CN114399630A - Countercheck sample generation method based on belief attack and significant area disturbance limitation - Google Patents
Countercheck sample generation method based on belief attack and significant area disturbance limitation Download PDFInfo
- Publication number
- CN114399630A CN114399630A CN202111655287.8A CN202111655287A CN114399630A CN 114399630 A CN114399630 A CN 114399630A CN 202111655287 A CN202111655287 A CN 202111655287A CN 114399630 A CN114399630 A CN 114399630A
- Authority
- CN
- China
- Prior art keywords
- disturbance
- attack
- belief
- generating
- countermeasure
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 82
- 230000004913 activation Effects 0.000 claims abstract description 13
- 238000013507 mapping Methods 0.000 claims abstract description 9
- 238000005516 engineering process Methods 0.000 claims abstract description 6
- 238000012549 training Methods 0.000 claims description 13
- 230000003042 antagnostic effect Effects 0.000 claims description 10
- 210000002569 neuron Anatomy 0.000 claims description 8
- 230000008569 process Effects 0.000 claims description 8
- 238000004364 calculation method Methods 0.000 claims description 7
- 230000004927 fusion Effects 0.000 claims description 5
- OAICVXFJPJFONN-UHFFFAOYSA-N Phosphorus Chemical compound [P] OAICVXFJPJFONN-UHFFFAOYSA-N 0.000 claims description 3
- HTIQEAQVCYTUBX-UHFFFAOYSA-N amlodipine Chemical compound CCOC(=O)C1=C(COCCN)NC(C)=C(C(=O)OC)C1C1=CC=CC=C1Cl HTIQEAQVCYTUBX-UHFFFAOYSA-N 0.000 claims description 3
- 238000012937 correction Methods 0.000 claims description 3
- 238000009499 grossing Methods 0.000 claims description 3
- 239000011159 matrix material Substances 0.000 claims description 3
- 238000013528 artificial neural network Methods 0.000 abstract description 5
- 235000000332 black box Nutrition 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 238000005457 optimization Methods 0.000 description 5
- 230000003044 adaptive effect Effects 0.000 description 4
- 238000011156 evaluation Methods 0.000 description 4
- 238000013459 approach Methods 0.000 description 3
- 238000004422 calculation algorithm Methods 0.000 description 3
- 238000013508 migration Methods 0.000 description 3
- 230000005012 migration Effects 0.000 description 3
- 238000003062 neural network model Methods 0.000 description 3
- 230000000007 visual effect Effects 0.000 description 3
- ORILYTVJVMAKLC-UHFFFAOYSA-N Adamantane Natural products C1C(C2)CC3CC1CC2C3 ORILYTVJVMAKLC-UHFFFAOYSA-N 0.000 description 2
- 238000001514 detection method Methods 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000007123 defense Effects 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 238000003709 image segmentation Methods 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 230000001537 neural effect Effects 0.000 description 1
- 238000003909 pattern recognition Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 229920006395 saturated elastomer Polymers 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Biophysics (AREA)
- Biomedical Technology (AREA)
- Mathematical Physics (AREA)
- Computational Linguistics (AREA)
- Health & Medical Sciences (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Image Analysis (AREA)
Abstract
The invention provides a method for generating an confrontation sample based on belief attack and significant area disturbance limitation, which relates to the technical field of deep neural networks and the field of computer vision, and comprises the following steps: providing an original image and a white-box target model, using a data set containing the original image as the data set, generating a binary mask of a salient region of the original image by utilizing a class activation mapping technology, and generating global countermeasure disturbance by utilizing a belief-based attack method to fuse an iterative fast gradient method; fusing the generated global countermeasure disturbance and the significant region binary mask to generate significant region countermeasure disturbance; adding the salient region countermeasure disturbance to the input image, iteratively updating until a preset termination condition is reached, and outputting the image countermeasure sample of the last iteration as the generated countermeasure sample. The challenge sample generated by the method has low disturbance and high mobility.
