An adversarial attack method fusing frequency domain information and dynamic gradient smoothing

Abstract

This invention discloses an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing, comprising: inputting the original image to be processed and preset parameters into a computer system; the computer system processor executing a computer program to perform discrete wavelet transform on the original image, and after adding sampling noise, calculating the average frequency domain gradient and global momentum gradient through inverse transform, fusing them, and updating the adversarial sample to the pre-convergence iteration number to obtain the initial global momentum; performing formal iteration based on the initial global momentum to obtain the gradient of the current step, and determining whether the gradient oscillates; if it oscillates, activating the gradient smoothing module for smoothing; otherwise, directly using the current gradient; adding noise to the smoothed gradient to the current image and cropping pixel values ​​to complete the iteration; and outputting the final adversarial sample. This invention solves the problems of insufficient feature diversity in the GI method and inaccurate direction in the later stages of traditional gradient update methods, thereby generating adversarial samples with stronger offensive and transferability.

Description

Technical Field

[0001] This invention belongs to the fields of artificial intelligence security and computer vision, and relates to a black-box adversarial attack method for deep neural networks to improve the transferability of adversarial samples, and in particular to an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing. Background Technology

[0002] Deep neural networks (DNNs) excel in computer vision tasks such as image classification and object detection, supporting critical scenarios like autonomous driving and facial recognition payment. However, they are susceptible to being misled by "adversarial examples." These examples, by adding minute perturbations imperceptible to the human eye, can induce the model to output incorrect results, posing a danger to security-sensitive fields. In real-world attack scenarios, attackers often struggle to obtain the parameters of the target model (i.e., black-box scenarios). Therefore, generating highly transferable adversarial examples (i.e., generated on an alternative model that can successfully attack other unknown models) has become a core research direction.

[0003] To improve transferability, the Global Momentum Initialization (GI) method is representative. It establishes a "pre-convergence" phase before the formal attack to optimize the initial momentum, effectively alleviating the instability of direction in the early stages of iteration in traditional momentum methods, thus improving the transferability of adversarial examples. However, this method has significant limitations: First, it lacks feature diversity, relying solely on a single-dimensional gradient in the spatial domain, making it prone to getting trapped in local optima and failing to capture vulnerable features shared by multiple models. Second, the gradient update direction is inaccurate, with gradients prone to oscillation in the later stages of iteration. Furthermore, GI, like other mainstream methods, relies on the sign function, losing the magnitude and direction information of the gradient, crudely mapping all small positive gradient values ​​to 1, thus losing the magnitude and precise direction information of the gradient, leading to reduced attack efficiency and a tendency to get trapped in local optima.

[0004] Existing improvement schemes remain limited by the sign function and require extensive experiments to determine fixed attenuation parameters, lacking adaptability and failing to fundamentally solve the problem. Despite continuous research, significant technical shortcomings persist. For example, the invention patent application (CN118865012A) discloses a highly covert adversarial attack method, which still suffers from two technical limitations: first, frequency domain information is only enhanced using input samples, which is deeply integrated in gradient updates and cannot address the insufficient diversity of GI characteristics; second, gradient updates rely on traditional averaging strategies and lack a dynamic smoothing mechanism for oscillations in the later stages of iteration, leaving room for improvement in attack efficiency and transfer stability in black-box scenarios.

[0005] In summary, in order to address the shortcomings and technical problems in the existing technologies, it is urgent to design an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing. Summary of the Invention

[0006] The main objective of this invention is to provide an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing. This method aims to address the limitations of existing global momentum initialization methods, such as insufficient feature diversity, inaccurate gradient update direction, and other existing technical solutions. By introducing frequency domain information to supplement features and using dynamic gradient smoothing to replace the sign function, the adversarial sample transferability is improved. This method is suitable for image classification model attacks in black-box scenarios.

