Adversarial sample generation and initial momentum optimization method and device for pre-deep search

Abstract

The invention discloses an adversarial sample generation and initial momentum optimization method and device for pre-deep search, and belongs to the technical field of image processing, and the initial momentum optimization method comprises the steps: adding a gradient regularization item on a classification loss function, and forming a pre-search loss function; multiple rounds of iterative search are carried out by maximizing a pre-search loss function, a gradient regularization item is used for limiting a search path in a sharp area in which the gradient norm of a classification loss function is higher than a preset condition, and finally a global initial momentum is generated. Searching is carried out in a classification loss function sharp area based on gradient regularization in a pre-searching stage, an initial momentum with global view and direction stability is generated, consistent initial direction guidance is provided for subsequent formal attacks, the problems that gradient directions are inconsistent and local optimum is likely to be caused in countermeasure attacks are solved, and the method is suitable for large-scale popularization and application. Therefore, the black box migration capability of the generated adversarial sample is remarkably improved, and overfitting of the source model is effectively avoided.

Description

Methods and apparatus for generating adversarial examples and optimizing initial momentum in pre-depth search Technical Field

[0001] This invention relates to the field of image processing technology, and in particular to a method and apparatus for generating adversarial examples and optimizing initial momentum using pre-depth search. Background Technology

[0002] Deep Neural Networks (DNNs) have achieved remarkable success in tasks such as image classification, object detection, and autonomous driving, but their vulnerability to adversarial attacks has raised serious security concerns. Adversarial examples are constructed by adding imperceptible perturbations to clean inputs, causing the model to produce erroneous outputs. In black-box attack scenarios, attackers cannot obtain internal information about the target model (such as parameters and gradients). Therefore, the transferability of adversarial examples—that is, the ability of an adversarial example generated on a source model to successfully attack another unknown target model—has become a core area of ​​research.

[0003] Existing methods for improving transferability can be mainly divided into two categories: gradient optimization methods and input transformation methods. Gradient optimization methods, represented by MI-FGSM (Momentum Iterative Fast Gradient Sign Method) and its variants (such as NI-FGSM), introduce a momentum term during iteration to stabilize the update direction, thus avoiding getting trapped in local optima and improving transferability to some extent. Input transformation methods, represented by DIM (Diversified Input Method), TIM (Translation Invariant Method), SIM (Scale Invariant Method), and their combinations (such as CT), enhance sample diversity by randomly transforming the input image, preventing adversarial examples from overfitting the source model. Despite the progress made by these methods, they still have fundamental bottlenecks in the transferability of black-box attacks: 1. Gradient vanishing and inconsistent direction: In gradient-based iterative attacks, the gradient direction may change drastically with each iteration, causing the overall attack path to fluctuate and fail to stably point to a global direction effective for multiple models. This results in weak generalization ability of the generated adversarial examples and limited improvement in transferability.

[0004] 2. Local Optimality Trap: Although existing momentum methods accumulate historical gradients, their initial directions are usually random or based only on the gradient of the initial point, lacking a global perspective. This makes it easy for the optimization process to get trapped in the local optimum region specific to the source model in the early stages, resulting in severe overfitting of the source model and ineffectiveness for other models.

[0005] 3. Inherent conflict of input transformation: Input transformation methods enhance robustness by creating multiple copies of data and averaging their gradients. However, the gradient directions generated by different transformations may conflict. Simple averaging will dilute the dominant gradient direction that is most beneficial to transferability, thereby weakening the attack effect.

[0006] 4. Ineffective against advanced defense models: When facing models that have been adversarially trained or have integrated advanced defense modules (such as denoisers, stochastic smoothing, etc.), the success rate of existing methods usually drops significantly. Summary of the Invention

[0007] The purpose of this invention is to overcome the problems of the prior art and provide a method and apparatus for generating adversarial examples and optimizing initial momentum through pre-depth search.

