Adversarial sample generation method based on wavelet transform

Abstract

The invention discloses an adversarial sample generation method based on wavelet transform. The adversarial sample generation method comprises the following steps of S1, forming a generator G and a discriminator D, S2, wavelet transform, S3, ELA, S4, adversarial training, S5, data enhancement, S6, Wavelet-AdVGAN, S7, Front Sub-band Discovery, S8, Wavelet Transform Local Features, S9, an experimental data set, S10, an evaluation index and S11, a comparison method. Compared with the prior art, the Wavelet-AdvGAN method has the advantages that the sparsity of disturbance is improved through the FSD module and the WTLF module, the amplitude of disturbance is limited by adding the boundary loss with the FSD loss as the benchmark into the loss function, and therefore the authenticity of an adversarial sample is improved. In the CRFAR-10 data set, the disturbance sparsity of the adversarial sample generated by the Wavelet-AdvGAN is high, and the attack success rate of the target model is higher.

Description

Technical Field

[0001] This invention relates to the field of adversarial sample technology, specifically an adversarial sample generation method based on wavelet transform. Background Technology

[0002] Adversarial examples are a crucial tool for evaluating the robustness of deep neural networks and revealing their potential security vulnerabilities. While adversarial example generation methods based on generative adversarial networks (GANs) have made significant progress in generating adversarial examples for images, they still fall short in terms of sparsity and transferability. To address these issues, this study proposes an image adversarial example generation method—Wavelet-AdvGAN—and designs a Frequency Subband Difference (FSD) module and a Wavelet Transform Local Feature (WTLF) extraction module to evaluate the difference between the original sample and the adversarial example from a frequency domain perspective, thereby limiting the amplitude of the perturbation and strengthening the feature region. This further enhances the attack effect of the adversarial example, improving its sparsity and transferability. Experimental results show that the Wavelet-AdvGAN method improves the attack success rate by an average of 1.26% across both data augmentation and adversarial training defense strategies, and improves adversarial transferability by an average of 2.7%. Furthermore, this method has a low l0 norm, exhibiting good perturbation sparsity, and can effectively evaluate the robustness of deep neural networks. Summary of the Invention

[0003] The technical problem to be solved by this invention is to overcome the above-mentioned technical defects and provide an adversarial sample generation method based on wavelet transform.

[0004] To solve the above problems, the technical solution of the present invention is: an adversarial sample generation method based on wavelet transform, comprising the following steps: an S1 generator G and a discriminator D, where G generates data from random noise with the goal of approximating the real sample distribution, and D classifies the input data to determine whether it comes from the real distribution or is generated by G.

[0005] S2 wavelet transform, by decomposing the signal into a superposition of wavelet functions of different scales, can provide localization information in both the time and frequency domains.

[0006] S3ELA, ELA, effectively improves the performance of image classification and object detection tasks by accurately capturing local and global features, while reducing the number of parameters;

[0007] S4 adversarial training enhances model robustness by co-training the model using original samples and adversarial samples (such as FGSM-generated samples).

[0008] S5 data augmentation, through enhancing diversity, dynamically adjusting augmentation strength, introducing regularizers, and employing spatial combination techniques, can significantly optimize the adversarial training process, alleviate overfitting problems, and improve model robustness.

[0009] S6Wavelet-AdVGAN consists of four parts: generator G, discriminator D, target model f, and frequency subband difference module.

[0010] S7Frequency Sub-band Discrepancy, in the original sample X real and adversarial sample X adv After two-dimensional discrete wavelet transform, frequency diagrams of their respective frequencies are obtained;

[0011] The S8WaveletTransform Local Features (WTLF) module is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed.

[0012] The design of the wavelet transform local feature module for the S9 experimental dataset is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed.

[0013] S10 evaluation metric, Attack Success Rate: ASR is used to measure the effectiveness of adversarial examples in attacking the target model. The higher the attack success rate, the more effective the adversarial examples are in attacking the model.

[0014] The S11 comparison method was used to evaluate the Wavelet-AdvGAN method by selecting AdvGAN, AIGAN, GE-AdvGAN, FGSM, PGD, and C&W as comparison methods.

