Black box attack resisting method and system based on target feature guidance

Abstract

The invention relates to the technical field of resisting learning migration attacks, in particular to a black box attack resisting method and system based on target feature guidance, and the method comprises the steps: collecting an input image, determining a target type, and obtaining a clean sample and an adversarial sample based on the input image according to whether disturbance is added or not; performing clock jitter and color conversion on the clean samples and the adversarial samples by adopting a data enhancement method based on a human eye vision system, and establishing an enhanced sample set; extracting a feature map of the enhanced sample set through the proxy model; the disturbance is updated through momentum convolution, the proxy model is trained in combination with the feature map until the preset maximum number of iterations is reached, and an output image is obtained; and inputting the output image into the black box model to obtain an attack success rate corresponding to the target category. The problem that a gradient-based black box attack algorithm cannot extract target features is solved, and the mobility and the target attack success rate of an adversarial sample between different models such as an agent model or a black box model are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of adversarial learning transfer attack, and particularly relates to an adversarial black-box attack method and system based on target feature guidance. BACKGROUND

[0002] At present, deep neural networks are widely used in the real world, such as image classification, target detection and image segmentation. Although the effect is remarkable, it is easy to be affected by adversarial attacks, that is, generating a perturbation that is difficult to detect by human eyes, leading to network recognition error; adversarial attacks not only reveal the security problem of network in practical application, but also explore the sample representation problem in high-dimensional nonlinear space, which is closely related to image generation, neural network explainability and other fields.

[0003] Adversarial attacks can be divided into gradient-based attacks and non-gradient-based attacks. Gradient-based attacks such as fast symbolic gradient descent rely on white-box model gradient to generate adversarial samples. Non-gradient-based attacks such as ADV-GAN (Adversarial Discriminative Variational Autoencoder) generate adversarial samples through a generator, which does not rely on white-box model gradient, but requires a discriminator to guide the generator as a proxy for the white-box model, and the GAN network requires more samples and training time. At the same time, adversarial attacks can also be divided into targeted attacks and untargeted attacks. Untargeted attacks only need to make the deep neural network classification error, and targeted attacks need to make it classified into a specified category, which is more difficult to achieve. White-box attack means that the attacker can obtain the model structure and parameters, while black-box attack cannot obtain the model structure and parameters, and black-box attack is more meaningful than white-box attack.

[0004] Since the weights and parameters of the model are known, white-box attacks can achieve a very high attack success rate; but black-box attacks using gradient-based methods are difficult to achieve ideal results. Firstly, the weights and structure of the model are unknown, and the adversarial samples generated from the proxy model may not be suitable for the black-box model; secondly, gradient-based attacks have no mechanism to prevent adversarial samples from overfitting to the proxy model, which makes the attack success rate very high when attacking the white-box model. Once the model weights and structure change, the attack success rate will drop straight down.

[0005] To solve such defects, the prior art enhances the sample input, that is, randomly performs operations such as cropping, translation, and scale transformation on the picture in a multi-round iterative attack process; or improves the gradient information of the white box model, which is reflected in the process of updating the sample gradient, and the gradient information of the adjacent sample or the gradient information in the previous iteration process is constrained by increasing the regularization term; more search directions are obtained from the feature space of the white box, which is reflected in the intermediate layer output of the proxy model, the distance between the adversarial sample and the clean sample is pulled away, the neuron weight is calculated by back propagation to generate a guide weight to re-propagate the adversarial features; but such methods are difficult to realize targeted transfer attacks, resulting in a low success rate of targeted attacks, or requiring additional sample data. SUMMARY

[0006] In order to solve the technical problems of low success rate of gradient-based black box attacks and overfitting phenomenon of generated adversarial samples, the purpose of the present application is to provide an adversarial black box attack method based on target feature guidance, and the technical solution adopted is as follows:

[0007] Collecting an input image to determine a target category, and obtaining a clean sample and an adversarial sample based on the input image according to whether a disturbance is added;

[0008] A data enhancement method based on the human eye visual system is used to perform clock jitter and color transformation on the clean sample and the adversarial sample to establish an enhanced sample set;

[0009] A proxy model is obtained, and features of the enhanced sample set are extracted through the proxy model;

[0010] The disturbance is updated by momentum convolution, the proxy model is trained in combination with the features, until a preset maximum number of iterations is reached, and an output image is obtained;

[0011] The output image is input into a black box model to obtain an attack success rate corresponding to the target category.

[0012] Preferably, the clean sample and the adversarial sample are obtained based on the input image according to whether a disturbance is added, specifically:

[0013] When the input image is not added with a disturbance, it is recorded as a clean sample; when the input image is added with a randomly initialized disturbance, it is recorded as an adversarial sample.

