Adversarial sample generation method and system based on multi-scale frequency domain decomposition

Abstract

The invention discloses an adversarial sample generation method and system based on multi-scale frequency domain decomposition, and belongs to the field of artificial intelligence safety. The invention relates to a deep learning model adversarial attack and robustness evaluation technology. An input image is decomposed into a plurality of frequency scale spaces, human eye visual perception characteristics and deep neural network frequency domain sensitivity analysis are combined, targeted disturbance is adaptively applied to different frequency bands, and an adversarial sample with high concealment and high mobility is generated.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, and in particular relates to a method and system for generating adversarial examples based on multi-scale frequency domain decomposition. Background Technology

[0002] Deep Neural Networks (DNNs) have achieved remarkable success in computer vision tasks such as image classification, object detection, and semantic segmentation, and have been widely applied in critical fields such as autonomous driving, medical diagnosis, facial recognition, and security monitoring. However, research shows that DNNs are extremely sensitive to carefully designed, subtle perturbations. Attackers can add perturbations that are imperceptible to the human eye to the original input image, generating so-called adversarial examples, which can cause otherwise high-performing deep learning models to produce incorrect predictions. This security vulnerability poses a serious threat to critical application systems that rely on deep learning technology. For example, in autonomous driving scenarios, adversarial examples may cause vehicles to misinterpret traffic signs, leading to serious safety accidents. Therefore, researching the generation mechanism and defense methods of adversarial examples is of significant theoretical and practical importance for improving the robustness and security of deep learning systems.

[0003] Currently, research on adversarial example generation methods mainly focuses on the spatial domain, with representative methods including Fast Signed Gradient Method (FGSM), Projected Gradient Descent (PGD), C&W attack, and DeepFool. These methods achieve their attack objectives by calculating the gradient information of the loss function with respect to the input image and directly adding perturbations in the image spatial domain. Specifically, the FGSM method generates adversarial examples quickly through single-step gradient ascent, which is computationally efficient but has a limited success rate; the PGD method enhances the attack effect through multi-step iteration and projection operations, but has a large computational cost; the C&W attack finds the minimum perturbation by optimizing the objective function, which has a good attack effect but the optimization process is complex and time-consuming. Although these spatial domain methods have achieved certain results in specific scenarios, they generally suffer from the following three limitations.

[0004] First, the perturbations added by spatial domain methods are typically concentrated on the high-frequency components of the image, presenting a texture pattern similar to noise. While this high-frequency perturbation pattern satisfies the imperceptibility constraint at the pixel level, it exhibits obvious anomalous characteristics in its frequency domain distribution, making it easily detectable and filtered by frequency domain analysis-based defense methods. In recent years, various defense methods such as JPEG compression, Gaussian filtering, and feature compression are designed based on the high-frequency characteristics of adversarial perturbations. These defense techniques can effectively weaken or even eliminate the adversarial effects of spatial domain attack methods.

[0005] Second, adversarial examples generated by spatial domain methods often exhibit poor transferability, meaning that adversarial examples generated for a specific model are unlikely to effectively attack other models. This limitation mainly stems from the fact that spatial domain perturbations overfit the specific decision boundaries of the target model, lacking effective exploitation of the model's general vulnerabilities. In real-world black-box attack scenarios, attackers typically cannot obtain detailed information about the target model; therefore, the transferability of adversarial examples is crucial for practical security assessments.

[0006] Third, existing spatial domain methods rarely consider the perceptual characteristics of the human visual system when designing perturbations, mainly relying on simple norm constraints (such as L∞ and L2 norms) to limit the perturbation amplitude. However, the human eye has significant differences in sensitivity to different frequency components, and simple norm constraints cannot fully utilize this visual characteristic to optimize the concealment of perturbations.

[0007] To address the aforementioned limitations of spatial domain methods, some researchers have begun exploring frequency domain adversarial attack methods. These methods typically employ Discrete Cosine Transform (DCT) or Fourier Transform to convert the image to the frequency domain, and then add perturbations to the frequency domain coefficients.

[0008] However, existing frequency domain methods have the following shortcomings: First, most frequency domain methods use a single-scale frequency decomposition, which cannot effectively capture the frequency characteristics of images at different resolution levels, thus limiting the flexibility of perturbation design; second, existing methods lack systematic analysis of the sensitivity of deep neural networks to different frequency bands, and perturbation allocation strategies are often based on empirical settings rather than adaptive optimization; finally, existing methods fail to fully incorporate the contrast sensitivity function (CSF) of the human visual system to different spatial frequencies when designing frequency domain perturbations, making it difficult to achieve a good balance between visual quality and attack effectiveness in the generated adversarial examples. Summary of the Invention

[0009] To address the aforementioned technical problems, this invention proposes an adversarial sample generation method and system based on multi-scale frequency domain decomposition; by adaptively designing perturbations in multiple frequency scale spaces, adversarial samples with high concealment, strong attack capability, and good transferability are generated.

[0010] The first aspect of this invention proposes an adversarial example generation method based on multi-scale frequency domain decomposition, the method comprising: S1. In the input layer, the original image and the target deep learning model are received. S2. Call the multi-scale frequency domain decomposition module to perform wavelet decomposition on the original image and obtain sub-band decomposition results at different frequency levels; S3. Call the frequency band sensitivity analysis module, based on the sub-band decomposition results, quantify the sensitivity of the target deep learning model to different frequency bands, and generate a frequency band weight map; S4. Call the visual perception constraint module and use the contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of the perturbation in different frequency bands; S5. Call the perturbation and generation optimization module to perform multi-scale joint optimization based on the upper bound of perturbation and frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation; S6. In the output layer, reconstruct adversarial examples based on the optimal frequency band perturbation.

