Register attack method and system for generating uniformly distributed disturbance by taking pulse as probability

Abstract

The invention relates to an adversarial attack method for generating uniform distribution disturbance by taking pulse as probability, which comprises the following steps of: preprocessing a data set, converting the data set into a corresponding pulse sequence through Poisson coding, then constructing an alternative network corresponding to the data set, and taking the network as an original classifier; inputting a pulse sequence generated by coding of the original classifier and an original sample into a filter to screen out an optimal pulse; the selected pulse and the original image are input into an adversarial sample generation network, the adversarial sample generation network is based on an original classifier, noise obeying uniform distribution is generated with the pulse as the probability, and therefore an initial adversarial sample is generated; and continuously iteratively optimizing the adversarial samples to finally obtain adversarial samples. According to the invention, a low-cost adversarial attack tool for generating the spiking neural network can be provided for security defense researchers.

Description

technical field [0001] The invention relates to the fields of computer image recognition and malicious attacks, in particular to an adversarial attack method and system for generating uniformly distributed disturbances with pulses as probability. Background technique [0002] Spiking neural network (SNN), as the third generation of neural network, not only has broad prospects in simulating brain-like, but also has the advantages of low power consumption and high performance in neuromorphic computing systems. In the field of image recognition, SNN has demonstrated image recognition performance no less than that of deep neural network (DNN), and because it simulates the processing method of the human brain, its energy consumption is far lower than that of DNN. However, some studies have shown that although SNN is more robust than DNN, carefully constructed adversarial samples by adding invisible perturbations to the original image can make people invisible to the original imag...

AI Technical Summary

Problems solved by technology

Researching the current related work found that the existing adversarial attack methods include using traditional PGD attacks, FGSM attacks, etc., as well as new attack strategies that increase, decrease, and reverse the pulse sequence, but these methods do not take into account the adversarial The extreme limitations of the generated samples of the attack, in other words, the generated adversarial samples can be easily recognized by the human eye due to the large number of modified pixels

However, the existing attack methods for attacking the pulse sequence have not fully utilized its characteristics.

Images