CN110276377B - Confrontation sample generation method based on Bayesian optimization - Google Patents

Abstract

The invention discloses a method for generating a confrontation sample based on Bayesian optimization, and the existing black box attack method needs to acquire optimization information by inquiring a large number of models. The method takes an original picture as input, and determines a position to be optimized by calculating the gradient of the structural similarity of a disturbed picture and the original picture; then carrying out sampling optimization in the selected position by using Bayesian optimization to obtain a disturbance value which can increase the loss function in the position; and selecting a plurality of positions in an iterative mode, and optimizing to obtain a disturbance value until the classification result of the disturbed image is changed or the maximum iteration number is reached, and stopping. The method and the device can effectively reduce the frequency of inquiring the target DNN model, and the number of the disturbance pixel points is small.

Description

Confrontation sample generation method based on Bayesian optimization

Technical Field

The invention belongs to the field of computer digital image processing, and particularly relates to a countermeasure sample generation method.

Background

Deep learning has made a major breakthrough in solving complex problems that have been difficult to solve in the past, and has been applied to, for example, reconstructing brain circuits, analyzing mutations in DNA, predicting the active structures of potential drug molecules, analyzing particle accelerator data, and the like. Deep Neural Networks (DNNs) have also become the method of choice to address many of the challenging tasks of speech recognition and natural language understanding.

While DNNs perform various computer vision tasks with surprising precision, DNNs are extremely vulnerable to counter-attacks in the form of adding minute image perturbations to the image that are barely perceptible to the human visual system. Such an attack may cause the DNN classifier to completely change its predictions about the image, with the attacked model being highly trusted about the wrong predictions. Moreover, the same image perturbation may spoof multiple neural network classifiers. Such perturbed pictures that can alter the prediction of the DNN classifier are referred to as countermeasure samples.

Current methods of generating challenge samples can be broadly divided into two categories: white box attacks and black box attacks. The white-box attack assumes that all knowledge of the existing target model, including its parameter values, architecture, training method, etc., and even the training data of the target model is known, and uses this knowledge to generate countermeasure samples to spoof the target model. For example, the FGSM calculates gradient information of a target model, adds a small perturbation construction countermeasure sample with the same size to each pixel value, calculates a forward derivative of the model, and perturbs the construction countermeasure sample of a limited number of pixel points. White-box attacks have the advantage of being computationally fast, but require gradient information to the target network. The black box attack method does not need to utilize gradient and parameter knowledge of a network, the target model is deceived by inputting a prediction label of an confrontation sample query output by the target model and generating the confrontation sample by utilizing the information. For example, the One Pixel attach method uses a concept of differential evolution, a countermeasure sample is generated by observing a prediction probability label of a target model, a target network can be misled only by changing One Pixel point, and the Boundary attach method can generate the countermeasure sample only by utilizing a classification output result of the network. However, the lack of gradient information results in a high evaluation cost, such as 3 million evaluations required by One Pixel Attacks method, and million evaluations required by Boundary Attacks method.

Disclosure of Invention

The invention mainly aims to provide a black box attack method for generating a countermeasure sample based on Bayesian optimization aiming at the problem that the existing black box attack method brings a large amount of query overhead. The method searches in a solution space by using Bayesian optimization, iteratively finds a specific disturbance in the solution space, and can change the classification result of a classifier on the disturbed image after the disturbance is added to an original image.

The black box attacking method used by the invention comprises the following steps:

step one, acquiring the real category y of an original image x_cAnd its probability M_c

Taking an original image x as the input of a target DNN classifier taking theta as a parameter to obtain a probability output vector M (x; theta) of the original image; taking the category corresponding to the maximum value in the probability output vector as the category prediction y of the original image_cMaximum value of the probability output vector is M_c；

Step two, determining an objective function to be optimized

Generating a countermeasure sample by using an iterative method, and only disturbing a certain dimension of an image vector in each iteration in order to reduce the complexity of calculation; setting a disturbance value as z, and assigning the disturbance value z to a corresponding dimension of delta x; the disturbance value satisfies that < z < epsilon to ensure the image quality, and epsilon is a set threshold value; inputting x + delta x into a deep neural network DNN classifier with a parameter theta to obtain a prediction output vector M (x + delta x; theta); divide y by M (x + Deltax; theta)_cMaximum probability value outside class M_tThe corresponding category is y_tThe objective function is defined as b (z) log (M)_c)- log(M_t) (ii) a The optimization target is B (z) less than or equal to 0, so that the classification result of the target DNN classifier on the disturbed image is changed; Δ x is an all-0 perturbation vector with the same dimensions as x;

step three, determining the coordinates and channels needing to be optimized in the iteration

In the Tth iteration, the current disturbance image x' x + delta x and the random image x are calculated_GGradient of structural similarity of

