Method, device, medium and system for evaluating robustness of model based on frequency domain sparsification query

Abstract

The application discloses a model robustness evaluation method and device based on frequency domain sparsification query, a medium and a system, and belongs to the model evaluation field.The method comprises the following steps: establishing an initial adversarial sample image, acquiring noise with perceptual characteristics in the process of establishing the initial adversarial sample; globally compressing the initial adversarial sample; locally compressing the globally compressed noise, decomposing the image into multiple regions in the local compression process, independently compressing each region, converting a high-dimensional optimization problem into a parallel sub-problem which is directly verified by a target model query, and processing the noise in the multiple regions respectively to make it converge under a limited query budget; and obtaining a final noise and a final adversarial sample by repeatedly executing the local compression stage until the number of queries is exhausted.The application can improve the efficiency of the security evaluation algorithm, reduce the evaluation cost, and enhance the evaluation strength.

Description

Technical Field

[0001] This invention relates to the field of model evaluation, and more specifically, to a method, apparatus, medium, and system for evaluating model robustness based on frequency domain sparse query. Background Technology

[0002] With the widespread application of machine learning (ML) technology in security-sensitive fields such as autonomous driving, financial risk control, and identity authentication, the robustness and security of models have become key considerations. Adversarial attacks are a core method for evaluating model robustness, among which hard-label adversarial attacks best fit real-world application scenarios and are an important tool for industry to conduct model security testing.

[0003] Currently, the industry typically employs benchmark black-box attack algorithms to perform such security assessments, such as BoundaryAttack, HopSkipJumpAttack (HSJA), GeoDA, and TriangleAttack. However, the inherent technical limitations of most current methods severely restrict the efficiency and effectiveness of security assessments.

[0004] First, the evaluation cycle is too long, making rapid screening impossible. This is reflected in the low efficiency of attack method queries, and the significant time required to complete robustness tests on a single model or input sample. For example, the initial phase of BoundaryAttack is extremely inefficient, resulting in a slow evaluation startup; while HSJA's binary search mechanism incurs high query costs with each iteration. This makes rapid security screening for large model sets or scenarios requiring frequent testing impractical.

[0005] Secondly, the evaluation costs are high, making large-scale application difficult. API calls targeting business models often incur costs, and a large number of queries directly translates into high costs for calling the target model's API. For commercial cloud AI services that charge per query, conducting a comprehensive security evaluation using existing methods would incur prohibitive economic costs, thus limiting the scale and frequency of evaluations.

[0006] Furthermore, the assessment results are distorted and fail to accurately reflect real threats. This is because adversarial examples generated by existing methods often have excessive perturbations (such as excessively high L2 norms), making them easily distinguishable to the human eye. Using these unobtrusive "crude" examples to evaluate the model cannot realistically simulate high-end threats composed of subtle perturbations in the real world, leading to overly optimistic assessment reports that fail to uncover deeper security vulnerabilities in the model. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a model robustness evaluation method, device, medium and system based on frequency domain sparse query, which can improve the efficiency of security evaluation algorithms, reduce evaluation costs and enhance evaluation strength.

[0008] The objective of this invention is achieved through the following solution:

[0009] A robustness evaluation method for a model based on frequency domain sparse query, comprising the following steps:

[0010] Establish initial adversarial sample images, and acquire noise with perceptual characteristics during the process of establishing initial adversarial samples;

[0011] The initial adversarial sample is globally compressed. During the global compression process, a binary search method is used to accurately measure the critical scaling factor that just makes the target model fail. This critical scaling factor is used as the global compression factor. The initial range and value of the global compression factor are set. The value of the global compression factor is dynamically updated by querying the target model to check the adversarial nature of the globally compressed image sample.

[0012] The globally compressed noise is locally compressed. During the local compression process, the image is decomposed into multiple regions, and each region is compressed independently. The high-dimensional optimization problem is transformed into a parallel sub-problem that can be directly verified by querying the target model. The noise is processed separately in the multiple regions so that it converges under a limited query budget.

[0013] By repeatedly performing the local compression phase until the number of queries is exhausted, the final noise and the final adversarial example are obtained.

[0014] Furthermore, the establishment of the initial adversarial sample image includes the following sub-steps: frequency optimization initialization, and obtaining the initial adversarial sample by crossing the decision boundary through perceptual modulation based on discrete cosine transform and multi-scale search localization with minimum query cost.

