Adaptive Complex Boundary Fitting Adversarial Attack Algorithm Based on Curvature Estimation

Abstract

This invention discloses an adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation, comprising the following steps: Step 1, obtaining initial adversarial samples; Step 2, estimating the curvature of local decision boundaries; Step 3, iterative search of an adaptive semi-elliptical path. This invention estimates the curvature of the local decision boundaries of the initial adversarial points using the three-point difference method, and adaptively constructs a semi-elliptical search path matching the degree of boundary curvature. This overcomes the limitations of fixed paths in existing methods, achieving accurate fitting of complex boundaries. Even in high-curvature boundary scenarios, it still achieves a high attack success rate. Under low query budget and strict perturbation constraints, it can still efficiently generate high-quality adversarial samples, and its performance is stable across models. It does not rely on internal model information, adapting to black-box attack scenarios. Furthermore, by optimizing the initial adversarial point selection and search path, it balances attack efficiency and sample concealment, providing a more reliable attack method for early warning of security risks in deep learning models.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to an adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation. Background Technology

[0002] With the widespread application of deep learning technology in fields such as image recognition and natural language processing, the security of its models has received increasing attention. Especially in commercial applications, deep learning models often serve as core components at the system's bottom layer; a successful attack could lead to serious security risks or even economic losses. Black-box adversarial attacks have become a research focus due to their close resemblance to real-world scenarios, but existing black-box attack methods suffer from the following shortcomings: 1. Most methods, such as qFool and GeoDA, rely on the assumption of low curvature decision boundaries, simplifying the boundary to a local hyperplane. When faced with increasingly prevalent non-uniformly curved, high-curvature boundaries in complex models, they struggle to accurately locate boundary points, resulting in a significant drop in attack performance. Even with subsequent methods like SurFree and CGBA employing geometric path search, the former still uses a fixed semicircular path based on the low curvature assumption, while the latter, although focusing on high curvature, does not model curvature changes and also uses a fixed semicircular structure, failing to adapt to nonlinear complex boundaries; 2. Under low query budgets or strict perturbation constraints, existing methods often struggle to generate adversarial examples with small perturbations and high success rates due to unreasonable path design, and they exhibit poor cross-model adaptability, failing to fully meet the needs of model security testing. Summary of the Invention

[0003] The purpose of this invention is to provide an adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation to solve the problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: an adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation, comprising the following steps: Step 1, obtaining initial adversarial samples; Step 2, local decision boundary curvature estimation; Step 3, adaptive semi-elliptical path iterative search;

[0005] Step one above specifically includes the following steps:

[0006] 1.1 Multi-directional perturbation generates multiple candidate samples: For the original samples... A perturbation with a finite step size is applied in multiple random directions, and a boundary point that satisfies the adversarial discrimination condition is found in each direction. Once an adversarial sample is successfully obtained in a certain direction, the sample is recorded as a candidate sample.

[0007] 1.2 Selecting initial adversarial samples: Select the sample with the smallest perturbation amplitude from all candidate samples as the initial adversarial sample, and retain all boundary points;

[0008] In step two above, three adjacent boundary points are selected from the retained boundary points. The curvature is calculated using an approximate second derivative method based on differences. ;

[0009] Step three above specifically includes the following steps:

[0010] 3.1 Initialization parameters and direction: First, calculate the initial adversarial sample. Compared with the original sample of distance For the boundary directions respectively and initial clean direction Perform normalization and initialize the adversarial direction. and clean direction Then calculate the minor axis of the ellipse. ;

[0011] 3.2 Iterative Update of Samples and Directions: First, set the loop condition. When the loop condition is met, execute the loop operation. In each loop, calculate the intermediate direction. The query count is updated by incrementing the count by one in each loop, and the middle direction is determined. Corresponding samples Is it an adversarial example? If so, update the adversarial example. and the direction of confrontation If not, update to a clean sample. and clean direction When the loop condition is not met, the iteration terminates, and the final high-quality adversarial example is output. And the number of queries during this iteration.

[0012] Preferably, in step 1.1, the candidate sample generation formula is:

[0013] in It is the first One direction of disturbance , It is the step size coefficient. This refers to the number of attempts to increase the perturbation step size, with a maximum allowed in each direction. In each perturbation iteration, if the predicted category changes after a certain perturbation, i.e. Then record the sample as a boundary point. and add it to the set ,gather It is expressed by the following formula:

[0014] .

