A cross-architecture security evaluation method for black-box visual models
Patent Information
- Application Number
- CN202611121591.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-07-27
- Publication Date
- 2026-10-13
AI Technical Summary
[0006]本发明的技术方案用于解决现有基于一阶梯度的黑盒迁移方法过分依赖源模型局部确定性梯度信息，导致迁移性不足、更新方向可利用信息有限；而现有高阶梯度方法在构造过程中分别对预估梯度与矫正梯度进行归一化，破坏了二者间的相对尺度关系，损害更新方向质量
本发明方法采用分裂随机二阶龙格-库塔求解机制，通过预估-中间状态-矫正框架利用更多前瞻信息，有效提高单步更新方向的质量与迁移潜力。放弃传统分步归一化，引入基于样本级更新梯度的统一梯度放大因子，完整保持预估与矫正梯度间的相对尺度，进一步提升对抗样本在多种架构和防御策略下的跨模型迁移成功率。实验证明，本发明方法在卷积网络、视觉Transformer及对抗训练模型上均取得了优于现有前沿方法的误导成功率，兼具高迁移性与可解释性。
Smart Images
Figure CN122906499A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of adversarial sample generation technology and relates to a cross-architecture security assessment method for black-box visual models. Background Technology
[0002] With the widespread application of deep learning technology in image recognition, object detection, and semantic segmentation, the security and robustness of these models have received increasing attention. Adversarial examples refer to a special type of input that, by superimposing minute perturbations imperceptible to the human eye onto the original sample, causes a deep learning model to produce erroneous outputs. These inputs are the cornerstone for testing the robustness of deep learning models and ensuring the safe and reliable deployment of such models. Among these, transfer-based adversarial example generation techniques are crucial for achieving security evaluation of deep learning visual models in black-box scenarios. Therefore, how to generate highly transferable adversarial examples to implement cross-architecture security evaluation of black-box visual models has always been a hot topic in this field.
[0003] Many existing methods for generating transferable adversarial examples are based on first-order gradient optimization, such as MI-FGSM, PGN, GAA, IE-FGSM, and MRK. While these methods can generate transferable adversarial examples, they often suffer from insufficient transferability and limited utilization of update direction information when facing unknown black-box models because they rely primarily on locally deterministic gradient information provided by the source model at the current position. Furthermore, the design of existing methods heavily depends on unreliable intuition, and insufficient theoretical explanation makes it difficult to design highly transferable adversarial example generation methods.
[0004] Existing research has shown that the discrete gradient iteration process can be linked to the numerical solution process of ordinary differential equations, allowing for a numerical analysis understanding of the construction mechanism of gradient update directions and leveraging higher-order numerical solvers to utilize more look-ahead information to improve the quality of single-step progress. However, modeling using only ordinary differential equations typically assumes that the iterative process is dominated by a single deterministic gradient field, making it difficult to explicitly characterize the gradient field differences between the source model and the black-box model, and also difficult to describe the propagation of local neighborhood perturbations and random fluctuations in the optimization path.
[0005] Furthermore, methods that use higher-order gradient information to generate adversarial examples (such as IE-FGSM and MRK) often employ normalization methods to ensure consistent gradient magnitudes when approximating higher-order gradients. This neglects the relative scale issue between different gradients, thus affecting the final update direction and compromising the transferability of adversarial examples. To balance computational feasibility, improved transferability, and interpretability of the adversarial example generation process, it is necessary to propose a transferable adversarial example generation method to achieve cross-architecture security evaluation of black-box visual models. Summary of the Invention
[0006] The technical solution of this invention addresses the problem that existing black-box transfer methods based on first-order gradients rely excessively on local deterministic gradient information of the source model, resulting in insufficient transferability and limited information available for update directions. Furthermore, existing higher-order gradient methods normalize both the predicted and corrected gradients during construction, disrupting the relative scale relationship between them and impairing the quality of update directions. Simultaneously, existing methods lack sufficient theoretical explanation, making it difficult to guide the generation of highly transferable adversarial examples for cross-architecture security evaluation of black-box visual models from a mechanistic perspective.
[0007] The present invention solves the above-mentioned technical problems through the following technical solutions:
[0008] This invention provides a cross-architecture security assessment method for black-box visual models, including: Obtain the original samples, ground truth labels, source model, and hyperparameters; The discrete iterative process based on I-FGSM is modeled as an ordinary differential equation, and the differences in gradient fields between models, the uncertainty of local neighborhood perturbation propagation, and optimization random fluctuations are introduced to extend the ordinary differential equation into a stochastic differential equation. In each iteration, random Gaussian noise is injected into the current sample to generate multiple neighborhood random samples, and the predicted gradient is calculated for each sample. An intermediate state is constructed based on the predicted gradient and the gradient amplification factor, and the corrected gradient is calculated at the intermediate state. An unnormalized sample-level update gradient is constructed based on the predicted gradient and the corrected gradient, and the unified gradient amplification factor is updated with the inverse of the gradient norm. The average update gradients corresponding to multiple neighborhood random samples are averaged to obtain the round average update gradient, and random Gaussian noise is superimposed to obtain the round update gradient estimate; Generate high-transfer adversarial examples by combining momentum update mechanism and projection constraints; The transferable adversarial sample is input into the black-box model under test, and the prediction result of the black-box model under test for the high-transferability adversarial sample is obtained. The misleading success rate is calculated based on the prediction result to evaluate the security defense performance or vulnerability level of the black-box model under test.
[0009] Furthermore, the stochastic differential equation is:
[0010] in, For the original sample, For deterministic drift terms, This represents the diffusion intensity term. This represents the Wiener process.
[0011] Furthermore, the formula for generating random samples in the neighborhood is:
[0012] in, The number of random samples in the neighborhood. Let n be the nth neighborhood sample at time t. For the sample at time t, Let n be the nth random noise at time t. Follows a normal distribution , This represents the intensity of random noise.
[0013] Furthermore, the formula for calculating the predicted gradient is as follows:
[0014] The formula for calculating the correction gradient is as follows:
[0015] in, To correct the gradient, To predict the gradient, For real labels, For loss function Regarding the gradient of x, For loss function Regarding the gradient of x, This is the source model.
[0016] Furthermore, the formula for the unnormalized sample-level update gradient is as follows:
[0017] The formula for calculating the unified gradient amplification factor is as follows:
[0018] in, Update gradients at the unnormalized sample level. To update the L1 norm of the gradient at the unnormalized sample level, This is the gradient amplification factor.
[0019] Furthermore, the formula for calculating the average update gradient across rounds is as follows:
[0020] in, The gradient is updated on average over rounds.
[0021] Furthermore, the momentum update mechanism is as follows:
[0022] Where μ represents the momentum decay coefficient, For the first The momentum term of the round iteration, For the first The momentum term of the round iteration, To update the gradient estimate for each round, The L1 norm of the gradient estimate is updated for each round.
[0023] Furthermore, the high-transfer adversarial example is:
[0024] in, For high-transfer adversarial examples, This is represented as the perturbation-constrained projection operator. The iteration step size, For symbolic functions, The sample is at time t+1.
[0025] The present invention also provides an electronic device, including a memory and a processor, wherein the memory is used to store a program that supports the processor in executing the above-described cross-architecture security assessment method for black-box visual models, and the processor is configured to execute the program stored in the memory.
[0026] The present invention also provides a storage medium storing a computer program, which, when run by a processor, executes the steps of the above-described cross-architecture security evaluation method for black-box visual models.
[0027] The beneficial effects of this invention are as follows: This invention employs a split-stochastic second-order Runge-Kutta solution mechanism, utilizing more look-ahead information through a prediction-intermediate state-correction framework to effectively improve the quality and transfer potential of single-step update directions. It abandons traditional step-by-step normalization and introduces a unified gradient amplification factor based on sample-level update gradients, fully maintaining the relative scale between the prediction and correction gradients, further enhancing the cross-model transfer success rate of adversarial examples under various architectures and defense strategies. Experiments demonstrate that this invention achieves superior misleading success rates compared to existing state-of-the-art methods on convolutional networks, visual Transformers, and adversarial training models, exhibiting both high transferability and interpretability. Attached Figure Description
[0028] Figure 1 This is a flowchart of the method for generating adversarial examples for course transfer in Embodiment 1 of the present invention; Figure 2 This is a structural diagram of an electronic device according to Embodiment 2 of the present invention. Detailed Implementation
[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0030] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments: Example 1 like Figure 1 As shown, this embodiment provides a cross-architecture security evaluation method for black-box visual models, applicable to deep learning-based image classification models, object detection models, semantic segmentation models, or other visual task models. It evaluates black-box visual models by generating adversarial examples with transferability capabilities, specifically including the following steps: Step 1: Obtaining raw sample data and parameters Obtain the original sample Authentic Labels Source Model Maximum Disturbance Budget Iteration step size Number of iterations Momentum decay coefficient Random noise intensity and the number of random samples in the neighborhood .
[0031] Step 2: Modeling from ordinary differential equations to stochastic differential equations Based on the discrete iterative process of I-FGSM (Iterative Fast Gradient Sign Method), a continuous-form ordinary differential equation is constructed; the discrete iterative process of I-FGSM is described as follows: (1) in, For perturbation-constrained projection operators. The iteration step size, The iteration number, For symbolic functions, For real labels, For the sample at time t, For the sample at time t+1, For loss function The gradient with respect to x.
[0032] Ignoring the perturbation constraint projection operator and the sign function, the discrete iterative process of I-FGSM can be represented as a continuous ordinary differential equation as follows: (2) in, For deterministic drift terms, , As the initial sample, This is the original sample.
[0033] Considering the differences in gradient fields between models, the uncertainty of local neighborhood perturbation propagation, and the optimization of stochastic fluctuations, the ordinary differential equation is extended into a stochastic differential equation; the stochastic differential equation is as follows: (3) in, This represents the diffusion intensity term. This represents the Wiener process.
[0034] The deterministic drift term characterizes the main optimization direction given by the source model, while the diffusion intensity term characterizes the differences between models, the propagation of local perturbations, and random fluctuations during the optimization process.
[0035] Step 3: Adding random Gaussian noise and calculating the predicted gradient In each iteration, an input intensity of is added to the current sample. Random Gaussian noise is used to generate multiple neighborhood random samples, and the predicted gradients are calculated for each.
[0036] In the During the round of iteration, for the current sample generate The following are random samples from the neighborhood: (4) in, The number of random samples in the neighborhood. Let n be the nth neighborhood sample at time t. Let n be the nth random noise at time t. Follows a normal distribution , This represents the intensity of random noise.
[0037] Based on domain samples, respectively in The predicted gradient is calculated at each of the random neighborhood samples, and the formula for calculating the predicted gradient is as follows: (5) in, To estimate the gradient.
[0038] Step 4: Construction of intermediate states and calculation of correction gradients An intermediate state is constructed based on the predicted gradient, and a corrected gradient is calculated at the intermediate state; the formula for constructing the intermediate state based on the predicted gradient is as follows: (6) in, This is the nth intermediate state sample at time t. This is the gradient amplification factor.
[0039] The formula for calculating the correction gradient at the intermediate state is as follows: (7) in, To correct the gradient, For loss function The gradient with respect to x.
[0040] Step 5: Calculation of unnormalized sample-level update gradient and gradient amplification factor Based on the predicted gradient and the corrected gradient, an unnormalized sample-level update gradient is constructed and the gradient amplification factor is calculated.
[0041] The formula for the unnormalized sample-level update gradient is as follows: (8) in, Update the gradient for unnormalized sample levels.
