A momentum-stable local adversarial sample generation method based on human visual contrast sensitivity

Abstract

The present application relates to a momentum stable local adversarial sample generation method based on human visual contrast sensitivity, belonging to the field of artificial intelligence security. In view of the problems of unstable pixel positioning and insufficient visual coherence in sparse adversarial attack, the present application precalculates the pixel-level visual sensitivity map based on Mannos-Sakrison contrast sensitivity function, constructs an adaptive momentum attenuation tensor to differentiate and smooth the pixel gradient noise, and designs a compound perception loss function that integrates direction consistency constraint, deep perception feature similarity and contrast sensitivity amplitude penalty to optimize the spatial distribution and amplitude form of the perturbation. The linear annealing scheduling of the upper bound of the perturbation amplitude realizes progressive optimization, which ensures the attack effectiveness while significantly improving the visual concealment of the sparse adversarial sample.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security, specifically to adversarial attack techniques for deep learning models, and in particular to an adversarial sample generation method that uses the human visual contrast sensitivity function as a unified perceptual constraint and coordinates the optimization of sparse adversarial perturbation distribution and amplitude shape through a frequency-aware pixel-level adaptive momentum mechanism and a composite perceptual loss function. Background Technology

[0002] Deep neural networks have achieved remarkable success in computer vision tasks such as image classification and object detection. However, they also exhibit extreme vulnerability to carefully designed adversarial perturbations; even minute human-induced perturbations can lead to incorrect classifications by deep models. Adversarial example generation research aims to reveal this potential vulnerability of deep models and provide theoretical tools for evaluating model robustness in security-critical scenarios. In adversarial example generation methods, sparse attacks based on L0 norm constraints mislead the target model by minimizing the number of perturbed pixels rather than the perturbation magnitude of each pixel. Since the human visual system is significantly less sensitive to changes in local sparse pixels than to global noise, sparse attacks have a potential advantage in attack effectiveness when visual perception costs are limited. However, optimal sparse attacks are essentially a combinatorial optimization problem involving the joint solution of pixel subset selection and perturbation magnitude, facing two interrelated core technical challenges in practice.

[0003] The first challenge is the insufficient iterative stability of key pixel localization. The signal-to-noise ratio of pixel importance estimates obtained from a single gradient calculation is low. In textured image regions, the gradient variance is significantly higher than in smooth regions. Pixel sorting based on instantaneous gradients is highly susceptible to gradient noise, causing drift and resulting in some non-key pixels with high gradient noise entering the selected set, continuously misleading the direction of subsequent perturbation optimization. Furthermore, applying a uniform scalar momentum decay to all pixels in the entire image is equivalent to applying a low-pass filter with the same cutoff frequency across the entire image from a signal processing perspective. However, there is a significant difference in the gradient sequence variance between high-frequency textured regions and low-frequency smooth regions. A uniform cutoff frequency is insufficient for smoothing in high-frequency regions and sluggish in response in low-frequency regions; both cannot be achieved simultaneously. This contradiction is particularly prominent in pixel localization using sparse attacks. The second challenge is the insufficient visual coherence constraint on perturbations on selected pixel subsets. When sparse perturbations are driven solely by attack loss, the perturbation directions between adjacent selected pixels lack spatial consistency constraints. The resulting perturbations tend to present a visually disordered discrete point pattern, which is inconsistent with the continuous transition characteristics of natural image texture structures and increases the risk that the perturbations will be perceived by the human eye.

[0004] The fundamental reason for the two challenges mentioned above lies in the insufficient accuracy of existing methods in modeling the spatial frequency response characteristics of the human visual system. They fail to systematically incorporate the quantitative model of the contrast sensitivity function, rigorously experimentally based in visual psychophysics, into the two core design stages of attack algorithms: pixel localization and perturbation generation. The contrast sensitivity function is a classic quantitative model in visual psychophysics describing the detection threshold of the human eye to sinusoidal grating stimuli at different spatial frequencies. Essentially, it is a bandpass function describing the gain response characteristics of the human visual system at different spatial frequencies. This function exhibits a peak in the mid-frequency range, with significantly decreased sensitivity at extremely low and high frequencies. This means that perturbations of the same amplitude applied to the mid-frequency region, which is sensitive to the human eye, are more likely to elicit a perceptual response than those applied to extremely high or low frequency regions. Systematically incorporating this quantitative model into sparse adversarial attacks means that the evaluation of pixel importance and the constraint of perturbation amplitude can be accurately based on the actual perceptual sensitivity of the human eye, thereby achieving efficient attacks with controllable perceptual costs. Summary of the Invention

[0005] To address the shortcomings of existing sparse adversarial attack methods in terms of key pixel localization stability and visual coherence of selected pixel perturbations, this invention provides a momentum-stabilized local adversarial example generation method based on human visual contrast sensitivity. It uses a pixel-level visual sensitivity map constructed with the Mannos-Sakrison contrast sensitivity function as a unified perceptual constraint. A frequency-aware pixel-level adaptive momentum decay mechanism is employed to improve the iterative stability of key pixel localization. Furthermore, a composite perceptual loss function, fusing directional consistency regularization loss, deep perceptual feature similarity loss, and visual contrast sensitivity amplitude penalty loss, is used to collaboratively constrain the spatial direction distribution and pixel-by-pixel amplitude pattern of perturbations on a selected subset of pixels. This significantly enhances the visual concealment of adversarial examples while ensuring attack effectiveness.