[0015] Preferably, step 1.2 specifically involves: from the set of boundary points Selected from The sample with the smallest value is used as the initial adversarial sample. It is an indicator that measures the degree of difference between adversarial examples and original samples, through distance. Quantify the amplitude of the disturbance. ,in For the boundary point, This is the original sample.

[0016] Preferably, in step two, the curvature The calculation formula is as follows:

[0017]

[0018] in These are three adjacent boundary points; the molecule is a pair. The second-order central difference approximation is used to measure The degree of deviation relative to its preceding and following points; the denominator is used for scale normalization to prevent curvature estimation deviation due to different path scales, and a division-to-zero protection threshold is introduced in the calculation process; The larger the value, the better. Geometrically, the greater the deviation from the line connecting two points, the more curved the trajectory and the greater the curvature.

[0019] Preferably, in step 3.1, the boundary direction is the direction from the initial adversarial sample to the original sample, expressed as:

[0020]

[0021] in This is the initial adversarial example. For the original sample, This is the normalization function;

[0022] The clean direction is the direction from clean samples near the boundary to the original samples. The initial clean direction expression is:

[0023]

[0024] in A clean sample is one that has been correctly classified by the target classifier and is close to the decision boundary. For the original sample, This is the normalization function.

[0025] Preferably, in step 3.1, initializing the adversarial direction and the clean direction specifically involves: setting the adversarial direction... Clean direction .

[0026] Preferably, in step 3.1, the minor axis of the ellipse The calculation formula is as follows:

[0027]

[0028] in For the initial adversarial sample and the original sample distance, For curvature.

[0029] Preferably, in step 3.2, the loop condition is: antagonistic direction. With clean direction of distance And the number of queries is less than N, where is is a preset minimum threshold used to determine whether the directions are close enough, and N is a preset maximum query count threshold.

[0030] Preferably, in step 3.2, the middle direction By analyzing the current direction of confrontation With clean direction Normalized summation yields the expression:

[0031] .

[0032] Preferably, in step 3.2, the middle direction is determined. Corresponding samples Whether an example is adversarial is determined by the target classifier. Check if the adversarial sample conditions are met; if so, update the adversarial sample. and the direction of confrontation If the conditions are not met, then update to a clean sample. and clean direction .

[0033] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention estimates the local decision boundary curvature of the initial adversarial point using the three-point difference method, adaptively constructs a semi-elliptical search path matching the degree of boundary curvature, breaks through the fixed path limitation of existing methods, achieves accurate fitting of complex boundaries, and can still achieve a high attack success rate in high curvature boundary scenarios; it can still efficiently generate high-quality adversarial samples under low query budget and strict perturbation constraints, and its performance is stable across models; it does not rely on internal model information, adapts to black-box attack scenarios, and at the same time, by optimizing the initial adversarial point selection and search path, it balances attack efficiency and sample concealment, providing a more reliable attack method for early warning of security risks of deep learning models. Attached Figure Description

[0034] Figure 1 This is a diagram illustrating the algorithm steps of the present invention;

[0035] Figure 2 This is a flowchart of the algorithm of the present invention;

[0036] Figure 3 This is a schematic diagram of multi-directional boundary sampling;

[0037] Figure 4 This is another schematic diagram of multi-directional boundary sampling;

[0038] Figure 5 This is a schematic diagram of the elliptic search path;

[0039] Figure 6 This is a schematic diagram of another elliptical search path;

[0040] Figure 7 A schematic diagram of the decision boundary;

[0041] Figure 8 A line graph showing the success rate of different query counts for the same threshold;

[0042] Figure 9 A line graph showing the success rate of the same number of queries at different thresholds;

[0043] Figure 10 A line graph showing how attack success rate changes with perturbation threshold;

[0044] Figure 11 This is a line graph showing how the attack success rate changes with the number of queries. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] Please see the appendix Figure 1 -Appendix Figure 11 The present invention provides an embodiment of an adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation, comprising the following steps: Step 1, obtaining initial adversarial samples; Step 2, local decision boundary curvature estimation; Step 3, adaptive semi-elliptical path iterative search.

