A black-box adversarial evaluation method based on policy driving and space residual remolding

Abstract

The application provides a black box confrontation evaluation method based on strategy driving and frequency-space residual remodeling, belongs to the technical field of confrontation attack, selects neural networks with multiple different network architectures to construct a heterogeneous agent model matrix, obtains a source detection tensor and a calibrated true value and extracts a benchmark response gradient; the current evolution state tensor, the benchmark response gradient, the frequency domain amplitude spectrum feature and the iteration progress scalar are spliced to form a multi-dimensional joint state vector; a frequency domain attenuation barrier and a space domain remodeling tensor are generated through a strategy decision network, the frequency domain filtering denoising and the space domain nonlinear residual remodeling are sequentially performed on the benchmark response gradient, and the evolution state tensor is updated in the residual fusion remodeling direction. After the multi-round iteration and the composite feedback signal optimization strategy network parameter, the tensor with the optimal comprehensive threat effectiveness is selected as the confrontation evaluation carrier output. The application can effectively strip high-frequency overfitting noise, solve the cross-model response offset problem, and improve the cross-model migration and evaluation stability of the black box confrontation evaluation carrier.

Description

Technical Field

[0001] This invention relates to the field of adversarial attack technology, and in particular to a black-box adversarial evaluation method based on strategy-driven and frequency-space residual reshaping. Background Technology

[0002] The vulnerability of deep neural networks makes them susceptible to security threats from adversarial examples. In black-box attack scenarios, attackers cannot obtain information about the internal workings of the target model, and their effectiveness highly depends on the cross-model transferability of the adversarial example, i.e., whether the adversarial example generated on one or more alternative models can successfully deceive another target model with an unknown structure.

[0003] Ensemble attacks are a mainstream technique for improving transferability, and their core lies in aggregating gradients from multiple alternative models to uncover shared vulnerabilities. Existing methods mostly employ static ensembles (such as average gradients) or dynamically weighted ensembles (such as AdaEA and SVRE). However, existing gradient fusion methods are essentially limited to linear operations in the spatial domain, exhibiting two major drawbacks: First, the locality of spatial domain optimization makes it impossible to remove high-frequency overfitting noise generated by specific alternative models. The transferability of adversarial examples highly depends on the low-frequency semantic components of the image, and existing techniques lack the ability to reshape the gradient distribution in the frequency domain, causing the generated perturbations to easily fail across models. Second, gradients from different alternative models often conflict in direction at specific spatial locations; simple linear weighting can lead to gradient cancellation, resulting in the loss of crucial attack features.

[0004] In summary, existing technologies urgently need a new adversarial attack method that can break through the spatial domain linear fusion framework, proactively solve cross-model gradient cancellation, and possess frequency-space joint modulation capabilities, in order to systematically improve the success rate of black-box attacks. Summary of the Invention

[0005] In view of this, the present invention provides a black-box adversarial evaluation method based on strategy-driven and frequency-space residual reshaping, in order to improve the cross-model transferability and evaluation stability of black-box adversarial evaluation.

[0006] The technical solution adopted in this invention is: This invention provides a black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping, comprising: S10. Select neural network models with different network architectures to construct a heterogeneous proxy model matrix, and obtain the source probe tensor to be evaluated and the corresponding calibration ground truth; in a single evolution step, input the current evolution state tensor into the heterogeneous proxy model matrix and extract the baseline response gradient at the current time. S20. Perform frequency domain transformation on the reference response gradient to extract frequency domain amplitude spectrum features, and concatenate the current evolution state tensor, reference response gradient, frequency domain amplitude spectrum features, and the current iteration progress scalar to form a multidimensional joint state vector; S30. Input the multidimensional joint state vector into the pre-trained policy decision network to generate frequency domain attenuation barrier and spatial domain reshaping tensor. Based on the frequency domain attenuation barrier and spatial domain reshaping tensor, perform frequency domain filtering and noise reduction and spatial domain nonlinear residual reshaping on the baseline response gradient in sequence to obtain the residual fusion reshaping direction and drive the evolution state tensor to perform manifold evolution. S40. Repeat S10 to S30 for multiple rounds of iterative evolution, and calculate the composite feedback signal after each round of evolution. Use the composite feedback signal to optimize the policy decision network parameters and fix the policy decision network weights. Perform T-step autonomous iterative evolution based on the source probe tensor. Select the tensor with the best comprehensive threat effectiveness from all intermediate evolution state tensors generated by autonomous iterative evolution as the output of the high-mobility adversarial assessment carrier.