Description
Technical Field
The invention relates to the technical field of deep neural networks and the field of computer vision, in particular to a countercheck sample generation method based on belief attack and significant area disturbance limitation.
Background
The wide application of deep neural networks has led to a tremendous performance increase for many computer vision tasks, such as image classification, target detection, image segmentation, etc. However, recent studies have found that Deep Neural Networks (DNNs) are susceptible to spoofing by artificially carefully designed challenge samples. In 2014, szegdy et al first discovered the existence of a challenge sample in the field of image classification, i.e., adding a small perturbation to the original image would cause a misdiscrimination of the DNN model. More seriously, these small perturbations are also very subtle and not easily perceived by the human visual system. This finding reveals that the DNN model presents a number of security issues that, if left unsolved, pose an uncontrollable security risk. Therefore, generating a countermeasure sample with high aggressiveness can not only detect the vulnerability of the DNN model, but also improve the robustness of the DNN model.
Existing challenge sample generation methods can be divided into two categories: a white box attack method and a black box attack method. The white-box attack method assumes that all information of the target network is grasped and the countermeasures are generated using the information. In contrast, the black box attack method can generate an offensive countermeasure sample without grasping any information of the target network. Since most of the model information in the real world is difficult to obtain, the black box attack is more applicable. Existing black box attack models can be further divided into two categories: a query-based attack method and a migration-based attack method. The query-based approach queries the target model using some input images and then uses the queried information to generate a black-box model that counters sample attacks. Such methods can be further classified into a prediction score-based query method and a prediction tag-based query method according to query information. For the predictive score-Based approach, Chen et al, in article "Zoo: zero Order Optimization Based Black-box targets to Deep Neural Networks with out Training sub static Models [ C ]// ACM 10th ACM works on Intelligent interest and Security, Dallas, TX, United states, pages 15-26,2017" propose a Black-box challenge sample generation method of zero Order Optimization Based Black-box targets (ZOO) that utilizes a gradient estimation method instead of gradient information of the Black-box target model Based on the predictive score to generate challenge samples. For predictive tag-based query methods, Brendel et al, in the article "Decision-based adaptive models". Reliable attacks against missing black-box machine Learning models [ C ]// International Conference on Learning retrieval, Vancouver, BC, Canada,2018, "propose a boundary attack method that randomly samples candidate perturbations of an anti-sample from a particular distribution, and then selects the perturbation that minimizes the loss function as the anti-perturbation. Although the query-based attack method can achieve a better black box attack effect, the method inevitably introduces high computational overhead due to the requirement of a large number of query operations. Migration-based methods, which aim to promote the mobility of the countersamples generated by the white-box model to attack the target model, can also be divided into two categories: surrogate model-based attack methods and gradient-based attack methods. The surrogate model-based attack method aims at training a white-box surrogate model to generate a countersample. Zhou et al, in the article "Datt: Data-free customization training for adaptive attacks [ C ]// IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, United states, pages 234-. Surrogate model-based approaches also require a large number of query operations. The gradient-based attack method is intended to improve the mobility of white-box models to generate challenge samples, and Kurakin et al propose the I-FGSM method in the article "adaptive experiments in the physical world [ C ]// International Conference on Learning responses, Caribe Hilton, San Juan, Puerto Rico, pages 99-112,2016, which generates challenge samples by multiple iterations. Although the gradient-based attack method does not require a large number of query operations, the following problems still exist: first, gradient-based methods typically ignore semantic information in the input image that plays an important role in DNN model decision-making, so the challenge samples generated by these methods are saturated with perceptible perturbations, which results in poor visual impact; secondly, the challenge samples generated by the gradient-based method are less aggressive on the black box target model and are particularly obvious on some defense models.