[0047] Step one above specifically includes the following steps:

[0048] 1.1 Multi-directional perturbation generates multiple candidate samples: For the original samples... A finite-step perturbation is applied in multiple random directions, and a boundary point satisfying the adversarial discrimination condition is searched in each direction. Once an adversarial sample is successfully obtained in a certain direction, it is recorded as a candidate sample. The candidate sample generation formula is as follows:

[0049] in It is the first One direction of disturbance , It is the step size coefficient. This refers to the number of attempts to increase the perturbation step size, with a maximum allowed in each direction. In each perturbation iteration, if the predicted category changes after a certain perturbation, i.e. Then record the sample as a boundary point. and add it to the set ,gather It is expressed by the following formula:

[0050] ;

[0051] 1.2 Selecting Initial Adversarial Samples: Select the sample with the smallest perturbation amplitude from all candidate samples as the initial adversarial sample, and retain all boundary points; specifically: from the boundary point set... Selected from The sample with the smallest value is used as the initial adversarial sample. It is an indicator that measures the degree of difference between adversarial examples and original samples, through distance. Quantify the amplitude of the disturbance. ,in For the boundary point, This is the original sample;

[0052] In step two above, three adjacent boundary points are selected from the retained boundary points. The curvature is calculated using an approximate second derivative method based on differences. curvature The calculation formula is as follows:

[0053]

[0054] in These are three adjacent boundary points; the molecule is a pair. The second-order central difference approximation is used to measure The degree of deviation relative to its preceding and following points; the denominator is used for scale normalization to prevent curvature estimation deviation due to different path scales, and a division-to-zero protection threshold is introduced in the calculation process; The larger the value, the better. Geometrically, the greater the deviation from the line connecting two points, the more curved the trajectory and the greater the curvature.

[0055] Step three above specifically includes the following steps:

[0056] 3.1 Initialization parameters and direction: First, calculate the initial adversarial sample. Compared with the original sample of distance For the boundary directions respectively and initial clean direction Perform normalization and initialize the adversarial direction. and clean direction Then calculate the minor axis of the ellipse. Wherein, the boundary direction is the direction from the initial adversarial sample to the original sample, expressed as:

[0057]

[0058] in This is the initial adversarial example. For the original sample, This is the normalization function;

[0059] The clean direction is the direction from clean samples near the boundary to the original samples. The initial clean direction expression is:

[0060]

[0061] in A clean sample is one that has been correctly classified by the target classifier and is close to the decision boundary. For the original sample, The normalization function is used; the initialization of the adversarial direction and the clean direction is specifically as follows: Let the adversarial direction... Clean direction ; minor axis of the ellipse The calculation formula is as follows:

[0062]

[0063] in For the initial adversarial sample and the original sample distance, For curvature;

[0064] 3.2 Iterative Update of Samples and Directions: First, set the loop condition. When the loop condition is met, execute the loop operation. In each loop, calculate the intermediate direction. The query count is updated by incrementing the count by one in each loop, and the middle direction is determined. Corresponding samples Is it an adversarial example? If so, update the adversarial example. and the direction of confrontation If not, update to a clean sample. and clean direction When the loop condition is not met, the iteration terminates, and the final high-quality adversarial example is output. and the number of queries during this iteration; where the loop condition is: adversarial direction With clean direction of distance And the number of queries is less than N, where is The preset minimum threshold is used to determine whether the directions are sufficiently close, and N is the preset maximum query count threshold; the middle direction By analyzing the current direction of confrontation With clean direction Normalized summation yields the expression:

[0065] ;

[0066] Determine the middle direction Corresponding samples Whether an example is adversarial is determined by the target classifier. Check if the adversarial sample conditions are met; if so, update the adversarial sample. and the direction of confrontation If the conditions are not met, then update to a clean sample. and clean direction .

