Migratable adversarial sample attack method based on attention mechanism

Abstract

The invention discloses a migratable adversarial sample attack method based on an attention mechanism, and the method comprises the steps of selecting a local replacement network model, constructing afeature library, and enabling an original image to be mapped into a feature space; adopting an iterative fast gradient symbol attack method based on momentum accumulation to enable the characteristics of the original picture to be far away from the original category area and to be close to the target category area; and inputting an adversarial sample obtained by attacks into a black box classification model, and outputting a target category by a misleading model. According to the invention, a triple loss function is used to destroy an area which is rich in information and is mainly concernedby the model in an attacked model characteristic space; the problems of low white-box target attack success rate and low black-box target mobility of an existing attack method in a classification taskof a complex data set are solved, and misleading of a classification model is effectively realized under the condition of considering a white-box scene and a black-box scene.

Description

technical field [0001] The invention belongs to the technical field of adversarial attacks, and in particular relates to a transferable adversarial sample attack method based on an attention mechanism. Background technique [0002] With the rapid development of deep learning, researchers can solve many computer vision tasks such as image classification and segmentation. However, due to the advent of adversarial examples, more widespread attention has been paid to the shortcomings of convolutional neural networks. Adversarial examples refer to adding some subtle perturbations that cannot be perceived by the human eye to the original input image, so that the convolutional neural network cannot correctly predict the image. The current method of generating adversarial samples can be divided into non-target attack and targeted attack according to the target or expectation of the attack. The former refers to the attacker’s goal only to make the classification model give wrong pre...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above-mentioned deficiencies in the prior art, the present invention provides a transferable adversarial sample attack method based on the attention mechanism, which destroys the information-rich, The main focus of the model is to solve the problems of low white-box target attack success rate and black-box target migration rate in existing attack methods in the classification task of complex data sets. It is effective in the case of both white-box and black-box scenarios. misleading classification model

Images