WO2022100603A1

WO2022100603A1 - Binary sampling processing method and apparatus, adversarial example generation method and apparatus, electronic device, and readable storage medium

Info

Publication number: WO2022100603A1
Application number: PCT/CN2021/129744
Authority: WO
Inventors: 沈杨书; 何伟; 邓磊; 祝夭龙
Original assignee: 北京灵汐科技有限公司
Priority date: 2020-11-13
Filing date: 2021-11-10
Publication date: 2022-05-19
Also published as: KR20220132010A; CN112379859A; CN112379859B

Abstract

A binary sampling processing method and apparatus, an adversarial example generation method and apparatus, an electronic device, and a readable storage medium. The binary sampling processing method comprises: determining a first sampling probability (S102), the first sampling probability corresponding to a sampling probability of one binary sampling; determining a value of a trigger signal parameter according to the first sampling probability (S104); inputting a trigger signal to a random access memory to trigger the performing of a write operation (S106), wherein the probability that the write operation is successful is associated with the value of the trigger signal parameter; and if the write operation is successful, generating first data, and if the write operation is not successful, generating second data (S108), wherein the first data and the second data are respectively different data in binary data. The method solves the problem in the related art of large energy consumption and large resource occupation of a binary sampling process caused by implementing binary sampling by continuously outputting pulse signals.

Description

Binary sampling processing method and device, counter sample generation method and device, electronic device, readable storage medium

technical field

The present invention relates to the field of computers, and relates to a binary sampling processing method and device, a method and device for generating countermeasures, an electronic device, and a readable storage medium.

Background technique

At present, in the process of binary sampling, it is necessary to obtain random numbers (binary random numbers) with the probability corresponding to the sampling probability; and the common way to generate random numbers by correlation is to continuously output pulse signals, and when random numbers need to be generated, Read the value of the current pulse signal, and use the current collected value as a random number. However, the above method of generating random numbers needs to continuously output a pulse signal within a certain period of time, which leads to problems such as large energy consumption and large resource occupation in the binary sampling process.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a method and device for processing binary sampling, a method and device for generating countermeasures, electronic equipment, and a readable storage medium, so as to solve the problem of implementing binary sampling by continuously outputting pulse signals in the related art, resulting in two problems. The process of value sampling has the problem of high energy consumption and large resource occupation.

In order to solve the above technical problems, this application is implemented as follows:

In a first aspect, a method for processing binary sampling is provided, including: determining a first sampling probability; the first sampling probability corresponds to a sampling probability of a binary sampling; determining a trigger signal parameter according to the first sampling probability take a value; input the trigger signal to the random access memory to trigger the execution of the write operation; wherein, the probability of the successful write operation is associated with the value of the trigger signal parameter; in the case that the write operation is successful, generate a first data; if the write operation is unsuccessful, second data is generated; wherein the first data and the second data are respectively different data in the binary data.

In a second aspect, a method for generating adversarial samples is provided, including: performing gradient descent processing on a first sample to obtain a first gradient of the first sample; wherein the sample data in the first sample is binary data, and the data in the first gradient is a continuous value; the absolute value of the data in the first gradient is normalized to obtain a second gradient; wherein, the data in the second gradient is a continuous value greater than or equal to zero and less than or equal to 1; the data in the second gradient is subjected to binary sampling by the binary sampling processing method described in any embodiment of the present application to obtain a third gradient; wherein, the The sampling probability of the binary sampling is determined by the data in the second gradient; the data in the third gradient is binary data; the target symbol of the data at the target position in the first gradient is extracted, and the adding a target symbol to the data corresponding to the target position in the third gradient; combining the sample data in the first sample with the data in the third gradient after adding the symbol to generate a target adversarial sample; The sample data in the target adversarial sample is binary data.

In a third aspect, a binary sampling processing device is provided, including: a controller configured to determine a first sampling probability, and determine a value of a trigger signal parameter according to the first sampling probability; the first sampling probability a sampling probability corresponding to a binary sampling; a random access memory for receiving the trigger signal to trigger the execution of a write operation; wherein, the probability of the successful write operation is associated with the value of the trigger signal parameter; the controller, It is also used to generate first data when the write operation is successful; generate second data when the write operation is unsuccessful; wherein the first data and the second data are respectively two different data in the value data.

In a fourth aspect, a device for generating an adversarial sample is provided, comprising: a first processing module configured to perform gradient descent processing on a first sample to obtain a first gradient of the first sample; wherein the first sample is The sample data in a sample is binary data, and the data in the first gradient is a continuous value; the normalization module is used to normalize the absolute value of the data in the first gradient to obtain The second gradient; wherein, the data in the second gradient is a continuous value that is greater than or equal to zero and less than or equal to 1; the binary sampling processing device of any embodiment of the present application is used for the second gradient. Binary sampling is performed on the data of , to obtain a third gradient; wherein, the sampling probability of the binary sampling is determined by the data in the second gradient; the data in the third gradient is binary data; the second processing module , for extracting the target symbol of the data of the target position in the first gradient, and adding the target symbol to the data corresponding to the target position in the third gradient; The sample data in the first sample is combined with the data in the third gradient after adding the symbol to generate a target adversarial sample; wherein, the sample data in the target adversarial sample is binary data.