[0011] According to the method in the first aspect, in S2, the multi-scale frequency domain decomposition module is invoked to perform wavelet decomposition on the original image, obtaining sub-band decomposition results at different frequency levels; where: The decomposition layers are represented by LL, LH, HL, and HH. The first-level decomposition is applied to the original image to obtain the first-level low-frequency approximate subband. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band The second-level decomposition only applies to the low-frequency approximate subband of the first level. The second-level low-frequency approximate subband is obtained. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band And so on, the... Level decomposition acts on the first Low-frequency approximate subband of the level Sub-band, to obtain the first Low-frequency approximate subband of the level Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band , ; The final subband decomposition results at different frequency levels include the low-frequency approximate subband of the Nth level. and The detail subbands at different frequency levels are represented as follows: .

[0012] According to the method in the first aspect, in S3, the frequency band sensitivity analysis module is invoked to quantify the sensitivity of the target deep learning model to different frequency bands based on the sub-band decomposition results, and a frequency band weight map is generated; specifically including: S31. Decompose the subband results The organization is represented by a differentiable tensor; S32, Based on target deep learning model The forward propagation calculates the classification loss; where: For non-targeted attacks, classification loss , This represents the original image, and CE represents cross-entropy. Original, authentic labels; For targeted attacks, classification loss , Indicates the target label; S33, Based on subband decomposition results Differentiable tensor representations are used to calculate classification loss using an automatic differentiation mechanism. The gradient for each wavelet coefficient; where: Sub-band The decomposition coefficient matrix is The gradient matrix of this sub-band is The absolute value of the gradient. Describe the degree to which changes in the decomposition coefficients affect the classification results; S34. Calculate the sensitivity index for each sub-band. : in, represents the balance coefficient, mean represents the mean, and std represents the standard deviation; S35. Normalize the sensitivity indices of all sub-bands to generate a frequency band weight map, represented as follows: in, For temperature parameters, This represents all candidate subbands.

[0013] According to the method in the first aspect, in S4, the visual perception constraint module is invoked, and the contrast sensitivity function is used to describe the visual characteristics of the human eye in order to determine the upper bound of the perturbation in different frequency bands, specifically including: The contrast sensitivity function (CSF) describes the minimum contrast required for the human eye to detect visual stimuli of different spatial frequencies. The Mannos-Sakrison model is used to model the CSF, and its expression is: in, For children Spatial frequency; The visibility threshold of the sub-band is set based on CSF. : in, It is a proportionality constant; Then the upper bound is disturbed. for: in, This is for the safety factor.

[0014] According to the method in the first aspect, in S5, the perturbation and generation optimization module is invoked to perform multi-scale joint optimization based on the upper bound of perturbation in different frequency bands and the frequency band weight map, so as to obtain the optimal frequency band perturbation; specifically including: S51. Initialize the disturbance in the frequency domain to obtain the initialized disturbance. Set the number of iterations Base learning rate ; S52, Perform iterative optimization; for the... Next iteration: The frequency domain coefficients after the current perturbation are reconstructed using inverse wavelet transform; Calculate the overall loss and its gradient with respect to each sub-band coefficient ; Adjust the gradient based on the frequency band weight map to obtain the weighted gradient. , , Indicates element-wise multiplication; in, Indicates the first Perturbation in +1 iteration Indicates the first Perturbation in the next iteration This represents a function that obtains the numerical sign of the gradient vector element by element in order to update the perturbation along the gradient direction; Project the updated perturbation into the feasible region, and apply it to the sub-bands. implement: in, Indicates the first After the next iteration, in the subband The disturbance coefficient on; An element-wise truncation function that restricts the input to a range Inside; S53. Perform convergence judgment; If the attack is successful, the iteration ends early; otherwise, the iteration continues until the maximum number of iterations is reached. ; S54. Obtain the optimal frequency band perturbation.

[0015] According to the method in the first aspect, in S6, adversarial examples are reconstructed at the output layer based on optimal frequency band perturbations; specifically including: Spatial domain images are reconstructed based on optimal frequency band perturbation; the final adversarial examples are obtained through numerical cropping, data type conversion, and color space conversion.

[0016] A second aspect of this invention proposes an adversarial example generation system based on multi-scale frequency domain decomposition, the system comprising: The input module is configured to receive the original image and the target deep learning model; The multi-scale frequency domain decomposition module is configured to perform wavelet decomposition on the original image to obtain sub-band decomposition results at different frequency levels. The frequency band sensitivity analysis module is configured to: quantify the sensitivity of the target deep learning model to different frequency bands based on the sub-band decomposition results, and generate a frequency band weight map; The visual perception constraint module is configured to: use a contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of perturbations in different frequency bands; The perturbation and generation optimization module is configured to perform multi-scale joint optimization based on the upper bound of perturbation and the frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation. The output module is configured to reconstruct adversarial examples based on optimal frequency band perturbations.

[0017] In summary, this invention proposes an adversarial example generation method and system based on multi-scale frequency domain decomposition. Multi-scale wavelet transform is used to perform hierarchical frequency domain decomposition on the input image. Perturbation weights for each frequency band are determined through deep neural network frequency band sensitivity analysis. Visual perception constraints are designed in conjunction with the human visual contrast sensitivity function. Targeted perturbations are adaptively applied at multiple frequency scales, and finally, adversarial examples are reconstructed through inverse transform.

[0018] This invention achieves collaborative optimization of adversarial perturbations across different frequency bands by constructing a frequency-domain-aware loss function and a multi-scale iterative optimization framework. The generated adversarial examples are highly concealed, have strong attack capabilities, and good transferability. This effectively solves the problems of existing spatial domain methods being easily detected by frequency domain defenses, having poor transferability, and poor visual quality, and provides a new technical means for security assessment and robustness improvement of deep learning systems. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the adversarial sample generation method based on multi-scale frequency domain decomposition according to an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention discloses an adversarial example generation method and system based on multi-scale frequency domain decomposition. Its overall goal is to utilize the multi-scale frequency domain representation of images, combined with the frequency band sensitivity of deep neural networks and the visual perception characteristics of the human eye, to adaptively design and optimize perturbations at different frequency scales, so that the generated adversarial examples can effectively deceive the target deep learning model and have good visual concealment and cross-model transfer capabilities.

