Frame-level alignment boundary adversarial attack method, system, device and equipment for sequence recognition model and medium

Abstract

The application provides a frame-level alignment boundary adversarial attack method, system, device and equipment for a sequence recognition model and a medium, and belongs to the fields of computer vision, speech processing and adversarial machine learning. The method comprises the following steps: S1: inputting a sample into a target sequence recognition model in a test stage to obtain an initial reference alignment label sequence; S2: based on the initial reference alignment label sequence, constructing an alignment boundary margin between a reference alignment label and a competitive label; S3: based on the alignment boundary margin, generating a dynamic continuous gating weight by using a smoothing mapping, constructing a margin optimization target with gating weighting and iteratively updating to obtain a candidate adversarial sample; and S4: performing total variation (TV) smoothing under a success maintaining constraint and amplitude scaling search on the candidate adversarial sample to generate a high-fidelity adversarial sample. The application can improve the adversarial attack efficiency and success rate and can be used in sequence recognition model robustness evaluation and privacy protection, copyright protection and the like.

Description

Technical Field

[0001] This invention belongs to the fields of computer vision, speech processing and adversarial machine learning, and specifically relates to a method, system, device, equipment and medium for frame-level alignment boundary adversarial attacks against sequence recognition models. Background Technology

[0002] In recent years, deep learning technology has made significant progress in computer vision and speech processing, with sequence recognition tasks finding widespread application. For example, scene text recognition can be used for traffic sign and caption text reading, product label recognition, and mobile scanning; automatic speech recognition is widely used in in-vehicle voice interaction, intelligent assistants, and meeting transcription systems. These tasks typically output variable-length label sequences, and in engineering implementations, connection-time classification (CTC) or attention mechanisms are commonly used to complete time-step prediction and alignment decoding.

[0003] However, deep neural networks are vulnerable in adversarial environments. Attackers can add small, imperceptible perturbations to the input to induce incorrect system outputs. For sequence recognition applications such as STR and ASR, misidentification can pose potential risks in security-sensitive scenarios such as autonomous driving, security forensics, and human-computer interaction. Therefore, constructing adversarial examples and conducting adversarial testing is of great significance.

[0004] Existing attack methods targeting sequence recognition tasks mostly employ a general perturbation iterative optimization framework, often focusing on optimizing the overall output loss or overall sequence score. Since the decoding results of sequence recognition models are typically dominated by competition over a small number of time steps, when the optimization objective does not explicitly characterize this competition boundary, perturbation updates may be unevenly distributed across time steps or deviate from key competitive time steps. This often requires large perturbation amplitudes or numerous search attempts to induce a shift in the output sequence, making it difficult to simultaneously achieve attack efficiency and perturbation stealth. Furthermore, candidate adversarial examples obtained solely through one-time iterative optimization exhibit significant fluctuations in perceptual quality and perturbation controllability, lacking a mechanism for further refining the perturbation under the constraint of "maintaining attack success," thus affecting the stability and usability of adversarial testing.

[0005] Based on this, it is necessary to propose a frame-level alignment boundary adversarial attack method and system for sequence recognition models, so that the optimization target is consistent with the frame-level alignment competition boundary, and the candidate adversarial samples are refined under the constraint of maintaining the success of the attack, so as to maintain high perception quality while reducing the perturbation amplitude. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a method and system for frame-level alignment boundary adversarial attacks against sequence recognition models. The method includes the following steps:

[0007] Step S1: During the testing phase, the original samples of the dataset are input into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample, and an initial reference aligned label sequence is constructed; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence;

[0008] Step S2: Based on the initial reference alignment label sequence and the correct label sequence, filter the samples that the target sequence recognition model can correctly recognize, and construct the alignment boundary margin according to the reference alignment label sequence and frame-level log probability matrix corresponding to the sample;

[0009] Step S3: Based on the alignment boundary edge, generate dynamic continuous gating weights using smooth mapping, construct a gating weighted alignment boundary edge loss for iterative updates, and simultaneously obtain candidate adversarial samples by adaptively balancing the attack intensity through a search mechanism.

[0010] Step S4: Perform total variational TV smoothing and amplitude scaling search under the successful preservation constraint on the candidate adversarial examples to generate high-fidelity adversarial examples.

[0011] Beneficial effects:

[0012] 1. This invention utilizes the frame-level prediction and alignment characteristics of sequence recognition models to construct an edge-based optimization target for perturbation updates, which can improve the attack success rate and increase generation efficiency compared to general attack strategies.

[0013] 2. This invention introduces a weight adjustment strategy related to dynamic gating coefficients and identification confidence factors, which can improve the optimization stability under long sequence conditions.

[0014] 3. This invention introduces a search mechanism to adaptively balance attack strength and perturbation constraints, reducing the dependence on parameter tuning, and achieving more stable attack effects and smaller perturbations under different sample and model conditions.

[0015] 4. After the candidate adversarial examples are generated, the present invention further performs total variational (TV) smoothing and amplitude scaling search under the success-preserving constraint, thereby reducing the perturbation amplitude and improving the perception quality while maintaining the success of the attack, thus improving the concealment and usability of the adversarial examples.

[0016] 5. The method of the present invention has a wide range of applications. It can be used for robustness evaluation and security testing of sequence recognition models, including scene text recognition and automatic speech recognition, and can be extended to application scenarios such as privacy protection and copyright protection. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a frame-level alignment boundary adversarial attack method for sequence recognition models according to the present invention.