[0007] Further, in step S10, the current evolutionary state tensor is input into the heterogeneous surrogate model matrix, and the baseline response gradient at the current moment is extracted, including: The current evolutionary state tensor is imported into the heterogeneous surrogate model matrix. The decision deviation gradient between the current evolutionary state tensor and the calibration truth is calculated using the decision deviation measurement function on each node network in the heterogeneous surrogate model matrix. The decision deviation gradient is weighted according to the weighting coefficients corresponding to each node network. Finally, all weighted decision deviation gradients are summed to obtain the baseline response gradient.

[0008] Furthermore, step S20 specifically includes the following sub-steps: S201. Obtain the pixel value of the current evolution state tensor as a spatial pixel representation, and read the original value of the baseline response gradient as a spatial distribution feature. S202. Perform a two-dimensional discrete Fourier transform on the reference response gradient to obtain the Fourier transform result, extract the amplitude spectrum component from the Fourier transform result as the frequency domain amplitude spectrum feature, and transfer the low frequency component to the center of the spectrum. S203. Obtain the iteration progress scalar of the current tensor manifold derivation, and extend the iteration progress scalar to the same dimension as the source probe tensor through the spatial broadcast mechanism; S204. The spatial pixel features, spatial distribution features, frequency domain amplitude spectrum features, and iteration progress scalar are sequentially aligned and concatenated to obtain a multidimensional joint state vector.

[0009] Further, step S30 includes the following sub-steps: S301. Construct a policy decision network and pre-train it to obtain a pre-trained policy decision network. Input the multi-dimensional joint state vector into the pre-trained policy decision network and output an action vector, wherein the action vector includes a frequency domain attenuation barrier and a spatial domain reshaping tensor. S302. Based on the frequency domain attenuation barrier, perform frequency domain filtering and denoising on the reference response gradient to obtain a smooth gradient. Then, perform nonlinear spatial residual reshaping on the smooth gradient and the spatial reshaping tensor to obtain the residual fusion reshaping direction for manifold evolution. S303. Using a momentum-based manifold stepping rule, the evolved state tensor is driven to perform manifold stepping along the residual fusion reshaping direction, and the evolved state tensor is projected onto the infinite norm boundary centered on the source probe tensor.

[0010] Further, in step S302, frequency domain filtering and denoising are performed on the reference response gradient based on the frequency domain attenuation barrier to obtain a smooth gradient, including: The reference response gradient is mapped to the frequency domain using the Discrete Fourier Transform (DFT) to obtain the frequency domain representation. The frequency domain representation is then multiplied by the frequency domain attenuation barrier to obtain the product. Finally, the product is restored to the spatial domain using the Inverse Discrete Fourier Transform (IFT) to obtain the smooth gradient.

[0011] Furthermore, the policy decision network is an encoder-decoder architecture. The decoder has a first branch and a second branch with two parallel outputs at the end. The first branch is used to output a frequency domain attenuation barrier with a value range of 0 to 1, and the second branch is used to output a spatial domain reshaping tensor with a value range of -1 to 1.

[0012] Furthermore, in step S40, a composite feedback signal is calculated after each round of evolution, and the parameters of the policy decision network are optimized using the composite feedback signal, including: Collect the states, actions, and cross-model response consistency metrics in each round of simulation to generate a global state transition sequence, and synthesize a composite driving feedback signal based on the global state transition sequence; Summarize all global state transition sequences generated by evolution and construct a global discounted efficiency function that runs through the evolution path; A near-end policy alignment optimization mechanism is adopted, and a gradient flow update is performed on the weight tensor of the policy decision network in combination with a global discount efficiency function until the policy decision network completes the optimization convergence.