Similar to the process of training the neural network model, the process of generating the challenge samples can also be considered as an optimization problem. In particular, generating countermeasure samples under a white-box model can be considered a process of training a neural network model. In contrast, using the challenge sample to attack the black box model can be viewed as a process of validating the neural network model. Therefore, an optimization method with good generalization can effectively improve the mobility of the antagonistic sample. Zhuang et al, in the article "AdaBelief Optimizer: adaptive steps by the Belief in underlying gradient [ C ]// Neural Information Processing systems.2020,33:18795 18806", propose an optimization method based on Belief's adaptivity, which integrates the advantages of Stochastic Gradient Descent (SGD) and Adam algorithm into a whole, and has both good generalization of SGD algorithm and fast convergence and stability of Adam algorithm. The belief idea is applied to the field of generation of countermeasure samples, so that the mobility of the countermeasure samples can be effectively improved.
Based on the above analysis, the existing method for generating the challenge sample has the problems of perceptible disturbance, low mobility and the like. Therefore, the invention provides a countermeasure sample generation method based on belief attack and significant area disturbance limitation to generate a low-disturbance and high-mobility countermeasure sample aiming at the problems of the existing method, and the countermeasure sample can detect the loophole of the DNN model and serve as an evaluation index of the safety of the DNN model, so that the robustness and the safety of the DNN model are improved.
Disclosure of Invention
The technical problem to be solved by the invention is to provide a countermeasure sample generation method based on belief attack and significant area disturbance limitation, effectively solve the problems of perceptible disturbance and low mobility of the existing countermeasure sample generation method, facilitate detection of a vulnerability of a DNN model, and serve as an evaluation index of the safety of the DNN model, so that the robustness and the safety of the DNN model are improved, and the generated countermeasure sample has low disturbance and high mobility.
In order to solve the technical problems, the technical scheme adopted by the invention is as follows:
a method for generating a countercheck sample based on belief attack and significant area disturbance limitation comprises the following steps:
step S1: providing an original image, and taking the original image as training data of a DNN model;
step S2: providing a white-box target model, using a data set containing an original image as a training data set, generating a binary mask of a salient region of the original image by using a class activation mapping technology, and generating global countermeasure disturbance by using a belief-based attack method and a fusion I-FGSM countermeasure sample generation method;
step S3: carrying out Hadamard product operation on the generated global countermeasure disturbance and the significant region binary mask to generate the significant region countermeasure disturbance;
step S4: the salient region is added to the input image against the disturbance,
step S5: and repeating the steps S2-S4 to generate image antagonistic samples in an iterative mode, and clipping overflowing pixel values until a preset termination condition is reached, wherein the antagonistic samples generated in the last iteration are used as output antagonistic samples.
The technical scheme of the invention is further improved as follows: in step 1, the raw image is from the ImageNet validity dataset and comprises 1000 different classes of pictures.
The technical scheme of the invention is further improved as follows: in the step 2, the white box model adopts one of the inclusion-v 3, the inclusion-v 4, the inclusion-Resnet-v 2 and the Resnet-v 2-101.
The technical scheme of the invention is further improved as follows: in the step 2, the class activation mapping technology is based on a Grad-CAM method, a class activation mapping map is obtained by calculating neuron importance weights of a white-box target model relative to an input image and performing weighted fusion on the neuron importance weights and the activation feature map, and then a corresponding significant region binary mask is generated;
the process of obtaining the binary mask of the salient region is specifically represented as:
wherein,for the k-th feature map with respect to the neuron significance weight of class c, ycThe gradient corresponding to the fraction of class c before the softmax layer,representing the pixel value of the k-th feature map at position (i, j), Z being the number of pixels of the input image, H (-) being the salient region selection function, Sf(r, x, y) an input image x labeled y selects a pixel region of scale r on classifier f as a significant binary mask; wherein the ratio r is in the range of [0.1,1]The most prominent region representing the ratio r is selected.
