CN110334806A - A method of adversarial sample generation based on generative adversarial network - Google Patents

Abstract

The invention discloses a method for generating an adversarial sample based on a generative adversarial network, including a generator G, a discriminator D, a space transformation module ST and a target classification network F. The generator G generates a disturbance, and the disturbance is superimposed on the original sample to generate Adversarial samples, and then train the generator G according to the loss function of the discriminator D and the target classification network F, and finally get the trained generator G, and use the trained generator G to generate adaptive confrontation samples for different input samples. The invention utilizes a generative confrontation network, embeds an enhancement module based on space transformation, conducts confrontation training in an unsupervised manner, improves the generalization ability and robustness of the attack model, and further enhances the migration and robustness of the confrontational samples.

Description

A method of adversarial sample generation based on generative adversarial network

technical field

The present invention relates to the field of machine learning, and more specifically, to a method for generating an adversarial example based on a generative adversarial network.

Background technique

Adversarial attacks are a hot topic in the field of machine learning. The principle of adversarial attack is to deceive the deep neural network to make wrong judgments by adversarial samples (new samples obtained by adding carefully trained tiny perturbations that are imperceptible to the human eye to the original data samples).

Most of the current attack algorithms based on deep neural networks (such as gradient-based and optimization-based methods) are aimed at the test process or test data set, and require white-box access to the model's architecture and parameters all the time (such as getting and input The associated gradient requires knowledge of the weights of the target network). However, current deep learning systems usually do not allow white-box access to the model for security reasons, only query access to the model, which treats the model as a black box. Attacks against this situation are called black-box attacks, but the success rate of most current black-box attacks is not high, because most black-box attack methods are based on the transferability of adversarial samples. Transferability is a common property of adversarial examples, which means that adversarial examples generated based on finite samples also have good attack effects on other variable domains.

Transferability is crucial in black-box attacks where the target network structure and training dataset are unavailable. How to efficiently generate adversarial samples with strong transferability and stable attack performance is a very meaningful and challenging problem.

In summary, although existing studies have proved that existing attack methods have certain transferability between neural networks with the same structure trained on different data, and between neural networks with different structures trained on the same task, such as [1] Goodfellow I J, Shlens J, Szegedy C, et al. Explaining and Harnessing Adversarial Examples [J]. International Conference on Learning Representations, 2015, Literature [2] Kurakin A, Goodfellow I J, Bengio S, et al. Adversarial examples in the physical world [J ].arXiv:Computer Vision and Pattern Recognition,2017, literature [3]Moosavidezfooli S,Fawzi A,Frossard P,et al.DeepFool:A Simple and Accurate Method to Fool Deep Neural Networks[J].Computer Vision and Pattern Recognition,2016: 2574-2582 and literature [4] Xiao C, Li B, Zhu J Y, et al. Generating Adversarial Examples with Adversarial Networks [J]. 2018; but there are still adversarial examples that rely too much on the target model, which leads to poor transferability of adversarial examples and successful attacks Low rate, low attack efficiency and other issues.

Contents of the invention

The present invention provides a method for generating adversarial samples based on a generative adversarial network, which realizes adaptive generation of adversarial samples with transferability and robustness for different input samples.

In order to solve the problems of the technologies described above, the technical solution of the present invention is as follows:

A method for generating an adversarial example based on a generative adversarial network, comprising the following steps:

S1: Input the original sample x into the generator G, the generator G outputs a disturbance G(x), the loss function of the generator G is L _G , and the disturbance G(x) is superimposed on the original sample x to obtain an adversarial sample x′ =x+G(x), unlike the general GAN, the goal of the generator is to generate disturbances rather than the final image, that is, the output image is equal to the input image plus the output image of the generator G, and the details and texture of the generated adversarial samples are copied from the input image, greatly preserving the details of the original image;

S2: Input the adversarial sample x' obtained by S1 into the discriminator D, and the discriminator D distinguishes the adversarial sample x' from the original sample x, and obtains the loss function L D of the discriminator _D ;