[0023] The main technical problems addressed by this invention include four aspects: first, how to effectively decompose input images into multiple frequency domains to obtain rich frequency hierarchical information; second, how to analyze and quantify the sensitivity of deep neural networks to different frequency bands to guide perturbation allocation; third, how to design frequency domain perturbation constraints in combination with the characteristics of human visual perception to ensure visual concealment; and fourth, how to construct a multi-scale joint optimization framework to achieve collaborative optimization of perturbations in each frequency band.

[0024] Specifically, the method described in this invention mainly includes the following key technical points.

[0025] First, multi-scale frequency domain decomposition technology: Multi-scale frequency domain decomposition is the fundamental technical step of this invention. Its core function is to transform the input image from the spatial domain to a multi-scale frequency domain representation, providing a foundation for subsequent frequency band sensitivity analysis and perturbation design. Compared with traditional single-scale frequency domain transformations (such as DCT and FFT), multi-scale decomposition can simultaneously preserve the spatial location information and frequency characteristics of the image, which is more in line with the multi-channel perception mechanism of the human visual system and is also more conducive to capturing the vulnerabilities of deep neural networks at different resolution levels.

[0026] This invention employs Discrete Wavelet Transform (DWT) as a multi-scale decomposition tool. For the input image, by applying low-pass and high-pass filtering to the rows and columns respectively, the image can be decomposed into four sub-bands: Low-Frequency Approximation Sub-band (LL), Horizontal High-Frequency Detail Sub-band (LH), Vertical High-Frequency Detail Sub-band (HL), and Diagonal High-Frequency Detail Sub-band (HH). The LL sub-band contains the main energy and structural information of the image, reflecting the overall contour and smooth regions; the LH, HL, and HH sub-bands capture the edge and texture details of the image in the horizontal, vertical, and diagonal directions, respectively. To obtain richer frequency hierarchy information, this invention recursively decomposes the LL sub-band, forming a multi-level wavelet pyramid structure. Each level of decomposition further subdivides the frequency range, with lower levels corresponding to high-frequency details and higher levels corresponding to low-frequency structure. This multi-scale representation provides the possibility of designing differentiated perturbation strategies at different frequency levels.

[0027] The advantages of choosing wavelet transform as a multi-scale decomposition tool are as follows: First, wavelet transform has excellent time-frequency localization characteristics, which can simultaneously characterize the local features of a signal in both the time and frequency domains, which is crucial for maintaining the rationality of the spatial distribution of perturbations. Second, the multi-resolution analysis framework of wavelet transform is highly consistent with the spatial frequency channel model of the human visual system, which is beneficial for designing perturbations that conform to visual perception. Finally, wavelet transform has perfect reconstruction characteristics, and the image can be recovered from the frequency domain coefficients without loss through inverse transform, ensuring precise control of perturbations.

[0028] Second: Deep Neural Network Band Sensitivity Analysis Technology: Deep neural networks exhibit significant differences in sensitivity to different frequency components. Effectively analyzing and quantifying this band sensitivity is crucial for achieving adaptive perturbation allocation. This invention proposes a band sensitivity quantification method based on gradient analysis. It calculates the contribution of each band coefficient to the classification loss through backpropagation and constructs a band weight graph to guide perturbation allocation.

[0029] Specifically, for images that have undergone multi-scale decomposition, the wavelet coefficients of each sub-band at each level are considered as optimizable variables. The classification loss is calculated via forward propagation, and then the gradient of the loss function with respect to each wavelet coefficient is calculated via backpropagation. The absolute value of the gradient reflects the degree to which a small change in that coefficient affects the classification result; a larger absolute gradient value indicates that the frequency component corresponding to that coefficient is more sensitive to the model's decision. Statistical analysis is performed on the gradients of all coefficients within the same sub-band, calculating their mean and variance to quantify the overall sensitivity of that frequency band. Experiments show that different deep neural network architectures exhibit different frequency band sensitivity patterns; some models are more sensitive to low-frequency components, while others are more sensitive to high-frequency components in specific directions. This difference provides an important basis for designing transferable perturbations.

[0030] Based on the results of frequency band sensitivity analysis, this invention constructs a normalized frequency band weight graph. High-sensitivity frequency bands are assigned larger perturbation weights because applying perturbations to these bands can more effectively influence model decisions; low-sensitivity frequency bands are assigned smaller weights to avoid wasting perturbation budget on bands that contribute little to the attack's effectiveness. The weight allocation follows the principle of maximizing attack efficiency, that is, under a given total perturbation budget constraint, optimizing the distribution ratio of perturbations across frequency bands to maximize the attack success rate.

[0031] Third: Frequency-domain perturbation constraint technology based on visual perception: The human visual system exhibits significant differences in sensitivity to different spatial frequencies. This characteristic can be used to design more visually covert adversarial perturbations. This invention innovatively introduces the Contrast Sensitivity Function (CSF) into the frequency-domain perturbation constraint design, adaptively adjusting the upper bound of the perturbation based on the human eye's visual sensitivity to each frequency band, achieving an optimal balance between attack effectiveness and visual quality.

[0032] The contrast sensitivity function (CSF) describes the minimum contrast required for the human eye to detect sinusoidal gratings at different spatial frequencies. Its typical form is a bandpass characteristic, meaning the human eye is most sensitive to mid-frequency gratings (approximately 2-5 cycles / degree) and less sensitive to low and high frequencies. This invention uses the widely accepted Mannos-Sakrison model to parametrically model the CSF and maps it to the various frequency bands of wavelet decomposition. For each frequency band, a visibility threshold is calculated based on its corresponding spatial frequency range. This threshold indicates the magnitude of perturbation required to be perceived by the human eye in that frequency band. Based on this, an upper bound for the perturbation in each frequency band is set as a certain proportion (e.g., 0.8 times) of the visibility threshold to ensure that the added perturbation is visually imperceptible.