[0042] Instead of normalizing the predicted gradient and the corrected gradient separately during the construction phase, the uniform gradient amplification factor is calculated and updated after obtaining the sample-level updated gradient.
[0043] The formula for calculating the unified gradient amplification factor is as follows: (9) in, Update the L1 norm of the gradient at the unnormalized sample level.
[0044] By unifying the gradient amplification factor, the relative scale relationship between the predicted gradient and the corrected gradient in the sample-level update gradient is maintained.
[0045] Step 6: Average gradient update across rounds and superimpose Gaussian noise. right The average update gradient across all samples is calculated by averaging the update gradients at each sample level. The formula for calculating the average update gradient across all rounds is as follows: (10) in, The gradient is updated on average over rounds.
[0046] The gradient Gaussian noise is superimposed on the average gradient of each round to obtain the round-updated gradient estimate. The calculation formula for the round-updated gradient estimate is as follows: (11) in, To update the gradient estimate for each round, Let be random noise at time t. Follows a normal distribution Preferably, the number of neighborhood random samples It is 20, but not limited to 20.
[0047] By averaging the gradients of multiple neighborhood random samples, the variance of gradient estimation caused by random sampling is reduced and the optimization stability is improved.
[0048] Step 7: Normalize the gradient, update the momentum term, and generate adversarial examples using projection constraints. In the final optimization stage, the gradient of each round is normalized, and the momentum term is updated in combination with the momentum mechanism of MI-FGSM. Then, the perturbation projection constraint is executed to obtain high transfer adversarial examples.
[0049] The formula for updating the momentum term using the momentum mechanism combined with MI-FGSM is as follows: (12) Where μ represents the momentum decay coefficient, For the first The momentum term of the round iteration, For the first The momentum term of the round iteration, The L1 norm of the gradient estimate is updated for each round.
[0050] The formula for calculating the high-mobility adversarial example is as follows: (13) in, For high-transfer adversarial examples, Represented as a perturbation-constrained projection operator, it is used to constrain the updated samples to a range centered on the original samples with a perturbation budget of Within the constrained space.
[0051] Step 8: Test the success rate of adversarial examples in misleading the black-box model. The high-transfer adversarial sample is input into the black-box model under test. The prediction results of the black-box model for the high-transfer adversarial sample are obtained, and the misdirection success rate is calculated based on the prediction results to evaluate the security defense performance or vulnerability level of the black-box model under test. In the classification task, the formula for calculating the misdirection success rate is as follows:
[0052] Where Pred represents the model's classification result for adversarial examples, and # represents the number of examples.
[0053] It should be noted that the number of neighborhood random samples, input noise intensity, gradient noise intensity, step size, number of iterations, momentum decay coefficient, and intermediate propulsion coefficient can all be configured according to the actual task. This embodiment is not limited to image classification tasks, but can also be extended to adversarial example generation in object detection, semantic segmentation, or other deep learning vision tasks.
[0054] In one example, a deep learning-based image classification model is selected as the source model. The original image is used as input, and the gradient is calculated using targetless cross-entropy loss. The number of random neighborhood samples is set to M=20, and in each iteration, the current sample is injected with 20 intensity levels. The input is Gaussian noise, resulting in 20 neighborhood random samples. For each neighborhood random sample, the predicted gradient is calculated, intermediate states are constructed, the corrected gradient is calculated, the sample-level final gradient is formed, and the corresponding uniform gradient amplification factor is determined. Then, the 20 uniformly scaled sample-level final gradients are averaged and the intensity is superimposed. The gradient Gaussian noise is used to obtain the gradient estimate for each round; finally, adversarial examples are generated iteratively by combining the MI-FGSM momentum update mechanism. The method in this embodiment can achieve better transfer performance on multiple unknown target models, and can explain the reason for the enhanced transferability from the perspective of stochastic differential equations.