[0014] Preferably, a data enhancement method based on the human eye visual system is used to perform clock jitter and color transformation on the clean sample and the adversarial sample to establish an enhanced sample set, including:

[0015] Random clock jitter is applied to the clean sample and the adversarial sample;

[0016] Several images are generated by copying clean samples and adversarial samples. The RGB pixel values ​​are decayed exponentially to form a mini-batch, thus completing the color transformation.

[0017] Clean samples and adversarial samples that have undergone clock jitter and color transformation processing are integrated to form an enhanced sample set.

[0018] Preferably, the feature map of the enhanced sample set is extracted through a surrogate model, including:

[0019] Based on the proxy model, the enhanced sample set is processed to obtain feature maps of clean samples and adversarial samples respectively;

[0020] The target label is determined based on the target category. The contribution of the feature map to the target label is determined. The feature map is then processed by backtracking the contribution to obtain the target feature weights, and then optimized.

[0021] Preferably, the target feature weights are obtained as follows:

[0022] The result corresponding to the feature map is defined as the activation value. The contribution of the activation value to the target label in the target category is determined by combining the surrogate model. The target feature weight is generated according to the contribution and then averaged according to the number of channels of the feature map.

[0023] Preferably, the target feature weights are obtained, and the corresponding calculation formula is as follows:

[0024]

[0025] in, Represents the target feature weights. This represents the images in the augmented sample set. Indicates the target label; The proxy model represents the image In target label The logit value on; Represents the feature map; Indicates gradient operation; , These represent the length and width of the feature map, respectively.

[0026] Preferably, the target feature weights are optimized as follows:

[0027] By combining the feature maps and target feature weights, we obtain feature activation maps of clean samples and adversarial samples with respect to the target category. By minimizing the cosine similarity of the feature activation maps, we bring the adversarial samples closer to the target category.

[0028] Preferably, momentum convolution updates the perturbation, and the surrogate model is trained using feature maps until a preset maximum number of iterations is reached to obtain the output image, including:

[0029] The loss function is designed, the momentum update and the gradient convolution mechanism are used to update the gradient, and the disturbance update and constraint are combined with the feature map;

[0030] Until the preset maximum number of iterations is reached, the updated disturbance is output, and the updated disturbance is added to the clean sample to generate an output image.

[0031] Preferably, the output image is input into the black box model to obtain an attack success rate corresponding to the target category, specifically:

[0032] The output image is input into the black box model to determine whether the output image is identified as the target category or misclassified by the black box model, and the target attack success rate or the non-target attack success rate is obtained, respectively.

[0033] To solve the above problems, the present application also provides: an adversarial black box attack system based on target feature guidance, the system comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the adversarial black box attack method based on target feature guidance.

[0034] The present application has the following advantages:

[0035] 1. Based on the analysis and processing of the input image, the data enhancement method based on the human eye visual system is adopted to establish an enhanced sample set, and the disturbance generalization ability is improved, that is, by simulating the micro tremor of the human eye and the characteristics of the high color of the center of the retina and the low color of the edge, the clean sample and the adversarial sample are subjected to clock jitter and color attenuation processing, forming diversified enhanced samples, effectively preventing the overfitting of the adversarial disturbance to the white box model features, enhancing the robustness and cross-model generalization ability of the disturbance, so that the generated adversarial samples can maintain a high attack success rate on different structure networks. Through the proxy model to extract the feature map, the analysis is carried out around the feature map, the target feature alignment ability of the adversarial sample is improved, the problem that the gradient-based black box attack algorithm cannot extract the target feature is solved, and the migration and target attack success rate of the adversarial sample between different models such as proxy model or black box model are significantly improved.

[0036] 2. The adversarial black box attack system based on target feature guidance provided by the present application has the same advantages as the adversarial black box attack method based on target feature guidance provided by the present application, and will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced. Obviously, the accompanying drawings in the following description only only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor based on these drawings.

[0038] Figure 1 A step flow chart of a target feature guided anti-black-box attack method provided by an embodiment of the present application;

[0039] Figure 2 A model framework schematic diagram of a target feature guided anti-black-box attack method provided by an embodiment of the present application;

[0040] Figure 3 A generated visual attention map of a target feature guided anti-black-box attack method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0041] In order to further illustrate the technical means and effects adopted by the present application to achieve the predetermined purpose, the specific implementation, structure, features and effects of a target feature guided anti-black-box attack method and system according to the present application are described in detail below in combination with the drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. In addition, the specific features, structures or characteristics in one or more embodiments can be combined in any suitable form.

