Adversarial sample generation method and system based on gradient whitening and wavelet decomposition

Abstract

This invention discloses an adversarial example generation method and system based on gradient whitening and wavelet decomposition. The method first acquires the original image and then uses wavelet decomposition to perform multi-level decomposition on the current adversarial example, generating multiple frequency sub-bands of different scales. Then, for each sub-band, its gradient with respect to the target model loss is calculated, and an adaptive noise mask is constructed based on the gradient. Next, the enhanced sub-bands are reconstructed back into the enhanced image. Then, the gradient of the enhanced image with respect to the source visual Transformer model is obtained, and during backpropagation, a whitening transformation is performed on the calculated gradient to decouple the correlation between tokens, generating a whitening gradient. Finally, the adversarial perturbation is updated based on the whitening gradient, iteratively generating adversarial examples. This invention, by combining gradient whitening and wavelet decomposition, effectively alleviates the overfitting problem of adversarial attacks on the source model and significantly improves the success rate of black-box transfer attacks of adversarial examples across different visual Transformer and convolutional neural network architectures.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, specifically relating to an adversarial example generation method and system for visual Transformer models, and more particularly to an adversarial attack method that improves the cross-architecture transferability of adversarial examples through gradient whitening and wavelet decomposition. Background Technology

[0002] In recent years, deep neural networks, represented by the Visual Transformer, have achieved significant performance breakthroughs in computer vision tasks such as image classification, object detection, and semantic segmentation. Compared to traditional convolutional neural networks, the Visual Transformer employs a self-attention mechanism to model global dependencies between image patches, enabling it to better capture long-range contextual information and achieving state-of-the-art recognition accuracy on multiple public benchmark datasets. However, research shows that, like convolutional neural networks, the Visual Transformer is vulnerable to adversarial examples—attackers can add minute perturbations to the original image, imperceptible to the human eye, leading to completely incorrect predictions from the model. This security vulnerability poses a serious threat in security-critical applications such as face recognition, autonomous driving, and medical image diagnosis. Therefore, researching adversarial example generation methods to evaluate and improve the robustness of deep neural networks has significant theoretical and practical value.

[0003] In real-world attack scenarios, attackers often lack access to the target model's internal parameters and gradient information, operating under a black-box environment. An effective strategy for black-box attacks is transfer-based adversarial attacks: attackers generate adversarial examples using a substitute model under white-box conditions, then use these examples to attack the unknown target model. This attack method has higher security evaluation value because it simulates the methods attackers might employ in the real world. However, existing transfer-based attack methods often exhibit low cross-architecture transfer success rates when facing visual Transformers. The main reasons are: firstly, the self-attention mechanism of visual Transformers leads to overfitting to specific token attention patterns, causing the generated adversarial perturbations to overly rely on the source model's attention structure; secondly, different models exhibit significant differences in sensitivity to different frequency components of images, and traditional methods have failed to fully exploit and utilize these frequency characteristics to enhance the generalization ability of the perturbations.

[0004] To address the aforementioned issues, researchers have proposed a series of improved methods. Regarding gradient regularization, the Pay NoAttention method alleviates overfitting by discarding gradients in the attention module; the Token gradient regularization method reduces variance by scaling extreme gradient values; and the virtual dense connection method smooths gradient propagation by introducing virtual skip connections. Regarding frequency domain attacks, methods based on Discrete Cosine Transform (DCT) attempt to enhance transferability through global frequency transformation. However, DCT only provides a global frequency representation and cannot capture the local frequency structure of the image, and it lacks an adaptive frequency enhancement mechanism. Furthermore, existing methods often handle gradient space and frequency space issues in isolation, failing to fully utilize the synergistic effect between the two.