[0006] The method provided by this invention includes the following steps:

[0007] Step S1: Receive the original digital image and the target deep learning classifier. Initialize both the adversarial perturbation tensor and the momentum accumulation gradient tensor to zero tensors of the same dimension as the original digital image. Convert the original digital image to a grayscale image using the standard brightness weighting formula. Construct corresponding Gabor convolution kernels using 24 combinations of 6 preset normalized spatial frequencies and 4 preset orientation angle parameters. Calculate the square of the convolution response amplitude between the grayscale image and each Gabor convolution kernel to obtain the local frequency response energy of each pixel position under each frequency orientation combination. Based on the Mannos-Sakrison parameterization form, convert each normalized spatial frequency into a visual spatial frequency in units of periods per viewing angle, and then calculate the corresponding contrast sensitivity. The contrast sensitivity values ​​are calculated and normalized by taking the maximum value of all contrast sensitivity values. Using the normalized contrast sensitivity values ​​as weights, the local frequency response energy of each pixel in all 24 frequency orientation combinations is weighted and summed, and then normalized to the maximum value of the whole image to obtain the visual sensitivity index of each pixel. Using the visual sensitivity index of each pixel as the interpolation parameter, linear interpolation is performed between the lower and upper bounds of the preset momentum decay coefficient to construct a pixel-level adaptive momentum decay tensor with the same spatial dimension and number of channels as the original digital image, where the upper bound is strictly less than 1. The pixels are sorted by the sum of the full-channel amplitudes of the gradient of the adversarial classification loss output by the target deep learning classifier in the perturbation zero state relative to the perturbation tensor, and the top-ranked pixels are selected to initialize the binary pixel selection mask.

[0008] Step S2 involves annealing scheduling of the upper bound of the perturbation amplitude controlled by the outer loop, and performing a fixed number of inner loop iterations within the outer loop to achieve coordinated advancement of pixel identification and perturbation optimization. Step S2 includes the following sub-steps: Step S21: At the beginning of each outer loop, linear annealing is performed to update the upper bound of the perturbation amplitude according to the current outer loop iteration, so that it monotonically decreases from the initial upper bound of the amplitude as the outer loop iteration increases to the final upper bound of the amplitude; Step S22: The current adversarial perturbation tensor is added element-wise to the original digital image and then cropped to the range of legal pixel values ​​to obtain candidate adversarial samples. The candidate adversarial samples are input into the target deep learning classifier, and the true class corresponding to the output logical score vector of the classifier is taken. The difference between the value and the maximum value among all non-true categories, plus the confidence margin threshold, is used as the adversarial classification loss; Step S23, if the current inner layer iteration number exceeds the preset warm-up step number, within the current binary pixel selection mask range, the mean cosine distance of the cross-channel perturbation vectors of all selected pixel pairs whose spatial distance does not exceed the preset neighborhood radius is calculated as the direction consistency regularization loss, the sum of the distances between multiple intermediate layers of the pre-trained deep convolutional network and the candidate adversarial sample and the original image feature map is used as the deep perception feature similarity loss, and the mean of the product of the visual sensitivity index of all selected pixels in the current mask and the maximum cross-channel perturbation amplitude is used as the visual contrast sensitivity amplitude penalty loss. The above three terms are combined with... The adversarial classification loss is weighted and summed according to a preset weight coefficient to form a composite perceptual loss, which is used as the overall loss. If the current inner layer iteration number does not exceed the warm-up step number, the adversarial classification loss is used as the overall loss. In step S24, the gradient of the adversarial classification loss relative to the perturbation tensor in the current inner layer iteration is normalized by adding the sum of the absolute values ​​of all elements plus the numerical stability constant as the denominator. The normalized result is multiplied element-wise with the pixel-level adaptive momentum decay tensor and then accumulated into the momentum gradient tensor of the previous iteration to complete the momentum gradient update. In step S25, if the current inner layer iteration number is an integer multiple of the mask refresh interval, the sum of the absolute values ​​of the momentum gradients of each channel of each pixel is multiplied by a non-negative penalty factor. Calculate priority scores. The non-negative penalty factor is taken as the maximum value of the product of the penalty intensity coefficient and the visual sensitivity index of the pixel minus one and zero. The top several pixels with the highest scores in the whole image are taken to update the binary pixel selection mask. Step S26: Multiply the learning rate by the element-wise sign of the overall loss relative to the gradient of the perturbation tensor. Subtract the product only at the pixel position selected by the current binary pixel selection mask to update the perturbation tensor. Clip each element of the updated perturbation tensor to the positive and negative range of the current upper bound of the amplitude. Then multiply the clipped perturbation tensor with the current binary pixel selection mask element-wise to restore the sparsity constraint. Then add the perturbation tensor to the original digital image and clip it to the range of legal pixel values ​​to update the candidate adversarial samples.

[0009] Step S3: After the iteration terminates, the adversarial perturbation tensor is added element by element to the original digital image and cropped to the range of legal pixel values ​​to output the adversarial sample.

[0010] Compared with existing technologies, this invention systematically embeds the spatial frequency bandpass response characteristics of the human eye, described by the Mannos-Sakrison contrast sensitivity function, into the two core stages of the attack algorithm: pixel identification and perturbation optimization. This enables precise modeling and active control of the perception concealment of sparse adversarial attacks. The pixel-level adaptive momentum decay tensor enables high-frequency texture regions to achieve stronger gradient smoothing adapted to their visual sensitivity, thereby suppressing the interference of gradient noise on pixel priority ranking and improving the iterative stability of key pixel localization. The orientation consistency regularization loss constrains the orientation consistency of the perturbation vectors of adjacent selected pixels at the spatial structure level, the deep perceptual feature similarity loss maintains the multi-scale consistency between adversarial examples and the original image at the high-level semantic feature level, and the visual contrast sensitivity amplitude penalty loss applies differential suppression to the perturbation of sensitive areas of the human eye at the amplitude level. The three work together to enable the generated adversarial examples to simultaneously meet the perceptual concealment requirements in three dimensions: spatial structure, semantic content, and per-pixel amplitude. The staged optimization framework completely decouples momentum update from perceptual constraint gradient, avoiding the interference of perceptual constraint gradient on pixel importance evaluation. This allows the two subtasks of pixel identification and perturbation optimization to be driven by their respective most suitable gradient signals, achieving an overall balance between attack effectiveness and perceptual concealment under a fixed sparse pixel budget. Attached Figure Description

[0011] Figure 1 This is an overall flowchart of a momentum-stabilized local adversarial sample generation method based on human visual contrast sensitivity, according to an embodiment of the present invention. Detailed Implementation

[0012] To make the objectives, technical solutions, and advantages of the present invention clearer, a specific embodiment of the present invention will be described in detail below with reference to the accompanying drawings.

