Adversarial example generation methods, devices, equipment, and media for image-based intelligent algorithms

Abstract

This application provides a method, apparatus, device, and medium for generating adversarial examples for image-based intelligent algorithms, applicable to the field of artificial intelligence technology. The method includes: performing feature sensitivity analysis on the image to be tested and the target algorithm model to obtain feature importance distribution data; initializing configuration data to generate perturbation generation configuration data based on the feature importance distribution data and the architecture type of the target algorithm model; generating initial adversarial perturbation data by performing architecture type matching-oriented perturbation on the image to be tested based on the perturbation generation configuration data; performing multi-objective optimization and adjustment on the initial adversarial perturbation data to generate optimized adversarial perturbation data; and performing pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested to generate an adversarial example set. This application achieves efficient and low-impact adversarial example generation through feature sensitivity analysis, adaptive perturbation strategy configuration, multi-objective optimization, and pixel-constraint synthesis and verification.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device and medium for generating adversarial examples for an image-based intelligent algorithm. Background Technology

[0002] In image-based intelligent algorithms, adversarial examples serve as tools for security testing and robustness evaluation. They reveal the model's vulnerability to input perturbations, distribution drift, or malicious attacks during actual deployment, thus providing quantitative evidence and improvement directions for defense mechanisms, training enhancement, and risk mitigation. The requirements for adversarial examples include both functionality—achieving a high attack success rate or misleading a specific target with the smallest possible perturbation (i.e., high ASR / target false alarm rate), cross-model transferability, and robustness under actual transmission / compression; and stealth—the perturbation should remain visually imperceptible or conform to physical constraints (e.g., L2 / L1). ∞ (Limited or very few pixels of L0 constraint); In addition, generation efficiency and controllability are required, which is to generate high-quality samples quickly under limited query / computational resources, facilitate batch testing, index evaluation (such as SSIM, PSNR, LPIPS) and result reproduction, and finally take into account ethical / compliance boundaries, limiting the use to security testing and defense research only.

[0003] The existing methods for generating adversarial examples are well-defined and diverse. In white-box scenarios, gradient-based deterministic methods (such as FGSM, PGD, and CW) are commonly used to construct perturbations quickly or iteratively by directly utilizing model gradients. There are also feature / saliency-based improvements (such as Grad-CAM-guided local perturbations or JSMA-based pixel selection). In black-box scenarios, transfer attacks based on alternative models and query-based estimation methods (finite difference, NES, SPSA) have emerged, along with evolutionary / optimization-based search strategies (differential evolution, genetic algorithms) to find effective perturbations without gradient access. Simultaneously, adversarial patches, physical world stickers, and generative attacks driven by GANs / generative models have appeared, specifically designed for robustness or stealth in real-world environments. These methods are widely used in both theoretical and engineering communities for model benchmarking, defense evaluation, and attack-defense adversarial research.

[0004] Existing methods use a single attack operator or empirical parameters (e.g., constant ε, fixed step size, or a single search mechanism), failing to dynamically adjust the perturbation location, scale, and iteration strategy based on the differences in multi-level feature representation, attention distribution, and sensitivity among different networks (CNN, ResNet, ViT, lightweight face network, etc.). This results in either introducing excessively large or scattered perturbations (poor visual perceptibility) to ensure a high success rate, or incurring high query / computation costs or reduced transferability to maintain stealth. Summary of the Invention

[0005] In view of this, this application provides a method, apparatus, device and medium for generating adversarial samples for image-based intelligent algorithms, which can solve the problem of balancing the attack success efficiency and stealth of adversarial samples generated in the prior art.

[0006] In a first aspect, embodiments of this application provide a method for generating adversarial examples for image-based intelligent algorithms, the method comprising: Feature sensitivity analysis is performed on the image under test and the target algorithm model to obtain feature importance distribution data; Based on the feature importance distribution data and the architecture type of the target algorithm model, configuration data initialization processing is performed to generate perturbation-generated configuration data; Based on the perturbation generation configuration data, the image under test is subjected to architecture type matching directional perturbation generation to obtain initial adversarial perturbation data, and the initial adversarial perturbation data is optimized and adjusted in multiple objectives to generate optimized adversarial perturbation data. The optimized adversarial perturbation data and the image under test are combined with pixel-level constraints for synthesis and adversarial effectiveness verification to generate an adversarial sample set.

[0007] In some embodiments, the step of performing feature sensitivity analysis on the image to be tested and the target algorithm model to obtain feature importance distribution data includes: The image to be tested is preprocessed to generate a standard input image, and the target algorithm model is forward propagated based on the standard input image to obtain the feature representation data of each network layer in the target algorithm model. Based on the preset target category set and the feature representation data, gradient backpropagation calculation is performed on the target algorithm model to obtain the gradient data of the standard input image; Based on the preset scoring coefficients and the gradient data, the feature importance score of each pixel region in the standard input image is calculated. The feature importance scores are weighted and aggregated across layers based on preset inter-layer weighting coefficients to generate a comprehensive importance score for each pixel region. Based on the spatial location of pixel regions in the standard input image, the comprehensive importance score is smoothed to obtain feature importance distribution data.

[0008] In some embodiments, the step of performing configuration data initialization processing based on the feature importance distribution data and the architecture type of the target algorithm model to generate perturbation-generated configuration data includes: The structural features of the target algorithm model are analyzed, and the basic perturbation generation strategy corresponding to the architecture type is determined through a preset strategy mapping mechanism. Based on the feature importance distribution data, the adjustable parameters in the basic perturbation generation strategy are initialized and assigned values ​​to obtain the core parameter set; Based on the architecture type, the basic disturbance generation strategy and the core parameter set are associated and integrated to generate disturbance generation configuration data.

[0009] In some embodiments, the step of generating directional perturbations for the image under test based on the perturbation generation configuration data, and obtaining initial adversarial perturbation data, includes: Using the basic perturbation generation strategy, gradient calculation is performed on the image under test based on the core parameter set to obtain perturbation generation-guided gradient change data. Based on the gradient change data and the perturbation amplitude parameters in the core parameter set, the perturbation values ​​of each region are transformed to obtain the initial perturbation values ​​corresponding to each pixel region. The initial perturbation value is spatially weighted and fused based on the feature importance distribution data to generate the original perturbation data of the image to be tested; Based on a preset disturbance amplitude constraint threshold, the original disturbance data is subjected to amplitude limiting processing to generate initial counter-disturbance data.