[0005] In summary, designing a highly transferable adversarial sample generation method that can effectively alleviate overfitting of the visual Transformer gradient while adaptively utilizing multi-scale frequency information is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] Purpose of the Invention: The purpose of this invention is to provide an adversarial example generation method and system based on gradient whitening and wavelet decomposition, aiming to solve the problems of poor transferability of existing adversarial example generation methods on visual Transformers, overfitting to the attention structure of the source model, and coarse frequency domain processing. By decoupling the gradient correlation between tokens through gradient whitening technology and combining a multi-scale frequency enhancement strategy of wavelet decomposition, this invention can significantly improve the success rate of black-box transfer attacks of adversarial examples across different visual Transformer architectures and between visual Transformer and convolutional neural network architectures, while ensuring the imperceptibility of perturbations in the generated adversarial examples.

[0007] Technical Solution: To achieve the above-mentioned objectives, the present invention provides an adversarial example generation method based on gradient whitening and wavelet decomposition, comprising the following steps:

[0008] Step 1: Obtain the original image and its ground truth label, initialize the adversarial example as the original image, and set the maximum perturbation budget ε and the total number of iterations T;

[0009] Step 2: Perform multi-level frequency sub-band decomposition on the current adversarial sample using wavelet decomposition to generate multiple frequency sub-bands at different scales; preferably, a two-level wavelet decomposition is performed using the Daubechies-4 wavelet basis. The first level of decomposition yields approximate sub-band a, horizontal detail sub-band h, vertical detail sub-band v, and diagonal detail sub-band d; the second level further decomposes approximate sub-band a to obtain secondary approximate sub-band aa, secondary horizontal detail sub-band ah, secondary vertical detail sub-band av, and secondary diagonal detail sub-band ad, forming a total of seven frequency sub-bands;

[0010] Step 3: For each frequency sub-band, calculate its gradient sensitivity with respect to the source visual Transformer model loss, and construct an adaptive noise mask based on this gradient sensitivity; specifically, for the i-th frequency sub-band... Set the other subbands to zero, by Reconstructing the image separately Calculate the loss function with respect to gradient Then the adaptive noise mask is ,in The constant is used; then, differentiated random enhancement is performed on each frequency sub-band: first, Gaussian noise is added in the spatial domain, and then Gaussian noise with a mean of 1 and a standard deviation of is applied to each sub-band after wavelet decomposition. Gaussian multiplicative noise, multiplied by the corresponding adaptive mask. The enhanced formula is ;

[0011] Step 4: Reconstruct the enhanced frequency sub-bands back to the spatial domain using inverse wavelet transform to obtain the enhanced image;

[0012] Step 5: Input the augmented image into the source visual Transformer model, calculate the gradient of the loss function with respect to the augmented image, and perform a global whitening transformation on the calculated token-level gradient during backpropagation to decouple the correlation between tokens and generate a whitening gradient;

[0013] Preferably, step 5 specifically includes:

[0014] Step 51: Extract the token-level gradient at a specified layer of the source visual Transformer model to obtain the gradient matrix. ,in The number of tokens after image segmentation (excluding category tokens). The gradient dimension for each token is calculated; the mean vector of the gradient matrix is ​​then used to obtain the centered gradient matrix. ,in This is the column-wise mean vector of the gradient matrix;

[0015] Step 52: Calculate the covariance matrix of the centered gradient matrix. covariance matrix The dimension is × Its diagonal elements represent the variance of the gradient in each dimension, and the off-diagonal elements represent the correlation between gradients in different dimensions.

[0016] Step 53: Calculate the inverse square root matrix of the covariance matrix using Newton's iteration method. The whitening matrix is ​​obtained. ;

[0017] Step 54: Perform a whitening transformation on the centered gradient: The whitened gradient matrix It satisfies that its covariance matrix is ​​the identity matrix, that is, the gradients of each dimension are mutually orthogonal;

[0018] Step 55: Blend the whitened gradient with the original gradient to generate the corrected gradient: ,in σ is the mixing coefficient, with a value range of [0, 1], preferably 0.12; when σ=0, it degenerates into the original gradient, when... When using the whitening gradient, a moderate σ value can balance the relationship between gradient decorrelation and maintaining the original attack direction.