[0013] Furthermore, in S40, the fixed policy decision network weights, the input source probe tensor undergoes T-step autonomous iterative evolution, and from all intermediate evolutionary tensors generated by the autonomous iterative evolution, the tensor with the optimal comprehensive threat effectiveness is selected as the output of the high-mobility adversarial assessment carrier, including: The tensor weights of the policy decision network are fixed. The source probe tensor to be evaluated is imported into the policy decision network and T-step manifold stepping autonomous iterative evolution is performed. The comprehensive threat effectiveness of all intermediate evolution tensors generated by autonomous iterative evolution on the heterogeneous agent model matrix is ​​compared. The intermediate evolution tensor that maximizes the average decision deviation is selected as the high-transferability adversarial evaluation carrier of the final output.

[0014] In summary, the beneficial effects of the present invention are as follows: This invention provides a black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping. The method constructs a heterogeneous proxy model matrix with a multi-network architecture to extract the baseline response gradient and integrates the current evolution state tensor, baseline response gradient, frequency domain amplitude spectrum features, and iteration progress scalar to form a multi-dimensional joint state vector. At the same time, a frequency-space dual-channel residual reshaping mechanism is introduced, which relies on the policy decision network to complete frequency domain filtering and denoising and spatial domain nonlinear residual reshaping. This can effectively remove high-frequency overfitting noise in the gradient and eliminate gradient cancellation problems between heterogeneous models. Then, the parameters of the policy decision network are adaptively optimized through composite feedback signals. The final adversarial evaluation carrier has stronger cross-model transfer capabilities and significantly improves the stability and evaluation efficiency of black-box adversarial evaluation. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, and these are all within the protection scope of the present invention.

[0016] Figure 1 This is a flowchart of a black-box adversarial evaluation method based on strategy-driven and frequency-space residual reshaping according to the present invention. Figure 2 This is a schematic diagram of the black-box adversarial evaluation workflow of the present invention; Figure 3 This is a schematic diagram of the frequency-space joint modulation process of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Unless otherwise specified, the present invention and the various features in the embodiments can be combined with each other, all of which are within the protection scope of the present invention.

[0018] Example 1: Refer to Figure 1 and Figure 2 As shown in the figure, an embodiment of the present invention provides a black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping, comprising: S10. Select neural network models with different network architectures to construct a heterogeneous proxy model matrix, and obtain the source probe tensor to be evaluated and the corresponding calibration ground truth; in a single evolution step, input the current evolution state tensor into the heterogeneous proxy model matrix and extract the baseline response gradient at the current time. S20. Perform frequency domain transformation on the reference response gradient to extract frequency domain amplitude spectrum features, and concatenate the current evolution state tensor, reference response gradient, frequency domain amplitude spectrum features, and the current iteration progress scalar to form a multidimensional joint state vector; S30. Input the multidimensional joint state vector into the pre-trained policy decision network to generate frequency domain attenuation barrier and spatial domain reshaping tensor. Based on the frequency domain attenuation barrier and spatial domain reshaping tensor, perform frequency domain filtering and noise reduction and spatial domain nonlinear residual reshaping on the baseline response gradient in sequence to obtain the residual fusion reshaping direction and drive the evolution state tensor to perform manifold evolution. S40. Repeat S10 to S30 for multiple rounds of iterative evolution, and calculate the composite feedback signal after each round of evolution. Use the composite feedback signal to optimize the policy decision network parameters and fix the policy decision network weights. Perform T-step autonomous iterative evolution based on the source probe tensor. Select the tensor with the best comprehensive threat effectiveness from all intermediate evolution state tensors generated by autonomous iterative evolution as the output of the high-mobility adversarial assessment carrier.

[0019] In this context, neural network models with different architectures refer to multiple node networks that differ in representation extraction paradigms and topologies. The heterogeneous proxy model matrix in this embodiment is a set of models composed of multiple deep neural network models with different architectures, used to replace the real target model in black-box adversarial evaluation scenarios, providing diverse gradient responses. The node network in the heterogeneous proxy model matrix refers to each independent proxy model (i.e., neural network model) within the matrix, and each node network has an independent network architecture.