[0007] Based on the first main aspect of the present invention, an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing is provided, comprising the following steps:

[0008] Input the original image to be processed into the computer system, as well as the preset number of pre-convergence iterations, the number of formal convergence iterations, and the number of frequency domain noisy samplings;

[0009] The computer system processor executes a computer program to perform discrete wavelet transform on the original image, and after adding sampling noise, performs inverse discrete wavelet transform to calculate the average frequency domain gradient, which is then fused with the global momentum gradient to update the adversarial sample to the pre-convergence iteration number to obtain the initial global momentum.

[0010] The computer system processor executes a computer program to perform formal convergence iteration based on the initial global momentum to obtain the gradient of the current step, and determines whether the gradient has oscillations; if the oscillations exist, the gradient smoothing module is activated to perform smoothing processing; if the oscillations do not exist, the current gradient is used directly.

[0011] The noise of the smoothed gradient is added to the input image of this formal convergence iteration and the pixel values ​​are cropped to complete this formal convergence iteration.

[0012] The computer system processor executes a computer program, repeats the formal convergence iteration up to the formal convergence iteration number, and outputs the final adversarial example.

[0013] As a further preferred embodiment, in the aforementioned method, the sampling noise is obtained from a set uniformly distributed range, and the number of samplings is equal to the number of frequency domain noisy samplings. The noise is then added sequentially to the result of the discrete wavelet transform before the inverse discrete wavelet transform is performed.

[0014] As a further preferred embodiment, in the aforementioned method, the fusion of the average frequency domain gradient and the global momentum gradient specifically includes: obtaining the global momentum gradient through momentum iteration; calculating the cosine similarity between the average frequency domain gradient and the global momentum gradient to obtain the correlation between the two; using the correlation as a dynamic weight to adaptively fuse the two gradients; and then updating the adversarial sample with a set exploration step size.

[0015] As a further preferred embodiment, in the aforementioned method, the step of performing formal convergence iteration based on the initial global momentum and determining whether the gradient oscillates specifically includes:

[0016] The initial global momentum is iterated through the standard momentum iteration method until the formal convergence iteration number is reached. The global momentum gradient of the current step is calculated, and it is determined whether there is an oscillation with the previous gradient direction. If the oscillation exists, the gradient smoothing module is activated, and the Scaled HardTanh function is used to smooth the current global momentum gradient.

[0017] As a further preferred embodiment, in the aforementioned method, the Scaled HardTanh function is:

[0018]

[0019] in, It is the Hadamard Product. This represents the gradient vector to be smoothed. It is a scaling constant. For symbolic functions, This indicates standardized operation. This represents the smoothing mapping function performed on the standardized results. This represents the logarithmic hash operation on the gradient vector to be smoothed.

[0020] As a further preferred embodiment, in the aforementioned method, the determination of whether the gradient oscillation exists is achieved by comparing the sign of the currently calculated global momentum gradient with that of the previously calculated global momentum gradient. If the signs are different, it is determined that oscillation exists; if the signs are the same, it is determined that oscillation does not exist.

[0021] As a further preferred embodiment, in the aforementioned method, the gradient smoothing module includes performing a nonlinear transformation on the global momentum gradient with oscillations using a logarithmic function to obtain the hashed gradient value, eliminating the dimension by Z-score normalization, and then truncating and smoothing the gradient.

[0022] As a further preferred option, in the aforementioned method, the Z-score standardization to eliminate dimensions involves performing Z-score standardization on the hashed gradient values ​​to make them conform to a standard distribution with a mean of 0 and a variance of 1.

[0023] As a further preferred embodiment, in the aforementioned method, the smoothing mapping includes truncating the interval of the standardized gradient value order and then strictly mapping it to the interval through a linear transformation.

[0024] Based on a second key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed, implements the aforementioned adversarial attack method for fusing frequency domain information and dynamic gradient smoothing.

[0025] Compared with the prior art, the present invention effectively solves the problem of insufficient feature diversity in the existing Global Momentum Initialization (GI) method. This is due to the design of the Frequency Domain Enhanced Global Gradient Calculation Framework (FEGA), which performs frequency domain sampling on the image through discrete wavelet transform, breaking through the limitation of traditional methods that only rely on spatial domain gradients and successfully extracting additional frequency domain feature gradients.