[0008] The objective of this invention is achieved through the following technical solution: a pre-deep search method for optimizing the initial momentum of adversarial examples, comprising the following steps: adding a gradient regularization term to the classification loss function to form a pre-search loss function; performing multiple rounds of iterative search by maximizing the pre-search loss function, wherein the gradient regularization term is used to restrict the search path to a sharp region where the gradient norm of the classification loss function is higher than a preset condition, and finally generating a global initial momentum.

[0009] In one example, the expression for the pre-search loss function is: ;in, Indicates the pre-search loss function; Indicates adversarial examples; Indicates the true label; Indicates the source model parameters; Represents the classification loss function; This represents a hyperparameter that controls the strength of regularization; This represents the classification loss function applied to the original input samples. The gradient; Represents the L2 norm; This represents the gradient regularization term.

[0010] In one example, the gradient of the pre-search loss function is calculated using the second derivative matrix. The calculation expression is: ;in, Indicates the depth search factor; Indicates the input image; Indicates a real label; Indicates the source model parameters; Represents the classification loss function; This represents an auxiliary computation point constructed by superimposing a small perturbation along the gradient direction onto the current adversarial example; Indicate the classification loss function in The gradient at that point.

[0011] In one example, in each iteration, a depth search strategy is used for gradient estimation, which includes: performing multiple random samplings around the current adversarial example point to obtain a series of neighboring sampling points; calculating the approximate gradient of the pre-search loss function at each neighboring sampling point; and averaging the approximate gradients of all neighboring sampling points as the gradient estimate for this iteration.

[0012] In one example, the multi-round iterative search includes the following sub-steps: obtaining the gradient estimate of the current iteration round based on the current adversarial sample and the pre-search loss function; weighting the historical momentum using a momentum decay factor and combining it with the normalized current gradient estimate to update the current momentum; adding perturbation to the current adversarial sample with a preset step size according to the direction of the updated current momentum, and limiting the cumulative perturbation to a preset perturbation budget through a pruning function to generate an updated adversarial sample; iteratively executing the above steps until a preset number of iterations is reached, and outputting the global initial momentum.

[0013] It should be further noted that the technical features corresponding to the above examples of initial momentum optimization methods can be combined or replaced to form new technical solutions.

[0014] The present invention also includes an adversarial example generation method, which includes the following steps: executing the adversarial example initial momentum optimization method formed by any one or more of the above examples to generate a global initial momentum; using the global initial momentum as the initial momentum of the attack, performing an iterative attack on the source model to generate the final adversarial example.

[0015] In one example, generating the final adversarial example includes: setting the current adversarial example as the original input image and initializing the current momentum to the global initial momentum output in the pre-search phase; for each iteration, performing the following update sub-steps: calculating the gradient of the classification loss function of the current adversarial example on the source model; weighting the momentum of the previous round using a momentum decay factor and combining it with the normalized current gradient to update the current momentum; adding perturbation to the current adversarial example with a preset step size according to the direction of the updated current momentum, and limiting the cumulative perturbation to a preset perturbation budget through a pruning function to generate the updated adversarial example; iteratively executing the above update sub-steps until a preset number of iterations is reached to generate the final adversarial example.

[0016] It should be further noted that the technical features corresponding to the above examples can be combined or replaced to form new technical solutions.

[0017] The present invention also includes a computer program product comprising a computer program that, when executed by a processor, implements the steps of the pre-depth search adversarial example initial momentum optimization method formed by any or a combination of the above examples, or the steps of the adversarial example generation method.

[0018] The present invention also includes a storage medium storing computer instructions that, when executed, perform the steps of the pre-depth search adversarial sample initial momentum optimization method formed by any or more of the above examples, or perform the steps of the adversarial sample generation method.

[0019] The present invention also includes a terminal comprising a memory and a processor, the memory storing computer instructions executable on the processor, wherein the processor, when executing the computer instructions, performs the steps of the pre-depth search adversarial example initial momentum optimization method formed by any or more of the above examples, or the steps of the adversarial example generation method.