[0015] Furthermore, the establishment of the initial adversarial sample image also includes a perturbation generation process: constructing a perturbation in the discrete cosine transform domain, and selectively modulating the selected frequency components using a frequency band selection mask; the scale of the perturbation changes dynamically according to the search process, and coarse search and fine search are performed by scaling up and down the scale respectively, so as to achieve bidirectional and controllable multi-scale exploration.

[0016] Furthermore, the initial range of the global compression factor is (0,1]; the global compression factor is used to uniformly compress the disturbance to obtain the compressed noise.

[0017] Furthermore, regarding the value of the global compression factor, the dynamic updating of the global compression factor includes the following sub-steps:

[0018] Set the range during initialization In each iteration, the midpoint is calculated. :

[0019] ;

[0020] Using the midpoint Generate candidate samples:

[0021] ;

[0022] in, This represents the selected sample from the initial adversarial examples. This indicates the noise corresponding to the selected sample;

[0023] Subsequently, the target model was queried for verification. Adversarial: If the target model is successfully misled, the compression is successful, and the update is performed. Otherwise update This iterative process continues until the interval length is lower than the preset threshold or the maximum number of iterations is reached.

[0024] Furthermore, the process of decomposing the image into multiple regions during local compression, with each region compressed independently, transforms the high-dimensional optimization problem into a parallel sub-problem that can be directly verified through querying the target model. This process specifically includes the following sub-steps:

[0025] A random geometric strategy is used to generate local regions. A binary mask is used to define the geometric regions on the image. The mask is broadcast along the channel dimension and applied to the perturbation tensor, thereby transforming the high-dimensional optimization problem into a parallel subproblem that can be directly verified by querying the target model. The compression operation of each local region depends only on the current global perturbation and the binary mask of that local region.

[0026] Furthermore, the geometric region includes circular primitives, elliptical primitives, and irregular patches.

[0027] A model robustness evaluation device based on frequency domain sparse query, comprising:

[0028] The initial adversarial sample image establishment module is used to establish initial adversarial samples and acquire noise with perceptual characteristics during the process of establishing initial adversarial samples.

[0029] The first processing module is used to perform global compression on the initial adversarial sample. During the global compression process, a binary search method is used to accurately measure the critical scaling factor that just causes the target model to fail. This critical scaling factor is used as the global compression factor. The value of the global compression factor is dynamically updated by querying the target model to check the adversarial nature of the globally compressed sample.

[0030] The second processing module is used to locally compress the globally compressed noise. During the local compression process, the image is decomposed into multiple regions, and each region is compressed independently. The high-dimensional optimization problem is transformed into a parallel sub-problem that can be directly verified by querying the target model. The noise is processed in each of the multiple regions to make it converge under a limited query budget. By repeatedly executing the local compression stage until the number of queries is exhausted, the final noise and the final adversarial example are obtained.

[0031] A computer-readable storage medium storing a computer program that, when loaded by a processor, executes an initial adversarial example image establishment module, and / or a first processing module, and / or a second processing module in the model robustness evaluation device based on frequency domain sparse query as described above.

[0032] A model robustness evaluation system based on frequency domain sparse query includes a model robustness evaluation device, which adopts the model robustness evaluation device based on frequency domain sparse query as described above.

[0033] The beneficial effects of this invention include:

[0034] This invention demonstrates significant technical advantages in the robustness evaluation of deep learning models through innovative frequency-domain perceptual initial noise generation, dynamic multi-scale search mechanism, and global and local two-level compression strategy. It improves evaluation efficiency, optimizes evaluation accuracy, highlights universality and generalization ability, and also has the advantages of perceptual friendliness and strong practicality.

[0035] Specifically, the significant improvement in evaluation efficiency stems from the adoption of a frequency-domain-aware noise generation strategy, which can quickly pinpoint the model's weaknesses in response to perceptually sensitive perturbations. Compared to traditional boundary search methods, this reduces unnecessary random searches. By dynamically adjusting the perturbation scale, it significantly reduces the number of model queries required to achieve the same evaluation accuracy while maintaining evaluation effectiveness. This efficient query scheme enables the robustness evaluation of more models to be completed within the same timeframe, making it particularly suitable for large-scale model testing and rapid safety screening before deployment.