[0010] In some embodiments, performing multi-objective optimization adjustment on the initial counter-disturbance data to generate optimized counter-disturbance data includes: Step S31: Use a preset multi-objective optimization strategy to perform gradient descent optimization on the initial adversarial perturbation data to obtain the current perturbation value of each pixel region; Step S32: Based on the preset constraint set and the preset learning rate, project the current perturbation value into the preset constraint space to update the initial adversarial perturbation data; Step S33: Accumulate and update the number of iterations according to the preset counting rules, and perform exponential decay calculation on the number of iterations to update the learning rate; Step S34: Calculate the current attack success rate and the current visual distortion loss rate based on the initial adversarial perturbation data using the multi-objective optimization strategy. Repeat steps S31 to S34 until the current attack success rate reaches a preset success threshold and the current visual distortion loss rate is less than a preset distortion threshold, or the number of iterations reaches a preset number threshold, at which point the initial adversarial perturbation data is used as optimized adversarial perturbation data.

[0011] In some embodiments, generating an adversarial sample set by performing pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested includes: The optimized anti-perturbation data and the image under test are added pixel by pixel to synthesize an initial synthesized image; The initial synthesized image is subjected to pixel value constraint processing according to a preset pixel value constraint threshold to generate candidate adversarial samples; The candidate adversarial sample is input into the target algorithm model to obtain the predicted category, and the similarity value between the preset attack target category and the predicted category is calculated; When the similarity value reaches a preset similarity threshold, the visual quality of the candidate adversarial sample is evaluated based on the image to be tested to obtain a visual quality evaluation index. When the visual quality assessment index reaches the preset index threshold, the candidate adversarial sample, the similarity value, and the visual quality assessment index are associated and stored to generate an adversarial sample set.

[0012] In some embodiments, when the basic perturbation generation strategy corresponding to the architecture type of the target algorithm model cannot be obtained, the method further includes: Extract the structural feature vector of the target algorithm model, and calculate the feature similarity between the typical architecture feature vectors in the policy mapping mechanism and the structural feature vector; The basic proportion of each basic perturbation generation strategy in the strategy mapping mechanism is calculated based on the feature similarity, and the fusion weight corresponding to each basic perturbation generation strategy is obtained. The basic perturbation generation strategy is weighted and fused according to the fusion weight to construct a composite perturbation generation strategy; Based on the feature importance distribution data, the adjustable parameters in the composite perturbation generation strategy are initialized and assigned values ​​to obtain the core parameter set; Based on the architecture type, the composite perturbation generation strategy, the fusion weight, and the core parameter set are associated and integrated to generate perturbation generation configuration data.

[0013] Secondly, this application also provides an adversarial example generation device for image-based intelligent algorithms, the device comprising: The correlation quantization module is used to perform feature sensitivity analysis on the image under test and the target algorithm model to obtain feature importance distribution data; The configuration setting module is used to perform configuration data initialization processing based on the feature importance distribution data and the architecture type of the target algorithm model, and generate perturbation generation configuration data. The directional matching module is used to generate directional perturbations for the image under test based on the perturbation generation configuration data to match the architecture type, thereby obtaining initial adversarial perturbation data. The perturbation optimization module is used to perform multi-objective optimization and adjustment on the initial counter-perturbation data to generate optimized counter-perturbation data; The synthesis and verification module is used to perform pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested, and generate an adversarial sample set.

[0014] Thirdly, this application also provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the adversarial example generation method of the image-based intelligent algorithm as described above.

[0015] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the adversarial example generation method of the image-based intelligent algorithm described above.

[0016] In summary, this application includes at least the following beneficial technical effects: 1. By locating key pixels / regions through multi-layer feature sensitivity analysis and combining them with architecture-aware perturbation strategies, perturbations become more targeted, thereby increasing the probability of misleading the target model with smaller perturbations.

[0017] 2. By employing multi-objective optimization and pixel-level constraints, post-processing, and quality assessment, perceptible distortion can be significantly reduced while maintaining high ASR.

[0018] 3. Adaptively select strategies based on model type and provide parameter initialization and constraint projection, which not only adapts to various architectures of image-based intelligent algorithms, but also facilitates parameterized control and batch generation, verification and archiving of adversarial sample sets. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic flowchart of an embodiment of an adversarial example generation method for an image-based intelligent algorithm provided in this application; Figure 2 This is a schematic diagram of an embodiment of an electronic device provided in this application; Figure 3 This is a structural block diagram of an adversarial example generation device for an image-based intelligent algorithm provided in this application. Detailed Implementation

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0022] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0023] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0024] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), unless otherwise expressly and specifically defined.

[0025] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0026] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0027] Firstly, please refer to Figure 1 , Figure 1 This is a schematic flowchart illustrating an embodiment of an adversarial example generation method for an image-based intelligent algorithm provided in this application. The adversarial example generation method for an image-based intelligent algorithm provided in this application includes the following steps.

[0028] Step S1: Perform feature sensitivity analysis on the image to be tested and the target algorithm model to obtain feature importance distribution data.

[0029] The test image is the raw image data intended for adversarial attack testing of the target algorithm model. This data typically exists in the form of an RGB three-channel digital matrix, with dimensions of height, width, and three-channel color information. The target algorithm model is an image recognition model that has been trained and is awaiting security evaluation. Its architecture may encompass various types, such as convolutional neural networks, visual Transformers, or lightweight networks optimized for face recognition. The test image is an image selected from the test dataset or provided directly by the user that has been correctly classified by the target model. It serves as the carrier for applying adversarial perturbations and is also the original input object of this application.

[0030] To ensure that the target algorithm model can process data within a consistent numerical range, a standardization preprocessing step is first required for the test image. The preprocessing operations used in this application typically include adjusting the image size to the model's preset input size, such as scaling or cropping an image of arbitrary size to 224 pixels square, and normalizing the original integer pixel values ​​from 0 to 255 to the floating-point range of 0 to 1, or normalizing them according to the mean and standard deviation used during model training. This standardization preprocessing eliminates differences in scale and numerical distribution of the original image data, allowing images from different sources or of different sizes to be input in a manner consistent with the model's expectations, thereby ensuring the stability of the forward propagation computation and the consistency of feature extraction.