[0015] Furthermore, in the initial stage of step S1, the sample quality output by G is relatively poor, but D can easily distinguish between real and fake samples and optimize using both real and generated data. Subsequently, G continuously adjusts its parameters through the gradient fed back by D, gradually bringing the generated samples closer to the real distribution.

[0016] Furthermore, in step S2, wavelet basis functions of the same type are used to express the local features of the signal at multiple scales through translation, scaling, decomposition, and reconstruction operations.

[0017] Furthermore, compared to traditional spatial attention methods, ELA demonstrates significant performance improvements and lower computational costs across a variety of visual tasks in step S3.

[0018] Furthermore, in step S4, existing research emphasizes the importance of adversarial training in improving deep neural network adversarial perturbation defense, covering its effectiveness in different application scenarios, such as backdoor attack defense, generalization performance optimization, cross-domain applications, and discussions on economics and future research directions.

[0019] Furthermore, the online instance-level data augmentation strategy in step S5 not only effectively reduces the search cost of augmentation strategies, but also further improves the stability and reliability of the model under adversarial attacks.

[0020] Furthermore, in step S6, G is responsible for generating perturbations, D is responsible for distinguishing between generated samples and original samples, guiding G's training, and f enables adversarial examples.

[0021] Furthermore, the algorithm used by wavelet-AdvGAN to generate adversarial examples in step S6 is as follows:

[0022]

[0023]

[0024] 1. Further, in step S6, the frequency subband difference (FSD) loss is calculated as follows:

[0025]

[0026]

[0027]

[0028] Furthermore, in S10, a certain adversarial sample generation method generates m adversarial samples, of which n successfully attack the target model. The attack success rate can then be calculated using the following formula 6:

[0029]

[0030] The L0 norm refers to the number of distinct elements between the adversarial example and the original example. It measures the number of pixels that have been altered in the adversarial example.

[0031] The L2 norm, also known as the Euclidean distance, measures the square root of the sum of the squared differences between the adversarial sample and the original sample.

[0032] L ∞ The norm measures the maximum difference between the adversarial sample and the original sample in any dimension.

[0033] The advantages of this invention compared to existing technologies are as follows: The Wavelet-AdvGAN method improves the sparsity of perturbations through FSD and WTLF modules, and enhances the realism of adversarial examples by adding a boundary loss based on the FSD loss to the loss function to limit the magnitude of the perturbations. In the CRFAR-10 dataset, the adversarial examples generated by Wavelet-AdvGAN exhibit high perturbation sparsity and a higher attack success rate against the target model. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the generative adversarial network of the present invention.

[0035] Figure 2 This is a schematic diagram of the AdvGAN network of the present invention.

[0036] Figure 3 This is a structural diagram of the Wavelet-AdvGAN of the present invention.

[0037] Figure 4 This is a structural diagram of the FSD module of the present invention.

[0038] Figure 5 This is a structural diagram of the WTLF of the present invention. Figure 6 This is a diagram showing the results of the ablation experiment of this invention. Detailed Implementation The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. Identical components are indicated by the same reference numerals.

[0039] It should be noted that the terms “front,” “back,” “left,” “right,” “up,” and “down” used in the following description refer to the directions shown in the attached diagram, while the terms “inside” and “outside” refer to the directions toward or away from the geometric center of a specific component, respectively.

[0040] To make the content of this invention easier to understand, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings.

[0041] Example 1

[0042] The adversarial example generation method based on wavelet transform is characterized by the following steps: An S1 generator G and a discriminator D are used. G generates data from random noise, aiming to approximate the real sample distribution. D classifies the input data, determining whether it comes from the real distribution or was generated by G. G and D alternately optimize, forming a dynamic game: G attempts to "deceive" D, while D continuously improves its discriminative ability. This adversarial mechanism ultimately enables G to generate high-quality samples while maintaining the discriminative performance of D.

[0043] In the initial stage of step S1, the sample quality output by G is poor. D can easily distinguish between real and fake samples and optimize using both real and generated data. Subsequently, G continuously adjusts its parameters through the gradients fed back by D, gradually bringing the generated samples closer to the real distribution.