[0042] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0043] The specific scheme of a target feature guided anti-black-box attack method and system provided by the present application is described in detail below in combination with the drawings.

[0044] The existing method has a low attack success rate in the scene of black-box targeted attack, mainly because the generated adversarial samples are over-fitted to the proxy model, and the gradient-based adversarial attack method cannot effectively extract the features of the target class, so that the adversarial samples cannot be migrated to other models; therefore, a target feature guided adversarial black-box attack method is proposed, which analyzes the clean samples, adversarial samples and proxy model, determines the feature map and obtains the output image, and then inputs the output image into other black-box models to obtain the attack success rate, so as to improve the attack success rate in the black-box scene; in order to realize the target feature guided adversarial black-box attack method, a target feature guided adversarial black-box attack system is provided, which is essentially a software system composed of various functional units, and the specific steps of the method will be described in detail.

[0045] Please refer to Figure 1 and Figure 2 , which shows a step flow chart and model framework schematic diagram of a target feature guided adversarial black-box attack method provided by an embodiment of the application, the method comprising:

[0046] Step S1: collecting input images to determine target categories, and obtaining clean samples and adversarial samples based on whether to add perturbations according to the input images;

[0047] Step S2: using a data enhancement method based on the human eye visual system to perform clock jitter and color transformation on the clean samples and adversarial samples, and establishing an enhanced sample set;

[0048] Step S3: obtaining a proxy model, and extracting the feature map of the enhanced sample set through the proxy model;

[0049] Step S4: updating the perturbation by momentum convolution, training the proxy model in combination with the feature map, until the preset maximum number of iterations is reached, and obtaining an output image;

[0050] Step S5: inputting the output image into a black-box model to obtain the attack success rate corresponding to the target category.

[0051] For better illustration, the adversarial attack refers to adding a human eye imperceptible perturbation to an image to make the neural network classification error, for example, the adversarial attack is usually based on a random perturbation, which is added to the image and the loss of the model output and the real category is calculated, then the perturbation is updated to increase the loss of the model output and the real category, until the image with the added perturbation is misclassified by the model, and the target of the adversarial attack is achieved.

[0052] The existing adversarial attack methods can well attack the white-box model, such as an iterative fast gradient sign method (I-FGSM), a momentum iterative fast gradient sign method (MI-FGSM), a feature disruptive attack (FDA) and a self-university (DTMI-SU) and the like; and a state-of-the-art (SOTA) method CFM (clean featue mixup) of the migration attack is to store the feature map of a clean sample in advance, to fuse the feature map into the feature map of an adversarial sample, to encourage a gradient-based optimization method to find more samples and more anti-interference local minimum points, so as to realize the migration of the adversarial sample. Although these methods have made certain progress in the research in the field, there are still limitations: the FDA needs to additionally train a full connection layer to output the category of the adversarial sample, and if the white-box model is replaced, the full connection layer needs to be retrained; as the SOTA method, the CFM needs to store the feature map of an additional clean sample before training, and also needs an additional extraction and storage module to be inserted into the white-box model. The only method DTMI-SU that does not need additional resources and can achieve targeted attack has a large gap in the migration success rate compared with the SOTA method. Therefore, the application provides an adversarial black-box attack method based on target feature guidance.

[0053] Further, in step S1, clean samples and adversarial samples are obtained based on the input image according to whether a disturbance is added, specifically:

[0054] When the input image is not added with a disturbance, it is recorded as a clean sample; when the input image is added with a randomly initialized disturbance, it is recorded as an adversarial sample.

[0055] As an optional implementation, a plurality of input images are collected to construct an image data set, and the number of categories and the image size are covered, and the image data set is any one of CIFAR10 (Canadian Institute For Advanced Research 10) and ImageNet-Competitable (compatible with ImageNet), wherein the CIFAR10 includes 10 categories, and the image size is ; the ImageNet-Competitable includes 1000 categories, and the image size is ; so that the image data set of the present application can be analyzed separately for small size and large size.

[0056] Specifically, in step S1, the input image is collected to determine the target category, i.e. randomly selecting the target category as the attack target based on the input image, and the target category is inconsistent with the original category of the input image; then, the clean sample and the adversarial sample are constructed respectively, i.e. randomly initializing the perturbation and adding it to the input image to obtain the adversarial sample, and the corresponding calculation formula is:

[0057]

[0058]

[0059] wherein, represents the adversarial sample; represents the input image; represents the initial perturbation; represents uniform random sampling in the interval .

[0060] Further, in step S2, it includes:

[0061] Step S21: applying random clock jitter to the clean sample and the adversarial sample; i.e. applying random clock jitter with an amplitude not exceeding 5% to the clean sample and the adversarial sample to simulate the micro-tremor phenomenon in the human visual system, so as to more truly simulate the dynamic visual environment of human observation of images, and to facilitate the improvement of anti-interference ability.

