CN111898645A - A transferable adversarial example attack method based on attention mechanism - Google Patents

Abstract

The invention discloses a transferable adversarial sample attack method based on an attention mechanism. The method includes selecting a local substitute network model, and constructing a feature library to map the original image into the feature space; adopting an iterative fast gradient based on momentum accumulation The symbol attack method moves the features of the original image away from the original category area, and at the same time makes it close to the target category area; the adversarial samples obtained by the attack are input into the black-box classification model to mislead the model to output the target category. The invention uses the triple loss function to destroy the information-rich area in the feature space of the attacked model and the main concern of the model, so as to solve the problems of low white-box target attack success rate and black target existing in the existing attack methods in the classification task of complex data sets. The problem of low box target migration rate can effectively implement a misleading classification model while taking into account both white-box and black-box scenarios.

Description

A transferable adversarial example attack method based on attention mechanism

technical field

The invention belongs to the technical field of adversarial attacks, and in particular relates to a transferable adversarial sample attack method based on an attention mechanism.

Background technique

With the rapid development of deep learning, researchers can solve many computer vision tasks such as image classification and segmentation. However, due to the advent of adversarial examples, more attention has been paid to the shortcomings of convolutional neural networks. Adversarial examples refer to the fact that the convolutional neural network cannot correctly predict the image by adding some subtle perturbations to the original input image that cannot be perceived by the human eye. The current method of generating adversarial samples can be divided into non-target attacks and target attacks according to the target or expectation of the attack. The prediction results are changed to some pre-specified target labels. Secondly, according to the attacker's understanding of the model, it can be divided into white box attack and black box attack. In the former case, the attacker has all the information of the attacked model, including model parameters, structure, etc.; in the latter case, the attacker cannot obtain the model. All the information, only the prediction results of the model corresponding to the input can be obtained. Therefore, the transferability of adversarial samples has become the key to black-box attacks. Transferability refers to the fact that adversarial samples generated by attacking a certain type of model may make other models predict incorrectly.

Generally speaking, adversarial attacks usually generate adversarial samples by destroying the Softmax output space of the classification model. Due to the limited mobility of such methods, more and more studies have proposed adversarial attacks based on destroying the feature space of the model. In the complex data set classification task, the method either has the problem of low success rate of white-box target attack or the problem of low transfer rate of black-box target.

SUMMARY OF THE INVENTION

In view of the above deficiencies in the prior art, the present invention provides a transferable adversarial sample attack method based on an attention mechanism, which destroys the information-rich, informative and The main focus area of the model is to solve the problems of low white-box target attack success rate and black-box target migration rate in existing attack methods in the classification task of complex datasets, and it is effective when both white-box and black-box scenarios are considered. to implement misleading classification models.

In order to achieve the above-mentioned purpose of the invention, the technical scheme adopted in the present invention is:

A transferable adversarial example attack method based on attention mechanism, including the following steps:

S1. Select a local alternative network model, and build a feature library to map the original image into the feature space;

S2. The iterative fast gradient sign attack method based on momentum accumulation is used to move the features of the original image away from the original category area, and at the same time make it close to the target category area;

S3. Input the adversarial samples obtained by the attack in step S2 into the black-box classification model, and mislead the model to output the target category.

Further, selecting a local alternative network model in the step S1 is specifically:

Choose a local alternative network model for image classification, choose the middle layer of the classification network as the shallow layer, and choose the previous layer of the Softmax of the classification network as the deep layer.

Further, building a feature library in the step S1 to map the original image into the feature space is specifically:

For each category in the verification set of the local replacement network model, the centroids of all images successfully classified by the local replacement network model are calculated in the shallow and deep layers of the selected classification network, and feature libraries of different layers are constructed.

Further, the calculation formula for calculating the centroid of all pictures successfully classified by the local substitute network model is:

为j类别中第i张图片，y^j为j类别的真实分类标签。Among them, n is the number of all pictures in the j category that are correctly classified by the local substitute network model, F _l is the lth layer in the middle of the local substitute network model,

is the i-th image in the j category, and y ^j is the real classification label of the j category.