[0026] Simultaneously, by calculating the cosine similarity between the average frequency domain gradient and the global momentum gradient, and using this correlation as a dynamic weight, the two are adaptively fused. This ensures that the generated global optimization gradient retains the overall update trend while incorporating diverse features from the frequency domain dimension. Combined with the large exploration step size update in the pre-convergence phase, this framework helps attacks escape local optima, providing a more stable initial global momentum for subsequent formal convergence iterations, thus fundamentally compensating for the limitation of feature singularity on attack effectiveness.

[0027] Secondly, this invention addresses the inaccuracy of traditional gradient update methods in the later stages of iteration by designing a dynamic gradient smoothing mechanism. By comparing the sign of the previous global momentum gradient, it accurately determines oscillations and activates the smoothing module only during oscillations. The Scaled HardTanh function is used, which preserves the original gradient direction information and generates accurate amplitudes based on the gradient value distribution. This overcomes the problem of losing details in traditional sign functions and is more effective than methods such as reducing step size and segmented weights. It also has no additional time overhead, balancing gradient update accuracy and attack efficiency.

[0028] Finally, this invention significantly improves the aggressiveness and transferability of adversarial examples through the collaborative design of pre-convergence iteration and formal convergence iteration. The pre-convergence stage establishes high-quality initial momentum using the FEGA framework, while the formal convergence iteration stage is based on standard momentum iteration, combined with a dynamic gradient smoothing module to accurately correct oscillating gradients, forming a "preliminary exploration - later precise adjustment" process. This addresses the problems of insufficient feature diversity and inaccurate gradient direction, enabling samples to possess both feature richness suitable for multiple models and accurate gradient direction, achieving a dual improvement far exceeding traditional solutions. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0030] Figure 1 The following is a flowchart illustrating the execution of an adversarial attack method that fuses frequency domain information and dynamic gradient smoothing, according to an embodiment of the present invention.

[0031] Figure 2 The flowchart of an adversarial attack method that integrates frequency domain information and dynamic gradient smoothing in one embodiment of the present invention is shown, demonstrating the two core stages of pre-convergence iteration and formal convergence iteration. Detailed Implementation

[0032] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0033] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0034] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0035] The specific meanings of the technical terms, English abbreviations, and letters that may be used in this invention are explained below:

[0036] GI: Global Momentum Initialization;

[0037] X: The original image from which the adversarial example is to be generated;

[0038] Adversarial examples;

[0039] t: Number of iterations;

[0040] P: Number of pre-convergence iterations;

[0041] T: Total number of iterations during the formal attack phase;

[0042] N: Number of frequency domain samplings with noise;

[0043] J: Loss function;

[0044] Noise distribution parameters;

[0045] Discrete Wavelet Transform (DWT): A multi-resolution signal processing method that decomposes a signal into components of different frequencies by discretizing the scale and translation parameters of the wavelet basis, while also possessing time-frequency localization characteristics.

[0046] like Figure 1 As shown, in one embodiment of the present invention, an adversarial attack method that fuses frequency domain information and dynamic gradient smoothing includes the following steps S110-S150:

[0047] S110, input the original image to be processed into the computer system, as well as the preset number of pre-convergence iterations, the number of formal convergence iterations, and the number of frequency domain noisy samplings;

[0048] S120, the computer system processor executes a computer program to perform discrete wavelet transform on the original image, and after adding sampling noise, performs inverse discrete wavelet transform to calculate the average frequency domain gradient, and then fuses it with the global momentum gradient to update the adversarial sample to the pre-convergence iteration number to obtain the initial global momentum.

[0049] S130, the computer system processor executes a computer program to perform formal convergence iteration based on the initial global momentum to obtain the gradient of the current step, and determines whether the gradient has oscillations; if the oscillations exist, the gradient smoothing module is activated to perform smoothing processing; if the oscillations do not exist, the current gradient is used directly.

