Alternative model automatic selection method, storage medium and terminal for black-box attack

Abstract

The invention discloses a method, a storage medium and a terminal for automatically selecting an alternative model for black-box attack, belonging to the technical field of deep learning. The method includes: selecting an alternative model in a neural network model according to original sample attribute information, and / or, according to Attack Feedback Updates currently use alternative models. The present invention selects an alternative model with a high degree of matching with the current black-box model according to the original sample attribute information that is related to the complexity of the black-box model, and / or updates the currently used alternative model through attack feedback information, so as to ensure that after the selection or update The surrogate model can exert excellent surrogate performance, and the generated adversarial samples have a high attack success rate in black-box attacks, which is conducive to promoting the current research on neural network model security.

Description

technical field [0001] The present invention relates to the technical field of deep learning, and in particular, to a method, a storage medium and a terminal for automatic selection of an alternative model for black-box attacks. Background technique [0002] In recent years, deep learning models have been widely used in various fields. Although the accuracy of the model is getting higher and higher, it is also more vulnerable to malicious attacks. Among them, adversarial attacks are the most common attack methods. By adding human eyes to the original samples Imperceptible small perturbations can cause the target model to output incorrect predictions or even predictions expected by the attacker. Since the existing technology proposed that adding tiny perturbations to the input data can affect the model classification results, many scholars have joined the research on model adversarial attacks, and many attack algorithms have also been born. [0003] Through the research on a...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to overcome the low attack success rate of the attack samples generated by the alternative model selected in the prior art, which is not conducive to the development of the current neural network model security research work, and provides an automatic selection of alternative models for black-box attacks Method, storage medium and terminal

Images