[0018] Figure 2 This is a schematic diagram of the overall architecture of the method of the present invention;

[0019] Figure 3A This is a schematic diagram illustrating the qualitative results of the adversarial attack method of the present invention on the STR model.

[0020] Figure 3B This is a schematic diagram showing the visual qualitative comparison results of existing adversarial attack methods and the adversarial method of this invention in the STR model;

[0021] Figure 4A This is a schematic diagram showing a visual qualitative comparison of existing adversarial attack methods and the adversarial method of this invention in the ASR model;

[0022] Figure 4B This is a schematic diagram illustrating the qualitative results of the adversarial attack method of the present invention on the ASR model.

[0023] Figure 5A This is a schematic diagram illustrating the application of the method of the present invention in privacy protection or information desensitization scenarios;

[0024] Figure 5B This is a schematic diagram illustrating the application of the method of the present invention in robustness evaluation or security testing scenarios of sequence recognition systems;

[0025] Figure 6 This is a structural block diagram of a frame-level alignment boundary adversarial attack system for sequence recognition models according to the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0027] The sequence recognition model of the present invention is used to map input images or audio into a sequence of labels. The sequence recognition model includes a scene text recognition model (STR) and an automatic speech recognition model (ASR).

[0028] Example 1:

[0029] like Figure 1 As shown in the figure, an embodiment of the present invention provides a frame-level alignment boundary adversarial attack method for sequence recognition models, comprising the following steps:

[0030] Step S1: During the testing phase, input the original samples of the dataset into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample, and construct the initial reference aligned label sequence; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence;

[0031] Step S2: Based on the initial reference alignment label sequence and the correct label sequence, filter the samples that the target sequence recognition model can correctly recognize, and construct the alignment boundary margin according to the reference alignment label sequence and the frame-level log probability matrix corresponding to the sample.

[0032] Step S3: Based on the aligned boundary margin, use smooth mapping to generate dynamic continuous gating weights, construct a gating weighted aligned boundary margin loss for iterative updates, and simultaneously use a search mechanism to adaptively balance the attack intensity to obtain candidate adversarial samples;

[0033] Step S4: Perform total variation TV smoothing and amplitude scaling search under the successful preservation constraint on the candidate adversarial examples to generate high-fidelity adversarial examples.

[0034] In one embodiment, step S1 above involves inputting the original samples of the dataset into the target sequence recognition model during the testing phase to obtain the frame-level log probability matrix corresponding to each sample, and constructing an initial reference aligned label sequence; wherein the dataset includes an image set or an audio set, and the corresponding correct label sequence, specifically including:

[0035] Step S101: Obtain the dataset, which includes: a set of images or a set of audio, and the corresponding correct label sequence;

[0036] Step S102: Obtain the architecture, weight parameters, and gradient information of the target sequence recognition model;

[0037] Step S103: Switch the target sequence recognition model from training mode to testing mode;

[0038] Step S104: Input the original samples in the dataset into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample;

[0039] Step S105: Take the maximum value index of the prediction vector at each time step in the frame-level log probability matrix and use it as the reference alignment label for the corresponding time step. The reference alignment labels are arranged into an initial reference alignment label sequence according to the time steps.

[0040] In one embodiment, step S2 above: based on the initial reference alignment label sequence and the correct label sequence, filters samples that the target sequence recognition model can correctly recognize, and constructs alignment boundary margins according to the reference alignment label sequence and frame-level log probability matrix corresponding to the samples, specifically including:

[0041] Step S201: Compare the correct label sequence with the initial reference alignment label sequence, delete the samples that the target sequence recognition model cannot correctly identify from the dataset, and obtain the correctly identifiable samples and their corresponding reference alignment label sequences.

[0042] Step S202: Obtain the frame-level log probability matrix corresponding to the correctly identifiable samples;

[0043] Pseudocode for initial reference alignment label sequence construction and identifiable sample selection:

[0044] Input: Dataset Target sequence recognition model G, Let J represent the j-th original sample in D and its corresponding label, respectively. The decoding function... ;

[0045] Output: The sample set can be correctly identified. Frame-level log probability matrix set Initial reference alignment label sequence set ;

[0046] 1: Initialization , , ;

[0047] 2: for j = 1..| | do

[0048] 3: Take a sample ;

[0049] 4: Forward inference yields the frame-level log probability matrix: ,in:

[0050] T is the number of time steps generated during the forward inference of the target sequence recognition model, and Ch is the set of characters that the target sequence recognition model can recognize.

[0051] 5: Construct a reference aligned label sequence based on the maximum index of each time step:

[0052] 6: for t = 1..T do

[0053] 7: ;

[0054] 8: end for

[0055] 9: Decode to obtain the predicted label sequence: ;

[0056] 10:if then

[0057] 11: ;

[0058] 12: ;

[0059] 13: ;

[0060] 14:end if

[0061] 15:end for

[0062] 16: Output , , .

[0063] Step S203: Based on the frame-level logarithmic probability matrix and the reference alignment label sequence, determine the competing label for each time step and construct the alignment boundary margin. The competing label is determined by the maximum logarithmic probability value after excluding the corresponding items of the reference alignment label and the corresponding items of invalid symbols. The alignment boundary margin is the difference between the logarithmic probability value of the reference alignment label and the logarithmic probability value of the competing label.