[0050] S140, add the noise of the smoothed gradient to the current image and crop the pixel values ​​to complete the formal convergence iteration;

[0051] S150, the computer system processor executes the computer program, repeats the formal convergence iteration up to the formal convergence iteration number, and outputs the final adversarial example.

[0052] Specifically, in one embodiment, the computer system includes hardware components and software functions.

[0053] The hardware components include a processor, volatile memory, non-volatile memory, and input / output interfaces.

[0054] The software functions include an input parsing module, a frequency domain processing module, a gradient processing module, an iterative control module, and a sample update module. Its hardware supports the computational power requirements of this invention, and its software adapts to the entire process of this invention, ensuring the algorithm's high efficiency and feasibility.

[0055] In one embodiment, the present invention designs a Frequency-Enhanced Global Gradient Attack (FEGA) framework. The core idea of ​​this framework is to introduce a frequency domain information dimension orthogonal to the spatial domain, and through the synergistic effect of multi-domain features, generate an initial momentum with more diverse features and stronger generalization ability.

[0056] Existing global momentum (GI) attack methods rely on a pre-convergence phase to find a better initial momentum direction. However, this method suffers from a fundamental flaw: its gradient information is entirely limited to the spatial domain of the image. This single-dimensional information accumulation makes the attack process prone to overfitting to specific spatial features (such as texture and local shape) of the surrogate model. Consequently, while the generated adversarial perturbation may be effective on the surrogate model, its effectiveness diminishes significantly when transferred to target models with different structures. To generate truly transferable adversarial examples, perturbations need to attack more low-level and general feature representations of the model.

[0057] Combination Figure 2 As shown, the adversarial attack method process that integrates frequency domain information and dynamic gradients is illustrated, which is divided into two core stages: pre-convergence iteration and formal convergence iteration.

[0058] Among the following possible implementations, the frequency domain enhanced global gradient calculation framework (pre-convergence stage) of the present invention will be described in detail below;

[0059] First, this invention performs frequency domain sampling on the image to obtain the frequency domain gradient. Specifically, for the current iteration of adversarial examples... Discrete Wavelet Transform (DWT) is applied. DWT is chosen because it provides image decomposition across multiple scales and directions, effectively capturing local features at different frequencies, which are often more consistent across different models than high-level spatial features. To ensure the stability and robustness of the frequency domain gradient, we perform N noisy samplings in the frequency domain and calculate the average gradient, a process that can be expressed as:

[0060]

[0061] in, From uniform distribution The noise in the mid-sample, IDWT is the inverse discrete wavelet transform, x represents the original image, and y represents the true label corresponding to the original image.

[0062] Specifically, the loss function : ,in, This represents the image after noise reduction processing. This represents the total number of categories in the classification task, and k represents the index of each category in the classification task. Represents the one-hot encoded components of the actual label. This represents the probability that the image after noise processing belongs to the k-th class.

[0063] The purpose of this step is to conduct a small-scale exploration in the frequency domain space to simulate the possible differences in frequency domain decision boundaries between different models.

[0064] At the same time, we calculate the global momentum gradient for the current round using the standard momentum iteration method. This calculation method inherits the core ideas from MI-FGSM and GI, aiming to accumulate historical gradient directions to stably update trends:

[0065]

[0066] in, As the momentum factor, in obtaining the frequency domain gradient and global momentum gradient Subsequently, this invention utilizes a global gradient calculation framework to dynamically fuse the two. The core of this framework is an adaptive arbitration mechanism that calculates the correlation R between the two through cosine similarity, thereby quantifying the consistency between the spatial domain gradient trend and the frequency domain feature gradient direction in real time.

[0067]

[0068] The correlation R is used as a dynamic weight to adaptively fuse the two gradients, generating the final global optimization gradient G′:

[0069]

[0070] The principle behind this multi-domain collaborative mechanism is as follows: when the global momentum direction is highly consistent with the attack direction revealed by the frequency domain features (R value close to 1), it indicates that the current attack direction is robust and effective. In this case, the formula assigns a higher weight to the global momentum g to reinforce this trend. Conversely, when there is a significant divergence between the two directions (R value is low), it indicates that relying solely on the spatial domain gradient may have led to a local optimum. In this case, the formula is based on the frequency domain gradient. Higher weights allow for the use of diverse feature information to refine and enrich attack strategies.

