An adversarial sample generation method based on gradient guided sampling corrected by second-order curvature information
Patent Information
- Application Number
- CN202611024177.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-10
- Publication Date
- 2026-09-25
AI Technical Summary
[0005]（1）过拟合与局部极值问题：传统的基于梯度的攻击方法（如FGSM、MI-FGSM）倾向于贪婪地寻找当前模型的损失最大化方向
[0044]（1）本发明通过构造基于随机向量的二阶曲率正则项，显式地惩罚尖锐极值，能够引导对抗样本落到平坦极大值区域，提升迁移性。
Smart Images
Figure CN122819359A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of machine learning, and more particularly to an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction. Background Technology
[0002] In recent years, deep neural networks (DNNs) have made groundbreaking progress in computer vision tasks, but their application in security-sensitive fields still faces severe challenges. Research has found that DNNs are extremely vulnerable to small perturbations in the input data; that is, by superimposing adversarial perturbations that are imperceptible to human vision onto the original image, the model can be induced to produce high-confidence erroneous predictions. This characteristic exists not only in white-box attack scenarios (where model parameters are known) but also exhibits "transferability" in black-box attack scenarios (where the model structure is unknown), meaning that adversarial examples generated against a certain alternative model can often also deceive other target models with unknown structures.
[0003] The above phenomena indicate that generating highly transferable adversarial examples is a key means of systematically discovering and verifying the vulnerabilities of deep models. By constructing adversarial examples that can transfer across models, it is possible to effectively detect weaknesses in the decision boundaries of a model without knowing the internal information of the target model. This provides valuable test benchmarks and optimization directions for the design and effectiveness evaluation of defense mechanisms such as adversarial training, input denoising, and model hardening.
[0004] To improve the transferability of adversarial examples, existing techniques mainly fall into two categories: momentum-based optimization methods and input transformation-based methods. However, these methods have the following limitations in practical applications:
[0005] (1) Overfitting and Local Extrema Problem: Traditional gradient-based attack methods (such as FGSM and MI-FGSM) tend to greedily search for the direction that maximizes the loss of the current model. This strategy can easily lead to adversarial examples getting stuck in sharp local extrema on the loss surface. Although these extrema show a high success rate of attack on alternative models, the sharp extrema are very sensitive to parameter changes, which leads to a significant decrease in their attack performance on cross-architecture models (such as transferring from CNN to Transformer).
[0006] (2) Insufficient utilization of second-order information: Theoretical studies have shown that adversarial examples at flat maxima have better generalization ability. However, directly calculating the Hessian matrix to obtain curvature information is computationally infeasible (the computational complexity is too high). Although methods such as NHTR attempt to introduce second-order information, existing implementations often rely on specific gradient directions for differencing. This deterministic direction selection limits the comprehensive exploration of the geometric features of the loss surface.
[0007] (3) Low sampling efficiency: In order to escape local extrema, some methods have introduced random sampling strategies. However, unguided random sampling is extremely inefficient and it is difficult to find the optimal attack direction within a limited number of attack steps. Although existing gradient-guided sampling methods introduce a guiding mechanism, they lack explicit constraints on the second curvature, which means that the generated samples may still be located in sharp regions. Summary of the Invention
[0008] This invention provides an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction, aiming to efficiently generate adversarial examples with high transferability. The adversarial examples generated by this method can serve as an effective tool for verifying the robustness of deep models, providing important basis for the formulation of defense strategies and model improvement.