[0064] In one embodiment, step S3 above: Based on the aligned boundary margin, a dynamic continuous gating weight is generated using a smooth mapping, and a gating weighted aligned boundary margin loss is constructed for iterative updates. Simultaneously, a search mechanism is used to adaptively balance the attack intensity to obtain candidate adversarial samples, specifically including:

[0065] Step S301: Initialize the disturbance Set the maximum number of iterations for the adversarial attack algorithm. and learning rate and initialize the tradeoff coefficients. and its binary search parameters, including the number of binary search attempts. Search the lower bound Search upper bound And the number of iterations after a successful attack. .

[0066] Step S302: Enable the tradeoff coefficient The outer loop of the binary search, in the first... During the secondary search for tradeoff coefficients, the current tradeoff coefficients are determined. And perform inner layer iterative updates.

[0067] Step S303: In the inner iteration... In the next iteration, Add to original input sample And perform numerical cropping to obtain the current candidate adversarial samples. ,in, For the clipping function, and Input the upper and lower bounds of the preset valid value range for the sample, and then... Input target sequence recognition model, output frame-level log probability matrix .

[0068] Step S304: Based on the frame-level log probability matrix A gated weighted marginal optimization objective is constructed by aligning the label sequence with the reference, and then combined with the perturbation. Norm and current tradeoff coefficient The calculated gated weighted alignment boundary marginal loss Loss includes:

[0069] Step S3041: Based on the reference aligned tag sequence, from the frame-level log probability matrix Extract the logarithmic probability value of the reference alignment label corresponding to each time step, and use it as the reference score. ;

[0070] Step S3042: For each time step In the frame-level log probability matrix In the corresponding prediction vector, after excluding the items corresponding to the reference alignment labels and the pre-defined invalid symbol items, the item with the largest log probability is selected as the effective competitive score from the remaining items. ;

[0071] Step S3043: Calculate the alignment boundary margin at each time step. And calculate the marginal loss. , It is an activation function;

[0072] Step S3044: Alignment boundary margins for each time step Sort the data and select the first few with the smallest marginal values. Each time step is considered as a vulnerable time step set;

[0073] Step S3045: Perform a soft-min smoothing minimization operation on the aligned boundary margins of the fragile time step set to obtain the aggregated margin value, and map the aggregated margin value through the Sigmoid function to obtain the original gating coefficients;

[0074] Step S3046: Introduce a preheating factor to Preheating and mixing are performed to obtain Among them, preheating factor R represents the preset number of warm-up iterations, i represents the i-th iteration, and a non-zero lower bound is set for the gating weights. The dynamic continuous gating weights are obtained. ;

[0075] Step S3047: Based on reference alignment label score Calculate the confidence factor for identification This is combined with the tradeoff coefficient c, the dynamic continuous gating weight H, and the marginal loss. Construction attack losses :

[0076] ;

[0077] Step S3048: Combine attack losses with disturbances The sum of the norm terms yields the gated weighted alignment boundary marginal loss. :

[0078] ; express Norm.

[0079] Pseudocode for calculating the boundary marginal loss of gated weighted alignment:

[0080] Input: Frame-level log probability matrix Reference alignment label sequence Number of vulnerable time steps k, soft minimization temperature parameter Sigmoid mapping coefficients lower gate Trade-off coefficient c, disturbance Invalid symbol set ;

[0081] Output: Gated weighted aligned boundary margin loss (Loss);

[0082] 1:for t = 1..T do

[0083] 2: ;

[0084] 3: Exclude candidates from the candidate set Ch and (When the target sequence recognition model uses a connection-time classification (CTC) decoding structure, It must contain at least a blank symbol; when the CTC structure is not used, (This can be an empty set or contain invalid symbols that need to be excluded by default) The corresponding items form the set. ;

[0085] 4: / / ;

[0086] 5: ;

[0087] 6:end for

[0088] 7: ;

[0089] 8: Select the k time steps with the smallest marginal values ​​to form a fragile set:

[0090] 9: ;

[0091] 10: soft-min aggregation margin:

[0092] 11: ;

[0093] 12: The Sigmoid mapping yields the original gating coefficients:

[0094] 13: ; / / Sigmoid function

[0095] 14: Calculate the preheating factor:

[0096] 15: ;

[0097] 16: Preheating and mixing to obtain the gate coefficient:

[0098] 17: ;

[0099] 18: Introducing lower bound constraints to obtain dynamic continuous gating weights:

[0100] 19: ;

[0101] 20: Identify confidence factors:

[0102] twenty one: ;

[0103] 22: Construction Attack Loss ;

[0104] 23: Calculate the marginal loss of the gated weighted alignment boundary:

[0105] twenty four: ;

[0106] 25: Output Loss.

[0107] Step S305: Calculate Loss with respect to the perturbation gradient .

[0108] Step S306: For the gradient Perform gradient norm pruning to ensure that the L2 norm of the update direction does not exceed a preset threshold. .

[0109] Step S307: Update the perturbation based on gradient using the Adam optimization algorithm. .

[0110] Step S308: Based on the updated perturbation Generate candidate adversarial examples And based on the numerical clipping results, the disturbance is... Perform projection update .

[0111] Step S309: Process the candidate adversarial examples obtained from the current inner layer iteration. The attack success determination is made when the perturbation norm is at that moment. Smaller than the current record ,Will As the best candidate adversarial sample Use the current renew ,in, This represents the optimal perturbation norm, while not exceeding the number of iterations. Under the condition of [condition], continue iterating to further reduce the perturbation; if the attack fails and the maximum number of iterations is not reached... If so, return to steps S303 to S309.