[0071] Finally, at each step of pre-convergence, we update the adversarial example with a larger exploration step size factor S. Since the fused gradient G′′ is of higher quality and more reliable in direction, we can confidently use a larger step size for exploration, enabling the attack process to escape shallow local optima and find a path to the global optimum in a broader parameter space.

[0072] In the later iterations of gradient attacks, the adversarial example is very close to the decision boundary. At this point, the gradient value usually becomes very small, and its direction changes frequently, i.e., gradient oscillation. Traditional attack methods, such as MI-FGSM and GI, all employ sign functions. The sign function is used to determine the update direction. It acts as a "blunt tool," treating any gradient value greater than zero (whether 1e-5 or 100) as 1, completely losing information about the gradient's magnitude. This loss of information is fatal in later iterations, causing the update step size to remain at its maximum (determined by the step size α), resulting in repeated "hopping" around the decision boundary and difficulty converging to the optimal position. Existing techniques like GRA mitigate this problem by reducing the step size and staircase by using piecewise weights, but these are essentially stopgap measures because they still rely on the coarse direction provided by the sign function.

[0073] As one possible implementation, the following embodiments illustrate the adversarial attack method for dynamic gradient smoothing (formal attack phase);

[0074] This invention introduces a dynamic gradient smoothing method. Its core advantages lie in selective intervention and high-precision gradient approximation.

[0075] This method first establishes a dynamic activation mechanism. In each iteration of the formal attack, the current momentum is compared... Compared to the previous momentum The sign of the gradient is used to determine whether oscillations have occurred in the gradient direction. In the early stages of iteration when the direction is stable, no intervention is performed, and the traditional method is used directly. The function is updated to maintain its advantage of quickly approximating the target class. Once an oscillation in the gradient direction is detected... If this is the case, the gradient smoothing module is activated. The function of this module... The definition is as follows:

[0076]

[0077] in, This represents the Hadamard Product, also known as the element-wise product or element-level product. This represents the gradient vector to be smoothed. It is a scaling constant. For symbolic functions, This indicates standardized operation. This represents the output of the dynamic activation mechanism. This represents the smoothing mapping function performed on the standardized results. This represents the logarithmic hash operation on the gradient vector to be smoothed. The Hadamard product is an operation performed on two matrices (or vectors, tensors) with identical dimensions. The result is a new matrix with the same dimensions as the original matrices, where each element of the new matrix is ​​the product of corresponding elements in the original two matrices.

[0078] This process strictly follows a carefully designed three-step procedure, aiming to transform the original, noisy gradient vector into a smooth and information-rich update vector:

[0079] Gradient Hashing:

[0080]

[0081] Drawing inspiration from the FGRM, we find that the distribution of the original gradient values ​​is usually very compact. This step uses a logarithmic function to perform a nonlinear transformation on the absolute value of the gradient. Its function is to "stretch" the dynamic range of the gradient, mapping the originally crowded small gradient values ​​(such as 1e-5 to 1e-3) to a wider range, making their relative magnitude relationship more significant, and providing better input for subsequent standardization and mapping.

[0082] Normalization:

[0083]

[0084] in, This represents the gradient value after preprocessing. This represents the mean of the gradient values. This represents the standard deviation of the gradient value;

[0085] The hashed gradient values ​​are Z-score standardized to follow a standard distribution with a mean of 0 and a variance of 1. This aims to eliminate the influence of gradient dimensions and ensure that the subsequent Scaled HardTanh function works within its most sensitive and efficient linear interval.

[0086] Smoothing Mapping:

[0087]

[0088] This invention innovatively employs a scaled and shifted hardTanh function for the final smooth mapping. This function is a piecewise linear approximation of the standard hyperbolic tangent function (tanh), and its basic form, HardTanh(z), truncates the input at... The interval, then through linear transformation Map it strictly to Interval.