[0013] This embodiment provides a momentum-stabilized local adversarial example generation method based on human visual contrast sensitivity. For example... Figure 1 As shown, this method divides the attack process into a pre-computation stage and a multi-stage iterative optimization stage. The human visual sensitivity map serves as the unified perceptual constraint throughout the two stages. Through the coordinated advancement of outer annealing scheduling and inner pixel identification and perturbation optimization, sparse adversarial samples that are visually difficult to distinguish from the original image are generated.

[0014] In step S1, the raw digital image is received. and their corresponding real category labels With target deep learning classifier Original digital image This is a three-channel color image, with pixel values ​​normalized to the specified range. Spatial dimension is OK Column, number of channels For RGB images The adversarial perturbation tensor to be applied to the original image Initialize to A zero tensor of completely identical dimension will accumulate the momentum gradient tensor. Initialize to Zero tensors of completely identical dimensions;

[0015] The pre-computation phase is executed only once before the attack iteration begins, and its results remain constant throughout the entire attack. First, the original digital image... The red, green, and blue color channels are multiplied by standard luminance weighting factors of 0.299, 0.587, and 0.114 respectively, and then summed pixel by pixel to obtain the spatial dimension. grayscale image ;

[0016] Gabor filter banks are constructed based on the principle of multiple frequencies and multiple directions. This embodiment uses six normalized spatial frequencies, namely... , , , , , The unit is the number of cycles per pixel, and the four orientation angles are respectively , , , Pairwise combinations yield a total of 24 Gabor convolution kernels. For grayscale images... With each Gabor convolution kernel After performing a 2D convolution operation, the square of the response amplitude is taken to calculate the position of each pixel. In frequency Orientation Local frequency response energy under:

[0017]

[0018] in This represents a grayscale image obtained by converting the original digital image. Represents spatial frequency Orientation angle is Gabor convolution kernel, Represents a two-dimensional convolution operation. This represents the amplitude calculation. Represents the pixel position index. Represents frequency Orientation Next pixel The larger the value of the local frequency response energy at a pixel location, the stronger the local energy concentration at that pixel location in the corresponding frequency and direction.

[0019] To correlate spatial frequency parameters with the physiological perception characteristics of the human eye, the normalized spatial frequency, measured in periods per pixel, needs to be converted to a visual spatial frequency measured in periods per viewing angle. The conversion is based on the number of viewing angles per single pixel. The visual spatial frequency is determined by the standard viewing distance and pixel physical size as specified in the ITU Radiocommunication Sector BT.500-14 standard, and is calculated according to the following relationship:

[0020]

[0021] in This is the normalized spatial frequency, expressed in periods per pixel. This represents the viewing angle corresponding to a single pixel. This is the converted visual spatial frequency in terms of cycles per visual angle.

[0022] For each normalized spatial frequency, the corresponding contrast sensitivity value is calculated according to the Mannos-Sakrison parameterization:

[0023]

[0024] in To calculate the visual spatial frequency, Represents spatial frequency The corresponding contrast sensitivity values ​​are: 2.6 for the overall gain coefficient, 0.0192 for the low-frequency boost constant, 0.114 for the frequency linearity factor, and 1.1 for the power parameter of the exponential decay envelope. All four parameters are classic Mannos-Sakrison fitting parameters. This formula describes the bandpass response characteristics of human eye contrast sensitivity, which peaks in the mid-frequency range and monotonically decreases towards both low and high frequencies. The mid-frequency peak corresponds to the frequency range where the human eye is most sensitive to spatial details. Extremely low-frequency components are suppressed by visual adaptation mechanisms due to changes in overall image brightness, resulting in decreased sensitivity. Extremely high-frequency components are significantly less sensitive due to the resolution limits of the eye's optical system.

[0025] The contrast sensitivity values ​​calculated for all six spatial frequencies were normalized to their maximum values.

[0026]

[0027] in This is the normalized contrast sensitivity value. , To normalize the calculation results of the maximum contrast sensitivity in all six preset spatial frequencies, the weighting coefficients corresponding to each frequency are made to fall within the range. This makes it convenient to use as a coefficient in subsequent weighted summation;

[0028] Normalized contrast sensitivity value As weights, for each pixel The original visual sensitivity score of the pixel is obtained by weighted summing of the local frequency response energies across all 24 frequency orientations.

[0029]

[0030] in Representing pixels The original visual sensitivity score was summed by iterating through all 24 combinations of 6 spatial frequencies and 4 orientation angles. To calculate the normalized contrast sensitivity value, The calculated local frequency response energy is denoted as . The physical meaning is the degree to which local frequency components within the neighborhood of a pixel are concentrated in the frequency band sensitive to the human eye. The larger the value, the more concentrated the local frequency structure at that location is near the peak of the human visual response, and the easier it is for the human eye to detect when a perturbation is applied at that location;

[0031] The original visual sensitivity scores of each pixel in the entire image are normalized by the maximum value of the entire image to obtain the visual sensitivity index of each pixel:

[0032]

[0033] in For pixels Visual sensitivity index , To calculate the position of all pixels in the entire image Calculated raw visual sensitivity score The maximum value in, To prevent division-by-zero overflow when the maximum value of the entire graph approaches zero, a numerical stability constant is used. Take the smallest positive real number. The closer to 1, the better the pixel. The more concentrated the local frequency components in the neighborhood are in the mid-frequency band that the human eye is sensitive to, the easier it is to detect a perturbation applied at that location; The closer a value is to 0, the more likely the local frequency components at that location are primarily in the extremely low or high frequency ranges where the human eye is less sensitive. Therefore, perturbations applied at this location are relatively difficult for the human eye to detect. (Visual sensitivity map) The calculation is performed only once before the attack begins and remains constant throughout the entire attack iteration. All subsequent steps directly reference the pre-calculated result.