[0112] Step S310: Complete the first After the second search of the tradeoff coefficient, based on whether it is in the current tradeoff coefficient... Get successful adversarial samples from the candidates and update the tradeoff coefficients. search lower bound Or search the upper bound Repeat steps S302 to S310 until the binary search count is reached. Output the candidate adversarial example with the smallest perturbation norm during the search process. As the final candidate adversarial example.

[0113] Pseudocode for generating candidate adversarial examples:

[0114] Input: Identifiable sample Its reference alignment label sequence Target sequence recognition model G, decoding function Maximum number of iterations Learning rate Trade-off coefficient, number of binary search attempts , , After success, continue iterating a certain number of times. Gradient clipping threshold And the parameters for calculating Loss;

[0115] Output: Candidate adversarial examples ;

[0116] 1: Initializing the perturbation ;

[0117] 2: Initialization , ;

[0118] 3:for do

[0119] 4: Basis Take the current trade-off coefficient: ;

[0120] 5: , ;

[0121] 6: for do

[0122] 7: ;

[0123] 8: ;

[0124] 9: Calculate Loss: ;

[0125] 10: ;

[0126] 11: if then

[0127] 12: ;

[0128] 13: end if

[0129] 14: Update the perturbation using Adam: ;

[0130] 15: ;

[0131] 16: (Projection update);

[0132] 17: Attack successful: ;

[0133] 18:if then

[0134] 19: ;

[0135] 20:if then

[0136] twenty one: ;

[0137] twenty two: ;

[0138] 23:end if

[0139] twenty four: ;

[0140] 25:if then break end if

[0141] 26:end if

[0142] 27:end for

[0143] 28:if then

[0144] 29: ;

[0145] 30:else

[0146] 31: ;

[0147] 32:end if

[0148] 33:end for

[0149] 34: Output .

[0150] In one embodiment, step S4 above, which involves performing total variational TV smoothing and amplitude scaling search under success-preserving constraints on candidate adversarial examples to generate high-fidelity adversarial examples, specifically includes:

[0151] Step S401: Obtain candidate adversarial examples Original input samples And make the optimal perturbation Construct a stable objective function while successfully preserving constraints. Stabilize the objective function This includes success preservation constraints to maintain the state of a successful attack and total variational regularization terms to smooth perturbations. ,in, The total variation coefficients, It is the total variational function;

[0152] Step S402: Based on the stabilized objective function Iterative update perturbation And perform numerical clipping after each update to obtain And based on the numerical clipping results, the disturbance is... Perform projection update ;

[0153] Step S403: During the stabilization iteration, a temporary sample is obtained each time based on the perturbation update. And determine whether it satisfies the successful hold constraint by decoding the result; when When the successful preservation constraint is satisfied, update and record the current optimal adversarial perturbation; when If the successful preservation constraint is not met, the optimal record is not updated, and the iteration continues until the preset number of smooth iterations is reached. ;

[0154] Step S404: After completing the total variation (TV) smoothing process, apply the smoothed perturbation... Perform an amplitude scaling search, and set the scaling factor... ,initialization , And record the optimal scaling factor. ;

[0155] Step S405: Execute scaling factor Binary search, in the first... In the second search, Construct scaled candidate samples And test Does the constraint of successful maintenance satisfy? If so, let... And update If not satisfied, update. Repeat this process until the preset number of binary search iterations is reached. ;

[0156] Step S406: Output high-fidelity adversarial examples .

[0157] Pseudocode for generating high-fidelity adversarial examples (stabilization and smoothing + amplitude scaling binary search)

[0158] Input: Candidate adversarial examples Original sample Reference alignment label sequence ,

[0159] Target sequence recognition model G, correct label sequence l,

[0160] Smooth iteration count TV weight Refined step length ,

[0161] Successfully maintain margin Scaling the binary search order ,

[0162] Invalid symbol set (When using the CTC decoding structure, It must contain at least a blank symbol; when the CTC structure is not used, (Can be an empty set or contain invalid symbols that must be excluded by default).

[0163] Output: High-fidelity adversarial examples ;

[0164] 1: Order ;

[0165] 2: Establish a stable target:

[0166] 3: ;

[0167] 4: for s = 1. do

[0168] 5: Forward inference yields the frame-level log probability matrix:

[0169] 6: ;

[0170] 7: for t = 1..T do

[0171] 8: ;

[0172] 9: Exclude from candidate set Ch and Get the set ;

[0173] 10: ;

[0174] 11: ;

[0175] 12: end for

[0176] 13: Construct a successful maintenance term:

[0177] 14: ;

[0178] 15: Obtain the stabilization target:

[0179] 16: ;

[0180] 17: Calculate the gradient: ;

[0181] 18: Update the perturbation using Adam: ;

[0182] 19: Projection Update:

[0183] 20: ;

[0184] twenty one: ;

[0185] 22: Successful determination maintained: ;

[0186] 23: if then

[0187] 24: Keep updated: ;

[0188] 25: else

[0189] 26: Decrease step size: ;

[0190] 27: end if

[0191] 28: end for

[0192] 29: Amplitude scaling binary search: Let the scaling factor be... ;

[0193] 30: Initialization , , ;

[0194] 31: for r=1.. do

[0195] 32: ;

[0196] 33: ;

[0197] 34: Successful maintenance determined: ;

[0198] 35: if then

[0199] 36: ;

[0200] 37: ;

[0201] 38: else

[0202] 39: ;

[0203] 40: end if

[0204] 41: end for

[0205] 42: Output .

