CN117523342A - A high-mobility adversarial sample generation method, equipment and medium - Google Patents

Abstract

The invention discloses a method, equipment and medium for generating high-mobility adversarial samples. First, an existing feature-level attack method is used to attack and then an adversarial sample is generated. The adversarial sample obtains new features on the original model as a strengthening direction. By further strengthening the newly generated features while interfering with the original features, the purpose of improving the transferability of adversarial samples is achieved. Compared with other feature-level methods that only interfere with original features, the present invention constructs a loss function by aggregating original feature gradients and newly generated feature gradients. It enhances the newly generated features while disturbing the original features of the image. When migrating and attacking other models, it is easier to be attacked into newly generated feature categories, which can generate adversarial samples with higher transferability.

Description

A high-mobility adversarial sample generation method, equipment and medium

Technical field

The invention relates to a high-mobility adversarial sample generation method, equipment and medium, and belongs to the technical field of image processing.

Background technique

In recent years, with the rapid development of deep neural networks, deep learning has been applied to many computer image fields such as object detection, image classification, and semantic segmentation, and has made remarkable progress. At the same time, because the fragility and instability of deep neural networks make them vulnerable to attacks, artificial intelligence security issues have gradually attracted widespread attention from researchers. A large number of studies have shown that adversarial samples can be generated by adding some subtle perturbations to original benign samples that will not cause alertness. Adversarial samples can mislead deep learning models to produce wrong results. For example, in the image recognition scenario, a picture that was originally recognized as a cat by the image recognition model was misclassified as a fish after adding a slight disturbance that was even imperceptible to the human eye. This makes the deep learning model create security risks after actual deployment.

There are two main usage scenarios for adversarial examples. One is to use the characteristics of adversarial examples as a means to test the classification accuracy and security of deep learning models. This helps to avoid security risks after the model is actually deployed. On the other hand, in order to respond to attacks and improve model classification accuracy, it is necessary to use existing image classification models in advance to generate adversarial samples with high transferability. These adversarial samples are used to train various types of image classification models so that the models can correctly classify these adversarial samples and resist external attacks. In both scenarios, researchers are required to generate more transferable adversarial examples.

Currently, many methods have been used to generate adversarial samples with high transferability, such as feature-level methods that reduce the influence of specific features of the local agent model by disrupting the output of the original image in the middle layer of the network. Further improve the transferability of adversarial samples. For example, the feature importance awareness method (FIA) uses aggregated gradients to find important features of the image for destruction.

The existing method of generating adversarial samples at the feature level generates adversarial samples by interfering with the original target features of the image. However, due to differences in parameters and structures between different models, these interfered original image target features will also vary from model to model, so the transfer effect is not ideal enough. This is because the existing feature-level methods only focus on the original target features of the interference image, but ignore the impact of the new features generated in the process of interfering with the original features on the transferability. In order to further enhance the transferability of adversarial examples, those skilled in the art urgently need to improve the existing methods of generating adversarial examples. To this end, the present invention proposes to improve the transferability of adversarial samples by further strengthening the newly generated features while interfering with the original features.

Contents of the invention

Purpose: In order to overcome the shortcomings in the existing technology, the present invention provides a high-mobility adversarial sample generation method, equipment and medium. For the first time, a high-mobility adversarial sample generation method based on strengthening newly generated features is proposed. First, using Existing feature-level attack methods generate adversarial samples after attacking, and the adversarial samples obtain new features on the original model as a strengthening direction. By further strengthening the newly generated features while interfering with the original features, the purpose of improving the transferability of adversarial samples is achieved.

Technical solution: In order to solve the above technical problems, the technical solution adopted by the present invention is:

The first aspect is a highly transferable adversarial sample generation method, including the following steps:

Step 1: Convert the original image Enter classification model/> , get the classification model/> No./> The feature map output by the middle layer of the layer .

Step 2: Convert the original image Replace the random pixels with random noise to obtain a random noise perturbation image/> .