[0062] Step S22: copying the clean sample and the adversarial sample to generate several copies, forming a mini-batch according to the exponential decay of RGB pixel values, and completing color transformation.

[0063] Specifically, the input image is copied to generate multiple copy images, the copy images are attenuated according to the exponential decay law, and then the processed pixel values are integrated to form a mini-batch, i.e. simulating the phenomenon that the optical perception cells in the center of the retina are more than those in the edge area in the human eye visual system, so that the model receives an integrated image with rich color in the center and single color at the edge of the field of view, enhancing the model's adaptability to the diversity of input images.

[0064] Step S23: integrating the clean sample and the adversarial sample processed by clock jitter and color transformation to form an enhanced sample set.

[0065] Specifically, the corresponding calculation formula is:

[0066]

[0067] wherein, Indicates augmented samples; Indicates the input image; Indicates random clock jitter; This indicates that a color transformation is being performed on the image; It indicates an increased intensity.

[0068] It can be explained that, with the increase in strength As the input image color decreases exponentially, even though the human eye can no longer recognize the image, such a 'completely black' image still has meaning. For the neural network, such an image simply means that the RGB values ​​are fewer, not all zero. The removal of redundant information actually helps the convolutional neural network obtain richer information. That is, by using data augmentation methods based on the human visual system to perform clock jitter and color transformation on the input image, the perturbation is prevented from relying too much on the surrogate feature space, thus alleviating the overfitting phenomenon of adversarial examples based on gradient models.

[0069] Further, in step S3, feature maps of the enhanced sample set are extracted using a surrogate model, including:

[0070] Step S31: Process the augmented sample set based on the proxy model to obtain feature maps of clean samples and adversarial samples respectively.

[0071] As an optional implementation, surrogate models are used to ensure correct classification of input images to filter clean samples, including but not limited to ResNet-50 and Inception-V3; wherein, ResNet-50 (Residual Network) is a deep residual network containing 50 weighted layers, consisting of an input layer, a... It consists of convolutional layers, max pooling layers, 16 residual units, global average pooling layers, and a fully connected output layer, with each residual unit containing several The model uses convolutional layers and identity mapping connections, employing batch normalization (BN) and ReLU activation functions. This effectively mitigates the vanishing and exploding gradient problems while maintaining a deep network structure, thus obtaining more generalizable high-level semantic features during feature extraction. Inception-V3 consists of multiple stacked Inception modules, each of which operates in parallel. , , The convolution and pooling operation fuses multi-scale feature information. The overall structure of the model includes an input layer, an initial convolution layer group, several Inception modules, an average pooling layer, and a full connection layer. The model uses factorized convolution (FC) and batch normalization strategy to reduce the computational complexity and overfitting risk. It also expands the network structure in the width direction, making the model perform excellently in extracting cross-scale features and providing multi-scale feature activation and more abundant gradient information for the generation of adversarial samples.

[0072] For illustration, the feature map of the input image is usually extracted based on the intermediate layer of the proxy model, and the intermediate layer is denoted as the layer, and the feature map is , and the corresponding dimension is , , where batchsize represents the batch size; , where the number of channels is represented by , , where height and width of the feature map are represented by

[0073] Table 1: Explanation of the intermediate layer of the proxy model

[0074]

[0075] Step S32: Determine the target label according to the target category, determine the contribution degree of the feature map to the target label, process the feature map through the contribution degree to obtain the target feature weight, and optimize it.

[0076] It can be understood that in the gradient-based method, the target category features cannot be obtained explicitly by training the generator, discriminator or additional intermediate layer full connection layer to align the target features. It is generally believed that it is difficult to directly extract the target features for target attack; however, the original features of the target sample dominate during the input process of the network, which does not mean that there is no target feature. Only by extracting and enhancing the target feature can the target adversarial attack be completed, that is, although the target category features cannot be obtained by explicit training in the prior art, during the forward propagation process of any input image through the neural network, the model will respond to all categories, including the target category. Although the response is weak, the gradient direction and feature contribution degree corresponding to the target category still objectively exist, so they are considered as the implicit feature information of the target category to achieve target attack without additional image samples or training.

[0077] To clarify, the target feature is not the significant semantic feature of the real sample of the target category, but rather the feature contribution response of the model to the input image in the direction of the target category. Thus, the target feature refers to the feature region corresponding to the contribution of the input image to the logit output of the target category on the feature map of each layer inside the model. Therefore, in this application, the target feature weight is constructed by using the feature contribution response, so that the adversarial sample gradually moves towards the direction of the target category.