[0033] This visual perception-based perturbation constraint offers significant advantages over traditional norm constraints. Traditional methods apply a uniform upper bound to the perturbation for all pixels, ignoring the differences in human eye perception of different frequency components. The method of this invention allows for relatively large perturbations in frequency bands where the human eye is less sensitive (such as extremely low and high frequencies), while strictly limiting the perturbation amplitude in the mid-frequency region where the human eye is sensitive. This maximizes the available perturbation space while ensuring visual quality, thereby enhancing the attack's effectiveness.

[0034] Fourth: Multi-scale joint optimization framework: The aforementioned three key technologies respectively address the issues of frequency domain representation, sensitivity analysis, and visual constraints. The organic integration of these technologies and the realization of collaborative optimization of perturbations across frequency bands relies on the multi-scale joint optimization framework proposed in this invention. This framework designs a frequency-domain-aware comprehensive loss function and employs a projection gradient descent algorithm for iterative optimization, maximizing the attack effect while satisfying visual perception constraints.

[0035] The comprehensive loss function consists of three parts: attack loss, visual quality loss, and frequency domain regularization term. The attack loss uses cross-entropy loss or marginal loss to measure the degree to which adversarial examples cause the target model to misclassify. The visual quality loss comprehensively considers structural similarity in the spatial domain (SSIM) and perceptual distortion in the frequency domain to ensure the overall visual quality of adversarial examples. The frequency domain regularization term encourages a balanced distribution of perturbations across frequency bands, avoiding over-concentration in a single band, which could lead to detection by targeted defense methods. These loss terms are weighted and combined using hyperparameters to form the final optimization objective.

[0036] The optimization process is conducted iteratively. Each iteration includes the following steps: First, the gradient of the comprehensive loss with respect to the wavelet coefficients of each frequency band is calculated in the frequency domain; then, the gradient update step size of each frequency band is adjusted according to the frequency band weight map; next, the updated coefficients are projected onto the feasible region defined by the visual perception constraints, ensuring that the perturbation of each frequency band does not exceed the corresponding visibility threshold; finally, the updated adversarial example is reconstructed through inverse wavelet transform, and the attack effect is evaluated. The iterative process continues until the attack is successful or the maximum number of iterations is reached.

[0037] The adversarial example generation scheme based on multi-scale frequency domain decomposition proposed in this invention is mainly implemented through an input layer, a multi-scale frequency domain decomposition module, a frequency band sensitivity analysis module, a visual perception constraint module, a perturbation generation and optimization module, and an output layer (adversarial example reconstruction module). Each layer / module collaborates closely through data flow to jointly complete the entire processing flow from the input original image to the output adversarial example.

[0038] The workflow is as follows: First, the input layer receives the original input image. The multi-scale frequency domain decomposition module uses multi-level discrete wavelet transform to decompose the image into multi-level frequency domain sub-band representations. Simultaneously, the input layer receives the target deep learning model. The frequency band sensitivity analysis module quantifies the model's sensitivity to each frequency band through gradient analysis, generating a frequency band weight map. Then, the visual perception constraint module calculates the visual visibility threshold for each frequency band based on the contrast sensitivity function, setting an upper bound for the perturbation. Next, the perturbation generation and optimization module comprehensively utilizes the frequency band weight map and visual perception constraints, generating the optimal perturbation for each frequency band through an iterative optimization algorithm. Finally, the output layer (adversarial example reconstruction module) reconstructs the perturbed frequency domain coefficients into a spatial domain image through inverse wavelet transform, outputting the final adversarial example.

[0039] The first aspect of this invention proposes an adversarial example generation method based on multi-scale frequency domain decomposition, specifically including (e.g.) Figure 1 (as shown) S1. In the input layer, the original image and the target deep learning model are received. S2. Call the multi-scale frequency domain decomposition module to perform wavelet decomposition on the original image and obtain sub-band decomposition results at different frequency levels; S3. Call the frequency band sensitivity analysis module, based on the sub-band decomposition results, quantify the sensitivity of the target deep learning model to different frequency bands, and generate a frequency band weight map; S4. Call the visual perception constraint module and use the contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of the perturbation in different frequency bands; S5. Call the perturbation and generation optimization module to perform multi-scale joint optimization based on the upper bound of perturbation and frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation; S6. In the output layer, reconstruct adversarial examples based on the optimal frequency band perturbation.

[0040] In some embodiments, in S2, the multi-scale frequency domain decomposition module is invoked to perform wavelet decomposition on the original image, obtaining sub-band decomposition results at different frequency levels; wherein: The decomposition layers are represented by LL, LH, HL, and HH. The first-level decomposition is applied to the original image to obtain the first-level low-frequency approximate subband. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band The second-level decomposition only applies to the low-frequency approximate subband of the first level. The second-level low-frequency approximate subband is obtained. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band And so on, the... Level decomposition acts on the first Low-frequency approximate subband of the level Sub-band, to obtain the first Low-frequency approximate subband of the level Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band , ; The final subband decomposition results at different frequency levels include the low-frequency approximate subband of the Nth level. and The detail subbands at different frequency levels are represented as follows: .

[0041] Specifically, the core task of the multi-scale frequency domain decomposition module is to convert the input image into a hierarchical frequency domain representation. For an image of size , Color input image ( For height, For width, (where is the number of channels), this invention performs wavelet decomposition independently on each color channel.

[0042] The mathematical principle of wavelet decomposition is as follows: Assume a one-dimensional discrete wavelet transform using low-pass and high-pass filters. For the input signal, the low-pass output (approximation coefficients) and high-pass output (detail coefficients) are obtained through convolution and downsampling, respectively. For a two-dimensional image, firstly, a one-dimensional wavelet transform is applied to each row to obtain low-frequency and high-frequency columns. Then, a one-dimensional wavelet transform is applied again to each column of the result, ultimately yielding four sub-bands: LL (low-frequency approximation), LH (horizontal details), HL (vertical details), and HH (diagonal details). The size of each sub-band is 1 / 4 of the original image (height and width are each halved).