[0009] The technical solution adopted in this invention is: an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction, which includes the following steps:
[0010] Step 1: Construct an adversarial example generation environment and initialize parameters: Obtain alternative models Original input image and their corresponding real category labels And set the attack hyperparameters;
[0011] Step 2: Calculate the second-order curvature gradient based on random vector differencing in each iteration: In each outer loop iteration of adversarial example generation, the second-order curvature gradient reflecting the flatness of the loss surface is approximated using random perturbation and the finite difference method. ;
[0012] Step 3: Calculate the first-order attack gradient based on guided sampling: Perform multiple inner loop samplings in each outer loop iteration, using historical gradient information to guide the current neighborhood sampling direction, calculate and accumulate the classification loss gradient, and obtain the first-order attack gradient. ;
[0013] Step 4: Calculate the adaptive balance coefficients and fuse the gradients: Calculate the first-order attack gradient. With second-order curvature gradient Amplitude statistics are used to construct adaptive balance coefficients. And generate the final update gradient. ;
[0014] Step 5: Momentum Iteration Update of Adversarial Examples: Update the adversarial perturbation using the momentum iteration algorithm to generate new adversarial examples.
[0015] Furthermore, in step 1, the attack hyperparameters include: the number of iterations T, the momentum decay factor, etc. Single-step attack stride Maximum disturbance amplitude Number of samples in the inner loop Sampling radius Curvature regularization weight coefficient and differential step size .
[0016] Furthermore, step 2 includes:
[0017] Step 201: Generate a version of the original input image Consistent dimension random probe vector ,vector The elements follow a normal distribution;
[0018] Step 202: Adversarial example images generated in the previous iteration Centered on the random probe vector Apply differential step sizes in the positive and negative directions respectively. The first detection point was obtained. Second detection point :
[0019] ; ;
[0020] in, This is the number of iterations for the outer loop, initially set to 1. Set as ;
[0021] Step 203: Input the two probe points into the model Calculate its targeting of real labels The classification loss value is calculated, and the curvature regularization term is obtained by summing the results. ;
[0022] Step 204: Regularize the curvature term About the current sample Taking the derivative, we obtain the second-order curvature gradient. .
[0023] Furthermore, step 3 includes:
[0024] Step 301: In the first In each inner loop sampling, a uniformly distributed basic random noise is generated. ,in , ;
[0025] Obtain the sign of the gradient direction calculated in the previous inner loop. ;like This is the first inner loop sampling, and no sign guidance is performed.
[0026] Step 302: Utilize the gradient direction sign For basic random noise Correction, generating guiding noise ;
[0027] when hour, ;
[0028] when hour, ;
[0029] Guide noise Superimposed on the current adversarial example to generate neighborhood sampling samples ;
[0030] Step 303: Calculate neighborhood sampling samples Classification loss gradient and in After the inner loop completes, the arithmetic mean of the gradients is calculated to obtain the first-order attack gradient. .
[0031] Furthermore, step 4 includes:
[0032] Step 401: Calculate separately and The absolute value of the mean is denoted as . and ;
[0033] Step 402: Calculate the adaptive balance coefficient : ,in, A preset constant is used to prevent division by zero;
[0034] Step 403: Utilizing the balance coefficient and curvature regularization coefficient The second-order curvature gradient Weighted fusion into first-order attack gradient In the process, the final update gradient is obtained: .
[0035] Furthermore, step 5 includes:
[0036] Step 501: Update gradients using the final update Update cumulative momentum : ; where the initial value of the accumulated momentum =0;
[0037] Step 502: Based on the current accumulated momentum Sign direction update against perturbation and using the truncation function Limit the disturbance to a preset value. Within the norm sphere:
[0038]
[0039] Among them, the initial value for resisting disturbances =0;
[0040] Step 503: Apply the current counter-perturbation Superimposed onto the original input image The values are then truncated to a valid range of pixel values to obtain the adversarial sample generated in the current iteration. This continues until the preset number of iterations is reached, yielding the final adversarial example. .
[0041] In another aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction provided by the present invention.
[0042] The present invention also provides a computer-readable storage medium storing a computer program / instruction that, when executed by a processor, implements an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction provided by the present invention.
[0043] The technical solution provided by this invention brings at least the following beneficial effects:
[0044] (1) By constructing a second-order curvature regularization term based on random vectors, this invention explicitly punishes sharp extrema, which can guide adversarial samples to fall into flat maxima regions and improve mobility.