The technical scheme of the invention is further improved as follows: in the step 2, the idea of the belief-based attack method includes: calculating the exponential moving average of the observed gradient by using the observed gradient, and calculating the observed gradient by using the following formula:
wherein J is a loss function of the classifier, | | · |. non-woven phosphor1Is L1A norm;
EMA for calculating the observed gradient and the square of the observed gradient based on the observed gradient is calculated using the formula:
mt=β1mt-1+(1-β1)gt
st=β2st-1+(1-β2)(gt-mt)2
wherein m istObserve the gradient g for the t-th iterationtEMA, s oftTo observe EMA, beta of the gradient squared10.99 and beta20.999 is a smoothing parameter;
based on the EMA of the observed gradient and the observed gradient squared, the opposition perturbation is calculated using the following formula:
wherein δ is 1 e-8;
and performing deviation correction and regularization and scaling operation on the confrontation disturbance to obtain a global confrontation disturbance, and calculating by the following formula:
wherein alpha is initial step length, epsilon is disturbance quantity, N is input image pixel number, T is total iteration number, and lambda istIn order to correct the deviation, the method comprises the following steps,the global countermeasure disturbance of the t iteration is achieved, and eta is a disturbance control factor; the disturbance amount epsilon is 16, and the generated anti-disturbance range is [ -16,16 [ -16 [ ]]。
The technical scheme of the invention is further improved as follows: in step 3, the significant region opposition disturbance calculation formula is as follows:
wherein,the Hadamard product operation is performed, i.e., a matrix bitwise multiplication operation is performed.
The technical scheme of the invention is further improved as follows: in step 5, the calculation formula for adding the disturbance to the input image operation and performing overflow pixel value clipping is as follows:
wherein, Clip () limits the disturbance quantity within the disturbance epsilon range;
the preset termination conditions include: and the preset iteration time T is 10.
Due to the adoption of the technical scheme, the invention has the technical progress that:
the method effectively solves the problems of perceptible disturbance and low mobility of the existing countermeasure sample generation method, is convenient for detecting the loophole of the DNN model, and is used as an evaluation index of the safety of the DNN model, so that the robustness and the safety of the DNN model are improved, and the generated countermeasure sample has low disturbance and high mobility.
(1) According to the characteristic that different DNN models are similar in the range and the shape of the salient region, the invention provides a global disturbance resisting and limiting method based on disturbance limitation of the salient region, and on the basis of hardly influencing the migration resisting property, the disturbance resisting is greatly reduced, so that the disturbance resisting which is not easily perceived by human eyes is obtained, and the visual quality is greatly improved.
(2) The invention provides a belief-based confrontation sample generation method by utilizing good convergence and generalization of an Adabeeif optimizer in the training of a DNN model, and the method enables the confrontation sample training process to easily escape from a local maximum value, so that the mobility of the confrontation sample is greatly improved.
(3) The method can be naturally and efficiently combined with the existing method for generating the confrontation sample based on the gradient, so that the mobility of the confrontation sample is further improved.
Drawings
Fig. 1 is a schematic diagram of an embodiment of a method for generating a countermeasure sample based on belief attack and significant area perturbation limitation provided by the present invention.
Detailed Description
The present invention will be described in further detail with reference to the following examples:
as shown in fig. 1, the main content of the present invention is to provide a method for generating a countermeasure sample based on belief attack and significant area perturbation limitation, which can be used to detect a vulnerability of a DNN model as an evaluation index of the security of the DNN model, thereby improving the robustness and security of the DNN model.
In order to make the technical method of the present invention clear, the present invention is further described in detail below with reference to the accompanying drawings and examples.
Step S1: providing an original image, wherein the original image serves as training data for the DNN model.
In this example, the raw images are from the ImageNet validity dataset, from which 1000 different classes of pictures were selected, which were almost all correctly classified by the test model.
Step S2: providing a white-box target model, using a data set containing an original image as a training data set, generating a binary mask of a salient region of the original image by using a class activation mapping technology, and generating global countermeasure disturbance by using a belief-based attack method and a fusion I-FGSM countermeasure sample generation method.