[0020] Specifically, this embodiment constructs a heterogeneous proxy model matrix by selecting neural network models with various network architectures to build an evaluation environment with complementary features. The construction and configuration process specifically includes: To maximize the cross-model generalization ability of the adversarial evaluation carrier and avoid the evolutionary trajectory from getting stuck in local overfitting of a specific network architecture, this embodiment requires that the selected node networks have significant heterogeneity in the underlying representation extraction paradigm when constructing the heterogeneous proxy model matrix. That is, the mathematical and physical mechanisms on which different node networks extract features must originate from orthogonal or complementary visual perception spaces. In other words, one network depends on the local spatial neighborhood, while the other must depend on the global context.

[0021] Preferably, the heterogeneous proxy model matrix contains at least two types of node networks with orthogonal feature spaces: the first type is a convolutional neural network architecture based on local receptive fields and spatial translation invariance (such as ResNet, DenseNet, or VGG series, etc.), used to extract local texture and high-frequency geometric features of the evolutionary tensor; the second type is a visual transformer architecture based on global self-attention mechanism (Vision Transformer, such as ViT, Swin Transformer series, etc.), used to capture long-distance dependencies and global low-frequency semantic features of the evolutionary tensor.

[0022] Through the above combination of node networks containing orthogonal representation paradigms, the configured heterogeneous agent model matrix can force the policy decision network to find shared vulnerability vulnerabilities that can simultaneously deceive local texture detectors and global semantic detectors in subsequent manifold inferences, laying a physical foundation for completely solving the cross-model response cancellation problem from the system architecture level.

[0023] Furthermore, the corresponding response weights are initialized for each node in the network within the matrix. The weight can be configured as a static equal weight or a dynamic adaptive weight based on the variance of the network decision deviation of nodes in the historical evolution steps.

[0024] Meanwhile, the source probe tensor refers to the original, unperturbed input sample (e.g., an original image) and its corresponding ground truth label. It is the starting point of the entire adversarial evaluation process and the geometric constraint center of the evolution space. In this embodiment, the source probe tensor is specifically the source probe image.

[0025] In this embodiment, S10 inputs the current evolution state tensor into the heterogeneous surrogate model matrix and extracts the baseline response gradient at the current time step, including: The current evolutionary state tensor is imported into the heterogeneous surrogate model matrix. The decision deviation gradient between the current evolutionary state tensor and the calibration truth is calculated using the decision deviation measurement function on each node network in the heterogeneous surrogate model matrix. The decision deviation gradient is weighted according to the weighting coefficients corresponding to each node network. Finally, all weighted decision deviation gradients are summed to obtain the baseline response gradient.

[0026] Specifically, in the process of extracting the baseline response gradient, let the current evolution step be... The current evolutionary state tensor is The configured heterogeneous proxy model matrix is ​​as follows: First, extract the baseline response gradient at the current time. : in, The response weights of each node in the network within the matrix. This is the decision deviation measurement function on the corresponding node network. To calibrate the true value, The gradient operator for taking the partial derivative with respect to the input tensor. denoted as the total number of node networks in the heterogeneous proxy model matrix, and k is the index number of the node network.

[0027] In one embodiment of the present invention, step S20 specifically includes the following sub-steps: S201. Obtain the pixel value of the current evolution state tensor as a spatial pixel representation, and read the original value of the baseline response gradient as a spatial distribution feature. S202. Perform a two-dimensional discrete Fourier transform on the reference response gradient to obtain the Fourier transform result, extract the amplitude spectrum component from the Fourier transform result as the frequency domain amplitude spectrum feature, and transfer the low frequency component to the center of the spectrum. S203. Obtain the iteration progress scalar of the current tensor manifold derivation, and extend the iteration progress scalar to the same dimension as the source probe tensor through the spatial broadcast mechanism; S204. The spatial pixel features, spatial distribution features, frequency domain amplitude spectrum features, and iteration progress scalar are sequentially aligned and concatenated to obtain a multidimensional joint state vector.

[0028] In order to enable the strategy decision-making system to perceive the physical distribution of sensitivity response in the frequency domain, a two-dimensional discrete Fourier transform is used. Extract the frequency domain amplitude spectrum features (i.e., amplitude spectrum components) of the reference response gradient, and shift the low-frequency components to the center of the spectrum. The frequency domain amplitude spectrum features are represented as follows: .