[0034] Based on visual sensitivity map Construct a pixel-level adaptive momentum decay tensor. For each pixel position... The visual sensitivity index of that pixel The interpolation parameter is the lower bound of the preset momentum decay coefficient. With the upper realm Perform linear interpolation between them:

[0035]

[0036] in Representing pixels The momentum decay coefficient at position, This is a preset lower bound for the momentum decay coefficient. As a preset upper bound for the momentum decay coefficient, it is required that ,and This ensures that the historical gradient weights decay in a bounded manner with each iteration, preventing unbounded accumulation. The momentum decay coefficient for all pixels. Together they constitute the spatial dimensions of the original digital image. and number of channels Completely consistent pixel-level adaptive momentum decay tensor Each channel shares the same spatial attenuation coefficient, which is broadcast along the channel dimension. The high visual sensitivity area is close to 1. tending towards the upper bound This is equivalent to applying a low-pass smoother with a lower cutoff frequency to the gradient sequence at that location, which suppresses gradient noise in high-frequency texture regions through stronger historical gradient accumulation, thereby improving the iterative stability of pixel priority scoring in that region. Low visual sensitivity area close to 0 trending towards the lower bound This allows the adversarial gradient signal to maintain a relatively fast response speed in this region, avoiding excessive smoothing suppression of the real adversarial signal. Unlike applying a uniform scalar decay to all pixels in the entire image, momentum decay is extended to pixel-level differentiated tensors, allowing the accumulation process to be finely adjusted according to the visual perception characteristics of different regions of the image. High-frequency texture regions and low-frequency smooth regions each obtain a smoothing intensity that matches their gradient noise level.

[0037] The initialization method of the binary pixel selection mask is based on the perturbation tensor. When the tensor is zero, the original digital image Input target deep learning classifier , in real category Calculate the adversarial classification loss for the perturbation tensor under the zero-perturbation state. The gradient is calculated by summing the absolute values ​​of the gradients across all color channels pixel by pixel to obtain an initial adversarial importance metric for each pixel location. The pixels are then sorted from largest to smallest metric, and the top-ranked pixels are grouped into the next most important. The mask elements corresponding to the specified pixel positions are set to 1, and the remaining positions are set to 0, forming the initial binary pixel selection mask. ,in The preset attack target pixel number hyperparameter allows all color channels at the same pixel location to be selected or excluded simultaneously.

[0038] In step S2, a multi-stage iterative optimization process is performed. This process consists of... The outer loop is composed of multiple outer loops, and each outer loop executes internally. The inner layer iteration promotes the coordinated evolution of pixel recognition and perturbation optimization.

[0039] Step S21 is executed at the beginning of each iteration of the outer loop. Let the current iteration number of the outer loop be... , Increasing from 1 to Update the upper bound of the current perturbation amplitude according to the following linear annealing rules. :

[0040]

[0041] in For the first The upper bound of the applicable disturbance amplitude in the outer layer cycle. The upper bound of the initial disturbance amplitude is... Amplitude constraints at that time To terminate the upper bound of the disturbance amplitude, i.e. Amplitude constraints at time, requiring , This represents the total number of outer loops. The resulting linear factor makes exist From 1 to From the process Decrease evenly to This achieves a gradual tightening strategy that transitions from global exploration under initially loose amplitude constraints to local refined search under stricter amplitude constraints, balancing the breadth of attack path search capability with the perceptibility and controllability of later perturbation amplitude.

[0042] Step S22 is executed at the beginning of each inner iteration. Let the current inner iteration number be... , Increasing from 1 to First, the current adversarial perturbation tensor With the original digital image Add each element one by one and truncate each element of the result to a specified interval. Candidate adversarial samples were obtained. ,Right now ,in This means truncating the value element by element to a range. The component truncation operation is then performed. Subsequently, candidate adversarial examples are... Input target deep learning classifier The category logical score vector is obtained. Its dimension is equal to the total number of categories. , For the first The logical score corresponding to the class. The adversarial classification loss adopts the confidence margin loss form:

[0043]

[0044] in Represents adversarial classification loss. For the real category The corresponding logical score, For all non-real categories The maximum value in the corresponding logical score, This is the confidence margin threshold hyperparameter. For When minimizing, the true class in the driver classifier output. The logic score is lower than the maximum non-true logic score by at least The gap is used to ensure that the final misclassification result has sufficient confidence and robustness, avoiding situations where attack success only occurs very close to the classification decision boundary, resulting in insufficient stability. Confidence margin threshold The larger the value, the higher the required confidence level for misclassification results. In practical applications, the confidence level can be set appropriately based on the attack scenario's requirements. value.