[0044] By combining adversarial attacks with generative adversarial networks (GANs), AdvGAN is proposed to address the time-consuming problem of optimizing attack algorithms. It leverages the ability of GANs to learn and approximate the original data distribution, trains on the training set, generates adversarial examples through a feedforward generative network, and uses a discriminator to make the adversarial examples more closely resemble the original image.

[0045] S2 wavelet transform, by decomposing the signal into a superposition of wavelet functions of different scales, can provide localization information in both the time and frequency domains.

[0046] In step S2, wavelet basis functions of the same type are translated, scaled, decomposed and reconstructed to realize the local feature expression of the signal at multiple scales. The two-dimensional discrete wavelet transform decomposes the input signal into four sub-bands: low-low, low-high, high-low (HL) and high-high, thereby revealing the frequency characteristics of the signal in different directions.

[0047] S3ELA, ELA, effectively improves the performance of image classification and object detection tasks by accurately capturing local and global features, while reducing the number of parameters;

[0048] Compared to traditional spatial attention methods, ELA demonstrates significant performance improvements and lower computational costs across various visual tasks in step S3. The ELA module aims to improve the performance of convolutional neural networks in tasks such as image classification, object detection, and semantic segmentation. Its core lies in using 1D convolution and group normalization techniques to effectively encode horizontal and vertical spatial location information, thereby avoiding the dimensionality reduction problem in the channel dimension encountered by existing methods.

[0049] S4 adversarial training enhances model robustness by co-training the model using original samples and adversarial samples (such as FGSM-generated samples).

[0050] Existing research in step S4 emphasizes the importance of adversarial training in improving deep neural network adversarial perturbation defense, covering its effectiveness in different application scenarios, such as backdoor attack defense, generalization performance optimization, cross-domain applications, and discussions on economics and future research directions. These commonalities indicate that AT not only enhances model robustness but also promotes the development and diversity of defense strategies and applications.

[0051] S5 data augmentation, through enhancing diversity, dynamically adjusting augmentation strength, introducing regularizers, and employing spatial combination techniques, can significantly optimize the adversarial training process, alleviate overfitting problems, and improve model robustness.

[0052] The online instance-level data augmentation strategy in step S5 not only effectively reduces the cost of augmentation strategy search, but also further improves the stability and reliability of the model under adversarial attacks. These results reveal the core role of data augmentation in strengthening adversarial training and provide a new direction for developing more efficient defense strategies. Based on data augmentation technology, we will systematically evaluate the effectiveness of the Wavelet-AdvGAN method to verify its practical application value.

[0053] S6Wavelet-AdVGAN consists of four parts: generator G, discriminator D, target model f, and frequency subband difference module.

[0054] In step S6, G is responsible for generating perturbations, D is responsible for distinguishing between generated samples and original samples, and guides the training of G. f ensures that the classification of adversarial examples is as close as possible to the target category. FSD calculates the original sample X. real Compared with adversarial sample X adv Based on the similarity, the wavelet-AdvGAN algorithm for generating adversarial examples is as follows:

[0055]

[0056]

[0057] For the generator G, its loss function L(G) consists of three parts, as shown in Equation (1).

[0058] L(G)=L GAN (G)+αL adv +βL FSD #(1)

[0059] Among them, L GAN (G) is the adversarial loss of the generator, which measures the quality of the generated adversarial examples. adv It is an adversarial loss, measuring the effectiveness of generated samples in attacking the target model f. FSD This is the frequency subband difference loss, used to limit the amplitude of the perturbation. α and β are the weight hyperparameters for the adversarial loss and the frequency subband difference loss, respectively.

[0060] D to X adv Discriminant loss L GAN (G), as shown in formula (2);

[0061]

[0062] X real This is the original sample. X pbThis is the perturbation generated by G. D(X) is the probability of the output of D, representing the probability that the input X is a true sample. L GAN (G) aims to minimize the probability that the adversarial sample generated by G is judged as a real sample by D. G hopes to generate the adversarial sample X. adv This loss term aims to minimize the likelihood that D will misclassify it as a real sample; therefore, it works by allowing D(X) to... adv ) Optimize G by getting it close to zero.