In a fifth aspect, an embodiment of the present application further provides an electronic device, including a processor, a memory, and a program or instruction stored on the memory and executable on the processor, the program or instruction being When executed by the processor, the method of any embodiment of the present application is implemented.

In a sixth aspect, an embodiment of the present application further provides a readable storage medium, where a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, the method of any embodiment of the present application is implemented.

Through the present application, the write operation can be triggered by inputting a trigger signal to the random access memory, and then, in the case of a successful or unsuccessful write operation, the first data and the second data are respectively generated, and the first data and the second data are two The data in the value data, and their generation probability corresponds to the sampling probability of the binary sampling, so they can be used as different results of the binary sampling respectively; thus, the application can realize the binary sampling as long as there is a trigger of the trigger signal, without the need for The trigger signal is continuously input to the random access memory, thereby solving the problems of high energy consumption and resource occupation in the binary sampling process by continuously outputting pulse signals for binary sampling in the related art.

Description of drawings

1 is a flowchart of a method for processing binary sampling according to an embodiment of the present application;

2 is a schematic diagram of the relationship between the input voltage of the trigger signal, the pulse width of the trigger signal and the probability of a successful write operation according to an embodiment of the present application;

3 is a flowchart of a method for generating an adversarial sample according to an embodiment of the present application;

Fig. 4 is the sample schematic diagram 1 of the embodiment of the present application;

5 is a second schematic diagram of a sample of an embodiment of the present application;

Fig. 6 is the sample schematic diagram 3 of the embodiment of the present application;

Fig. 7 is the sample schematic diagram 4 of the embodiment of the present application;

Fig. 8 is the gradient schematic diagram 1 of the embodiment of the present application;

Fig. 9 is the gradient schematic diagram II of the embodiment of the present application;

Fig. 10 is the gradient schematic diagram three of the embodiment of the present application;

Fig. 11 is the gradient schematic diagram four of the embodiment of the present application;

FIG. 12 is a schematic diagram of gradient descent processing according to an embodiment of the present application;

13 is a schematic diagram of an absolute value normalization process according to an embodiment of the present application;

14 is a schematic diagram 1 of binary sampling according to an embodiment of the present application;

15 is a second schematic diagram of binary sampling according to an embodiment of the present application;

FIG. 16 is a schematic diagram of taking symbols in an embodiment of the present application;

17 is a schematic diagram of a limit conversion in an embodiment of the present application;

FIG. 18 is a complete schematic diagram of generating an adversarial sample according to an embodiment of the present application;

19 is a schematic structural diagram of an apparatus for generating random numbers according to an embodiment of the present application;

20 is a schematic structural diagram of an apparatus for generating an adversarial sample according to an embodiment of the present application;

21 is a schematic structural diagram of an electronic device according to an embodiment of the present application;

FIG. 22 is a schematic structural diagram of a readable storage medium according to an embodiment of the present application.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

In the description of this application, it should be understood that the terms "first" and "second" are only for the purpose of description, and cannot be construed as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, a feature delimited with "first", "second" may expressly or implicitly include one or more of that feature. In the description of the present invention, unless otherwise specified, "plurality" means two or more.

In the first aspect, an embodiment of the present application provides a method for processing binary sampling. FIG. 1 is a flowchart of the method for processing binary sampling according to an embodiment of the present application. As shown in FIG. 1 , the steps of the method are as follows:

Step S102, determining a first sampling probability.

The first sampling probability corresponds to the sampling probability of a binary sampling.

Step S104: Determine the value of the trigger signal parameter according to the first sampling probability.

Step S106, input a trigger signal to the random access memory to trigger the execution of the write operation.

The probability of a successful write operation is associated with the value of the trigger signal parameter.

Step S108, in the case that the write operation is successful, generate the first data; in the case that the write operation is unsuccessful, generate the second data.

Wherein, the first data and the second data are respectively different data in the binary data.

When writing to random access memory (RAM), it is not necessarily successful, but has a certain probability of success, and the probability of success can be adjusted by "the value of the trigger signal parameter"; and before the write operation, whether the write operation is Success is unpredictable, or the outcome is "random".

Therefore, in this application, the first sampling probability corresponding to the sampling probability of binary sampling is first determined, and then the value of the trigger signal parameter is set according to the first sampling probability, so that when the corresponding trigger signal is used for the writing operation, the writing The success probability of the operation corresponds to the sampling probability, so the probability of obtaining the first data or the second data according to whether the write operation is successful or not corresponds to the sampling probability, so as long as different sampling results are generated according to the first data and the second data, it can be realized The desired binary sampling.

