General adversarial disturbance generation method based on correlation class activation mapping

Abstract

The invention discloses a general adversarial disturbance generation method based on correlation class activation mapping, and belongs to the field of adversarial machine learning. At present, the key technical problem in the field is deep neural network decision interpretability and adversarial sample mobility enhancement. According to the method, the general adversarial disturbance is generated and optimized by utilizing an inter-layer correlation propagation and class activation mapping cascading mode, and then the focus of the deep neural network is understood. Firstly, a deep neural network classifier is utilized to calculate an original label class and other error label classes of a clean sample, then through forward propagation class activation mapping feature map and correlation coefficient linear weight combination, the contribution of a final thermodynamic diagram of the original label is minimum, the contribution of thermodynamic diagrams of other error classes is maximum, and finally, the error label class is obtained. And the general adversarial disturbance is iteratively updated by minimizing the correlation class activation mapping loss function, so that the general adversarial disturbance with strong mobility is formed, and the attack success rate of the adversarial sample is improved.

Description

Technical field [0001] The invention relates to a general adversarial perturbation generation method based on correlation class activation mapping, and belongs to the field of adversarial machine learning. Background technique [0002] Machine learning technology has made major breakthroughs in solving complex tasks. However, machine learning technology (especially artificial neural networks and data-driven artificial intelligence) are extremely vulnerable to adversarial sample attacks during training or testing, and these samples can easily subvert the machine learning model. the original output. Since the AlexNet model made a breakthrough in the Large Scale Visual Recognition Challenge (ILSVRC), various image classification neural networks have been proposed to improve image classification technology. Deep neural networks have shown amazing high performance in solving complex computer vision problems, including images. Recognition, target detection, semantic segmentation ...

AI Technical Summary

Problems solved by technology

Iterative attacks have a higher success rate than single-step attacks in white-box environments, but their transferability is not ideal in most cases because it is sensitive to network parameters

Furthermore, it is difficult for the attacker to obtain exact knowledge of the victim model, making it difficult to use white-box attacks in practice

[0004] The general adversarial attack generates a general adversarial sample perturbation on the data set. Any input in the data set plus this perturbation can cause the output of the neural network model to be wrong.

Images