Metaoptimization adversarial sample generation algorithm combined with frequency domain feature fusion

Abstract

The invention discloses a meta-optimization adversarial sample generation algorithm combined with frequency domain feature fusion. The meta-optimization adversarial sample generation algorithm comprises the following steps: S1, frequency domain feature decomposition; s2, low-frequency reconstruction: reconstructing a low-frequency reconstructed image of the input image by adopting inverse discrete wavelet transform, and calculating a corresponding high-frequency image according to an original image and a low-frequency reconstructed difference value; s3, feature storage: respectively inputting the low-frequency image and the high-frequency image of the clean sample into a white box model, and extracting and storing features corresponding to each layer; s4, performing feature fusion; s5, inputting the fusion features obtained in the step S4 into a subsequent layer of the white box model to obtain model output; and S6, executing a meta-optimization strategy, calculating and combining internal and external gradient information to update the adversarial sample, and outputting a finally generated adversarial sample. According to the method, the image is decomposed and reconstructed in the frequency domain, and the multi-frequency features and the meta-optimization updating strategy are extracted and fused respectively, so that conflicts among different frequency domain features are effectively relieved, and the attack mobility of the generated confrontation sample to a conventional model and a defense model is improved.

Description

Technical Field

[0001] This invention relates to the field of deep neural network security technology, specifically to a meta-optimized adversarial sample generation algorithm based on joint frequency domain feature fusion. Background Technology

[0002] Deep neural networks (DNNs) have achieved remarkable results in fields such as image recognition, autonomous driving, and medical image analysis. However, research shows that they are vulnerable to adversarial attacks. Adversarial attacks generate "adversarial examples" that cause models to make incorrect predictions by adding tiny perturbations that are imperceptible to humans to clean samples. This security vulnerability severely limits the reliable application of deep models in security-sensitive scenarios.

[0003] In recent years, frequency domain analysis methods have revealed the differentiated roles of different frequency components in adversarial attacks. Existing research has found that high-frequency components play a dominant role in influencing the prediction results of conventionally trained models. Adversarial examples generated based on high-frequency perturbations can effectively mislead models that have not undergone robust training, but their attack transferability significantly decreases when targeting models that have undergone adversarial training or other defense enhancements. In contrast, attacks targeting low-frequency components perform better in improving the transferability to defensive models, but relying solely on low-frequency perturbations has limited effectiveness against conventionally trained models.

[0004] To simultaneously assess attack performance against both conventional and defensive models, this invention attempts to fuse different frequency domain information at the feature level. For example, integrating clean sample features into the full-frequency features of adversarial examples can enhance the attack capability against conventionally trained models; while integrating clean sample features into the low-frequency features of adversarial examples helps improve the transferability against defensive models. However, when both fusion methods are used simultaneously, frequency domain feature conflicts are often introduced, leading to mutual interference between fused features and thus weakening the overall attack transferability performance. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to overcome the above-mentioned technical defects and provide a meta-optimized adversarial sample generation algorithm that can resolve feature conflicts, fully integrate multi-frequency domain information, and improve the attack transferability of conventional and defensive models through joint frequency domain feature fusion by optimization strategies.

[0006] To solve the above-mentioned technical problems, the technical solution provided by this invention is: a meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion, comprising the following steps:

[0007] S1: Frequency domain feature decomposition, using discrete wavelet transform to decompose the input image. It can be decomposed into one low-frequency component and three high-frequency components;

[0008] S2: Low-frequency reconstruction, using inverse discrete wavelet transform to reconstruct the low-frequency image of the input image. The high-frequency image is calculated from the difference between the original image and the low-frequency reconstructed image. ;

[0009] S3: Feature storage, input the low-frequency and high-frequency images of the clean samples into the white-box model respectively, and store the features corresponding to each layer;

[0010] S4: Feature fusion, performing low-frequency adversarial feature fusion and adversarial feature fusion respectively, including fusing clean low-frequency features and clean high-frequency features with adversarial samples respectively. Low-frequency images Features and adversarial examples are fused by weights in a randomly selected layer;

[0011] S5: Input the fusion features obtained in S4 into the subsequent layers of the white-box model to obtain the model output;

[0012] S6: Based on the model output of S4, execute the meta-optimization strategy and output the final adversarial example.

