability of the model when training the attacked model. BRIEF DESCRIPTION OF DRAWINGS

[0045] The specific embodiments of the application will be clearly and completely described below with reference to the accompanying drawings, which are used to provide further understanding of the application, and form a part of the application. The same reference numerals are used to represent the same or similar parts in the accompanying drawings, and the illustrative embodiments of the application and their descriptions are used to explain the application, and do not constitute an improper limitation on the application.

[0046] Figure 1A flow chart of the method in an example of the present application;

[0047] Figure 2 A flow chart of the preferred example method of the present application. DETAILED DESCRIPTION

[0048] The technical solutions of the present application will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0049] In the description of the present application, it should be noted that the directions or positional relationships indicated by “center”, “upper”, “lower”, “left”, “right”, “vertical”, “horizontal”, “inner”, “outer” and the like are the directions or positional relationships described based on the drawings, and are only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the devices or elements indicated must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, the ordinal numbers (for example, “first and second”, “first to fourth”, etc.) are used to distinguish objects, and are not limited to the order, and cannot be understood as indicating or implying relative importance.

[0050] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, “mounting”, “connection” and “connection” should be understood in a broad sense, for example, can be fixed connection, can also be detachable connection, or integral connection; can be mechanical connection, can also be electrical connection; can be directly connected, can also be indirectly connected through an intermediate medium, and can be the communication inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0051] In addition, the technical features involved in different embodiments of the present application described below can be combined with each other as long as there is no conflict.

[0052] In an example, as shown in Figure 1 , a multi-layer attention-guided patch confusion adversarial sample generation method, the method comprising the following steps:

[0053] S1: obtaining an original input image and a target model for attack ;

[0054] S2: inputting the target model , extracting the attention map of the kth layer to the k+pth layer, and weighting the attention map of the kth layer to the k+pth layer according to the weight of the kth layer to the k+pth layer Weighted fusion and normalization to get attention heat map ;

[0055] S3: According to the attention heat map Calculate the key feature area ;

[0056] S4: Randomly extract several kinds of perturbations from the perturbation pool , superimposed on the key feature area of the original image to generate a set of perturbed images ;

[0057] S5: Divide each into blocks (i is an integer, 0≤i≤m), apply random permutation to the blocks and reassemble to generate shuffled images ;

[0058] S6: Input each to the target model , calculate the loss and find the gradient ;

[0059] S7: Dot product aggregation to get , based on the sign of the gradient to iteratively update the target model generated adversarial samples, and constraint the adversarial sample value, output the final adversarial sample.

[0060] In detail, in step S2, the attention heat map is input to the target model, and the key feature area with the highest contribution to correct recognition is calculated by extracting the multi-layer output of the target model and GradCAM. The key feature area of the corresponding attention heat map part of the original image is added with several perturbations randomly selected from the perturbation pool to obtain a first converted image, and a plurality of first converted images form a first converted image set. After block shuffling processing, a second converted image set is obtained. The original sample is input to different target models to calculate the attention heat map, and the attention heat maps of different models show the high similarity between different networks. Adding perturbations in the key feature area and block shuffling can improve the attack success rate of the adversarial sample on each model.

[0061] In this example, the multi-layer attention calculation and block shuffling processing are preferably executed independently and in series to obtain a first converted image (perturbed image) and a second converted image (shuffled image), and a plurality of shuffled images form a converted image set.

[0062] More specifically, as Figure 2 ​As shown, the multi-layer attention is calculated including:

[0063] inputting the original image into the target model;

[0064] obtaining the kth layer to the k+pth layer outputs of the target model respectively, obtaining the attention heat map by GradCAM and weighted average;

[0065] According to the attention heat map feature matrix, selecting the pixels with the top p% value size in the original image corresponding area, and superimposing a plurality of random perturbations obeying various distributions randomly selected from the perturbation pool;

[0066] More specifically, as shown in Figure 2 The block mixing includes:

[0067] According to the added random perturbations, the perturbation images are uniformly divided into blocks respectively;

[0068] Wherein, i is the number of added random perturbations;

[0069] The blocks are mixed and rearranged to obtain the mixed image.