Selecting a dimension s corresponding to the minimum gradient value as a required optimization dimension; x is the number of_GIs a random vector sampled from a gaussian distribution with the same dimension as x;

step four, Bayesian optimization is used in specific dimensionality

1) Proxying an objective function to be optimized using a Gaussian process, doing so using an EI policyIs an acquisition function; setting the maximum test point frequency as I and the current test point number I as 0; firstly, randomly selecting a plurality of disturbance values to test, and generating an initial observation data set D_1:tT observed data points;

2) from the observed data set D_1:tThe obtained posterior distribution constructs an EI acquisition function alpha_t(z；D_1:t)：

Wherein v is^*Represents the current optimum function value, phi (-) as a standard normal distribution probability density function, mu_t(z) and σ_t(z) each represents D_1:tMean and variance of the median data points;

3) selecting the next evaluation point by maximizing the acquisition function

Will z_t+1Is assigned to the corresponding dimension s of Δ x and the value of the objective function at that time B (z) is evaluated_t+1) At z is_t+1Adding the evaluation value into the observation data set D after evaluation; if I is less than or equal to I, turning to (2);

4) outputting the minimum function value B (z) in the observed data set and a corresponding disturbance value z;

step five: assigning the optimal disturbance value z obtained in the step four to a disturbance vector delta x; if B (z) is less than or equal to 0, the attack is considered to be successful, the disturbed picture x + delta x is output as a countercheck sample, if B (z) is greater than 0, the attack is considered to be unsuccessful in the iteration, the step three is skipped, and the next iteration is continued on the basis of the current disturbance vector delta x.

The invention has the beneficial effects that:

according to the method, the gradient of the structural similarity is calculated, and the disturbance is added to the pixel point of the coordinate corresponding to the minimum gradient, so that the influence of the added disturbance on the image quality is reduced. Meanwhile, the Bayesian optimization method is adopted to calculate the disturbance, and the optimal disturbance value can be obtained by using fewer query times.

Drawings

FIG. 1 is an original image;

FIG. 2 is a Gaussian random image;

FIG. 3 is a resistance disturbance image;

fig. 4 is a countermeasure sample image.

Detailed Description

The method takes an original image as input, calculates the structural similarity between the original image and a random Gaussian image, calculates the gradient of the original image and the random Gaussian image, and selects the dimension corresponding to the minimum gradient value. The best perturbation value is obtained using bayesian optimization dimension by dimension. And superposing the disturbances obtained by multiple iterations until the class prediction result of the DNN classifier is changed.

The following illustrates the specific implementation of the whole process of the present invention (see fig. 2 for the effect diagram of each step):

step one, acquiring the real category y of an original image x_cAnd its probability M_c

x is the original image vector (as shown in FIG. 1), Δ x is the all 0 perturbation vector with the same dimension as x, x_GIs a random vector sampled from a gaussian distribution with the same dimension as x (as shown in fig. 2). Taking an original image x as the input of a target DNN classifier, and obtaining a probability output vector M (x; theta) of the original image; taking the category corresponding to the maximum value in the probability output vector as the category prediction y of the original image_cMaximum value of the probability output vector is M_c。

Step two, determining an objective function to be optimized

Since the image vector x has a higher dimension and no perturbation needs to be added to all dimensions to generate the challenge sample, only one dimension is perturbed at a time in the method, and the other dimensions are not changed to generate the trial perturbation ax. And inputting the x + delta x into the DNN classifier to obtain a prediction output vector M (x + delta x; theta). Divide y by M (x + Deltax; theta)_cMaximum probability value outside class M_tThe corresponding category is y_tThe objective function is defined as b (z) log (M)_c)- log(M_t). The goal of the optimization is B (z) ≦ 0, changing the classification result of the target DNN classifier on the perturbed image.

Step three: determining the coordinates and channels to be optimized in the iteration

In the Tth iteration, the current disturbance image x' x + delta x and the random image x are calculated_GStructural similarity SSIM (x', x)_G)：

Here mu_x′、

Denotes x' and x_GThe average value of (a) of (b),

denotes x' and x_GThe variance of (a) is determined,

denotes x' and x_GIs e.g., c₁And e₂Is a small scalar to ensure that the denominator is not zero. Then, the gradient of the structural similarity with respect to x' is solved to obtain a gradient vector with the same dimension as the original image

And selecting the coordinate s and the channel c corresponding to the minimum gradient value as the next optimized coordinate:

step four: using Bayesian optimization for particular pixels

1) And (3) using a Gaussian process to proxy an objective function to be optimized, and using an EI strategy as an acquisition function. Setting the maximum test point frequency I and the current test point number I to be 0; firstly, randomly selecting a plurality of disturbance values to test, and generating an initial observation data set D_1:tT observed data points are included.