[0078] Further, in step S32, the target feature weights are obtained, specifically as follows:

[0079] The result corresponding to the feature map is defined as the activation value. The contribution of the activation value to the target label in the target category is determined by combining the surrogate model. The target feature weight is generated according to the contribution and then averaged according to the number of channels of the feature map.

[0080] In this embodiment, the first Layer corresponding feature map As a proxy model The activation value of the layer; the contribution refers to the logit value of the surrogate model for the image with respect to the label, which reflects the raw score of the model output without normalization, and is used to effectively distinguish different categories.

[0081] Further, in step S32, the target feature weights are obtained, and the corresponding calculation formula is as follows:

[0082]

[0083] in, Represents the target feature weights. This represents the images in the augmented sample set. Indicates the target label; The proxy model represents the image In target label The logit value on; Represents the feature map; Indicates gradient operation; , These represent the length and width of the feature map, respectively.

[0084] It can be explained that the target feature weights reflect the cleanness of the sample relative to the target class in the th... Channel weights of layer feature maps; where a larger value for an image region indicates a greater contribution of the region corresponding to the clean sample feature map to the target category in the model output, thus indirectly solving the problem that gradient-based targeted black-box attack methods cannot extract target category features.

[0085] Further, in step S32, the target feature weights are optimized, specifically as follows:

[0086] By combining the feature maps and target feature weights, we obtain feature activation maps of clean samples and adversarial samples with respect to the target category. By minimizing the cosine similarity of the feature activation maps, we bring the adversarial samples closer to the target category.

[0087] Specifically, the feature maps obtained in the preceding steps, i.e., the activation values, are multiplied by the target feature weights to obtain the feature activation maps of clean samples and adversarial samples with respect to the target category. The cosine similarity of the feature activation maps is minimized, i.e., the applied feature weights are minimized. The corresponding calculation formula is as follows:

[0088]

[0089] in, This represents minimizing the cosine similarity of the feature activation maps; , These represent the adversarial sample and the clean sample at the 1st... The activation value of the layer; Indicates the target feature weights; This indicates channel-by-channel multiplication.

[0090] It can be explained that the target feature weights This value represents the activation strength of the model in the feature space under the target class. The higher the value, the greater the contribution of that location to the target class. This represents the adversarial sample after iterative optimization of the feature map from the initial adversarial sample; channel-wise multiplication. This is used to perform multiplication operations on corresponding positions of each channel of the feature map to maintain consistency in the weighting across spatial dimensions; it guides the feature weights to extract features of the current sample related to the target category. This indicates the extraction of features related to the target category from adversarial examples. Similarly, this can be expressed as extracting features about the target category from clean samples. Since the attack target category is different from the clean target category, the feature activation of clean samples about the attack target category is very weak. Maximizing the difference in feature activation between adversarial samples and clean samples about the target category can maximize the features of adversarial samples about the target category. This will make the features of the input image far away from the features of clean samples and close to the features of the target category.

[0091] In addition, cosine similarity is used to measure the degree of similarity between two feature vectors in a direction, and the calculation formula is: , , These represent the flattened feature representation vectors, i.e., the bounding tensors. , The dimensions are respectively If they are all 4-dimensional vectors, then after flattening they are... It is a 1-dimensional vector to simplify calculations, and its range is... The closer the cosine similarity is to 1, the more similar the two feature vectors are in direction.

[0092] Further, in step S4, the following is included:

[0093] Step S41: design a loss function, update the gradient using a momentum update and a gradient convolution mechanism, and update and constrain the perturbation in combination with the feature map.

[0094] It is explained that the perturbation is iteratively updated based on the gradient-based optimization method, and the final adversarial sample is generated using a momentum update and a gradient convolution mechanism, thereby achieving targeted transfer attacks.

[0095] Specifically, first, define the class loss, and the corresponding calculation formula is:

[0096]

[0097] wherein, represents the class loss; represents the logit value output by the target model before the softmax layer, corresponding to the attack target class; represents an image in the enhanced sample set, represents the target label.

[0098] Next, determine the total loss, i.e. the loss function, and the corresponding calculation formula is:

[0099]

[0100] wherein, represents the total loss; represents the weight coefficient of the target feature guide loss.

[0101] It can be explained that, compared with the cross-entropy loss, directly using the logit value as the optimization target can more effectively alleviate the gradient vanishing problem that occurs during the adversarial attack process, and thereby determine the classification loss based on the logit output .