[0070] Further, the target model in step S1 can be a neural network model such as Inception-V3 (Inc-V3), Inception-V4 (Inc-V4), InceptionResNet-V2 (IncRes-V2), ResNet-V2-101 (Res-01), etc. The second converted image is input into the model, and each gradient of the model is calculated; each gradient is respectively multiplied with the attention heat map feature matrix and aggregated to obtain a multi-layer attention guided aggregated gradient; the above calculation steps are repeated to obtain the aggregated gradient of the tth iteration. Assuming that the gradient momentum of the last iteration is obtained, the aggregated gradient of t+1 times is obtained, the image sample generated by the model is updated according to the aggregated gradient of t+1 times, the adversarial sample of the t+1th iteration is obtained, and the iteration calculation is continued until the preset iteration number is reached, and the final high-migration adversarial sample is obtained.

[0071] Further, in step S2, the expression of the multi-layer attention heat map is:

[0072]

[0073] Wherein, represents a regularization operation, k is the kth layer of the target model, is the jth layer attention of the sample to the target model, is a weight coefficient, and A is the attention of multiple levels.

[0074] Further, in step S3, the calculation expression of the key feature region R is:

[0075]

[0076] wherein, represents a calculation pixel size operation, is an attention heat map, is a key feature region of the original sample , which is obtained by sorting the pixel values and taking the first p% of the connected regions.

[0077] Further, in step S4, the expression of the perturbation pool D is.

[0078] .

[0079] wherein Gaussian, Poisson, and Uniform respectively represent random noises following Gaussian distribution, Poisson distribution, and uniform distribution.

[0080] In an example, the present application also includes a model training method for multi-layer attention guided block mixed shuffle adversarial samples, which has the same inventive concept as the above-mentioned method for generating multi-layer attention guided block mixed shuffle adversarial samples, and specifically includes:

[0081] By training the neural network model using the adversarial samples, the model can explicitly learn and recognize the perturbation features contained in the adversarial samples, so as to make a targeted response to such features during the inference process. This process enables the model to distinguish the differences between the adversarial samples and the original samples when facing the adversarial samples, and corrects the classification results to achieve correct identification and classification of the adversarial samples. As a result, the robustness and attack resistance of the model are significantly improved, thereby effectively enhancing the security performance of the neural network model.

[0082] The present application generates multi-layer attention guided channel confusion adversarial samples to attack the target model, and the generated adversarial samples also have a high attack success rate on the black box model.

[0083] In an example, the optimization target of the process of finding adversarial samples is:

[0084]

[0085] wherein, represents an adversarial sample; represents an original image; represents the size of the second converted image set; represents a cross-entropy loss; represents the true label value of the image input into the model. represents a constraint condition; represents a maximum value of the perturbation.

[0086] The embodiment also provides a storage medium having the same inventive concept as the multi-layer attention-guided block-shuffled adversarial sample generation method formed by any one or combination of the above examples, and computer instructions stored thereon, which, when executed, perform the steps of the multi-layer attention-guided block-shuffled adversarial sample generation method formed by any one or combination of the above examples.

[0087] Based on such understanding, the technical solution of the embodiment or the part of the technical solution that essentially contributes to the prior art or the part of the technical solution can be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in various embodiments of the application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0088] The present application also includes a terminal having the same inventive concept as any one or combination of the above examples corresponding to the multi-layer attention-guided block-shuffled adversarial sample generation method, including a memory and a processor, the memory having computer instructions executable on the processor stored thereon, and the processor executing the computer instructions to perform the steps of the multi-layer attention-guided block-shuffled adversarial sample generation method. The processor can be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present application.

[0089] In an example, the terminal, i.e., the electronic device, is in the form of a general-purpose computing device, and the components of the electronic device can include but are not limited to: the above-mentioned at least one processing unit (processor), the above-mentioned at least one storage unit, and a bus connecting different system components, including the storage unit and the processing unit.

[0090] The storage unit stores program codes executable by the processing unit, so that the processing unit performs the steps according to various exemplary embodiments of the present application described in the above "Exemplary Method" section of the specification. For example, the processing unit can execute the multi-layer attention-guided block-shuffled adversarial sample generation method.

[0091] The storage can include a readable medium in the form of volatile storage such as a random access memory (RAM) 3201 and / or cache memory and can further include a read only memory (ROM).

[0092] The storage can also include programs / utilities with a set (at least one) of program modules that include, but are not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or a combination thereof can include implementation of a network environment.

[0093] The bus can be representative of one or more of several types of bus structures, including a storage bus or storage bus controller, a peripheral bus, a graphics acceleration port, a processor or local bus using any of a variety of bus structures, and the like.