[0089] Compared to computationally expensive exponential functions like the sigmoid, Scaled HardTanh involves only basic comparisons, additions, and multiplications, making it extremely efficient with almost no additional overhead. It smoothly maps standardized gradient values ​​to... The interval generates a "proportional weight" that accurately reflects the relative magnitude of the original gradient.

[0090] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0091] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. An adversarial attack method that integrates frequency domain information and dynamic gradient smoothing, characterized in that, Includes the following steps: Input the original image to be processed into the computer system, as well as the preset number of pre-convergence iterations, the number of formal convergence iterations, and the number of frequency domain noisy samplings; The computer system processor executes a computer program to perform discrete wavelet transform on the original image, and after adding sampling noise, performs inverse discrete wavelet transform to calculate the average frequency domain gradient, which is then fused with the global momentum gradient to update the adversarial sample to the pre-convergence iteration number to obtain the initial global momentum. The computer system processor executes a computer program to perform formal convergence iteration based on the initial global momentum to obtain the gradient of the current step, and determines whether the gradient has oscillations; if the oscillations exist, the gradient smoothing module is activated to perform smoothing processing; if the oscillations do not exist, the current gradient is used directly. The noise from the smoothed gradient is added to the current image and the pixel values ​​are cropped to complete this formal convergence iteration. The computer system processor executes a computer program, repeats the formal convergence iteration up to the formal convergence iteration number, and outputs the final adversarial example; Obtaining the frequency domain gradient and global momentum gradient Then, a global gradient calculation framework is used to dynamically fuse the two. The core of this framework is an adaptive arbitration mechanism that calculates the correlation R between the two through cosine similarity to quantify the consistency between the spatial domain gradient trend and the frequency domain feature gradient direction in real time. The correlation R is used as a dynamic weight to adaptively fuse the two gradients, generating the final global optimization gradient G′: The step of performing formal convergence iteration based on the initial global momentum and determining whether gradient oscillations exist specifically includes: The initial global momentum is iterated through the standard momentum iteration method until the formal convergence iteration number. The global momentum gradient of the current step is calculated, and it is determined whether there is an oscillation with the previous gradient direction. If such an oscillation exists, the gradient smoothing module is activated, and the Scaled HardTanh function is used to smooth the current global momentum gradient. The Scaled HardTanh function is: in, For Hadama accumulation, This represents the gradient vector to be smoothed. It is a scaling constant. For symbolic functions, This indicates standardized operation. This represents the output of the dynamic activation mechanism. This represents the smoothing mapping function performed on the standardized results. This represents the logarithmic hash operation on the gradient vector to be smoothed. The determination of whether the gradient has oscillations is achieved by comparing the sign of the currently calculated global momentum gradient with that of the previously calculated global momentum gradient. If the signs are different, it is determined that there is an oscillation; if the signs are the same, it is determined that there is no oscillation. The gradient smoothing module includes performing a nonlinear transformation on the oscillating global momentum gradient using a logarithmic function to obtain a hashed gradient value, eliminating the dimension by Z-score standardization, and then truncating and smoothing the gradient.

2. The adversarial attack method for fusing frequency domain information and dynamic gradient smoothing according to claim 1, characterized in that, The sampling noise is obtained from a set uniformly distributed range, and the number of samplings is equal to the number of frequency domain noisy samplings. The sampling noise is added to the result of the discrete wavelet transform in sequence, and then the inverse discrete wavelet transform is performed.

3. The adversarial attack method for fusing frequency domain information and dynamic gradient smoothing according to claim 1, characterized in that, The Z-score standardization to eliminate dimensions involves performing Z-score standardization on the hashed gradient values ​​to make them conform to a standard distribution with a mean of 0 and a variance of 1.

4. The adversarial attack method for fusing frequency domain information and dynamic gradient smoothing according to claim 1, characterized in that, The smoothing mapping includes truncating the normalized gradient order. The interval is then mapped strictly to using a linear transformation. Interval.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the adversarial attack method for fusing frequency domain information and dynamic gradient smoothing as described in any one of claims 1 to 4.

Images