[0019] Step 6: Iteratively update against perturbations based on corrected gradients; set the number of inner loop iterations. Repeat steps 2 through 5 for a total of Next, get Corrected gradient Take the average value Then, the adversarial examples are updated using signed gradient descent. ,in, Let be the step size, and let its value be . ; This indicates that adversarial examples are projected onto the original image. Centered on Norm radius is Inside the ball;

[0020] Step 7: Repeat steps 2 to 6 until the total number of iterations T is reached, and output the final adversarial example.

[0021] Furthermore, the above method also includes step 8: when the number of iterations reaches the preset upper limit T, or when the success rate of the attack no longer increases after multiple consecutive iterations, the iteration is terminated in advance and the current adversarial sample is output.

[0022] Based on the same inventive concept, this invention provides an adversarial example generation system based on gradient whitening and wavelet decomposition, comprising:

[0023] Wavelet decomposition enhancement module: used to perform wavelet decomposition on the current adversarial sample to obtain multiple frequency sub-bands, calculate the gradient sensitivity of each sub-band and construct an adaptive noise mask, perform differential random enhancement on each sub-band and reconstruct it back to the spatial domain, and output the enhanced image;

[0024] Gradient whitening module: used to obtain the token-level gradient of the source visual Transformer model during backpropagation, calculate the covariance matrix of the gradient matrix and its inverse square root, perform global whitening transformation on the token-level gradient to decouple the correlation between tokens, and fuse the whitening gradient with the original gradient through the mixing coefficient to output the whitening gradient.

[0025] Iterative update module: used to iteratively update the adversarial perturbation based on the corrected gradient using the sign gradient descent method, and project the updated adversarial sample into the perturbation constraint sphere to generate new adversarial samples;

[0026] Loop control module: Used to control the number of iterations and the number of inner loops, and to determine whether the termination condition has been met, deciding whether to continue iterating or output the final adversarial example.

[0027] Based on the same inventive concept, the present invention provides a computer system including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the steps of the adversarial sample generation method based on gradient whitening and wavelet decomposition.

[0028] Based on the same inventive concept, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the adversarial sample generation method based on gradient whitening and wavelet decomposition.

[0029] Beneficial effects: Compared with the prior art, the present invention has the following beneficial effects:

[0030] High transferability: This invention is the first to introduce gradient whitening technology into adversarial attacks on visual Transformers. By performing global whitening transformation on token-level gradients, the high correlation between gradients of different tokens is decoupled, breaking the overfitting of adversarial perturbations to the attention structure of the source model, making the generated adversarial perturbations more universal. Experiments show that on multiple visual Transformer models, the average attack success rate of this invention is more than 2% higher than the existing best method.

[0031] Frequency Domain Enhancement: Unlike existing global frequency processing methods based on discrete cosine transform, this invention employs wavelet decomposition to perform multi-level, multi-directional frequency sub-band decomposition of the image, enabling the simultaneous capture of low-frequency structural information and anisotropic high-frequency texture information. Through gradient-sensitive guided adaptive noise masking, personalized frequency enhancement is applied to each sub-band, effectively simulating the differentiated responses of different target models to frequency information. This significantly improves the success rate of cross-architecture attacks, particularly in scenarios transitioning from visual Transformers to convolutional neural networks.

[0032] High robustness: The method of this invention does not depend on a specific model structure and is applicable to various visual Transformer variants (such as ViT, CaiT, PiT, Swin, etc.) as well as traditional convolutional neural networks (such as ResNet, VGG, MobileNet, Inception, etc.), demonstrating excellent generalization ability and practical value. Attached Figure Description

[0033] Figure 1 This is an overall flowchart of the method of the present invention;

[0034] Figure 2 This is a schematic diagram of the wavelet decomposition frequency enhancement process in this invention;

[0035] Figure 3 This is a schematic diagram of the gradient whitening process in this invention. Detailed Implementation

[0036] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. After reading this invention, any modifications of the invention in various equivalent forms by those skilled in the art will fall within the scope defined by the appended claims.