[0045] (2) This invention combines historical gradient-guided inner loop sampling to ensure the search efficiency of the attack. Through an adaptive gradient fusion mechanism, the first-order attack power and the second-order flatness constraint are balanced.
[0046] (3) This invention is easy to reproduce, does not require setting complex parameters, has low basic hardware requirements, and does not require complex additional adjustments. Attached Figure Description
[0047] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0048] Figure 1 A flowchart of an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction provided in an embodiment of the present invention;
[0049] Figure 2 The original image used in this embodiment of the invention;
[0050] Figure 3 In this embodiment of the invention, the adversarial sample image is obtained by generating adversarial samples from the original image.
[0051] Figure 4 This is the result of classifying the original image and adversarial sample image using a classification model in an embodiment of the present invention.
[0052] Figure 5 and Figure 6 In this embodiment of the invention, loss surfaces are drawn on the generated adversarial samples along two random directions on the proxy model for visualization. Detailed Implementation
[0053] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be described in detail and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Generally, the components of the embodiments of the present invention described and shown in the accompanying drawings can be arranged and designed using different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of the present invention.
[0054] This invention provides an adversarial example generation method based on gradient-guided sampling with second-order curvature information correction. This addresses the problems of adversarial example generation methods easily getting trapped in sharp local extrema and having weak cross-model transferability. The method guides adversarial examples into flat maxima regions to obtain adversarial examples with high transferability. This invention explicitly penalizes sharp extrema by constructing a second-order curvature regularization term based on random vectors; simultaneously, it combines historical gradient-guided inner loop sampling to ensure the efficiency of attack search; and it balances first-order attack power with second-order flatness constraints through an adaptive gradient fusion mechanism.
[0055] See Figure 1 The specific implementation steps of this embodiment of the invention include:
[0056] Step 1: Build the adversarial example generation environment and initialize parameters
[0057] Obtaining alternative models Original input image and their corresponding real category labels And set the attack hyperparameters.
[0058] In this embodiment, the original input image like Figure 2 As shown, it includes four different objects;
[0059] In this embodiment, step 1 includes the following sub-steps:
[0060] Step 101: Load the alternative model Set the number of iterations T=10 and the momentum decay factor. Single-step attack stride Maximum disturbance amplitude Number of samples in the inner loop Sampling radius Curvature regularization weight coefficient and differential step size ;
[0061] Step 102: Initialize the anti-disturbance adversarial examples Accumulated momentum ;
[0062] Step 2: Calculate the second-order curvature gradient based on random vector differences in each iteration;
[0063] In each iteration of the outer loop for generating adversarial examples, the second-order curvature gradient reflecting the flatness of the loss surface is approximated using random perturbation and the finite difference method. ;
[0064] In this embodiment, step 2 includes the following sub-steps:
[0065] Step 201: Generate a random probe vector with the same dimensions as the input image. The elements of this vector follow a standard normal distribution;
[0066] Step 202: Adversarial example images generated in the previous iteration Centered on the random probe vector Apply differential step sizes in the positive and negative directions respectively. The first detection point was obtained. Second detection point The calculation formula is as follows:
[0067] (1)
[0068] (2)
[0069] Step 203: Input the two probe points into the model Calculate its targeting of real labels The classification loss value is calculated, and the curvature regularization term is obtained by summing the results. This term approximately represents the trace of the Hessian matrix of the loss function, and its calculation formula is as follows:
[0070] (3)
[0071] Step 204: Regularize the curvature term About the current sample Taking the derivative, we obtain the second-order curvature gradient. :
[0072] (4)
[0073] Step 3: Calculate the first-order attack gradient based on guided sampling;
[0074] Execute in each iteration of the outer loop In the next inner loop sampling, historical gradient information is used to guide the current neighborhood sampling direction, and the classification loss gradient is calculated and accumulated to obtain the first-order attack gradient. ;