[0067] To verify the effectiveness of this algorithm (CAGBA, curvature-adaptive geometric boundary attack), experiments 1 through 3 were conducted. The specific setup for each experiment was as follows: The ImageNet large-scale image recognition dataset ILSVRC2012 validation set was used as the benchmark platform. Four deep neural network models—ResNet-50, VGG-16, ResNet-101, and ViT—were selected for evaluation. In the attack experiments, 1000 image samples correctly classified by the target model were randomly selected from the ILSVRC2012 validation set. An additional 300 image samples with non-low curvature that were correctly classified by the target model were selected for high curvature experiments. All images were preprocessed to a uniform size of 3×224×224. The evaluation metrics were perturbation amplitude and attack success rate. Perturbation amplitude was calculated as the difference between the adversarial sample and the original image under a limited query budget. The distance from the median; the lower the value, the more efficient the attack. The attack success rate is the proportion of successfully generating adversarial examples under specific query limits and preset perturbation thresholds. The maximum number of queries is set to 20,000, and the perturbation amplitude... The distance threshold was set to 2.5. Based on this, low-number experiments were conducted at different thresholds, as well as experiments with different thresholds under 20,000 queries. The experimental baselines were selected as the CGBA algorithm based on curvature optimization and the SurFree algorithm based on decision boundary approximation.

[0068] Experimental Example 1:

[0069] An experiment was conducted to examine the geometric differences in the decision boundary from the perspective of adversarial attacks. The results are as follows: Figure 7 As shown, by visualizing the decision boundaries of different models, significant differences are found. The adversarial boundary curvature is complex. CAGBA dynamically adjusts the perturbation path based on the local geometry of the decision boundary. Whether it is the traditional convolutional network ResNet, VGG-16 or the ViT architecture that relies on global feature modeling, it can adaptively construct elliptical paths according to the changes in boundary curvature, thereby achieving stable and efficient attack effects on different models.

[0070] Experimental Example 2:

[0071] Attack experiments were conducted on high curvature decision boundaries. To comprehensively evaluate the performance of CAGBA in high curvature regions, two sets of comparative experiments were performed on the same set of 300 high curvature images. The results are as follows: Figure 8 and Figure 9 As shown; these two sets of experiments used different settings. The following evaluation of the experimental results further verifies the stability and adaptability of CAGBA under complex boundary conditions:

[0072] Attack effectiveness evaluation based on fixed threshold: Figure 8 This study demonstrates the increasing attack success rate of various methods on four models—ResNet-50, VGG-16, ResNet-101, and ViT—with a fixed perturbation threshold of 2.5, as the number of queries increases. Experimental results show that CAGBA consistently outperforms CGBA and SurFree in terms of attack success rate, especially in low query budget ranges. On ResNet-50, when the number of queries is only 5000, CAGBA's success rate exceeds 50%, while CGBA and SurFree remain at approximately 35% and 20%, respectively. This result further validates that CAGBA can quickly capture boundary geometry in high curvature regions and achieve attack point approximation with higher efficiency.

[0073] Multi-threshold evaluation under a fixed query budget: Figure 9Under the premise of a fixed number of queries of 20,000, the attack success rate trend under different perturbation thresholds was analyzed to further reveal the responsiveness of the three methods to perturbation tolerance in high curvature regions. It can be observed that CAGBA maintains its leading position under all models and all threshold settings, and the improvement trend with increasing threshold is more significant and smoother. For example, on the VGG-16 model, when the perturbation threshold reaches 4, the success rate of CAGBA is close to 80%, while CGBA and SurFree are still below 60% and 45%, respectively. This difference indicates that CAGBA not only has stronger attack adaptability in high curvature scenarios but also makes fuller use of the available perturbation space, thereby achieving a higher attack success rate. The core of this advantage lies in CAGBA's... Geometric Awareness Mechanism: Unlike SurFree's random search strategy and CGBA's approximate curvature exploitation, CAGBA can estimate the curvature information of the current local region and construct a semi-elliptical search path accordingly, making it more accurately fit the complex boundary curve structure. This geometry-driven strategy enables CAGBA to maintain stable and efficient attack capabilities even in regions with severely curved or irregular boundaries. Furthermore, CAGBA's performance curves show high consistency on both CNN architectures (ResNet series, VGG-16) and Transformer architectures (ViT). This cross-model robustness reflects its good architecture independence and geometric generalization ability, further consolidating its applicability in practical adversarial attack applications. Figure 8 and Figure 9 The results further demonstrate the significant advantages of CAGBA in high curvature regions. It not only outperforms existing methods under different query budgets and perturbation intensities, but also exhibits excellent geometric adaptability and model generalization ability, fully demonstrating its theoretical value and practical potential as an efficient geometric-aware attack method.