Step 3: Perturb the image with random noise Enter classification model/> , respectively obtain the original feature category labels of the image/> The output/> and newly generated feature category labels after feature attack/> The output/> . According to/> ,/> Perform gradient backpropagation to the first/> The middle layer of the layer obtains the original feature gradient of the image/> and newly generated feature gradient/> . Among them,/> Indicates the category confidence rate output by the classification model,/> Represents a random perturbation image/> Enter classification model/> From the second page/> The feature map output by the convolutional layer, /> Represents derivation.

Step 4: Repeat steps 2 to 3 until the preset number of times N, and aggregate the original feature gradients of the N images obtained. , aggregating the obtained N newly generated feature gradients to obtain /> . Among them,/> Expresses yes/> Find the value of the 2-norm of the result. /> Expresses yes/> Find the value of the 2-norm of the result.

Step 5: Construct the loss function . Among them,/> Represents the product of corresponding points,/> Indicates the impact factor,/> Represents the adversarial sample to be determined,/> Indicates that/> Enter classification model/> From the second page/> The feature map output by the convolutional layer.

Step 6: According to the loss function Construct an optimized loss function model, solve the optimized loss function model, and obtain the final adversarial sample.

As a preferred solution, the optimization loss function model specifically includes:

in, Represents the loss function/> /> at minimum value .

Express/> is in/> Modify the original image within the range/> The adversarial sample is obtained by the value of the pixel point. /> Represents infinite norm,/> Represents hyperparameters.

As a preferred solution, the optimization loss function model is solved to obtain the final adversarial sample, which specifically includes:

Step 6.1: Obtain the Newton acceleration sample of the jth round ,Calculated as follows:

Among them: when j is initialized to 0, the gradient ,/> for the original image. /> Represents the gradient of the jth round, /> Represents the Newton acceleration sample of the jth round,/> Represents the adversarial sample of the jth round,/> Represents the Newton acceleration control factor.

Step 6.2: Place Enter classification model/> From the second page/> Feature map output by layer convolutional layer/> .

Step 6.3: Place Substitute the loss function/> , get/> .

Step 6.4: Place Back propagate from the intermediate layer to the input layer to get the gradient/> .

Step 6.5: According to the gradient Calculate/> ,Calculated as follows:

In the formula:

Represents 1-norm operation,/> Represents the gradient accumulation control factor.

Step 6.6: According to ,/> Calculate the adversarial samples of j+1 rounds/> ,Calculated as follows:

Indicates the step size of the iterative attack. /> Indicates that the element value is clipped. Among them,/> Calculated as follows:

Step 6.7: Repeat the above iteration steps 6.1 to 6.6 to determine whether the number of iterations reaches the preset number. If so, generate the final adversarial example. If not, return to step 6.1.

As a preferred solution, the noise added in step 2 and the random pixels selected in the original image are different each time step 4 is repeated.

A second aspect is a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, a high-mobility adversarial sample generation method as described in any one of the first aspects is implemented.

In a third aspect, a computer device includes:

Memory, used to store instructions.

A processor, configured to execute the instructions, causing the computer device to perform operations of a high-mobility adversarial sample generation method as described in any one of the first aspects.

Beneficial effects: The present invention provides a high-mobility adversarial sample generation method, equipment and medium. Compared with other feature-level methods that only interfere with original features, the present invention has a loss constructed by aggregating original feature gradients and newly generated feature gradients. function. It enhances the newly generated features while disturbing the original features of the image. When migrating and attacking other models, it is easier to be attacked into newly generated feature categories, which can generate adversarial samples with higher transferability.

Description of drawings

Figure 1 is a schematic flow chart of the method of the present invention.

Detailed ways

The technical solutions in the examples of the present invention are clearly and completely described below with reference to the accompanying drawings in the examples of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without any creative work fall within the protection scope of the present invention.

The present invention will be further described below in conjunction with specific embodiments.

Example 1:

This embodiment introduces a method for generating high-transfer adversarial samples, which includes the following steps:

Step 1: Convert the original image Enter classification model/> , get the classification model/> No./> The feature map output by the middle layer of the layer .