[0102] Based on the total loss, the noise added to the input image is updated by gradient backpropagation to maximize the value of the total loss, thereby completing the generation of adversarial perturbation, i.e. using momentum update and gradient convolution mechanism for gradient update, and the corresponding calculation formula is:

[0103]

[0104]

[0105] wherein, , respectively represent the first the second and the third the gradient of the second iteration; denotes a momentum coefficient; denotes a gradient difference; denotes a gradient smoothing convolution kernel; denotes a convolution operation.

[0106] To better illustrate, the momentum update mechanism can effectively avoid the current perturbation optimization from falling into a local optimal point by introducing a weighted item of the gradient of the last round in each round of gradient update; this way uses the direction information of the historical gradient to guide the optimization process to cross the local minimum area and obtain a global or suboptimal solution, thereby enhancing the generalization ability of the adversarial samples among multiple models; the gradient convolution mechanism simulates the translation data enhancement effect of the input image based on the translation invariance of the convolutional neural network by performing convolution operation on the gradient graph. Compared with directly performing multiple translation enhancement on the input image, this method does not need to perform repeated forward propagation calculation on the input image, thereby significantly reducing the calculation amount and storage consumption; and the gradient convolution realizes "virtual translation" in the gradient space, so that the generated perturbation has translation robustness in space, effectively alleviates the phenomenon that the adversarial perturbation overfits the proxy model, and improves the stability of the transfer attack.

[0107] Optionally, the gradient smoothing convolution kernel According to the feature layer resolution of the target model and the size of the input image, preferably , or the mean kernel or the Gaussian smoothing kernel, when the convolution kernel size is large, a wider range of translation simulation can be realized; when the convolution kernel size is small, local gradient details can be preserved; by adaptively adjusting the size of the convolution kernel, a balance between perturbation smoothness and target alignment can be achieved.

[0108] The perturbation update and constraint process, and the corresponding calculation formula are:

[0109]

[0110]

[0111]

[0112] wherein, , denote the adversarial perturbation of the first and the third iteration, respectively; denotes a step size; denotes a sign function; denotes a constant; denotes the input image of the first iteration.

[0113] It can be explained that when the sign function is 1; when is -1; when is 0; the constant represents the maximum disturbance amplitude, represents the size of the limited disturbance , which is within to ensure that the human eye is not easily perceived; represents the size of the limited adversarial sample , which is within corresponding to the RGB pixel value before normalization; so that in the transfer attack, it does not depend on additional resources other than the input image, and can only generate targeted adversarial samples with high transferability through a single proxy model and target class information.

[0114] Step S42: until the preset maximum number of iterations is reached, output the updated disturbance, and add the updated disturbance to the clean sample to generate an output image.

[0115] As an optional implementation, in the present embodiment, the maximum number of iterations is 300 rounds, and the specific case is adjusted according to the actual situation. Based on the updated disturbance output after 300 iterations in the foregoing step S41, the output image is generated by adding the updated disturbance to the clean sample, that is, the final adversarial sample.

[0116] Further, in step S5, specifically:

[0117] The output image is input into the black box model to determine whether the output image is recognized as the target class or misclassified by the black box model, and the targeted attack success rate or the untargeted attack success rate is obtained, respectively.

[0118] Specifically, the output image is input into the black box model, that is, other models different from the proxy model, to determine whether the output image is recognized as the attack target class or misclassified by other models, and then the targeted attack success rate or the untargeted attack success rate is calculated; the untargeted attack success refers to that after the adversarial sample is input into the model, that is, the output image is input into the black box model, the output class is different from the clean class; the targeted attack success refers to that after the adversarial sample is input into the model, the class output by the model is the same as the attack target class.

[0119] For better illustration, the application proposes a target feature guided adversarial black-box attack method is compared with traditional adversarial attack methods; wherein, TI-MIM (Tensorized Momentum Iterative Method, i.e. Tensorized Momentum Iterative Method), DI-MIM (Diverse Input Momentum Iterative Method, i.e. Diverse Input Momentum Iterative Method), Logits (Logits-based Attack, i.e. Logits-based Attack), DI-TI-MIM (Diverse Input Tensorized Momentum Iterative Method, i.e. Diverse Input Tensorized Momentum Iterative Method), DTMI-SU (Dynamic Targeted Momentum Iterative with Spatial Uncertainty, i.e. Dynamic Targeted Momentum Iterative with Spatial Uncertainty), FDA (Feature Distillation Attack, i.e. Feature Distillation Attack), BSR (Boundary Seeking Region, i.e. Boundary Seeking Region), IDAA (Iterative Distillation and Adversarial Attack, i.e. Iterative Distillation and Adversarial Attack), TFA (Transferable Feature Attack, i.e. Transferable Feature Attack), VGG16 (Visual Geometry Group 16-layer, i.e. Visual Geometry Group 16-layer network), AVG (Average Gradient Attack, i.e. Average Gradient Attack); then, about the attack method model corresponding to the calculation of the success rate of the targetless attack is explained: TAP (Targeted Adversarial Perturbation, i.e. Targeted Adversarial Perturbation), ATA (Adversarial Training Attack, i.e. Adversarial Training Attack), FIA (Fast Iterative Attack, i.e. Fast Iterative Attack), ANDA (Adversarial Noise Distillation Attack, i.e. Adversarial Noise Distillation Attack).

