Iterative fast gradient descent anti-attack method based on Adam

Abstract

The invention discloses an Adam-based iterative fast gradient descent adversarial attack method, which comprises the following steps: setting a deep neural network-based image classification model used for adversarial attack and other adversarial attack parameters, then initializing iteration parameters, inputting a current image into the image classification model to obtain a classification result during each iteration, and finally obtaining an adversarial attack result. And calculating the loss function gradient of the current image classification, updating the gradient mean value and the gradient variance according to the loss function gradient, updating each image after correcting the gradient mean value and the gradient variance, repeating the steps until the maximum number of iterations is reached, and taking the image obtained by the last iteration as an adversarial sample. According to the invention, the Adam algorithm is introduced to improve the I-FGSM algorithm, so that the training time can be shortened, and the mobility and attack success rate of the generated confrontation sample can be improved.

Description

technical field [0001] The invention belongs to the technical field of confrontation attacks, and more specifically relates to an Adam-based iterative rapid gradient descent confrontation attack method. Background technique [0002] In recent years, the contribution of deep neural network in various fields is quite significant. Convolutional Neural Network (CNN) has been successfully applied in the fields of self-driving cars, surveillance, malicious code detection, drones, etc., and plays a role in it. Therefore, the importance of deep neural network model security is more prominent. [0003] Adversarial attack is one of the main types of attacks that threaten deep learning models. Its purpose is to add small noise perturbations to the input samples, so that the prediction results of the model will be wrong (also known as untargeted attacks), and it can even be based on specific noise. The perturbed output predicts what the attacker expects (called a targeted attack). On ...

AI Technical Summary

Problems solved by technology

[0006] As far as the FGSM algorithm is concerned, it uses a linear assumption when calculating adversarial samples, but in practice, when the distortion is large (such as blurred pictures), the linear assumption may not be true, which makes the adversarial samples generated by FGSM unable to succeed. Attack the target deep neural network model, thus limiting the efficiency of its attack

Although the I-FGSM algorithm has been improved, it will greedily move towards the direction of generating adversarial samples in the sign direction of the gradient in each iteration

Therefore, adversarial samples tend to fall into bad local maximums and "overfit" the model. Although the adversarial samples generated in this way are stronger in attack strength, the attack effect reflected on the black box model will be worse

Images