[0020] Compared with existing technologies, the beneficial effects of this invention are as follows: 1. The initial momentum optimization method of this invention generates an initial momentum that combines global vision and directional stability by searching in the sharp region of the classification loss function based on gradient regularization during the pre-search stage. This initial momentum provides accurate and consistent initial directional guidance for subsequent formal attacks, fundamentally solving the problem of inconsistent gradient directions and easy getting trapped in local optima in adversarial attacks. This significantly improves the black-box transfer capability of the generated adversarial examples and effectively avoids overfitting to the source model. Furthermore, experiments show that the method of this invention has a higher average attack success rate compared to other existing methods when attacking normally trained models, adversarial trained models, Transformer architectures, and other advanced defense models.

[0021] 2. Unlike existing approaches that pursue flat regions, this invention verifies through theory and experiments that restricting the initial momentum to the sharp region of the loss function can more effectively improve mobility, providing a new perspective on optimizing the initial momentum of adversarial examples.

[0022] 3. The method of this invention can be encapsulated as a plug-and-play module, which can be seamlessly integrated into various existing gradient optimization and input transformation methods (such as DIM, TIM, SIM, etc.) to further enhance the attack effect and demonstrate excellent framework compatibility.

[0023] 4. The method of this invention has clear logic, controllable computational overhead, and the generated adversarial examples can be used to evaluate model robustness and conduct adversarial training, which is of great practical significance for ensuring the security of AI systems. Attached Figure Description

[0024] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. The accompanying drawings are provided to provide a further understanding of the present application and constitute a part of the present application. The same reference numerals are used in these drawings to denote the same or similar parts. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation of the present application.

[0025] Figure 1 is a flowchart of the initial momentum optimization method provided by an example of the present invention; Figure 2 is a schematic diagram of the migration experiment results of adversarial samples generated in different regions of the proxy model using the basic adversarial attack method under the source model; Figure 3 is a flowchart of the adversarial sample generation method provided by an example of the present invention; Figure 4 is an architecture diagram of the adversarial sample generation method provided by an example of the present invention. Detailed Implementation

[0026] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0028] In one example, as shown in Figure 1, a pre-depth search method for optimizing the initial momentum of adversarial examples belongs to the pre-search stage of adversarial example generation methods. Its goal is to construct a stable, global initial momentum. The method includes the following steps: S10: Add a gradient regularization term to the classification loss function to form a pre-search loss function.

[0029] Among them, classification loss functions such as cross-entropy loss function are standard functions for measuring the difference between model prediction and true label. This invention adds a gradient regularization term to the standard classification loss function to construct a pre-search loss function. Specifically, the gradient regularization term penalizes small gradient regions with gentle changes in the loss function and rewards large gradient regions with drastic changes (sharp regions). Thus, the gradient regularization term actively guides the search towards the sharp regions of the loss function. This is because experiments have shown that initial momentum in sharp regions brings higher transferability than in flat or random regions. Specifically, this invention explores the transferability of adversarial examples generated in different regions of a proxy model (unknown target model) using the basic adversarial attack method MI-FGSM in the source model. That is, based on the MI-FGSM method, it explores the impact of restricting initial momentum to random, flat, and sharp regions on transferability. The adversarial examples are generated based on Inc-v3, Inc-v4, and Res101 source models. The experimental results are shown in Figure 2. It can be seen that among the other nine black-box target models, the attack success rate of the sharp region is on average 4.8% and 1.8% higher than that of the random region and the flat region, respectively. Therefore, this invention proposes to restrict the initial momentum to the sharp region to enhance the transferability of adversarial samples generated based on this global initial momentum.

[0030] S20: Multi-round iterative search is performed by maximizing the pre-search loss function. The gradient regularization term is used to restrict the search path to the sharp region where the gradient norm of the classification loss function is higher than the preset condition, and finally a global initial momentum is generated.