[0120] Specifically, clean samples are randomly collected from CIFAR10 and Imagenet-Compatible datasets to construct images, if the adversarial attack method used for comparison is designed for the application scenario of targetless attack, the success rate of targetless attack is calculated; if the adversarial attack method used for comparison is designed for the application scenario of targeted attack, the success rate of targeted attack is calculated.

[0121] It can be explained that the experimental correlation parameters are set in turn: the maximum disturbance amplitude is set to , the step size is set to , the maximum number of iterations is set to 300; and in the process of data enhancement of the input image, the clock jitter does not exceed 15% of the maximum size of the input image, the RGB pixel value is exponentially attenuated to form a mini-batch size set to 5; the momentum coefficient , the gradient smoothing convolution kernel , a Gaussian two-dimensional convolution kernel is used, and the corresponding simulation results are obtained, as shown in Table 2, the attack success rate of different targeted adversarial attack methods in the migration of 3 different models, and Table 3, the attack success rate of different untargeted adversarial attack methods in the untargeted migration of 3 different models.

[0122] Table 2 Attack success rate of different targeted adversarial attack methods in migration of 3 different models

[0123]

[0124] Table 3 Attack success rate of different untargeted adversarial attack methods in untargeted migration of 3 different models

[0125]

[0126] It is explained that, in terms of data comparison, the adversarial samples generated by TFA have excellent attack effect when migrated to different models; at the same time, the attack success rate of the adversarial samples generated by TFA using different proxy models is better than that of other adversarial attack methods.

[0127] It can be understood that based on the analysis and processing of the input image, a data enhancement method based on the human eye visual system is used to establish an enhanced sample set and improve the disturbance generalization ability, that is, by simulating the micro tremor of the human eye and the characteristics of the high color of the center of the retina and the low color of the edge, the clock jitter and color attenuation processing are performed on the clean samples and the adversarial samples, forming diversified enhanced samples, effectively preventing the overfitting of the adversarial disturbance to the white box model features, enhancing the robustness and cross-model generalization ability of the disturbance, so that the generated adversarial samples can maintain a high attack success rate on different structure networks. Through the proxy model to extract the feature map, the analysis is carried out around the feature map, the target feature alignment ability of the adversarial sample is improved, the problem that the gradient-based black box attack algorithm cannot extract the target feature is solved, and the migration and target attack success rate of the adversarial sample between different models such as proxy model or black box model are significantly improved.

[0128] It can be explained that by calculating the feature response of the input image to the target class in the white box model, the feature weight is generated for constraining the similarity of the adversarial sample and the target class in the feature space, that is, the feature weight can accurately locate the weight distribution of the model to the target class activation area, so that the generated adversarial sample is closer to the target class in the deep feature, solves the problem that the gradient-based black box attack algorithm cannot extract the target feature, and significantly improves the migration of the adversarial sample between different models and the target attack success rate; the data enhancement method based on the human eye visual system is adopted, the clock jitter and color attenuation processing are performed on the input image by simulating the micro tremor of the human eye and the characteristics of the high chrominance of the center of the retina and the low chrominance of the edge, and diversified enhanced samples are formed; and then the whole attack method effectively prevents the overfitting of the adversarial disturbance to the white box model feature, enhances the robustness and cross-model generalization ability of the disturbance, so that the generated adversarial sample can maintain a high attack success rate on different structure networks.

[0129] Please refer to Figure 3 , figure (a) shows a clean sample; figure (b) shows an adversarial sample added with the disturbance generated by TFA; wherein the shadow explicitly present part represents that the contribution value of the current region of the image to the target class is large; that is, in the attention map of the clean sample, the attention area about the target class is small, and the model classifies correctly; after adding the disturbance generated by TFA, the attention area about the target class increases significantly, so that the attack is successful.

[0130] The second embodiment of the present application provides an adversarial black box attack system based on target feature guidance, which comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus, and the processor calls the logic instructions in the memory to execute the adversarial black box attack method based on target feature guidance according to any one of the embodiments of the present application; the system has the same beneficial effects as the adversarial black box attack method based on target feature guidance provided above, and will not be described here.

