Adversarial sample generation method and system based on frequency domain guided multi-feature attention

Abstract

The application discloses a frequency domain guidance-based multi-feature attention adversarial sample generation method and system. In the method, the target recognition loss of the initial adversarial sample of each round is calculated in the iterative generation of the final adversarial sample; the multi-scale features of the initial adversarial sample of the round are extracted, and the multi-scale feature gradient is calculated; the spatial domain feature weight is calculated and determined according to the target recognition loss and the multi-scale feature gradient; the spatial domain feature weight is subjected to frequency domain transformation and band-stop filtering processing to obtain the filtered weight; the filtered weight is reconstructed back to the spatial domain to obtain the frequency domain guidance weight; the frequency domain guidance weight and the multi-scale feature gradient are point-multiplication fused to obtain the fusion gradient; the initial adversarial sample of the next round is obtained by updating the initial adversarial sample of the round through the fusion gradient, and the initial adversarial sample of the next round is obtained. The generated adversarial sample has good cross-model migration.

Description

Technical Field

[0001] This invention relates to the field of adversarial sample generation technology, and in particular to an adversarial sample generation method and system based on frequency domain-guided multi-feature attention. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of deep learning, structures such as convolutional neural networks, residual networks, and Inception have been widely used in tasks such as image classification, object detection, and semantic segmentation. However, research shows that these models are highly sensitive to adversarial perturbations. Attackers can cause the model to make completely incorrect predictions by adding minute noise that is almost imperceptible to the human eye to the input image. The existence of adversarial examples not only threatens the reliability of models in open environments but also poses a serious threat to applications in high-risk scenarios such as autonomous driving, security monitoring, and medical image analysis.

[0004] Traditional adversarial attack methods mostly perform iterative optimization directly in the image space or gradient space, such as FGSM, PGD, and MI-FGSM. While these methods can achieve high attack success rates in white-box environments, the perturbations they generate often lack transferability, meaning they are ineffective in cross-model attacks between different models. Furthermore, while some methods introduce multi-model ensembles or input diversification, they also increase computational overhead while improving attack strength, making it difficult to balance efficiency and high transferability in real-world scenarios. Recent research has attempted to introduce feature-layer attacks, which utilize gradient information from intermediate layers of the network to guide perturbation generation. These methods generate adversarial examples by manipulating the feature representations of intermediate layers, such as maximizing feature distances or disrupting key feature channels. Traditional feature map attention mechanisms, such as Crad-CAM attention, typically use the functional gradient in a single layer to guide the addition of perturbations based on the correct classification score. However, they ignore the fact that different depths of deep neural networks have different receptivity corresponding to various dimensions of features, resulting in inaccurate feature weight maps obtained using single layers and a high risk of overfitting. Recently, experts have proposed a multi-feature attention attack and its core layer aggregation gradient and ensemble attention mechanism. By recursively fusing deep semantic information with shallow detail information, a feature importance weight map is generated, which can more accurately guide the generation of perturbations and significantly improve transferability.

[0005] Despite advancements in existing technologies, the feature importance weight maps generated by these methods are calculated and fused entirely in the spatial domain, ignoring the fact that different frequency components of deep neural networks carry different information. Existing multi-layer feature attention methods directly use weight maps containing all frequency components to guide attacks, inevitably incorporating a large amount of model-specific information originating from mid-frequency noise into the generated perturbations. This results in a significant reduction in transfer performance when attacking target models with different architectures. Summary of the Invention

[0006] To address the aforementioned problems, this invention proposes a method and system for generating adversarial examples based on frequency domain-guided multi-feature attention. The generated adversarial examples exhibit good cross-model transferability.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] Firstly, an adversarial example generation method based on frequency domain-guided multi-feature attention is proposed, including:

[0009] Obtain raw image samples;

[0010] The original image samples are used as the initial adversarial samples for the first round of iteration. The original image samples are then updated in multiple rounds. Each round of update includes:

[0011] Calculate the target recognition loss of the initial adversarial sample in this round;

[0012] Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients;

[0013] Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined.

[0014] The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights.

[0015] The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights.

[0016] The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient;

[0017] The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration.

[0018] The last updated adversarial sample will be used as the final adversarial sample.