[0029] Constructed multidimensional joint state vector It is the input to the policy decision network, and it is represented as: in, This represents the total number of step evolutions (rounds). This represents a concatenation operation based on channel dimensions. (Scalar) The state vector is extended to the same width and height dimensions as the image through a spatial broadcast mechanism. This state vector comprehensively characterizes the current evolutionary environment in terms of local texture and global frequency. This state vector not only contains local geometric information in the spatial domain, but also explicitly introduces global frequency distribution features, providing the policy network with a complete evolutionary environment state.

[0030] In one embodiment of the present invention, step S30 includes the following sub-steps: S301. Construct a policy decision network and pre-train it to obtain a pre-trained policy decision network. Input the multi-dimensional joint state vector into the pre-trained policy decision network and output an action vector, wherein the action vector includes a frequency domain attenuation barrier and a spatial domain reshaping tensor.

[0031] S302. Based on the frequency domain attenuation barrier, perform frequency domain filtering and denoising on the baseline response gradient to obtain a smooth gradient. Then, perform nonlinear spatial residual reshaping on the smooth gradient and the spatial reshaping tensor to obtain the residual fusion reshaping direction for manifold evolution. This step allows the policy decision network to actively flip or scale the response direction of a specific pixel to eliminate the response cancellation effect between heterogeneous models.

[0032] S303, such as Figure 2 As shown, a momentum-based manifold stepping rule is used to drive the evolutionary state tensor to perform manifold stepping along the residual fusion reshaping direction (i.e., Figure 2 The tensor manifold stepping method in this embodiment uses a sign momentum-driven approach, where the evolved tensor is projected back into the infinity norm boundary centered on the source-detector tensor. This method borrows the iterative rules of MI-FGSM (Momentum Iterative Fast Gradient Sign Method), replacing the core original gradient with an anti-cancellation reshaping direction intelligently modulated by a policy network. Therefore, this tensor manifold stepping method is driven by the anti-cancellation gradient after frequency-space reshaping, performs numerical updates based on sign momentum, and at each step must be projected back into the hidden boundary, forcibly pulling the updated tensor back to the original source-detector tensor (original image). Infinite norm boundary The iterative optimization process within the model aims to steadily advance towards high mobility regions along the model decision manifold surface while ensuring that the perturbation remains invisible.

[0033] Specifically, in the above sub-step S302, frequency domain filtering and denoising are performed on the reference response gradient based on the frequency domain attenuation barrier to obtain a smooth gradient, including: The reference response gradient is mapped to the frequency domain using the Discrete Fourier Transform (DFT) to obtain the frequency domain representation. The frequency domain representation is then multiplied by the frequency domain attenuation barrier to obtain the product. Finally, the product is restored to the spatial domain using the Inverse Discrete Fourier Transform (IFT) to obtain the smooth gradient.

[0034] Specifically, the above process of frequency-domain and spatial-domain modulation of the reference response gradient can construct a frequency-space joint modulation module, which can be easily applied to corresponding systems. Here, the frequency-domain attenuation barrier is a type of frequency-domain filtering mask, such as... Figure 3 As shown, in the frequency domain filtering and denoising process, the reference response gradient is mapped to the frequency domain using the discrete Fourier transform and then compared with the frequency domain filtering mask. Element-wise multiplication modulation is performed to filter out specific noise, followed by inverse discrete Fourier transform. By restoring to the spatial domain, a smooth gradient is obtained, free from network-specific high-frequency overfitting noise. Specifically, it is expressed by the following formula: Finally, the smoothing gradient and the spatial modulation field are then combined. Nonlinear spatial residual reshaping is performed to obtain the final residual fusion reshaping direction. : in, For element-wise multiplication, This is an adjustable scaling factor. This mechanism enables the policy network to proactively correct orientation conflicts between heterogeneous models.

[0035] Specifically, the policy decision network is an encoder-decoder architecture (such as the U-Net architecture). The decoder has a first branch and a second branch with two parallel outputs at the end. The first branch is used to output a frequency domain attenuation barrier with a value range of 0 to 1, and the second branch is used to output a spatial domain reshaping tensor with a value range of -1 to 1.

[0036] Specifically, the strategy decision network is represented as The network reception status. Finally, at the end of the decoder, the action vector is output through two parallel output branches. The first branch outputs a frequency domain attenuation barrier through the Sigmoid activation function: The second branch outputs a spatial reshaping tensor (i.e., a spatial modulation field) through the Tanh activation function: .