An example, classification model It refers to the current mainstream image classification model, such as VGG model and inception model.

The middle layer refers to the classification model The convolutional layer before the fully connected layer.

No. Layer refers to the layer/> convolutional layer.

feature map refers to the original image/> From classification model/> The input port passes through/> The output content after a convolutional layer.

Step 2: Convert the original image Replace the random pixels with random noise to obtain a random noise perturbation image/> .

One embodiment is to randomly select a certain proportion of pixels in the original image and then replace these pixels with random noise perturbations.

Step 3: Disturbing the image with random noise Enter classification model/> , respectively obtain the original feature category labels of the image The output/> and newly generated feature category labels after feature attack/> The output/> , and perform gradient backpropagation to the /> The middle layer of the layer obtains the original feature gradient of the image/> and newly generated feature gradient/> .

In one embodiment, the present invention uses a classification model trained on the ImageNet data set . The ImageNet dataset has a total of 1000 categories.

in, is the confidence rate of all categories output by the classification model.

Labels are categories marked after manual recognition of the original image as the true category of the image. /> It is random noise perturbing the image/> Enter classification model/> After/> The confidence rate of the class label output.

The label is an adversarial sample generated by the original image through existing feature-level methods. The adversarial sample is reclassified on the original classification model to obtain the wrong result category/> . /> It is random noise perturbing the image/> Input classification model After/> The confidence rate of the class label output.

Backpropagate the output results of the two categories separately, but only propagate to the first mentioned in step one. Layer middle layer. The mathematical expressions of this process are/> and/> .

in: Represents a random perturbation image/> Enter classification model/> From the second page/> The feature map output by the convolutional layer.

Expresses yes/> Label output results, use/> Perform derivation.

Expresses yes/> Label output results, use /> Perform derivation.

Step 4: Repeat steps 2 to 3 until the preset number of times N, and aggregate the original feature gradients of the N images obtained. , aggregating the obtained N newly generated feature gradients to obtain /> .

When repeating steps 2 and 3 N times:

Each time you repeat step 2, the noise added and the random pixels selected in the original image are different.

Therefore, each time we get in step 3 and/> It's also different.

Indicates the number/> in a repeated process operations.

Then the category gradients of the two categories are accumulated and processed separately to obtain and/> .

in, Indicates the use of the /> The result obtained by the convolution block.

Expresses yes/> Find the value of the 2-norm of the result.

Expresses yes/> Find the value of the 2-norm of the result.

Step 5: Construct a loss function by multiplying the obtained feature map and the difference between the two aggregated gradients .

In one embodiment, this step represents the processing obtained in the above steps. and/> data to construct a loss function. For the next step, optimize the loss function/> Prepare to generate adversarial examples.

in: Represents the product of corresponding points. /> Represents the influencing factor, used to adjust new features.

Will Bring in the loss function/> Get results/> .

in, Indicates changes to the original image/> The adversarial sample obtained from the value of the pixel is used as the variable to be determined.

Indicates that/> Input classification modelInput classification model/> From the second page/> The feature map output by the convolutional layer.

Step 6: Use the optimized loss function model to iteratively generate adversarial samples: through the loss function constructed in the previous step , the adversarial sample generation problem can be converted into an optimization problem, and then solved using the Newton iteration method. The definition formula is:

in, Represents the loss function/> /> at minimum value .

Express/> is in/> Modify the original image within the range/> The adversarial sample obtained by the value of the pixel is within this range/> Bring in the loss function/> is the minimum value.

Represents infinite norm,/> Represents the hyperparameter used to control the size of the perturbation.

In one embodiment, the Newton momentum accumulation method (NI) is used to optimize and solve the optimization loss function model to obtain the final , the specific process is as follows:

Step 6.1: Use the Newtonian momentum acceleration method to calculate the local optimal solution that is easy to jump out of, and obtain the Newtonian acceleration sample of the jth round. ,Calculated as follows:

Among them: j represents the jth iteration. When j is initially set to 0, the gradient ,/> is the original image;/> Represents the gradient of the jth round;/> Represents the Newton acceleration sample of the jth round,/> Represents the adversarial sample of the jth round,/> Represents the Newton acceleration control factor.