[0043] This invention employs a multi-level decomposition strategy, setting the number of decomposition levels to be [number missing]. (Typical values ​​are 3-5 layers). The first-level decomposition is applied to the original image to obtain the first-level decomposition. , , , Four sub-bands. Second-level decomposition only applies to... Sub-band, to obtain the second level , , , And so on, the... Hierarchical decomposition acts on Subband. The final multi-scale representation contains an approximate subband with the lowest frequency. and The image is divided into detail sub-bands at different frequency levels. This pyramid structure organizes the frequency information of the image in ascending order, with higher-level sub-bands corresponding to low-frequency components and lower-level sub-bands corresponding to high-frequency components.

[0044] The choice of wavelet basis functions has a significant impact on the decomposition results. This invention uses the Daubechies-4 (db4) wavelet as the default choice. This wavelet has a moderate support length and good time-frequency localization characteristics, effectively capturing the edge and texture features of the image. For specific application scenarios, the system also supports configuring other wavelet basis functions, such as the Haar wavelet (computationally simple, suitable for real-time applications), the Symlet wavelet (better symmetry), and the bioorthogonal wavelet (supports linear phase reconstruction).

[0045] In some embodiments, in S3, the frequency band sensitivity analysis module is invoked to quantify the sensitivity of the target deep learning model to different frequency bands based on the sub-band decomposition results, and a frequency band weight map is generated; specifically including: S31. Decompose the subband results The organization is represented by a differentiable tensor; S32, Based on target deep learning model The forward propagation calculates the classification loss; where: For non-targeted attacks, classification loss , This represents the original image, and CE represents cross-entropy. Original, authentic labels; For targeted attacks, classification loss , Indicates the target label; S33, Based on subband decomposition results Differentiable tensor representations are used to calculate classification loss using an automatic differentiation mechanism. The gradient for each wavelet coefficient; where: Sub-band The decomposition coefficient matrix is The gradient matrix of this sub-band is The absolute value of the gradient. Describe the degree to which changes in the decomposition coefficients affect the classification results; S34. Calculate the sensitivity index for each sub-band. : in, represents the balance coefficient, mean represents the mean, and std represents the standard deviation; S35. Normalize the sensitivity indices of all sub-bands to generate a frequency band weight map, represented as follows: in, For temperature parameters, This represents all candidate subbands.

[0046] Specifically, the frequency band sensitivity analysis module quantifies the sensitivity of the target deep neural network to each frequency band, providing guidance for perturbation allocation. This invention employs a gradient-based sensitivity analysis method.

[0047] The first step is to prepare the input for analysis. This involves preparing the original image. Multi-scale wavelet decomposition is performed to obtain the set of coefficients for each sub-band. Organizing these coefficients into differentiable tensor representations facilitates subsequent gradient calculations.

[0048] The second step is to construct the forward computation graph. The wavelet coefficients are reconstructed into an image using inverse wavelet transform, and then input into the target deep neural network. Perform forward propagation and calculate classification loss. For non-targeted attacks, the loss function is the cross-entropy loss. ,in The original true labels are used; for targeted attacks, the loss function is negative cross-entropy loss. ,in For target labels.

[0049] The third step is to calculate the gradient through backpropagation. The loss is then calculated using an automatic differentiation mechanism. The gradient for each wavelet coefficient. Let's assume a certain sub-band. The coefficient matrix is Then the gradient matrix of this sub-band is The absolute value of the gradient. This reflects the degree to which changes in the corresponding coefficients affect the classification results.

[0050] The fourth step is to statistically analyze the frequency band sensitivity. For each sub-band... Calculate its sensitivity index This invention uses a combination of the mean and standard deviation of the absolute values ​​of the gradient as a sensitivity measure: in This is the balance factor (default value is 0.5). The mean reflects the average sensitivity of the frequency band, and the standard deviation reflects the spatial variation of the sensitivity. Combining the two can more comprehensively characterize the frequency band characteristics.

[0051] Step 5: Generate the frequency band weighting map. Normalize the sensitivity indices of all sub-bands to generate the weighting map. Normalization uses the softmax function. in This is a temperature parameter (default value 1.0), which controls the concentration of the weight distribution. The lower the temperature, the more concentrated the weights are in the high-sensitivity frequency band; the higher the temperature, the more uniform the weight distribution. This represents all candidate subbands.

[0052] To enhance the robustness of the analysis, this invention also introduces a multi-sample aggregation strategy. Since the analysis results of a single input image may exhibit randomness, the system supports aggregating the sensitivity analysis results of multiple samples to obtain a more representative frequency band weight map. The aggregation method can be either mean aggregation or median aggregation to suit different application requirements.

[0053] In some embodiments, in S4, the visual perception constraint module is invoked to describe the visual characteristics of the human eye using a contrast sensitivity function, in order to determine the upper bound of perturbations in different frequency bands, specifically including: The contrast sensitivity function (CSF) describes the minimum contrast required for the human eye to detect visual stimuli of different spatial frequencies. The Mannos-Sakrison model is used to model the CSF, and its expression is: in, For children Spatial frequency; The visibility threshold of the sub-band is set based on CSF. : in, It is a proportionality constant; Then the upper bound is disturbed. for: in, This is for the safety factor.

[0054] Specifically, the visual perception constraint module sets upper bounds for perturbations in each frequency band based on the characteristics of human vision, ensuring that the generated adversarial examples are visually imperceptible. The core of this module is the modeling and frequency band mapping of the contrast sensitivity function.

[0055] The contrast sensitivity function (CSF) describes the minimum contrast required for the human eye to detect visual stimuli of different spatial frequencies. This invention uses the Mannos-Sakrison model for CSF modeling, and the mathematical expression of this model is: in The function represents the spatial frequency (unit: cycles / degree). It peaks at approximately 4 cycles / degree, indicating that the human eye is most sensitive to this frequency; below and above this frequency, the sensitivity gradually decreases.

[0056] Mapping CSF to the frequency bands of wavelet decomposition requires establishing the correspondence between frequency bands and spatial frequencies. Let the highest spatial frequency corresponding to the sampling rate of the original image be... (Determined by image resolution and viewing distance, typically 30-60 cycles / degree), then the... Detail subbands of the level decomposition ( , , The corresponding spatial frequency range is Take the geometric center frequency within this range. As the representative frequency of this sub-band, it is substituted into the CSF model to calculate the corresponding sensitivity value.