[0036] In terms of dual optimization of evaluation accuracy, synergistic optimization has been achieved in two core metrics: success rate (attack effectiveness) and perturbation concealment (L2 norm). The optimization to ensure high success rate is achieved through frequency-domain-aware initial noise design, ensuring that the generated test samples can effectively trigger model defects and maintain a success rate close to or reaching the optimal level on various complex datasets. The optimization of low perturbation norm is achieved through an innovative two-level compression mechanism, which can compress the perturbation amplitude to a minimum without affecting the success rate. The generated test samples are visually closer to the original samples, meeting the strict concealment requirements in actual deployment scenarios.

[0037] It demonstrates outstanding universality and generalization ability, exhibiting excellent performance across multiple datasets and maintaining stable evaluation performance for different types of deep learning models. This stable performance across datasets and models proves that the proposed method has good generalization ability and can serve as a standardized model robustness evaluation tool.

[0038] In terms of enhanced perception and practicality, frequency domain filtering technology concentrates the generated test samples primarily in the low-frequency region, where the human visual system is relatively insensitive, making disturbances more natural and difficult to detect. This perception-friendly characteristic not only enhances the practical significance of the test but also allows the evaluation results to better reflect the model's true safety status in real-world applications. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating the overall steps of the method in an embodiment of the present invention;

[0041] Figure 2 This is a comparison diagram of the effects of the method of the present invention and the prior art. Detailed Implementation

[0042] All features disclosed in all embodiments of this specification, or steps in all methods or processes implied in the disclosure, may be combined and / or extended or replaced in any way, except for mutually exclusive features and / or steps.

[0043] The specific implementation process of this invention is as follows:

[0044] like Figure 1 As shown, in a preferred embodiment, a model robustness evaluation method based on frequency domain sparse query is provided, including the following steps:

[0045] Establish initial adversarial sample images, and acquire noise with perceptual characteristics during the process of establishing initial adversarial samples;

[0046] The initial adversarial sample is globally compressed. During the global compression process, a binary search method is used to accurately measure the critical scaling factor that just causes the target model to fail. This critical scaling factor is used as the global compression factor. The value of the global compression factor is dynamically updated by querying the target model to check the adversarial nature of the globally compressed image sample.

[0047] The globally compressed noise is locally compressed. During the local compression process, the image is decomposed into multiple regions, and each region is compressed independently. The high-dimensional optimization problem is transformed into a parallel sub-problem that can be directly verified by querying the target model. The noise is processed separately in the multiple regions so that it converges under a limited query budget.

[0048] By repeatedly performing the local compression phase until the number of queries is exhausted, the final noise and the final adversarial example are obtained.

[0049] This embodiment provides a systematic framework for evaluating model robustness in the field, which comprehensively evaluates the robustness of a model in adversarial environments by generating test samples that are difficult for the human visual system to detect.

[0050] In other embodiments, based on the above embodiments, the entire process further includes the following three steps:

[0051] Step S1, initial noise generation.

[0052] This step aims to generate initial robustness test samples. In this invention, these samples are required to possess the perceptual characteristics of the human visual system in the frequency domain, selectively enhancing low frequencies and suppressing high frequencies to obtain noise with perceptual characteristics. To simulate the human visual system's greater sensitivity to low-frequency signals, the following frequency domain selection mask is designed:

[0053] ;

[0054] Where (u,v) represents the frequency coordinates, Ω band Used to specify a target frequency region, in this embodiment of the invention, it may specifically refer to a low-frequency region, which is defined as:

[0055] ;

[0056] Where H represents height and W represents width, This represents the scaling factor. The formula defines a rectangular region of size (αH×αW) in the DCT (Discrete Cosine Transform) coefficient matrix, with the origin (0,0) as its top-left corner. This region is designated as the low-frequency component region containing the most important information of the image.

[0057] For noise, first in pixel space Construct a random Gaussian noise field and make it conform to a normal distribution. :

[0058] ;

[0059] Then the noise Transform to the frequency domain using DCT and then apply a mask. Preserve the low-frequency noise:

[0060] ;

[0061] ;

[0062] Finally, the noise is converted back to pixel space through inverse DCT transformation:

[0063] ;

[0064] To balance search efficiency and success rate, this invention employs a dynamic multi-scale search mechanism. Specifically, this mechanism defines the perturbation scale. Here, the perturbation scale s is not a fixed value, but changes dynamically according to the search structure, which constitutes an adaptive, multi-scale search process.