[0031] After obtaining the standard input image, it is fed into the target algorithm model to perform forward propagation calculations. This process moves the image data from the model's input layer through all hidden layers to the output layer, capturing and recording the feature representation data generated by each network layer. For convolutional neural networks, the feature representation data is represented as multi-dimensional feature maps output by different convolutional layers; for visual Transformers, the feature representation data is represented as serialized feature vectors or attention weight matrices processed by a multi-head attention mechanism. This multi-layered feature representation data is used to gain insight into the model's internal understanding and abstraction process of the input image. Network layers of different depths capture information ranging from low-level features such as edges and textures to high-level features such as object parts and semantic concepts. This information forms the basic raw material for evaluating the contribution of different regions of the image to the final classification decision. Furthermore, gradient backpropagation calculations are performed on the obtained feature representation data according to a predefined target category set. The target category set contains one or more category labels that the attacker intends to cause the model to mispredict; in non-targeted attacks, this set may contain all other categories besides the original correct category. In this embodiment, the gradient backpropagation calculation starts from the model's output layer, specifically calculating the partial derivative of the predicted probability for each target category with respect to each pixel in the standard input image, thereby obtaining a set of gradient data. This gradient data is a tensor with the same spatial dimension as the standard input image, where the value at each position quantifies the strength and direction of the influence of a small change in the corresponding pixel on the probability of the model predicting the target category. For example, if the goal is to generate an image of a "dog" that is misclassified as a "cat," the gradient data calculation used in this embodiment is the sensitivity of each pixel value change to the probability of the "cat" category. The above calculation operations reveal the specific local regions in the input image that the target algorithm model's decision logic depends on, providing direct gradient guidance for locating key perturbation points.

[0032] Based on the gradient data obtained from the above calculations, it is necessary to further calculate the feature importance score of each pixel region in the standard input image. This application embodiment adjusts the obtained gradient data by introducing a preset scoring coefficient, where the scoring coefficient is a scaling factor used to balance the influence of different channels or spatial locations. In some optional implementations, the scoring coefficient can also be a non-linear activation function. The scoring coefficient transforms the original gradient value into a more representative or stable metric. This application embodiment employs a common operation—taking the absolute or squared value of the gradient as a preliminary importance measure, and then multiplying it by a learnable or empirical coefficient matrix to emphasize certain feature dimensions that are more effective against adversarial attacks. For example, in a face recognition model, the gradients of the eye and mouth regions may be assigned higher scoring coefficients because modifying these regions is more likely to lead to misidentification. By transforming gradient information, which may contain positive and negative directions and noise, into a purely non-negative scalar field, the pixel regions in the image that have the greatest influence on the model's current prediction are intuitively identified.

[0033] Because the target algorithm model has a hierarchical structure, the same image region may exhibit different importance features in network layers of different depths. For example, the feature importance of shallow networks may focus more on local edges and textures, while the feature importance of deep networks is related to high-level semantic concepts. Therefore, it is necessary to perform cross-layer weighted aggregation of the feature importance scores from different network layers calculated above, according to preset inter-layer weight coefficients. These inter-layer weight coefficients are usually allocated according to network depth, with deeper networks often having higher weights because their features are closer to the final classification decision. The weighted aggregation operation used in this application linearly superimposes the adjusted importance score maps corresponding to each layer according to their weights, ultimately generating a single comprehensive importance score for each pixel region. By fusing information from all layers of the model, the bias caused by relying solely on the gradient of a single layer (such as the last layer) is avoided, resulting in a comprehensive image importance heatmap that fully reflects everything from low-level features to high-level semantics (this heatmap marks the comprehensive importance score of each pixel region in the input image). For example, in an image containing a car, shallow importance might highlight the outline of the wheels, deep importance might highlight the shape of the whole car, and the weighted aggregated comprehensive importance score can cover these key areas at the same time.

[0034] However, the directly aggregated comprehensive importance score (in the form of a heatmap) suffers from noise and spatial discontinuities, meaning that the importance scores of adjacent pixels may differ significantly, which does not conform to the prior knowledge of the continuity of object structure in natural images. Therefore, it is necessary to smooth the comprehensive importance score based on the spatial location of pixel regions in the standard input image. The spatial smoothing operation used in this embodiment is implemented through spatial filtering techniques, such as applying a Gaussian convolution kernel with adjustable standard deviation to convolve the comprehensive importance score map. The weights of the Gaussian convolution kernel decay from the center outwards, making the final score of each pixel a weighted average of its own score and the scores of surrounding pixels, thereby eliminating isolated noise points and making the boundaries of important regions (such as object contours) smoother and more continuous. After smoothing, the output data is the final feature importance distribution data. This data is a two-dimensional matrix with the same spatial dimensions as the standard input image. The value at each position in the matrix represents the overall importance of the corresponding pixel region to the target algorithm model in making a specific decision. The higher the value, the more sensitive the region is and the more worthy it is of adversarial perturbation.

[0035] Step S2: Based on the feature importance distribution data and the architecture type of the target algorithm model, perform configuration data initialization processing to generate perturbation generation configuration data.

