Local adversarial sample generation method based on semantic guidance and momentum optimization

Abstract

The invention discloses a local confrontation sample generation method based on semantic guidance and momentum optimization, and belongs to the technical field of artificial intelligence security. The invention aims to solve the problems of unstable pixel positioning and abrupt local disturbance vision in the existing sparse attack method. According to the method, historical gradient information is accumulated by introducing a momentum mechanism, gradient fluctuation is smoothed to robustly position key semantic pixels, and a sparse mask is generated; and meanwhile, a comprehensive objective function containing an attack guide item, a distribution planarization item and a deep feature consistency item is constructed, and a disturbance value is finely updated under the mask constraint by using an adaptive moment estimation strategy. According to the method, the local confrontation sample which is high in attack success rate and difficult to perceive visually can be generated, and the concealment and robustness of the confrontation attack in a complex scene are effectively improved.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and image processing technology, and more specifically, to a method for generating adversarial examples for deep neural network models, aiming to generate high-visual-quality and sparse examples. Background Technology

[0002] Deep neural networks excel in tasks such as image recognition, but they are highly vulnerable to adversarial attacks. Existing adversarial attack methods mainly fall into two categories: dense attacks that limit the overall perturbation amplitude and sparse attacks that limit the number of perturbed pixels. Traditional sparse attacks, while attempting to modify only a small number of pixels, face two major technical bottlenecks: first, the pixel selection process typically relies on instantaneous gradients, leading to unstable point selection and a tendency to get trapped in local optima; second, they focus solely on the attack success rate while neglecting the visual harmony between the perturbed pixels and their surroundings, resulting in abrupt artifacts on the modified pixels. Therefore, how to accurately and stably locate key pixels while ensuring the attack success rate, and make local perturbations visually imperceptible, is a pressing problem that needs to be solved. Summary of the Invention

[0003] To address the shortcomings of existing sparse adversarial attack methods in pixel localization stability and visual perception quality, this invention provides a local adversarial example generation method based on semantic guidance and momentum optimization. This method introduces a momentum mechanism to stabilize the recognition process of key pixels and combines a comprehensive objective function with multiple constraints to optimize local perturbations. The method of this invention includes the following steps: Step S1: Receive the original input image data and the target deep neural network model to be attacked, initialize the adversarial perturbation matrix with the same dimension as the original input image data, and initialize the momentum matrix used to accumulate gradient history information to a zero matrix. Step S2: Enter the iterative optimization loop process. In each iteration, the localization of key pixels and the update of perturbations are guided by calculating the comprehensive objective function. Step S3: Determine whether the preset iteration termination condition has been met. If it has, superimpose the current iteration-optimized adversarial perturbation matrix with the original input image data to output the final local adversarial sample. Optionally, step S2 includes the following sub-steps: Step S21: Construct a comprehensive objective function, which is a weighted combination of an attack guidance term, a distribution flattening term, and a deep feature consistency term, used to induce model misclassification, disrupt decision boundary stability, and maintain visual perception quality, respectively. Step S22: Calculate the gradient information of the integrated objective function relative to the current adversarial example; Step S23: Update the momentum matrix using the gradient information. This update process combines the gradient information at the current moment with the momentum matrix information at the previous moment to smooth the instantaneous fluctuations of the gradient and enhance the long-term response to key regions. Step S24: Based on the numerical significance of each spatial location in the updated momentum matrix, select the top few pixel locations that have the greatest impact on the model decision and generate a binarized sparse selection mask. Step S25: Update the adversarial perturbation matrix using a parameter optimization algorithm, and perform a Hadamard product operation between the updated perturbation matrix and the sparse selection mask to force the perturbation values ​​to be retained only at the positions selected by the mask. Then, the perturbation amplitude is truncated.

