Cross-modal adversarial attack method and system based on mask weight and random cropping
By adopting a cross-modal adversarial attack method based on mask weights and random pruning, the problems of insufficient semantic guidance and multi-scale robustness in existing technologies are solved, achieving efficient and covert adversarial attacks and improving the attack success rate and transferability of large-scale vision-language models.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING SCI & TECH PATENT OFFICE
- Filing Date
- 2025-12-18
- Publication Date
- 2026-05-15
AI Technical Summary
Existing adversarial attack methods lack semantic guidance mechanisms in large-scale visual-language models (LVLMs), have insufficient multi-scale robustness, high perturbation perceptibility, and limited cross-modal transfer capabilities, making it difficult to achieve efficient attacks under limited perturbation budgets.
A cross-modal adversarial attack method based on mask weights and random cropping is adopted. The perturbation distribution is guided by DINOv2 mask, and local and global feature alignment is performed under random multi-cropping mechanism. The pixel-level and cropping-level loss are optimized by combining saliency mask and cropping-level weight allocation to generate adversarial examples.
It improves attack efficiency, enhances cross-modal transferability, reduces the perceptibility of perturbations, takes into account success rates under different scales and task scenarios, and is suitable for quality evaluation of different LVLMs models.
Smart Images
Figure CN121706883B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of deep learning technology, and in particular to a cross-modal adversarial attack method and system based on mask weights and random pruning. Background Technology
[0002] With the development of deep learning, large-scale visual-language models (LVLMs) have gradually become an important cornerstone of the field of artificial intelligence. These models, such as CLIP, BLIP, and LLaVA, can align visual features with natural language features to achieve cross-modal semantic understanding and perform exceptionally well in tasks such as image captioning, visual question answering, and cross-modal retrieval. The widespread application of these models also gives them potentially enormous value in safety-critical fields such as autonomous driving, medical image-assisted diagnosis, surveillance and security, and financial risk control.
[0003] However, research shows that LVLMs are vulnerable to adversarial attacks. Adversarial attacks can introduce subtle and imperceptible perturbations into the input data, causing significant biases in the model. For example, a perturbed image might be misrepresented by the model or incorrectly matched in a retrieval task, thus posing security risks. Therefore, resistance to adversarial attacks has become a key indicator for evaluating the quality of LVLMs.
[0004] Existing adversarial attack methods mainly include Fast Gradient Signed Method (FGSM), Projected Gradient Descent (PGD), Momentum Iteration Method (MI-FGSM), and Pruning Enhancement Attacks (such as Square Attack and Patch Attack). Among them, Fast Gradient Signed Method generates adversarial examples quickly through a single gradient update, which is efficient but has limited attack effectiveness; Projected Gradient Descent accumulates perturbations through multiple iterations, resulting in a higher attack success rate, but often lacks transferability; Momentum Iteration Method introduces a momentum term in the update, improving convergence stability; Pruning Enhancement Attack improves efficiency through local perturbations, but lacks semantic guidance.
[0005] While these existing adversarial attack methods have achieved some success in single scenarios, they still have the following obvious shortcomings.
[0006] 1) Lack of semantic guidance mechanism: Traditional attack methods assign the same weight to all pixels, ignoring important information such as the target subject and key semantic regions in the image. This makes the perturbation distribution too scattered, making it difficult to achieve efficient attacks with a limited perturbation budget.
[0007] 2) Insufficient multi-scale robustness: Most existing attacks only optimize at the full-scale and do not consider the feature stability of LVLMs when processing local cropping. Therefore, when the input is randomly cropped or scaled, the attack effect of the perturbation will be significantly reduced.
[0008] 3) High perceptibility of perturbation: Global uniform perturbation is likely to introduce unnecessary noise in low semantic regions such as image background, which increases the perceptibility of adversarial examples to the human eye.
[0009] 4) Limited cross-modal transfer capability: The feature space of LVLMs includes both image and text modalities. Existing attack methods usually only optimize the similarity between image features and target image features, but lack specific optimization for cross-modal semantic consistency.