[0019] Furthermore, based on the target recognition loss and multi-scale feature gradient, the layer aggregation gradient of the last feature extraction layer is calculated and determined;

[0020] After taking the absolute value of the layer aggregation gradient of the last feature extraction layer, normalization and Gaussian smoothing are performed to obtain the spatial domain feature weights.

[0021] Furthermore, the target recognition loss is calculated using cross-entropy loss.

[0022] Furthermore, the Fast Fourier Transform method is used to transform the spatial domain feature weights in the frequency domain; thus obtaining the frequency domain representation of the spatial domain feature weights.

[0023] Based on the iteration rounds, the band-stop filter mask is calculated and determined using the cosine annealing algorithm.

[0024] The filtered weights are calculated by multiplying the band-stop filter mask with the frequency domain representation of the spatial domain feature weights.

[0025] Furthermore, the sum of all fusion gradients from the current update to the previous update is calculated as the cumulative gradient; based on the cumulative gradient, the initial adversarial sample for this round is updated.

[0026] Furthermore, the iteration update is completed when the maximum number of iterations is reached or the attack is successful, and the final adversarial sample is output.

[0027] Secondly, an adversarial example generation system based on frequency domain-guided multi-feature attention is proposed, including:

[0028] Image sample acquisition unit, used to acquire original image samples;

[0029] The adversarial sample generation unit is used to take the original image sample as the initial adversarial sample for the first iteration and perform multiple rounds of iterative updates on the original image sample. Each round of update includes:

[0030] Calculate the target recognition loss of the initial adversarial sample in this round;

[0031] Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients;

[0032] Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined.

[0033] The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights.

[0034] The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights.

[0035] The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient;

[0036] The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration.

[0037] The last updated adversarial sample will be used as the final adversarial sample.

[0038] Thirdly, a computer device is proposed, the device comprising:

[0039] A processor, adapted to execute computer programs;

[0040] A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the adversarial example generation method based on frequency domain-guided multi-feature attention proposed in the first aspect.

[0041] Fourthly, a computer-readable storage medium is proposed, which stores a computer program adapted to be loaded by a processor and executed by the adversarial example generation method based on frequency domain-guided multi-feature attention proposed in the first aspect.

[0042] Fifthly, a computer program product is proposed, which includes a computer program that, when executed by a processor, implements the adversarial example generation method based on frequency domain-guided multi-feature attention proposed in the first aspect.

[0043] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0044] This invention proposes a method and system for generating adversarial examples based on frequency domain-guided multi-feature attention. During the iterative update of original image samples, the method calculates spatial domain feature weights for multi-scale features based on the target recognition loss of the samples. Then, it performs a frequency domain transformation on the spatial domain feature weights to obtain frequency domain feature weights. Band-stop filtering and cosine annealing algorithms are used to guide and correct the frequency domain feature weights, resulting in filtered weights. Frequency domain transformation (such as Fast Fourier Transform, FFT) is introduced, and mid-frequency noise components in the weight map are suppressed using a band-stop mask. The range of low and high frequencies is dynamically adjusted using cosine annealing, effectively filtering out model-specific non-robust signals while retaining low-frequency and some high-frequency features shared across models. The filtered weights are reconstructed back into the spatial domain to obtain frequency-guided weights. These frequency-guided weights are then multiplied and fused with the multi-scale feature gradients to obtain a fused gradient. This fused gradient is then used to update the initial adversarial examples in each round, effectively disrupting robust feature regions commonly relied upon by the target model and significantly improving cross-model transferability.

[0045] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0046] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.

[0047] Figure 1 This is a flowchart of the adversarial example generation method based on frequency domain-guided multi-feature attention proposed in this invention. Detailed Implementation

[0048] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0049] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0050] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0051] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0052] Example 1

[0053] With the development of deep learning, structures such as convolutional neural networks, residual networks, and Inception have been widely used in tasks such as image classification, object detection, and semantic segmentation. However, research shows that these models are highly sensitive to adversarial perturbations. Attackers can cause the model to make completely incorrect predictions by adding minute noise that is almost imperceptible to the human eye to the input image. The existence of adversarial examples not only threatens the reliability of models in open environments but also poses a serious threat to applications in high-risk scenarios such as autonomous driving, security monitoring, and medical image analysis.