[0013] Preferably, the discrete wavelet transform in S1 is decomposed using a low-pass filter L and a high-pass filter H of orthogonal wavelets, and the low-frequency component in S1 is represented as follows: The three high-frequency components are respectively , , .

[0014] Preferably, the low-frequency image reconstructed using inverse discrete wavelet transform in step S2 is... The high-frequency image is calculated from the difference between the original image and the low-frequency reconstructed image. .

[0015] Preferably, the features corresponding to each layer in S3 include clean low-frequency features { } and clean high-frequency features { }

[0016] Preferably, the weights in S4 include , and The constraints are satisfied:

[0017]

[0018] The low-frequency countermeasures features obtained in S4 are fused as follows: ;

[0019] The adversarial features obtained in S4 are fused as follows: .

[0020] Preferably, the S6 meta-optimization strategy includes low-frequency component-guided Meta-Train, adversarial example-guided Meta-Test, and final updated adversarial examples.

[0021] Preferably, the low-frequency component-guided Meta-Train includes calculating gradients using low-frequency adversarial feature fusion:

[0022] ;

[0023] The adversarial examples are updated using I-FGSM, and after 𝑁 successive internal optimization steps, a temporary sample set is generated. = { , , · · · , .

[0024] Preferably, the adversarial example-guided meta-test includes testing on a temporary sample set. Perform adversarial feature fusion to calculate the average gradient:

[0025] ; .

[0026] Preferably, the final updated adversarial example includes: ;

[0027] in, To satisfy the condition that, in a maximum of 𝑇 iterations of optimization, Still in Within the norm.

[0028] The advantages of this invention compared to the prior art are:

[0029] 1. The method provided by this invention consists of a meta-training step, a meta-testing step, and a final update. In the meta-training step, low-frequency components of adversarial examples are used to enhance the attack transferability of the defense model. In the meta-testing step, adversarial examples are used to stabilize gradients, thereby improving the attack transferability of the conventionally trained model. The adversarial examples are then updated based on the gradients obtained from the meta-training and meta-testing steps.

[0030] 2. The algorithm is based on discrete wavelet transform for frequency domain decomposition and conventional gradient optimization methods. It has low computational complexity, requires no additional complex models or hardware support, and is easy to deploy in DNNs security testing scenarios.

[0031] 3. By employing random layer selection, random weight fusion, and gradient stabilization strategies, the dependence on specific model structures is reduced, and high attack performance can be maintained on target models with different architectures. Attached Figure Description

[0032] Figure 1 This is a flowchart of the meta-optimized adversarial sample generation algorithm based on joint frequency domain feature fusion.

[0033] Figure 2 This is the final update diagram.

[0034] Figure 3 This is a schematic diagram of the data from the experiment. Detailed Implementation

[0035] The present invention will now be described in further detail with reference to the accompanying drawings.

[0036] To improve the transferability of adversarial examples to unknown defense models, this patent starts from "multi-frequency joint attacks" and constructs a meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion, which specifically includes the following steps:

[0037] Frequency domain feature fusion

[0038] Frequency domain feature decomposition: using discrete wavelet transform to decompose the input image It can be decomposed into one low-frequency component and three high-frequency components:

[0039] (Formula 1)

[0040] (Formula 2)

[0041] in, and These are the low-pass and high-pass filters of orthogonal wavelets, respectively. Subsequently, inverse discrete wavelet transform is used to reconstruct the low-frequency image and calculate the corresponding high-frequency image.

[0042] (Formula 3)

[0043] (Formula 4)

[0044] Feature fusion: Different models have similar classification boundaries for clean images. Therefore, we propose to use clean image features to perform low-frequency adversarial feature fusion (LF-AFM) and adversarial feature fusion (AFM).