[0037] like Figure 1 As shown in the figure, an adversarial example generation method based on gradient whitening and wavelet decomposition disclosed in this invention mainly includes the following steps:

[0038] Step 1: Obtain the original image and its ground truth label, initialize the adversarial example as the original image, and set the maximum perturbation budget ε and the total number of iterations T;

[0039] Step 2: Use wavelet decomposition to perform multi-level frequency sub-band decomposition on the current adversarial sample, generating multiple frequency sub-bands of different scales;

[0040] Step 3: For each frequency sub-band, calculate its gradient sensitivity with respect to the source visual Transformer model loss, and construct an adaptive noise mask based on the gradient sensitivity. Perform differentiated random enhancement on each frequency sub-band after decomposition to obtain the enhanced sub-band.

[0041] Step 4: Reconstruct the enhanced frequency sub-bands back to the spatial domain using inverse wavelet transform to obtain the enhanced image;

[0042] Step 5: Input the augmented image into the source visual Transformer model, calculate the gradient of the loss function with respect to the augmented image, and perform a global whitening transformation on the calculated token-level gradient during backpropagation to decouple the correlation between tokens and generate a whitening gradient.

[0043] Step 6: Iteratively update the adversarial perturbation based on the whitening gradient to generate new adversarial examples;

[0044] Step 7: Repeat steps 2 to 6 until the total number of iterations T is reached, and output the final adversarial example.

[0045] Figure 2 The process of wavelet decomposition frequency enhancement in steps 2-4 of the present invention is illustrated, and specifically, it is further described as follows:

[0046] Step 2: Perform wavelet decomposition on the current adversarial example using the Daubechies-4 wavelet basis, with two decomposition layers. The first layer decomposes the image into four frequency sub-bands: approximate sub-band a, horizontal detail sub-band h, vertical detail sub-band v, and diagonal detail sub-band d. The second layer decomposition is performed only on approximate sub-band a, further decomposing it into four secondary sub-bands: secondary approximate sub-band aa, secondary horizontal detail sub-band ah, secondary vertical detail sub-band av, and secondary diagonal detail sub-band ad. Finally, a total of seven frequency sub-bands are obtained: C = {aa, ah, av, ad, h, v, d}. Among them, the approximate sub-band and secondary approximate sub-band contain the low-frequency structural information of the image, while the detail sub-band contains the high-frequency edge and texture information of the image.

[0047] Step 3: Calculate the gradient sensitivity for each frequency sub-band. Frequency sub-band Set other subbands to zero, only by A single image is reconstructed using inverse wavelet transform. ;Will Input source: Visual Transformer model; calculate loss function. about gradient ;based on Constructing an adaptive noise mask The calculation formula is as follows:

[0048]

[0049] in, ξ represents the true label of the original image, and ξ is the numerical stability constant. The value range is [0,1], which is used to characterize the importance of each coefficient in this frequency sub-band to the model decision. The larger the value, the more sensitive the frequency coefficient is. At the same time, step 3 performs differentiated random augmentation on each frequency sub-band, first on the current adversarial sample. Add spatial domain Gaussian noise The noisy image is obtained; the wavelet decomposition described in step 2 is performed on the noisy image to obtain each frequency sub-band. Then, frequency domain enhancement is performed on each sub-band, and the enhancement formula is as follows:

[0050]

[0051] Here, ⊙ represents element-wise multiplication. With a mean of 1 and a standard deviation of 1 Gaussian noise, The value range is [0.1, 0.5]; The adaptive noise mask is calculated in step 3. Through the above operations, a small enhancement perturbation is applied to the sensitive frequency coefficients, and a large enhancement perturbation is applied to the insensitive frequency coefficients, thereby simulating the differentiated response characteristics of different target models to frequency information.

[0052] like Figure 3 As shown, the gradient whitening method in step 5 is as follows:

[0053] Step 51: Extract the token-level gradient at a specified layer of the source visual Transformer model to obtain the gradient matrix. ,in The number of tokens after image segmentation (excluding category tokens). The gradient dimension for each token is calculated; the mean vector of the gradient matrix is ​​then used to obtain the centered gradient matrix. ,in This is the column-wise mean vector of the gradient matrix;

[0054] Step 52: Calculate the covariance matrix of the centered gradient matrix. covariance matrix The dimension is × Its diagonal elements represent the variance of the gradient in each dimension, and the off-diagonal elements represent the correlation between gradients in different dimensions.