Through steps S102 to S108 in this embodiment of the present application, a trigger signal can be input to the random access memory to trigger the execution of the write operation, and then the first data and the second data are respectively generated when the write operation is successful or unsuccessful. The first data and the second data are data in binary data, and their generation probability corresponds to the sampling probability of binary sampling, so they can be used as different results of binary sampling respectively; The binary sampling can be achieved by triggering without continuously inputting a trigger signal to the random access memory, thereby solving the problems of high energy consumption and resource occupation in the related art by continuously outputting pulse signals for binary sampling.

In an optional implementation of this embodiment of the present application, the first sampling probability refers to the probability that the binary sampling result is the first data, or the first sampling probability refers to the probability that the binary sampling result is the second data.

It should be noted that the binary data in this embodiment of the present application refers to a combination of two specific data, for example, it may include 0 and 1, that is, the first data may be 1, and the second data may be 0; One data is 0, and the second data is 1. Of course, the above binary data including 0 and 1 is only for illustration, and other binary data combinations are also possible, for example, the binary data is 2 and 1, or 3 and 5, or 4 and 7, and so on. The specific value of the binary data is not limited in this application, and the specific value can be determined according to the actual situation.

Based on this, taking the binary data including 0 and 1 as an example, if the first data is 1 and the second data is 0, the first sampling probability may refer to the probability that the binary sampling result is 1, or it may refer to the binary sampling probability. The probability that the sampling result is 0. If the first sampling probability refers to the probability that the binary sampling result is 1, and the first sampling probability is 0.8, it means that the probability that the binary sampling result is 1 is 0.8 (of course, the probability that the corresponding binary sampling result is 0 is 0.2) .

In an optional implementation of this embodiment of the present application, the trigger signal may be a pulse signal. Based on this, the trigger signal parameters in this embodiment of the present application include at least one of the following: pulse width of the trigger signal, pulse amplitude of the trigger signal, trigger signal The input voltage of the signal, the number of times the trigger signal is input in a unit time (that is, the time of each write operation).

In a specific application scenario, the pulse width of the trigger signal can be 20ns, the input voltage can be 1.5V, and the number of times the trigger signal is input per unit time can be 10 times, etc. The above values are just examples, and corresponding values can be set according to the actual situation in different application scenarios.

Based on this, the probability of a successful write operation is related to the value of the trigger signal parameter, and the trigger signal parameter is the number of times the trigger signal is input in a unit time, which is the current unit time (that is, the time of each write operation) in a specific application scenario. is 1s, and the current number of input trigger signals within 1s is 40 times. In order to obtain more data generated by successful write operations, the number of input trigger signals within 1s can be increased to 60 times, or, in order to reduce the number of times generated by successful operations The number of input trigger signals can be reduced to 20 times within 1s. For the pulse width, if the pulse width of the current trigger signal is 20ns, since the value of the pulse width is related to the probability of a successful write operation, if the value of the pulse width is larger, the probability of the success of the write operation is higher. In order to have a higher success probability of the write operation, the current pulse width can be adjusted to 30ns, 40ns, etc. On the contrary, if the success probability of the write operation is lower, the current pulse width can be adjusted to 10ns and so on. Of course, in other application scenarios, the success rate of the write operation may be 100% under a specified pulse width, and the success rate of the write operation decreases exponentially if it is higher or lower than the pulse width. For example, a pulse width of 50 ns with a write success rate of 100% is 60% or less in the case of a pulse width of 40 ns or 60 ns. Of course, the above is just an example, and in a specific application scenario, the value of the trigger signal parameter may be adjusted accordingly according to the actual situation.

For other parameters in the trigger signal parameters, the processing method is similar, that is, the pulse amplitude of the trigger signal and the input voltage used to adjust the trigger signal can be adjusted. It is represented by the pulse duration) and the corresponding relationship between the success probability of the write operation (represented by the switching probability in the figure), as shown in Figure 2.

In an optional implementation manner of the embodiment of the present application, the random access memory is preferably a non-volatile memory. Of course, the above is only an example, and other memories, such as non-volatile magnetic random access memory (MRAM), may also be used.

As a way of the embodiment of the present application, a magnetic random access memory (MRAM) can be used as the above random access memory, because the magnetic random access memory can use a pulse signal as a trigger signal to perform a write operation, and the probability of its successful writing is related to the width of the pulse signal. The parameters of the trigger signal have a certain relationship, which is easy to adjust.

Based on the foregoing embodiments of the present application, in order to be able to adjust the success probability of the write operation, after triggering the execution of the write operation, the method in the embodiments of the present application may further include:

Step S110: Adjust the value of the trigger signal parameter according to the second sampling probability.