[0045] Step S23 is executed after step S22, which calculates the adversarial classification loss, in each inner iteration. This occurs when the current inner iteration number... Exceeding the preset preheating steps At that time, the composite perceptual loss, which includes three perceptual constraint terms, is calculated. Direction consistency regularization loss is also included. The calculation scope is limited to the current binary pixel selection mask. Selected set of pixels Within this range, calculate the cosine distance between cross-channel perturbation vectors for all pixel pairs that satisfy the spatial neighborhood constraint:

[0046]

[0047] in This represents the loss due to directional consistency regularization. A set of pixel pairs that satisfy the following conditions: pixels With pixels All belong to the current mask selection set And pixels With pixels Two-dimensional space coordinates and The difference does not exceed the pre-defined neighborhood radius in the sense of the infinite norm. ,Right now , The total number of pixel pairs that meet the conditions. For pixels A column vector consisting of perturbation components across all color channels. For pixels A column vector consisting of perturbation components across all color channels. Represents the dot product of vectors. The Euclidean norm of a vector. This is a numerical stability constant to prevent division-by-zero overflow when the norm of the perturbation vector approaches zero. The cosine distance, obtained by subtracting the cosine similarity from 1, ranges from [interval]. ,right Minimizing this process causes the cross-channel perturbation vectors of adjacent selected pixels to tend towards parallelism and the same direction. This suppresses the generation of disordered discrete noise patterns among neighboring pixels from a spatial structure perspective, eliminating visual artifacts similar to salt-and-pepper noise that are easily perceived by the human eye. Neighborhood radius This determines the spatial range of pixel pairs involved in the cosine distance calculation. The larger the value, the wider the range of constraints. A smaller value only constrains the directional consistency between immediately adjacent pixels. In practical applications, this can be adjusted based on the pixel budget. Adjust appropriately according to image resolution;

[0048] Deep-perception feature similarity loss captures high-level semantic and mid-level texture features that human vision is more sensitive to in perceiving image similarity by comparing the distance between candidate adversarial examples and the original image in the feature space of multiple intermediate layers of a pre-trained deep convolutional neural network.

[0049]

[0050] in Represents deep perception feature similarity loss, This represents a perceptual image patch similarity metric function, which measures the similarity of the original digital image patches. Adversarial Examples By extracting feature maps from each intermediate layer of a deep convolutional neural network pre-trained on a large-scale image dataset, and calculating the feature maps of each intermediate layer, the network is further optimized. and The normalized Euclidean distance between corresponding feature maps is obtained by weighting and summing the distances of all intermediate layers according to their layer weights. value. The smaller the value, the closer the candidate adversarial sample is to the original image in the multi-layer feature space of the pre-trained network, that is, the more consistent it is with the similarity judgment of human visual perception in high-level semantic expression and mid-level texture structure. This loss can constrain the overall perception quality in sparse perturbation scenarios and prevent perturbation optimization on fixed pixel subsets from causing excessive feature shift at the semantic level. Its consistency with human visual judgment is better than traditional pixel-level mean square error and other measures.

[0051] The calculation of visual contrast sensitivity magnitude penalty loss covers the current mask. For all selected pixels within the range, a penalty is applied to the perturbation amplitude of each selected pixel, weighted by its visual sensitivity index:

[0052]

[0053] in This represents the amplitude penalty loss for visual contrast sensitivity. Select the set of positions of the selected pixels in the mask for the current binary pixel. The total number of selected pixels. For the calculated pixels Visual sensitivity index For perturbation tensor In pixels Position color channel The component values ​​on, Get pixels The maximum absolute value of the perturbation component across all color channels is taken as the representative perturbation amplitude for that pixel. The minimization-driven optimization process applies stronger amplitude suppression to pixels with high visual sensitivity indices and allows relatively loose perturbation amplitudes to pixels with low visual sensitivity indices. This achieves pixel-by-pixel differentiated amplitude constraints based on the real perceptual characteristics of the human eye, directly controlling the perceptual cost within the allowable range of the human eye's sensitive frequency band at the amplitude level. This loss and the directional consistency constraint complement each other at the level of action. The former constrains the amplitude magnitude, while the latter constrains the directional distribution, together ensuring the perceptual concealment of the perturbation from different dimensions.

[0054] when Then, the three perceptual constraint losses and adversarial classification losses mentioned above are weighted and summed according to preset weight coefficients to form a composite perceptual loss as the overall loss:

[0055]

[0056] in The composite perceptual loss represents the overall optimization objective. To calculate the adversarial classification loss, , , These are the calculated direction consistency regularization loss, deep perception feature similarity loss, and visual contrast sensitivity magnitude penalty loss, respectively. , , These are the corresponding preset weight hyperparameters. By adjusting... , , It can control the relative weight of the three perceptual constraints in the composite target, thereby adjusting the trade-off between the constraint strength and attack effectiveness of the perturbation in the three dimensions of spatial coherence, semantic feature consistency, and visual amplitude. At that time, the total loss is only the adversarial classification loss, i.e. In this warm-up phase, the initial accumulation of momentum gradient is driven only by adversarial loss, providing a pure gradient direction reference that is not disturbed by perceptual constraints for the pixel identification phase. After the momentum gradient has been accumulated to statistical robustness through sufficient iterations, perceptual constraints are introduced for joint optimization after the number of warm-up steps is completed, so as to avoid perceptual constraints interfering with the pixel selection direction in advance before the momentum gradient has converged.

[0057] Step S24 is executed after step S23 in each inner iteration, completing the momentum gradient update for the current iteration. The momentum update process is entirely powered by adversarial classification loss. perturbation tensor gradient This approach, which does not introduce any gradients into the perceptual constraint loss term, ensures that momentum accumulation purely reflects the long-term cumulative effect of each pixel location on the model's decision boundary, maintaining complete decoupling from the perceptual loss gradient.