[0031] The preset conditions include: the gradient norm is greater than a preset gradient threshold; and / or, the gradient norm reaches a local maximum in its neighborhood. By pre-searching the gradient regularization term of the loss function, the gradient optimization process focuses on regions with drastic gradient changes. Within these regions, the gradient direction is estimated, and momentum is accumulated along historical paths. After multiple iterations, the process converges and outputs a vector representing the optimal direction in the sharp region, i.e., the global initial momentum.

[0032] This invention uses the Pre-depth Search Initial Momentum (PDS) method as a pre-search stage to find a stable initial momentum pointing to the global optimum for the subsequent attack process. This guides the gradient update of the entire attack process to a consistent and effective direction, fundamentally solving the problems of inconsistent gradient directions and blind initial directions. It avoids the attack from falling into the trap of local optima that are only effective for the source model too early, and provides a prerequisite for generating highly transferable adversarial examples.

[0033] In one example, the expression for the pre-search loss function is: ;in, Indicates the pre-search loss function; Indicates adversarial examples; This represents the true label of the original input sample; Indicates the source model parameters; Represents the classification loss function; This represents a hyperparameter that controls the strength of regularization; This represents the classification loss function applied to the original input image. The gradient; Represents the L2 norm; It is the gradient regularization term, representing the classification loss function applied to the original input samples. The L2 norm, i.e., the gradient magnitude.

[0034] Preferably, the pre-search loss function is directly solved with respect to the original input samples. The gradient of the first-order loss function is computationally expensive. In this example, a Hessian matrix term is introduced, and Taylor expansion is used for efficient approximation. This compresses the second-order Hessian information into a linear combination of two first-order gradients, which is then used to pre-search the gradient of the loss function. Approximately: ;in, , is the sample point one step ahead, that is: an auxiliary calculation point constructed by superimposing a small perturbation along the gradient direction on the current adversarial sample. This represents the unit vector of the gradient direction. It's the step length. It is a depth search factor; Indicates the classification loss function in The gradient at that point.

[0035] In one example, in each iteration of the search, a depth-first search strategy is used for gradient estimation to stabilize the orientation, including: at the current adversarial example point Surrounding After one random sampling, a series of neighboring sampling points are obtained. Calculate the approximate gradient of the pre-search loss function at each neighboring sampling point. The average of the approximate gradients of all neighboring sampling points is used as the gradient estimate for this iteration. : In this example, the gradient of a single neighboring sampling point may be noisy or point to a local optimum. By sampling multiple times and averaging, random fluctuations can be removed to obtain a more stable direction that better represents the overall gradient trend of the region.

[0036] In one example, the multi-round iterative search includes the following sub-steps: S201: Based on the current adversarial sample and the pre-search loss function, obtain the gradient estimate of the current iteration round.

[0037] This step first uses the second derivative matrix to calculate the gradient of the pre-search loss function in the current iteration round, and then uses a depth search strategy to estimate the gradient, that is: to perform multiple random samplings on the current adversarial sample point and calculate the gradient of each neighboring sample point, and use the average of the gradients of each neighboring sample point as the gradient estimate of the current iteration round.

[0038] S202: The historical momentum is weighted using a momentum decay factor and combined with the normalized current gradient estimate to update the current momentum. That is, the gradient direction is accumulated using the standard momentum update rule. ;in, This indicates that the updated pillars inherit the main direction of the past and incorporate the better local direction determined in the current iteration; The momentum decay factor determines the degree to which historical momentum is preserved; it also represents the directional information of historical gradients. Incorporating current updates helps overcome the trap of local optima and maintains stability in the direction of progress. This indicates the normalization of the current gradient, that is, L1 norm normalization of the current gradient estimate, which aims to preserve the influence of the gradient vector magnitude, thereby extracting and retaining its directional information.