[0065] Initial clean samples plus adjusted noise Generate candidate adversarial examples as follows:

[0066] ;

[0067] When valid samples are found consecutively... By increasing the scale of perturbation, we can explore the robustness boundary of the model under stronger perturbation. This allows us to quickly move to stronger perturbation regions, efficiently approach and locate the boundary point where the model begins to fail, until the samples lose adversarialness or the maximum number of iterations is reached.

[0068] When no valid test samples are found consecutively This involves reducing the scale of perturbation and precisely locating the critical point of model failure until a valid sample is found or the maximum number of iterations is reached.

[0069] By scaling up and down, the former performs a coarse search, while the latter performs a fine search. This pair of coefficients together achieves bidirectional, controllable multi-scale exploration. Simultaneously, both have clearly defined termination criteria (until the required number of samples is reached or the maximum number of iterations is reached), avoiding blind searching and instead aiming to find effective samples or locate the critical point. Once the goal is achieved, the adjustment of the current scale stops. This avoids redundant queries at invalid scales, maximizing the conservation of model query counts.

[0070] The decision boundary is a complex high-dimensional surface. Approximating the entire boundary in only one direction is inefficient and has a very low success rate. Therefore, this invention will independently perform multi-scale searches in multiple directions, thereby potentially obtaining multiple test samples that meet the requirements.

[0071] Finally, from all the test samples that successfully caused the model to malfunction, the one closest to the original sample is selected as the output of step S1:

[0072] ;

[0073] in, This represents the set of samples from which the attack was successful. Indicates candidate samples Compared with the original clean sample Between Norm distance (also known as Euclidean distance) reflects the magnitude of the perturbation. A smaller value means... and The more similar, the more likely the invention will be in Elected Ambassador The candidate sample that minimizes the norm distance. Proceed to the next step.

[0074] Step S2, global noise compression. This step compresses the optimal sample selected in the previous step S1. noise Further optimization, through global compression factor Uniform compression disturbance is obtained This operation directly reduces the disturbance. Norm and The norm can quantify the change in a model's performance when the intensity of the disturbance is systematically reduced.

[0075] For using compression factor To accurately measure the critical scaling factor that just causes the model to fail, this invention employs a binary search method. The binary search method avoids excessive compression, which would negate the adversarial effect; it also avoids insufficient compression, which would be ineffective and wasteful of resources.

[0076] Specifically, the range is set during the initialization of the search process. In each iteration, the midpoint is calculated. :

[0077] ;

[0078] And generate candidate samples:

[0079] ;

[0080] Subsequently, the target model was queried for verification. Adversarial: If the target model is successfully misled, the compression is successful, and the update is performed. Otherwise update This iterative process continues until the interval length falls below a preset threshold or the maximum number of iterations is reached.

[0081] Step S3, Local Noise Compression. The local compression stage focuses on further reducing noise. Norm. This step employs a divide-and-conquer strategy, segmenting the noise, which has already been preliminarily compressed in the previous step S2, into multiple overlapping or non-overlapping geometric regions, and performing compression operations independently on each region. To achieve effective spatial coverage compression, this invention designs various geometric primitives, including circular primitives, elliptical primitives, and irregular patches. Among them, the circular region with a random center and adaptive radius of the circular primitive has good isotropy and is suitable for capturing local features; the elliptical region with different axis ratios of the elliptical primitive can adapt to common anisotropic structures in images; the irregular patch, through adaptive shape regions generated by random deformation, can enhance adaptability to complex textures. This transformation turns the originally complex high-dimensional continuous optimization into a large number of discrete, simple decisions that can be directly verified through a single model query.