[0206] Regarding the aforementioned marginal loss The following example illustrates how to align label sequences based on a reference. Calculate the aligned boundary edges and select the set of vulnerable time steps:

[0207] Suppose we have an input sample from the set of identifiable samples. The input target sequence recognition model has an output time step of T=2 and a possible label set Ch of size 3. Let's assume the three labels are a, b, and c (when the model is a CTC structure, the blank symbol is considered a default invalid symbol and needs to be excluded when calculating competing labels). For ease of explanation, the log probability values ​​here are represented by equivalent normalized fractions. Let the frame-level log probability matrix output by this sample during the testing phase be... Therefore, the log probability vector for the first time step is The log probability vector at the second time step is According to step S105, the reference alignment label sequence can be obtained by taking the maximum value index for each time step. Therefore, we can conclude that:

[0208] At time step t=1, the reference label is a, and its logarithmic probability fraction is... The highest logarithmic probability score among the remaining labels (excluding reference label 'a', and excluding any blank labels as well) is taken as the valid competitive score. Therefore, the aligned boundary edge is At time step t=2, the reference label is still 'a', and its logarithmic probability fraction is... Effective competition score ,therefore .

[0209] Therefore, the alignment boundary sequence is as follows: If the number of vulnerable time steps is set to k=1, then the time step t=2 with the smallest alignment boundary margin is selected as the set of vulnerable time steps, i.e. Furthermore, by performing a smooth minimization operation on the aligned boundary margins in the fragile time step set and then applying a Sigmoid mapping, a dynamic continuous gating weight H can be obtained, giving greater attention to the optimization update at time step t=2; simultaneously, the marginal loss is calculated as follows: Based on this, the confidence factor S, the tradeoff coefficient c, and the disturbance are combined. The norm can be used to construct and compute the gated weighted aligned boundary marginal loss (Loss) and use it for subsequent gradient calculation and perturbation update.

[0210] Figure 2 This is a schematic diagram of the overall architecture of the method of the present invention.

[0211] like Figure 3A and Figure 3B This is a schematic diagram illustrating the qualitative results of the method of the present invention. Note: For ease of observation, Figure 3A The adversarial perturbation image in the image is a perturbation image obtained by multiplying the value of the original adversarial perturbation image by 20.

[0212] (1) Visualized qualitative results:

[0213] Depend on Figure 3A As can be seen, in complex scenarios, the adversarial examples generated by this invention maintain a high degree of visual consistency with the original examples, and the adversarial perturbations are not easily detected visually; at the same time, by Figure 3B As can be seen, compared with other attack methods, the perturbation of the present invention is more concentrated in a certain area, rather than adding perturbation to the whole area. This can both cause the target model recognition result to deviate and have good attack effectiveness and concealment.

[0214] Furthermore, for ASR tasks, this invention provides qualitative visualization results in both the frequency domain and the time domain: Figure 4A To counteract the comparison of spectrograms of the preceding and following speech. Figure 4B To compare the time-domain waveforms of the preceding and following audio recordings. (By...) Figures 4A-4B As can be seen, the adversarial speech maintains the same overall structure as the original speech, with only minor differences, and the similarity in the spectrogram is also better than other methods, indicating that the present invention can maintain good perceptual quality while ensuring the success of the attack.

[0215] (2) Quantitative results:

[0216] Table 1 presents the quantitative comparison results of the proposed method and the comparative methods on STR tasks (SVT, CUTE80) and ASR tasks (LibriSpeech subset). The proposed method achieves a high attack success rate (SR) on different recognition models and datasets, while also outperforming in terms of perturbation magnitude and quality metrics. For example, on the CRNN model for STR, the proposed method achieves an SR of 100.00% on both SVT and CUTE80, and the ASR on SVT... The SNR of the present invention was reduced from 0.69 to 0.58 compared to the comparison method; on the ASR Wav2Vec 2.0 model, the SNR of the present invention was increased from 18.96 dB to 40.66 dB, and the PESQ was increased from 1.59 to 3.28.

[0217] Table 1. Quantitative comparison results between the method of this invention and current adversarial attack methods.

[0218]

[0219] To further verify the effectiveness of key components, this invention conducted ablation experiments on the stabilization phase, and the results are shown in Table 2. It can be seen that after introducing stabilization, while maintaining the success of the attack, the STR side... Smaller and with better SSIM / ED, ASR side Smaller size and higher SNR / PESQ indicate that the stabilization phase can effectively improve the concealment and usability of adversarial examples.

[0220] Table 2. Quantitative comparison results between the method of this invention and the ablation comparison method.

[0221]

[0222] Two typical examples of embodiments of the present invention are as follows:

[0223] like Figure 5A Example 1 illustrates the application of this invention in privacy / copyright protection. First, samples containing sensitive / privacy information or requiring copyright protection are input into a sequence recognition model (using the STR model as an example here) and attacked using the frame-level alignment boundary adversarial attack method proposed in this invention, resulting in adversarial samples. These adversarial samples cannot be correctly recognized by the target model, thus achieving the effects of information hiding, privacy protection, and copyright protection.

[0224] like Figure 5BExample 2 illustrates the application of this invention in enhancing the robustness and security of sequence recognition models (again, using the STR model as an example). First, clean samples are input into the STR model, and adversarial samples are generated using the frame-level alignment boundary adversarial attack method proposed in this invention. Then, the adversarial samples and correct labels are input into the model again for training, and the above attack operation is repeated continuously. By using the method proposed in this invention for adversarial training and iterative iteration, the robustness and security of the model against adversarial attacks can be improved.