2) From the observed data set D_1:tThe obtained posterior distribution constructs an EI acquisition function alpha_t(z；D_1:t)：

Wherein v is^*Represents the current optimum function value, phi (-) as a standard normal distribution probability density function, mu_t(z) and σ_t(z) each represents D_1:tMean and variance of the mean data points.

3) Selecting the next evaluation point by maximizing the acquisition function

Will z_t+1Is assigned to the corresponding dimension s of Δ x and the value of the objective function at that time B (z) is evaluated_t+1) At z is_t+1After the evaluation, the evaluation value is added to the observation data set D. I + -, 1, if I is less than or equal to I, turn (2).

4) And outputting the minimum function value B (z) in the observed data set and the corresponding disturbance value z.

Step five: and assigning the optimal disturbance value z obtained in the fourth step to a disturbance vector delta x (the final disturbance image is shown in fig. 3, total disturbance is carried out on 36 pixel points, and 891 evaluation times are carried out). If B (z) ≦ 0, the attack is considered to be successful, and the disturbed picture x + Δ x is output as a countercheck sample (the final countercheck sample image is shown in FIG. 4), if B (z) > 0, the attack is considered to be unsuccessful in the iteration, the step three is skipped, and the next iteration is continued on the basis of the current disturbance vector Δ x.

The experimental results are as follows: 100 pictures are randomly selected from CIFAR10 as experimental data, and in the experimental result, the average number of the disturbed pixels is 95.22, the median is 78.5, the average evaluation times is 2364.85 times, and the median is 1944.5 times. The number of evaluations is significantly less than the One Pixel Attacks method and Boundary Attacks method.

Claims (1)

1. A countercheck sample generation method based on Bayesian optimization is characterized by comprising the following steps:

step one, acquiring the real category y of an original image x_cAnd its probability M_c

Taking an original image x as the input of a target DNN classifier taking theta as a parameter to obtain a probability output vector M (x; theta) of the original image; taking the category corresponding to the maximum value in the probability output vector as the category prediction y of the original image_cMaximum value of the probability output vector is M_c；

Step two, determining an objective function to be optimized

Generating a countermeasure sample by using an iterative method, and only disturbing a certain dimension of an image vector in each iteration in order to reduce the complexity of calculation; setting a disturbance value as z, and assigning the disturbance value z to a corresponding dimension of delta x; the disturbance value satisfies that < z < epsilon to ensure the image quality, and epsilon is a set threshold value; inputting x + delta x into a deep neural network DNN classifier with a parameter theta to obtain a prediction output vector M (x + delta x; theta); divide y by M (x + Deltax; theta)_cMaximum probability value outside class M_tThe corresponding category is y_tThe objective function is defined as b (z) log (M)_c)-log(M_t) (ii) a The optimization target is B (z) less than or equal to 0, so that the classification result of the target DNN classifier on the disturbed image is changed; Δ x is an all-0 perturbation vector with the same dimensions as x;

step three, determining the coordinates and channels needing to be optimized in the iteration

In the Tth iteration, the current disturbance image x' x + delta x and the random image x are calculated_GGradient of structural similarity of

Selecting a dimension s corresponding to the minimum gradient value as a required optimization dimension; x is the number of_GIs a random vector sampled from a gaussian distribution with the same dimension as x;

step four, Bayesian optimization is used in specific dimensionality

1) Using a Gaussian process to proxy an objective function to be optimized, and using an EI strategy as an acquisition function; setting the maximum test point frequency as I and the current test point number I as 0; firstly, randomly selecting a plurality of disturbance values to test, and generating an initial observation data set D_1：tT observed data points;

2) from the observed data set D_1：tThe obtained posterior distribution constructs an EI acquisition function alpha_t(z；D_1：t)：

Wherein v is^*Represents the current optimum function value, phi (-) as a standard normal distribution probability density function, mu_t(z) and σ_t(z) each represents D_1：tMean and variance of the median data points;

3) selecting the next evaluation point by maximizing the acquisition function

Will z_t+1Is assigned to the corresponding dimension s of Δ x and the value of the objective function at that time B (z) is evaluated_t+1) At z is_t+1Adding the evaluation value into the observation data set D after evaluation; if I is less than or equal to I, turning to (2);

4) outputting the minimum function value B (z) in the observed data set and a corresponding disturbance value z;

step five: assigning the optimal disturbance value z obtained in the step four to a disturbance vector delta x; if B (z) is less than or equal to 0, the attack is considered to be successful, the disturbed picture x + delta x is output as a countercheck sample, if B (z) is greater than 0, the attack is considered to be unsuccessful in the iteration, the step three is skipped, and the next iteration is continued on the basis of the current disturbance vector delta x.

Images