Deep learning adversarial sample generation method based on second-order method

Abstract

The invention belongs to a data information processing technology, and discloses a deep learning adversarial sample generation method and system based on a second-order method, and the method comprises the steps: carrying out the secondary Taylor expansion of a neural network function in a tiny neighborhood of an input sample X, i.e., Lp (p belongs to [2, 0, infinity]) norm constraint, and replacing a nonlinear part of a neural network; and constructing a dual function through a Lagrange multiplier method to calculate an extreme value to solve the optimal disturbance delta, so that the confidence coefficient of the confrontation sample X '= X + delta which is judged as a correct class is reduced to the minimum, or the confidence coefficient of the confrontation sample X' which is judged asa target class is increased to the maximum. According to the method, the operation of reducing the confidence coefficient of the correct output class is adopted for the target-free attack; and for the target attack, the operation of improving the confidence of the target class is adopted. The method provided by the invention can avoid falling into a local extreme value, generates a high-quality adversarial sample at extremely low cost, is applied to adversarial training of the deep neural network, and can effectively improve the defense effect.

Description

technical field [0001] The invention belongs to the technical field of data information processing, and in particular relates to a second-order method-based deep learning adversarial sample generation method and system. Background technique [0002] Currently, the closest existing technology: Deep Neural Networks (DNNs) have achieved successful applications in many fields such as bioinformatics, speech recognition, and computer vision. However, studies have found that DNNs are vulnerable to adversarial examples. Existing technology 1 finds DNN's adversarial examples in the field of image classification, that is, adding small perturbations in natural images, and the obtained noisy images can make DNNs make wrong predictions. Since the adversarial examples are usually difficult to detect obviously for human vision, and there will be no misjudgment. Therefore, adversarial samples have better concealment, and attacks on DNNs using adversarial samples are very harmful. For exa...

AI Technical Summary

Problems solved by technology

[0006] To sum up, the problems existing in the existing technology are: the speed of the existing adversarial sample generation method is not good, the calculation complexity is high, and it is easy to fall into the local optimum prematurely, and the utilization of gradient information is very low

At the same time, the quality of generated adversarial samples is not high, and the transferability is low

In particular, once the gradient is smoothed, most existing methods introduce extreme variations resulting in extreme derivative values, which degrades the quality of information about how neurons are activated by different inputs, making it impossible to generate adversarial examples

[0007] Difficulty in solving the above technical problems: After converting the generation of adversarial samples into an optimization problem, the highly non-convex and nonlinear nature of DNNs makes it very difficult to solve this optimization problem; Transferability; an effective adversarial example must take into account the attack success rate while maintaining concealment, which means that the added perturbation must be very small and effective

Images