Further, the step S2 specifically includes the following sub-steps:

S21. For each original picture, select a centroid of the same category as the original picture in the feature library of the lth layer as a negative sample, randomly select a centroid of a different category from the original picture as a positive sample, and compare it with the lth centroid of the original picture. The features of the layers together form a triple loss function;

S22, constructing a total loss function of the local alternative network model according to the triplet loss function;

S23 , using an iterative fast gradient sign attack method based on momentum accumulation to generate disturbances to the features of the original image.

Further, the total loss function of the local substitute network model in the step S22 is specifically:

L _total =L _l +L _k

L _l =[D(f _l ^a ,f _l ^p )-D(f _l ^a ,f _l ⁿ )+θ _l ] ₊

分别为原始图片的第l层和第k层特征，f_l ⁿ、

分别为第l层和第k层特征库中负样本，f_l ^p、

分别为第l层和第k层特征库中正样本，θ_l、θ_k分别为原始图片的第l层和第k层的特征与正样本之间的距离和该特征与负样本之间的距离之间的最小间隔，+表示[]内的值大于零时取该值为损失值，小于零时损失值为零。Among them, L _total is the total loss function, L _l and L _k are the triple loss functions on the _lth layer and the kth layer, respectively, D function is the Euclidean distance function, f ^la ,

are the l-th layer and k-th layer features of the original image, respectively, f _l ⁿ ,

are the negative samples in the feature library of the lth layer and the kth layer, respectively, f _l ^p ,

are the positive samples in the l-th layer and the k-th layer feature library respectively, θ _l and θ _k are the distances between the features of the l-th layer and the k-th layer of the original image and the positive samples and the distance between the feature and the negative samples, respectively The minimum interval between, + means that when the value in [] is greater than zero, take this value as the loss value, and when it is less than zero, the loss value is zero.

Further, the step S23 specifically includes the following sub-steps:

S231. Calculate the gradient of the total loss function for the original image;

S232. Calculate the accumulated momentum according to the gradient of the total loss function;

S233, using the obtained momentum to calculate the disturbance and add it to the adversarial sample image of the t-th iteration to generate the adversarial sample image of the t+1-th iteration;

S234: After performing T iterations of the attack on the original image, output the confrontation sample image of the T-th iteration as the final confrontation sample.

Further, the step S233 generates the confrontation sample picture of the t+1th iteration and is represented as:

x' _t+1 =x' _t -α·sign(g _t+1 )

Among them, x' _t+1 is the adversarial sample image of the t+1th iteration, x' _t is the adversarial sample image of the t-th iteration, α is the perturbation step size of a single iteration, sign() is the sign function, parentheses Output 1 when the value in the bracket is greater than 0, output -1 when the value in the bracket is less than 0, and output 0 when the value in the bracket is equal to 0.

Further, the step S23 also includes cropping each pixel in the adversarial sample picture of the t+1th iteration to be between 0 and 1, and the calculation formula is:

x" _t+1 = Clip(x' _t+1 ,0,1)

Among them, x” _t+1 is the cropped adversarial sample image, Clip() is the cropping function, and the pixels greater than 1 in the adversarial sample image are cropped to 1.

The present invention has the following beneficial effects:

(1) The present invention uses the triple loss function to replace the cross-entropy function in the existing MI-FGSM method, so as to destroy the rich areas in the picture in the feature space and the main concern of the model, and balance the white box and the black box well The target attack success rate in the scenario;

(2) The present invention combines the features of the shallow and deep layers of the network to attack at the same time, effectively destroying the global rough information and local detail information of the picture, so as to generate more aggressive confrontation samples;

(3) When the present invention solves the classification task of complex data sets, the feature of the original image can still be kept as far away as possible from the area of the original real category through the triple loss function, and at the same time as close to the area of the target category as possible, improving the final whiteness Box target attack success rate and even black box attack success rate.

Description of drawings

Fig. 1 is the flow chart of the transferable adversarial sample attack method based on the attention mechanism of the present invention;

FIG. 2 is a flow chart of a method for adversarial sample attack in an embodiment of the present invention.