[0063] Use X adv Adversarial loss L generated by attacking target model f adv As shown in formula (3);

[0064]

[0065] l f (X adv For adversarial sample X adv The loss function on the target model f is denoted as the model's classification loss. The goal is to optimize X. pb This causes the target model f to make incorrect predictions about the generated adversarial examples.

[0066] Boundary loss L based on the Frequency Subband Difference (FSD) module FSD Limitation X pb The amplitude is given by the formula (4).

[0067] L FSD =w LL D LL +w LH D LH +w HL D HL +w HH D HH #(4)

[0068] D LL D LH D HL D HH These represent the differences in different frequency bands (low-frequency and high-frequency components) of the image after wavelet transform, reflecting the impact of disturbances at different scales. LL ,w LH ,w HL ,w HH The weighting parameters for the corresponding frequency bands determine the contribution of different frequency bands to the total loss.

[0069] For D, its loss function L GAN (D) is X real The probability of judging it as true and X adv The sum of the probabilities of being judged as false is shown in formula (5).

[0070]

[0071] In this method, the goal of G is to generate adversarial examples that deceive D and effectively attack the target model, where D...

[0072] The goal is to distinguish between real samples and generated adversarial samples. This is achieved by introducing L... adv L FSD With alternating training of G and D, the model can effectively generate high-quality and difficult-to-detect adversarial examples, further improving the attack effect on the target model.

[0073] S7Frequency Sub-band Discrepancy, in the original sample X real and adversarial sample X adv After two-dimensional discrete wavelet transform, frequency diagrams of their respective frequencies are obtained;

[0074] Frequency subband difference loss is calculated as follows:

[0075]

[0076]

[0077] The S8WaveletTransform Local Features (WTLF) module is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed.

[0078] In this module, the input feature map is first decomposed at multiple scales using wavelet transform to separate low-frequency and high-frequency information from the image. These low-frequency and high-frequency components are then processed through convolution and scale adjustment. Inverse wavelet transform is used to resynthesize the wavelet coefficients from each layer back into the low-frequency portion of the image. Subsequently, the horizontal and vertical means of the image are calculated to extract local features, and local attention is enhanced through convolution, normalization, and activation functions. Finally, element-wise multiplication with the original image features is used to highlight important regions and suppress unimportant regions. This module enables the feature map to be more effectively represented across multiple scales and spatial contexts, significantly improving the network's feature extraction capabilities.

[0079] The design of the wavelet transform local feature module for the S9 experimental dataset is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed.

[0080] The CIFAR-10 dataset contains 60,000 32x32 pixel color image samples, with 50,000 used for training and 10,000 for testing. These images are divided into 10 different categories, each containing approximately 6,000 image samples. These categories are airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck.

[0081] S10 evaluation metric, Attack Success Rate: ASR is used to measure the effectiveness of adversarial examples in attacking the target model. The higher the attack success rate, the more effective the adversarial examples are in attacking the model.

[0082] If a certain adversarial sample generation method in S10 generates m adversarial samples, of which n successfully attack the target model, then the attack success rate can be calculated using the following formula 6:

[0083]

[0084] The L0 norm refers to the number of distinct elements between the adversarial example and the original example. It measures the number of pixels that have been altered in the adversarial example.

[0085] The L2 norm, also known as the Euclidean distance, measures the square root of the sum of the squared differences between the adversarial sample and the original sample.

[0086] L ∞ The norm measures the maximum difference between the adversarial sample and the original sample in any dimension.

[0087] These three norms provide different measures of perturbation; the smaller the value, the smaller the perturbation added to the adversarial example.

[0088] The S11 comparison method was used to evaluate the Wavelet-AdvGAN method by selecting AdvGAN, AIGAN, GE-AdvGAN, FGSM, PGD, and C&W as comparison methods.

[0089] The experiment selected AdvGAN, AIGAN, GE-AdvGAN, FGSM, PGD, and C&W as comparative methods to evaluate the Wavelet-AdvGAN method. To ensure the rigor of the evaluation, a batch of target models were trained under the same conditions to test these attack methods. Experiments were conducted using the trained target models to test each attack method, and comparative data were obtained.