Wherein, the second sampling probability corresponds to the sampling probability of another binary sampling.

After the first binary sampling is performed according to the first sampling probability, new binary sampling may be continued according to the second sampling probability, and binary sampling may be continuously performed according to the sampling probability of each subsequent binary sampling.

It should be noted that both the first sampling probability and the second sampling probability in this embodiment of the present application can be determined by the value of the trigger signal parameter, and both the first sampling probability and the second sampling probability refer to the sampling as the first sampling probability. In the case of the probability of the data, that is, the probability of a successful write operation, in order to match the probability of a successful write operation with the first sampling probability, it is necessary to adjust the value of the trigger signal parameter according to the first sampling probability or the second sampling probability; For example, the first sampling probability is 0.4, and the corresponding probability of a successful write operation is also 0.4. If the current trigger signal parameter is the number of times the trigger signal is input per unit time, the number of times the trigger signal is input per unit time corresponding to the first sampling probability is The number of times the trigger signal is input in 1s is 40 times; if the first sampling probability is to be adjusted to the second sampling probability, and the second sampling probability is 0.6, the corresponding probability of a successful write operation is also 0.6, then the second sampling probability is 0.6. The number of times the trigger signal is input in a unit time corresponding to the sampling probability is increased to 60 times within 1s. It should be noted that other trigger signal parameters are also processed in a similar manner. The above is just an example, and the values of other sampling probabilities and the values of the corresponding trigger signal parameters can be set according to the actual situation.

In a second aspect, an embodiment of the present application also provides a method for generating an adversarial sample.

In some related technologies, for a spiking neural network (SNN), since the required input is a binary pulse signal, part of the pulse signal of the input sample is randomly flipped, and then the random flip result is searched. way to generate adversarial samples to achieve the purpose of adversarial attacks.

However, in the method of generating impulse adversarial samples by trial and error, due to the huge search space, it is difficult to find accurate adversarial samples, resulting in a low attack success rate.

The method for generating an adversarial sample according to the embodiment of the present application can solve the problem of using random flipping of part of the pulse signal of the input sample in the related art, and then search for the random flipping result, but the search space will lead to a low attack success rate of the pulsed neural network. The problem.

As shown in FIG. 3 , the steps of the adversarial sample generation method according to the embodiment of the present application include:

Step S302, performing gradient descent processing on the first sample to obtain a first gradient of the first sample.

The sample data in the first sample is binary data, and the data in the first gradient is continuous value.

Step S304, normalize the absolute value of the data in the first gradient to obtain the second gradient.

Wherein, the data in the second gradient is a continuous value greater than or equal to zero and less than or equal to 1.

Step S306 , binary sampling is performed on the data in the second gradient by the method in the above-mentioned embodiment of the processing method for binary sampling to obtain the third gradient.

Among them, the sampling probability of binary sampling is determined by the data in the second gradient.

The data in the third gradient is binary data.

Step S308, extracting the target symbol of the data of the target position in the first gradient, and adding the target symbol to the data corresponding to the target position in the third gradient.

Step S310, combine the sample data in the first sample with the data in the third gradient after adding the symbol to generate a target adversarial sample.

Among them, the sample data in the target adversarial sample is binary data.

In the embodiment of the present application, first the binary first sample (the original input sample of the spiking neural network) is subjected to gradient descent processing to obtain the first gradient; the data of the first gradient is obviously a continuous value, and there are positive and negative .

Then, the absolute value of the data in the first gradient is taken and normalized to obtain the second gradient. Therefore, the data of the second gradient is a continuous value between 0 and 1, and each continuous value represents the sampling probability of binary sampling. For example, if one piece of data in the first gradient is 0.4, the probability that the binary sampling result is 1 is 0.4, and the probability that the binary sampling result is 0 is 0.6.

Furthermore, according to the second gradient, binary sampling may be performed according to the method of the embodiment of the present application to obtain a binary third gradient.

Then add the symbol of the data in the first gradient to the corresponding data of the third gradient as a correction to the first sample, so that the data of the first sample and the correction (that is, the corresponding data of the third gradient after adding the symbol) Add them to get the required binary adversarial samples (target adversarial samples).

Through the above-mentioned steps S302 to S310 in the embodiments of the present application, the first sample whose data type is binary data can be processed by gradient descent to obtain a first gradient whose corresponding data is continuous value, and then the first sample of continuous value can be After the gradient is processed by normalization, binary sampling, and taking symbols, it is converted into a third gradient with added symbols whose data is three-valued data. Finally, the sample data in the first sample is compared with the third gradient with added symbols. The data are combined to generate the target adversarial sample, so that the generated target adversarial sample and the data type of the first sample are matched, and both are binary data. If the first sample is the original sample of the spiking neural network, the adversarial sample obtained by the embodiment of the present application is a sample of the same data type as the original sample. On the one hand, the gradient descent method is used to generate a sample containing accurate gradient information. The first gradient avoids the use of random flipping of part of the pulse signal of the input sample in the related art, and then searches for the random flip result, but this search space will lead to the problem of low attack success rate of the spiking neural network. The first gradient is processed and converted into an adversarial sample that is consistent with the original sample data type, thereby improving the camouflage ability of the adversarial sample and achieving the effect of improving the success rate of the spiking neural network attack.