[0075] In this embodiment, step 3 includes the following sub-steps:
[0076] Step 301: In the first In the second inner loop sampling ( Generates a basic random noise that follows a uniform distribution. Its numerical range is determined by the sampling radius. Decide:
[0077] (5)
[0078] And obtain the gradient direction sign obtained from the previous inner loop calculation. ;like This is the first inner loop sampling, without sign guidance;
[0079] Step 302: Correct the basic random noise using the gradient direction sign to generate guiding noise. ;
[0080] when At that time, the guided noise is directly equal to the fundamental random noise (i.e., );
[0081] when At this time, the direction of the noise is aligned with the ascending direction of the previous gradient, so that the sampling points tend to be distributed in the ascending direction of the gradient. The calculation formula is as follows:
[0082] (6)
[0083] Subsequently, guiding noise is superimposed onto the current adversarial example to generate neighborhood sampling samples. :
[0084] (7)
[0085] Step 303: Calculate the classification loss gradient of the neighborhood sampled samples. and in After each iteration, the arithmetic mean of the gradients is calculated to obtain the first-order attack gradient. :
[0086] (8)
[0087] Step 4: Calculate the adaptive balancing coefficients and fuse the gradients;
[0088] Calculate the magnitude statistics of the first-order main attack gradient and the second-order curvature gradient, and construct an adaptive balance coefficient. And generate the final update gradient. ;
[0089] In this embodiment, step 4 includes the following sub-steps:
[0090] Step 401: Calculate separately and The absolute value of the mean is denoted as . and ;
[0091] Step 402: Calculate the adaptive balance coefficient This coefficient is used to normalize the magnitude of the second-order gradient to the level of the first-order gradient, as shown in the following formula:
[0092] (9)
[0093] in, To prevent small constants from being divided by zero, take ;
[0094] Step 403: Utilize the aforementioned balance coefficient and curvature regularization coefficient The second-order curvature gradient is weighted and fused into the first-order attack gradient to obtain the final update gradient. :
[0095] (10)
[0096] Step 5: Iterative update of momentum for adversarial examples.
[0097] The momentum iteration algorithm is used to update the adversarial perturbation and generate new adversarial examples;
[0098] In this embodiment, step 5 includes the following sub-steps:
[0099] Step 501: Update gradients using the final update Update cumulative momentum :
[0100] (11)
[0101] Step 502: Update the anti-disturbance based on the sign and direction of the accumulated momentum. and using the truncation function Limit the disturbance to a preset value. Within the norm sphere:
[0102] (12)
[0103] Step 503: Superimpose the updated perturbation onto the original image and truncate it to the valid pixel value range to obtain the adversarial example generated in the current iteration. This continues until the preset number of iterations is reached, yielding the final adversarial example. ,like Figure 3 As shown, the calculation formula is as follows:
[0104] (13)
[0105] The comparison results between this embodiment and existing advanced adversarial example generation algorithms are shown in Table 1:
[0106] Table 1
[0107]
[0108] The experiment selected the NIPS 2017 ImageNet-Compatible dataset and used ResNet-50, DenseNet-121, and Inception-v3 as white-box replacement models. Adversarial examples were generated on these models respectively. The Attack Success Rate (ASR) was used as the core evaluation metric, which is the proportion of adversarial examples that are misclassified on the target model.
[0109] A classification model is used to classify the original image and the adversarial example image. The classification model misclassifies the adversarial example image generated in this instance, thus the adversarial example is successfully generated. Figure 4As shown. The adversarial examples generated in this embodiment can mislead the model, effectively detect the weak links in the decision boundaries of different architecture models, verify the vulnerability of the target model under unknown attacks, and serve as an effective tool for verifying the robustness of deep models, providing support for the formulation and improvement of defense strategies;
[0110] To further verify the effectiveness of this example, this implementation plots loss surfaces on the proxy model along two random directions and visualizes the loss surfaces, as shown below. Figure 5 and Figure 6 As shown in the example, this instance allows the adversarial example to reach a flat maximum region, demonstrating strong adversarial sample mobility.
[0111] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
[0112] The above descriptions are merely some embodiments of the present invention. Those skilled in the art can make various modifications and improvements without departing from the inventive concept of the present invention, and these all fall within the scope of protection of the present invention.