[0039] S203: Based on the updated direction of the current momentum, add perturbations to the current adversarial example with a preset step size, and limit the cumulative perturbations to a preset perturbation budget using a pruning function to generate an updated adversarial example. .

[0040] In this step, the adversarial examples are updated as follows: ;in, For the clipping function, Ensure disturbances do not exceed budget. ; Preset step size; Take momentum The symbolic function.

[0041] S204: Iteratively execute steps S201-S203 until the preset number of iterations is reached. The final output momentum This is the global initial momentum we are looking for.

[0042] The present invention also includes an adversarial sample generation method, which belongs to the formal attack stage, as shown in Figure 3, including the following steps: S30: Execute the adversarial sample initial momentum optimization method composed of any one or more of the above examples to generate a global initial momentum.

[0043] The original clean image and its true label are input into the source model. An adversarial example initial momentum optimization method is performed to search within a sharp region of a pre-search loss function that includes a gradient regularization term. The global initial momentum is then output to determine the attack direction.

[0044] S40: An iterative attack algorithm (such as MI-FGSM or NI-FGSM) that runs on the source model using the global initial momentum as the initial momentum of the attack, generates adversarial examples to deceive the model in the end.

[0045] Here, the source model represents a deep neural network classification model whose internal structure and parameters (white-box access) are fully accessible to the attacker. In this step, the global initial momentum is used as the initial momentum for the attack. From the first iteration, the attack direction is established on a globally explored basis, pointing towards a sharp region. This initial momentum, which combines global vision and directional stability, provides a consistent guide for the formal attack process, effectively reducing the random oscillation of gradient direction during iteration. This fundamentally solves the problem of inconsistent gradient direction and easy getting trapped in local optima in adversarial attacks, thereby significantly improving the black-box transferability of the generated adversarial examples.

[0046] Preferably, generating the final adversarial example includes: S401: setting the current adversarial example as the original input image and initializing the current momentum as the global initial momentum output in the pre-search phase.

[0047] This step is the initialization step, let (Original clean sample) (Inherited initial momentum from the pre-search).

[0048] S402: For each iteration, perform the following update sub-steps: (1) Calculate the gradient of the classification loss function of the current adversarial example on the source model; (2) Update momentum: Weight the momentum of the previous round using the momentum decay factor, and combine it with the normalized current gradient to update the current momentum, expressed as: .

[0049] (3) Update adversarial examples: Based on the direction of the updated current momentum, add perturbations to the current adversarial examples with a preset step size, and limit the cumulative perturbations to a preset perturbation budget through a pruning function to generate updated adversarial examples, as follows: .

[0050] (4) Iteratively execute the above update sub-steps (1)-(3) until the preset number of iterations is reached, and generate the final adversarial sample.

[0051] In this example, since the initial momentum is already pointing in a globally favorable direction, the risk of getting trapped in local optima in the early stages is avoided, and the gradient updates during the formal attack phase can remain stable and consistent, thus quickly converging to an adversarial example that is threatening to both the source and target models.

[0052] Combining the above examples, a preferred example of the adversarial example generation method of the present invention is obtained, as shown in Figure 4. This method includes the following sub-steps: S1: Adding a gradient regularization term to the classification loss function to form a pre-search loss function; S2: Based on the current adversarial example and the pre-search loss function, calculating the gradient of the pre-search loss function using the second derivative matrix, and performing gradient estimation using a depth-first search strategy: performing gradient estimation around the current adversarial example point... S1: Random sampling is performed to obtain a series of neighboring sampling points. The approximate gradient of the pre-search loss function at each neighboring sampling point is calculated. The average of the approximate gradients of all neighboring sampling points is used as the gradient estimate for this iteration. S2: The historical momentum is weighted using a momentum decay factor and combined with the normalized current gradient estimate to update the current momentum. S3: Based on the direction of the updated current momentum, a perturbation is added to the current adversarial example with a preset step size, and the cumulative perturbation is limited to a preset total perturbation budget by a pruning function. S2: Generate updated adversarial examples; S3: Iterate through steps S2-S4 until the preset number of iterations is reached. S6: Use the global initial momentum as the initial momentum for the attack, and perform the following on the source model: The next iteration of the attack generates the final adversarial sample.