[0057] Based on CSF sensitivity values, visibility thresholds (Just Noticeable Difference, JND) are set for each frequency band. The visibility threshold is inversely proportional to CSF ​​sensitivity. in It is a proportionality constant (typically 0.01-0.05, determined experimentally). For children The corresponding spatial frequency. This threshold indicates the sub-band... The increase is less than The disturbance is imperceptible to the human eye.

[0058] The final upper bound for the perturbation is set as the visibility threshold multiplied by a safety factor: in Set the safety factor (default is 0.8). This safety factor provides an additional margin for visual imperceptibility, taking into account individual differences and variations in viewing conditions, ensuring that adversarial examples maintain good visual quality for the vast majority of observers.

[0059] For color images, this invention further considers the perceptual differences between color channels. The human eye is more sensitive to the luminance channel than the chrominance channel; therefore, in the YCbCr color space, the upper limit of perturbation for the Y channel (luminance) is set more strictly, while the upper limits for perturbation for the Cb and Cr channels (chrominance) can be appropriately relaxed. This differentiated processing provides a larger perturbation space while ensuring visual quality.

[0060] In some embodiments, in S5, the perturbation and generation optimization module is invoked to perform multi-scale joint optimization based on the upper bound of perturbation in different frequency bands and the frequency band weight map to obtain the optimal frequency band perturbation; specifically including: S51. Initialize the disturbance in the frequency domain to obtain the initialized disturbance. Set the number of iterations Base learning rate ; S52, Perform iterative optimization; for the... Next iteration: The frequency domain coefficients after the current perturbation are reconstructed using inverse wavelet transform; Calculate the overall loss and its gradient with respect to each sub-band coefficient ; Adjust the gradient based on the frequency band weight map to obtain the weighted gradient. , , Indicates element-wise multiplication; Update the perturbation using the following formula: in, Indicates the first Perturbation in +1 iteration Indicates the first Perturbation in the next iteration This function takes the numerical sign of the gradient vector element by element and outputs the positive or negative direction of each element. To update the perturbation along the gradient direction; Project the updated perturbation into the feasible region, and apply it to the sub-bands. implement: in, This represents the perturbation coefficient on subband S after the (t+1)th iteration; For element-wise truncation functions, the input is restricted to a range. Inside; and These are the lower and upper bounds of the sub-band perturbation, respectively, ensuring that the perturbation does not exceed the upper bound of the perturbation. S53. Perform convergence judgment; If the attack is successful, the iteration ends early; otherwise, the iteration continues until the maximum number of iterations is reached. ; S54. Obtain the optimal frequency band perturbation.

[0061] Specifically, the perturbation generation and optimization module is the core module of the system, responsible for generating the optimal frequency domain perturbation through an iterative optimization algorithm under visual perception constraints. This invention designs a comprehensive loss function for frequency domain perception and an optimization algorithm based on projective gradient descent.

[0062] Comprehensive loss function It consists of three parts, and its mathematical expression is: in, and For weighted hyperparameters. Attack loss. The confidence boundary method is used to drive the adversarial example deception target model; perceptual quality loss. Visual quality is constrained by a combination of mean squared error (MSE) and structural similarity (SSIM) metrics; frequency domain regularization term. By constraining the uniformity of the perturbation energy distribution in each subband, the perturbation is ensured not to be excessively concentrated in a specific frequency band, thus enhancing the robustness against frequency domain defense methods.

[0063] The optimization algorithm employs Projected Gradient Descent (PGD). The algorithm flow is as follows: The first step is initialization. Initialize the perturbation in the frequency domain. Zero initialization or small-scale random initialization can be used. Set the number of iterations. (Default 100 times), base learning rate (Default 0.01).

[0064] The second step is iterative optimization. For the... The next iteration ( ): (a) Reconstruct the image from the frequency domain coefficients after the current perturbation using inverse wavelet transform. ; (b) Calculate the overall loss and its gradient with respect to each frequency band coefficient ; (c) Adjust the gradient according to the frequency band weight map to obtain the weighted gradient. ,in This is element-wise multiplication; (d) Update perturbation: The signed gradient method is used to ensure consistent update step size; (e) Projection operation: Project the updated perturbation into the feasible region for each sub-band. ,implement Ensure that the disturbance does not exceed the upper limit set by the visual perception constraint.

[0065] The third step is convergence judgment. If the attack is successful (for non-targeted attacks, the model's predicted class is not equal to the original label; for targeted attacks, the model's predicted class is equal to the target label), the iteration is terminated early; otherwise, iteration continues until the maximum number of iterations is reached. .

[0066] The fourth step is to output the results.

[0067] In some embodiments, in S6, adversarial examples are reconstructed at the output layer based on optimal frequency band perturbations; specifically including: Spatial domain images are reconstructed based on optimal frequency band perturbation; the final adversarial examples are obtained through numerical cropping, data type conversion, and color space conversion.

[0068] Specifically, the output layer (adversarial example reconstruction module) is responsible for converting the optimized frequency domain perturbation coefficients back to the spatial domain image. This module is implemented based on the Inverse Discrete Wavelet Transform (IDWT) to ensure the mathematical accuracy of the reconstruction process.

[0069] The inverse wavelet transform is the inverse process of the forward transform. For multi-level decomposition, reconstruction starts from the highest level (lowest frequency) and proceeds downwards level by level. Taking a three-level decomposition as an example, first... and , , The four sub-bands are combined to obtain Then and , , Synthesized Finally and , , The resulting reconstructed image is obtained at the original size. Each level of reconstruction includes upsampling and filtering operations, which are the inverse operations of downsampling and filtering in the forward transform.

[0070] After reconstruction, post-processing is required to ensure the validity of the output image. Post-processing includes: (1) numerical cropping, which limits the pixel values ​​to the valid range [0, 255] and handles values ​​that may be out of range due to disturbances; (2) data type conversion, which converts the floating-point calculation results to integer types (if necessary) to adapt to the image storage and display format; and (3) color space conversion, which converts the results back to RGB space if the above processing is performed in YCbCr space.