It should be noted that the first sample in the embodiment of the present application is obtained by converting at least one of the following: an image sample, a voice sample, and a text sample; or, the first sample is data collected by at least one of the following: dynamic vision Sensors, brain-computer interfaces. Based on this, the third gradient is used to characterize the amount of change in the data in the first sample, so the original sample and the third gradient (the amount of change) can be combined to generate the target adversarial sample.

In addition, the first sample in the embodiment of the present application is suitable for a neural network that receives a binary input signal, and may be an input sample of a spiking neural network SNN (Spiking Neuron Networks) in a specific application scenario. The binary data in the embodiment of the present application is a data type, and the data type means that the data in the sample only consists of {0, 1}. For example, the first sample in the embodiment of the present application is in a specific application scenario It may be any one of samples 1 to 4 as shown in FIGS. 4 to 7 .

Of course, samples 1 to 4 in the embodiment of the present application are only examples for the first sample, and the specific value of the data in the first sample can be determined according to the actual situation.

In addition, the ternary data in the embodiment of the present application is also a data type, and the data type means that the data in the sample consists only of {-1, 0, 1}, for example, the gradient of the ternary data (after adding the symbol) The third gradient) may be any one of gradients 1 to 4 as shown in FIGS. 8 to 11 .

That is to say, in this embodiment of the present application, a sample of binary data can be converted to obtain a corresponding gradient according to the following principles: the data in the original sample is 0, and the corresponding data in the converted gradient is 1 or -1; wherein, for- In the case of 1, subsequent limiting needs to be performed. The data in the original sample gradient is 1, and the corresponding data in the gradient is 0 or 1; among them, if the converted value is 1, subsequent limiting needs to be performed.

Of course, the above-mentioned gradients 1 to 4 are only examples of the three-valued data, and the specific three-valued data in the embodiment of the present application may be determined according to the actual situation.

In addition, in the embodiment of the present application, the continuous values in the first gradient obtained after the first sample is processed by gradient descent, take the first sample as sample 2 as an example, as shown in FIG. After the gradient descent process, the first gradient can be obtained. However, the gradient descent process in FIG. 11 is only an example, and it is also possible that the data in the first gradient is other values, and the corresponding first sample is still sample 2. The specific gradient descent processing needs to be processed according to the actual situation.

In an optional implementation of the embodiment of the present application, the absolute value of the data in the first gradient involved in step S304 is normalized to obtain a second gradient; wherein, the data in the second gradient is greater than or equal to zero, and less than or equal to 1 continuous value; it should be noted that the continuous value greater than or equal to zero may be a continuous value between 0 and 1 in a specific application scenario.

Taking the specific value of the first gradient in the above Figure 12 as an example, the absolute value of the data in the first gradient is normalized. In a specific application scenario, the absolute value of each data can be determined first, and then the absolute value of The data with the largest value is normalized to 1, and the number with the largest absolute value is determined as the normalization coefficient, and then the other absolute values are divided by the normalization coefficient. Specifically, the number with the largest absolute value is determined as 2, that is - The absolute value of 2.0 (ie, 2.0), and the result of normalizing it is 1, and it is determined as the normalization coefficient; then, the result of normalizing 0.8 based on this normalization coefficient is 0.4 , and other data in the first gradient are sequentially normalized, as shown in Figure 13.

In an optional implementation of this embodiment of the present application, the method involved in step S306 is to perform binary sampling on the data in the second gradient in the manner in the above-mentioned binary sampling processing method embodiment to obtain the third gradient This can be further achieved by:

The above step S306 can be further implemented by the following steps:

Step S11, determining that the gradient value of the data in the second gradient is the first sampling probability of the binary sampling.

Step S12: Determine the value of the trigger signal parameter based on the first sampling probability.

Step S13, input a trigger signal to the random access memory to trigger the execution of the write operation.

Step S14, if the write operation is successful, generate the first data; if the write operation is unsuccessful, generate the second data.

The first data and the second data are respectively different data in the binary data; the data in the third gradient includes the first data or the second data.

It should be noted that the sampling probability in the embodiment of the present application refers to the probability of obtaining one of the binary data, that is, the probability of 0 in the binary data or the probability of 1 in the binary data.

The following will take the probability of sampling as 1 as an example for description.