[0074] Evaluation of low-query attacks on high curvature boundaries: Tables 1.1, 1.2, and 1.3 show 300 images at a fixed curvature boundary. Under distance constraints, with query counts of 500, 1000, and 2000, the success rates of the three attack algorithms in generating adversarial examples on four deep learning models: ResNet-50, VGG-16, ResNet-101, and ViT were compared. With a query limit of 2000, CAGBA achieved a success rate exceeding 56% on all models, reaching 57.7% on ResNet-101, significantly outperforming CGBA (28.0%) and SurFree (22.0%). In contrast, SurFree's success rate was generally below 22%, while CGBA's was slightly higher but still significantly lower. This indicates that CAGBA can more effectively approach the model's decision boundary, possessing superior attack quality and efficiency. Even with a limit of only 1000 queries, CAGBA's success rate exceeded 50% on all models, with particularly high success rates on ResNet-101 and ViT. The success rates of CAGBA and CGBA reached 52.0% and 51.6% respectively, while CGBA's were 20.3% and 21.3%, and SurFree's were even lower, at only 14.3% and 14.7%. In comparison, CAGBA's success rate under moderate budget conditions is more than 3.5 times that of SurFree and more than 2.5 times that of CGBA, demonstrating stronger attack adaptability and practicality. When transitioning from ResNet-50 to the deeper ResNet-101, or from the traditional convolutional layer VGG-16 to ViT, CAGBA's success rate remained highly stable: with 2000 queries, the success rate from ResNet-50 to ViT showed almost no significant decrease (57.0% → 56.7%), while SurFree and CGBA showed significant fluctuations, indicating their greater sensitivity to changes in model structure. CAGBA's stability highlights its excellent structural generalization ability. Even in scenarios where distance is limited to 1, CAGBA's attack capabilities remain outstanding. For example, on the ViT model, CAGBA achieves a success rate of 41.7%, while CGBA and SurFree achieve 13.3% and 10.0%, respectively. In other words, CAGBA's success rate is 3.13 times that of CGBA and 4.17 times that of SurFree, indicating that it can still achieve more precise attack control and sample construction under high constraints. On the ResNet-101 model, CAGBA's success rate is 29.7 percentage points higher than CGBA and 35.7 percentage points higher than SurFree. On VGG-16, the success rates are 27.6 percentage points and 35.0 percentage points higher, respectively. This broad and stable improvement verifies CAGBA's comprehensive advantages over geometric search-based CGBA and boundary estimation-based SurFree methods in terms of attack strength, query efficiency, and cross-model consistency.

[0075] Experimental Example 3:

[0076] A comparative experiment on full curvature adaptive adversarial attack was conducted, and the results are shown in Tables 2 and 3. Figure 10 , Figure 11 As shown, the performance differences between CAGBA and two non-adaptive attack methods, SurFree and CGBA, were evaluated on four mainstream deep neural network models: ResNet-50, VGG-16, ResNet-101, and ViT. The results show that CAGBA exhibits superior attack success rate, convergence stability, and cross-model generalization ability under two typical constraint scenarios: perturbation strength control and query count limitation. The specific evaluation of the experimental results is as follows:

[0077] Evaluation of the effectiveness of fixed threshold attacks under full curvature: Figure 10 The attack success rate trends of the three methods under different perturbation thresholds were shown for 20,000 queries. It can be observed that CAGBA significantly outperforms SurFree and CGBA on all models, especially in the medium to high perturbation threshold range, such as threshold ≥3, where it shows stronger convergence ability and stability. For example, on ResNet-50 and VGG-16, CAGBA has achieved a success rate of over 97% when the perturbation threshold reaches 3, while SurFree only reaches about 75% at the same threshold. In addition, the CAGBA curve rises faster and saturates earlier, indicating that it can achieve efficient attacks with lower perturbation costs, demonstrating excellent fitting ability to complex geometric boundaries.