[0071] The implementation process of this invention is described in detail below through a specific embodiment. This embodiment targets the ResNet-50 classification model on the ImageNet dataset and generates non-target adversarial examples.

[0072] The first step is to prepare the input data and target model. Select an ImageNet validation image as the raw input. Image size is Original category label The target model is "Goldfish" (category index 1). A pre-trained ResNet-50 model is loaded as the target model. The model achieved a Top-1 accuracy of 76.1% on the ImageNet validation set.

[0073] The second step involves performing multi-scale frequency domain decomposition. The db4 wavelet is used to perform a three-level decomposition of the input image. The RGB channels are processed separately, yielding a result for each channel. Sub-band (size) ) and 9 detail sub-bands ( , , size , , , size , , , size A total of 30 sub-band matrices (3 channels × 10 sub-bands).

[0074] The third step is to perform band sensitivity analysis. The wavelet coefficients are set as differentiable tensors, and the image is reconstructed through inverse transform and input into ResNet-50 to calculate the cross-entropy loss. Backpropagation is used to calculate the gradient of each sub-band, and the sensitivity index is statistically obtained. The analysis results show that ResNet-50 is sensitive to the second-level detail sub-bands (especially...). and The most sensitive values ​​are 0.82 and 0.78 for the third-level low-frequency subband, respectively. The sensitivity is moderate (0.45); the sensitivity to the first-order high-frequency detail subband is low (approximately 0.2-0.3). A band weighting map is generated based on the sensitivity index. and Assign weights of 0.25 and 0.22. Assign a weight of 0.15 to the remaining sub-bands, and assign the remaining weights to the rest of the sub-bands.

[0075] The fourth step is to calculate the visual perception constraints. Assuming the image viewing conditions are a viewing distance of 60cm and a display resolution of 96 PPI, the highest spatial frequency is calculated. The frequency is approximately 48 cycles / degree. The representative spatial frequencies of each sub-band are as follows: Level 1 approximately 34 cycles / degree, Level 2 approximately 17 cycles / degree, and Level 3 approximately 8.5 cycles / degree. Substituting these values ​​into the CSF model to calculate sensitivity values, the Level 2 sub-band falls within the frequency range of high human eye sensitivity, resulting in a relatively low JND threshold (approximately 0.02); the Level 1 and Level 3 sub-bands have relatively high JND thresholds (approximately 0.05 and 0.04, respectively). A safety factor is then set. Thus, the upper bound of the perturbation for each frequency band is obtained.

[0076] Step 5: Iteratively optimize and generate perturbations. Initialize the frequency domain perturbation to zero and set the number of iterations. Base learning rate Loss weight , During the iterations, the overall loss gradually decreased, with the attack loss dropping from an initial 2.3 to -3.5 (indicating that the model's confidence in non-real categories was significantly higher than that in real categories), the perceptual quality loss remaining at a low level (approximately 0.02), and the frequency domain regularization term at approximately 0.001. The attack succeeded in the 67th iteration, and the model's prediction for the adversarial example changed to "tiger shark" (category index 3) with a confidence level of 0.72, while the confidence level for the "goldfish" category decreased to 0.08.

[0077] Step 6: Reconstruct adversarial examples. The optimized frequency domain coefficients are reconstructed into a spatial domain image using inverse wavelet transform. Post-processing includes cropping to... The range is converted to an 8-bit integer type. The generated adversarial examples are compared to the original image. The norm distance is 3.2 (approximately 0.8% relative to the normalized image), and the structural similarity (SSIM) is 0.992, making the differences visually imperceptible.

[0078] Step 7: Verify transferability. The generated adversarial examples were input into other unoptimized models for testing. The attack success rate was 68% on VGG-16, 72% on DenseNet-121, and 61% on Inception-v3, indicating that the generated adversarial examples have good cross-model transferability. Compared with adversarial examples generated using the PGD spatial domain attack method (transfer rates of 45%, 52%, and 38%, respectively), the adversarial examples generated by the method of this invention show an improvement in transferability of approximately 20-25 percentage points.

[0079] A second aspect of this invention proposes an adversarial example generation system based on multi-scale frequency domain decomposition, the system comprising: The input module is configured to receive the original image and the target deep learning model; The multi-scale frequency domain decomposition module is configured to perform wavelet decomposition on the original image to obtain sub-band decomposition results at different frequency levels. The frequency band sensitivity analysis module is configured to: quantify the sensitivity of the target deep learning model to different frequency bands based on the sub-band decomposition results, and generate a frequency band weight map; The visual perception constraint module is configured to: use a contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of perturbations in different frequency bands; The perturbation and generation optimization module is configured to perform multi-scale joint optimization based on the upper bound of perturbation and the frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation. The output module is configured to reconstruct adversarial examples based on optimal frequency band perturbations.

[0080] In summary, this invention proposes an adversarial example generation method and system based on multi-scale frequency domain decomposition. Multi-scale wavelet transform is used to perform hierarchical frequency domain decomposition on the input image. Perturbation weights for each frequency band are determined through deep neural network frequency band sensitivity analysis. Visual perception constraints are designed in conjunction with the human visual contrast sensitivity function. Targeted perturbations are adaptively applied at multiple frequency scales, and finally, adversarial examples are reconstructed through inverse transform.

[0081] This invention achieves collaborative optimization of adversarial perturbations across different frequency bands by constructing a frequency-domain-aware loss function and a multi-scale iterative optimization framework. The generated adversarial examples are highly concealed, have strong attack capabilities, and good transferability. This effectively solves the problems of existing spatial domain methods being easily detected by frequency domain defenses, having poor transferability, and poor visual quality, and provides a new technical means for security assessment and robustness improvement of deep learning systems.

[0082] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the appended claims.