In the embodiment, the inclusion-v 3 is adopted as the white-box target model, and other models such as inclusion-v 4, inclusion-Resnet-v 2, Resnet-v2-101 and the like can be used as the white-box model. As shown in fig. 1, the class activation mapping technique is based on the Grad-CAM method, and obtains a class activation map by calculating and weighting and fusing the neuron importance weights of the white-box target model with respect to the input image with the activation feature map, and then generates a corresponding significant region binary mask.
The process of obtaining the significant region binary mask may be specifically expressed as:
wherein,for the k-th feature map with respect to the neuron significance weight of class c, ycThe gradient corresponding to the fraction of class c before the softmax layer,representing the pixel value of the k-th feature map at position (i, j), Z being the number of pixels of the input image, H (-) being the salient region selection function, Sf(r, x, y) input image x labeled y selects a proportion r of regions of pixels on classifier f as significant binary mask, where the proportion r ranges from [0.1,1]The most prominent region representing the ratio r is selected. In the present embodiment, r is selected to be 0.8.
In this embodiment, the idea of the belief-based attack method includes: the observed gradient is used to calculate its Exponential Moving Average (EMA), which is calculated using the following formula:
wherein J is a loss function of the classifier, | | · |. non-woven phosphor1Is L1And (4) norm.
EMA for calculating the observed gradient and the square of the observed gradient based on the observed gradient is calculated using the formula:
mt=β1mt-1+(1-β1)gt
st=β2st-1+(1-β2)(gt-mt)2
wherein m istObserve the gradient g for the t-th iterationtEMA, s oftTo observe EMA, beta of the gradient squared10.99 and beta20.999 is a smoothing parameter.
Based on the EMA of the observed gradient and the observed gradient squared, the opposition perturbation is calculated using the following formula:
where δ is a small value used for numerical calculation stability, and δ is 1e-8 in the present embodiment.
And carrying out operations such as deviation correction, regularization, scaling and the like on the countermeasure disturbance to obtain global countermeasure disturbance, and calculating by the following formula:
wherein alpha is initial step length, epsilon is disturbance quantity, N is input image pixel number, T is total iteration number, and lambda istIn order to correct the deviation, the method comprises the following steps,and eta is a disturbance control factor for the global counterdisturbance of the t-th iteration. In the present embodiment, the disturbance amount ∈ 16 indicates that the generated countermeasure disturbance range is [ -16,16 [ ]]。
Step S3: and carrying out Hadamard product (Hadamard product) operation on the generated global anti-disturbance and the significant region binary mask to generate the significant region anti-disturbance.
In this embodiment, the significant region opposition disturbance calculation formula is as follows:
wherein,the Hadamard product operation is performed, i.e., a matrix bitwise multiplication operation is performed.
Step S4: the salient region is added to the input image against the disturbance,
step S5: and repeating the steps S2-S4 to generate image antagonistic samples in an iterative mode, and clipping overflowing pixel values until a preset termination condition is reached, wherein the antagonistic samples generated in the last iteration are used as output antagonistic samples.
In this embodiment, the calculation formula for adding a perturbation to the input image operation and performing overflow pixel value clipping is as follows:
wherein Clip () limits the perturbation amount to within perturbation epsilon.
In step S5, the preset termination condition includes: and the preset iteration time T is 10.
Claims (7)
1. The method for generating the confrontation sample based on belief attack and significant area disturbance limitation is characterized by comprising the following steps of:
step S1: providing an original image, and taking the original image as training data of a DNN model;
step S2: providing a white-box target model, using a data set containing an original image as a training data set, generating a binary mask of a salient region of the original image by using a class activation mapping technology, and generating global countermeasure disturbance by using a belief-based attack method and a fusion I-FGSM countermeasure sample generation method;
step S3: carrying out Hadamard product operation on the generated global countermeasure disturbance and the significant region binary mask to generate the significant region countermeasure disturbance;
step S4: the salient region is added to the input image against the disturbance,
step S5: and repeating the steps S2-S4 to generate image antagonistic samples in an iterative mode, and clipping overflowing pixel values until a preset termination condition is reached, wherein the antagonistic samples generated in the last iteration are used as output antagonistic samples.
2. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in step 1, the raw image is from the ImageNet validity dataset and comprises 1000 different classes of pictures.
3. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in the step 2, the white box model adopts one of the inclusion-v 3, the inclusion-v 4, the inclusion-Resnet-v 2 and the Resnet-v 2-101.
4. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in the step 2, the class activation mapping technology is based on a Grad-CAM method, a class activation mapping map is obtained by calculating neuron importance weights of a white-box target model relative to an input image and performing weighted fusion on the neuron importance weights and the activation feature map, and then a corresponding significant region binary mask is generated;
the process of obtaining the binary mask of the salient region is specifically represented as:
wherein,for the k-th feature map with respect to the neuron significance weight of class c, ycThe gradient corresponding to the fraction of class c before the softmax layer,representing the pixel value of the k-th feature map at position (i, j), Z being the number of pixels of the input image, H (-) being the salient region selection function, Sf(r, x, y) an input image x labeled y selects a pixel region of scale r on classifier f as a significant binary mask; wherein the ratio r is in the range of [0.1,1]The most prominent region representing the ratio r is selected.
5. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in the step 2, the idea of the belief-based attack method includes: calculating the exponential moving average of the observed gradient by using the observed gradient, and calculating the observed gradient by using the following formula:
wherein J is a loss function of the classifier, | | · |. non-woven phosphor1Is L1A norm;
EMA for calculating the observed gradient and the square of the observed gradient based on the observed gradient is calculated using the formula:
mt=β1mt-1+(1-β1)gt
st=β2st-1+(1-β2)(gt-mt)2
wherein m istObserve the gradient g for the t-th iterationtEMA, s oftTo observe EMA, beta of the gradient squared10.99 and beta20.999 is a smoothing parameter;
based on the EMA of the observed gradient and the observed gradient squared, the opposition perturbation is calculated using the following formula:
wherein δ is 1 e-8;
and performing deviation correction and regularization and scaling operation on the confrontation disturbance to obtain a global confrontation disturbance, and calculating by the following formula:
wherein alpha is initial step length, epsilon is disturbance quantity, N is input image pixel number, T is total iteration number, and lambda istIn order to correct the deviation, the method comprises the following steps,the global countermeasure disturbance of the t iteration is achieved, and eta is a disturbance control factor; the disturbance amount epsilon is 16, and the generated anti-disturbance range is [ -16,16 [ -16 [ ]]。
6. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in step 3, the significant region opposition disturbance calculation formula is as follows:
7. The method for generating the confrontational sample based on the belief attack and the significant area perturbation limitation as claimed in claim 1, wherein: in step 5, the calculation formula for adding the disturbance to the input image operation and performing overflow pixel value clipping is as follows:
wherein, Clip () limits the disturbance quantity within the disturbance epsilon range;
the preset termination conditions include: and the preset iteration time T is 10.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111655287.8A CN114399630A (en) | 2021-12-31 | 2021-12-31 | Countercheck sample generation method based on belief attack and significant area disturbance limitation |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111655287.8A CN114399630A (en) | 2021-12-31 | 2021-12-31 | Countercheck sample generation method based on belief attack and significant area disturbance limitation |
Publications (1)
Publication Number | Publication Date |
---|---|
CN114399630A true CN114399630A (en) | 2022-04-26 |
Family
ID=81228706
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202111655287.8A Pending CN114399630A (en) | 2021-12-31 | 2021-12-31 | Countercheck sample generation method based on belief attack and significant area disturbance limitation |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN114399630A (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114969728A (en) * | 2022-06-06 | 2022-08-30 | 北京邮电大学 | Thermodynamic diagram-based neural network attack method |
