A data-free black-box adversarial attack method and device, electronic equipment and medium

Abstract

The application provides a data-free black-box adversarial attack method and device based on image enhancement and two-stage decoupling training, an electronic device and a medium. The method comprises the following steps: obtaining a hard label by querying a target model with a synthetic image, constructing a query synthetic sample pool and training an initial substitute model; performing multi-view enhancement and mixed enhancement on the queried samples respectively, and constructing an enhanced training sample set; in the first stage, only the backbone network of the substitute model is updated by using a multi-view loss, and the classifier is not updated; in the second stage, the backbone network and the classifier are simultaneously updated by using a target anchor loss; and generating an adversarial sample on the trained substitute model and migrating the adversarial sample to the target model. Under the condition of only obtaining a hard label and without accessing the internal information of the target model, the method realizes efficient querying by using one-time querying and fixed sample pool multiplexing, and improves the decision approximation ability of the substitute model to the target model and the migration attack success rate of the adversarial sample by the synergy of enhancement recombination and decoupling training.

Description

Technical Field

[0001] This invention relates to the field of computer vision security and adversarial attack technology, specifically to a data-free black-box adversarial attack method, apparatus, electronic device, and storage medium based on image enhancement and two-stage decoupled training. Background Technology

[0002] With the widespread adoption of Artificial Intelligence as a Service (AIaaS) and cloud-based application programming interfaces (APIs), image recognition models are increasingly being offered as online services. Service providers typically encapsulate models through APIs, exposing only input and output interfaces to the caller. The caller can only submit the input image and receive the recognition result, without knowing the target model's network structure, parameters, gradients, or training data. To further protect training data, model structure, and service security, service providers also employ measures such as hard-label output, query quota limits, and billing or frequency restrictions. Hard labels only return the final category identifier, without exposing the probability distribution or confidence level of each category; limited query constraints restrict the amount of feedback an attacker can collect to a preset quota.

[0003] The aforementioned measures can increase the cost of attacks to some extent, but they are not equivalent to reliable protection. If attackers can still train a substitute model under limited hard-label query conditions, generate transferable adversarial examples, and ultimately influence the decision output of the target model, it indicates that such protective measures, when used alone, still have the risk of being bypassed. In this scenario, data-free black-box adversarial attacks do not rely on the original training set of the target model, are closer to actual security assessment scenarios where training data is unavailable, and better reveal the objective fact that such risks still exist under strictly limited conditions. Here, "data-free" means that attackers cannot obtain the original training set, training labels, target model structure, parameters, gradients, or probability outputs of the target model. The samples used for training the substitute model are formed by synthesizing candidate inputs through hard-label queries of the target model, without using real samples or publicly available substitute datasets with the same distribution as the target model's training set.

[0004] Existing data-free black-box adversarial attack methods mainly develop in two directions. One type of method focuses on improving the generator structure, the quality of synthesized samples, or the distribution of query samples to reduce reliance on real training data. The other type of method focuses on improving the training method of the alternative model, making its decision boundary closer to the target model, thereby increasing the success rate of transfer attacks from the alternative model-generated adversarial examples to the target model.

[0005] Patent document CN120952099A discloses a data-free black-box adversarial attack method based on a memory bank and neural network search. This method trains a generator with random noise to form synthetic samples, updates the generator under the joint guidance of a memory bank-based primary and secondary substitution model, and then performs substitution model distillation on the enhanced synthetic samples. After the substitution model converges, the newly generated adversarial samples are mixed with the original synthetic samples, and optimized through neural network architecture search. The value of this method lies in using a memory bank and neural network architecture search to improve the structure of the synthetic sample generation and substitution model. However, the black-box interface in this scheme can return labels or probabilities, covering both hard labels and soft probabilities, and does not rely solely on a single hard label approach. It does not specifically address the problem of insufficient supervision information under strict hard label conditions.

[0006] Patent document CN120597263A discloses a stable and efficient data-free model attack method based on label noise data generation, addressing the training instability and efficiency issues in data-free black-box attacks under limited query conditions. This scheme starts with random noise and labels, constructs a perturbation matrix through a label noise generation module, and applies it to the generator's intermediate features to improve the intra-class diversity and inter-class separability of generated samples. It then combines this with an adaptive intra-class attack strategy to adjust the distribution of generated data, and writes the synthesized samples obtained through iterative loss optimization into a cache for subsequent training of alternative models. While this scheme makes a clear contribution to generator-side stability and generation distribution optimization, its black-box interface can return classification probabilities or classification labels, not limiting it to hard label feedback, and it does not address the staged processing of the differences between the backbone network and the classifier's training objectives.

[0007] Patent document CN121543090A discloses a method and apparatus for visual model security assessment based on black-box, data-free general adversarial perturbation, primarily targeting visual model security assessment. This method first selects a known visual model as a substitute model and generates high-confidence artificial images. Then, it constructs and integrates an auxiliary model based on the substitute model structure. Subsequently, it combines multiple types of black-box general adversarial assessment algorithms to implement dynamic attacks and statistically analyzes the attack success rate. Finally, it adaptively adjusts the attack parameters, strategies, and angles based on the success rate and parameter differences. The focus of this scheme is on automated assessment processes, auxiliary model integration, and general perturbation transfer enhancement; it is not specifically designed for query-efficient attack scenarios under strict hard-label feedback conditions.

[0008] Patent document CN121278716A discloses a black-box attack method based on active learning and verifiable adversarial techniques, primarily targeting the high query overhead problem in black-box transfer attacks. This scheme first constructs a probe pool based on an image dataset, consisting of clean samples and their Gaussian scrambled samples. It then queries the target model for class labels through class-balanced sampling and hybrid embedding filtering, iteratively fine-tuning the alternative model. After the alternative model converges, initial adversarial samples are generated and an adversarial distribution is constructed. The attack success rate is evaluated using Monte Carlo sampling. This scheme is effective in reducing redundant queries, but it relies on real image samples to construct the probe pool, and therefore does not strictly belong to a zero-real-sample, no-data black-box attack route.

[0009] Patent document CN120893516A discloses a black-box attack method based on gradient alignment adversarial distillation. This scheme alternately trains a substitute model and a perturbation generator on labeled training data, enabling the substitute model to simultaneously fit the target model's output on both static and dynamically perturbated samples. Gradient consistency is improved through first-order gradient matching. In the attack phase, a white-box attack is performed on the substitute model based on the original dataset, and then the generated samples are transferred to attack the target model. This scheme relies on real data and labels, and uses the target model's probabilistic output for distillation, thus avoiding the data-free black-box attack route that relies solely on hard label feedback and lacks real samples.

[0010] Patent document CN121982451A discloses a method for generating transferable adversarial examples based on wavelet transform and multi-scale padding. This scheme first performs wavelet decomposition on the input image, randomly scrambles and reconstructs high-frequency subbands, then introduces random scaling and zero-padding based on Bernoulli thresholding in the iterative attack, and updates the data using gradients from multiple alternative models to generate transferable adversarial examples. The key technical aspects of this scheme are the input transformation and the collaborative gradients of multiple alternative models. It does not disclose the hard-label query mechanism under conditions without real training data, nor does it disclose the complete process of training alternative models and generating transferable adversarial examples based on hard-label queries around the target model.