[0082] More specifically, based on the above geometric primitives, let... The adversarial sample is globally compressed, and its corresponding perturbation is: The goal of local compression is to compress multiple local regions. Application of compression factor This makes the total disturbance To achieve smaller gains while maintaining competitiveness 2-norm, where For the region The binary mask. Wherein, the compression factor... By setting values ​​from 0, 0.1, 0.2, ..., 0.9, 0.2 was ultimately determined to be the optimal value for overall performance. (Region) The generation employs a random geometric strategy, with each spatial mask... A geometric region (such as a circle, ellipse, or irregular patch) is defined on the image. This mask is broadcast along the channel dimension and applied to the perturbation tensor. The final number of generated regions is determined by the remaining number of queries (if the query budget is 500, and 300 remain after the first two stages, then the third stage generates 300 geometric regions). Each local region... The compression operation depends only on the current global perturbation. and the mask for that area It does not depend on the processing results of other regions. Candidate samples from all regions can be generated simultaneously and submitted to the model in batches for parallel query verification.

[0083] Furthermore, for each region The present invention is conceived of compressing this region and generating candidate perturbations:

[0084] ;

[0085] The corresponding candidate samples are The sample is queried; if it remains adversarial, it is compressed and updated. .

[0086] To ensure a thorough and uniform exploration of the image space, the size of each region is determined based on the input image size (H). W) Adaptively determined. The radius range is set as a proportion of the shortest side length of the image:

[0087] ;

[0088] in, and These are the height and width of the image, respectively. and This is a preset scaling factor used to control the minimum and maximum ratio of the region relative to the image size. By repeatedly performing the local compression phase until the number of queries is exhausted, the final noise is obtained. And the final adversarial examples This design ensures that the generated region matches the scale of the image content, capturing both large-scale structural features and fine local details. Through proper settings... and The boundary conditions were defined, maintaining the stability and generalization of the algorithm.

[0089] The above-described embodiments of the present invention have the following technical advantages:

[0090] This invention proposes a model robustness evaluation method based on frequency-domain sparse querying, which it names FSRE (Frequency-based Robustness Systematic Evaluation). Through innovative frequency-domain aware initial noise generation, a dynamic multi-scale search mechanism, and the collaboration of global and local two-level compression strategies, it demonstrates significant technical advantages in deep learning model robustness evaluation. Figure 2 As shown, this is specifically reflected in the following aspects:

[0091] (1) Significantly improved evaluation efficiency: The FSRE method adopts a frequency domain-aware noise generation strategy, which can quickly locate the weak links of the model to perceptually sensitive perturbations. Compared with the traditional boundary search method, this method reduces the number of unnecessary random searches. By dynamically adjusting the perturbation scale, it significantly reduces the number of model queries required to achieve the same evaluation accuracy while ensuring the evaluation effect. This efficient query scheme enables the robustness evaluation of more models to be completed in the same amount of time, and is particularly suitable for large-scale model testing and rapid security screening before deployment.

[0092] (2) Dual optimization of evaluation accuracy: The method of this invention achieves synergistic optimization in two core indicators: success rate (attack effectiveness) and perturbation concealment (L2 norm).

[0093] High success rate guarantee: Through frequency domain-aware initial noise design, it is ensured that the generated test samples can effectively trigger model defects, and the success rate can be close to or reach the optimal level on various complex datasets.

[0094] Low perturbation norm: The innovative two-level compression mechanism can minimize the perturbation amplitude without affecting the success rate. The generated test samples are visually closer to the original samples, which meets the strict requirements for concealment in actual deployment scenarios.

[0095] (3) Excellent universality and generalization ability: Experimental results show that the FSRE method performs well on multiple datasets such as CIFAR-10, CIFAR-100 and ImageNet, and maintains stable evaluation performance for different types of deep learning models (including ResNet50, ResNet101 and Inception_v3). This stable performance across datasets and models proves that the method of the present invention has good generalization ability and can be used as a standardized model robustness evaluation tool.

[0096] (4) Perceptually friendly and highly practical: Through frequency domain filtering technology, the test samples generated by the method in this embodiment are mainly concentrated in the low-frequency region where the human visual system is relatively insensitive, making the disturbances more natural and difficult to detect. This perceptually friendly characteristic not only enhances the practical significance of the test, but also makes the evaluation results more reflective of the model's true safety status in actual applications.

[0097] In other embodiments of the present invention, a model robustness evaluation device based on frequency domain sparse query is also provided, characterized in that it includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is loaded by the processor, it executes the method as described in any of the above embodiments.

[0098] In other embodiments of the present invention, a computer-readable storage medium is also provided, in which a computer program is stored, which, when loaded by a processor, performs the method as described in any of the preceding embodiments.