[0055] Experimental verification This invention verifies the effectiveness of its method through the following experimental examples. In these examples, adversarial examples are generated based on the ResNext-50 classifier as a white-box source model. To fully evaluate the effectiveness of the method, this experimental example introduces six target models, covering two model architectures: convolutional neural networks and Transformers, and two learning paradigms: normal training and adversarial training. This experimental example uses the Attack Success Rate (ASR) as a key evaluation metric. The Attack Success Rate (ASR) directly measures the ability of adversarial examples to mislead the classifier; that is, under specific conditions, the proportion of times the adversarial example causes the classifier to fail to obtain the correct result. A higher ASR indicates stronger adversarial performance and better misleading effect on the classifier. A comparison of the effectiveness of the method of this invention with existing methods is shown in Table 1. This experiment tested the performance of adversarial examples on six models: ResNet18 (Res18), Inception-v3 (Incv3), Vision Transformer (Vit), Swin Transformer (Sit), advInception-v3 (advIncv3), and advInceptionResNet-v2 (advIR). Res18 and Incv3 are normal training models with convolutional neural network architectures; Vit and Sit are normal training models with Transformer architectures; and advIncv3 and advIR are adversarial training models with defensive capabilities based on convolutional neural network architectures. This experiment generated adversarial examples based on 1000 ImageNet validation images and statistically analyzed the misleading success rate of adversarial examples generated by different methods on the six test models. Higher values indicate better performance of the adversarial examples (see Table 1 below).
[0056] Table 1. Comparison of the effects of the method of the present invention and existing methods
[0057] As shown in Table 1, the adversarial examples generated by the method of this invention have an average misleading success rate that is 4% and 7% higher than the current state-of-the-art methods PGN and GAA, respectively. Experimental results demonstrate that the adversarial examples generated by the method of this invention exhibit stable and high transferability against models with various architectures and training methods.
[0058] The method of this invention first models the gradient iteration process of I-FGSM as an ordinary differential equation, and then introduces the differences in gradient fields between models, the uncertainty of local neighborhood perturbation propagation, and optimization of random fluctuations to extend the ordinary differential equation into a stochastic differential equation. Subsequently, the stochastic second-order Runge-Kutta method is used to approximate the solution of the stochastic differential equation. Specifically, in each iteration, random Gaussian noise is injected into the current sample to form multiple neighborhood random samples, and the predicted gradient is calculated for each sample. An intermediate state is constructed based on the predicted gradient and the gradient amplification factor. The corrected gradient is calculated at the intermediate state. The sample-level update gradient is obtained based on the gradient amplification factor, the predicted gradient, and the corrected gradient, and random Gaussian noise is superimposed on it. At the same time, the unified gradient amplification factor is updated with the inverse of the norm of the sample-level update gradient. Then, the update gradients corresponding to multiple neighborhood random samples are averaged. Finally, adversarial examples are generated by combining the momentum update mechanism of MI-FGSM. This invention explicitly characterizes deterministic drift and stochastic diffusion in the migration process from the perspective of stochastic differential equations, providing a unified mathematical expression for inter-model differences and optimization fluctuations, thereby enhancing the theoretical interpretability of the method. It employs a split stochastic second-order Runge-Kutta solution framework, utilizing more local state information through a second-order approximation mechanism of prediction-intermediate state-correction to improve the quality of update directions, which is beneficial for enhancing the cross-model migration capability of adversarial examples. By elevating the iterative generation process of adversarial examples to a stochastic differential equation model, it explicitly characterizes deterministic gradient drift and stochastic diffusion such as inter-model differences and neighborhood perturbations, significantly enhancing theoretical interpretability.
[0059] Example 2 This embodiment provides an electronic device, including a memory and a processor. The memory is used to store a program that supports the processor in executing the cross-architecture security assessment method for black-box visual models in Embodiment 1. The processor is configured to execute the program stored in the memory. Figure 2 This is a structural diagram of an electronic device according to an embodiment, such as... Figure 2 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.
