Deep neural network attack method and device, medium and computing equipment

Abstract

The embodiment of the invention provides a deep neural network attack method. The method comprises the steps that an attack model is established, and the attack model at least comprises transformationinformation of an original sample and the weight of a loss function, transformed by a picture of the original sample according to the transformation information, of an identification model; an adversarial sample is generated based on an original sample using the attack model. According to the method, the confrontation sample is generated for the real picture and the group of pictures after translation, and the transfer performance of the generated confrontation sample is greatly improved, so that the sensitivity of the confrontation sample to the attacked model is remarkably reduced, and thegeneration cost of the confrontation sample is reduced. In addition, the embodiment of the invention provides a deep neural network attack device, a medium and computing equipment.

Description

technical field [0001] Embodiments of the present invention relate to the field of deep learning, and more specifically, embodiments of the present invention relate to a deep neural network attack method, device, medium, and computing device. Background technique [0002] This section is intended to provide a background or context for implementations of the invention that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] As a type of machine learning method, deep neural network has gained widespread attention in recent years due to its remarkable effects in many fields such as speech recognition, image classification, and object detection. However, deep neural network models that can achieve high accuracy on many tasks are vulnerable to attacks in adversarial environments. In an adversarial environment, the deep neural network will be input with some maliciously constructed adversarial samples based o...

AI Technical Summary

Problems solved by technology

[0005] However, in the actual application process, it is very difficult to attack a black-box model, especially for a model with certain defense measures, it is more difficult for a black-box attack to succeed

For example, integrated adversarial training can improve the robustness of the trained deep neural network by adding adversarial samples into the training process, and the existing black-box attack methods are difficult to succeed

The root cause of this phenomenon is that the objective function used in the white-box attack of the existing attack method only considers the current picture, which makes the generated adversarial samples very sensitive to the attacked model, and the transfer performance is poor.

Images