[0054] Traditional adversarial attack methods mostly perform iterative optimization directly in the image space or gradient space, such as FGSM, PGD, and MI-FGSM. While these methods can achieve high attack success rates in white-box environments, the perturbations they generate often lack transferability, meaning they are ineffective in cross-model attacks between different models. Furthermore, although some methods introduce multi-model ensembles or input diversification, they also increase computational overhead while improving attack strength, making it difficult to balance efficiency and high transferability in real-world scenarios.

[0055] Recent research has attempted to introduce feature layer attacks, which utilize gradient information from intermediate layers of the network to guide perturbation generation. These methods generate adversarial examples by manipulating the feature representations of intermediate layers, such as maximizing feature distances or disrupting key feature channels. Traditional feature map attention mechanisms, such as Crad-CAM attention, typically use the functional gradients in a single layer to guide the addition of perturbations based on the correct classification score. However, they overlook the fact that different depths of deep neural networks have different receptivity corresponding to various dimensions of features, resulting in inaccurate feature weight maps obtained using single layers and a tendency to overfit. Recently, experts have proposed multi-feature attention attacks and their core layer aggregation gradient and ensemble attention mechanisms. By recursively fusing deep semantic information with shallow detail information, they generate feature importance weight maps, thereby more accurately guiding perturbation generation and significantly improving transferability.

[0056] DNNs have varying degrees of dependence on features from different frequency domain components. Low-frequency components typically correspond to smooth regions and overall contours of an image, forming the basis for class-level semantic understanding and exhibiting cross-model universality. High-frequency components, on the other hand, typically correspond to edges, textures, and details of an image, crucial for instance-level discrimination. However, they are susceptible to model-specific structures and training details, resulting in poor cross-model consistency. Mid-frequency components often contain a large amount of adversarial sample generation model-specific features and noise. These components are a significant cause of overfitting of the source model to adversarial perturbations and reduced transferability. Traditional attention mechanisms, which directly use the original spatial domain weights to guide attacks, inevitably introduce a large amount of mid-frequency noise into the model.

[0057] Therefore, existing perturbation generation methods usually have the following problems: (1) Noise sensitivity problem. The generated attention weight map integrates multi-scale feature gradients from shallow to deep layers, which includes both robust feature signals shared across models and a large number of model-specific, sensitive non-robust feature noises. These noises are mainly concentrated in the mid-frequency part of the frequency domain. Directly using the weight map will guide attackers to destroy some features that are only effective on the source model but not on the target model, thereby reducing transferability. (2) Traditional methods operate directly in the spatial domain and lack explicit control and guidance on the frequency distribution of feature weights. The injection of perturbation energy does not follow the frequency law of robust features across models, which makes the perturbation mode easily defended by the preprocessing (such as denoising and smoothing) or inherent architecture of the target model. (3) Insufficient defense and evasion capabilities. With the emergence of defense strategies based on frequency domain analysis (such as frequency domain filtering and noise suppression), perturbations generated by traditional spatial domain attack methods are easily detected and filtered out due to their abnormal frequency distribution.

[0058] To generate more universal and transferable adversarial examples, this invention refocuses the attack on robust low-frequency and high-frequency features shared across models. It proposes an adversarial example generation method based on frequency domain-guided multi-feature attention. By performing frequency domain analysis and reconstruction on the attention weights, it focuses on robust frequency components shared across models, thereby generating more transferable adversarial perturbations that can effectively evade frequency domain defenses.

[0059] The proposed adversarial example generation method based on frequency domain-guided multi-feature attention can solve the following technical problems:

[0060] (1) Addressing the issue of mid-frequency noise affecting transfer success rate. The proposed method introduces frequency domain transformation (such as Fast Fourier Transform, FFT) after generating a multi-scale feature gradient weight map, and suppresses mid-frequency noise components in the weight map through band-stop masking, thereby effectively filtering out model-specific non-robust signals and retaining low-frequency and some high-frequency features shared across models. The resulting adversarial perturbations can focus on destroying the robust feature regions that the target model generally relies on, significantly improving cross-model transferability.