CN115100421A (en) * | 2022-06-22 | 2022-09-23 | 西北工业大学 | Confrontation sample generation method based on image frequency domain decomposition and reconstruction |
CN115147682A (en) * | 2022-07-04 | 2022-10-04 | 内蒙古科技大学 | Method and device for generating concealed white box confrontation sample with mobility |
CN115439377A (en) * | 2022-11-08 | 2022-12-06 | 电子科技大学 | Method for enhancing resistance to image sample migration attack |
-
2021
- 2021-12-31 CN CN202111655287.8A patent/CN114399630A/en active Pending
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114969728A (en) * | 2022-06-06 | 2022-08-30 | 北京邮电大学 | Thermodynamic diagram-based neural network attack method |
CN114969728B (en) * | 2022-06-06 | 2024-06-07 | 北京邮电大学 | Neural network attack method based on thermodynamic diagram |
CN115100421A (en) * | 2022-06-22 | 2022-09-23 | 西北工业大学 | Confrontation sample generation method based on image frequency domain decomposition and reconstruction |
CN115100421B (en) * | 2022-06-22 | 2024-03-12 | 西北工业大学 | Antagonistic sample generation method based on image frequency domain decomposition reconstruction |
CN115147682A (en) * | 2022-07-04 | 2022-10-04 | 内蒙古科技大学 | Method and device for generating concealed white box confrontation sample with mobility |
CN115147682B (en) * | 2022-07-04 | 2024-07-05 | 内蒙古科技大学 | Method and device for generating hidden white box countermeasure sample with mobility |
CN115439377A (en) * | 2022-11-08 | 2022-12-06 | 电子科技大学 | Method for enhancing resistance to image sample migration attack |
CN115439377B (en) * | 2022-11-08 | 2023-03-24 | 电子科技大学 | Method for enhancing resistance to image sample migration attack |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN114399630A (en) | Countercheck sample generation method based on belief attack and significant area disturbance limitation | |
CN109639710B (en) | Network attack defense method based on countermeasure training | |
CN111627044B (en) | Target tracking attack and defense method based on deep network | |
CN111709435B (en) | Discrete wavelet transform-based countermeasure sample generation method | |
CN111080675B (en) | Target tracking method based on space-time constraint correlation filtering | |
CN110853074B (en) | Video target detection network system for enhancing targets by utilizing optical flow | |
Chen et al. | Local patch network with global attention for infrared small target detection | |
CN111325324A (en) | Deep learning confrontation sample generation method based on second-order method | |
CN112200243B (en) | Black box countermeasure sample generation method based on low query image data | |
CN113822328A (en) | Image classification method for defending against sample attack, terminal device and storage medium | |
CN113704758A (en) | Black box attack counterattack sample generation method and system | |
CN113935396A (en) | Manifold theory-based method and related device for resisting sample attack | |
CN116051924B (en) | Divide-and-conquer defense method for image countermeasure sample | |
CN116433909A (en) | Similarity weighted multi-teacher network model-based semi-supervised image semantic segmentation method | |
CN111325221A (en) | Image feature extraction method based on image depth information | |
CN115510986A (en) | Countermeasure sample generation method based on AdvGAN | |
CN114638356A (en) | Static weight guided deep neural network back door detection method and system | |
CN113487506A (en) | Countermeasure sample defense method, device and system based on attention denoising | |
CN111797732A (en) | Video motion identification anti-attack method insensitive to sampling | |
CN111191717A (en) | Black box confrontation sample generation algorithm based on hidden space clustering | |
Yin | A comparative study on the method of extracting edge and contour information of multifunctional digital ship image | |
Zhang et al. | An efficient general black-box adversarial attack approach based on multi-objective optimization for high dimensional images | |
CN117315397B (en) | Classification method for noise data containing labels based on class curvature | |
CN111080727B (en) | Color image reconstruction method and device and image classification method and device | |
CN114627373B (en) | Method for generating countermeasure sample for remote sensing image target detection model |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination |