Gradient-based adversarial sample generation method and system

Abstract

The invention discloses a gradient-based adversarial sample generation method and system. The method comprises the following steps: acquiring an original image sample and a neural network model to be attacked; inputting the original image sample into a neural network model, and obtaining loss information of the original image sample according to a cross entropy loss function; a corresponding gradient symbol matrix is obtained according to the loss information, disturbance information is generated, disturbance is added to the original image sample through the disturbance information, and a first noise image sample is obtained; performing filtering operation and cutting operation on the first noise image sample to obtain a second noise image sample; and judging whether the second noise image sample meets the requirements of the adversarial sample, if not, inputting the second noise image sample into the neural network model for next iteration, and otherwise, taking the second noise image sample as the adversarial sample and stopping iteration. According to the method, the adversarial sample with higher attack success rate and smaller noise visibility can be generated, so that the ability of the neural network model to resist adversarial attacks is enhanced.

Description

technical field [0001] The present invention relates to the technical fields of computer vision and deep learning, in particular to a method and system for generating adversarial samples based on gradients. Background technique [0002] In recent years, machine learning and deep learning have been applied in various aspects of daily life, including face recognition, image classification, autonomous driving, and semantic segmentation. However, the uninterpretability of deep learning limits its application. Adversarial attack is one of the clinical manifestations. It generates adversarial samples by adding tiny noises to clean samples to fool the neural network model and mislead the attacked model to output an answer that is different or diametrically opposite to the correct result. In this case, it is very necessary to better understand the neural network model and improve its robustness, which is inseparable from the generation of adversarial examples. [0003] However, th...

AI Technical Summary

Problems solved by technology

[0003] However, adversarial examples generated by existing methods or systems are poorly transferable and have high noise visibility under black-box conditions

Images