[0225] Example 2:

[0226] like Figure 6 As shown, this embodiment provides a frame-level alignment boundary adversarial attack system for sequence recognition models, including the following modules:

[0227] The data and prediction output acquisition module 51 is used to input the original samples of the dataset into the target sequence recognition model during the testing phase, obtain the frame-level log probability matrix corresponding to each sample, and construct the initial reference aligned label sequence; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence;

[0228] The alignment boundary construction module 52 is used to filter samples that the target sequence recognition model can correctly recognize based on the initial reference alignment label sequence and the correct label sequence, and to construct the alignment boundary based on the reference alignment label sequence and the frame-level log probability matrix corresponding to the sample.

[0229] The candidate adversarial sample generation module 53 is used to generate dynamic continuous gating weights based on the alignment boundary margins using smooth mapping, construct a gating weighted alignment boundary margin loss for iterative updates, and simultaneously adaptively balance the attack intensity through a search mechanism to obtain candidate adversarial samples.

[0230] The high-fidelity adversarial example generation module 54 is used to perform total variational TV smoothing and amplitude scaling search under the successful preservation constraint on candidate adversarial examples to generate high-fidelity adversarial examples.

[0231] A frame-level alignment boundary adversarial attack apparatus for a sequence recognition model includes one or more electronic devices, wherein the one or more electronic devices are used to implement a frame-level alignment boundary adversarial attack method for the sequence recognition model.

[0232] An electronic device includes: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement a frame-level alignment boundary adversarial attack method against a sequence recognition model.

[0233] A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to implement a frame-level alignment boundary adversarial attack method against a sequence recognition model.

[0234] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A frame-level alignment boundary adversarial attack method for sequence recognition models, characterized in that, include: Step S1: During the testing phase, the original samples of the dataset are input into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample, and an initial reference aligned label sequence is constructed; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence; Step S2: Based on the initial reference alignment label sequence and the correct label sequence, filter the samples that the target sequence recognition model can correctly recognize, and construct the alignment boundary margin according to the reference alignment label sequence and frame-level log probability matrix corresponding to the sample; Step S3: Based on the alignment boundary margin, generate dynamic continuous gating weights using smooth mapping, construct a gating weighted alignment boundary margin loss for iterative updates, and simultaneously adaptively balance the attack intensity through a search mechanism to obtain candidate adversarial samples, specifically including: Step S301: Initialize the disturbance Set the maximum number of iterations for the adversarial attack algorithm. and learning rate and initialize the tradeoff coefficients. and its binary search parameters, wherein the binary search parameters include: the number of binary search operations. Search the lower bound Search upper bound And the number of iterations after a successful attack. ; Step S302: Enable the tradeoff coefficient The outer loop of the binary search, in the first... During the secondary search for tradeoff coefficients, the current tradeoff coefficients are determined. and perform inner layer iterative updates; Step S303: In the inner layer iteration update... In the wheel, the disturbance will be Add to original sample And perform numerical cropping to obtain the current candidate adversarial samples. ,in, For the clipping function, and Input the upper and lower bounds of the preset valid value range for the sample, respectively. Input the target sequence recognition model to obtain the frame-level log probability matrix. ; Step S304: Based on the frame-level log probability matrix A gated weighted marginal optimization objective is constructed by aligning the label sequence with the reference, and then combined with the perturbation. Norm and current tradeoff coefficient The calculated gated weighted alignment boundary marginal loss Loss includes: Step S3041: Based on the reference aligned tag sequence, from the frame-level log probability matrix Extract the logarithmic probability value of the reference alignment label corresponding to each time step, and use it as the reference score. ; Step S3042: For each time step In the frame-level log probability matrix In the corresponding prediction vector, after excluding the items corresponding to the reference alignment labels and the pre-defined invalid symbol items, the item with the largest log probability is selected as the effective competitive score from the remaining items. ; Step S3043: Calculate the alignment boundary margin at each time step. And calculate the marginal loss. , It is an activation function; Step S3044: Alignment boundary margins for each time step Sort the data and select the first few with the smallest marginal values. Each time step is considered as a vulnerable time step set; Step S3045: Perform a soft-min smoothing minimization operation on the aligned boundary margins of the fragile time step set to obtain aggregated margin values, and map the aggregated margin values ​​through the Sigmoid function to obtain the original gating coefficients. ; Step S3046: Introduce a preheating factor to Preheating and mixing are performed to obtain Among them, preheating factor , To preset the number of warm-up iterations, i represents the i-th iteration, and a non-zero lower bound is set for the gating weights. The dynamic continuous gating weights are obtained. ; S3047: Based on Calculate the confidence factor for identification ,in The number of time steps generated during the forward inference of the target sequence identification model, combined with the aforementioned tradeoff coefficient. Dynamic continuous gating weights and marginal loss Construction attack losses : ； Step S3048: Combine the attack loss with the disturbance The sum of the norm terms yields the gated weighted alignment boundary marginal loss. : ； Step S305: Calculate Loss with respect to the perturbation gradient ; Step S306: For Perform gradient norm pruning to ensure that the L2 norm of the update direction does not exceed a preset threshold. ; Step S307: Utilize the Adam optimization algorithm based on gradient... Update perturbation ; Step S308: Based on the updated perturbation Generate candidate adversarial examples And based on the numerical clipping results, the disturbance is... Perform a projection update; Step S309: Process the candidate adversarial examples obtained from the current inner layer iteration. The attack success determination is made when the perturbation norm is at that moment. Smaller than the current record ,Will As the best candidate adversarial sample Use the current renew ,in, This represents the optimal perturbation norm. express Norm; and within no more than the number of iterations. Under the condition of [condition], continue iterating to further reduce the perturbation; if the attack fails and the maximum number of iterations is not reached... If so, return to steps S303 to S309. Step S310: Complete the first After the second search of the tradeoff coefficient, based on whether it is in the current tradeoff coefficient... Get successful adversarial samples from the candidates and update the tradeoff coefficients. search lower bound Or search the upper bound Repeat steps S302 to S310 until the binary search count is reached. The candidate adversarial sample with the smallest perturbation norm during the search process is output as the final candidate adversarial sample. Step S4: Perform total variational TV smoothing and amplitude scaling search under the success-preserving constraint on the candidate adversarial examples to generate high-fidelity adversarial examples, specifically including: Step S401: Obtain candidate adversarial examples Original samples And make the optimal perturbation Construct a stable objective function while successfully preserving constraints. ,in, This includes success preservation constraints to maintain the state of a successful attack and total variational regularization terms to smooth perturbations. ,in, The total variation coefficients, It is the total variational function; Step S402: Based on the stabilized objective function Iterative update perturbation And perform numerical clipping after each update to obtain And based on the numerical clipping results, the disturbance is... Perform a projection update; Step S403: During the stabilization iteration, a temporary sample is obtained each time based on the perturbation update. And determine whether it satisfies the successful hold constraint by decoding the result; when When the successful preservation constraint is satisfied, update and record the current optimal adversarial perturbation; when If the successful preservation constraint is not met, the optimal record is not updated, and the iteration continues until the preset number of smooth iterations is reached. ; Step S404: After completing the total variation TV smoothing process, apply the smoothed perturbation... Perform an amplitude scaling search, and set the scaling factor... ,initialization , And record the optimal scaling factor. ; Step S405: Execute scaling factor Binary search, in the first... In the second search, Construct scaled candidate samples And test Does the constraint of successful maintenance satisfy? If so, then let... And update If not satisfied, then update. Repeat this process until the preset number of binary search iterations is reached. ; Step S406: Output high-fidelity adversarial examples .