Step 6.2: Place Enter classification model/> From the second page/> Feature map output by layer convolutional layer/> .

Step 6.3: Place Substitute the loss function/> , get/> .

Step 6.4: Place Back propagate from the intermediate layer to the input layer to get the gradient/> .

Step 6.5: According to the gradient Calculate/> ,Calculated as follows:

In the formula:

Represents 1-norm operation,/> Represents the gradient accumulation control factor.

Step 6.6: Add perturbation to the image generated in the previous round , then crop it and generate j+1 rounds of adversarial samples/> , the formula is as follows:

Indicates the step size of the iterative attack;/> Indicates that the element value is clipped so that its range can be within/> between.

in, Calculated as follows:

Step 6.7: Repeat the above iteration steps 6.1 to 6.6 to determine whether the number of iterations reaches the preset number; if so, generate the final adversarial sample; if not, return to step 6.1.

Example 2:

This embodiment introduces a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, a high-mobility adversarial sample generation method as described in any one of Embodiment 1 is implemented.

Example 3:

This embodiment introduces a computer device, including:

Memory, used to store instructions.

A processor, configured to execute the instructions, causing the computer device to perform operations of a high-mobility adversarial sample generation method as described in any one of Embodiment 1.

Example 4:

A method for generating high-mobility adversarial samples will be described in detail below with reference to Figure 1:

used in this embodiment Represents the image classification model. When the classification model inputs a clean original image/> When, you can get the probability output that the image belongs to category r/> .

The purpose of this invention is to process the original image Add imperceptible perturbations to generate adversarial examples/> , causing the image classification model to produce misclassification results. The adversarial example process can be defined as follows:

in, Represents the original image, /> is an adversarial example,/> Represents an image classification model, /> Is an image classification model/> parameters,/> Express/> with/> between/> Norm distance,/> is a hyperparameter used to control the size of the perturbation. The present invention can also successfully mislead the decision-making of other target models through the adversarial samples generated by the local proxy original model, thereby realizing the migration of the adversarial samples generated by the present invention.

In an embodiment, the embodiment of the present invention provides a highly portable adversarial sample generation method, including:

Step 1: Convert the original image Enter classification model/> , get the classification model/> No./> The feature map output by the middle layer of the layer .

Step 2: To the original image Randomly discard pixels and add random 0-1 normal distributed random noise to the discarded pixels to obtain/> , its formula is expressed as:

in: is the same as the original image/> A matrix of the same size contains two types of values: 0 and 1. The pixel at the 1 position will be retained, while the pixel at the 0 position will be discarded. /> Represents the probability of containing 0. /> Expresses yes/> Element negation operation. /> Display size image/> The same random noise matrix. /> Represents the product of corresponding points,/> Indicates that the probability of discarding pixels is/> .

Step 3: Perturb the image with random noise from the previous step Enter classification model/> , respectively obtain the original feature category labels of the image/> The output/> and newly generated feature category labels after feature attack/> The output/> , and perform gradient backpropagation to the /> The middle layer of the layer obtains the original feature gradient of the image/> and newly generated feature gradient/> .

Labels are categories marked after manual recognition of the original image as the true category of the image. /> It is random noise perturbing the image/> Enter classification model/> After/> The confidence rate of the class label output.

The label is an adversarial sample generated by the original image through existing feature-level methods. The adversarial sample is reclassified on the original classification model to obtain the wrong result category/> . /> It is random noise perturbing the image/> Input classification model After/> The confidence rate of the class label output. Its formula process is expressed as:

in: Represents existing signature-level attack methods. Replace the original image/> , use existing feature-level attack methods to obtain adversarial samples/> . Send the adversarial sample to the original image classification model/> Then get the category label/> .