Claims

1. A method for generating adversarial examples based on multi-scale frequency domain decomposition, characterized in that, The method includes: S1. In the input layer, the original image and the target deep learning model are received. S2. Call the multi-scale frequency domain decomposition module to perform wavelet decomposition on the original image and obtain sub-band decomposition results at different frequency levels; S3. Call the frequency band sensitivity analysis module, based on the sub-band decomposition results, quantify the sensitivity of the target deep learning model to different frequency bands, and generate a frequency band weight map; S4. Call the visual perception constraint module and use the contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of the perturbation in different frequency bands; S5. Call the perturbation and generation optimization module to perform multi-scale joint optimization based on the upper bound of perturbation and frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation; S6. In the output layer, reconstruct adversarial examples based on the optimal frequency band perturbation.

2. The adversarial example generation method based on multi-scale frequency domain decomposition according to claim 1, characterized in that, In S2, the multi-scale frequency domain decomposition module is invoked to perform wavelet decomposition on the original image, obtaining sub-band decomposition results at different frequency levels; where: The decomposition layers are represented by LL, LH, HL, and HH. The first-level decomposition is applied to the original image to obtain the first-level low-frequency approximate subband. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band ; The second-level decomposition only applies to the low-frequency approximate subband of the first level. The second-level low-frequency approximate subband is obtained. Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band ; And so on, the... Level decomposition acts on the first Low-frequency approximate subband of the level Sub-band, to obtain the first Low-frequency approximate subband of the level Horizontal detail sub-band Vertical detail sub-band Diagonal detail sub-band , ; The final subband decomposition results at different frequency levels include the low-frequency approximate subband of the Nth level. and The detail subbands at different frequency levels are represented as follows: .

3. The adversarial example generation method based on multi-scale frequency domain decomposition according to claim 2, characterized in that, In S3, the frequency band sensitivity analysis module is invoked. Based on the sub-band decomposition results, the sensitivity of the target deep learning model to different frequency bands is quantified, and a frequency band weight map is generated; specifically, this includes: S31. Decompose the subband results The organization is represented by a differentiable tensor; S32, Based on target deep learning model The forward propagation calculates the classification loss; where: For non-targeted attacks, classification loss , This represents the original image, and CE represents cross-entropy. Original, authentic labels; For targeted attacks, classification loss , Indicates the target label; S33, Based on subband decomposition results Differentiable tensor representations are used to calculate classification loss using an automatic differentiation mechanism. The gradient for each wavelet coefficient; where: Sub-band The decomposition coefficient matrix is The gradient matrix of this sub-band is The absolute value of the gradient. Describe the degree to which changes in the decomposition coefficients affect the classification results; S34. Calculate the sensitivity index for each sub-band. : in, represents the balance coefficient, mean represents the mean, and std represents the standard deviation; S35. Normalize the sensitivity indices of all sub-bands to generate a frequency band weight map, represented as follows: in, For temperature parameters, This represents all candidate subbands.

4. The adversarial example generation method based on multi-scale frequency domain decomposition according to claim 3, characterized in that, In S4, the visual perception constraint module is invoked, and the contrast sensitivity function is used to describe the characteristics of human vision in order to determine the upper bound of perturbations in different frequency bands, specifically including: The contrast sensitivity function (CSF) describes the minimum contrast required for the human eye to detect visual stimuli of different spatial frequencies. The Mannos-Sakrison model is used to model the CSF, and its expression is: in, For children Spatial frequency; The visibility threshold of the sub-band is set based on CSF. : in, It is a proportionality constant; Then the upper bound is disturbed. for: in, This is for the safety factor.

5. The adversarial example generation method based on multi-scale frequency domain decomposition according to claim 4, characterized in that, In S5, the perturbation and generation optimization module is invoked to perform multi-scale joint optimization based on the upper bound of perturbation in different frequency bands and the frequency band weight map, to obtain the optimal frequency band perturbation; specifically including: S51. Initialize the disturbance in the frequency domain to obtain the initialized disturbance. Set the number of iterations Base learning rate ; S52, Perform iterative optimization; for the... Next iteration: The frequency domain coefficients after the current perturbation are reconstructed using inverse wavelet transform; Calculate the overall loss and its gradient with respect to each sub-band coefficient ; Adjust the gradient based on the frequency band weight map to obtain the weighted gradient. , , Indicates element-wise multiplication; Update the perturbation using the following formula: in, Indicates the first Perturbation in +1 iteration Indicates the first Perturbation in the next iteration This represents a function that obtains the numerical sign of the gradient vector element by element in order to update the perturbation along the gradient direction; Project the updated perturbation into the feasible region, and apply it to the sub-bands. implement: in, Indicates the first After the next iteration, in the subband The disturbance coefficient on; An element-wise truncation function that restricts the input to a range Inside; S53. Perform convergence judgment; If the attack is successful, the iteration ends early; otherwise, the iteration continues until the maximum number of iterations is reached. ; S54. Obtain the optimal frequency band perturbation.

6. The adversarial example generation method based on multi-scale frequency domain decomposition according to claim 5, characterized in that, In S6, adversarial examples are reconstructed at the output layer based on optimal frequency band perturbations; specifically, this includes: Spatial domain images are reconstructed based on optimal frequency band perturbation; the final adversarial examples are obtained through numerical cropping, data type conversion, and color space conversion.

7. An adversarial example generation system based on multi-scale frequency domain decomposition, characterized in that, The system includes: The input module is configured to receive the original image and the target deep learning model; The multi-scale frequency domain decomposition module is configured to perform wavelet decomposition on the original image to obtain sub-band decomposition results at different frequency levels. The frequency band sensitivity analysis module is configured to: quantify the sensitivity of the target deep learning model to different frequency bands based on the sub-band decomposition results, and generate a frequency band weight map; The visual perception constraint module is configured to: use a contrast sensitivity function to describe the visual characteristics of the human eye in order to determine the upper bound of perturbations in different frequency bands; The perturbation and generation optimization module is configured to perform multi-scale joint optimization based on the upper bound of perturbation and the frequency band weight map of different frequency bands to obtain the optimal frequency band perturbation. The output module is configured to reconstruct adversarial examples based on optimal frequency band perturbations.

Images