2. The frame-level alignment boundary adversarial attack method for sequence recognition models according to claim 1, characterized in that, Step S1: During the testing phase, the original samples of the dataset are input into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample, and an initial reference aligned label sequence is constructed; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence, specifically including: Step S101: Obtain the dataset, which includes: an image set or an audio set, and the corresponding correct label sequence; Step S102: Obtain the architecture, weight parameters, and gradient information of the target sequence recognition model; Step S103: Switch the target sequence recognition model from training mode to testing mode; Step S104: Input the original samples in the dataset into the target sequence recognition model to obtain the frame-level log probability matrix corresponding to each sample; Step S105: Take the maximum value index of the prediction vector at each time step in the frame-level log probability matrix as the reference alignment label for the corresponding time step, and the reference alignment labels form an initial reference alignment label sequence according to the time steps.

3. The frame-level alignment boundary adversarial attack method for sequence recognition models according to claim 2, characterized in that, Step S2: Based on the initial reference alignment label sequence and the correct label sequence, samples that the target sequence recognition model can correctly recognize are selected. Based on the reference alignment label sequence and frame-level logarithmic probability matrix corresponding to the samples, alignment boundary margins are constructed, specifically including: Step S201: Compare the correct label sequence with the initial reference alignment label sequence, delete the samples that the target sequence recognition model cannot correctly recognize from the dataset, and obtain the correctly identifiable samples and their corresponding reference alignment label sequences; Step S202: Obtain the frame-level log probability matrix corresponding to the correctly identifiable samples; Step S203: Based on the frame-level logarithmic probability matrix and the reference alignment label sequence, determine the competing label for each time step and construct the alignment boundary margin, wherein the competing label is the index of the maximum logarithmic probability value after excluding the corresponding item of the reference alignment label and the corresponding item of invalid symbol, and the alignment boundary margin is the difference between the logarithmic probability value of the reference alignment label and the logarithmic probability value of the competing label.