Detailed ways

The specific embodiments of the present invention are described below to facilitate those skilled in the art to understand the present invention, but it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, as long as various changes Such changes are obvious within the spirit and scope of the present invention as defined and determined by the appended claims, and all inventions and creations utilizing the inventive concept are within the scope of protection.

The embodiment of the present invention provides a transferable adversarial attack method based on an attention mechanism, by using an iterative fast gradient sign attack method based on accumulated momentum in the feature space of the model to destroy the information-rich, model mainly concerned region to generate adversarial examples with strong migration and high success rate of white-box target attack.

The research object of the present invention is black box target attack, and the technical scenarios specifically solved are:

1) The attacker cannot obtain all the information of the attacked classification model, but can only obtain the predicted output corresponding to the input of the model;

2) The attacker's goal is to mislead the model into predicting a pre-specified class that is different from the true class of the original image. Therefore, for this scenario, the conventional attack method relies on the mobility of adversarial samples, that is, the attacker selects a local alternative network model to attack, and achieves the attack purpose by migrating the obtained adversarial samples to the attacked model.

As shown in FIG. 1 and FIG. 2 , the adversarial sample attack method of the present invention specifically includes the following steps S1 to S3:

S1. Select a local alternative network model, and build a feature library to map the original image into the feature space;

In this embodiment, the present invention first establishes a local substitute network model for image classification, optionally using a neural network model such as DenseNet [6], ResNet [7] and so on.

Taking the neural network model DenseNet-121 as an example, the output of the second dense block (DenseBlock) of the neural network and the previous layer of Softmax in the classification layer are selected as the attacked layer.

The invention calculates the centroid of pictures successfully classified by the local substitute network model in the shallow and deep layers of the selected classification network for each category in the verification set of the local substitute network model, and constructs feature libraries of different layers.

In order to solve the classification task on complex datasets, the present invention will be explained with the ImageNet dataset. For each category in the ImageNet validation set, the centroids c ^j of all images successfully classified by the substituted model are calculated in the shallow and deep layers of the selected classification network, respectively. The calculation formula is:

为j类别中第i张图片，y^j为j类别的真实分类标签。Among them, n is the number of all pictures correctly classified by the local substitute network model in the j category, F _l is the lth layer in the middle of the local substitute network model,

is the i-th image in the j category, and y ^j is the true classification label of the j category.

Through the above methods, feature libraries for different layers are constructed respectively.

The invention combines the features of the shallow and deep layers of the network to attack at the same time, effectively destroying the global rough information and local detail information of the picture to generate more aggressive confrontation samples, and this method can also be extended to other damage-based feature spaces. method of attack.

S2. The iterative fast gradient sign attack method based on momentum accumulation is used to move the features of the original image away from the original category area, and at the same time make it close to the target category area;

In this embodiment, the present invention specifically includes the following steps:

S21. For each attacked original image, select a centroid of the same category as the original image in the feature library of the l-th layer as a negative sample f _l ⁿ , and randomly select a centroid of a different category from the original image as a positive sample f _l ^p , and together with the feature f _la of the lth layer of the original image, form ^a triple loss function <f _l ^a ,f _l ^p ,f _l ⁿ >;

S22, constructing a total loss function of the local alternative network model according to the triplet loss function;

The present invention constructs the total loss function of the local replacement network model by using the triple loss function on the shallow layer and the deep layer of the network respectively, specifically:

L _total =L _l +L _k ,

L _l =[D(f _l ^a ,f _l ^p )-D(f _l ^a ,f _l ⁿ )+θ] ₊ ,

分别为原始图片的第l层和第k层特征，f_l ⁿ、

分别为第l层和第k层特征库中负样本，f_l ^p、

分别为第l层和第k层特征库中正样本，θ_l、θ_k分别为原始图片的第l层和第k层的特征与正样本之间的距离和该特征与负样本之间的距离之间的最小间隔，+表示[]内的值大于零时取该值为损失值，小于零时损失值为零。Among them, L _total is the total loss function, L _l and L _k are the triple loss functions on the _lth layer and the kth layer, respectively, D function is the Euclidean distance function, f ^la ,