[0011] In summary, the aforementioned existing technologies have technical value in areas such as generator stability, memory banks, neural network architecture search, active learning sampling, verifiable adversarial distributions, gradient alignment distillation, and input transformation enhancement. However, they are not all based on the same threat model, nor are they all designed for the strictly black-box condition of only hard-label feedback. In strictly limited scenarios where attackers lack real training data, cannot obtain the target model's structure / parameters / gradients / probability outputs, and can only obtain hard labels through a limited number of target model queries, the existing technologies still have at least the following shortcomings:

[0012] First, the limited number of query responses is not fully utilized. Existing methods typically focus on generators, generation distributions, or architecture search. When the number of times an attacker queries the real target model is strictly limited, each query result needs to serve both the training of the surrogate model and subsequent transfer attacks. If the surrogate model is directly trained in its original form after forming a small pool of hard-labeled synthetic samples, the distributional differences between the synthetic samples and the real data will be retained during training. The surrogate model is prone to simultaneously learning category information and synthetic artifacts, reducing the training value of the limited query responses and affecting the effectiveness of subsequent transfer attacks.

[0013] Second, the supervision information is insufficient under strict hard labeling conditions. Hard label output, as a common protection method in model services, avoids directly exposing probability distributions, confidence levels, and inter-class similarity relationships. In the black-box setting that only returns the final category, the target model does not directly provide the relative relationships between categories. Even if the attacker encodes the returned categories as one-hot labels, the supervision information is still limited. If soft labeling forms such as probability vectors are used instead, it no longer conforms to the strict hard labeling setting. Therefore, alternative models find it difficult to learn richer inter-class structural information from existing query results.

[0014] Third, the backbone network and the classifier undertake different training tasks, but existing methods typically do not differentiate between them. The backbone network is responsible for learning generalizable representations, while the classifier is responsible for task calibration and decision boundary alignment. If both are consistently updated jointly on data containing synthetic artifacts and noisy labels, the classifier's bias may affect the backbone network's feature learning. When the class distribution is imbalanced, high-frequency classes may also dominate the gradient update direction, making it more difficult to calibrate the decision boundaries of rare classes. This, in turn, affects how closely the alternative model approximates the target model's decision boundaries, and the success rate of subsequent adversarial transfer attacks. Summary of the Invention

[0015] To overcome the shortcomings of existing technologies, this invention provides a data-free black-box adversarial attack method, apparatus, electronic device, and storage medium based on image enhancement and two-stage decoupled training.

[0016] The technical solution adopted by this invention to solve its technical problem is:

[0017] According to one aspect of this application, a data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training is provided, comprising:

[0018] A synthetic image is used to query a target model to obtain the hard labels returned by the target model. A query synthetic sample pool is constructed, and an initial alternative model is trained based on the query synthetic sample pool. The alternative model includes a backbone network and a classifier.

[0019] The samples in the query synthesis sample pool are subjected to multi-view enhancement to generate a strongly enhanced view and multiple weakly enhanced views. A pseudo-label is generated based on the weakly enhanced views using a teacher model. The strongly enhanced view and the pseudo-label constitute the multi-view enhanced sample. The samples in the query synthesis sample pool are also subjected to hybrid enhancement by mixing the enhanced views of two samples according to a mixing coefficient to obtain a hybrid image. The two corresponding hard labels are interpolated according to the same coefficient to obtain a hybrid label. The hybrid image and the hybrid label constitute the hybrid enhanced sample.

[0020] Based on the multi-view augmented samples, the parameters of the backbone network are updated using a first loss function, while the parameters of the classifier are not updated during this stage; based on the hybrid augmented samples and the query hard labels, the parameters of both the backbone network and the classifier are updated simultaneously using a second loss function.

[0021] Adversarial examples are generated on the trained alternative model, and the adversarial examples are input into the target model to carry out the attack.

[0022] In one optional implementation, constructing the query synthetic sample pool specifically includes: synthesizing candidate images. Query target model Obtain one-hot hard label ,through Build after the query ;use The initial alternative model is trained using cross-entropy loss. ,in , As the backbone network, For classifiers, This is the cross-entropy loss function.

[0023] In one alternative implementation, the multi-view enhancement specifically includes: synthesizing samples for each query. Generate a strongly enhanced view and A weakly enhanced view Using the exponential moving average teacher model The pseudo-label distribution is obtained by averaging the predictions from multiple weakly augmented views. The category corresponding to the maximum value is taken as the pseudo-label. To form a multi-view enhanced sample set ;

[0024] in:

[0025]

[0026] .

[0027] In one optional implementation, the hybrid enhancement specifically includes: adjusting the two strongly enhanced samples according to a mixing coefficient. Blend to obtain a blended image. Linear interpolation is performed on the two corresponding query hard labels using the same coefficient to obtain the mixed label. To form a hybrid enhanced sample set ;

[0028] in ,from Sampling in the distribution ; Implemented by MixUp or CutMix; the two strongly enhanced samples are random pairings of different original samples from the same mini-batch, obtained by randomly permuting the mini-batch sample index.

[0029] In one optional implementation, updating the backbone network with the first loss function specifically includes: using a multi-view loss function. The first loss function is calculated using pseudo-label confidence scores as a weighting factor:

[0030]

[0031]

[0032] in As the confidence level weight, This represents the maximum probability value of the pseudo-label distribution. This is the lower confidence level. The upper limit of confidence and satisfying , is the numerical stability constant.

[0033] In one optional implementation, simultaneously updating the backbone network and the classifier with the second loss function specifically includes: using target anchoring loss. For the second loss function:

[0034]

[0035]

[0036]

[0037] in For mixed sample loss, For soft-label cross-entropy loss; For class-balanced loss, To balance the weights for each category, For the sample Category The number of times it appears in; This is a weighting factor.

[0038] According to another aspect of this application, the present invention provides a data-free black-box adversarial attack device based on image enhancement and two-stage decoupled training, comprising:

[0039] The query synthesis module is used to obtain hard labels from the target model by querying the synthesized image, construct a query synthesis sample pool, and train an initial alternative model based on the query synthesis sample pool. The alternative model includes a backbone network and a classifier.

[0040] The multi-view enhancement module is used to perform multi-view enhancement on the samples in the query synthetic sample pool, generate a strong enhanced view and multiple weak enhanced views, use the teacher model to generate pseudo-labels based on the weak enhanced views, and the strong enhanced views and the pseudo-labels constitute the multi-view enhanced samples.

[0041] The hybrid enhancement module is used to perform hybrid enhancement on the samples in the query synthetic sample pool. It mixes the enhanced views of two samples according to the mixing coefficient to obtain a hybrid image, and interpolates the corresponding two hard labels according to the same coefficient to obtain a hybrid label. The hybrid image and the hybrid label constitute a hybrid enhanced sample.