[0061] (2) Addressing the lack of frequency control in spatial domain operations. This invention proposes a method that explicitly constrains and gradually adjusts feature weights in the frequency domain, combined with a cosine annealing strategy to dynamically adjust the bandstop radius. This allows the perturbation energy distribution to gradually expand or contract with each iteration, thus preventing the perturbation from concentrating in a fixed frequency range. This dynamic frequency domain guidance makes the energy distribution of the perturbation more consistent with the frequency characteristics of robustness, enhancing the universality and stability of the attack.

[0062] (3) Addressing the problem of insufficient defense and evasion capabilities. The proposed method, based on frequency domain filtering, further incorporates post-processing techniques such as mild Gaussian smoothing and amplitude clipping, making the generated perturbations present a more natural and continuous structure in the spatial domain, avoiding the formation of abrupt high-frequency patterns. This not only improves the imperceptibility of the perturbations to the human eye, but also reduces the risk of being detected and removed by frequency domain filtering-based defense methods, thereby enhancing the survivability of adversarial examples in real defense environments.

[0063] like Figure 1 As shown, the adversarial example generation method based on frequency domain-guided multi-feature attention proposed in this invention includes:

[0064] Obtain raw image samples;

[0065] The original image samples are iteratively updated to obtain the final adversarial examples; each update process includes:

[0066] Obtain raw image samples;

[0067] The original image samples are used as the initial adversarial samples for the first round of iteration. The original image samples are then updated in multiple rounds. Each round of update includes:

[0068] Calculate the target recognition loss of the initial adversarial sample in this round;

[0069] Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients;

[0070] Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined.

[0071] The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights.

[0072] The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights.

[0073] The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient;

[0074] The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration.

[0075] The last updated adversarial sample will be used as the final adversarial sample.

[0076] In some embodiments, the original image samples are first subjected to preprocessing operations such as normalization and size scaling to obtain standardized images that meet the input requirements of the adversarial sample generation model.

[0077] The preprocessing operations performed on the original image samples specifically include: converting the original image samples into tensors, and normalizing or standardizing the pixel range of [0,255] of the image to control the pixels within [0,1], thereby obtaining a standardized image tensor.

[0078] In some embodiments, the original image sample is used as the initial adversarial sample for the first iteration, and the adversarial sample generation model is used to iteratively update the original image sample to obtain the final adversarial sample. Here, the original image sample is a standardized image.

[0079] The adversarial example generation model and the target recognition model have the same structure, both including multiple feature extraction layers and a classification layer. The multiple feature extraction layers perform multi-scale feature extraction on the initial adversarial examples input to the adversarial example generation model to obtain the feature tensors output on each feature layer. The classification layer recognizes the features extracted by the last feature extraction layer to obtain the target recognition result.

[0080] Specifically, a pre-trained deep neural network is selected as the adversarial example generation model, and L convolutional layers from shallow to deep are pre-specified as feature extraction layers, followed by a classification layer. The initial adversarial sample of this round is input into the adversarial example generation model and propagated forward to extract and save the feature maps of these L specified layers in sequence. The original image sample is used as the initial adversarial sample of the first iteration, and in each subsequent iteration, the adversarial sample obtained in the previous round is used as the initial adversarial sample of the current round.

[0081] In some embodiments, the layer aggregation gradient of the last feature extraction layer is calculated and determined based on the target recognition loss and the multi-scale feature gradient.

[0082] After taking the absolute value of the layer aggregation gradient of the last feature extraction layer, normalization and Gaussian smoothing are performed to obtain the spatial domain feature weights.

[0083] The target recognition loss is the cross-entropy loss. For attacks without a target, the cross-entropy loss formula is used:

[0084] For targeted attacks, the cross-entropy loss formula is used:

[0085]

[0086] in, The classification model represents the classification layer. This refers to the adversarial examples generated during the iterative process. The correct classification label for the original image sample. This indicates the target category that the adversarial sample misclassification model incorrectly classifies.

