Attack judgment method for fooling explainable algorithm of deep neural network

Abstract

The invention discloses an attack judgment method for fooling an explainable algorithm of a deep neural network. The method comprises the steps of: adding noise to an input image in a certain area, and then generating a disturbance image; and constructing a loss function item by utilizing the disturbance image; on the premise that the generated disturbance image classification result is kept the same as the original image classification result, explaining the classification result by using an explainable algorithm, and positioning the explained salient region in the disturbance area; and gradually limiting the noise by using an Adam optimization algorithm until disturbance cannot be visually perceived, so that the disturbance is not obvious, and finally generating a disturbance image in which interpretation is wrong. According to the invention, attacks and explainable tasks are combined, five deep neural network explainable methods can be effectively attacked, the size and the positionof an attack area can be changed at will, and the robust performance of interpretation under the attacks can be measured.

Description

technical field [0001] The invention relates to an interpretable attack judgment method for image processing, in particular to an attack judgment method for fooling a deep neural network explainable algorithm. Background technique [0002] For artificial intelligence systems, the real environment is complex and changeable, and system decision-making mistakes will lead to heavy losses. Therefore, the interpretability of artificial intelligence system models becomes very important, so that people can understand how the system works and how decisions are formed. , find the cause of its error and improve it. Therefore, it is necessary to study the interpretability of deep learning. However, as artificial intelligence explainability algorithms are continuously proposed, attacks on explainable algorithms have emerged. For example, adding perturbation to the input image will greatly change the interpretation effect while keeping the prediction result unchanged. Therefore, it is d...

AI Technical Summary

Problems solved by technology

[0004] The technical problems to be solved in the present invention include: an effective attack algorithm; the size of the disturbance added to the noise must be constrained; both single-target object and multi-target object image classification interpretation can be fooled; multi-target object image classification interpretation is fooled to be distributed Suitable

Images