[0004] Compared with existing technologies, this invention clearly distinguishes between the momentum matrix used for pixel localization and the moment estimation used for numerical optimization. The momentum matrix effectively filters out noise interference from instantaneous gradients, achieving robust localization of key pixels with long-term semantic influence in images. Simultaneously, this invention constructs a comprehensive objective function that includes a distribution flattening term and a deep feature consistency term. The former disrupts the model's decision boundary by maximizing the uncertainty of the output distribution, while the latter directly constrains the perceptual quality of perturbations in the feature space, allowing the generated local perturbations to naturally integrate into the image texture. Attached Figure Description

[0005] Figure 1 This is a flowchart illustrating a local adversarial sample generation method based on semantic guidance and momentum optimization provided in an embodiment of the present invention. Detailed Implementation

[0006] To make the objectives, technical solutions, and advantages of the present invention clearer, a specific embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

[0007] This embodiment proposes a novel adversarial attack framework aimed at addressing the shortcomings of inaccurate pixel positioning and significant perturbation in existing technologies. For example... Figure 1 As shown, this method decouples the attack process into two mutually guiding modules: a pixel localization module based on momentum accumulation and a perturbation optimization module based on composite loss.

[0008] Step S1: Initialization Phase The system first receives the raw input image and the target deep neural network model to be attacked .

[0009] set up The dimension is Simultaneously, the adversarial perturbation matrix to be optimized is initialized. The initial values ​​are all 0, and its dimension is the same as... The same applies. To achieve stable pixel selection, a momentum matrix is ​​initialized. Its dimensions are also The initial value is set to an all-zero matrix.

[0010] In addition, a series of hyperparameters are set, including the maximum number of iterations. The decay factor of the momentum matrix Maximum number of pixels allowed to be modified Perturb the updated learning rate and the weight coefficients of each term in the comprehensive objective function. , and .

[0011] Step S2: Iterative Optimization to Generate Adversarial Perturbations. This step is the core of the invention, refining the perturbations through multiple iterative cycles. In each iteration... In the process, perform the following detailed sub-steps: Step S21: Constructing a Synthetic Objective Function To generate both effective and covert perturbations within the selected region, this invention constructs a synthetic objective function comprising three parts. ;

[0012] in, This is the attack guidance term, using the confidence boundary loss form. Let... The corresponding original labels output by the model logical value, If the logical value is the highest category other than the original label, then:

[0013] in This is a confidence threshold that controls the intensity of the attack. It aims to lower the score for the correct category and raise the score for the most likely incorrect category.

[0014] It is the distribution flattening term, defined as the negative of the variance of the model output logistic vector, i.e.:

[0015] The variance of this term measures the dispersion of the data distribution; the smaller the variance, the more concentrated the data distribution. In the context of logistic vectors, minimizing the negative value of the variance is equivalent to maximizing the negative value of the variance, or in other words, aiming to make the variance as small as possible. By forcing the probability distribution of the model's output to become flat, the uncertainty of the model's decisions can be greatly increased, disrupting the stability of its original decision boundary.

[0016] It is a deep feature consistency term, using a perceptual distance metric. The specific calculation process is as follows: [The original image is then processed...] and current adversarial examples Each input is fed into a pre-trained feature extraction network to extract... Feature maps of a specified layer.

[0017] For the Layer, let the features of the original image be The characteristics of adversarial examples are First, the features are normalized according to the channel dimension. Then, the Euclidean distance between the two features is calculated and the spatial average is taken. Finally, the distances of all layers are weighted and summed, i.e.:

[0018] in This is the layer weight. This term ensures that the generated perturbation remains consistent with the original image in the deep semantic space.

[0019] Step S22: Calculate gradient information for the current adversarial example. Input the target model and use the backpropagation algorithm to calculate the comprehensive objective function. Relative to input gradient:

[0020] Step S23: Update the momentum matrix to eliminate gradients from a single calculation. To address the high-frequency noise and directional instability contained within the matrix, this invention utilizes a momentum mechanism to update the momentum matrix. The updated formula is:

[0021] in The momentum matrix representing the current iteration step. The momentum matrix representing the previous iteration step is the decay factor. This represents the L1 norm of the gradient. By performing L1 normalization on the current gradient, the influence of excessive differences in gradient magnitude at different iteration stages is eliminated, ensuring the stability of the accumulation process.

[0022] This step, through the accumulation of historical information, highlights those pixel regions that consistently have a significant impact on model decisions across multiple iterations.

[0023] Step S24: Generate a sparse selection mask based on the updated momentum matrix The system evaluates the importance of each pixel. (Calculation) Each spatial location The saliency score of a pixel is the sum of the absolute values ​​of all channel values. Sort all pixels in descending order of saliency score, and select the top... The location of the pixel with the highest score is used to generate a binary sparse selection mask. .exist In the middle, this The values ​​at the key positions are set to 1, and the values ​​at all other positions are set to 0.