[0036] It should be understood that the architecture type of the target algorithm model, as a trained deep learning model, is defined by its constituent units, connection methods, and computation modes. To select the corresponding strategy and set relevant parameters from a pre-defined database based on the specific architectural characteristics and image content sensitivity of the target algorithm model, it is first necessary to perform structural feature analysis on the architecture type of the target algorithm model. This application's embodiments automatically identify these key characteristics of the model in a programmatic manner. For example, checking whether the model contains residual connection modules to determine if it is a ResNet family architecture, detecting the presence of self-attention layers and multi-head attention mechanisms to identify a visual Transformer architecture, or analyzing the network depth-to-width ratio and specific operator types to confirm whether it is a lightweight network such as MobileFaceNet. Transforming the model from a black-box entity into a series of categorizable and comparable structured descriptors is a prerequisite for targeted attack strategy selection. For example, when facing a Transformer-based visual model, its decisions highly depend on the global relationships between image patches, rather than the local receptive fields of convolutional networks, thus requiring different attack focuses. After clarifying the architecture type, a pre-defined strategy mapping mechanism is queried to determine the corresponding basic perturbation generation strategy. The policy mapping mechanism is a predefined key-value pair database or rule set, where the keys are structural feature descriptors of the model architecture, and the values ​​are recommended basic perturbation generation algorithms. For example, the policy mapping mechanism specifies: if the model architecture features are parsed as "standard convolutional neural network," it maps to "Fast Gradient Sign Method (FGSM)"; if the features contain "residual blocks and batch normalization," it maps to "Projected Gradient Descent Method (PGD)"; if the features contain "self-attention layers and layer normalization," it maps to "perturbation generation method based on self-attention gradient analysis"; and if the features conform to "minimalist depthwise separable convolutional structure optimized for facial feature points," it maps to "locally sensitive region perturbation method." This links abstract architecture types with specific, proven attack algorithms effective for those architectures, thus avoiding the use of general but inefficient attack methods and directly enabling targeted perturbation generation logic. For example, PGD is used instead of FGSM for the ResNet model because its deep residual structure may not be sensitive to large single-step perturbations, requiring multi-step, small-step iterative attacks to effectively traverse its complex decision boundaries.

[0037] After determining the basic perturbation generation strategy, the adjustable parameters in this strategy need to be initialized based on the previously generated feature importance distribution data to obtain the core parameter set. The feature importance distribution data obtained through the above operations quantifies the influence of each region of the image on the model's decision, and this data directly guides how attack resources should be allocated during parameter initialization. The core parameter set typically includes perturbation amplitude, iteration step size, learning rate, attention weight threshold, and local region mask range. This application embodiment dynamically calculates based on the statistical characteristics of the feature importance distribution data. For example, the initial value of the perturbation amplitude parameter can be proportional to the average or median of the feature importance scores, making the initial perturbation more probing for images with high overall importance; for the visual Transformer, the initialization of its attention weight threshold can be set based on the dispersion of highlighted areas in the heatmap of the feature importance distribution data; for local attack strategies, its mask range can be directly extracted from the heatmap of the feature importance distribution data by binarizing it using an importance score threshold. By injecting the semantic information of the heatmap content of the feature importance distribution data into the attack parameters, the corresponding strategy can be determined based on the features of the model structure, and the relevant core parameter set can be set so that the initial attack direction and intensity match the specific content of the current image to be tested, thereby improving the efficiency of the initial attack.

[0038] Subsequently, based on the architecture type, the determined basic perturbation generation strategy is associated and integrated with the initialized core parameter set to generate the final perturbation generation configuration data. The integration operation in this embodiment creates a structured data object, which at least includes a strategy identifier, a list of parameter key-value pairs, and a source architecture type label. For example, configuration data for a VGG16 network might be encapsulated as {"strategy": "FGSM", "params": {"epsilon":0.03, …}, "arch_type": "CNN"}. The obtained configuration data, as a complete attack targeting data, will be directly read and executed by the subsequent perturbation generation module, providing a unified, explicit instruction set containing all necessary information for the entire adversarial example generation task, ensuring a coherent process and consistent parameters from analysis to attack.

[0039] However, the pre-defined policy mapping mechanism may not cover all possible model architectures, especially when dealing with novel, hybrid, or highly customized algorithm models, where a clear corresponding basic perturbation generation policy may not be obtained. Therefore, this application adopts the following alternative processing flow: First, the structural feature vector of the target algorithm model is extracted. This structural feature vector is a low-dimensional vector that numerically represents the model's structural analysis results. Its dimensions can include metrics that summarize the complexity and characteristics of the target algorithm model, such as the total number of network layers, the number of convolutional layers, the number of fully connected layers, the number of attention heads, the total number of parameters, and the estimated number of floating-point operations. The model is placed in a measurable feature space for comparison with known typical architectures. Next, the feature similarity between the obtained structural feature vector and the feature vectors of various typical architectures pre-stored in the policy mapping mechanism is calculated. The feature vectors of typical architectures are associated with known effective basic perturbation generation policies. The feature similarity calculation in this embodiment uses the reciprocal method of cosine similarity (in an optional implementation, the reciprocal method of Euclidean distance can also be used) to quantify the structural closeness between the target model and each known typical model. For example, a novel model's feature vector may have some similarity to standard ResNet and ViT vectors, but not a perfect match. When a precise match cannot be achieved through feature similarity calculation, the "nearest neighbor" known architecture is searched to obtain a reference for policy selection.

[0040] Based on the calculated feature similarity, the basic proportion of each basic perturbation generation strategy in the policy mapping mechanism is further calculated to obtain the fusion weight corresponding to each strategy. In this embodiment, the calculation of the fusion weight is designed to normalize the feature similarity so that the sum of all fusion weights is one, and the fusion weight is proportional to the similarity. For example, if the feature similarity between the target model and typical architecture A is 0.7 and the feature similarity between the target model and typical architecture B is 0.3, then the fusion weight of the strategy corresponding to architecture A may be 0.7, and the fusion weight of the strategy corresponding to architecture B may be 0.3. Structural similarity is quantified as policy contribution. In the absence of direct mapping, a weighted average policy selection scheme based on model structural affinity is constructed. Subsequently, according to the calculated fusion weight, multiple basic perturbation generation strategies are weighted and fused to construct a novel composite perturbation generation strategy. The fusion operation used in this embodiment defines a hybrid behavior at the algorithm logic level. For example, at each step of perturbation generation, the gradient directions calculated by different strategies can be combined according to weights; or, in iterative attacks, different strategies or their parameter update rules are used alternately. By creating a resilient attack mechanism that can absorb the strengths of multiple strategies and adapt to unknown or hybrid architectures, the generalization ability and robustness of the method can be improved.

[0041] For the constructed composite perturbation generation strategy, the adjustable parameters also need to be initialized based on the feature importance distribution data to obtain the core parameter set suitable for the composite strategy. The assignment process is the same as the amplitude operation after determining the basic perturbation generation strategy, and will not be elaborated further here. Finally, the newly constructed composite perturbation generation strategy, the calculated fusion weights, and the initialized core parameter set are correlated and integrated to generate perturbation generation configuration data suitable for the current unknown architecture. This configuration data includes strategy and parameter information, and also records the source of the fusion weights, providing a traceability basis for subsequent analysis and interpretation of the attack results.