Step 4: The differences in parameters and network structures between different classification models lead to different characteristics between classification models. When obtaining image category features, the characteristics of the classification model are carried, resulting in poor transferability of adversarial samples. To this end, the image is transformed multiple times to retain its semantic features, and then the feature gradient obtained from the transformed image is used for aggregation. The aggregated gradient weakens the features carried by the original classification model, thereby improving the transferability of adversarial samples. By repeating the second and third steps until the set number of times N, N numbers are obtained respectively. Category feature gradient/> , and N/> Category feature gradient/> . The aggregation operations are performed separately, and the following formula calculates the aggregation gradient:

Step 5: The present invention is implemented according to the following loss function to guide the generation of adversarial samples :

Step 6: Use the optimized loss function model to iteratively generate adversarial samples: through the loss function constructed in the previous step , the adversarial sample generation problem can be converted into an optimization problem, and then solved using the Newton iteration method. The definition formula is:

in, Represents the loss function/> /> at minimum value .

Express/> is in/> Modify the original image within the range/> The adversarial sample obtained by the value of the pixel is within this range/> Bring in the loss function/> is the minimum value.

Represents infinite norm,/> Represents the hyperparameter used to control the size of the perturbation.

In one embodiment, the Newton momentum accumulation method (NI) is used to optimize and solve the optimization loss function model to obtain the final .

Example 5:

In order to evaluate the effectiveness of the adversarial samples generated by the method of the present invention with high transferability, the adversarial samples generated by the method of this embodiment were compared with FIA (Feature Importance-aware Attack), RPA (Random PatchAttack) and NAA (Neuron Attribution-based Attack). ) existing feature-level methods. The method of the present invention is called ours.

This article uses 5 classification models as target models to evaluate the performance of the attack. Among them: 4 classification models that have been trained normally are:

Vgg-16 (Visual Geometry Group-16), Res-152 (152-layer neural network trained using ResNet (Deep Residual Network) Unit), Inc-v3 (Inception-v3 Google's convolutional neural network model), Inc-v4 (Inception-v4 Google's convolutional neural network model).

1 defense classification model, Inc-v3-adv (Inception-v3-adv Google's adversarially trained convolutional neural network model).

This article selects four local original models to generate adversarial samples, namely Inc-v3, Inc-v4, Res-152, and Vgg-16.

The parameter settings for the adversarial sample generation method are as follows:

For the classification model, the middle layer is set to layer 3.

The FIA parameters are set as follows, the aggregation number N is set to 30, and the drop probability p is set. When attacking the normally trained classification model, the drop probability is set to p=0.3, and when attacking the defense classification model, p=0.1.

The RPA parameters are set as follows, the aggregation number N is set to 60, and the pixel modification probability pm is set to 0.3 respectively.

The NAA parameter settings are as follows, set the aggregation number N to 30, and set the positive feature influence factor.

The ours parameter is set as follows, and the result after the RPA attack is used as the newly generated feature category label t. The random perturbation pixel probability p is set to 0.3, which means that the Newton cumulative control factor is set to 1.0.

All adversarial example generation methods set the maximum perturbation setting to 16, the number of iterations to T=10, and the step size to . Set the attenuation factor to for all methods.

As shown in Table 1, in the table, the first column represents the original model used to generate adversarial samples, and the table data represents the attack success rate corresponding to using the adversarial samples generated by the original model to migrate and attack other models. *Indicates the attack success rate of the adversarial sample generated by the original model on itself, and other data is the black box attack success rate of the corresponding model. The success rate of migration attack indicates the proportion of images that the attacked model misclassifies under the corresponding generative model. The higher the proportion, the better the attack performance. The best migration results in each term are highlighted in bold.

The results show that the highest success rate for each item is the attack method proposed by this invention. In addition, compared with the optimal results of other benchmark methods, the overall attack success rate has increased by more than 2.0%.

Experimental results show that for the baseline method and the attack method proposed in this invention, strengthening the newly generated feature strategy can maximize the transferability of the generated adversarial samples.