4. A frame-level alignment boundary adversarial attack system for sequence recognition models, characterized in that, Includes the following modules: The data and prediction output acquisition module is used to input the original samples of the dataset into the target sequence recognition model during the testing phase, obtain the frame-level log probability matrix corresponding to each sample, and construct the initial reference aligned label sequence; wherein, the dataset includes an image set or an audio set, and the corresponding correct label sequence; The alignment boundary construction module is used to filter samples that the target sequence recognition model can correctly recognize based on the initial reference alignment label sequence and the correct label sequence, and construct the alignment boundary based on the reference alignment label sequence and the frame-level log probability matrix corresponding to the sample. The candidate adversarial example generation module is used to generate dynamic continuous gating weights based on the alignment boundary margin using a smooth mapping, construct a gating weighted alignment boundary margin loss for iterative updates, and simultaneously adaptively balance the attack intensity through a search mechanism to obtain candidate adversarial examples, specifically including: Step S301: Initialize the disturbance Set the maximum number of iterations for the adversarial attack algorithm. and learning rate and initialize the tradeoff coefficients. and its binary search parameters, wherein the binary search parameters include: the number of binary search operations. Search the lower bound Search upper bound And the number of iterations after a successful attack. ; Step S302: Enable the tradeoff coefficient The outer loop of the binary search, in the first... During the secondary search for tradeoff coefficients, the current tradeoff coefficients are determined. and perform inner layer iterative updates; Step S303: In the inner layer iteration update... In the wheel, the disturbance will be Add to original sample And perform numerical cropping to obtain the current candidate adversarial samples. ,in, For the clipping function, and Input the upper and lower bounds of the preset valid value range for the sample, respectively. Input the target sequence recognition model to obtain the frame-level log probability matrix. ; Step S304: Based on the frame-level log probability matrix A gated weighted marginal optimization objective is constructed by aligning the label sequence with the reference, and then combined with the perturbation. Norm and current tradeoff coefficient The calculated gated weighted alignment boundary marginal loss Loss includes: Step S3041: Based on the reference aligned tag sequence, from the frame-level log probability matrix Extract the logarithmic probability value of the reference alignment label corresponding to each time step, and use it as the reference score. ; Step S3042: For each time step In the frame-level log probability matrix In the corresponding prediction vector, after excluding the items corresponding to the reference alignment labels and the pre-defined invalid symbol items, the item with the largest log probability is selected as the effective competitive score from the remaining items. ; Step S3043: Calculate the alignment boundary margin at each time step. And calculate the marginal loss. , It is an activation function; Step S3044: Alignment boundary margins for each time step Sort the data and select the first few with the smallest marginal values. Each time step is considered as a vulnerable time step set; Step S3045: Perform a soft-min smoothing minimization operation on the aligned boundary margins of the fragile time step set to obtain aggregated margin values, and map the aggregated margin values ​​through the Sigmoid function to obtain the original gating coefficients. ; Step S3046: Introduce a preheating factor to Preheating and mixing are performed to obtain Among them, preheating factor , To preset the number of warm-up iterations, i represents the i-th iteration, and a non-zero lower bound is set for the gating weights. The dynamic continuous gating weights are obtained. ; S3047: Based on Calculate the confidence factor for identification ,in The number of time steps generated during the forward inference of the target sequence identification model, combined with the aforementioned tradeoff coefficient. Dynamic continuous gating weights and marginal loss Construction attack losses : ； Step S3048: Combine the attack loss with the disturbance The sum of the norm terms yields the gated weighted alignment boundary marginal loss. : ； Step S305: Calculate Loss with respect to the perturbation gradient ; Step S306: For Perform gradient norm pruning to ensure that the L2 norm of the update direction does not exceed a preset threshold. ; Step S307: Utilize the Adam optimization algorithm based on gradient... Update perturbation ; Step S308: Based on the updated perturbation Generate candidate adversarial examples And based on the numerical clipping results, the disturbance is... Perform a projection update; Step S309: Process the candidate adversarial examples obtained from the current inner layer iteration. The attack success determination is made when the perturbation norm is at that moment. Smaller than the current record ,Will As the best candidate adversarial sample Use the current renew ,in, This represents the optimal perturbation norm. express Norm; and within no more than the number of iterations. Under the condition of [condition], continue iterating to further reduce the perturbation; if the attack fails and the maximum number of iterations is not reached... If so, return to steps S303 to S309. Step S310: Complete the first After the second search of the tradeoff coefficient, based on whether it is in the current tradeoff coefficient... Get successful adversarial samples from the candidates and update the tradeoff coefficients. search lower bound Or search the upper bound Repeat steps S302 to S310 until the binary search count is reached. The candidate adversarial sample with the smallest perturbation norm during the search process is output as the final candidate adversarial sample. The high-fidelity adversarial example generation module is used to perform total variational TV smoothing and amplitude scaling search under success-preserving constraints on the candidate adversarial examples to generate high-fidelity adversarial examples, specifically including: Step S401: Obtain candidate adversarial examples Original samples And make the optimal perturbation Construct a stable objective function while successfully preserving constraints. ,in, This includes success preservation constraints to maintain the state of a successful attack and total variational regularization terms to smooth perturbations. ,in, The total variation coefficients, It is the total variational function; Step S402: Based on the stabilized objective function Iterative update perturbation And perform numerical clipping after each update to obtain And based on the numerical clipping results, the disturbance is... Perform a projection update; Step S403: During the stabilization iteration, a temporary sample is obtained each time based on the perturbation update. And determine whether it satisfies the successful hold constraint by decoding the result; when When the successful preservation constraint is satisfied, update and record the current optimal adversarial perturbation; when If the successful preservation constraint is not met, the optimal record is not updated, and the iteration continues until the preset number of smooth iterations is reached. ; Step S404: After completing the total variation TV smoothing process, apply the smoothed perturbation... Perform an amplitude scaling search, and set the scaling factor... ,initialization , And record the optimal scaling factor. ; Step S405: Execute scaling factor Binary search, in the first... In the second search, Construct scaled candidate samples And test Does the constraint of successful maintenance satisfy? If so, then let... And update If not satisfied, then update. Repeat this process until the preset number of binary search iterations is reached. ; Step S406: Output high-fidelity adversarial examples .

5. A frame-level alignment boundary adversarial attack device for sequence recognition models, characterized in that, It includes one or more electronic devices, wherein the one or more electronic devices are used to implement the frame-level alignment boundary adversarial attack method for sequence recognition models as described in any one of claims 1 to 3.

6. An electronic device, characterized in that, include: One or more processors; A memory for storing one or more programs, wherein, when the one or more programs are executed by the one or more processors, the electronic device implements the frame-level alignment boundary adversarial attack method for a sequence recognition model as described in any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that, It stores executable instructions, which, when executed by a processor, cause the processor to implement the frame-level alignment boundary adversarial attack method for sequence recognition models as described in any one of claims 1 to 3.

Images