General countermeasure disturbance generation method

Abstract

The invention discloses a general countermeasure disturbance generation method, which comprises the following steps of: (1) acquiring a network structure and a weight matrix of a target artificial neural network; (2) initializing an adversarial disturbance vector; (3) randomly sampling pictures from a training set, superposing the pictures with the current general adversarial disturbance, and inputting the superposed pictures into a neural network; (4) performing back propagation of gradients at a current picture label and a label with the maximum prediction probability other than the currentpicture label; (5) calculating an updating amount of the countermeasure disturbance by utilizing a predicted vector and the two groups of gradients; and (6) repeating the steps (3)-(5) until the current general countermeasure disturbance can reach a predetermined error rate on a test set. According to the general countermeasure disturbance generation method, the position of the decision-making boundary of the target artificial neural network can be accurately found out based on the network structure and the weight matrix of the target artificial neural network, and blind spots of a classifierin feature extraction are reflected to a certain extent.

Description

Technical field [0001] The invention belongs to an adversarial sample generation algorithm in the field of deep learning security, in particular a general anti-disturbance generation method. Background technique [0002] Deep learning is leading a new wave of artificial intelligence and has received widespread attention in many fields. Especially in the field of graphics and images, applications such as face recognition and autonomous driving are gradually entering our lives. At the same time, the security problems of deep learning have gradually emerged, facing threats from multiple aspects: including software implementation vulnerabilities in the deep learning framework, counterattacks, and pollution of training data. The adversarial attack refers to the attack that deceives the target system by constructing specific input samples without changing the target machine learning system. The samples specially constructed by the attacker to implement the adversarial attack are usual...

AI Technical Summary

Problems solved by technology

The study found that since the adversarial samples are not generated based on semantics, the adversarial samples are very sensitive to the image preprocessing process, and any area screenshot, zoom in and out, and rotation can easily invalidate the adversarial samples

At the same time, the current methods of generating adversarial samples have non-convergence problems to varying degrees, and the generalization ability, diversity and confrontation strength of the generated adversarial samples still need to be improved.

Images