[0094] The electronic device can also communicate with one or more external devices such as a keyboard or a pointing device, a Bluetooth device, etc. and can also communicate with one or more devices that enable a user to interact with the electronic device and / or any devices (e.g., a router, a modem, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication can occur via an input / output (I / O) interface. Still yet, the electronic device can communicate with one or more networks such as a local area network (LAN), a general wide area network (WAN), and / or a public network such as the Internet via a network adapter. The network adapter can communicate with the other modules of the electronic device via the bus. It should be appreciated that numerous other hardware and / or software elements can be utilized in conjunction with the electronic device, including but not limited to microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archival storage systems, etc.

[0095] With the above description, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software and can also be implemented by software in combination with necessary hardware. Therefore, the technical solutions according to the example embodiments can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the methods of the example embodiments.

[0096] The above detailed description merely describes exemplary embodiments of the application, and the specific implementation of the application is not limited to these descriptions. For those skilled in the art, without departing from the concept of the application, a number of simple deductions and substitutions can be made, which should be considered as falling within the scope of protection of the application.

Claims

1. A multi-layer attention-guided block shuffling adversarial example generation method, characterized in that: It includes the following steps: S1: Obtain the original input image X and the target model for the attack. ; S2: Input X into the target model Extract the attention mapping from layer k to layer k+p. By weight Weighted fusion and normalization yield the attention heatmap A; S3: Calculate the key feature region R based on the attention heatmap A; S4: Randomly select several types of perturbations from the perturbation pool D and superimpose them onto the key feature region R of X to generate a perturbation image set XR; S5: Put each Average score Each block (i is an integer, 0≤i≤m) is randomly permuted and reassembled to generate a shuffled image. ; S6: Put each Input the target model M and calculate the loss. And calculate the input gradient ; S7: Aggregation get Iterative update of the target model based on gradient sign Generate adversarial examples, constrain the values ​​of the adversarial examples, and output the final adversarial examples.

2. The method according to claim 1, characterized in that, The attention mapping from layer k to layer (k+p) in step S2 is calculated using the GradCAM method, and the attention mapping is weighted... The attention heatmap is generated by weighted fusion and normalization. .

3. The method according to claim 1, characterized in that, The key feature region R mentioned in step S3 is a region selected on the original image X based on the attention heatmap A. The selection includes, but is not limited to: sorting A by pixel value and taking the first m% of the connected regions. The position of R on X is the key feature region.

4. The method according to claim 1, characterized in that, The perturbation pool D in step S4 consists of one or more perturbation distributions, which can be uniform distribution, Gaussian distribution, Bernoulli distribution, Poisson distribution, etc., and the perturbations extracted from D are only superimposed on the key feature regions of X and satisfy the overall perturbation norm constraint.

5. The method according to any one of claims 1-4, characterized in that, The specific value of the block parameter m in step S5 depends on the number of types of perturbation distributions selected in step S4. In practice, each perturbation image is divided into an average of [number missing]. (i is a random integer, 0≤i≤m) blocks are divided into blocks. Random permutations are applied to the blocks and they are reassembled according to the permutation positions to obtain a shuffled image.

6. The method according to claim 1, characterized in that, The gradient obtained from the shuffled image in steps S6-S7 The attention-guided gradient is obtained by multiplying the attention heatmap A element-wise by pixel or channel. ,right Aggregation along the sample dimension yields and based on The original image is iteratively updated using a symbolic method to generate adversarial examples.

7. A system for generating adversarial sample generation methods according to any one of claims 1-6, characterized in that, It includes a storage unit, a processing unit, and program instructions stored in the storage unit and executed by the processing unit, the program instructions causing the processing unit to perform attention extraction, key region perturbation addition, block shuffling, gradient calculation, attention weighting, and aggregation iterative update according to the steps of claims 1-6 to generate adversarial examples.

8. A terminal device or computer-readable medium, the terminal device comprising the system of claim 7; or the computer-readable medium storing computer-executable instructions that cause a processor to perform the method of any one of claims 1-6.

9. A terminal comprising a memory and a processor, wherein the memory stores computer instructions executable on the processor, characterized in that: When the processor executes the computer instructions, it performs the steps of the multi-layer attention-guided block shuffling adversarial sample generation method according to any one of claims 1-6.

Images