are the l-th layer and k-th layer features of the original image, respectively, f _l ⁿ ,

are the negative samples in the feature library of the lth layer and the kth layer, respectively, f _l ^p ,

are the positive samples in the l-th layer and the k-th layer feature library, respectively, θ _l and θ _k are the distances between the features of the l-th layer and the k-th layer of the original image and the positive samples and the distance between the feature and the negative samples, respectively The minimum interval between, + means that when the value in [] is greater than zero, take this value as the loss value, and when it is less than zero, the loss value is zero.

S23, using an iterative fast gradient symbol attack method based on momentum accumulation to generate disturbances to the features of the original image, which specifically includes the following sub-steps:

S231. Calculate the partial derivative of the total loss function L _total for the attacked original image x to obtain the gradient

S232. Calculate the accumulated momentum g _t+1 according to the gradient of the total loss function, which is expressed as:

Among them, g _t is the momentum accumulated during the t-th iteration;

S233, using the obtained momentum to calculate the disturbance and add it to the adversarial sample image x' _t of the t-th iteration to generate the adversarial sample image x' _t+1 of the t+1-th iteration, which is expressed as:

x' _t+1 =x' _t -α·sign(g _t+1 )

sign()为符号函数，括号内大于0时输出1，括号内小于0时输出-1，括号内等于0时输出0；Among them, x' _t+1 is the adversarial sample image of the t+1th iteration, x' _t is the adversarial sample image of the t-th iteration, α is the perturbation step size of a single iteration, and its calculation method is the total perturbation step size ε divided by the number of iterations, i.e.

sign() is a sign function, output 1 when the parentheses are greater than 0, output -1 when the parentheses are less than 0, and output 0 when the parentheses are equal to 0;

In order to keep the distribution of the adversarial sample image consistent with the original input image, the present invention clips each pixel in the adversarial sample image of the t+1th iteration to be between 0 and 1, and the calculation formula is:

x" _t+1 = Clip(x' _t+1 ,0,1)

Among them, x” _t+1 is the cropped adversarial sample image, Clip() is the cropping function, and the pixels greater than 1 in the adversarial sample image are cropped to 1.

S234. The above steps are regarded as one attack iteration, and T iterations are performed in total, wherein the adversarial sample x' ₀ of the 0th iteration is initialized as the original input image x, and finally the adversarial sample image of the Tth iteration is output as the final adversarial sample .

The invention uses triple loss function to replace the cross entropy function in the existing MI-FGSM method, and achieves a coarse-to-fine attack process by using a triple loss function in the two middle layers of the model respectively, By destroying the rich areas of the image in the feature space and the main focus of the model, the target attack success rate in the white-box and black-box scenarios is well balanced.

S3. Input the adversarial samples obtained by the attack in step S2 into the black-box classification model, and mislead the model to output the target category.

When solving the classification task of complex data sets, the present invention can still use the triple loss function to keep the features of the original image as far away as possible from the area of the original real category, and at the same time as close to the area of the target category as possible, so as to improve the final white-box target attack. The success rate is even the black box attack success rate. Since the method is simple and the number of parameters is moderate, the use of the present invention is quick and convenient.

Those of ordinary skill in the art will appreciate that the embodiments described herein are intended to assist readers in understanding the principles of the present invention, and it should be understood that the scope of protection of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations without departing from the essence of the present invention according to the technical teaching disclosed in the present invention, and these modifications and combinations still fall within the protection scope of the present invention.

Claims (9)

1. A migratable sample attack resistance method based on an attention mechanism is characterized by comprising the following steps:

s1, selecting a local substitute network model, and constructing a feature library to map the original picture into a feature space;

s2, separating the characteristics of the original picture from the original category area by adopting an iterative fast gradient sign attack method based on momentum accumulation, and simultaneously enabling the characteristics to be close to the target category area;

and S3, inputting the confrontation sample obtained by the attack in the step S2 into the black box classification model, and misleading the model to output the target class.