[0042] A two-stage decoupled training module is used to update the parameters of the backbone network with a first loss function based on the multi-view augmented samples, while the parameters of the classifier are not updated in this stage; and to update the parameters of the backbone network and the classifier simultaneously with a second loss function based on the mixed augmented samples and the query hard labels.

[0043] The adversarial example generation and transfer module is used to generate adversarial examples on the trained alternative model and input the adversarial examples into the target model to carry out the attack.

[0044] In one optional implementation, the two-stage decoupled training module includes: a first-stage training submodule, which updates only the backbone network based on the multi-view augmented samples and pseudo-label confidence-weighted multi-view loss, wherein the classifier participates in forward propagation but its gradient is zeroed after backpropagation; a second-stage training submodule, which updates both the backbone network and the classifier simultaneously based on the mixed augmented samples and query hard labels, using a target anchoring loss combining mixed sample loss and class balance loss; and a teacher model update submodule, which updates the teacher model using an exponential moving average.

[0045] According to another aspect of this application, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to perform the above-described method.

[0046] According to another aspect of this application, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, wherein the computer program instructions, when executed by a processor, implement the above-described method.

[0047] The positive effects of this invention:

[0048] This method achieves high query efficiency through one-time query fixed pool reuse, and uses multi-view augmentation, hybrid augmentation, and two-stage decoupled training to synergistically drive the alternative model to approach the decision boundary of the target model. It also leverages dual-path supervision with target anchoring to achieve defensive robustness, while classifier gradient zeroing and EMA dynamic updates ensure the quality of pseudo-labels. A detailed analysis follows:

[0049] (1) This method decouples the target model query from subsequent training into two independent stages: the query stage is only used to obtain hard labels and build a synthetic sample pool. Once the sample pool is established, all subsequent augmentation, training, and teacher model updates are iterated on this fixed pool, without consuming additional query quotas. This design allows a single query feedback to participate simultaneously in the initial alternative model training, pseudo-label generation for multi-view augmentation, label interpolation for hybrid augmentation, and the calculation of class balance weighting. A single query result is reused by multiple training paths. In contrast, schemes that rely on alternating generator-discriminator optimization often require continuous access to the target model to obtain feedback signals to update the generator, and the query consumption is linearly related to the number of training rounds. The number of queries in this invention depends only on the size of the initial sample pool and is independent of the number of subsequent training rounds. Therefore, under the same query budget, more computational resources can be allocated to augmentation recombination and model optimization, resulting in a systematic improvement in query efficiency.

[0050] (2) The transfer attack capability of the substitute model (i.e., the model trained locally by the attacker to simulate the behavior of the target model) essentially depends on how close its decision boundary is to the target model—the more consistent they are, the more likely the perturbations generated on the substitute model are to cause the same decision bias on the target model. This invention systematically narrows this gap in three dimensions. First, there is a distribution difference between synthetic samples and real training data. Synthetic artifacts can mislead the substitute model to learn features unrelated to the target model. Multi-view augmentation forces the substitute model to output a prediction consistent with the weakly augmented pseudo-label when faced with inputs with drastically changed appearances. In essence, it ignores synthetic artifacts and focuses on the category semantics itself when training the backbone network. Second, hard labels only provide information about a single category. The similarity and transition relationship between classes are completely hidden. Hybrid augmentation creates continuous transition samples between categories in both the input and output dimensions through image-level MixUp / CutMix mixing and linear interpolation in the label space. This allows the substitute model to implicitly learn the inter-class structure during training, rather than simply fitting discrete one-hot boundaries. Third, the backbone network and the classifier have fundamentally different tasks—the former needs to extract generalizable visual representations, while the latter needs to label class boundaries in a high-dimensional feature space. Two-stage decoupled training optimizes them separately. First, the backbone network establishes stable feature extraction capabilities under the guidance of pseudo-labels. Then, in the second stage, target anchoring loss is used to calibrate the classification boundary to the hard decision returned by the target model, avoiding interference from classifier bias in feature learning during early training. Functionally, the three complement each other: multi-view augmentation addresses data quality issues, hybrid augmentation addresses insufficient supervision information, and two-stage training resolves optimization path conflicts, jointly driving the alternative model towards the decision boundary of the target model.

[0051] (3) Adversarial training smooths the decision boundary of the target model by injecting adversarial examples during the training phase, while stochastic smoothing introduces decision randomness through noise injection and prediction aggregation during the inference phase. Both defense strategies make it more difficult for the alternative model to accurately reproduce the behavior of the target model from a limited set of queries. The key to the high attack success rate of this invention under both defenses lies in the design of the target anchoring loss in the second stage— In The method uses strongly augmented views and hard labels from the original queries to calculate class-balanced cross-entropy. Its supervision signal comes directly from the true output of the target model rather than the inference of the teacher model, acting as a continuous constraint on the training process, constantly pulling the classification boundary of the alternative model back to the hard decisions explicitly expressed by the target model. Hybrid augmentation provides information on inter-class relationships (…). ) and the precise decision anchors provided by hard labels ( This creates a complementary system—the former explores transitional regions between categories, while the latter ensures that queried decision points are not shifted. This dual-path supervision structure prevents the alternative model from deviating from the target model's true behavior pattern due to over-reliance on pseudo-labels when facing unknown defense strategies, thus demonstrating good adaptability to defense models.

[0052] (4) Zeroing the classifier gradient in the first stage: The pseudo-labels generated by the EMA teacher model are derived from the alternative model itself and have inherent uncertainty. If the classifier updates synchronously with these noisy pseudo-labels, the classification boundary will be directly disturbed by the pseudo-label error and gradually amplified through training iterations. After zeroing the classifier gradient, the pseudo-label noise is confined to the feature space level rather than the decision boundary level, preserving a cleaner representation basis for the second stage. The EMA momentum of the teacher model controls the balance between pseudo-label stability and adaptability. The decision boundary of the alternative model changes continuously during training. If the teacher model remains unchanged, the pseudo-labels will gradually become outdated. If it is completely synchronized, the pseudo-labels will fluctuate violently and cannot provide stable supervision. EMA achieves smooth tracking by weighted averaging of historical parameters, taking into account both the stability of historical judgments and the improvement of the new model. Experiments show that the decrease in iterative attack when the teacher model is frozen is significantly greater than that of single-step attack, indicating that multi-step attack is more sensitive to the fineness of the decision boundary. Outdated pseudo-labels destroy this fine structure, further confirming the necessity of dynamic updating of the teacher model. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0054] Figure 1 The above is an overall flowchart provided for an embodiment of the present invention.

