Rotation-robust image adversarial example generation in the physical world

Abstract

The invention relates to an image confrontation sample generation method with rotational robustness in the physical world, and relates to the technical field of artificial intelligence security. The main steps include: 1. Initialize the algorithm parameters and image preprocessing to obtain the current adversarial sample; 2. Use the current adversarial sample to rotate to obtain the rotated adversarial sample; 3. Determine whether the iteration termination condition is met, if yes, output the final adversarial sample and perform step 7 , otherwise go to step 4; 4. Calculate the rotation-invariant joint gradient matrix; 5. Perform mean filtering on the rotation-invariant joint gradient matrix; 6. Update the current adversarial sample, and return to step 23; 7. Use the final result in the real physical world Test against adversarial samples and observe the effect of adversarial attacks under different rotation angles. The confrontation sample generated by the invention has rotation robustness in the physical world, solves the situation that the attack of the confrontation sample fails after rotation, and further improves the attack success rate.

Description

technical field [0001] The present invention relates to the technical field of artificial intelligence security, in particular to an image adversarial sample generation method with rotational robustness in the physical world. Background technique [0002] In the field of image recognition, the experimental results on some standard test sets show that the recognition ability of deep models has reached or even exceeded the level of human intelligence. While deep learning brings great convenience to people, it also has some security problems. For an abnormal input, whether the deep model can still obtain satisfactory results. The hidden security issues have gradually attracted attention, and many scholars have begun to pay attention to the anti-interference ability of the deep model. Among them, the adversarial sample refers to the sample that is misclassified and misidentified by the deep learning algorithm after the malicious attacker adds a small perturbation to the origina...

AI Technical Summary

Problems solved by technology

However, the disadvantage of this method is that this method can only process images in the digital world to generate image adversarial samples, and lacks the ability to generate image adversarial samples in the physical world

However, the disadvantage of this method is that the attack success rate of this method is relatively low after the image is added with the anti-perturbation after rotation.

Images