[0090] This study selected ResNet18, ResNet50, Vgg11, Vgg16, and DenseNet121, and only modified the last layer of the model to adapt it to the dataset; the rest remained unchanged.

[0091] The defense strategies for the target model are divided into two types: data augmentation (DE) and Adv-DE, which uses FGSM for adversarial training and simultaneously employs data augmentation techniques.

[0092] Table 1 Attack success rates of different models under two adversarial defense scenarios.

[0093]

[0094]

[0095] According to the experimental results, under DE defense, the accuracy of all network architectures is close to 96%, with ResNet18 at 96.17%, ResNet50 at 96.20%, Vgg11 at 95.52%, Vgg16 at 96.31%, and DenseNet121 at 96.69%. The results indicate that this method exhibits good stability and attack resistance under DE defense, with an average improvement of 1.31%.

[0096] Under Adv-DE defense, although the accuracy decreased, it remained above 92%, with ResNet18 at 95.71% and DenseNet121 at 94.97%, showing stable performance compared to other methods (AIGAN and Adv-GAN). Overall, this method demonstrated high attack effectiveness against both gradient-based and optimization-based attacks (FGSM, PGD, C&W) and generative adversarial network-based attacks (AdvGAN, AIGAN), with an average improvement of 1.22%.

[0097] Table 2. Experimental results of adversarial attack transferability of different models under DE defense.

[0098]

[0099]

[0100]

[0101] Based on the data in the table, the experiment aimed to explore the transferability of three adversarial attack methods across five network models protected by DE (Defense-Based Intervention) methods. Among the three adversarial attack methods, our proposed method generally outperformed AdvGAN and AIGAN across all five network architectures, achieving an average improvement of 0.61%. Particularly on ResNet50 and DenseNet121, the attack success rate was significantly improved, reaching 96.20% and 96.69%, respectively. This indicates that our proposed method is more effective in improving the transferability of adversarial attacks, and its performance is particularly outstanding in complex networks.

[0102] Table 3. Experimental results on the adversarial attack transferability of different models under the Adv-DE adversarial training defense background.

[0103]

[0104]

[0105] Based on the data in the table, the experiment aimed to explore the transferability of three adversarial attack methods across five network models protected by the Adv-DE defense method. Our proposed method outperforms AdvGAN and AIGAN, achieving an average improvement of 4.79%. Particularly in more complex network models such as ResNet50 and DenseNet121, our method significantly improves attack success rates, demonstrating its advantage in adversarial attack transferability. Furthermore, in simpler networks such as Vgg11 and Vgg16, the performance difference between AdvGAN and AIGAN is small, but our proposed method still performs well, especially in Vgg16, achieving an accuracy of 94.41%.

[0106] Table 4 shows the attack success rate of the GE-AdvGAN method.

[0107]

[0108] According to the table data, this method significantly outperforms GE-AdvGAN under both DE and Adv-DE defense methods, especially on the CIFAR10 dataset, where it shows an average improvement of 11.32%. Overall, this method is more stable and effective in improving model attack accuracy and adversarial robustness.

[0109] Table 5 Different methods L0L2L ∞ gap

[0110]

[0111] This method is used in L ∞ The performance on the L2 norm is comparable to other methods. However, by comparison, our method has a slightly higher L2 norm, exceeding 0.0483 at the highest and 0.0127 at the lowest. In the L0 norm, the perturbations of our method are all lower than those of other methods, indicating that although our method has a higher L2 norm, the perturbations are lower in the L0 norm. ∞ It is on par with other methods in terms of norm, but has an advantage in the degree of perturbation in the L0 norm.

[0112] Table 6. Unit sample generation time

[0113]

[0114] In the CIFAR10 dataset with 10,000 test images, generative attack methods show a significant advantage over optimization-based attack methods, averaging less than 0.01 seconds per image. This makes generative attacks more practically valuable in terms of generation speed.