[0024] Step S25: Update the adversarial perturbation matrix. This step uses an adaptive parameter optimization algorithm to update the perturbation values. Here, a clear distinction is made between the momentum matrix used for pixel selection and the algorithm's internal parameters used for numerical optimization. Specifically, the Adam adaptive moment estimation strategy is employed. First, the first-order moment estimate is updated:

[0025] Next, update the second-order moment estimate:

[0026] in , It is the exponential decay rate. Then, the bias-corrected estimate is calculated. and Finally, the perturbation update amount under the unmasked constraint is calculated:

[0027] After obtaining the update amount, apply the mask generated in step S24. To impose spatial constraints, namely:

[0028] in This represents the Hadamard product, which is element-wise multiplication. This step forces all non-critical region perturbations to be updated to zero. Finally, for Perform numerical truncation to ensure The pixel values ​​are within the valid image value range.

[0029] Step S3: Output adversarial examples. Repeat steps S2 to S25 until the number of iterations reaches [number missing]. Or the attack is successful. At this point, the final low-impact local adversarial sample is output. Through the above refined steps, this invention ensures the effectiveness of the attack while utilizing the physical properties of deep feature consistency terms and distribution flattening terms to hide attack traces to the greatest extent.

[0030] This invention, through the aforementioned steps, particularly by combining a momentum accumulation mechanism for robust localization of key semantic pixels and fine-tuning of a comprehensive objective function including attack loss, logistic variance loss, and semantic perception loss under mask constraints, can concentrate attacks on the sparse regions most influential on model decisions. While ensuring a high attack success rate, it reduces visual perception distortion to an extremely low level, achieving a Pareto optimal balance between attack effectiveness and visual concealment. Experimental results show that this method achieves significant attack results on standard benchmark datasets such as CIFAR-10 and Tiny ImageNet, targeting various mainstream models encompassing convolutional neural networks and Transformer architectures, including VGG16, ResNet50, ViT-B / 16, and Swin-Transformer. Specifically, on the CIFAR-10 dataset, targeting the ResNet50 model, this method achieves a high attack success rate of 96.6% by modifying only local pixels in the image, while reducing the LPIPS (Limited Perceptual Index) to 0.0194, representing an order-of-magnitude improvement in visual concealment compared to traditional sparse attack methods, while maintaining the same or higher attack success rate. For the attention-based ViT-B / 16 model, the attack success rate reaches an even higher 99.8%. On the Tiny ImageNet dataset, which has more complex image textures, this method also performs excellently, maintaining a 98.4% attack success rate against ResNet50, and keeping the LPIPS at an extremely low level of 0.0846, demonstrating the method's generalization ability across different resolutions and scenes. Furthermore, the local adversarial examples generated by this method exhibit extremely strong robustness against defenses. Experimental data shows that even when facing high-strength JPEG compression and feature compression defenses, the adversarial examples generated by this method still maintain average attack success rates of over 88.3% and 91.3%, respectively, demonstrating the strong feature penetration capability of semantically guided local perturbations. Notably, the experiments also reveal the significant potential of this method in cross-architecture transfer attacks, particularly the local adversarial perturbations generated based on the Transformer architecture model, which demonstrate extremely high black-box transfer attack capabilities against various CNN architecture models. This provides a new benchmark for evaluating the security vulnerabilities of different model architectures.

[0031] The above embodiments are merely one specific implementation of the present invention and are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, without departing from the core ideas and spirit of the present invention, various equivalent substitutions, modifications, or improvements can be made to the specific formula forms, components of the loss function, momentum update strategies, hyperparameter settings, etc., and all such changes should be included within the scope of protection of the present invention. For example, the semantic awareness term in the comprehensive loss function can be replaced with other distance metrics based on depth features; the momentum matrix update can employ Nesterov momentum or other adaptive gradient estimation algorithms; and the pixel selection strategy can also be adjusted according to the specific application scenario to be region-based block selection or frequency domain-based mask generation.