[0078] Multi-threshold evaluation of fixed query budget under full curvature: Figure 11 The study presents the ASR (Average Score) trends of the three methods under different query counts at the same threshold. Within the low to medium query budget range of 2500 to 15000 queries, CAGBA's attack performance improves more rapidly and stably. For example, in the VGG-16 model, CAGBA reaches 84.16% after 5000 queries, while CGBA and SurFree achieve 76.40% and 55.62%, respectively. On ViT, CAGBA surpasses 93.5% after 10000 queries, significantly outperforming other methods. As the number of queries increases... Furthermore, the CAGBA curve gradually stabilizes and consistently maintains its leading position, indicating faster convergence and stronger attack power. A comprehensive analysis of the tables and graphs reveals that CAGBA's core advantage lies in its elliptical trajectory generation mechanism, which adapts to curvature information, thereby more accurately fitting boundary structures in high-curvature or nonlinear boundary regions and reducing query waste in invalid perturbation directions. This geometric guidance mechanism not only improves query utilization but also effectively enhances the attack strength and generalization ability of adversarial examples. Moreover, under conditions of limited perturbation resources, such as... Figure 10 As shown, CAGBA also maintains a very high success rate and low volatility, further verifying the feasibility and practicality of its method. Figure 10 and Figure 11The results intuitively reflect the comprehensive performance advantages of CAGBA under different constraints, indicating that it significantly reduces query costs while ensuring attack quality. Compared with SurFree and CGBA, it shows better geometric adaptability, convergence speed and cross-model versatility, providing a more efficient strategy design idea for decision-based black-box attacks.

[0079] Image set attack comparison under the same number of queries: As shown in Table 4, a set of typical images were selected, and images with high curvature near the adversarial point were chosen for comparison. A unified attack was performed on multiple models, including ResNet-50, ResNet-101, VGG-16, and ViT. During the attack, each model used the exact same image samples to ensure consistent experimental conditions, thus more objectively evaluating the adaptability of CAGBA under different model decision boundary structures and the consistency of attack performance. Although the input images were exactly the same, not only were the curvature values ​​different on different models, but the perturbation distance required for a successful attack on the same image also showed significant differences. This phenomenon reflects that the decision boundary morphology of the same image differs significantly in different models, and the curvature structure of the boundary is model-specific. Further analysis revealed that some images... ResNet-50 corresponds to a relatively flat, low-curvature boundary, while architectures such as ViT or ResNet-101 exhibit more complex and curved high-curvature boundaries. This difference in curvature distribution further confirms the significant diversity of decision boundary geometric properties among different neural network models from a quantitative perspective. CAGBA does not rely on any prior model structure information and can dynamically adjust the perturbation path based on the local curvature of the current adversarial point, thereby achieving efficient fitting on heterogeneous decision boundaries presented by different models. Even when faced with the challenge of significant differences in boundary structures between models, CAGBA can still stably generate effective adversarial examples and exhibit strong consistency and scalability. This not only verifies CAGBA's ability to adapt to complex geometric boundaries but also fully demonstrates its cross-model generalization potential and stability.

[0080] Table 1.1 Success Rate under a Limited Number of Queries at High Curvature Decision Boundaries (Part 1)

[0081]

[0082] Table 1.2 Success Rate under a Limited Number of Queries at High Curvature Decision Boundaries (Part 2)

[0083]

[0084] Table 1.3 Success Rate under Limited Number of Queries in High-Curvature Decision Boundaries (Part 3)

[0085]

[0086] Table 2 Disturbance Magnitude and Success Rate

[0087]

[0088] Table 3. Number of Queries and Success Rate

[0089]

[0090] Table 4 Results of attacks on the same set of images with the same number of queries

[0091]

[0092] Based on the above, the advantages of this invention are as follows: When used, by performing boundary search along a semi-elliptical trajectory on a constrained two-dimensional plane, it effectively improves the success rate of boundary attacks on different decision boundaries, especially when dealing with decision boundaries with non-low curvature, demonstrating greater flexibility and effectiveness compared to existing methods. By introducing a curvature estimation mechanism, based on the estimated local decision boundary curvature, the elliptical search trajectory is adaptively determined, enabling the perturbation path to more accurately fit the geometry of the decision boundary. A semi-elliptical query path is further generated based on this trajectory, thereby improving the accuracy and efficiency of the boundary search. To obtain a better initial adversarial point and estimate its decision boundary curvature, a five-point query method is used to select… The nearest point is used as the initial adversarial point, and the minor axis length of the elliptical path is adaptively determined accordingly to improve the accuracy of boundary fitting and attack efficiency. Comparative experiments are conducted on four different deep learning models with the SurFree attack algorithm and the CGBA algorithm, particularly on high curvature boundaries. With a high query count and a perturbation value of 2.5, the attack success rate increases by at least 45.9%. When the perturbation value is 1 and the number of queries is low, the attack success rate can be increased by up to 30.4%. In the full curvature uncertain boundary attack experiment, the success rate is also higher than that of the comparison algorithm, which reflects the advantages of CAGBA under complex boundary conditions.