[0045] First, clean the sample Decomposed into low-frequency components and high frequency components Input white box model respectively Calculate and store the features corresponding to each layer: and .

[0046] Low-frequency adversarial feature fusion (LF-AFM) utilizes clean low-frequency features. Clean high-frequency characteristics Adversarial Examples low-frequency components Features In the randomly selected number Layer-by-layer feature fusion:

[0047] (Formula 5)

[0048] in, , and The weights are random and satisfy the constraints. Adversarial Feature Fusion (AFM) combines clean low-frequency features, clean high-frequency features, and adversarial samples. Features Merge in the same way:

[0049] (Formula 6)

[0050] Finally, the fused features and Input the subsequent layers of the white-box model into each layer to obtain the model output;

[0051] Meta-optimization strategy:

[0052] To fully utilize various frequency domain information, a meta-optimization strategy combining frequency domain information is proposed to simultaneously use AFM and LF-AFM, thereby improving the transferability of adversarial attack normal models and defense models. For example... Figure 1 As shown, the optimization process is planned to include: 1) Meta-Train guided by low-frequency components; 2) Meta-Test guided by adversarial examples; 3) Final update;

[0053] Low-frequency component guided Meta-Train: To enhance the attack transferability of the defense model, for each internal iteration 𝑖, LF-AFM is first used to obtain the final output, and the Meta-Train gradient is calculated:

[0054] (Formula 7)

[0055] Where ℒ is the commonly used cross-entropy loss, Adversarial examples The low-frequency components. Then, the adversarial examples are updated using I-FGSM. To obtain temporary adversarial examples Finally, after 𝑁 successive internal optimization steps, a temporary adversarial example is obtained. = { , , … , }

[0056] Adversarial Example-Guided Meta-Test: To enhance the attack transferability of the normally trained model, adversarial example-guided meta-test is performed to stabilize gradients. In this step, for each adversarial example... Perform AFM, compute its gradient, and calculate the average of the gradients of all temporary adversarial examples as the current meta-test gradient:

[0057] (Formula 8)

[0058] Final Update: After obtaining the gradients from the Meta-Train and Meta-Test steps, update the adversarial examples:

[0059] (Formula 9)

[0060] in, Ensure that at most 𝑇 iterations of optimization, Still in Within the norm, the specific algorithm is as follows: Figure 2 As shown:

[0061] In practice:

[0062] Dataset. This patent evaluates the performance of the method on the ImageNet-Compatible dataset, which contains 1,000 images with a resolution of 299×299×3.

[0063] Models. This invention selects Inception-v3, Inception-v4, Inception-ResNet-v2, and ResNet-v2-101 as source models to generate adversarial examples, and tests them on multiple target models, including the source models. Defense models include Inc-v3_adv, Inc-v3_ens3, Inc-v3_ens4, and IncRes-v2_ens, etc.

[0064] Baseline Methods. To compare the method with various mainstream attack methods, this patent selected attack algorithms such as gradient-based (VTMI-FGSM, GRA, PGN), input augmentation-based (SINI-FGSM, Admix, SIA, BSR) and frequency domain-based (S²IMI-FGSM, FSD-MIM) attacks.

[0065] Parameter Settings. To ensure fair comparison, the attack parameters are kept consistent with widely used parameters: maximum perturbation ε=16, number of iterations T=10, step size α=ε / T. Specific parameters include momentum decay μ=1.0 for MI, input transformation probability p=0.5 for DI, kernel size k=7 for TI, and replication count m=5 for SI. Other method parameters are set as originally, such as β=1.5 and N=20 for VTMI, mixing ratio η=0.2 for Admix, masking factor ρ=0.5 for S²I-FGSM, sampling range β=3.5 for GRA, noise addition in the range [-45,45] for FSD-MIM, balance coefficient of PGN is 0.5, maximum rotation angle of BSR is 24°, and number of partitions of SIA is 3. For the parameters of this invention, the number of internal step samples N=10. Furthermore, to reduce the number of parameters, a layer is randomly selected for feature mixing in each iteration, and the mixing weights are also randomly generated.