[0010] In summary, existing adversarial attack methods not only ignore the semantic region differences of images and the uniform distribution of perturbations in the image, leading to wasted perturbation budgets, but also, in cross-modal attacks, the alignment target is often limited to global features, lacking constraints on local cropping and multi-scale features. Furthermore, existing adversarial attack methods struggle to balance attack success rate, transferability, and perturbation concealment. Therefore, there is an urgent need for a novel method that combines semantic mask guidance with multi-cropping feature constraints to improve the performance and practicality of LVLMs adversarial attacks, and to better evaluate the quality of LVLMs. Summary of the Invention
[0011] To address the aforementioned issues, this invention proposes a cross-modal adversarial attack method and system based on mask weights and random pruning. It first utilizes the DINOv2 mask as a guide for perturbation distribution, then performs local and global feature alignment under a random multi-pruning mechanism, and finally balances attack success rate, transferability, and perturbation concealment through dual weight allocation of the mask at the pixel and pruning levels. This approach is adaptable to quality assessment of different LVLMs models.
[0012] To achieve the above objectives, the technical solution of the present invention includes the following:
[0013] A cross-modal adversarial attack method based on mask weights and random pruning, the method comprising:
[0014] Extract source image A salience mask;
[0015] Using disturbance variables For the source image Perturb and generate adversarial examples And combine saliency masking to randomly sample K clipping boxes ;
[0016] Extract the cropping frame separately In adversarial examples On the cutting features And target embedding on the target image And based on this cutting feature and target embedding Calculate the cropping frame Cutting loss ;
[0017] Calculate all clipping frames based on saliency mask Cutting loss The weighted sum yields the total loss. ;
[0018] Based on the total loss Perform backpropagation to update the perturbation variables. Then, based on the updated perturbation variables Re-execute the operation using the perturbation variable For the source image Perturb until the maximum number of steps or total loss is reached. Convergence, outputting the final adversarial example. .
[0019] Furthermore, by combining saliency masks, adversarial examples... Randomly sample K cropping frames :
[0020] Calculate the height and width of the clipping frame based on the sampling side length ratio and aspect ratio;
[0021] Adversarial Samples Using the mean as the center and combining it with the set standard deviation, a two-dimensional Gaussian distribution centered on vision is generated. ;
[0022] Based on this saliency mask m The pixel values are transformed by a power law to generate a semantic weight matrix;
[0023] According to this two-dimensional Gaussian distribution Together with the semantic weight matrix, we obtain the joint distribution. ;
[0024] Normalize the joint distribution to obtain the probability distribution. ;
[0025] According to this probability distribution Sample K center points ;
[0026] Based on the center point Including the height and width of the clipping frame, we obtain K clipping frames. .
[0027] Further, extract the cropping frame. Target embedding on the target image ,include:
[0028] Extract the cropping frame Cropping features on the target image ;
[0029] Extract global features from the target image ;
[0030] Generate target embedding Among them, when attacking tasks consistent with global semantics, the weights When attacking tasks sensitive to partial pruning, the weights .
[0031] Furthermore, the trimming loss .
[0032] Furthermore, all clipping frames are calculated based on the saliency mask. Cutting loss The weighted sum yields the total loss. ,include:
[0033] Extract the clipping box from the saliency mask Average mask value of the corresponding region ;
[0034] By introducing a mask enhancement index To obtain the weight ;
[0035] Based on this weight For cutting loss We perform a weighted summation to obtain the total loss. .
[0036] Furthermore, based on this total loss Perform backpropagation to update the perturbation variables, including:
[0037] Based on saliency mask and mask enhancement index Calculate the pixel-level weight A;
[0038] Based on total loss Calculate the gradient and use the pixel-level weights A as the step size to perform PGD updates; during the PGD update process, adversarial examples are processed. Norm projection makes the updated perturbation variable Always -Within the sphere constraint, This indicates the maximum disturbance amplitude.
[0039] A cross-modal adversarial attack system based on mask weights and random pruning, the system comprising:
[0040] The mask extraction module is used to extract the source image. A salience mask;
[0041] The clipping box generation module is used to utilize perturbation variables. For the source image Perturb and generate adversarial examples And combine saliency masking to randomly sample K clipping boxes ;
[0042] The loss calculation module is used to extract the clipping frame separately. In adversarial examples On the cutting features And target embedding on the target image And based on this cutting feature and target embedding Calculate the cropping frame Cutting loss Calculate all clipping frames based on saliency masks. Cutting loss The weighted sum yields the total loss. ;
[0043] The adversarial example output module is used to calculate the total loss. Perform backpropagation to update the perturbation variables. Then, based on the updated perturbation variables Re-execute the operation using the perturbation variable For the source image Perturb until the maximum number of steps or total loss is reached. Convergence, outputting the final adversarial example. .