[0055] Figure 2 The heatmap shows the hard decision consistency rate between the surrogate model and the target model on the SVHN dataset, and contains four subplots: Figure 2 a is the confusion matrix between the target model's own predictions and the true labels; Figure 2 b is the confusion matrix between the alternative model and the target model without post-training optimization; Figure 2 c is the confusion matrix between the naive post-trained alternative model and the target model; Figure 2 d is the confusion matrix between the alternative model and the target model after applying the method of this invention;

[0056] Figure 3The comparison curves of the JS divergence between the output distributions of the surrogate model and the target model contain two subplots: Figure 3 'a' corresponds to the CIFAR-10 dataset. Figure 3 b corresponds to the Fashion-MNIST dataset;

[0057] Figure 4 Sensitivity analysis of the gradient decay factor for the first-stage classifier, comprising six subplots: Figure 4 a represents a non-directional FGSM. Figure 4 b represents directional FGSM. Figure 4 c represents non-directional BIM. Figure 4 d represents directional BIM. Figure 4 e represents non-directional PGD. Figure 4 f represents directional PGD;

[0058] Figure 5 Sensitivity analysis of the momentum coefficient of the EMA teacher model, comprising eight subplots: Figure 5 a and Figure 5 b represents non-targeted and targeted attacks on the MNIST dataset, respectively. Figure 5 c and Figure 5 d represents non-targeted and targeted attacks on the Fashion-MNIST dataset, respectively. Figure 5 e and Figure 5 f represents non-targeted and targeted attacks on the CIFAR-10 dataset, respectively. Figure 5 g and Figure 5 h represents non-targeted and targeted attacks on the SVHN dataset, respectively. Detailed Implementation

[0059] The prior art and the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Furthermore, to better illustrate this application, numerous specific details are provided in the following detailed embodiments. Those skilled in the art should understand that this application can be implemented without certain specific details. In some instances, methods, means, components, and circuits well-known to those skilled in the art have not been described in detail in order to highlight the main points of this application.

[0061] Existing adversarial attack methods without data suffer from three shortcomings: the training value of a limited number of query responses is not fully exploited, and synthetic artifacts reduce the quality of the substitute model; strict hard labels only return the final category, lacking information on inter-class relationships, and one-hot label supervision information is limited; the backbone network and classifier perform different tasks (representation learning and boundary calibration), but existing training often does not process them separately, classifier bias can easily interfere with backbone feature learning, and high-frequency categories dominate gradients when classes are imbalanced. This invention aims to solve the problem of how to improve the success rate of attacking the target model under the conditions of strict hard labels, lack of real training data, and limited number of queries—by performing multi-view enhancement (strong enhancement changes appearance + weak enhancement generates pseudo-labels) and hybrid enhancement (image blending + hard label interpolation) on the queried samples, expanding the distribution and supervision information of the training data without adding new queries. It adopts a two-stage decoupled training strategy, first training the backbone network with multi-view loss and then jointly training the backbone network and classifier with target anchoring loss, making adversarial examples generated on the substitute model easier to transfer to the target model. In this invention, "no data" means that the attacker cannot obtain the original training set, training labels, target model structure, parameters, gradients, or probability outputs of the target model; the samples used for training the alternative model are formed by querying the target model's hard labels through synthetic candidate inputs, and do not use real samples or publicly available alternative datasets that are distributed in the same way as the target model's training set.

[0062] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0063] Reference Figure 1 , Figure 1 This paper illustrates a data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training, according to an embodiment of the present invention. The overall process is divided into two parts: one part is the construction of a refined dataset based on enhancement (multi-view enhancement + hybrid enhancement), and the other part is two-stage training based on gradient decoupling (first updating the backbone network and then jointly updating the backbone network and the classifier). The target model query is a one-time operation, i.e., within a given query budget... After obtaining the synthetic sample pool, this sample pool is fixed. Steps 2 through 6 below are all performed on this fixed sample pool. During training, the target model is not additionally queried due to the generation of pseudo-labels or the updating of the teacher model. The EMA teacher model is not another independent attack model, but a substitute model. An exponential moving average copy is used to stably generate pseudo-labels for weakly enhanced views.

[0064] It should be noted that the following content shows one possible order of steps, and it is not strictly necessary to follow this order. Some steps can be performed in parallel without interdependence.

[0065] Specifically, according to an embodiment of this application, a data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training includes the following steps:

[0066] A synthetic image is used to query a target model to obtain the hard labels returned by the target model. A query synthetic sample pool is constructed, and an initial alternative model is trained based on the query synthetic sample pool. The alternative model includes a backbone network and a classifier.

[0067] The samples in the query synthesis sample pool are subjected to multi-view enhancement to generate a strongly enhanced view and multiple weakly enhanced views. A pseudo-label is generated based on the weakly enhanced views using a teacher model. The strongly enhanced view and the pseudo-label constitute the multi-view enhanced sample. The samples in the query synthesis sample pool are also subjected to hybrid enhancement by mixing the enhanced views of two samples according to a mixing coefficient to obtain a hybrid image. The two corresponding hard labels are interpolated according to the same coefficient to obtain a hybrid label. The hybrid image and the hybrid label constitute the hybrid enhanced sample.

[0068] Based on the multi-view augmented samples, the parameters of the backbone network are updated using a first loss function, while the parameters of the classifier are not updated during this stage; based on the hybrid augmented samples and the query hard labels, the parameters of both the backbone network and the classifier are updated simultaneously using a second loss function.

[0069] Adversarial examples are generated on the trained alternative model, and the adversarial examples are input into the target model to carry out the attack.

[0070] The detailed technical implementation of each step is as follows.

[0071] Step 1: Construct a query synthetic sample pool and train an initial alternative model

[0072] The attacker faces the target model, denoted as Since its parameters, gradients, network structure, and training data are unknown, it can only submit input and obtain hard labels. In this embodiment, the target model... This is an image classification model deployed on the AIaaS platform, which only exposes input and output interfaces through API; hard labels are single-category identifiers and do not contain probability vectors or confidence information; the number of queries is constrained by query quotas, billing, or frequency limits.

[0073] Attackers first synthesize candidate inputs, then access the target model with a limited number of queries to obtain hard labels:

[0074]

[0075] in Indicates the first A query-generated sample, Representing the target model For input The returned one-hot hard label, This represents the inference function of the target model. After... After the first query, a query synthesis sample pool is constructed. :

[0076]

[0077] in This indicates a query for the synthetic sample pool. This indicates the number of queries, which is equivalent to the size of the query pool. .

[0078] The synthesized candidate input is generated by a candidate image generator, or it can be obtained by initializing with random noise and then optimizing with prior image constraints. The candidate image generator can employ a convolutional generative network, a VAE, a diffusion decoder, or other methods capable of generating input from random vectors. and optional category priors The generated image structure is trained or sampled using only natural image statistical priors, entropy constraints, diversity constraints, class balance constraints, or publicly available pre-trained weights, without using the original training samples of the target model as supervision. The number of channels and spatial size of the generated candidate images... The pixel range and normalization method must be consistent with the input interface of the target model.