2. The method of claim 1, wherein the step S1 of selecting a local surrogate network model is specifically:

selecting a local substitute network model for picture classification, selecting a middle layer of a classification network as a shallow layer, and selecting a previous layer of Softmax of the classification network as a deep layer.

3. The method for mobilizable countersample attack based on attention mechanism of claim 2, wherein the step S1 of constructing the feature library maps the original picture into the feature space specifically as follows:

and for each category in the verification set of the local substitution network model, calculating the centroids of all pictures successfully classified by the local substitution network model in the shallow layer and the deep layer of the selected classification network respectively, and constructing feature libraries of different layers.

4. The method for mobilizable countersample attack based on attention mechanism of claim 3, wherein the calculation formula of the centroid of all the pictures successfully classified by the local substitution network model is as follows:

wherein n is the number of pictures correctly classified by the local substitution network model in the j category, F_lTo locally replace the middle l-th layer of the network model,

is the ith picture in the j category, y^jThe true class label for the j category.

5. The method for mobilizable countersample attack based on attention mechanism of claim 1, wherein the step S2 comprises the following sub-steps:

s21, for each original picture, selecting a mass center in the same category as the original picture from the feature library of the l layer as a negative sample, randomly selecting a mass center in different category from the original picture as a positive sample, and forming a triple loss function together with the features of the l layer of the original picture;

s22, constructing a total loss function of the local substitute network model according to the triple loss function;

and S23, generating disturbance on the characteristics of the original picture by adopting an iterative fast gradient sign attack method based on momentum accumulation.

6. The method for mobilizable countersample attack based on attention mechanism of claim 5, wherein the total loss function of the local surrogate network model in step S22 is specifically:

L_total＝L_l+L_k

L_l＝[D(f_l ^a,f_l ^p)-D(f_l ^a,f_l ⁿ)+θ_l]₊

wherein L is_totalAs a function of total loss, L_l、L_kTriple loss functions on the l-th layer and the k-th layer respectively, D function is Euclidean distance function, f_l ^a、

Features of the l-th and k-th layers, respectively, of the original picture, f_l ⁿ、

Characterised by the l-th and k-th layers, respectivelyNegative sample in the library, f_l ^p、

Positive samples, θ, in the ith and kth layer feature libraries, respectively_l、θ_kThe minimum interval between the distance between the feature and the positive sample and the distance between the feature and the negative sample of the l-th and k-th layers of the original picture, respectively, + represents [, ]]When the value in the internal is larger than zero, the value is taken as a loss value, and when the value is smaller than zero, the loss value is zero.

7. The method for mobilizable countersample attack based on attention mechanism of claim 5, wherein the step S23 comprises the following sub-steps:

s231, calculating the gradient of a total loss function for the original picture;

s232, calculating accumulated momentum according to the gradient of the total loss function;

s233, calculating disturbance by using the obtained momentum, and adding the disturbance to the confrontation sample picture of the t iteration to generate the confrontation sample picture of the t +1 iteration;

and S234, performing T iterative attacks on the original picture, and outputting a countercheck sample picture of the T iteration as a final countercheck sample.

8. The method of claim 7, wherein the step S233 generates the confrontation sample picture of the t +1 th iteration as:

x′_t+1＝x′_t-α·sign(g_t+1)

wherein, x'_t+1Confrontation sample picture, x 'for t +1 iteration'_tFor the countercheck sample picture of the t-th iteration, alpha is the disturbance step length of the single iteration, sign () is a sign function, 1 is output when the parenthesis is greater than 0, minus 1 is output when the parenthesis is less than 0, and 0 is output when the parenthesis is equal to 0.

9. The method of claim 8, wherein the step S23 further comprises clipping each pixel point in the confrontation sample picture of the t +1 th iteration to 0 to 1, and the calculation formula is:

x″_t+1＝Clip(x′_t+1,0,1)

wherein, x ″)_t+1For the cut confrontation sample picture, Clip () is a cutting function, and the pixel points larger than 1 in the confrontation sample picture are cut to be 1.

Images