[0055] Step 53: Calculate the inverse square root matrix of the covariance matrix using Newton's iteration method. The whitening matrix is ​​obtained. ;

[0056] Step 54: Perform a whitening transformation on the centered gradient: The whitened gradient matrix It satisfies that its covariance matrix is ​​the identity matrix, that is, the gradients of each dimension are mutually orthogonal;

[0057] Step 55: Blend the whitened gradient with the original gradient to generate the corrected gradient: ,in σ is the mixing coefficient, with a value range of [0, 1], preferably 0.12; when σ=0, it degenerates into the original gradient, when... When using the whitening gradient, a moderate σ value can balance the relationship between gradient decorrelation and maintaining the original attack direction.

[0058] For ease of description, we evaluate the effectiveness of this invention using the ImageNet dataset on the ViT-Base model, as follows:

[0059] (1) First, normalize the original image to normalize the pixel value of [0, 255] in the image to the interval of [0, 1].

[0060] (2) Based on wavelet packet decomposition, the current adversarial sample is decomposed into two layers. The Daubechies-4 wavelet basis is used to generate seven frequency sub-bands (aa, ah, av, ad, h, v, d). The gradient sensitivity of each sub-band with respect to the source visual Transformer model loss is calculated, an adaptive noise mask is constructed, differential Gaussian multiplicative noise enhancement is applied to each sub-band, and the enhanced image is reconstructed through inverse wavelet packet transformation.

[0061] (3) The visual Transformer model of the enhanced image input source is used to extract the Token level gradient during the backpropagation process, calculate the covariance matrix of the gradient matrix, use Newton's iteration method to find its inverse square root for whitening transformation, and mix the whitened gradient with the original gradient in a ratio of 0.88:0.12 to generate the corrected gradient.

[0062] (4) Based on the corrected gradient, the sign gradient descent method is used to iteratively update the adversarial perturbation. Steps (2)-(4) are repeated 10 times to generate the final adversarial sample.

[0063] To further illustrate the effectiveness of the proposed method, it was applied to the ImageNet dataset, using ViT-Base as the proxy model, to attack various visual Transformers (including CaiT-S, PiT-B, Visformer-S, and Swin-B). The results were compared with PNA (Pay No Attention) and TGR (Token Gradient Regularization) methods, as shown in Table 1. Here, ASR represents the average success rate (%) of the adversarial examples against the aforementioned visual Transformers. The results show that the adversarial examples generated by the proposed method achieve the highest attack success rate (82.4%) on various black-box visual Transformer models, significantly higher than PNA (53.2%) and TGR (71.0%).

[0064] Table 1 Comparison of experimental results

[0065]

[0066] Based on the same inventive concept, this invention provides an adversarial example generation system based on gradient whitening and wavelet decomposition, comprising: a wavelet decomposition enhancement module: used to perform wavelet decomposition on the current adversarial example to obtain multiple frequency sub-bands, calculate the gradient sensitivity of each sub-band and construct an adaptive noise mask, perform differential random enhancement on each sub-band and reconstruct it back to the spatial domain, and output the enhanced image; a gradient whitening module: used to obtain the token-level gradient of the source visual Transformer model during backpropagation, calculate the covariance matrix and its inverse square root of the gradient matrix, perform a global whitening transformation on the token-level gradient to decouple the correlation between tokens, and fuse the whitening gradient with the original gradient through a mixing coefficient to output the corrected gradient; and an iterative update module: used to iteratively update the adversarial perturbation based on the corrected gradient using the signed gradient descent method, and project the updated adversarial example onto the... Within the perturbation constraint sphere, new adversarial examples are generated. The loop control module controls the number of iterations and the number of inner loops, and determines whether the termination condition is met, deciding whether to continue iteration or output the final adversarial example. The specific working process of each module described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here. The division of modules is only a logical functional division; in actual implementation, there may be other division methods, such as multiple modules being combined or integrated into another system.