[0079] Category distribution control can be adaptively achieved through query feedback: when the number of categories... When the information is unknown, exploratory queries are first performed to count the set of category identifiers returned by the API, and the one-hot label dimension is expanded as new categories appear; then, category balancing weighting is performed based on the number of samples of the discovered categories.

[0080] Then use Training the initial alternative model :

[0081]

[0082] in Indicates the initial alternative model; Represents the inference function of the alternative model. ; This represents the backbone network, which is responsible for extracting feature representations from the input image, including convolutional layers, normalization layers, activation layers, and global pooling layers; This represents a classifier, typically the final linear layer or a multilayer perceptron. Represents the cross-entropy loss function; This method involves searching for parameters in the alternative model parameter space that minimize the loss function. It is applicable to CNN-type networks.

[0083] Target Model and alternative models The network structure is not limited to a specific architecture. In a typical implementation, the target model uses ResNet-34, the alternative model uses ResNet-18, and the backbone network... To remove the residual network portion of the fully connected classification layer, the classifier This is a fully connected classification layer. In an alternative implementation, other architectures such as VGG series, DenseNet, MobileNet, and EfficientNet can also be used, where the backbone network is the feature extraction part of the final classification layer removed, and the classifier is the final linear or non-linear classification layer.

[0084] like Figure 1 As shown in the initial section, after the synthesized image obtains hard labels through the query target model, it flows to two branches: strong enhancement and weak enhancement, respectively, and enters the multi-view enhancement process in step 2 and the hybrid enhancement process in step 3.

[0085] Step 2: Multi-view Enhancement – ​​Generating Strongly Enhanced Views and Weakly Enhanced Pseudo-tags

[0086] For querying the synthetic sample pool Each sample in :

[0087] (2a) Generate a strongly enhanced view. For the original synthetic sample... Applying a strong enhancement transformation yields a strongly enhanced view, denoted as . Strong enhancements are used to significantly alter the surface appearance of an image while preserving categorical content as much as possible (such as large color jitter, geometric distortion, occlusion, etc.). Strong enhancements can employ RandAugment or AutoAugment data augmentation strategies; alternative implementations may also use SimCLR-style enhancement combinations, AugMix, or TrivialAugment. Specific enhancement operations are not limited to a single numerical range such as a fixed cropping ratio, rotation angle, flip probability, or random erasure area.

[0088] (2b) Generate multiple weakly enhanced views. For the same original synthetic sample Apply The next weak enhancement transformation (using a different random seed each time) yields... A weakly enhanced view, denoted as ,in Weak enhancements are used to generate more stable views while largely preserving category semantics, including random horizontal flipping and / or minor random cropping. The range of values ​​is In alternative implementations, weak enhancement may also include small-amplitude color dithering or Gaussian noise.

[0089] (2c) Generating pseudo-labels using the EMA teacher model. Construct an exponential moving average (EMA) teacher model, denoted as . . From the initial alternative model The parameters are copied and initialized, and updated at a preset frequency during training (preferably once after each training iteration or each training round; see step 6 for specific update methods). When used for pseudo-label inference, it is in evaluation mode, gradients are frozen, batch normalization and Dropout are applied to the inference state. Figure 1 As shown, Each weakly enhanced view is input into the teacher model. The arithmetic mean of the output logits can be calculated (or the probabilities can be taken first and then averaged), and then normalized using the softmax function to obtain the pseudo-label distribution:

[0090]

[0091] in Indicates the first The pseudo-label probability distribution vector of each sample, with dimension equal to the total number of classification categories of the target model; This represents the inference function of the EMA teacher model, outputting logits; This represents the softmax normalization function. This embodiment does not introduce temperature scaling by default; however, if a temperature parameter is introduced... Then default .

[0092] (2d) Determine the pseudo-labels. Take The category index corresponding to the highest probability in the middle is used as a strongly enhanced view. Corresponding pseudo-tags:

[0093]

[0094] These pseudo-labels are supervisory labels generated by the teacher model based on the weakly augmented view and then on the augmented strongly augmented view.

[0095] (2e) Forming a multi-view enhanced sample set:

[0096]

[0097] in This represents a multi-view augmentation sample set. Strong augmentation changes the appearance of the image, while weak augmentation generates stable pseudo-labels. The combination of the two reduces the surrogate model's dependence on synthetic artifacts without increasing the number of queries to the target model.

[0098] Step 3: Blending Enhancement – ​​Generating Blended Images and Blending Labels

[0099] Hard labels, as protective outputs, only provide information about a single category. To supplement the information about the relationships between categories without exceeding the limitations of hard label outputs, this step performs a mixed processing on the strongly enhanced samples.

[0100] (3a) Generate blended images. From the strongly enhanced views of the same mini-batch samples, obtain two strongly enhanced views of different original samples by randomly permuting the mini-batch sample indices. and ( ), according to the mixing coefficient Perform image blending:

[0101]

[0102] in Represents a mixed image; The mixing coefficient, From the Beta distribution obtained from sampling, Mixture function This can be achieved using MixUp or CutMix: When using MixUp, the operation is a pixel-level weighted overlay. When using CutMix, the operation involves replacing a rectangular region of one image with a corresponding region of another image. In alternative implementations, the blending function can also be CutOut, FMix, or ResizeMix, etc.

[0103] (3b) Generate mixed tags. For the two corresponding query hard tags and Using the same mixing coefficient Perform linear interpolation to obtain the mixed labels:

[0104]

[0105] in It is in the form of soft labels (a non-negative vector whose sum of all dimensions is 1). It consists of a linear combination of two query hard labels, which supplements the alternative model with relative information between the two queried categories without breaking the output limitations of hard labels.

[0106] (3c) Forming a hybrid augmented sample set:

[0107]

[0108] like Figure 1 As shown, and Together, they form the refined dataset, which serves as the input for the subsequent two stages of training. Both datasets originate from already queried hard-labeled samples, eliminating the need for additional queries to the target model.

[0109] Step 4: First Stage – Updating the Backbone Network with Multi-View Loss

[0110] like Figure 1 As shown, the first stage only applies to the backbone network (classifier parameters are not updated). This stage uses multi-view loss. Update the backbone network using the first loss function. Parameters of the classifier The parameters remain frozen. In a specific embodiment, steps 4 and 5 are executed as two consecutive training sub-steps within each training round.

[0111] (4a) Calculate the sample confidence weights. Let the pseudo-label distribution be... The maximum probability value is This value reflects the teacher model's confidence in false labels. Sample weights are obtained by pruning based on a confidence threshold. :

[0112]

[0113] in Indicates the first Confidence weights for multi-view enhanced samples; This is the lower confidence level. This is the upper confidence level, and ; Limit input values ​​to Range: below Weight is 0, higher than The weight is 1, and it transitions linearly between these values.

[0114] (4b) Construct the first loss function. Using confidence weights... Weighted calculation of multi-view loss :

[0115]

[0116] in Indicates multi-view loss; To replace the model's prediction output for strongly augmented views; This is a numerical stability constant, used only to avoid a denominator of zero. Cross-entropy loss. In alternative embodiments, it can also be replaced with Divergence loss, mean square error loss, or cosine similarity loss.