[0087] Specifically:

[0088] Using a recursive approach, starting from the initial layer ( ) to the designated attack layer (i.e. )Calculate the aggregated gradient of the layer;

[0089] For the initial layer (shallowest layer), the calculation formula is:

[0090]

[0091] For subsequent layers ( (2 to n), the calculation formula is:

[0092]

[0093] in, It is the layer aggregation weight coefficient. It is the first Feature mapping of layers, express The layer aggregate gradient, i.e., the feature gradient at each scale. Indicates calculation Layer feature gradient, This indicates element-wise multiplication.

[0094] For the final attack layer ( ) characteristic gradient The absolute values ​​are then normalized and Gaussian smoothed to obtain the final spatial domain feature weights. The specific formula is as follows:

[0095]

[0096] In some embodiments, the Fast Fourier Transform method is used to perform a frequency domain transformation on the spatial domain feature weights to obtain the frequency domain representation of the spatial domain feature weights.

[0097] Based on the iteration rounds, the band-stop filter mask is calculated and determined using the cosine annealing algorithm.

[0098] The filtered weights are calculated by multiplying the band-stop filter mask with the frequency domain representation of the spatial domain feature weights.

[0099] The frequency domain transformation employs the commonly used two-dimensional fast Fourier transform to obtain the spatial domain feature weights. Convert to the frequency domain to obtain its frequency domain representation. :

[0100]

[0101] in This represents the Fast Fourier Transform.

[0102] Construct a dynamic bandstop mask This mask is used to suppress frequency components in the mid-frequency region while preserving low-frequency and high-frequency components; the frequency boundaries of the mask... and Based on the current iteration round Dynamic adjustments are made using a cosine annealing strategy.

[0103] The formula for the low-frequency dynamic radius function is:

[0104]

[0105] The formula for the high-frequency dynamic radius function is:

[0106]

[0107] in, For the total number of iterations, and A preset frequency radius threshold is used; more high-frequency details are retained in the early stages of iteration, and more low-frequency structures are retained in the later stages. The frequency domain representation is multiplied by a dynamic band-stop mask to complete frequency domain filtering, obtaining the filtered weights. The specific formula is as follows:

[0108]

[0109] In some embodiments, the filtered weights The frequency domain guided weights are obtained by reconstructing the spatial domain using the inverse Fourier transform (IFFT). The specific formula is as follows:

[0110]

[0111] Guide this frequency domain weights and feature gradients Element-wise multiplication and summation are performed to generate the final fused gradient. The specific formula is as follows:

[0112]

[0113] In some embodiments, the sum of all fused gradients from the current update to the previous update is calculated as the cumulative gradient; the initial adversarial sample for the current update is updated based on the cumulative gradient.

[0114] The initial adversarial examples are updated using the momentum algorithm, and gradient clipping is performed. Specifically, this includes: first, the final fused gradient is... conduct Normalization is performed, followed by updating based on historical momentum. The specific formula is as follows:

[0115]

[0116] Where μ is the decay factor of the momentum term. This is the cumulative gradient from the previous iteration.

[0117] Then, the initial adversarial samples for this round... Pruning is performed, and the adversarial examples are updated along the momentum direction to obtain the updated adversarial examples for this round. The specific formula is as follows:

[0118]

[0119] in, This is the adversarial sample updated in round t+1. These are the adversarial samples updated in round t, which are the initial adversarial samples in round t+1. Step size, For the maximum disturbance constraint, This is the clipping function.

[0120] In some embodiments, the iterative update is completed when the maximum number of iterations is reached or the attack is successful, and the final adversarial sample is output, which can then be used to perform a migration attack on the black-box target model.

[0121] The adversarial example generation method based on frequency-guided multi-feature attention (FG-MFAA) proposed in this invention uses the Res-152 model as the adversarial example generation model and selects 1000 images from the ImageNet compatible dataset as original image samples. Specific experiments were conducted on basic models such as Inc-v3, Inc-v4, IncRes-v2, Res-50, Res-152, Vgg-16, and Vgg-19, as well as defensive models such as Adv-Inc-v3, Adv-IncRes-v2, Ens3-Inc-v3, Ens4-Inc-v3, and Ens-IncRes-v2, and the attack success rate was compared with that of several traditional methods.