[0099] In other embodiments of the present invention, a model robustness evaluation system based on frequency domain sparse query is also provided, including the model robustness evaluation device based on frequency domain sparse query as described in the above embodiments.

[0100] The technical effects of this invention are verified as follows:

[0101] Based on the above embodiments, a direct comparison method for robustness evaluation is to evaluate the same prediction model under the same number of queries, and finally judge the advantage of a method by comprehensively considering success rate and L2. This invention compares the performance of FSRE with benchmark methods such as BoundaryAttack, HSJA, GeoDA, and TriangleAttack on three datasets: CIFAR-10, CIFAR-100, and ImageNets, specifically targeting ResNet50, ResNet101, and Inception_v3 models, with 500 and 1000 queries respectively (described separately in the table) to simulate very limited query conditions.

[0102] Table 1

[0103]

[0104] As shown in Table 1, on the CIFAR-10 dataset, the method of this invention maintains a near-optimal success rate (99.29%, only 0.11 percentage points lower than GeoDA) while significantly reducing the average L2 norm to 0.95. Compared to the L2-optimal HSJA method, the method of this invention optimizes the L2 norm by 30.66% (from 1.37 to 0.95) while improving the success rate by 4.98 percentage points, achieving a dual breakthrough in both success rate and stealth.

[0105] On the more granular CIFAR-100 dataset, the method of this invention achieved the highest success rate (99.80%) among all compared methods, while the L2 norm (1.20) was close to the optimum (1.04). Although slightly higher than GeoDA's 1.04, the success rate is 0.10 percentage points higher than GeoDA.

[0106] Table 2

[0107]

[0108] On large-scale, highly complex ImageNet datasets, the advantages of the method in this invention are even more pronounced:

[0109] As shown in Table 2, for the Inception_v3 model, the success rate of the method in this embodiment is absolutely superior, with a success rate of 89.00%, which is significantly better than the second-place Triangle Attack (79.34%), representing an improvement of 12.18%. Furthermore, the average L2 norm of 4.20 is the lowest among all methods, and it is 45.81% better than the second-place GeoDA (7.75).

[0110] For the ResNet50 model, the method of this invention still leads all the comparison methods with a success rate of 81.98%, which is 4.98 percentage points higher than the second-place Triangle Attack. The method has the lowest average L2 norm of 5.79 and the best concealment, which is about 22.49% better than the second-place Triangle Attack (7.47).

[0111] For the ResNet101 model, the success rate of 75.56% remains the highest, while the L2 norm of 6.95 is also the lowest.

[0112] In summary, the method of this invention achieves the dual advantages of the highest success rate and the least perturbation on the three mainstream models on the large-scale, highly complex ImageNet dataset, verifying the strong generalization ability and efficient, low-perturbation characteristics of the method of this invention on highly complex datasets.

[0113] Table 3

[0114]

[0115] Table 3 shows the ablation experiments, which indicate that:

[0116] Stage 1 (A): Provides a high success rate (84.4%), but has a large perturbation when used alone (21.24 L2).

[0117] Stage 2 (B): When used alone (A→A+B), it has limited effect on improving disturbances and mainly serves as a prelude to Stage 3. It plays a synergistic optimization role in the complete process.

[0118] Stage 3 (C): The core disturbance reduction module is the decisive factor in reducing the disturbance amplitude and the key to achieving stealth (low L2).

[0119] The units described in the embodiments of the present invention can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0120] According to one aspect of the present invention, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described above.

[0121] In another aspect, embodiments of the present invention also provide a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

Claims

1. A model robustness evaluation method based on frequency domain sparse query, characterized in that, Including the following steps: Establish initial adversarial sample images, and acquire noise with perceptual characteristics during the process of establishing initial adversarial samples; The initial adversarial sample is globally compressed. During the global compression process, a binary search method is used to accurately measure the critical scaling factor that just makes the target model fail. This critical scaling factor is used as the global compression factor. The initial range and value of the global compression factor are set. The value of the global compression factor is dynamically updated by querying the target model to check the adversarial nature of the globally compressed image sample. The globally compressed noise is locally compressed. During the local compression process, the image is decomposed into multiple regions, and each region is compressed independently. The high-dimensional optimization problem is transformed into a parallel sub-problem that can be directly verified by querying the target model. The noise is processed separately in the multiple regions so that it converges under a limited query budget. By repeatedly performing the local compression phase until the number of queries is exhausted, the final noise and the final adversarial example are obtained. The establishment of the initial adversarial sample image includes the following sub-steps: frequency optimization initialization: obtaining the initial adversarial sample with minimum query cost by crossing the decision boundary through perceptual modulation based on discrete cosine transform and multi-scale search localization; Perturbation generation process: A perturbation is constructed in the discrete cosine transform domain, and a frequency band selection mask is used to selectively modulate the selected frequency components; The scale of the perturbation changes dynamically according to the search process. By scaling up and down the scale, coarse and fine searches are performed respectively, thus achieving bidirectional and controllable multi-scale exploration.