For the above step S306, take the second gradient in the above-mentioned FIG. 13 as an example, that is, the first sampling probability refers to the probability that the binary sampling result of each data is 1, that is, the binary sampling of the data whose second gradient is 0.4 The first sampling probability of 1 in the second gradient is 0.4; the binary sampling of the data with 0.8 in the second gradient is 0.8; the binary sampling of the data with 1 in the second gradient is 1. The first sampling probability is 1, as shown in FIG. 14 . It should be noted that FIG. 14 is only one of the sampling results, that is, it may also be the result shown in FIG. 15 , and of course it may be other situations; that is, FIG. 14 and FIG. 15 are examples for illustration.

That is to say, if there is only one random access memory in the embodiment of the present application, if 0.4 is input first, the probability of a successful write operation is 0.4, that is, the first sampling probability is 0.4; if 0.8 is continued to be input, the probability of a successful write operation is 0.8, the first sampling probability needs to be adjusted to the second sampling probability, that is, the second sampling probability is 0.8. If there are multiple random access memories in this embodiment of the present application, and input 0.4, the probability of a successful write operation after the multiple random access memories are connected is 0.4, and the probability of the successful write operation is determined by the corresponding probability of each of the multiple random access memories. The write operation success probability is combined to obtain.

The target position involved in step S308 in this embodiment of the present application refers to any position in the first gradient, that is, the symbols of all the data in the first gradient need to be added to the corresponding data in the third gradient, using the above Take the first gradient in Fig. 12 and the third gradient in Fig. 14 as an example, the symbol "-" in -2.0 can be added to 1 at the corresponding position in the third gradient, and the obtained result is "-1", followed by By analogy, the symbols in other positions are also processed in a similar manner, as shown in FIG. 16 .

In an optional implementation manner in the embodiment of the present application, for the step S310 involved in the embodiment of the present application, the sample data in the first sample is combined with the data in the third gradient after adding the symbol to generate the target Ways of adversarial examples can further include:

Step S310-11: Accumulate the first sample and the data at the same position in the third gradient after adding the symbol to obtain the first confrontation sample.

Step S310-12, performing clipping transformation on the first adversarial sample to generate an adversarial sample.

Wherein, step S310-12 may further be:

In step S21, data that does not match the binary data is determined from the first adversarial sample.

Step S22: Convert the data in the first adversarial sample that does not match the binary data into binary data to generate a target adversarial sample.

It should be noted that the clipping in the clipping conversion is determined according to the binary data in the first sample. That is to say, the data type in the finally generated adversarial sample is consistent with the data type in the first sample. Based on this, for the above step S310, taking the third gradient after adding the symbol in the above-mentioned FIG. 16 as an example, the data in the third gradient after adding the symbol and the data in the first sample are accumulated to obtain the first confrontation sample, as shown in FIG. 17 . As shown, since the data in the first adversarial sample may have data of -1, 0, 1, and 2, that is, the data in the first adversarial sample is quaternary data, it is necessary to perform clipping transformation. The purpose of clipping transformation is to convert the data in the first adversarial sample into binary data, that is, convert the 2 in the first adversarial sample to 1, and convert the -1 in the first adversarial sample to 0, so as to obtain the same value as the data in the first sample. Type-consistent target adversarial examples.

For the above steps S302 to S310, in a specific application scenario, the entire process of generating adversarial samples is shown in Figure 18.

Through the embodiments of the present application, gradient descent is used to generate impulse adversarial samples (target adversarial samples) corresponding to the original samples (first samples), and a high-success rate impulse neural network attack is realized; In the process of the pulse confrontation sample corresponding to the sample, the sample gradient of the continuous value format is used to modify the input sample of the pulse format, as the basis for the subsequent generation of the pulse confrontation sample, in which the difference between the confrontation sample and the original sample is limited by probability sampling, so that This makes it possible to generate easily camouflaged adversarial samples with accurate gradient information, consistent with the original sample data type and with a small amount of change, avoiding the use of random flipping of part of the pulse signal of the input sample in the related art, and then searching for the random flipping results. The search space assembly leads to the problem of low attack success rate of the spiking neural network, and achieves the effect of improving the attack success rate of the spiking neural network.

In a third aspect, an embodiment of the present application provides a binary sampling processing device. FIG. 19 is a schematic structural diagram of a binary sampling processing device according to an embodiment of the present application. As shown in FIG. 19 , the binary sampling processing device 190 includes: a controller 192 and a random access memory 194; wherein,

The controller 192 is configured to determine the first sampling probability, and determine the value of the trigger signal parameter according to the first sampling probability.

The random access memory 194 is used to receive a trigger signal to trigger a write operation.

Among them, the probability of a successful write operation is associated with the value of the trigger signal parameter;

The controller 192 is further configured to generate the first data when the write operation is successful; and generate the second data when the write operation is unsuccessful.