Claims
1. A method for generating adversarial examples based on gradient-guided sampling with second-order curvature information correction, characterized in that, Includes the following steps: Step 1: Construct an adversarial example generation environment and initialize parameters: Obtain alternative models Original input image and their corresponding real category labels And set the attack hyperparameters; Step 2: Calculate the second-order curvature gradient based on random vector differencing in each iteration: In each outer loop iteration of adversarial example generation, the second-order curvature gradient reflecting the flatness of the loss surface is approximated using random perturbation and the finite difference method. ; Step 3: Calculate the first-order attack gradient based on guided sampling: Perform multiple inner loop samplings in each outer loop iteration, using historical gradient information to guide the current neighborhood sampling direction, calculate and accumulate the classification loss gradient, and obtain the first-order attack gradient. ; Step 4: Calculate the adaptive balance coefficients and fuse the gradients: Calculate the first-order attack gradient. With second-order curvature gradient Amplitude statistics are used to construct adaptive balance coefficients. And generate the final update gradient. ; Step 5: Momentum Iteration Update of Adversarial Examples: Update the adversarial perturbation using the momentum iteration algorithm to generate new adversarial examples.
2. The method as described in claim 1, characterized in that, In step 1, the attack hyperparameters include: number of iterations T, momentum decay factor. Single-step attack stride Maximum disturbance amplitude Number of samples in the inner loop Sampling radius Curvature regularization weight coefficient Sum and difference step size .
3. The method as described in claim 2, characterized in that, Step 2 includes: Step 201: Generate a version of the original input image Consistent dimension random probe vector ,vector The elements follow a normal distribution; Step 202: Adversarial example images generated in the previous iteration Centered on the random probe vector Apply differential step sizes in the positive and negative directions respectively. The first detection point was obtained. Second detection point : ； ； in, This is the number of iterations for the outer loop, initially set to 1. Set as ; Step 203: Input the two probe points into the model Calculate its targeting of real labels The classification loss value is calculated, and the curvature regularization term is obtained by summing the results. ; Step 204: Regularize the curvature term About the current sample Taking the derivative, we obtain the second-order curvature gradient. .
4. The method as described in claim 2, characterized in that, Step 3 includes: Step 301: In the first In each inner loop sampling, a uniformly distributed basic random noise is generated. ,in , ; Obtain the sign of the gradient direction calculated in the previous inner loop. ;like This is the first inner loop sampling, and no sign guidance is performed. Step 302: Utilize the gradient direction sign For basic random noise Correction, generating guiding noise ; when hour, ; when hour, ; Guide noise Superimposed on the current adversarial example to generate neighborhood sampling samples ; Step 303: Calculate neighborhood sampling samples Classification loss gradient and in After the inner loop completes, the arithmetic mean of the gradients is calculated to obtain the first-order attack gradient. .
5. The method as described in claim 2, characterized in that, Step 4 includes: Step 401: Calculate separately and The absolute value of the mean is denoted as . and ; Step 402: Calculate the adaptive balance coefficient : ,in, A preset constant is used to prevent division by zero; Step 403: Utilizing the balance coefficient and curvature regularization coefficient The second-order curvature gradient Weighted fusion into first-order attack gradient In the process, the final update gradient is obtained: .
6. The method as described in claim 2, characterized in that, Step 5 includes: Step 501: Update gradients using the final update Update cumulative momentum : ; where the initial value of the accumulated momentum =0; Step 502: Based on the current accumulated momentum Sign direction update against perturbation and using the truncation function Limit the disturbance to a preset value. Within the norm sphere: Among them, the initial value for resisting disturbances =0; Step 503: Apply the current counter-perturbation Superimposed onto the original input image The values are then truncated to a valid range of pixel values to obtain the adversarial sample generated in the current iteration. This continues until the preset number of iterations is reached, yielding the final adversarial example. .
7. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.
8. A computer-readable storage medium storing a computer program / instructions thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.