[0044] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the cross-modal adversarial attack method based on mask weights and random pruning as described above.
[0045] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cross-modal adversarial attack method based on mask weights and random pruning as described above.
[0046] A computer program product, characterized in that, when the computer program product is run on a computer device, it causes the computer device to execute the cross-modal adversarial attack method based on mask weights and random pruning as described above.
[0047] Compared with the prior art, the present invention has at least the following beneficial effects.
[0048] 1. Improve attack efficiency: Enhance the effect of perturbations in semantically salient regions through semantic masking.
[0049] 2. Enhance cross-modal portability: Combine local→global and local→local pruning patterns to ensure the stability of perturbations under different modal tasks.
[0050] 3. Reduce perceptibility: Reduce invalid perturbations in non-semantic regions to make adversarial examples more covert.
[0051] 4. Balancing robustness and generalization: Through a multi-pruning sampling mechanism, attacks can maintain a high success rate across different scales and task scenarios. Attached Figure Description
[0052] Figure 1 Flowchart of a cross-modal adversarial attack method based on mask weights and random pruning. Detailed Implementation
[0053] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0054] The present invention provides a cross-modal adversarial attack method based on mask weights and random pruning, such as... Figure 1 As shown, the process includes steps S1 to S5.
[0055] Step S1: Extract the saliency mask of the source image.
[0056] This step uses the DINOv2 self-supervised model to generate a saliency mask for the source image x, and then normalizes this saliency mask to the [0,1] interval to obtain the saliency mask. Among them, the salience mask A higher mask value indicates greater semantic importance of the pixel.
[0057] Step S2: Perturb the source image using perturbation variables to generate adversarial examples, and randomly sample K cropping boxes using a saliency mask.
[0058] This invention first utilizes a perturbation variable initialized to zero. The source image is perturbed, and the resulting perturbation is affected in subsequent iterations. ( Infinite norm) constraint limit (maximum perturbation amplitude set by parameter epsilon).
[0059] Then, in order to ensure the stability of the perturbation at different localities and scales, the present invention randomly samples K clipping frames in each iteration. Where `top` is the vertical pixel coordinate of the top-left corner of the cropping region; `left` is the horizontal pixel coordinate of the top-left corner of the cropping region; `h` is the height of the cropping box; and `w` is the width of the cropping box. The cropping result is scaled to a 224×224 input size. The cropping center position is sampled using a "center Gaussian offset + mask guidance" method, which increases the probability of semantic regions being sampled.
[0060] Specifically, for heights of Width is The source image, the cropping process includes:
[0061] 1) Create a 2D coordinate grid: ; ;
[0062] 2) Calculate the two-dimensional Gaussian distribution Let the center point Standard deviation and standard deviation It can be set as part of the adversarial sample size, such as the standard deviation. Standard deviation Then the Gaussian distribution function is A two-dimensional Gaussian weighted graph with the mean centered on the image is constructed to achieve center bias.
[0063] 3) Calculate the semantic weight matrix: Apply the normalized saliency mask... Take each element The power is used to obtain the semantic guidance weight;
[0064] 4) Calculate the joint distribution ;
[0065] 5) This joint distribution Normalization yields the central sampling probability distribution. ;
[0066] 6) Center sampling probability distribution Flatten the vector into a one-dimensional vector, then use multinomial sampling to select an index, and finally map the index back to two-dimensional coordinates to obtain the clipping center point. ;
[0067] 7) Determine the clipping frame : at the sampling point of the cutting center Subsequently, this invention is based on the proportion of randomly sampled side lengths. Aspect Ratio Get the height of the clipping frame Hekuan ;
[0068] 8) Repeat the following steps until samples are obtained. A cropping box .
[0069] Step S3: Extract the cropping features of the cropping box on the adversarial example and the target embedding on the target image, and then use the cropping features to... Combine the target embedding and calculate the clipping loss of the clipping box.
[0070] Step 31: Extract the cropping frame In adversarial examples On the cutting features .
[0071] The adversarial examples obtained in the current iteration are placed in the clipping box. After cropping and scaling to the input size of the visual encoder, the cropping frame is obtained by feeding it into the visual encoder. In adversarial examples On the cutting features .
[0072] Step 32: Extract the cropping frame Target embedding on the target image .