[0058]

[0059] in Representative after the first The momentum gradient tensor updated after the next inner iteration. The pixel-level adaptive momentum decay tensor constructed in step S1, This represents the element-wise multiplication operation between two tensors. For the first The momentum gradient tensor saved at the end of the innermost iteration, when hour For zero tensor, Representative adversarial classification loss For the current perturbation tensor The partial derivative tensor is the gradient. The L1 norm is the sum of the absolute values ​​of all elements of the gradient tensor. To prevent The numerical stability constant that causes division-to-zero overflow when approaching zero. In the formula... The term applies pixel-level differential decay to historical momentum: the historical momentum decay coefficient in visually sensitive regions tends towards the upper bound. This means that the accumulated weight of gradient history in this region is greater, and high-frequency gradient noise is effectively suppressed through more sufficient historical gradient averaging, making the momentum gradient magnitude of pixels in this region more reflective of the long-term stable contribution to model decision-making; the historical momentum decay coefficient of low visual sensitivity regions tends to the lower bound. This allows the new gradient information of the current iteration to be given greater weight in the region, maintaining a fast response to real adversarial gradient changes and ensuring that key pixels in the region are not masked by historical momentum smoothing. Divide by L1 norm plus The normalization term eliminates the influence of gradient magnitude differences between different iterations on the momentum accumulation ratio, ensuring that the contribution to momentum in each iteration remains stable in magnitude. The entire momentum update process is completely isolated from the gradient of the perceptual constraint loss, ensuring that the historical information accumulated by momentum always comes purely from the model's adversarial response and is not affected by the perceptual constraint optimization direction.

[0060] Step S25 is executed after each inner iteration step S24. When the number of inner iterations... Mask refresh interval When it is an integer multiple of the current momentum gradient tensor, based on the current momentum gradient tensor Calculate the position of each pixel in the entire image Priority scores are assigned, and the binary pixel selection mask is updated accordingly:

[0061]

[0062] in Representing pixels Priority rating, Represents the momentum gradient tensor In pixels Position all color channels The summation of the upper amplitude values ​​reflects the accumulated adversarial gradient strength at that pixel location. To control the hyperparameter of contrast sensitivity penalty intensity, For the calculated pixels Visual sensitivity index To compare the sensitivity penalty factor, when When the penalty factor is set to zero, the pixel score is reset to zero. Time penalty factor is A linear discount is applied to the momentum gradient score, with the penalty factor always non-negative to ensure the score remains non-negative. Pixels with higher visual sensitivity indices receive a greater discount on their priority score, and are less likely to be selected into the mask under the same momentum gradient magnitude. This guides the attack algorithm to preferentially apply sparse perturbations to low visual sensitivity regions where the human eye is insensitive, prioritizing the inclusion of pixel locations with lower perceptual costs into the attack set. Sort all pixels in the entire image from largest to smallest, and then select the pixels with the highest scores. Set the mask element corresponding to the specified pixel position to 1, and set the rest to 0, then update the binary pixel selection mask. .when Not for When the mask is an integer multiple of the number of times ... The previous update result is maintained to ensure the directional stability of the search trajectory across several iterations, preventing perturbation optimization from failing to achieve sufficient refinement on a fixed subset of pixels due to frequent mask switching. Mask refresh interval. The setting needs to balance the continuity of the search trajectory with the ability to respond to dynamic changes in locally sensitive structures; too small a value will result in a loss of responsiveness. Weakening search continuity, excessive size To reduce dynamic adaptability, in practical applications, the total number of inner layer iterations can be used as a reference. Make appropriate adjustments.

[0063] Step S26 is executed after step S25 in each inner iteration, completing the update of the perturbation tensor for the current iteration. This is based on the current total loss. perturbation tensor gradient The element-wise sign direction is update-driven, based on the learning rate. After scaling, only the mask is selected for the current binary pixel. Subtract the scaling amount from the selected pixel location:

[0064]

[0065] in The learning rate hyperparameter, Total loss perturbation tensor gradient, For element-wise sign removal function, Choose a mask for the current binary pixel. For element-wise multiplication, this update only applies to the mask. A gradient sign-driven update is applied to the pixel position with an element value of 1, while the pixel positions outside the mask are updated accordingly. The value is 0 and remains unchanged in this update;

[0066] Then, the updated perturbation tensor Each element value is clipped to the upper bound of the current amplitude. Within the positive and negative range:

[0067]

[0068] in This means truncating the values ​​of each element of the tensor to an interval. Component truncation operation within. For the current outer loop cycle Based on the calculated upper bound of the perturbation amplitude, this operation ensures that the amplitude of each element of the perturbation tensor does not exceed the current maximum perturbation intensity, thus achieving a global uniform constraint on the absolute amplitude of the perturbation of each selected pixel.

[0069] The trimmed perturbation tensor Select mask with current binary pixels Perform element-wise multiplication to reset the perturbation values ​​at non-selected pixel locations to zero, thus restoring the sparse constraint:

[0070]

[0071] in This represents element-wise multiplication, an operation that ensures that after each perturbation update and pruning, the perturbation tensor contains only the mask. Selected Only one pixel position retains a non-zero value, while the rest are strictly zeroed, ensuring that the perturbation always satisfies the L0 norm not exceeding [a certain value]. The sparse constraints are applied. After processing, the perturbation is superimposed on the original image again and cropped to the legal pixel range to update the candidate adversarial examples. ,Right now This serves as the final result of this inner layer iteration.

[0072] When the inner loop is in the current iteration of the outer loop Complete execution After the first iteration, proceed to the next outer loop iteration. Based on the updated upper bound of the disturbance amplitude Continue executing the inner loop iteration, repeating this process until all iterations are completed. Outer loop. Throughout the entire iteration, whenever a candidate adversarial example... Make the target deep learning classifier Predicted category and true category If there is a discrepancy, the attack is considered successful. At this point, the loop can be terminated early to save computational resources, and the current perturbation tensor and the corresponding candidate adversarial sample are recorded as the attack result output.

[0073] In step S3, after the iteration process has completely terminated, the final saved adversarial perturbation tensor is... With the original digital image Add element by element and crop the result to the range of valid pixel values. Output the final adversarial sample ,Right now If the attack is successful during the iteration, the candidate adversarial sample with the lowest perceptual cost among the recorded candidate adversarial samples is output; if the attack is not successful by the end of the iteration, the candidate adversarial sample generated in the last iteration is output.