With the binary sampling processing device in the embodiment of the present application, a trigger signal can be input to the random access memory to trigger the execution of the write operation, and then the first data and the second data are respectively generated when the write operation is successful or unsuccessful, The first data and the second data are data in binary data, and their generation probability corresponds to the sampling probability of binary sampling, so they can be used as different results of binary sampling respectively; thus, as long as there is a trigger signal in the present application The binary sampling can be realized by only triggering, without continuously inputting the trigger signal to the random access memory, thus solving the problem of high energy consumption and resource occupation in the related art by continuously outputting the pulse signal for binary sampling.

Optionally, the first sampling probability refers to the probability that the binary sampling result is the first data, or the first sampling probability refers to the probability that the binary sampling result is the second data.

Optionally, the trigger signal in this embodiment of the present application is a pulse signal. Based on this, the trigger signal parameter includes at least one of the following: the pulse width of the trigger signal, the pulse amplitude of the trigger signal, the input voltage of the trigger signal, and the number of times the trigger signal is input per unit time.

Optionally, the controller 192 in this embodiment of the present application is further configured to adjust the value of the trigger signal parameter according to the second sampling probability after triggering the execution of the write operation.

Optionally, the random access memory in this embodiment of the present application is a non-volatile magnetic random access memory MRAM.

In a fourth aspect, an embodiment of the present application also provides an apparatus for generating an adversarial sample. As shown in FIG. 20 , the apparatus includes:

The first processing module 202 is configured to perform gradient descent processing on the first sample to obtain the first gradient of the first sample.

The normalization module 204 is configured to perform normalization processing on the absolute value of the data in the first gradient to obtain the second gradient.

The binary sampling processing device 190 in FIG. 19 is configured to perform binary sampling on the data in the second gradient to obtain the third gradient.

The sampling probability of binary sampling is determined by the data in the second gradient; the data in the third gradient is binary data.

The second processing module 206 is configured to extract the target symbol of the data of the target position in the first gradient, and add the target symbol to the data corresponding to the target position in the third gradient.

The generating module 208 is configured to combine the sample data in the first sample with the data in the third gradient after adding the symbol to generate a target adversarial sample; wherein, the sample data in the target adversarial sample is binary data.

Optionally, the generation module 208 in this embodiment of the present application may further include: an accumulation unit, configured to accumulate the first sample and the data at the same position in the third gradient after adding the symbol to obtain the first confrontation sample; the generation unit , which is used to clip the first adversarial example to generate the target adversarial example.

Optionally, the generating unit in this embodiment of the present application may further include: a determining subunit, configured to determine data that does not match the binary data from the first confrontation sample; The data that does not match the binary data is converted into binary data to generate target adversarial samples.

Optionally, the clipping in the clipping conversion in the embodiment of the present application is determined according to the binary data in the first sample.

Optionally, the first sample in the embodiment of the present application is an input sample of the spiking neural network.

Optionally, the first sample in this embodiment of the present application is obtained by converting at least one of the following: an image sample, a voice sample, and a text sample; or, the first sample is data collected by at least one of the following: a dynamic vision sensor , Brain-computer interface.

In a fifth aspect, referring to FIG. 21 , an embodiment of the present application further provides an electronic device, including a processor, a memory, and a program or instruction stored in the memory and executable on the processor, the program or instruction being executed by the processor During execution, each process of the above-mentioned binary sampling processing method or the method for generating an adversarial sample is implemented, and the same technical effect can be achieved. In order to avoid repetition, details are not repeated here.

It should be noted that the electronic devices in the embodiments of the present application include the aforementioned mobile electronic devices and non-mobile electronic devices.

In a sixth aspect, referring to FIG. 22 , an embodiment of the present application further provides a readable storage medium, where a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, the processing of the above-mentioned binary sampling is realized. The method, or the various processes of the embodiments of the method for generating an adversarial sample, and can achieve the same technical effect, in order to avoid repetition, details are not repeated here.

Wherein, the processor is the processor in the electronic device described in the foregoing embodiments. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, and the like.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present application can be implemented by a general-purpose computing device, and they can be centralized on a single computing device, or distributed in a network composed of multiple computing devices Alternatively, they may be implemented in program code executable by a computing device, such that they may be stored in a storage device and executed by the computing device, and in some cases, in a different order than here The steps shown or described are performed either by fabricating them separately into individual integrated circuit modules, or by fabricating multiple modules or steps of them into a single integrated circuit module. As such, the present application is not limited to any particular combination of hardware and software.