[0122] Table 1: Attack success rate against the standard model

[0123]

[0124] Table 2: Attack success rate against the defense model

[0125]

[0126] Experimental results show that the success rate is significantly improved compared to traditional Path-wise Attention Map (PAM), Non-local Attention Attack (NAA), and Multi-Feature Attention Attack (MFAA). Regarding the defense model, compared to the current best multi-feature attention attack, improvements of 2.4%, 2.2%, 1.0%, 1.9%, and 1.4% are achieved, respectively. Compared to earlier attention methods, the improvement in transfer success rate is even more significant.

[0127] The adversarial example generation method based on frequency-domain guided multi-feature attention introduces a frequency-domain guidance mechanism. By suppressing mid-frequency noise and dynamically adjusting low- and high-frequency noise, the perturbation is gradually expanded. This not only solves the problem of different receptivity levels corresponding to different dimensions of different depth features in traditional attention mechanisms, but also further addresses the issue that multi-feature attention mechanisms ignore the fact that different frequency components of deep neural networks carry different information. The resulting multi-layer feature weights are output as weighted gradients, which can be superimposed on commonly used gradient descent methods for gradient guidance, more accurately identifying key perturbation points. Furthermore, it can be combined with momentum, translation invariance, and pixel iterative updates to jointly optimize gradient methods and update strategies, demonstrating high applicability. This method is applicable to various mainstream deep learning models and can be effectively applied in tasks such as image classification, detection, and recognition.

[0128] This invention also proposes an adversarial example generation system based on frequency domain-guided multi-feature attention, comprising:

[0129] Image sample acquisition unit, used to acquire original image samples;

[0130] The adversarial sample generation unit is used to take the original image sample as the initial adversarial sample for the first iteration and perform multiple rounds of iterative updates on the original image sample. Each round of update includes:

[0131] Calculate the target recognition loss of the initial adversarial sample in this round;

[0132] Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients;

[0133] Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined.

[0134] The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights.

[0135] The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights.

[0136] The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient;

[0137] The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration.

[0138] The last updated adversarial sample will be used as the final adversarial sample.

[0139] The present invention also discloses a computer device, the device comprising:

[0140] A processor, adapted to execute computer programs;

[0141] A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the adversarial example generation method based on frequency domain-guided multi-feature attention disclosed in Embodiment 1.

[0142] The present invention also discloses a computer-readable storage medium storing a computer program adapted for loading and execution by a processor of the adversarial example generation method based on frequency domain guided multi-feature attention disclosed in Example 1.

[0143] The present invention also discloses a computer program product, which includes a computer program that, when executed by a processor, implements the adversarial example generation method based on frequency domain guided multi-feature attention disclosed in Embodiment 1.

[0144] The method disclosed in Example 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, detailed descriptions are omitted here.

[0145] Those skilled in the art will recognize that the units and algorithm steps described in conjunction with the embodiments herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0146] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. An adversarial example generation method based on frequency domain-guided multi-feature attention, characterized in that, include: Obtain raw image samples; The original image samples are used as the initial adversarial samples for the first round of iteration. The original image samples are then updated in multiple rounds. Each round of update includes: Calculate the target recognition loss of the initial adversarial sample in this round; Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients; Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined. The target recognition loss is the cross-entropy loss. For attacks without a target, the cross-entropy loss formula is used: For targeted attacks, the cross-entropy loss formula is used: in, The classification model represents the classification layer. This refers to the adversarial examples generated during the iterative process. The correct classification label for the original image sample. This represents the target category that the adversarial sample misclassification model misclassifies. The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights. The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights. The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient; The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration. The last updated adversarial sample will be used as the final adversarial sample. Construct a dynamic bandstop mask This mask is used to suppress frequency components in the mid-frequency region while preserving low-frequency and high-frequency components; the frequency boundaries of the mask... and Based on the current iteration round Dynamic adjustments are made using a cosine annealing strategy. The formula for the low-frequency dynamic radius function is: The formula for the high-frequency dynamic radius function is: in, For the total number of iterations, and A preset frequency radius threshold is used; more high-frequency details are retained in the early stages of iteration, and more low-frequency structures are retained in the later stages; the frequency domain representation is multiplied by a dynamic band-stop mask to complete frequency domain filtering, and the filtered weights are obtained. The specific formula is as follows: ; This indicates element-wise multiplication, where M(u,v,t) is the dynamic band-stop filter mask, and t is the current iteration number.