[0074] This invention achieves frequency-aware pixel-level adaptive gradient smoothing through the above steps, particularly by embedding the pixel-level visual sensitivity map constructed using the Mannos-Sakrison contrast sensitivity function into the two stages of pre-computed momentum decay tensor construction and mask refresh scoring during the optimization phase. By fusing a composite perceptual loss constrained by three factors—directional consistency regularization, deep perceptual feature similarity, and visual contrast sensitivity magnitude penalty—it collaboratively controls the spatial direction distribution and pixel-by-pixel magnitude shape of perturbations on a fixed sparse pixel subset. By completely decoupling momentum updates from perceptual constraint gradients, it ensures the purity and iterative stability of pixel importance assessment.

[0075] The above embodiments are merely one specific implementation of the present invention and are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, without departing from the core idea of ​​the present invention, equivalent substitutions or adaptive adjustments can be made to specific parameter values, the selection of the frequency and number of Gabor filter banks, the normalization method of the visual sensitivity index, the setting of the weight hyperparameters in the composite loss function, the determination of the number of warm-up steps and the mask refresh interval, and the outer annealing scheduling strategy, etc., and all such changes should be included within the scope of protection of the present invention.

Claims

1. A method for generating momentum-stabilized local adversarial examples based on human visual contrast sensitivity, characterized in that, Includes the following steps: Step S1: Receive the original digital image and the target deep learning classifier. Initialize both the adversarial perturbation tensor and the momentum accumulation gradient tensor to zero tensors of the same dimension as the original digital image. Convert the original digital image to a grayscale image using the standard brightness weighting formula. Construct corresponding Gabor convolution kernels using 24 combinations of 6 preset normalized spatial frequencies and 4 preset orientation angle parameters. Calculate the square of the convolution response amplitude of the grayscale image and each Gabor convolution kernel to obtain the local frequency response energy of each pixel position under each frequency orientation combination. Based on the Mannos-Sakrison parameterization form, convert each normalized spatial frequency into a visual spatial frequency in units of periods per viewing angle, calculate the corresponding contrast sensitivity value, and normalize the maximum value of all contrast sensitivity values. Using the normalized contrast sensitivity value as the weight, the local frequency response energy of each pixel in all 24 frequency orientation combinations is weighted and summed, and then the maximum value of the whole image is normalized to obtain the visual sensitivity index of each pixel. Using the visual sensitivity index of each pixel as the interpolation parameter, linear interpolation is performed between the lower and upper bounds of the preset momentum decay coefficient to construct a pixel-level adaptive momentum decay tensor with the same spatial dimension and number of channels as the original digital image, where the upper bound is strictly less than 1; sorted by the sum of the full-channel amplitudes of the gradient of the adversarial classification loss output by the target deep learning classifier in the perturbation zero state relative to the perturbation tensor, and the top-ranked pixels are selected to initialize the binary pixel selection mask; Step S2 involves annealing scheduling of the upper bound of the disturbance amplitude controlled by the outer loop, and performing a fixed number of inner loop iterations within the outer loop to achieve the coordinated advancement of pixel identification and disturbance optimization. Step S3: After the iteration terminates, the adversarial perturbation tensor is added element by element to the original digital image and cropped to the range of legal pixel values ​​to output the adversarial sample.

2. The method according to claim 1, characterized in that, In step S2, the iterative optimization process includes the following sub-steps: Step S21: At the beginning of each outer loop, perform linear annealing update on the upper bound of the disturbance amplitude according to the current outer loop cycle, so that it monotonically decreases from the initial upper bound of the amplitude as the outer loop cycle increases to the final upper bound of the amplitude. Step S22: Add the current adversarial perturbation tensor to the original digital image element by element and then crop it to the range of legal pixel values ​​to obtain candidate adversarial samples. Input the candidate adversarial samples into the target deep learning classifier and take the difference between the true class corresponding value and the maximum value among all non-true classes in the output logical score vector of the classifier, plus the negative number of the confidence margin threshold, as the adversarial classification loss. Step S23: If the current inner layer iteration count exceeds the preset warm-up step count, within the current binary pixel selection mask range, calculate the mean cosine distance of the cross-channel perturbation vector for all selected pixel pairs whose spatial distance does not exceed the preset neighborhood radius as the directional consistency regularization loss. Use the sum of the distances between the candidate adversarial samples and the original image feature map of multiple intermediate layers of the pre-trained deep convolutional network as the deep perception feature similarity loss. Use the mean of the product of the visual sensitivity index of all selected pixels in the current mask and the maximum cross-channel perturbation amplitude as the visual contrast sensitivity amplitude penalty loss. Weight the above three items with the adversarial classification loss according to the preset weight coefficient to form a composite perception loss, and use the composite perception loss as the overall loss. If the current inner layer iteration count does not exceed the warm-up step count, use the adversarial classification loss as the overall loss. Step S24: Normalize the gradient of the adversarial classification loss relative to the perturbation tensor in the current inner iteration with the sum of the absolute values ​​of all elements plus the numerical stability constant as the denominator. Multiply the normalized result element by element with the pixel-level adaptive momentum decay tensor and add it to the momentum gradient tensor of the previous iteration to complete the momentum gradient update. Step S25: If the current inner layer iteration number is an integer multiple of the mask refresh interval, calculate the priority score for each pixel by multiplying the sum of the absolute values ​​of the momentum gradients of each channel by a non-negative penalty factor. The non-negative penalty factor is the maximum value of the product of the penalty intensity coefficient and the visual sensitivity index of the pixel and zero. The top few pixels with the highest scores in the whole image are selected to update the binary pixel selection mask. Step S26: Multiply the learning rate element-wise by the overall loss relative to the gradient of the perturbation tensor, and subtract the product only at the pixel position selected by the current binary pixel selection mask to update the perturbation tensor. Clip each element of the updated perturbation tensor to the positive and negative range of the current upper bound of the amplitude. Then multiply the clipped perturbation tensor element-wise with the current binary pixel selection mask to restore the sparsity constraint. Finally, add the perturbation tensor to the original digital image and clip it to the range of legal pixel values ​​to update the candidate adversarial samples.