2. The model robustness evaluation method based on frequency domain sparse query according to claim 1, characterized in that, The initial range of the global compression factor is (0,1]; the global compression factor is used to uniformly compress the disturbance to obtain the compressed noise.

3. The model robustness evaluation method based on frequency domain sparse query according to claim 2, characterized in that, Regarding the value of the global compression factor, the dynamic update of the global compression factor value includes the following sub-steps: Set the range during initialization ; In each iteration, the midpoint is calculated. : ； Using the midpoint Generate candidate samples: ； in, This represents the selected sample from the initial adversarial examples. This indicates the noise corresponding to the selected sample; Subsequently, the target model was queried for verification. Adversarial: If the target model is successfully misled, the compression is successful, and the update is performed. Otherwise update This iterative process continues until the interval length is lower than the preset threshold or the maximum number of iterations is reached.

4. The model robustness evaluation method based on frequency domain sparse query according to claim 1, characterized in that, The process of decomposing the image into multiple regions during local compression, with each region compressed independently, transforms the high-dimensional optimization problem into a parallel sub-problem that can be directly verified through querying the target model. This process specifically includes the following sub-steps: A random geometric strategy is used to generate local regions. A binary mask is used to define the geometric regions on the image. The mask is broadcast along the channel dimension and applied to the perturbation tensor, thereby transforming the high-dimensional optimization problem into a parallel subproblem that can be directly verified by querying the target model. The compression operation of each local region depends only on the current global perturbation and the binary mask of that local region.

5. The model robustness evaluation method based on frequency domain sparse query according to claim 4, characterized in that, The geometric region includes circular primitives, elliptical primitives, and irregular patches.

6. A model robustness evaluation device based on frequency domain sparse query, characterized in that, include: The initial adversarial sample image establishment module is used to establish initial adversarial samples and acquire noise with perceptual characteristics during the process of establishing initial adversarial samples; the establishment of the initial adversarial sample image includes frequency optimization initialization and perturbation generation processes. Frequency optimization initialization: Initial adversarial examples are obtained with minimal query cost by crossing the decision boundary through perceptual modulation based on discrete cosine transform and multi-scale search localization; Perturbation generation process: A perturbation is constructed in the discrete cosine transform domain, and a frequency band selection mask is used to selectively modulate the selected frequency components; The scale of the perturbation changes dynamically according to the search process. By scaling up and down the scale, coarse and fine searches are performed respectively, thus achieving bidirectional and controllable multi-scale exploration. The first processing module is used to perform global compression on the initial adversarial sample. During the global compression process, a binary search method is used to accurately measure the critical scaling factor that just causes the target model to fail. This critical scaling factor is used as the global compression factor. The value of the global compression factor is dynamically updated by querying the target model to test the adversarial nature of the globally compressed samples. The second processing module is used to locally compress the globally compressed noise. During the local compression process, the image is decomposed into multiple regions, and each region is compressed independently. The high-dimensional optimization problem is transformed into a parallel sub-problem that can be directly verified by querying the target model. The noise is processed in each of the multiple regions to make it converge under a limited query budget. By repeatedly executing the local compression stage until the number of queries is exhausted, the final noise and the final adversarial example are obtained.

7. A computer-readable storage medium, characterized in that, A computer program is stored in a readable storage medium, which, when loaded by a processor, executes the initial adversarial example image establishment module, and / or the first processing module, and / or the second processing module in the model robustness evaluation device based on frequency domain sparsity query as described in claim 6.

8. A model robustness evaluation system based on frequency domain sparse query, characterized in that, The system includes a model robustness evaluation device, which employs the model robustness evaluation device based on frequency domain sparsity query as described in claim 6.

Images