[0067] Based on the same inventive concept, the present invention provides a computer system including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the steps of the adversarial sample generation method based on gradient whitening and wavelet decomposition.

[0068] Based on the same inventive concept, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the adversarial sample generation method based on gradient whitening and wavelet decomposition.

[0069] Those skilled in the art will understand that the technical solution of this invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer system (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in the embodiments of this invention. The storage medium includes various media capable of storing computer programs, such as a USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

Claims

1. An adversarial example generation method based on gradient whitening and wavelet decomposition, characterized in that, Includes the following steps: Step 1: Obtain the original image and its ground truth label, initialize the adversarial example as the original image, and set the maximum perturbation budget ε and the total number of iterations T; Step 2: Use wavelet decomposition to perform multi-level frequency sub-band decomposition on the current adversarial sample, generating multiple frequency sub-bands of different scales; Step 3: For each frequency sub-band, calculate its gradient sensitivity with respect to the source visual Transformer model loss, and construct an adaptive noise mask based on the gradient sensitivity. Perform differentiated random enhancement on each frequency sub-band after decomposition to obtain the enhanced sub-band. Step 4: Reconstruct the enhanced frequency sub-bands back to the spatial domain using inverse wavelet transform to obtain the enhanced image; Step 5: Input the augmented image into the source visual Transformer model, calculate the gradient of the loss function with respect to the augmented image, and perform a global whitening transformation on the calculated token-level gradient during backpropagation to decouple the correlation between tokens and generate a whitening gradient. Step 6: Iteratively update the adversarial perturbation based on the whitening gradient to generate new adversarial examples; Step 7: Repeat steps 2 to 6 until the total number of iterations T is reached, and output the final adversarial example.

2. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 1, characterized in that, In step 2, the wavelet decomposition uses the Daubechies-4 wavelet basis and has two decomposition levels. The first level decomposes the image into four frequency sub-bands: approximate sub-band a, horizontal detail sub-band h, vertical detail sub-band v, and diagonal detail sub-band d. The second level decomposition is performed only on approximate sub-band a, further decomposing it into four secondary sub-bands: secondary approximate sub-band aa, secondary horizontal detail sub-band ah, secondary vertical detail sub-band av, and secondary diagonal detail sub-band ad. Finally, a total of seven frequency sub-bands are obtained: C = {aa, ah, av, ad, h, v, d}. Among them, the approximate sub-band and the secondary approximate sub-band contain the low-frequency structural information of the image, and the detail sub-band contains the high-frequency edge and texture information of the image.

3. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 1, characterized in that, In step 3, the specific method for calculating the gradient sensitivity of each frequency sub-band is as follows: For the first... Frequency sub-band Set other subbands to zero, only by A single image is reconstructed using inverse wavelet transform. ;Will Input source: Visual Transformer model; calculate loss function. about gradient ;based on Constructing an adaptive noise mask The calculation formula is as follows: in, ξ represents the true label of the original image, and ξ is the numerical stability constant. The value range is [0,1], which is used to characterize the importance of each coefficient in this frequency subband to the model decision. The larger the value, the more sensitive the frequency coefficient is.

4. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 3, characterized in that, In step 3, the method for differential random enhancement of each frequency sub-band is as follows: First, the current adversarial sample... Add spatial domain Gaussian noise The noisy image is obtained; the wavelet decomposition described in step 2 is performed on the noisy image to obtain each frequency sub-band. Then, frequency domain enhancement is performed on each sub-band, and the enhancement formula is as follows: Here, ⊙ represents element-wise multiplication. With a mean of 1 and a standard deviation of 1 Gaussian noise, The value range is [0.1, 0.5]; The adaptive noise mask is calculated in step 3. Through the above operations, a small enhancement perturbation is applied to the sensitive frequency coefficients, and a large enhancement perturbation is applied to the insensitive frequency coefficients, thereby simulating the differentiated response characteristics of different target models to frequency information.

5. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 1, characterized in that, In step 5, the specific method for performing the global whitening transformation includes the following sub-steps: Step 51: Extract the token-level gradient at a specified layer of the source visual Transformer model to obtain the gradient matrix. ,in The number of tokens after image segmentation (excluding category tokens). The gradient dimension for each token is calculated; the mean vector of the gradient matrix is ​​then used to obtain the centered gradient matrix. ,in This is the column-wise mean vector of the gradient matrix; Step 52: Calculate the covariance matrix of the centered gradient matrix. covariance matrix The dimension is × Its diagonal elements represent the variance of the gradient in each dimension, and the off-diagonal elements represent the correlation between gradients in different dimensions. Step 53: Calculate the inverse square root matrix of the covariance matrix using Newton's iteration method. The whitening matrix is ​​obtained. ; Step 54: Perform a whitening transformation on the centered gradient: The whitened gradient matrix It satisfies that its covariance matrix is ​​the identity matrix, that is, the gradients of each dimension are mutually orthogonal; Step 55: Blend the whitened gradient with the original gradient to generate the corrected gradient: ,in σ is the mixing coefficient, with a value range of [0, 1], preferably 0.12; when σ=0, it degenerates into the original gradient, when... When using the whitening gradient, a moderate σ value can balance the relationship between gradient decorrelation and maintaining the original attack direction.

6. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 1, characterized in that, In step 6, the specific method for iterative updating against perturbations based on corrected gradients is as follows: First, set the number of inner loop iterations. For each iteration of the inner loop, steps 2 through 5 are executed repeatedly, for a total of... Each inner loop uses a different random noise seed to obtain M enhanced images and their corresponding correction gradients. Then calculate the average of the M corrected gradients: Finally, the signified gradient descent method is used to update the adversarial examples, and the update formula is as follows: in, Let be the step size, and let its value be . ; This indicates that adversarial examples are projected onto the original image. Centered on Norm radius is Inside the sphere, ensure that the added perturbation is not visible to the naked eye.

7. The adversarial example generation method based on gradient whitening and wavelet decomposition according to claim 1, characterized in that, The method further includes step 8: when the number of iterations reaches a preset upper limit T, or when the attack success rate no longer increases after multiple consecutive iterations, the iteration is terminated in advance and the current adversarial sample is output; the attack success rate refers to the probability that the adversarial sample causes the target model to make a misclassification.

8. An adversarial example generation system based on gradient whitening and wavelet decomposition, characterized in that, include: The wavelet decomposition enhancement module is used to perform wavelet decomposition on the current adversarial sample to obtain multiple frequency sub-bands, calculate the gradient sensitivity of each sub-band and construct an adaptive noise mask, perform differential random enhancement on each sub-band and reconstruct it back to the spatial domain, and output the enhanced image. The gradient whitening module is used to obtain the token-level gradient of the source visual Transformer model during backpropagation, calculate the covariance matrix of the gradient matrix and its inverse square root, perform a global whitening transformation on the token-level gradient to decouple the correlation between tokens, and fuse the whitening gradient with the original gradient through a mixing coefficient to output the corrected gradient. The iterative update module is used to iteratively update the adversarial perturbation based on the corrected gradient using the signed gradient descent method, and project the updated adversarial example onto... Within the perturbation-constrained sphere, new adversarial examples are generated. The loop control module is used to control the number of iterations and the number of inner loops, and to determine whether the termination condition has been met, deciding whether to continue iterating or output the final adversarial example.

9. The adversarial example generation system based on gradient whitening and wavelet decomposition according to claim 8, characterized in that, The wavelet decomposition enhancement module uses the Daubechies-4 wavelet basis to perform two-level wavelet decomposition, generating a total of seven frequency sub-bands; the gradient whitening module uses the Newton-Raphson iteration method to calculate the inverse square root of the covariance matrix.

10. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the steps of the adversarial example generation method based on gradient whitening and wavelet decomposition according to any one of claims 1 to 7.

11. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the adversarial sample generation method based on gradient whitening and wavelet decomposition according to any one of claims 1 to 7.

Images