[0073] This invention first places the target image within a cropping frame After cropping and scaling to the input size of the visual encoder, the cropping frame is obtained by feeding it into the visual encoder. Cropping features on the target image The target image is then scaled to the input size of the visual encoder and fed into it to obtain the global features of the target image. Finally, the clipping features are aligned according to the alignment mode. and global features Select or combine (depending on mode switching) to generate target embeddings. .
[0074] in, This indicates the local→global mode (local cropping to align with the global target), which is used to attack tasks such as cross-modal retrieval / image-text matching that require consistency with global semantics. This indicates a local→local mode (local cropping aligned with target cropping), used to attack tasks sensitive to local cropping (such as multi-scale matching) and ensure accurate local alignment. This dual-mode can be freely switched according to the task, ensuring both global semantic consistency and enhanced local feature alignment.
[0075] Step 33: Based on this cutting feature and target embedding Calculate the cropping frame Cutting loss .
[0076] For each clipping feature -Target embedding Yes, this invention uses cosine distance to calculate the corresponding clipping frame. Cutting loss .
[0077] Step S4: Calculate the weighted sum of the clipping losses of all clipping boxes based on the saliency mask to obtain the total loss.
[0078] This invention first extracts the clipping box from the saliency mask. Average mask value of the corresponding region Then, the exponent is enhanced by introducing a mask. To obtain the weight Finally, based on this weight For cutting loss Weighted average to obtain the total loss ;in, This indicates a summation.
[0079] Step S5: Perform backpropagation based on the total loss to update the perturbation variables. Then, re-execute step S2 based on the updated perturbation variables until the maximum number of steps is reached or the total loss converges, and output the final adversarial example.
[0080] This invention first uses saliency masks and mask enhancement exponents. Calculate pixel-level weights Then based on the total loss Calculate the gradient and use the pixel-level weights A as the step size to perform PGD updates; during the PGD update process, adversarial examples are processed. Norm projection makes the updated perturbation variable Always - Within the sphere constraint.
[0081] In summary, this invention can significantly improve the success rate of adversarial attacks and cross-scale generalization ability while ensuring image visual quality. It is applicable to robustness evaluation and attack and defense research for multimodal tasks such as image classification, image-text matching, and attribute reasoning.
[0082] This invention adds a pixel-level mask step size modulation mechanism, which achieves differentiated perturbation allocation for semantically significant regions through semantic mask exponential enhancement.
[0083] This invention integrates a pruning-level weighted loss aggregation mechanism, which uses the semantic mask mean as the weight to assign pruning loss, thus solving the regional imbalance problem in multi-pruning optimization.
[0084] This invention proposes a dual-mode cross-modal cropping optimization: local→global and local→local cropping modes are compatible, improving cross-modal attack transferability in tasks such as image captioning and cross-modal retrieval.
[0085] Compared to methods that only optimize global features, this invention demonstrates better generalization and robustness by randomly cropping multiple features to cover different scales and locations.
[0086] This invention focuses perturbations primarily on semantic regions to enhance attack strength while reducing background perturbations, thereby improving the naturalness of adversarial examples and reducing their visual perceptibility, thus increasing concealment. Experiments show that, under the same perturbation budget, this invention achieves a global attack success rate comparable to that of the three attack methods: FGSM / PGD / MI-FGSM.
[0087] The multi-pruning mechanism of this invention avoids global overcomputation while ensuring effectiveness, thus guaranteeing both high efficiency and high performance in adversarial example generation.
[0088] The above embodiments are provided merely for the purpose of describing the present invention and are not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims. Various equivalent substitutions and modifications made without departing from the spirit and principles of the invention should be covered within the scope of the invention.