[0053] In this example, the preferred parameter settings are as follows: total disturbance budget Preset number of iterations Number of formal attack iterations Step size Momentum decay factor ; depth search factor Random sample number .

[0054] It should be noted that the above steps S1-S5 are the preferred method for optimizing the initial momentum of adversarial samples in this invention.

[0055] This invention provides an adversarial example generation and initial momentum optimization method based on pre-deep search and gradient regularization. Through a pre-search stage, an initial momentum located in the sharp region of the loss function and pointing in the global direction is systematically found, and this momentum is used as the starting point of the formal attack stage, thereby guiding the entire attack process to evolve in a direction with high transferability.

[0056] Extensive experiments on the ImageNet dataset demonstrate that the proposed Pre-Depth Search Initial Momentum (PDS) method achieves significantly higher attack success rates than existing methods such as MI-FGSM, NI-FGSM, and GI when attacking normal training models, adversarial training models, Transformer architectures, and nine advanced defense models. In particular, in ensemble attacks, the average attack success rate is 18.1% higher than previous methods, and the success rate exceeds 96% on some defense models.

[0057] The present invention also provides a computer program product, comprising a computer program that, when executed by a processor, implements the steps of a pre-deep search adversarial example initial momentum optimization method or adversarial example generation method formed by any or a combination of the above examples. The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0058] The present invention also provides a storage medium having the same inventive concept as the pre-depth search adversarial sample initial momentum optimization method or adversarial sample generation method formed by any or more of the above examples, wherein computer instructions are stored thereon, and the computer instructions, when executed, perform the steps of the pre-depth search adversarial sample initial momentum optimization method or adversarial sample generation method formed by any or more of the above examples.

[0059] Based on this understanding, the technical solution of this embodiment, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0060] This invention also provides a terminal that shares the same inventive concept as any or a combination of examples corresponding to the aforementioned pre-deep search adversarial example initial momentum optimization method or adversarial example generation method, including a memory and a processor. The memory stores computer instructions executable on the processor, and when the processor executes the computer instructions, it performs the steps of the aforementioned pre-deep search adversarial example initial momentum optimization method or adversarial example generation method. The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement this invention.

[0061] In one example, the terminal, i.e., the electronic device, is represented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: at least one processing unit (processor) mentioned above, at least one storage unit mentioned above, and a bus connecting different system components (including storage units and processing units).

[0062] The storage unit stores program code that can be executed by the processing unit, causing the processing unit to perform the steps described in the "Exemplary Methods" section above, based on various exemplary embodiments of the present invention. For example, the processing unit can execute the aforementioned pre-depth search adversarial example initial momentum optimization method or adversarial example generation method.

[0063] The storage unit may include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 3201 and / or a cache storage unit, and may further include a read-only memory (ROM).

[0064] The storage unit may also include a program / utility having a set (at least one) of program modules, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0065] A bus can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus that uses any of the various bus structures.

[0066] The electronic device can also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication can be performed via input / output (I / O) interfaces. Furthermore, the electronic device can communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. It should be understood that other hardware and / or software modules can be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0067] Through the above description, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to this exemplary embodiment can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the method of the exemplary embodiment of this application.

[0068] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. A pre-depth search method for optimizing the initial momentum of adversarial examples, characterized in that, Includes the following steps: A gradient regularization term is added to the classification loss function to form a pre-search loss function. Multiple rounds of iterative search are performed by maximizing the pre-search loss function. The gradient regularization term is used to restrict the search path to the sharp region where the gradient norm of the classification loss function is higher than the preset condition, and finally a global initial momentum is generated.