[0131] It can be understood that an adversarial black box attack system based on target feature guidance needs to use an adversarial black box attack method based on target feature guidance when it is in operation, so whether the system is integrated with program data or different hardware is configured to produce a function similar to the effect achieved by the present application, all belong to the protection scope of the present application.

[0132] It should be noted that: the above-mentioned sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or can be advantageous.

[0133] The various embodiments described in this specification are presented by way of example, and each embodiment is not necessarily composed of all features described with respect to other embodiments.

Claims

1. A method for countering black-box attacks based on target features, characterized in that, The method includes: The target category is determined by acquiring the input image, and clean samples and adversarial samples are obtained based on whether perturbation is added to the input image. A data augmentation method based on the human visual system is used to perform clock jitter and color transformation on clean samples and adversarial samples to establish an augmented sample set. Obtain the proxy model and extract feature maps of the enhanced sample set using the proxy model; The momentum convolution updates the perturbation, and the surrogate model is trained in combination with the feature map until the preset maximum number of iterations is reached to obtain the output image; The output image is input into the black-box model to obtain the attack success rate corresponding to the target category.

2. The method for countering black-box attacks based on target feature guidance according to claim 1, characterized in that, Based on the input image, clean samples and adversarial samples are obtained depending on whether perturbations are added, specifically: An input image without added perturbation is denoted as a clean sample; an input image with randomly initialized perturbation is denoted as an adversarial sample.

3. The method for countering black-box attacks based on target feature guidance according to claim 1, characterized in that, Using a data augmentation method based on the human visual system, clock jitter and color transformation are applied to clean samples and adversarial samples to establish an augmented sample set, including: Apply random clock jitter to clean and adversarial samples; Several images are generated by copying clean samples and adversarial samples. The RGB pixel values ​​are decayed exponentially to form a mini-batch, thus completing the color transformation. Clean samples and adversarial samples that have undergone clock jitter and color transformation processing are integrated to form an enhanced sample set.

4. The method for countering black-box attacks based on target feature guidance according to claim 1, characterized in that, Feature maps of the enhanced sample set are extracted using a surrogate model, including: Based on the proxy model, the enhanced sample set is processed to obtain feature maps of clean samples and adversarial samples respectively; The target label is determined based on the target category. The contribution of the feature map to the target label is determined. The feature map is then processed by backtracking the contribution to obtain the target feature weights, and then optimized.

5. The method for countering black-box attacks based on target feature guidance according to claim 4, characterized in that, The target feature weights are obtained as follows: The result corresponding to the feature map is defined as the activation value. The contribution of the activation value to the target label in the target category is determined by combining the surrogate model. The target feature weight is generated according to the contribution and then averaged according to the number of channels of the feature map.

6. The method for countering black-box attacks based on target feature guidance according to claim 5, characterized in that, The target feature weights are obtained, and the corresponding calculation formula is: ； in, Represents the target feature weights. This represents the images in the augmented sample set. Indicates the target label; The proxy model represents the image In target label The logit value on; Represents the feature map; Indicates gradient operation; , These represent the length and width of the feature map, respectively.

7. The method for countering black-box attacks based on target feature guidance according to claim 4, characterized in that, Optimize the target feature weights, specifically as follows: By combining the feature maps and target feature weights, we obtain feature activation maps of clean samples and adversarial samples with respect to the target category. By minimizing the cosine similarity of the feature activation maps, we bring the adversarial samples closer to the target category.

8. The method for countering black-box attacks based on target feature guidance according to claim 1, characterized in that, Momentum convolution updates the perturbation, and the surrogate model is trained using feature maps until a preset maximum number of iterations is reached, resulting in the output image, including: The loss function is designed, and the gradient is updated using momentum update and gradient convolution mechanism, and perturbation update and constraint are performed in combination with feature map. The process continues until the preset maximum number of iterations is reached. The updated perturbation is then output, added to the clean samples, and the output image is generated.

9. A method for countering black-box attacks based on target feature guidance according to claim 1, characterized in that, The output image is input into the black-box model to obtain the attack success rate corresponding to the target category, specifically: The output image is input into the black-box model, and it is determined whether the output image is identified as the target category or misclassified by the black-box model. The success rate of targeted attacks or the success rate of untargeted attacks are obtained respectively.

10. A target feature-guided system for combating black-box attacks, characterized in that, The system includes a processor, a communication interface, a memory, and a communication bus. The processor, the communication interface, and the memory communicate with each other through the communication bus. The processor calls logical instructions in the memory to execute the method for combating black-box attacks based on target features as described in any one of claims 1 to 9.

Images