Table 1 Comparison of migration attack success rates

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in a process or processes in a flowchart and/or a block or blocks in a block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes in the flowchart and/or in a block or blocks in the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

The above are only the preferred embodiments of the present invention. It should be pointed out that those of ordinary skill in the art can make several improvements and modifications without departing from the principles of the present invention. These improvements and modifications can also be made. should be regarded as the protection scope of the present invention.

Claims (6)

1. A highly transferable adversarial sample generation method, characterized by: including the following steps: Step 1: Convert the original image Enter classification model/> , get the classification model/> No./> Feature map output by the middle layer/> ; Step 2: Convert the original image Replace the random pixels with random noise to obtain a random noise perturbation image/> ; Step 3: Perturb the image with random noise Enter classification model/> , respectively obtain the original feature category labels of the image/> The output/> and newly generated feature category labels after feature attack/> The output/> ;according to/> ,/> Perform gradient backpropagation to the first/> The middle layer of the layer obtains the original feature gradient of the image/> and newly generated feature gradient/> ;wherein,/> Indicates the category confidence rate output by the classification model,/> Represents a random perturbation image/> Enter classification model/> From the second page/> The feature map output by the convolutional layer, /> Expresses derivation; Step 4: Repeat steps 2 to 3 until the preset number of times N, and aggregate the original feature gradients of the N images obtained. , aggregating the obtained N newly generated feature gradients to obtain /> ;wherein,/> Expresses yes/> Find the value of 2-norm for the result;/> Expresses yes/> Find the value of 2-norm for the result; Step 5: Construct the loss function ;wherein,/> Represents the product of corresponding points,/> represents the impact factor, Represents the adversarial sample to be determined,/> Indicates that/> Enter classification model/> From the second page/> The feature map output by the convolutional layer; Step 6: According to the loss function Construct an optimized loss function model, solve the optimized loss function model, and obtain the final adversarial sample. 2. A method for generating highly transferable adversarial examples according to claim 1, characterized in that: the optimized loss function model specifically includes: ; in, Represents the loss function/> /> at minimum value ; Express/> is in/> Modify the original image within the range/> The adversarial sample obtained from the value of the pixel;/> Represents infinite norm,/> Represents hyperparameters. 3. A method for generating high-mobility adversarial samples according to claim 2, characterized in that: the optimization loss function model is solved to obtain the final adversarial sample, which specifically includes: Step 6.1: Obtain the Newton acceleration sample of the jth round ,Calculated as follows: ; Among them: when j is initialized to 0, the gradient ,/> is the original image;/> Represents the gradient of the jth round;/> Represents the Newton acceleration sample of the jth round,/> Represents the adversarial sample of the jth round,/> Represents the Newton acceleration control factor; Step 6.2: Place Enter classification model/> From the second page/> Feature map output by layer convolutional layer/> ; Step 6.3: Place Substitute the loss function/> , get/> ; Step 6.4: Place Back propagate from the intermediate layer to the input layer to get the gradient/> ; Step 6.5: According to the gradient Calculate/> ,Calculated as follows: ; In the formula: ; Represents 1-norm operation,/> Represents the gradient accumulation control factor; Step 6.6: According to ,/> Calculate the adversarial samples of j+1 rounds/> ,Calculated as follows: ; Indicates the step size of the iterative attack;/> Represents clipping of element values; among them, /> Calculated as follows: ; Step 6.7: Repeat the above iteration steps 6.1 to 6.6 to determine whether the number of iterations reaches the preset number; if so, generate the final adversarial sample; if not, return to step 6.1. 4. A method for generating high-mobility adversarial samples according to claim 1, characterized in that: each time the step 4 is repeated, the noise added in step 2 and the random pixels selected in the original image are both is different. 5. A computer-readable storage medium, characterized in that: a computer program is stored thereon, and when the computer program is executed by a processor, a high-mobility adversarial example as described in any one of claims 1-4 is realized. Generate method. 6. A computer device, characterized by: including: Memory, used to store instructions; A processor configured to execute the instructions, causing the computer device to perform operations of a high-mobility adversarial sample generation method as described in any one of claims 1-4.