[0042] By employing an intelligent approach based on structural similarity measurement and strategy fusion, the aforementioned backup operations can readily address unknown or emerging algorithm models, thereby greatly expanding the application scope and practical value of this application.

[0043] Step S3: Generate directional perturbation for the image under test by matching the architecture type according to the perturbation generation configuration data to obtain initial adversarial perturbation data, and perform multi-target optimization adjustment on the initial adversarial perturbation data to generate optimized adversarial perturbation data.

[0044] First, targeted perturbation generation based on architecture type matching is performed to obtain initial adversarial perturbation data. In this embodiment, gradient calculation is performed on the test image based on the basic perturbation generation strategy in the configuration data. The gradient calculation operation in this embodiment is defined by the selected basic perturbation generation strategy. For example, if the basic strategy is the Fast Gradient Sign Method (FGSM), the gradient of the target class prediction probability relative to each pixel of the standard input image is calculated; if it is the Projective Gradient Descent Method (PGD), a similar calculation may be performed in the first iteration; if it is a strategy based on self-attention gradient analysis, the calculation may involve a combination of attention weights and class gradients. By obtaining perturbation generation-guided gradient change data, the strength and sign of the influence of small increases or decreases in the pixel value of each pixel in the test image on the direction driving the target algorithm model toward the attack target (misclassification) are quantified, thereby indicating the theoretically most effective perturbation application direction.

[0045] Based on the gradient change data obtained from the above calculations, and combined with the perturbation amplitude parameter specified in the core parameter set, the perturbation values ​​of each pixel region are transformed to obtain the corresponding initial perturbation values. The perturbation amplitude parameter defines the maximum intensity of the perturbation allowed. The transformation operation used in this application follows specific strategy rules. For FGSM, the transformation multiplies the gradient sign by a fixed perturbation amplitude parameter; for the initial PGD step, the product of the gradient direction and the step size parameter may be used. This operation transforms the relatively abstract gradient vector into concrete, dimensional pixel value modification suggestions. It maps the sensitivity of the model's decisions to numerical changes that can be directly added to the original image, generating an initial, untuned perturbation field. For example, in an attack designed to misclassify a "truck" as an "airplane," the gradient change data indicates which pixel brightening or darkening contributes to increasing the probability of the "airplane" category, while the perturbation amplitude parameter controls the initial intensity of these changes; too small a value may be ineffective, while too large a value may prematurely cause visual anomalies.

[0046] However, the initial perturbation values ​​obtained above are uniformly applied and do not consider the differences in perturbation sensitivity among different regions of the image content itself. Therefore, it is necessary to perform spatial weighted fusion on the initial perturbation values ​​based on the previously obtained feature importance distribution data. Feature importance distribution data, existing in the form of heatmaps, identifies the importance of different regions in the image to the model's original decision. By multiplying the initial perturbation values ​​element-wise with this distribution data, spatial weighted fusion can be achieved. Weighting allows the perturbation intensity allocated to regions with high feature importance (such as key contours of objects and semantic core parts) to be preserved or even enhanced, while perturbations in regions with low importance (such as uniform backgrounds) are significantly suppressed, thereby obtaining the original perturbation data corresponding to the image under test. Introducing content awareness into the perturbation generation process enables precise perturbation delivery, ensuring that the limited perturbation budget is concentrated on attacking the visual features most relied upon by the model, thereby pursuing higher attack potential with the same perturbation amplitude, or reducing overall visual modification to achieve the same attack effect. For example, for a face image, weighted fusion ensures that the perturbation is mainly concentrated in key feature areas such as the eyes, nose, and mouth, rather than being evenly distributed across the entire face.

[0047] It should be understood that the original perturbation data obtained from the above operations may still contain extreme values ​​beyond the range imperceptible to human vision, or violate the valid range of image data formats. Therefore, the obtained original perturbation data is subjected to amplitude limiting processing. In this embodiment, a preset perturbation amplitude constraint threshold is used to perform element-by-element pruning on the original perturbation data—limiting the perturbation value of each pixel channel to between a negative and a positive threshold. The perturbation amplitude constraint threshold is part of the core parameter set, and its value ensures that the perturbation added in a single instance is small at the pixel level. By forcibly introducing a priori constraints on perturbation concealment, it is ensured that the generated initial adversarial perturbation theoretically possesses a certain degree of visual imperceptibility, thereby providing a starting point that meets basic concealment requirements and avoiding meaningless searches in an invalid or visually unacceptable perturbation space during the optimization process.

[0048] To further iteratively optimize the obtained initial adversarial perturbation data, this application employs the following multi-objective optimization adjustment stage for the obtained initial adversarial perturbation data: First, the initial adversarial perturbation data is optimized using a gradient descent-based approach through a pre-defined multi-objective optimization strategy. This multi-objective optimization strategy defines a loss function containing at least two terms: one encourages successful attacks (e.g., maximizing the target class probability or minimizing the original class probability), and the other penalizes visual distortion (e.g., measuring the L2 norm of the perturbation value or its difference from the original image). Starting with the initial adversarial perturbation data, the gradient of this composite loss function with respect to the current perturbation data is calculated, and the perturbation values ​​for each pixel region are updated along the gradient descent direction to obtain new current perturbation values. The perturbation generation problem is formalized as a constrained optimization problem, and gradient information is used for systematic improvement, enabling the perturbation to find a better balance between the two competing objectives of attack effectiveness and visual concealment.

[0049] Subsequently, using a pre-defined set of constraints and a learning rate, the updated perturbation value is projected onto a pre-defined constraint space. The constraint set defines the conditions that must be satisfied to counteract the perturbation. The core constraints include: a feasible region constraint (meaning the original image, after perturbation, remains within the valid pixel value range), ensuring that each pixel value remains within the valid range (e.g., between 0 and 1) after perturbation; and a perturbation amplitude constraint (meaning the perturbation itself cannot exceed a certain absolute value upper limit). The projection operation used in this application "pulls" perturbation values ​​that may temporarily exceed the constraint range back to the allowable range after optimization. For example, if the update causes a pixel perturbation value to exceed the amplitude threshold, it is set as the threshold. Simultaneously, the learning rate controls the step size of each gradient descent update. The goal of the projection operation in this application is to ensure that the intermediate results generated in each iteration are physically realizable and legitimate perturbations that meet the basic requirements of concealment, guaranteeing that the optimization path always occurs within the feasible solution space.