[0117] (4c) Execute parameter update. The first phase only utilizes Update the backbone network via backpropagation. The parameters. The implementation of "classifier not being updated" is as follows: Classifier Still participates in forward propagation and output However, the classifier gradient is zeroed out after backpropagation. This allows the backbone network to learn stable representations across views first, avoiding direct perturbation of classification boundaries by pseudo-label noise, and retaining representations more suitable for transfer attacks.

[0118] Step 5: Second Stage – Jointly Update the Backbone Network and Classifier Using Target Anchoring Loss

[0119] like Figure 1 As shown, the second stage simultaneously acts on the backbone network and the classifier, fusing them together. and Two monitoring signals. This phase focuses on target-anchored loss. The second loss function is used to update the backbone network simultaneously. and classifier .

[0120] In one training iteration, strong augmented views, weak augmented views, and randomly paired mixed samples are generated using the same mini-batch of samples, and calculations are performed separately for each. , and .

[0121] (5a) Calculate the mixed sample loss. For the mixed augmented sample set Each sample in the sample, due to the mixed label In the form of soft labels, the soft-label cross-entropy loss metric is used to measure the difference between the model output and the mixed label distribution:

[0122]

[0123] in Indicates the mixed sample loss; This represents the soft-label cross-entropy loss function, for soft labels. and model output logits , , Iterate through all categories.

[0124] (5b) Calculate the class balance loss. Considering There may be class imbalance. We construct a class balancing loss using the hard labels of the original query to suppress the dominance of high-frequency classes on the gradient.

[0125]

[0126] in Indicates class balance loss; To balance the weights for each category, For the sample Category The frequency of occurrences in the sample. The class balancing loss uses strongly augmented views instead of original synthetic samples to ensure that class boundary calibration occurs on the augmentation distribution consistent with multi-view training, reducing the surrogate model's dependence on original synthetic artifacts. If a class has no samples in the current mini-batch or sample pool, that class does not generate any sample items and does not participate in this round of summation. The specific normalization method is as follows:

[0127]

[0128] in This formula represents the total number of categories, giving rarer categories higher weights. In alternative implementations, category balancing can also be achieved using strategies such as effective sample weighting or focal loss.

[0129] (5c) Construct the second loss function. and Through the weighting coefficient Combined target anchoring loss:

[0130]

[0131] in This represents the target anchoring loss, while simultaneously receiving two supervisory signals: hybrid augmented samples and query hard labels. This is a weighting coefficient used to balance information about relationships between classes. ) and category-balanced hard label supervision ( ).

[0132] "Target anchoring" means that the second stage not only uses mixed labels to learn the transitional relationship between categories, but also uses the original query hard labels and category balancing weights to continuously constrain the classification boundary of the alternative model to the hard label decision returned by the target model, so as to avoid the mixed augmented supervision causing the model to deviate from the actual hard decision of the target model.

[0133] (5d) Execute parameter update. The second stage utilizes... Simultaneously update the backbone network. and classifier The parameters are used to calibrate the task boundaries and retain the characterization capabilities obtained in the first stage.

[0134] Step 6: Update the teacher model and generate transferable adversarial examples

[0135] (6a) Update the teacher model. After each training round (preferably once per training iteration or after each training round), update the teacher model parameters using an exponential moving average:

[0136]

[0137] in For teacher model All trainable parameters; For the current alternative model All trainable parameters; This is the EMA momentum coefficient. For example... Figure 1 As shown, the updated Return to step 2 to participate in the next round of pseudo-label generation for the weakly enhanced view. In an alternative implementation, the alternative model parameters can also be completely copied to the teacher model at fixed intervals.

[0138] (6b) Generate transferable adversarial examples. After completing all training rounds, in the alternative model The white-box attack algorithm is executed to generate perturbations. :

[0139] Non-targeted attacks (causing the target model's classification to deviate from the true label):

[0140]

[0141] Targeted attack (causing the target model to misclassify as a specified target category):

[0142]

[0143] in To counteract disturbances; To disrupt the budget; for Norm, ; This is a real label; The target category is defined. The above optimization can be approximated by FGSM, BIM, or PGD. In one implementation, the grayscale dataset... Color dataset BIM iteration takes 120 steps, PGD iteration takes 20 steps; grayscale step size Color step size In alternative implementations, C&W attacks, DeepFool, AutoAttack, Square Attack, or generator-based attack methods may also be used.

[0144] Transfer to the target model refers to the alternative model The adversarial examples generated based on white-box gradients can also change the hard label output of the target model after being submitted to the target model's API. Its transferability comes from the consistency between the alternative model and the target model in the decision boundary and hard decision region.

[0145] (6c) Implement the attack. The generated adversarial sample... Submit to the target model .

[0146] This method is not limited to image classification tasks. In alternative implementations, this method can be extended to tasks such as object detection (hard labels are bounding boxes and category information) or image segmentation (hard labels are pixel-level category mappings), simply by modifying the classifier. Simply replace it with the corresponding detection head or segmentation head.

[0147] This invention treats the target model query as a one-time operation, and expands the distribution and supervision information of the training data without adding new queries by using two complementary image enhancement methods on a fixed query synthetic sample pool—multi-view enhancement (strong enhancement to change appearance + EMA teacher to generate pseudo-labels based on weak enhancement) and hybrid enhancement (image MixUp / CutMix + query hard label linear interpolation); and employs a two-stage decoupled training, with the first stage using confidence-weighted multi-view loss. Only the backbone network is updated (classifier gradients are zeroed) to avoid pseudo-label noise perturbing the classification boundary and to preserve generalizable representations. The second stage uses target-anchored loss. ( Simultaneously update the backbone network and classifier, continuously anchoring the classification boundary of the alternative model to the hard decision of the target model—thus enabling each query feedback to serve both alternative model training and transfer attack under conditions of strict hard labels, no real training data, and limited queries.

[0148] To further verify the technical effects of the data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training provided in this application, the beneficial effects achievable by the embodiments of this application are explained below in conjunction with specific experimental data and comparison results.

[0149] (1) Experimental setup

[0150] Target Model ResNet-34 was used as an alternative model. ResNet-18 was used as the backbone network. To remove the residual network (including convolutional layers, normalization layers, activation layers, and global pooling layers) from the fully connected classification layer, the classifier... This is a fully connected classification layer. Training uses a learning rate... ,momentum The SGD optimizer, , . Choose 2 or 4. , , .

[0151] The experimental dataset includes four standard image classification datasets: a grayscale dataset with 20,000 queries and a color dataset with 30,000 queries.

[0152]

[0153] The attack assessment included FGSM, BIM, and PGD, with BIM undergoing 120 iterations and PGD undergoing 20 iterations; grayscale... ,color Average Attack Success Rate (ASR) is calculated separately for each attack type: Non-targeted ASR is the proportion of times the target model misclassifies an adversarial version of a correctly classified sample; Targeted ASR is the proportion of times the target model predicts an adversarial sample as a specified target category. The proportion.