Claims
1. A cross-modal adversarial attack method based on mask weights and random pruning, characterized in that, The method includes: Extract source image saliency mask ; Using disturbance variables For the source image Perturb and generate adversarial examples And combine saliency masking to randomly sample K clipping boxes ; Extract the cropping frame separately In adversarial examples On the cutting features And target embedding on the target image And based on this cutting feature and target embedding Calculate the cropping frame Cutting loss ; Calculate all clipping frames based on saliency mask Cutting loss The weighted sum yields the total loss. ; Based on the total loss Perform backpropagation to update the perturbation variables. Then, based on the updated perturbation variables Re-execute the operation using the perturbation variable For the source image The perturbation process continues until the maximum number of steps or total loss is reached. Convergence, outputting the final adversarial example. ; Among them, K clipping boxes are randomly sampled using a saliency mask. : Calculate the height and width of the clipping frame based on the sampling side length ratio and aspect ratio; Using the center of the source image as the mean and combining it with a set standard deviation, a two-dimensional Gaussian distribution centered on the viewpoint is generated. ; Based on this saliency mask The pixel values are transformed by a power law to generate a semantic weight matrix; According to this two-dimensional Gaussian distribution Together with the semantic weight matrix, we obtain the joint distribution. ; Normalize the joint distribution to obtain the probability distribution. ; According to this probability distribution Sample K center points (C x C y ); Based on the center point (C) x C y ) and the height and width of the clipping frame, to obtain K clipping frames. ; Extract the cropping frame. Target embedding on the target image ,include: Extract the cropping frame Cropping features on the target image ; Extract global features from the target image ; Generate target embedding Among them, when attacking tasks consistent with global semantics, the weights When attacking tasks sensitive to partial pruning, the weights ; Among them, all clipping boxes are calculated based on the saliency mask. Cutting loss The weighted sum yields the total loss. ,include: Extract the clipping box from the saliency mask Average mask value of the corresponding region ; By introducing a mask enhancement index To obtain the weight ; Based on this weight Cutting loss We perform a weighted summation to obtain the total loss. .
2. The method according to claim 1, characterized in that, The cutting loss .
3. The method according to claim 1, characterized in that, Based on the total loss Perform backpropagation to update the perturbation variables, including: Based on saliency mask and mask enhancement index Calculate pixel-level weights ; Based on total loss Calculate the gradient and assign pixel-level weights. As the step size, perform PGD updates; during the PGD update process, perform the following on the adversarial examples: Norm projection makes the updated perturbation variable Always -Within the sphere constraint, This indicates the maximum disturbance amplitude.
4. A cross-modal adversarial attack system based on mask weights and random pruning, characterized in that, The system includes: The mask extraction module is used to extract the source image. saliency mask ; The cropping box generation module is used to utilize perturbation variables. For the source image Perturb and generate adversarial examples And combine saliency masking to randomly sample K clipping boxes ; The loss calculation module is used to extract the clipping frame separately. In adversarial examples On the cutting features And target embedding on the target image And based on this cutting feature and target embedding Calculate the cropping frame Cutting loss Calculate all clipping frames based on saliency masks. Cutting loss The weighted sum yields the total loss. ; The adversarial example output module is used to calculate the total loss. Perform backpropagation to update the perturbation variables. Then, based on the updated perturbation variables Re-execute the operation using the perturbation variable For the source image The perturbation process continues until the maximum number of steps or total loss is reached. Convergence, outputting the final adversarial example. ; Among them, K clipping boxes are randomly sampled using a saliency mask. : Calculate the height and width of the clipping frame based on the sampling side length ratio and aspect ratio; Using the center of the source image as the mean and combining it with a set standard deviation, a two-dimensional Gaussian distribution centered on the viewpoint is generated. ; Based on this saliency mask The pixel values are transformed by a power law to generate a semantic weight matrix; According to this two-dimensional Gaussian distribution Together with the semantic weight matrix, we obtain the joint distribution. ; Normalize the joint distribution to obtain the probability distribution. ; According to this probability distribution Sample K center points (C x C y ); Based on the center point (C) x C y ) and the height and width of the clipping frame, to obtain K clipping frames. ; Extract the cropping frame. Target embedding on the target image ,include: Extract the cropping frame Cropping features on the target image ; Extract global features from the target image ; Generate target embedding Among them, when attacking tasks consistent with global semantics, the weights When attacking tasks sensitive to partial pruning, the weights ; Among them, all clipping boxes are calculated based on the saliency mask. Cutting loss The weighted sum yields the total loss. ,include: Extract the clipping box from the saliency mask Average mask value of the corresponding region ; By introducing a mask enhancement index To obtain the weight ; Based on this weight Cutting loss We perform a weighted summation to obtain the total loss. .
5. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, it implements the cross-modal adversarial attack method based on mask weights and random pruning as described in any one of claims 1-3.
6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the cross-modal adversarial attack method based on mask weights and random pruning as described in any one of claims 1-3.
7. A computer program product, characterized in that, When the computer program product is run on a computer device, the computer device performs the cross-modal adversarial attack method based on mask weights and random pruning as described in any one of claims 1-3.