[0116] The ablation experiments show that the model accuracy is generally highest when using the combination of FSD and WTLF modules, confirming the synergistic effect of the two modules in improving model performance. In contrast, accuracy decreases when using only one module, especially in the VGG16 model, where the accuracy drop is most significant when the WTLF module is missing. ResNet18 and ResNet50 also experience significant accuracy drops when the FSD module is missing. These findings highlight the importance of FSD and WTLF in improving the accuracy of various deep learning models and point to the necessity of considering these two modules in model design.

[0117] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A wavelet transform-based adversarial example generation method, characterized in that: Includes the following steps: The S1 generator G and discriminator D are composed of a generator G and a discriminator D. G generates data from random noise with the goal of approximating the real sample distribution, while D classifies the input data to determine whether it comes from the real distribution or is generated by G. S2 wavelet transform, by decomposing the signal into a superposition of wavelet functions of different scales, can provide localization information in both the time and frequency domains. S3ELA, ELA, effectively improves the performance of image classification and object detection tasks by accurately capturing local and global features, while reducing the number of parameters; S4 adversarial training enhances model robustness by co-training the model using original samples and adversarial samples (such as FGSM-generated samples). S5 data augmentation, through enhancing diversity, dynamically adjusting augmentation strength, introducing regularizers, and employing spatial combination techniques, can significantly optimize the adversarial training process, alleviate overfitting problems, and improve model robustness. S6Wavelet-AdVGAN consists of four parts: generator G, discriminator D, target model f, and frequency subband difference module. S7Frequency Sub-band Discrepancy, in the original sample X real and adversarial sample X adv After two-dimensional discrete wavelet transform, frequency diagrams of their respective frequencies are obtained; The design of the S8WaveletTransform Local Features module is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed. The design of the wavelet transform local feature module for the S9 experimental dataset is inspired by two-dimensional wavelet convolution and ELA attention mechanism. By combining the advantages of these two technologies, a new deep learning module is proposed. S10 evaluation metric, Attack Success Rate: ASR is used to measure the effectiveness of adversarial examples in attacking the target model. The higher the attack success rate, the more effective the adversarial examples are in attacking the model. The S11 comparison method was used to evaluate the Wavelet-AdvGAN method by selecting AdvGAN, AIGAN, GE-AdvGAN, FGSM, PGD, and C&W as comparison methods.

2. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: In the initial stage of step S1, the sample quality output by G is poor. D can easily distinguish between real and fake samples and optimize using real and generated data. Subsequently, G continuously adjusts its parameters through the gradient fed back by D, so that the generated samples gradually approach the real distribution.

3. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: In step S2, wavelet basis functions of the same type are used to express the local features of the signal at multiple scales through translation, scaling, decomposition and reconstruction operations.

4. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: Compared to traditional spatial attention methods, ELA demonstrates significant performance improvements and lower computational costs across a variety of visual tasks in step S3.

5. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: In step S4, existing research emphasizes the importance of adversarial training in improving deep neural network adversarial perturbation defense, covering its effectiveness in different application scenarios, such as backdoor attack defense, generalization performance optimization, cross-domain applications, and discussions on economics and future research directions.

6. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: The online instance-level data augmentation strategy in step S5 not only effectively reduces the search cost of augmentation strategies, but also further improves the stability and reliability of the model under adversarial attacks.

7. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: In step S6, G is responsible for generating perturbations, and D is responsible for distinguishing between generated samples and original samples, guiding G's training.

8. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: The algorithm used by wavelet-AdvGAN to generate adversarial examples in step S6 is as follows:

9. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: The frequency subband difference loss calculation in step S7:

10. The adversarial example generation method based on wavelet transform according to claim 1, characterized in that: In S10, a certain adversarial sample generation method generates m adversarial samples, of which n successfully attack the target model. The attack success rate can be calculated using the following formula 6: The L0 norm refers to the number of distinct elements between the adversarial example and the original example. It measures the number of pixels that have been altered in the adversarial example. The L2 norm, also known as the Euclidean distance, measures the square root of the sum of the squared differences between the adversarial sample and the original sample. L ∞ The norm measures the maximum difference between the adversarial sample and the original sample in any dimension. These three norms provide different measures of perturbation; the smaller the value, the smaller the perturbation added to the adversarial example.

Images