2. The method for optimizing the initial momentum of adversarial examples using pre-depth search according to claim 1, characterized in that, The expression for the pre-search loss function is: ;in, Indicates the pre-search loss function; Indicates adversarial examples; Indicates the true label; Indicates the source model parameters; Represents the classification loss function; This represents a hyperparameter that controls the strength of regularization; This represents the classification loss function applied to the original input samples. The gradient; Represents the L2 norm; This represents the gradient regularization term.

3. The method for optimizing the initial momentum of adversarial examples using pre-depth search according to claim 1, characterized in that, Calculate the gradient of the pre-search loss function using the second derivative matrix. The calculation expression is: ;in, Indicates the depth search factor; Indicates the input image; Indicates a real label; Indicates the source model parameters; Represents the classification loss function; This represents an auxiliary computation point constructed by superimposing a small perturbation along the gradient direction onto the current adversarial example; Indicates the classification loss function in The gradient at that point.

4. The method for optimizing the initial momentum of adversarial examples using pre-depth search according to claim 1, characterized in that, In each iteration of the multi-round iterative search, a depth search strategy is used for gradient estimation, including: performing multiple random samplings around the current adversarial example point to obtain a series of neighboring sampling points; calculating the approximate gradient of the pre-search loss function at each neighboring sampling point; and averaging the approximate gradients of all neighboring sampling points as the gradient estimate for this round of iteration.

5. The method for optimizing the initial momentum of adversarial examples using pre-depth search according to claim 1, characterized in that, The multi-round iterative search includes the following sub-steps: obtaining the gradient estimate of the current iteration round based on the current adversarial sample and the pre-search loss function; weighting the historical momentum using the momentum decay factor and combining it with the normalized current gradient estimate to update the current momentum; Based on the direction of the updated current momentum, perturbations are added to the current adversarial sample with a preset step size, and the cumulative perturbations are limited to a preset perturbation budget by a pruning function to generate updated adversarial samples; the above steps are iteratively executed until a preset number of iterations is reached, and the global initial momentum is output.

6. A method for generating adversarial examples, characterized in that, Includes the following steps: The adversarial example initial momentum optimization method according to any one of claims 1-5 is used to generate a global initial momentum; Using the global initial momentum as the initial momentum for the attack, an iterative attack is performed on the source model to generate the final adversarial sample.

7. The adversarial example generation method according to claim 6, characterized in that, The generation of the final adversarial example includes: setting the current adversarial example as the original input image and initializing the current momentum to the global initial momentum output in the pre-search phase; for each iteration, performing the following update sub-steps: calculating the gradient of the classification loss function of the current adversarial example on the source model; weighting the momentum of the previous round using the momentum decay factor and combining it with the normalized current gradient to update the current momentum; adding perturbation to the current adversarial example with a preset step size according to the direction of the updated current momentum, and limiting the cumulative perturbation to a preset perturbation budget through a pruning function to generate the updated adversarial example; iteratively executing the above update sub-steps until a preset number of iterations is reached to generate the final adversarial example.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the adversarial example initial momentum optimization method for pre-depth search as described in any one of claims 1-5, or when the computer program is executed by the processor, it implements the steps of the adversarial example generation method as described in claim 6 or 7.

9. A storage medium storing computer instructions thereon, characterized in that, When the computer instruction is executed, it performs the steps of the adversarial example initial momentum optimization method according to any one of claims 1-5, or when the computer instruction is executed, it performs the steps of the adversarial example generation method according to claim 6 or 7.

10. A terminal comprising a memory and a processor, wherein the memory stores computer instructions executable on the processor, characterized in that, When the processor executes the computer instructions, it performs the steps of the adversarial example initial momentum optimization method according to any one of claims 1-5 for pre-depth search, or when the processor executes the computer instructions, it performs the steps of the adversarial example generation method according to claim 6 or 7.

Images