The above descriptions are only preferred embodiments of the present application, and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims

A method for processing binary sampling, comprising:

determining a first sampling probability; the first sampling probability corresponds to the sampling probability of a binary sampling;

Determine the value of the trigger signal parameter according to the first sampling probability;

inputting the trigger signal to the random access memory to trigger the execution of the write operation; wherein, the probability of the successful write operation is associated with the value of the trigger signal parameter;

in the case that the write operation is successful, generating first data;

In the case that the write operation is unsuccessful, second data is generated; wherein, the first data and the second data are respectively different data in the binary data.
The method according to claim 1, wherein the first sampling probability refers to the probability that the binary sampling result is the first data, or the first sampling probability refers to the binary sampling result being all the probability of the second data.
The method according to claim 1, wherein the trigger signal is a pulse signal.
The method according to claim 3, wherein the trigger signal parameters include at least one of the following: pulse width of the trigger signal, pulse amplitude of the trigger signal, input voltage of the trigger signal, unit time The number of times that the trigger signal is input within.
The method according to claim 1, wherein after triggering the execution of the write operation, the method further comprises:

The value of the trigger signal parameter is adjusted according to the second sampling probability; the second sampling probability corresponds to the sampling probability of another binary sampling.
The method according to any one of claims 1 to 5, wherein the random access memory is a non-volatile magnetic random access memory MRAM.
A method for generating adversarial samples, comprising:

Perform gradient descent processing on the first sample to obtain the first gradient of the first sample; wherein, the sample data in the first sample is binary data, and the data in the first gradient is continuous numerical value ;

Normalizing the absolute value of the data in the first gradient to obtain a second gradient; wherein, the data in the second gradient is a continuous value greater than or equal to zero and less than or equal to 1;

Binary sampling is performed on the data in the second gradient by using the binary sampling processing method according to any one of claims 1 to 6 to obtain a third gradient; wherein, the sampling probability of the binary sampling is determined by the The data in the second gradient is determined; the data in the third gradient is binary data;

extracting the target symbol of the data of the target position in the first gradient, and adding the target symbol to the data corresponding to the target position in the third gradient;

The sample data in the first sample is combined with the data in the third gradient after adding the symbol to generate a target adversarial sample; wherein, the sample data in the target adversarial sample is binary data.
The method according to claim 7, wherein the combining the sample data in the first sample with the data in the third gradient after adding the symbol to generate the target adversarial sample comprises:

Accumulating the first sample and the data at the same position in the third gradient after adding the symbol to obtain the first adversarial sample;

A clipping transformation is performed on the first adversarial example to generate the target adversarial example.
The method according to claim 8, wherein the performing clipping transformation on the first adversarial sample to generate a target adversarial sample, comprising:

determining from the first adversarial sample data that does not match the binary data;

Converting the data in the first adversarial sample that does not match the binary data into binary data to generate the target adversarial sample.
The method according to claim 8, wherein the clipping in the clipping conversion is determined according to the binary data in the first sample.
The method according to any one of claims 7 to 10, wherein the first sample is an input sample of a spiking neural network.
The method according to any one of claims 7 to 10, wherein,

The first sample is obtained by converting at least one of the following: an image sample, a voice sample, and a text sample;

or,

The first sample is data collected by at least one of the following: a dynamic vision sensor and a brain-computer interface.
A processing device for binary sampling, comprising:

a controller, configured to determine a first sampling probability, and determine a value of a trigger signal parameter according to the first sampling probability; the first sampling probability corresponds to a sampling probability of a binary sampling;

a random access memory, configured to receive the trigger signal to trigger the execution of a write operation; wherein, the probability of the successful write operation is associated with the value of the trigger signal parameter;

The controller is further configured to generate first data when the write operation is successful; generate second data when the write operation is unsuccessful; wherein the first data and the first data The two data are different data in the binary data, respectively.
A device for generating adversarial samples, comprising:

a first processing module, configured to perform gradient descent processing on the first sample to obtain a first gradient of the first sample; wherein the sample data in the first sample is binary data, and the first The data in the gradient are continuous values;

A normalization module, configured to normalize the absolute value of the data in the first gradient to obtain a second gradient; wherein the data in the second gradient is greater than or equal to zero and less than or equal to 1 continuous value of ;

The processing device for binary sampling according to claim 13, for performing binary sampling on the data in the second gradient to obtain a third gradient; wherein, the sampling probability of the binary sampling is determined by the second gradient The data in the third gradient is determined; the data in the third gradient is binary data;

The second processing module, for extracting the target symbol of the data of the target position in the first gradient, and adding the target symbol to the data corresponding to the target position in the third gradient;

A generating module, configured to combine the sample data in the first sample with the data in the third gradient after adding the symbol to generate a target adversarial sample; wherein, the sample data in the target adversarial sample is a binary value data.
An electronic device, characterized in that it includes a processor, a memory, and a program or instruction stored on the memory and executable on the processor, the program or instruction being executed by the processor to achieve the right The method for processing binary sampling according to any one of claims 1-6, or the steps of implementing the method for generating adversarial samples according to any one of claims 7-12.
A readable storage medium, characterized in that, a program or an instruction is stored on the readable storage medium, and when the program or instruction is executed by a processor, the binary sampling according to any one of claims 1-6 is implemented. The processing method, or, the steps of implementing the adversarial sample generation method according to any one of claims 7-12.