S3: Input the adversarial sample x' obtained in S1 into the enhanced module ST, the enhanced module ST performs a spatial transformation operation on the adversarial sample x' based on the spatial transformation, and the enhanced module ST outputs the affine transformed adversarial sample x ′ _st =T _θ (x+G(x)), where T _θ is the transformation function;

S4: Input the adversarial sample x′ _st processed by the affine transformation into the target classification model F, and obtain the loss function L _{F of the target classification model F} ;

S5: According to the loss function of the generator G as L _G , the loss function L D of the discriminator _D and the loss function L _F of the target classification model F, the target function L _GAN is constructed to train the attack model GAN, and the trained generator G is obtained ;

S6: Use the trained generator G to generate adaptive adversarial samples for different input samples.

Preferably, the loss function of the generator G uses the L2 norm as the distance metric loss, specifically expressed as follows:

L _G ＝max(0,||G(x)|| ₂ -c)

Among them, c is a custom constant, which allows the user to specify the amount of perturbation added, and can generate various adversarial samples, which can help to better understand the feature space of adversarial samples. This loss can also stabilize the training of GAN.

Preferably, the discriminator D is a binary neural network classifier.

Preferably, the loss function of the discriminator D is specifically:

L _D =logD(x)+log(1-D(x+G(x))).

Preferably, the loss function of the target classification model F in a targeted attack is:

L _F = L(F(T _θ (x+G(x))),y′)

Indicates the distance between the predicted class and the target class y′, where L is the cross-entropy loss function;

The loss function of the target classification model F in an untargeted attack is:

L _F ＝-L(F(T _θ (x+G(x))),y)

Indicates the negative distance between the predicted class and the original label class y, where L is the cross-entropy loss function.

Preferably, the objective function L _GAN is expressed as:

L _GAN ＝L _F +αL _D +β·L _G

In the formula, α and β are constants used to control the relative importance of each objective function, L _G is used to generate small perturbations, _{L D} is used to encourage the generated adversarial samples to show similarity to the original samples, and LF is used to optimize the adversarial sample, improve the attack success rate, and obtain the generator G and discriminator D by minimizing the generator loss function and maximizing the discriminator loss function argmin _g max _d L _GAN solution.

Preferably, step S5 also includes testing the trained generator G, specifically including the following steps:

S5.1: Use the trained generator G to generate disturbances to generate test adversarial samples, and input the test adversarial samples into target classification networks with different structures to make them misclassified;

S5.2: Perform spatial transformation on the test adversarial samples in S5.1 to generate new test adversarial samples, and input the new test adversarial samples into the target classification network to make them classified incorrectly.

Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

Compared with the existing attack algorithm, the method proposed in the present invention can effectively generate attack samples for different input samples without accessing the original target classification model, the query and generation efficiency is high, the attack model has strong generalization ability and robustness, and can Effectively improve the transferability and robustness of adversarial samples, thereby increasing the success rate of black-box attacks. The method of the invention has wide applicability and strong versatility, and the attack success rate on different types of data sets and models with different structures is relatively high.

Description of drawings

Figure 1 is a flow chart of a method for generating an adversarial example based on a generative adversarial network.

Figure 2 is a schematic diagram of a model of an adversarial sample generation method based on a generative adversarial network. The dotted line in the figure represents the training process, and the solid line represents the testing process.

Figure 3 is a flow chart of black-box attack robustness implementation.

Detailed ways

The accompanying drawings are for illustrative purposes only and cannot be construed as limiting the patent;

In order to better illustrate this embodiment, some parts in the drawings will be omitted, enlarged or reduced, and do not represent the size of the actual product;

For those skilled in the art, it is understandable that some well-known structures and descriptions thereof may be omitted in the drawings.

The technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

Example 1

A method for generating an adversarial example based on a generative adversarial network, as shown in Figures 1 to 2, comprising the following steps:

S1: Input the original sample x into the generator G, the generator G outputs a disturbance G(x), the loss function of the generator G is L _G , and the disturbance G(x) is superimposed on the original sample x to obtain an adversarial sample x′ =x+G(x), unlike the general GAN, the goal of the generator is to generate disturbances rather than the final image, that is, the output image is equal to the input image plus the output image of the generator G, and the details and texture of the generated adversarial samples are Copied from the input image, the details of the original image are greatly preserved. The loss function of the generator G uses the L2 norm as the distance metric loss, which is expressed as follows:

L _G ＝max(0,||G(x)|| ₂ -c)

Among them, c is a custom constant;

S2: Input the adversarial sample x' obtained by S1 into the discriminator D, the discriminator D distinguishes the adversarial sample x' from the original sample x, the discriminator D is a binary neural network classifier, and the loss of the discriminator D is obtained Function L _D =logD(x)+log(1-D(x+G(x)));

S3: Input the adversarial sample x' obtained in S1 into the enhanced module ST, the enhanced module ST performs a spatial transformation operation on the adversarial sample x' based on the spatial transformation, and the enhanced module ST outputs the affine transformed adversarial sample x ′ _st =T _θ (x+G(x)), where T _θ is the transformation function;

S4: Input the adversarial sample x′ _st processed by the affine transformation into the target classification model F, and obtain the loss function L _F of the target classification model F. The loss function of the target classification model F in a targeted attack is:

L _F = L(F(T _θ (x+G(x))),y′)

Indicates the distance between the predicted class and the target class y′, where L is the cross-entropy loss function;

The loss function of the target classification model F in an untargeted attack is:

L _F ＝-L(F(T _θ (x+G(x))),y)

Indicates the negative distance between the predicted class and the original label class y, where L is the cross-entropy loss function;

S5: According to the loss function of the generator G as L _G , the loss function L D of the discriminator _D and the loss function L _F of the target classification model F, the target function L _GAN is constructed to train the attack model GAN, and the trained generator G is obtained and the discriminator D, the objective function L _GAN is expressed as:

L _GAN ＝L _F +αL _D +β·L _G

In the formula, α and β are constants used to control the relative importance of each objective function, L _G is used to generate small perturbations, _{L D} is used to encourage the generated adversarial samples to show similarity to the original samples, and LF is used to optimize the adversarial samples to increase the attack success rate;

It also includes testing the trained generator G, which specifically includes the following steps:

S5.1: Use the trained generator G to generate disturbances to generate test adversarial samples, and input the test adversarial samples into target classification networks with different structures to make them misclassified;

S5.2: Perform spatial transformation on the test adversarial samples in S5.1 to generate new test adversarial samples, and input the new test adversarial samples into the target classification network to make them classified incorrectly.

S6: Use the trained generator G to generate adaptive adversarial samples for different input samples.

In the specific implementation process, the black-box attack is taken as an example to carry out the robustness test, and the specific process is shown in Figure 3.

1) Select attack target F. Use the CIFAR-10 dataset to train ResNet-18, ResNet-34 and VGG-16 Use the GTSRB dataset to train VGG-16 and Multi-Scale CNN, and get two groups of five attack target models F={F1,F2,F3, F4,F5}. Among them, ResNet-34 and VGG-16 are respectively used as gray-box and black-box models for testing adversarial samples.

2) Data preprocessing. In order to exclude the influence of classification errors caused by the performance of the network itself, the samples that can be correctly classified by the target classification network are screened out as the original samples for generating adversarial samples.

3) Generate adversarial examples. Generate an attack model according to the training process in Figure 2, and use it to generate adversarial samples.

4) Test the effectiveness of adversarial examples. If the generated adversarial example can successfully deceive the target classification network F to make a wrong classification, it shows that the attack method of this embodiment is effective.

5) Test the transferability of adversarial examples. If the generated adversarial samples can deceive target classification networks F1 and F2 with different structures at the same time, making them misclassified, it means that the adversarial samples have strong transferability, otherwise, it means that the adversarial samples have poor transferability. Compared with the adversarial samples generated by the FGSM, BIM, DeepFool and advGAN methods, the success rate of the attack is improved, which shows that the method of this embodiment can effectively improve the transferability of the adversarial samples.

Test the robustness against adversarial examples. Space transformation is performed on the adversarial samples generated in step 3) to generate new adversarial samples, and the target classification network F2 in step 1) can still be deceived successfully, which means that the generated adversarial samples are robust. Compared with the adversarial samples generated by FGSM, BIM, DeepFool and advGAN methods, the success rate of the attack is improved, which shows that this implementation method can effectively improve the robustness of the adversarial samples.

The experimental results of the CIFAR-10 data set are shown in Table 1:

Table 1

The experimental results of the GTSRB dataset are shown in Table 2:

Table 2

The same or similar reference numerals correspond to the same or similar components;

The terms describing the positional relationship in the drawings are only for illustrative purposes and cannot be interpreted as limitations on this patent;

Apparently, the above-mentioned embodiments of the present invention are only examples for clearly illustrating the present invention, rather than limiting the implementation of the present invention. For those of ordinary skill in the art, on the basis of the above description, other changes or changes in different forms can also be made. It is not necessary and impossible to exhaustively list all the implementation manners here. All modifications, equivalent replacements and improvements made within the spirit and principles of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (7)

1. a kind of confrontation sample generating method based on production confrontation network, which comprises the following steps:

S1: original sample x being inputted in generator G, the generator G output disturbance G (x), and the loss function of generator G is L_G, disturb Dynamic G (x), which is added in original sample x, to be obtained to resisting sample x '=x+G (x)；

S2: by S1 obtain in resisting sample x ' input discriminator D, the discriminator D is distinguished to resisting sample x ' and original sample x, Obtain the loss function L of discriminator D_D；

S3: resisting sample x ' is input in enhancing module ST by what S1 was obtained, the enhancing module ST is based on spatial alternation, to right Resisting sample x ' carry out spatial alternation operation, by affine transformation, treated to resisting sample x ' for enhancing module ST output_st=T_θ(x+ G (x)), T in formula_θFor transforming function transformation function；

S4: passing through affine transformation, treated to resisting sample x '_stObject-class model F is inputted, obtains object-class model F's Loss function L_F；

S5: being L according to the loss function of generator G_G, discriminator D loss function L_DWith the loss function of object-class model F L_FConstruct objective function L_GANFor training challenge model GAN, trained generator G is obtained；

S6: it is adaptive to resisting sample to be that different input samples generate using trained generator G.

2. the confrontation sample generating method according to claim 1 based on production confrontation network, which is characterized in that generate The loss function of device G uses L2 norm to lose as distance metric, is specifically expressed as follows:

L_G=max (0, | | G (x) | |₂-c)

Wherein, c is customized constant.

3. the confrontation sample generating method according to claim 2 based on production network, which is characterized in that the identification Device D is binary neural network classifier.

4. the confrontation sample generating method according to claim 3 based on production confrontation network, which is characterized in that described The loss function of discriminator D specifically:

L_D=log D (x)+log (1-D (x+G (x))).

5. the confrontation sample generating method according to claim 4 based on production confrontation network, which is characterized in that target The loss function of disaggregated model F is in the attack for having target are as follows:

L_F=L (F (T_θ(x+G(x))),y′)

Indicate prediction the distance between class and target class y ', in formula, L is cross entropy loss function；

The loss function of object-class model F is in aimless attack are as follows:

L_F=-L (F (T_θ(x+G(x))),y)

Indicate the negative distance between prediction class and original tag class y, in formula, L is cross entropy loss function.

6. the confrontation sample generating method according to claim 5 based on production confrontation network, which is characterized in that target Function L_GANIt indicates are as follows:

L_GAN=L_F+αL_D+β·L_G

In formula, α and β are constants, maximize discriminator loss function argmin by minimizing generator loss function_gmax_dL_GAN Solution obtains generator G and discriminator D.

7. the confrontation sample generating method according to claim 6 based on production confrontation network, which is characterized in that step S5 further include trained generator G is tested, specifically includes the following steps:

S5.1: generating disturbance using trained generator G, to generate test to resisting sample, test inputs resisting sample The target classification network of different structure, makes its classification error；

S5.2: carrying out spatial alternation to resisting sample to the test of S5.1, generates new test to resisting sample, new test is defeated to resisting sample Enter target classification network, makes its classification error.