[0050] Meanwhile, this application employs a preset counting rule to accumulate and update the iteration count, and dynamically updates the learning rate based on the iteration count. Specifically, the counting rule used in this application increments the iteration count by one for each complete gradient update and projection. The learning rate is updated using a preset exponential decay formula, which can be expressed as: New learning rate = Initial learning rate × (decay coefficient) 当前的迭代次数 The update operation in this application simulates the common annealing strategy in optimization algorithms: using a larger learning rate in the early stages of optimization helps to quickly approach the potential optimal region; reducing the learning rate in the later stages of optimization helps to fine-tune, stabilize convergence, and avoid oscillations near the optimal solution. The exploration and utilization of dynamically updating the learning rate to balance the optimization process accelerates convergence and may yield better perturbation schemes.

[0051] In each iteration, the performance of the current adversarial data (i.e., the updated initial adversarial perturbation data) needs to be re-evaluated using the loss function component in the multi-objective optimization strategy, based on the current initial adversarial perturbation data (i.e., the latest updated perturbation). Specifically, two key evaluation metrics are calculated: the current attack success rate and the current visual distortion loss rate. The current attack success rate is a Boolean value or probability value, obtained by overlaying the current perturbation onto the original image and inputting it into the target algorithm model to check whether the predicted category has changed to the target category (targeted attack) or a non-original category (non-targeted attack). In this embodiment, the current visual distortion loss rate is directly taken from the calculated value of the term corresponding to visual distortion in the multi-objective loss function, i.e., the ratio of the L2 norm of the measured perturbation data matrix (i.e., the square root of the sum of squares of all elements) to the total number of pixels in the original image or the maximum possible pixel change. These two metrics, obtained through the above calculations, monitor the state of the optimization process in real time, providing a basis for decision-making regarding iteration termination.

[0052] The aforementioned process from gradient descent solution to metric calculation is encapsulated into an iterative loop and executed repeatedly. In this application, the termination condition of this loop is formed by two parts connected by a logical "OR": first, the current attack success rate reaches a preset success threshold (e.g., a success rate of 1, indicating a successful attack) and the current visual distortion loss rate is less than a preset distortion threshold (i.e., the visual modification is sufficiently small); second, the number of iterations reaches a preset maximum number threshold. When either condition is met, the loop terminates, and the initial adversarial perturbation data that satisfies all constraints is output as the final optimized adversarial perturbation data.

[0053] The aforementioned iterative optimization starts with a coarse initial perturbation that meets basic constraints. Through automated and guided repeated fine-tuning, it ultimately obtains a perturbation scheme that achieves the best trade-off between attack success and visual stealth. For example, it might start with a perturbation that could cause the model to misclassify but whose modification is somewhat obvious. Through dozens of iterations, it gradually "prunes" those perturbation parts that do not contribute much to maintaining the effectiveness of the attack but increase visual distortion. Finally, it obtains an optimized adversarial perturbation data that is almost imperceptible but still offensive, thus completing the core construction task of adversarial example generation with high quality.

[0054] Step S4: Perform pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested to generate an adversarial sample set.

[0055] After successfully obtaining the optimized adversarial perturbation data, in order to transform the theoretical perturbation scheme into practically usable adversarial examples and to rigorously test their quality and effectiveness, a structured set of adversarial examples is ultimately formed. First, the optimized adversarial perturbation data and the image to be tested are added pixel-by-pixel. The image to be tested serves as the benchmark for the operation and the main carrier of the perturbation, providing definite spatial coordinates and color references for pixel-level synthesis. It should be understood that the optimized adversarial perturbation data and the image to be tested are matrices of identical dimensions, where each element represents the suggested modification amount at the corresponding pixel. In this embodiment, the values ​​at corresponding positions in the two matrices of the same dimension are algebraically added. The finely adjusted perturbation values ​​obtained through multiple rounds of optimization are formally and completely applied to the original image, thereby mathematically generating a modified new image data matrix (i.e., the initial synthesized image). For example, for an original image containing a cat, the optimized perturbation data may contain a series of values ​​that cause extremely subtle changes to the cat's whisker texture and ear outline; adding them together yields an initial synthesized image that appears unchanged to the human eye but may be perceived by the target algorithm model as resembling a "dog."

[0056] However, the pixel values ​​of the initial composite image obtained by direct addition may exceed the valid range allowed by the image data format. For a standard 8-bit RGB image, the valid pixel value range is an integer from 0 to 255; for a floating-point representation normalized to the [0,1] interval, the valid range is 0 to 1. Therefore, the initial composite image must be subjected to pixel value constraint processing according to a preset pixel value constraint threshold. This embodiment employs a channel-by-channel cropping operation to forcibly limit all pixel values ​​to between a preset minimum and maximum value. For example, if the pixel value constraint threshold is set to [0, 255], then all pixel values ​​less than 0 are set to 0, and all pixel values ​​greater than 255 are set to 255. The pixel value constraint operation ensures that the generated image data is technically legal and can be correctly processed and rendered by a standard image codec or display device, preventing information loss or display abnormalities due to numerical overflow.

[0057] Furthermore, the candidate adversarial samples obtained through the above operations need to be validated against adversarial attacks. This application inputs the candidate adversarial samples into the target algorithm model to obtain its predicted category. The target algorithm model is the image recognition model to be tested. The candidate samples are input into the model, and a complete forward propagation calculation is performed. The model outputs a probability distribution for all possible categories, where the category with the highest probability is the model's predicted category. Simultaneously, a preset attack target category is accessed. This category is a specific category specified by the attacker in a targeted attack, and any category other than the original correct category in a non-targeted attack. Next, the similarity value between this preset attack target category and the model's predicted category needs to be calculated. In classification tasks, a common definition of "similarity" is whether the two are identical. Therefore, the calculation can be simplified to an indicator function: if the predicted category equals the attack target category, the similarity value is 1 (or 100%), otherwise it is 0. In more complex evaluations, the model's predicted probability for the target category may also be used as a continuous similarity value. Quantifying the immediate effect of the candidate adversarial samples in misleading the target algorithm model through similarity value calculation provides an objective and measurable score for its attack effectiveness. For example, in an attack designed to misidentify a "stop sign" as a "speed limit sign", if the model's prediction of a candidate sample is indeed a "speed limit sign", the similarity value is 1, indicating that the attack has succeeded at the category label level.