[0154] (2) Attack results on the standard target model

[0155] The average ASR result (%) of the method of this invention is shown in the table below:

[0156]

[0157] Without accessing the target model structure, parameters, gradients, training data, or probability outputs, this method achieves transferable adversarial examples within a limited hard-label query budget.

[0158] (3) Component ablation test

[0159] To verify the contributions of multi-view augmentation, hybrid augmentation, and two-stage decoupling training (not simply increasing the number of training epochs), ablation experiments were conducted on SVHN. For non-targeted attacks: the ASR was 18.02% with standard end-to-end training, 41.08% with multi-view augmentation only, 25.12% with hybrid augmentation only, 27.63% with two-stage decoupling only, and reached 53.24% with the complete method described in this invention. For targeted attacks: the ASR was 3.36% with standard end-to-end training and reached 27.45% with the complete method. These results support the necessity of multi-view pseudo-labels mitigating synthesis artifacts, hybrid labels supplementing inter-class relationships, and two-stage decoupling improving transferability.

[0160] (4) Consistency between the alternative model and the target model

[0161] Hard decision consensus rate is defined as ,in For the hard labels returned by the target model API, To replace the model's prediction of categories, To evaluate the sample size, Cohen kappa is defined as... ,in This represents the actual consistency rate. This is the random coincidence rate, used to deduct the actual degree of consistency after random coincidence.

[0162] On SVHN, the consensus rate of hard decisions reached 74.61% after adopting this method, and 71.20% for Cohen kappa. Figure 2 The hard decision distributions of the alternative and target models are compared using a confusion matrix heatmap. In the graph, Acc represents the original consistency rate, and Kappa represents the Cohen kappa value after deducting random coincidences. Figure 2 It contains four subgraphs: Figure 2 a is the confusion matrix between the target model's own prediction and the true label (Target vs Ground-Truth), with Acc=93.95%, serving as a benchmark. Figure 2 b is the confusion matrix between the surrogate model and the target model without post-training optimization (No post-train vsTarget), Acc=39.45%, Kappa=30.87%; Figure 2 c is the confusion matrix between the surrogate model and the target model after naive post-training (Naive post-train vs Target), with Acc=46.09% and Kappa=38.74%; Figure 2d represents the confusion matrix (ADDT post-train vs Target) between the surrogate model and the target model after applying this method, with Acc=74.61% and Kappa=71.20%. In each subplot, the horizontal axis represents the predicted label, and the vertical axis represents the target label. Brighter diagonal lines indicate greater consistency in the hard decisions of the two models, while darker off-diagonal lines indicate less divergence. Figure 2 b to Figure 2 d. The alternative model gradually approaches the decision boundary of the target model. Naive training only provides a slight improvement, while our method achieves a significant improvement. This intuitively shows that the combination of weakly enhanced pseudo-labels, mixed labels, and two-stage decoupled training significantly reduces the decision gap between the alternative model and the target model. Figure 3 The comparison curves of the JS divergence between the output distributions of the surrogate model and the target model contain two subplots: Figure 3 'a' corresponds to the CIFAR-10 dataset. Figure 3 b corresponds to the Fashion-MNIST dataset. The three curves in each subplot represent no post-training, naive post-training, and our method. Our method shows lower JS divergence across all confidence intervals compared to the two control cases, indicating that the output distribution of the alternative model is closer to the target model.

[0163] (5) Attack results against the defense model

[0164] The adversarial training target model is obtained using PGD adversarial training (grayscale). ,color The stochastic smoothing target model injects Gaussian noise into the input during the inference phase and aggregates multiple prediction results.

[0165]

[0166] The results show that the alternative model obtained by two-stage decoupled training can still generate adversarial examples with good transfer attack performance even when faced with more complex target decision boundaries.

[0167] (6) Parameter sensitivity experiment

[0168] Gradient decay factor. Figure 4 The changes in ASR are shown when the gradient decay factor of the first-stage classifier is increased from 0 (updating only the backbone network) to 1.0 (end-to-end joint update). The ASR for non-oriented BIM decreases from 52.82% to 43.10%, and for oriented BIM from 24.07% to 17.11%, indicating that suppressing classifier updates in the first stage helps avoid pseudo-label noise perturbing the classification boundary and preserves representations more suitable for transfer attacks.

[0169] EMA momentum. Figure 5 Showing Sensitivity under different datasets and attack scenarios. Fine-grained experiments in CIFAR-10. or The best ASR is usually achieved when the teacher model is frozen ( When the relative peak values ​​of non-directional BIM / PGD / FGSM decreased by 6.47 / 6.43 / 4.84 percentage points respectively, the directional attack also showed a more obvious trend of decreasing during iterative attacks, indicating that the teacher model needs to be updated gradually with the replacement model.

[0170] A data-free black-box adversarial attack device based on image enhancement and two-stage decoupled training, according to an embodiment of this application, includes:

[0171] The query synthesis module is used to obtain hard labels from the target model by querying the synthesized image, construct a query synthesis sample pool, and train an initial alternative model based on the query synthesis sample pool. The alternative model includes a backbone network and a classifier.

[0172] The multi-view enhancement module is used to perform multi-view enhancement on the samples in the query synthetic sample pool, generate a strong enhanced view and multiple weak enhanced views, use the teacher model to generate pseudo-labels based on the weak enhanced views, and the strong enhanced views and the pseudo-labels constitute the multi-view enhanced samples.

[0173] The hybrid enhancement module is used to perform hybrid enhancement on the samples in the query synthetic sample pool. It mixes the enhanced views of two samples according to the mixing coefficient to obtain a hybrid image, and interpolates the corresponding two hard labels according to the same coefficient to obtain a hybrid label. The hybrid image and the hybrid label constitute a hybrid enhanced sample.

[0174] A two-stage decoupled training module is used to update the parameters of the backbone network with a first loss function based on the multi-view augmented samples, while the parameters of the classifier are not updated in this stage; and to update the parameters of the backbone network and the classifier simultaneously with a second loss function based on the mixed augmented samples and the query hard labels.

[0175] The adversarial example generation and transfer module is used to generate adversarial examples on the trained alternative model and input the adversarial examples into the target model to carry out the attack.

[0176] The dual-stage decoupled training module includes: a first-stage training submodule, which updates only the backbone network based on the multi-view augmented samples and pseudo-label confidence-weighted multi-view loss, where the classifier participates in forward propagation but its gradient is cleared to zero after backpropagation; a second-stage training submodule, which updates both the backbone network and the classifier simultaneously based on the mixed augmented samples and query hard labels, using a target anchoring loss combining mixed sample loss and class balance loss; and a teacher model update submodule, which updates the teacher model using an exponential moving average.