[0093] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. An adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation, comprising the following steps: Step 1, obtaining initial adversarial samples; Step 2, local decision boundary curvature estimation; Step 3, adaptive semi-elliptical path iterative search; characterized in that: Step one above specifically includes the following steps: 1.1 Generating multiple candidate samples through multi-directional perturbation: For the original samples A perturbation with a finite step size is applied in multiple random directions, and a boundary point that satisfies the adversarial discrimination condition is found in each direction. Once an adversarial sample is successfully obtained in a certain direction, the sample is recorded as a candidate sample. 1.2 Selecting initial adversarial samples: Select the sample with the smallest perturbation amplitude from all candidate samples as the initial adversarial sample, and retain all boundary points; In step two above, three adjacent boundary points are selected from the retained boundary points. The curvature is calculated using an approximate second derivative method based on differences. ; The original samples are image samples, which are classified using the target model; Step three above specifically includes the following steps: 3.1 Initialization parameters and direction: First, calculate the initial adversarial sample. Compared with the original sample of distance For the boundary directions respectively and initial clean direction Perform normalization and initialize the adversarial direction. and clean direction Then calculate the minor axis of the ellipse. ; It is an indicator that measures the degree of difference between adversarial examples and original samples; 3.2 Iterative update of samples and directions: First, set the loop condition. When the loop condition is met, execute the loop operation. In each loop, calculate the intermediate direction. The query count is updated by incrementing the count by one in each loop, and the middle direction is determined. Corresponding samples Is it an adversarial example? If so, update the adversarial example. and the direction of confrontation If not, update to a clean sample. and clean direction When the loop condition is not met, the iteration terminates, and the final high-quality adversarial example is output. And the number of queries during this iteration.

2. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 1.1, the candidate sample generation formula is as follows: ; in It is the first One direction of disturbance , It is the step size coefficient. This refers to the number of attempts to increase the perturbation step size, with a maximum allowed in each direction. In each perturbation iteration, if the predicted category changes after a certain perturbation, i.e. Then record the sample as a boundary point. and add it to the set ,gather It is expressed by the following formula: ； N is the preset maximum number of queries threshold.

3. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 2, characterized in that: In step 1.2, specifically: from the set of boundary points Selected from The sample with the smallest value is used as the initial adversarial sample, and then the distance is used to... Quantify the amplitude of the disturbance. ,in For the boundary point, This is the original sample.

4. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step two, curvature The calculation formula is as follows: ； in These are three adjacent boundary points; the molecule is a pair. The second-order central difference approximation is used to measure The degree of deviation relative to its preceding and following points; the denominator is used for scale normalization to prevent curvature estimation deviation due to different path scales, and a division-to-zero protection threshold is introduced in the calculation process; The larger the value, the better. Geometrically, the greater the deviation from the line connecting two points, the more curved the trajectory and the greater the curvature.

5. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.1, the boundary direction is the direction from the initial adversarial sample to the original sample, expressed as: ； in This is the initial adversarial example. For the original sample, This is the normalization function; The clean direction is the direction from clean samples near the boundary to the original samples. The initial clean direction expression is: ； in A clean sample is one that has been correctly classified by the target classifier and is close to the decision boundary. For the original sample, This is the normalization function.

6. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.1, initializing the adversarial direction and the clean direction specifically involves: setting the adversarial direction... Clean direction .

7. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.1, the minor axis of the ellipse The calculation formula is as follows: ； in For the initial adversarial sample and the original sample distance, For curvature.

8. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.2, the loop condition is: antagonistic direction. With clean direction of distance And the number of queries is less than N, where is is a preset minimum threshold used to determine whether the directions are close enough, and N is a preset maximum query count threshold.

9. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.2, the middle direction By analyzing the current direction of confrontation With clean direction Normalized summation yields the expression: ； This is the normalization function.

10. The adaptive complex boundary fitting adversarial attack algorithm based on curvature estimation according to claim 1, characterized in that: In step 3.2, the middle direction is determined. Corresponding samples Whether an example is adversarial is determined by the target classifier. Check if the adversarial sample conditions are met; if so, update the adversarial sample. and the direction of confrontation If the conditions are not met, then update to a clean sample. and clean direction .

Images