[0037] Based on the aforementioned residual fusion and reshaping direction, a momentum-based manifold stepping rule can be used to drive the evolutionary state tensor to evolve along the residual fusion and reshaping direction and project it onto the infinite norm boundary. Internally, this ensures the concealment of the evolutionary trajectory: in, The single-step evolution step size, The maximum tolerance threshold. For the source probe tensor, It is a symbolic function.

[0038] Existing ensemble methods are mostly limited to linear weighting in the spatial domain, failing to remove high-frequency overfitting noise generated by specific node networks. This embodiment innovatively introduces a frequency-space dual-channel residual reshaping mechanism, endowing the policy decision system with the ability to directly filter out high-frequency specific noise in the frequency domain. By combining discrete Fourier transform with frequency domain attenuation barriers, the frequency distribution of the baseline response gradient is fundamentally reshaped, significantly improving the cross-model transfer and generalization capabilities of underlying vulnerability features.

[0039] In one embodiment of the present invention, step S40, which involves calculating a composite feedback signal after each round of evolution and using the composite feedback signal to optimize the parameters of the policy decision network, includes: Collect the states, actions, and cross-model response consistency metrics in each round of simulation to generate a global state transition sequence, and synthesize a composite driving feedback signal based on the global state transition sequence; Summarize all global state transition sequences generated by evolution and construct a global discount efficiency function that runs through the evolution path; A near-end policy alignment optimization mechanism is adopted, and a gradient flow update is performed on the weight tensor of the policy decision network in combination with a global discount efficiency function until the policy decision network completes the optimization convergence.

[0040] This embodiment addresses the challenge of mutually canceling response directions caused by differences in model architecture in traditional integration methods. It breaks away from conventional trial-and-error reward mechanisms and creatively introduces a composite driving feedback signal that includes the variance of cross-model decision deviation. This mechanism forces the policy decision system, during manifold extrapolation, not only to pursue improved single-point threat effectiveness but also to proactively seek highly consistent response trajectories across multiple heterogeneous agent models, thereby resolving the cross-model response cancellation phenomenon.

[0041] In one embodiment of the present invention, in step S40, the weights of the fixed policy decision network are determined, the input source probe tensor undergoes T-step autonomous iterative evolution, and the tensor with the optimal comprehensive threat effectiveness is selected from all intermediate evolutionary tensors generated by autonomous iterative evolution as the output of the high-mobility adversarial assessment carrier, including: The tensor weights of the policy decision network are fixed. The source probe tensor to be evaluated is imported into the policy decision network and T-step manifold stepping autonomous iterative evolution is performed. The comprehensive threat effectiveness of all intermediate evolution tensors generated by autonomous iterative evolution on the heterogeneous agent model matrix is ​​compared. The intermediate evolution tensor that maximizes the average decision deviation is selected as the high-transferability adversarial evaluation carrier of the final output.

[0042] Based on the specific implementation process of S40 in the above embodiments, this embodiment abandons the traditional trial-and-error optimization mechanism. This invention constructs a strategy optimization closed loop based on cross-model response alignment. In each stage of the manifold derivation step... Ultimately, the system does not simply evaluate the success or failure of a single point of attack, but rather calculates the composite driving feedback signal. To force the policy decision network to lock onto low-frequency vulnerability features shared across models and eliminate response cancellation effects, the composite driving feedback signal... The mathematical quantification design is as follows: in, The average decision deviation of the evolutionary state tensor across all node networks; The variance represents the deviation of network decisions at each node. The smaller the variance, the more consistent the response of manifold evolution is across different networks. This is a high-frequency evolution energy penalty term, used to further constrain the concealment of state evolution; and The constant is the balance coefficient; They represent the evolutionary state tensor at the th... To the The decision deviation corresponding to each node on the network.

[0043] Secondly, convergence After obtaining complete global state transition sequence data, a global discount efficiency function is constructed that spans the entire evolutionary path. Specifically, it is expressed as: , Indicates the first The composite drive feedback signal of the step.