Claims

1. A method for generating local adversarial examples based on semantic guidance and momentum optimization, characterized in that, Includes the following steps: Step S1: Receive the original input image data and the target deep neural network model to be attacked, initialize the adversarial perturbation matrix with the same dimension as the original input image data, and initialize the momentum matrix used to accumulate gradient history information to a zero matrix. Step S2: Enter the iterative optimization loop process. In each iteration, the localization of key pixels and the update of perturbations are guided by calculating the comprehensive objective function. Step S3: Determine whether the preset iteration termination condition has been met. If it has, superimpose the current iteration-optimized adversarial perturbation matrix with the original input image data to output the final local adversarial sample. Step S2 includes the following sub-steps: Step S21: Construct a comprehensive objective function, which is a weighted combination of an attack guidance term, a distribution flattening term, and a deep feature consistency term, used to induce model misclassification, disrupt decision boundary stability, and maintain visual perception quality, respectively. Step S22: Calculate the gradient information of the integrated objective function relative to the current adversarial example; Step S23: Update the momentum matrix using the gradient information. This update process combines the gradient information at the current moment with the momentum matrix information at the previous moment to smooth the instantaneous fluctuations of the gradient and enhance the long-term response to key regions. Step S24: Based on the numerical significance of each spatial location in the updated momentum matrix, select the top few pixel locations that have the greatest impact on the model decision and generate a binarized sparse selection mask. Step S25: Update the adversarial perturbation matrix using a parameter optimization algorithm, and perform a Hadamard product operation between the updated perturbation matrix and the sparse selection mask to force the perturbation values ​​to be retained only at the positions selected by the mask. Then, the perturbation amplitude is truncated.

2. The method according to claim 1, characterized in that, In step S23, the process of updating the momentum matrix adopts an exponentially weighted moving average strategy. First, the gradient information calculated in step S22 is regularized to unify the magnitude scale. Then, the momentum matrix of the previous iteration step is multiplied by the decay factor and added to the current regularized gradient information to obtain the momentum matrix of the current iteration step.

3. The method according to claim 1, characterized in that, In step S24, the specific method for generating the binarized sparse selection mask is as follows: calculate the sum of the absolute values ​​of all channel values ​​of the momentum matrix at each pixel coordinate position as the importance score of that position, sort all positions according to the score, select the first K positions as the active state, and set the remaining positions as the suppressed state, where K is a preset sparsity threshold.

4. The method according to claim 1, characterized in that, In step S21, the attack guidance term adopts the confidence boundary form, which aims to widen the gap between the predicted scores of the target category and other categories; the distribution flattening term is defined as the negative value of the variance of the model output logistic vector; the deep feature consistency term is defined as the perceptual distance between the original input image and the current adversarial sample in the multi-layer feature maps of the pre-trained feature extraction network.

5. The method according to claim 4, characterized in that, The specific calculation method of the distribution flattening term is as follows: obtain the logical value vector of the model output layer before Softmax activation, calculate the degree of dispersion of all elements in the vector relative to its mean, and take the negative sign of the degree of dispersion as the loss value, which aims to force the model output distribution to tend to be uniform and increase the uncertainty of the model.

6. The method according to claim 4, characterized in that, The specific calculation method of the deep feature consistency term is as follows: input the original input image and the adversarial sample into the feature extraction network respectively, extract the feature tensors of multiple specified layers, perform channel normalization on the feature tensors of each layer, calculate the Euclidean distance between the two, and finally sum the distances of each layer by weight.

7. The method according to claim 1, characterized in that, In step S25, the process of updating the adversarial perturbation matrix adopts an adaptive moment estimation strategy. This strategy maintains the first-order moment estimation and the second-order moment estimation in the perturbation update process. The first-order moment estimation is used to smooth the update direction, and the second-order moment estimation is used to adjust the learning rate of different parameters, thereby achieving fine adjustment of the perturbation value under the constraint of sparse selection mask.

8. The method according to claim 7, characterized in that, The updates of the first-order moment estimate and the second-order moment estimate are based on the exponentially weighted average of the gradient and the square of the integrated objective function, respectively, and the first-order moment and the second-order moment are corrected for deviations before updating the perturbation matrix.

9. A local adversarial example generation system based on semantic guidance and momentum optimization, characterized in that, The system is configured to perform the method as described in any one of claims 1 to 8.

Images