[0060] Example 3 This embodiment provides a storage medium on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the cross-architecture security assessment method for black-box visual models in Embodiment 1.
[0061] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A cross-architecture security assessment method for black-box visual models, characterized in that, include: Obtain the original samples, ground truth labels, source model, and hyperparameters; The discrete generation process based on I-FGSM is modeled as an ordinary differential equation, and the differences in gradient fields between models, the uncertainty of local neighborhood perturbation propagation, and optimization of random fluctuations are introduced to extend the ordinary differential equation into a stochastic differential equation. In each iteration, random Gaussian noise is injected into the current sample to generate multiple neighborhood random samples, and the predicted gradient is calculated for each sample. An intermediate state is constructed based on the predicted gradient and the gradient amplification factor, and the corrected gradient is calculated at the intermediate state. An unnormalized sample-level update gradient is constructed based on the predicted gradient and the corrected gradient, and the unified gradient amplification factor is updated with the inverse of the gradient norm. The average update gradients corresponding to multiple neighborhood random samples are averaged to obtain the round average update gradient, and random Gaussian noise is superimposed to obtain the round update gradient estimate; Generate high-transfer adversarial examples by combining momentum update mechanism and projection constraints; The high-transfer adversarial sample is input into the black-box model under test, the prediction result of the black-box model under test for the high-transfer adversarial sample is obtained, and the misleading success rate is calculated based on the prediction result to evaluate the security defense performance or vulnerability level of the black-box model under test.
2. The cross-architecture security assessment method for black-box visual models according to claim 1, characterized in that, The stochastic differential equation is: in, For the original sample, For deterministic drift terms, This represents the diffusion intensity term. This represents the Wiener process.
3. The cross-architecture security assessment method for black-box visual models according to claim 2, characterized in that, The formula for generating random neighborhood samples is: in, The number of random samples in the neighborhood. Let n be the nth neighborhood sample at time t. For the sample at time t, Let n be the nth random noise at time t. Follows a normal distribution , This represents the intensity of random noise.
4. The cross-architecture security assessment method for black-box visual models according to claim 3, characterized in that, The formula for calculating the predicted gradient is as follows: The formula for calculating the correction gradient is as follows: in, To correct the gradient, To predict the gradient, For real labels, For loss function Regarding the gradient of x, For loss function Regarding the gradient of x, This is the source model.
5. The cross-architecture security assessment method for black-box visual models according to claim 4, characterized in that, The formula for the unnormalized sample-level update gradient is as follows: The formula for calculating the unified gradient amplification factor is as follows: in, Update gradients at the unnormalized sample level. To update the L1 norm of the gradient at the unnormalized sample level, This is the gradient amplification factor.
6. The cross-architecture security assessment method for black-box visual models according to claim 5, characterized in that, The formula for calculating the average update gradient across rounds is as follows: in, The gradient is updated on average over each round.
7. The cross-architecture security assessment method for black-box visual models according to claim 6, characterized in that, The momentum update mechanism is as follows: Where μ represents the momentum decay coefficient, For the first The momentum term of the round iteration, For the first The momentum term of the round iteration, To update the gradient estimate for each round, The L1 norm of the gradient estimate is updated for each round.
8. The cross-architecture security assessment method for black-box visual models according to claim 7, characterized in that, The high-transfer adversarial sample is: in, For high-transfer adversarial examples, This is represented as the perturbation-constrained projection operator. The iteration step size, For symbolic functions, The sample is at time t+1.
9. An electronic device, comprising a memory and a processor, characterized in that, The memory is used to store a program that supports the processor in executing the cross-architecture security assessment method for black-box visual models as described in any one of claims 1 to 8, and the processor is configured to execute the program stored in the memory.
10. A storage medium storing a computer program, characterized in that, The computer program is executed by a processor to perform the steps of the cross-architecture security assessment method for black-box visual models as described in any one of claims 1 to 8.