[0066] Results analysis.

[0067] From Table 1, the following key conclusions can be observed from this patent. Among gradient-based methods, GRA and PGN have significant advantages over VTMI-FGSM, achieving higher attack success rates on most black-box models. These results indicate that obtaining flat local optima during the optimization process is crucial for improving transferability.

[0068] Among input augmentation-based methods, BSR demonstrates significantly better transferability than SINI, Admix, and SIA. BSR also exhibits the most competitive performance on normally trained models because its chunked data augmentation strategy generates consistent attention heatmaps across different architectures. However, these methods perform relatively poorly on defensive models, indicating their over-reliance on high-frequency perturbations, which limits the effectiveness of defensive mechanisms.

[0069] Among frequency-domain-based methods, this method significantly outperforms S under all settings. 2 IMI and FSD-MIM, especially when attacking robust models. For example, when the attack source model is IncRes-v2, this method achieves an average success rate of 88.3%, while S 2 IMI and FSD-MIM achieved success rates of 78.7% and 83.8%, respectively. Overall, the method proposed in this patent achieved the highest average success rate across all source models and demonstrated stronger adversarial transferability on the defense model, fully validating the effectiveness of the proposed "feature fusion and cross-frequency meta-optimization" method in fully utilizing the diverse frequency component information in both clean and adversarial images.

[0070] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A joint frequency domain feature fusion meta-optimization adversarial sample generation algorithm, characterized in that: Includes the following steps: S1: Frequency domain feature decomposition, using discrete wavelet transform to decompose the input image. It can be decomposed into one low-frequency component and three high-frequency components; S2: Low-frequency reconstruction, using inverse discrete wavelet transform to reconstruct the low-frequency image of the input image. The high-frequency image is calculated from the difference between the original image and the low-frequency reconstructed image. ; S3: Feature storage, input the low-frequency and high-frequency images of the clean samples into the white-box model respectively, and store the features corresponding to each layer; S4: Feature fusion, performing low-frequency adversarial feature fusion and adversarial feature fusion respectively, including fusing clean low-frequency features and clean high-frequency features with adversarial samples respectively. Low-frequency images Features and adversarial examples are fused by weights in a randomly selected layer; S5: Input the fusion features obtained in S4 into the subsequent layers of the white-box model to obtain the model output; S6: Based on the model output of S4, execute the meta-optimization strategy and output the final adversarial example.

2. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 1, characterized in that: In S1, the discrete wavelet transform is decomposed using a low-pass filter L and a high-pass filter H of orthogonal wavelets.

3. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 1, characterized in that: The low-frequency component in S1 is represented as follows: The three high-frequency components are respectively , , .

4. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 1, characterized in that: The low-frequency image reconstructed using inverse discrete wavelet transform in S2 is... High-frequency image calculation is .

5. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 1, characterized in that: The features corresponding to each layer in S3 include clean low-frequency features. } and clean high-frequency features { } 6. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 5, characterized in that: The weights in S4 include , and The constraints are satisfied: The low-frequency countermeasures features obtained in S4 are fused as follows: ; The adversarial features obtained in S4 are fused as follows: .

7. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 6, characterized in that: The S6 meta-optimization strategy includes low-frequency component-guided Meta-Train, adversarial example-guided Meta-Test, and final updated adversarial examples.

8. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 7, characterized in that: The low-frequency component-guided Meta-Train includes calculating gradients using low-frequency adversarial feature fusion: ； The adversarial examples are updated using I-FGSM, and after 𝑁 successive internal optimization steps, a temporary sample set is generated. ={ , , · · · , .

9. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 8, characterized in that: The adversarial example-guided meta-test includes testing on temporary sample sets. Perform adversarial feature fusion to calculate the average gradient: 。 10. The meta-optimized adversarial example generation algorithm based on joint frequency domain feature fusion according to claim 9, characterized in that: The final updated adversarial sample includes: ; in, To satisfy the condition that, in a maximum of 𝑇 iterations of optimization, Still in Within the norm.

Images