[0058] When the calculated similarity value reaches a preset similarity threshold (i.e., in binary judgment, a similarity value of 1 usually signifies a successful attack), the candidate adversarial sample is eligible to enter the next round of quality assessment. The similarity threshold provides the minimum judgment threshold for the effectiveness of adversarial attacks, ensuring that subsequent resources are only invested in truly successful attack samples, filtering out failed attempts that, even after optimization, fail to change the model's decision. For candidate samples that pass this threshold, a rigorous visual quality assessment is performed on them based on the original image to obtain one or more visual quality assessment metrics. The visual quality assessment quantifies the perceptible differences between the adversarial sample and the original image, ensuring the perturbation has sufficient stealth. The assessment metrics used in this application include peak signal-to-noise ratio (PSNR) and structural similarity index. PSNR is calculated based on mean squared error; a higher value indicates less image distortion. The structural similarity index compares the similarity between two images from three perspectives: brightness, contrast, and structure; a value closer to 1 indicates higher visual consistency. Visual quality assessment quantitatively scores the stealth of adversarial examples from a human perception perspective, ensuring that a successful attack does not come at the expense of the image's natural appearance. This is crucial for evaluating the potential effectiveness of adversarial examples in real-world deception scenarios. For example, an adversarial example that breaks a face recognition model, if its PSNR value is extremely low or its SSIM value is much less than 1, means that the human eye can easily detect the modification, thus significantly reducing the likelihood of its application in real-world access control systems.

[0059] Finally, when the visual quality evaluation metrics of the candidate adversarial sample also reach the preset threshold (e.g., SSIM greater than 0.98 and PSNR greater than 35dB), it indicates that the sample not only succeeds in attacking at the algorithm level but also has good concealment at the visual level, meeting the dual requirements of a high-quality adversarial sample. Furthermore, the candidate adversarial sample itself, the calculated similarity value (or its derived attack success indicator), and the visual quality evaluation metrics are stored together. This application packages these data into a structured record, such as a data object or database entry containing fields such as image data, attack target category, prediction category, attack success rate, SSIM score, and PSNR value. Collecting all such qualified records generates the final adversarial sample set. The generated adversarial sample set not only contains adversarial images that can be directly used for security testing but also includes detailed metadata, providing a solid data foundation for analyzing the vulnerability patterns of models under different attacks, comparing the effectiveness of different attack methods, and developing corresponding defense measures.

[0060] On the other hand, please see Figure 2 , Figure 2 This is a schematic diagram of an embodiment of an electronic device provided in this application.

[0061] like Figure 2 As shown, the electronic device 2 in this embodiment includes: at least one processor 21 ( Figure 2 Only one is shown in the diagram), memory 22, and computer program 23 stored in the memory 22 and executable on the at least one processor 21. When the processor 21 executes the computer program 23, it implements the steps in the embodiment of the adversarial sample generation method of the image-type intelligent algorithm of this application.

[0062] Figure 2 The illustrated electronic device 2 may include, but is not limited to, a processor 21 and a memory 22. Those skilled in the art will understand that... Figure 2 The example shown is merely an illustration of electronic device 2 and does not constitute a limitation on electronic devices. It may have more or fewer components than shown, or combine certain components, or have different components. For example, it may also include input / output devices, network access devices, etc.

[0063] The processor 21 may be a central processing unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), or field-programmable gate arrays (FPGAs). Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0064] In some embodiments, the memory 22 may be an internal storage unit of the electronic device, such as a hard drive or memory. In other embodiments, the memory 22 may be an external storage device of the electronic device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, the memory 22 may include both internal and external storage units of the electronic device. The memory 22 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 22 can also be used to temporarily store data that has been output or will be output.

[0065] Furthermore, in one embodiment, as Figure 3As shown, this application also provides an adversarial example generation device for image-based intelligent algorithms, comprising: The correlation quantization module 1100 is used to perform feature sensitivity analysis on the image under test and the target algorithm model to obtain feature importance distribution data; The configuration setting module 1200 is used to perform configuration data initialization processing based on the feature importance distribution data and the architecture type of the target algorithm model, and generate perturbation generation configuration data. The directional matching module 1300 is used to generate directional perturbations for the image under test by matching the architecture type according to the perturbation generation configuration data, so as to obtain initial adversarial perturbation data. The disturbance optimization module 1400 is used to perform multi-objective optimization and adjustment on the initial counter-disturbance data to generate optimized counter-disturbance data; The synthesis and verification module 1500 is used to perform pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested, and generate an adversarial sample set.

[0066] It should be noted that the adversarial example generation device for the image-based intelligent algorithm can be understood as a virtual device that can be installed in the electronic device in the aforementioned embodiments. The electronic device calls the adversarial example generation device for the image-based intelligent algorithm through its processor, thereby running the specific implementation scheme in the above embodiments of the adversarial example generation method for the image-based intelligent algorithm. The information interaction and execution process between the above devices / units are based on the same concept as the method embodiments of this application; their specific functions and technical effects can be found in the method embodiments section.

[0067] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0068] This application also provides a storage medium, which is a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps in the above-described method embodiments.

[0069] This application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0070] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0071] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0072] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for generating adversarial examples in an image-based intelligent algorithm, characterized in that, The method includes: Feature sensitivity analysis is performed on the image under test and the target algorithm model to obtain feature importance distribution data; Based on the feature importance distribution data and the architecture type of the target algorithm model, configuration data initialization processing is performed to generate perturbation-generated configuration data; Based on the perturbation generation configuration data, the image under test is subjected to architecture type matching directional perturbation generation to obtain initial adversarial perturbation data, and the initial adversarial perturbation data is optimized and adjusted in multiple objectives to generate optimized adversarial perturbation data. The optimized adversarial perturbation data and the image under test are combined with pixel-level constraints for synthesis and adversarial effectiveness verification to generate an adversarial sample set.