[0177] Data flow relationships between modules and Figure 1 The details are consistent with those shown. The specific formulas, parameter values, alternative implementation methods, and training processes involved in each module are the same as those described in the corresponding parts of steps 1 to 6 of the above method embodiment, and will not be repeated here.

[0178] An electronic device for countering dataless black-box attacks according to an embodiment of this application is a terminal, which may include a processor, memory, network interface, display screen, and input device connected via a system bus. The processor of the electronic device provides computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements a dataless black-box attack countermeasure method. The display screen of the electronic device may be a liquid crystal display screen or an e-ink display screen. The input device of the electronic device may be a touch layer covering the display screen, or buttons, a trackball, or a touchpad provided on the casing of the electronic device, or an external keyboard, touchpad, or mouse, etc.

[0179] Those skilled in the art will understand that the structure of the above-described electronic device is only a partial structure related to the present disclosure and does not constitute a limitation on the electronic device to which the present disclosure is applied. A specific electronic device may include more or fewer components than the aforementioned components, or combine certain components, or have different component arrangements.

[0180] In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the dataless black-box adversarial attack method as described in the embodiments of this application.

[0181] In an exemplary embodiment, a storage medium is also provided, which, when the instructions in the storage medium are executed by the processor of an electronic device, enables the electronic device to execute the dataless black-box countermeasure attack method in the embodiments of this application.

[0182] In an exemplary embodiment, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute the dataless black-box adversarial attack method in the embodiments of this application.

[0183] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0184] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0185] The above description is only a preferred embodiment of the present invention. It should be understood that the above description of the embodiments is only for the purpose of helping to understand the method and core idea of ​​the present invention, and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, etc. made within the idea and principle of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training, characterized in that, include: A synthetic image is used to query a target model to obtain the hard labels returned by the target model. A query synthetic sample pool is constructed, and an initial alternative model is trained based on the query synthetic sample pool. The alternative model includes a backbone network and a classifier. The samples in the query synthetic sample pool are subjected to multi-view enhancement to generate a strong enhanced view and multiple weak enhanced views. The teacher model is used to generate pseudo-labels based on the weak enhanced views. The strong enhanced views and the pseudo-labels constitute the multi-view enhanced samples. Furthermore, the samples in the query synthesis sample pool are mixed and enhanced by mixing the enhanced views of two samples according to the mixing coefficient to obtain a mixed image, and the corresponding two hard labels are interpolated according to the same coefficient to obtain a mixed label. The mixed image and the mixed label constitute a mixed enhanced sample. Based on the multi-view augmented samples, the parameters of the backbone network are updated with a first loss function, and the parameters of the classifier are not updated during this stage; Based on the hybrid augmented samples and the query hard labels, the parameters of the backbone network and the classifier are updated simultaneously using a second loss function; Adversarial examples are generated on the trained alternative model, and the adversarial examples are input into the target model to carry out the attack.

2. The data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training according to claim 1, characterized in that, The construction of the query synthetic sample pool specifically includes: synthesizing candidate images. Query target model Obtain one-hot hard label ,through Build after the query ;use The initial alternative model is trained using cross-entropy loss. ,in , As the backbone network, For classifiers, This is the cross-entropy loss function.

3. The data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training according to claim 1, characterized in that, The multi-view enhancement specifically includes: synthesizing samples for each query. Generate a strongly enhanced view and A weakly enhanced view Using the exponential moving average teacher model The pseudo-label distribution is obtained by averaging the predictions from multiple weakly augmented views. The category corresponding to the maximum value is taken as the pseudo-label. To form a multi-view enhanced sample set ; in: ， 。 4. The data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training according to claim 1, characterized in that, The hybrid enhancement specifically includes: adjusting the two strongly enhanced samples according to a mixing coefficient. Blend to obtain a blended image. Linear interpolation is performed on the two corresponding query hard labels using the same coefficient to obtain the mixed label. To form a hybrid enhanced sample set ; in ,from Sampling in the distribution ; Implemented by MixUp or CutMix; the two strongly enhanced samples are random pairings of different original samples from the same mini-batch, obtained by randomly permuting the mini-batch sample index.

5. The data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training according to claim 1, characterized in that, The step of updating the backbone network with the first loss function specifically includes: using multi-view loss. The first loss function is calculated using pseudo-label confidence scores as a weighting factor: ， ， in As the confidence level weight, This represents the maximum probability value of the pseudo-label distribution. This is the lower confidence level. The upper limit of confidence and satisfying , is the numerical stability constant.

6. The data-free black-box adversarial attack method based on image enhancement and two-stage decoupled training according to claim 1, characterized in that, The step of simultaneously updating the backbone network and the classifier using the second loss function specifically includes: using target anchoring loss. For the second loss function: ， ， ， in For mixed sample loss, For soft-label cross-entropy loss; For class-balanced loss, To balance the weights for each category, For the sample Category The number of times it appears in; This is a weighting factor.

7. A data-free black-box adversarial attack device based on image enhancement and two-stage decoupled training, characterized in that, include: The query synthesis module is used to obtain hard labels from the target model by querying the synthesized image, construct a query synthesis sample pool, and train an initial alternative model based on the query synthesis sample pool. The alternative model includes a backbone network and a classifier. The multi-view enhancement module is used to perform multi-view enhancement on the samples in the query synthetic sample pool, generate a strong enhanced view and multiple weak enhanced views, use the teacher model to generate pseudo-labels based on the weak enhanced views, and the strong enhanced views and the pseudo-labels constitute the multi-view enhanced samples. The hybrid enhancement module is used to perform hybrid enhancement on the samples in the query synthetic sample pool. It mixes the enhanced views of two samples according to the mixing coefficient to obtain a hybrid image, and interpolates the corresponding two hard labels according to the same coefficient to obtain a hybrid label. The hybrid image and the hybrid label constitute a hybrid enhanced sample. A two-stage decoupled training module is used to update the parameters of the backbone network with a first loss function based on the multi-view augmented samples, and the parameters of the classifier are not updated in this stage; And based on the hybrid augmented samples and the query hard labels, the parameters of the backbone network and the classifier are updated simultaneously using a second loss function; The adversarial example generation and transfer module is used to generate adversarial examples on the trained alternative model and input the adversarial examples into the target model to carry out the attack.

8. The data-free black-box adversarial attack device based on image enhancement and two-stage decoupled training according to claim 7, characterized in that, The two-stage decoupled training module includes: a first-stage training submodule, which updates only the backbone network based on the multi-view augmented samples and pseudo-label confidence-weighted multi-view loss, where the classifier participates in forward propagation but its gradient is cleared to zero after backpropagation; a second-stage training submodule, which updates both the backbone network and the classifier simultaneously based on the mixed augmented samples and query hard labels, using a target anchoring loss combining mixed sample loss and class balance loss; and a teacher model update submodule, which updates the teacher model using an exponential moving average.

9. An electronic device, comprising: processor; A memory for storing processor-executable instructions; characterized in that the processor is configured to perform the method of any one of claims 1-6.

10. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method of any one of claims 1-6.

Images