[0044] Subsequently, a near-end policy alignment optimization mechanism is employed, combined with the aforementioned global discount performance function, to optimize the weight tensor of the policy decision network. Gradient flow updates are performed under boundary constraints. This mechanism ensures the absolute stability of the weight convergence process from the underlying mathematical logic by pruning out-of-limit deviations in the probability ratio.

[0045] Finally, after the policy decision network completes its optimization convergence, it enters the adaptive synthesis stage of the adversarial state carrier. At this point, the weight tensor (i.e., link weights) of the policy decision network is solidified. Import the source probe tensor to be evaluated and perform forward activation. The process involves autonomous manifold derivation. Real-time comparison of all intermediate evolutionary tensors in the derivation sequence is performed. The comprehensive threat effectiveness on the heterogeneous agent model matrix accurately extracts the average decision deviation. The tensor that reaches its maximum value serves as the high-transferability adversarial evaluation vector for the final output: in, This refers to a highly transferable adversarial assessment vehicle, which can be directly applied to perform security assessments and robustness tests on unknown black-box target models.

[0046] This embodiment addresses the shortcomings of existing policy gradient-based optimization methods, which are prone to excessively large update steps and unstable convergence. It constructs a policy optimization closed loop based on cross-model response alignment. Through a gradient flow update mechanism under boundary constraints, the weight tensors of the policy decision network are adaptively optimized. This feedback mechanism based on the global state transition sequence prunes the excessive deviation of probability ratios from the underlying mathematical logic, ensuring the absolute stability of the multidimensional tensor manifold evolution process.

[0047] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping, characterized in that, include: S10. Select neural network models with different network architectures to construct a heterogeneous proxy model matrix, and obtain the source probe tensor to be evaluated and the corresponding calibration ground truth; in a single evolution step, input the current evolution state tensor into the heterogeneous proxy model matrix and extract the baseline response gradient at the current moment; the source probe tensor is specifically the source probe image; S20. Perform frequency domain transformation on the reference response gradient to extract frequency domain amplitude spectrum features, and concatenate the current evolution state tensor, reference response gradient, frequency domain amplitude spectrum features, and the current iteration progress scalar to form a multidimensional joint state vector; S30. Input the multidimensional joint state vector into the pre-trained policy decision network to generate a frequency domain attenuation barrier and a spatial domain reshaping tensor. Based on the frequency domain attenuation barrier and the spatial domain reshaping tensor, perform frequency domain filtering and denoising and spatial domain nonlinear residual reshaping on the baseline response gradient in sequence to obtain the residual fusion reshaping direction and drive the evolution state tensor to perform manifold evolution. The value range of the frequency domain attenuation barrier is 0 to 1, and the value range of the spatial domain reshaping tensor is -1 to 1. S30 includes the following sub-steps: S301, constructing a policy decision network and pre-training it to obtain a pre-trained policy decision network, inputting a multi-dimensional joint state vector into the pre-trained policy decision network, and outputting an action vector, wherein the action vector includes a frequency domain attenuation barrier and a spatial domain reshaping tensor; S302, performing frequency domain filtering and denoising on the baseline response gradient based on the frequency domain attenuation barrier to obtain a smooth gradient, and performing nonlinear spatial residual reshaping on the smooth gradient and the spatial domain reshaping tensor to obtain a residual fusion reshaping direction for manifold evolution; S303, using a momentum-based manifold stepping rule, driving the evolutionary state tensor to perform manifold stepping along the residual fusion reshaping direction, and projecting the evolved state tensor onto an infinite norm boundary centered on the source and probe tensor; S40. Repeat S10 to S30 for multiple rounds of iterative evolution, and calculate the composite feedback signal after each round of evolution. Use the composite feedback signal to optimize the policy decision network parameters and fix the policy decision network weights. Perform T-step autonomous iterative evolution based on the source probe tensor. Select the tensor with the best comprehensive threat effectiveness from all intermediate evolution state tensors generated by autonomous iterative evolution as the output of the high-mobility adversarial assessment carrier. The composite feedback signal is calculated from the average decision deviation of the current evolutionary state tensor on each node network in the heterogeneous surrogate model matrix, the variance of the decision deviation of each node network, and the high-frequency evolution energy penalty term. The variance of the decision deviation of each node network is used to characterize the cross-model response consistency. After the strategy decision network completes optimization and convergence, the weights of the strategy decision network are fixed, and T-step autonomous iterative evolution is performed based on the source probe tensor during the evaluation carrier generation stage. The average decision deviation of each intermediate evolution state tensor generated by the T-step autonomous iterative evolution on the heterogeneous proxy model matrix is ​​compared. The intermediate evolution state tensor that maximizes the average decision deviation is selected as the output of a highly transferable adversarial evaluation carrier for security evaluation and robustness testing of the unknown black-box target model.

2. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, In step S10, the current evolutionary state tensor is input into the heterogeneous surrogate model matrix, and the baseline response gradient at the current moment is extracted, including: The current evolutionary state tensor is imported into the heterogeneous surrogate model matrix. The decision deviation gradient between the current evolutionary state tensor and the calibration truth is calculated using the decision deviation measurement function on each node network in the heterogeneous surrogate model matrix. The decision deviation gradient is weighted according to the weighting coefficients corresponding to each node network. Finally, all weighted decision deviation gradients are summed to obtain the baseline response gradient.

3. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, S20 specifically includes the following sub-steps: S201. Obtain the pixel value of the current evolution state tensor as a spatial pixel representation, and read the original value of the baseline response gradient as a spatial distribution feature. S202. Perform a two-dimensional discrete Fourier transform on the reference response gradient to obtain the Fourier transform result, extract the amplitude spectrum component from the Fourier transform result as the frequency domain amplitude spectrum feature, and transfer the low frequency component to the center of the spectrum. S203. Obtain the iteration progress scalar of the current tensor manifold derivation, and extend the iteration progress scalar to the same dimension as the source probe tensor through the spatial broadcast mechanism. S204. The spatial pixel features, spatial distribution features, frequency domain amplitude spectrum features, and iteration progress scalar are sequentially aligned and concatenated to obtain a multidimensional joint state vector.

4. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, In step S302, frequency domain filtering and denoising are performed on the reference response gradient based on the frequency domain attenuation barrier to obtain a smooth gradient, including: The reference response gradient is mapped to the frequency domain using the Discrete Fourier Transform (DFT) to obtain the frequency domain representation. The frequency domain representation is then multiplied by the frequency domain attenuation barrier to obtain the product. Finally, the product is restored to the spatial domain using the Inverse Discrete Fourier Transform (IFT) to obtain the smooth gradient.

5. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, The policy decision network is an encoder-decoder architecture. The decoder has a first branch and a second branch with two parallel outputs at the end. The first branch is used to output a frequency domain attenuation barrier with a value range of 0 to 1, and the second branch is used to output a spatial domain reshaping tensor with a value range of -1 to 1.

6. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, In step S40, a composite feedback signal is calculated after each round of evolution, and the parameters of the policy decision network are optimized using the composite feedback signal, including: Collect the states, actions, and cross-model response consistency metrics in each round of simulation to generate a global state transition sequence, and synthesize a composite driving feedback signal based on the global state transition sequence; Summarize all global state transition sequences generated by evolution and construct a global discount efficiency function that runs through the evolution path; A near-end policy alignment optimization mechanism is adopted, and a gradient flow update is performed on the weight tensor of the policy decision network in combination with a global discount efficiency function until the policy decision network completes the optimization convergence.

7. The black-box adversarial evaluation method based on policy-driven and frequency-space residual reshaping according to claim 1, characterized in that, In S40, the fixed policy decision network weights are used. The input source probe tensor undergoes T-step autonomous iterative evolution. From all intermediate evolutionary tensors generated by the autonomous iterative evolution, the tensor with the optimal comprehensive threat effectiveness is selected as the output of the high-mobility adversarial assessment carrier, including: The tensor weights of the policy decision network are fixed. The source probe tensor to be evaluated is imported into the policy decision network and T-step manifold stepping autonomous iterative evolution is performed. The comprehensive threat effectiveness of all intermediate evolution tensors generated by autonomous iterative evolution on the heterogeneous agent model matrix is ​​compared. The intermediate evolution tensor that maximizes the average decision deviation is selected as the high-transferability adversarial evaluation carrier of the final output.

Images