2. The adversarial example generation method based on frequency domain-guided multi-feature attention as described in claim 1, characterized in that, Based on the target recognition loss and multi-scale feature gradient, the layer aggregation gradient of the last feature extraction layer is calculated and determined. After taking the absolute value of the layer aggregation gradient of the last feature extraction layer, normalization and Gaussian smoothing are performed to obtain the spatial domain feature weights.

3. The adversarial example generation method based on frequency domain-guided multi-feature attention as described in claim 2, characterized in that, The target recognition loss is calculated using cross-entropy loss.

4. The adversarial example generation method based on frequency domain-guided multi-feature attention as described in claim 1, characterized in that, The Fast Fourier Transform (FFT) method is used to transform the spatial domain feature weights in the frequency domain, thereby obtaining the frequency domain representation of the spatial domain feature weights. Based on the iteration rounds, the band-stop filter mask is calculated and determined using the cosine annealing algorithm. The filtered weights are calculated by multiplying the band-stop filter mask with the frequency domain representation of the spatial domain feature weights.

5. The adversarial example generation method based on frequency domain-guided multi-feature attention as described in claim 1, characterized in that, Calculate the sum of all fused gradients from the current update to the previous update, and use this as the cumulative gradient; update the initial adversarial sample for this round based on the cumulative gradient.

6. The adversarial example generation method based on frequency domain-guided multi-feature attention as described in claim 1, characterized in that, The iteration update is complete when the maximum number of iterations is reached or the attack is successful, and the final adversarial sample is output.

7. An adversarial example generation system based on frequency domain-guided multi-feature attention, characterized in that, include: Image sample acquisition unit, used to acquire original image samples; The adversarial sample generation unit is used to take the original image sample as the initial adversarial sample for the first iteration and perform multiple rounds of iterative updates on the original image sample. Each round of update includes: Calculate the target recognition loss of the initial adversarial sample in this round; Extract multi-scale features from the initial adversarial sample in this round and calculate the multi-scale feature gradients; Based on the target recognition loss and multi-scale feature gradient, the spatial domain feature weights are calculated and determined. The target recognition loss is the cross-entropy loss. For attacks without a target, the cross-entropy loss formula is used: For targeted attacks, the cross-entropy loss formula is used: in, The classification model represents the classification layer. This refers to the adversarial examples generated during the iterative process. The correct classification label for the original image sample. This represents the target category that the adversarial sample misclassification model misclassifies. The frequency domain feature weights are obtained by performing frequency domain transformation on the spatial domain feature weights, and the frequency domain feature weights are guided and corrected by band-stop filtering and cosine annealing algorithms to obtain the filtered weights. The filtered weights are reconstructed back into the spatial domain to obtain frequency domain guided weights. The frequency domain guided weights are multiplied and fused with the multi-scale feature gradients to obtain the fused gradient; The initial adversarial samples in this round are updated by fusing gradients to obtain the updated adversarial samples, which are then used as the initial adversarial samples for the next iteration. The last updated adversarial sample will be used as the final adversarial sample. Construct a dynamic bandstop mask This mask is used to suppress frequency components in the mid-frequency region while preserving low-frequency and high-frequency components; the frequency boundaries of the mask... and Based on the current iteration round Dynamic adjustments are made using a cosine annealing strategy. The formula for the low-frequency dynamic radius function is: The formula for the high-frequency dynamic radius function is: in, For the total number of iterations, and A preset frequency radius threshold is used; more high-frequency details are retained in the early stages of iteration, and more low-frequency structures are retained in the later stages; the frequency domain representation is multiplied by a dynamic band-stop mask to complete frequency domain filtering, and the filtered weights are obtained. The specific formula is as follows: ; This indicates element-wise multiplication, where M(u,v,t) is the dynamic band-stop filter mask, and t is the current iteration number.

8. An electronic device, characterized in that, The device includes: A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements the adversarial example generation method based on frequency domain-guided multi-feature attention as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted for loading by a processor and executing the adversarial example generation method based on frequency domain guided multi-feature attention as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the adversarial example generation method based on frequency domain-guided multi-feature attention as described in any one of claims 1-6.

Images