3. The method according to claim 1, characterized in that, In step S1, the six normalized spatial frequencies are 0.05, 0.1, 0.15, 0.2, 0.3, and 0.4 periods per pixel, and the four orientation angles are 0 degrees, 45 degrees, 90 degrees, and 135 degrees, respectively, to construct a total of 24 Gabor convolution kernels; The visual spatial frequency conversion method corresponding to each spatial frequency is as follows: divide the normalized spatial frequency by the number of viewing angles corresponding to a single pixel to obtain the visual spatial frequency in units of the number of viewing angle cycles. The number of viewing angles per single pixel is determined according to the standard viewing distance specified by the ITU Radiocommunication Sector BT.500-14 standard. The Mannos-Sakrison contrast sensitivity value is obtained by multiplying an increasing factor composed of a linear function of the visual spatial frequency with a decay envelope exponentiated by a power of the visual spatial frequency. The resulting curve shows a peak in the mid-frequency band and decreases monotonically towards the low and high frequencies, reflecting the bandpass response characteristics of the human eye.

4. The method according to claim 1, characterized in that, In step S1, the values ​​of each element of the pixel-level adaptive momentum decay tensor are uniquely determined by the visual sensitivity index of that pixel location. The momentum decay coefficient of a pixel with a visual sensitivity index of zero is equal to a preset lower bound, and the momentum decay coefficient of a pixel with a visual sensitivity index of 1 is equal to a preset upper bound. The two have a linear relationship, and the upper bound is strictly less than 1 to avoid the unbounded accumulation of historical gradient weights. The momentum decay coefficient of high visual sensitivity regions tends to the upper bound, which is equivalent to applying a stronger low-pass smoothing to the gradient sequence of that region to suppress gradient noise. The momentum decay coefficient of low visual sensitivity regions tends to the lower bound to maintain a fast response to new gradient signals.

5. The method according to claim 2, characterized in that, In step S24, the momentum gradient update takes only the gradient of the adversarial classification loss as input and does not introduce the gradient of any perceptual constraint loss term. This ensures that the momentum accumulation process strictly reflects the long-term cumulative contribution of each pixel position to the model's classification decision boundary, and is completely decoupled from the perceptual loss gradient, thereby guaranteeing the purity and iterative stability of pixel importance assessment.

6. The method according to claim 2, characterized in that, In step S25, the pixel priority scoring applies a full discount to pixels whose visual sensitivity index is higher than the reciprocal of the penalty intensity coefficient, reducing their score to zero. Pixels whose visual sensitivity index is between zero and the reciprocal of the penalty intensity coefficient apply a linear discount proportional to the visual sensitivity index. Pixels whose visual sensitivity index is zero are not subject to any discount. Thus, under the same momentum gradient magnitude, the mask is guided to preferentially cover low-frequency region pixels that are not sensitive to the human eye.

7. The method according to claim 2, characterized in that, In step S23, the calculation range of the direction consistency regularization loss is all pixel pairs within the current binary pixel selection mask that meet the following conditions: both pixels belong to the current mask selection set, and the distance between the two-dimensional spatial coordinates of the two pixels in the sense of infinite norm does not exceed the preset neighborhood radius; for each pair of pixels that meet the conditions, the cosine similarity between the two perturbation vectors across all color channels is calculated with the numerical stability constant to prevent division by zero, and the cosine distance is obtained by subtracting the cosine similarity from 1. The average cosine distance of all pixel pairs that meet the conditions is calculated to obtain the direction consistency regularization loss value; when this loss is minimized, it promotes the perturbation vectors of adjacent selected pixels to tend to be parallel and in the same direction, and suppresses the discrete perturbation mode with disordered direction.

8. The method according to claim 2, characterized in that, In step S23, the calculation range of the visual contrast sensitivity amplitude penalty loss is all selected pixels within the current binary pixel selection mask; for each selected pixel, the product of the maximum value of the absolute value of the perturbation component in all color channels and the visual sensitivity index of the pixel is taken, and the product of all selected pixels is summed and divided by the total number of selected pixels to obtain the amplitude penalty loss value. Pixels with high visual sensitivity index are more strongly suppressed in the amplitude optimization direction, while pixels with low visual sensitivity index are allowed relatively loose perturbation amplitudes, so that amplitude constraints are differentiated among selected pixels with perceptual priority as the weight.

9. The method according to claim 2, characterized in that, In step S26, when updating the perturbation tensor, only the gradient sign-driven update is applied to the selected pixel position of the current binary pixel selection mask, and the perturbation value of the pixel position outside the mask remains unchanged. After the update, the element is truncated to the positive and negative range of the current upper bound of the amplitude through the amplitude clipping operation. After clipping, it is multiplied with the current binary pixel selection mask element by element again to set the perturbation of the non-selected position to zero, ensuring that the perturbation is always strictly kept within the sparse subset defined by the mask throughout the entire optimization process.

10. A momentum-stabilized local adversarial example generation system based on human visual contrast sensitivity, characterized in that, The system is configured to perform the method as described in any one of claims 1 to 9; the system includes a pre-computation module and an iterative optimization module, the pre-computation module being configured to perform grayscale conversion, Gabor filter response energy calculation, contrast sensitivity weighted summation and normalization, visual sensitivity map full-image normalization, pixel-level adaptive momentum decay tensor construction, and binary pixel selection mask initialization in step S1. The iterative optimization module is configured to execute all sub-steps in step S2, including perturbation amplitude upper bound annealing update, candidate adversarial sample generation and adversarial classification loss calculation, composite sensing loss formation and overall loss switching, momentum gradient normalization cumulative update, binary pixel selection mask periodic refresh, and perturbation tensor update pruning and sparse constraint recovery.

Images