2. The method according to claim 1, characterized in that, The feature sensitivity analysis performed on the image to be tested and the target algorithm model to obtain feature importance distribution data includes: The image to be tested is preprocessed to generate a standard input image, and the target algorithm model is forward propagated based on the standard input image to obtain the feature representation data of each network layer in the target algorithm model. Based on the preset target category set and the feature representation data, gradient backpropagation calculation is performed on the target algorithm model to obtain the gradient data of the standard input image; Based on the preset scoring coefficients and the gradient data, the feature importance score of each pixel region in the standard input image is calculated. The feature importance scores are weighted and aggregated across layers based on preset inter-layer weighting coefficients to generate a comprehensive importance score for each pixel region. Based on the spatial location of pixel regions in the standard input image, the comprehensive importance score is smoothed to obtain feature importance distribution data.

3. The method according to claim 1, characterized in that, The step of initializing configuration data based on the feature importance distribution data and the architecture type of the target algorithm model to generate perturbation-generated configuration data includes: The structural features of the target algorithm model are analyzed, and the basic perturbation generation strategy corresponding to the architecture type is determined through a preset strategy mapping mechanism. Based on the feature importance distribution data, the adjustable parameters in the basic perturbation generation strategy are initialized and assigned values ​​to obtain the core parameter set; Based on the architecture type, the basic disturbance generation strategy and the core parameter set are associated and integrated to generate disturbance generation configuration data.

4. The method according to claim 3, characterized in that, The perturbation generation configuration data includes a basic perturbation generation strategy and a core parameter set. The step of generating directional perturbations based on the architecture type matching of the image under test according to the perturbation generation configuration data to obtain initial adversarial perturbation data includes: Using the basic perturbation generation strategy, gradient calculation is performed on the image under test based on the core parameter set to obtain perturbation generation-guided gradient change data. Based on the gradient change data and the perturbation amplitude parameters in the core parameter set, the perturbation values ​​of each region are transformed to obtain the initial perturbation values ​​corresponding to each pixel region. The initial perturbation value is spatially weighted and fused based on the feature importance distribution data to generate the original perturbation data of the image to be tested; Based on a preset disturbance amplitude constraint threshold, the original disturbance data is subjected to amplitude limiting processing to generate initial counter-disturbance data.

5. The method according to claim 1, characterized in that, The step of performing multi-objective optimization and adjustment on the initial adversarial perturbation data to generate optimized adversarial perturbation data includes: Step S31: Use a preset multi-objective optimization strategy to perform gradient descent optimization on the initial adversarial perturbation data to obtain the current perturbation value of each pixel region; Step S32: Based on the preset constraint set and the preset learning rate, project the current perturbation value into the preset constraint space to update the initial adversarial perturbation data; Step S33: Accumulate and update the number of iterations according to the preset counting rules, and perform exponential decay calculation on the number of iterations to update the learning rate; Step S34: Calculate the current attack success rate and the current visual distortion loss rate based on the initial adversarial perturbation data using the multi-objective optimization strategy. Repeat steps S31 to S34 until the current attack success rate reaches a preset success threshold and the current visual distortion loss rate is less than a preset distortion threshold, or the number of iterations reaches a preset number threshold, at which point the initial adversarial perturbation data is used as optimized adversarial perturbation data.

6. The method according to claim 1, characterized in that, The step of performing pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested to generate an adversarial sample set includes: The optimized anti-perturbation data and the image under test are added pixel by pixel to synthesize an initial synthesized image; The initial synthesized image is subjected to pixel value constraint processing according to a preset pixel value constraint threshold to generate candidate adversarial samples; The candidate adversarial sample is input into the target algorithm model to obtain the predicted category, and the similarity value between the preset attack target category and the predicted category is calculated; When the similarity value reaches a preset similarity threshold, the visual quality of the candidate adversarial sample is evaluated based on the image to be tested to obtain a visual quality evaluation index. When the visual quality assessment index reaches the preset index threshold, the candidate adversarial sample, the similarity value, and the visual quality assessment index are associated and stored to generate an adversarial sample set.

7. The method according to claim 3, characterized in that, When the basic perturbation generation strategy corresponding to the architecture type of the target algorithm model cannot be obtained, the method further includes: Extract the structural feature vector of the target algorithm model, and calculate the feature similarity between the typical architecture feature vectors in the policy mapping mechanism and the structural feature vector; The basic proportion of each basic perturbation generation strategy in the strategy mapping mechanism is calculated based on the feature similarity, and the fusion weight corresponding to each basic perturbation generation strategy is obtained. The basic perturbation generation strategy is weighted and fused according to the fusion weight to construct a composite perturbation generation strategy; Based on the feature importance distribution data, the adjustable parameters in the composite perturbation generation strategy are initialized and assigned values ​​to obtain the core parameter set; Based on the architecture type, the composite perturbation generation strategy, the fusion weight, and the core parameter set are associated and integrated to generate perturbation generation configuration data.

8. An adversarial example generation device for an image-based intelligent algorithm, applied to the adversarial example generation method for the image-based intelligent algorithm as described in claim 1, characterized in that, The device includes: The correlation quantization module is used to perform feature sensitivity analysis on the image under test and the target algorithm model to obtain feature importance distribution data; The configuration setting module is used to perform configuration data initialization processing based on the feature importance distribution data and the architecture type of the target algorithm model, and generate perturbation generation configuration data. The directional matching module is used to generate directional perturbations for the image under test based on the perturbation generation configuration data to match the architecture type, thereby obtaining initial adversarial perturbation data. The perturbation optimization module is used to perform multi-objective optimization and adjustment on the initial counter-perturbation data to generate optimized counter-perturbation data; The synthesis and verification module is used to perform pixel-level constraint synthesis and adversarial effectiveness verification on the optimized adversarial perturbation data and the image to be tested, and generate an adversarial sample set.

9. An electronic device, characterized in that, The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the adversarial sample generation method of the image-based intelligent algorithm according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the adversarial sample generation method of the image-based intelligent algorithm according to any one of claims 1 to 7.

Images