基于稳定Adam和空间域变换的对抗样本生成算法

Adversarial Example Generation Algorithm Based on Stable Adam and Space Domain Transformation

深度神经网络广泛应用于图像分类、目标检测、自然语言处理等领域,但其容易受到对抗样本攻击。现有的多数攻击都是基于快速梯度符号法,通过在输入中添加相同幅度的扰动达到攻击效果,这些方法虽然有效但并不利于快速找到具有泛化能力的对抗样本。针对对抗样本的泛化性,提出一种结合稳定自适应矩估计和空间域变换的梯度优化算法来改进现有的对抗样本生成算法。将Nesterov算法引入一阶矩估计的更新中,基于AdaBelief算法,将Belief参数应用于二阶矩估计,同时根据指数衰减率计算衰减步长以获取更稳定的梯度。从数据增强的角度考虑,在对抗样本生成的过程中将输入样本在空间域进行变换,通过加权不同变换的梯度来更新原有梯度,从而提高对抗样本的可迁移性。实验结果表明,改进算法对抗样本性能显著提升,其白盒攻击成功率能够保持在99.6%以上,同时黑盒攻击成功率可提高到74.5%。

Deep neural networks have been widely used in natural language processing,target detection,and image classification.However,relevant studies have shown that deep neural networks are vulnerable to counter-sample attacks.Several existing attacks are based on the fast gradient sign method,which adds a disturbance of the same size to the input to achieve an attack effect.Although these methods are effective,they are not conducive to quickly finding adversarial examples with generalization ability.Therefore,to generalize the countermeasure samples,a gradient optimization method for stable adaptive moment estimation and spatial domain transformation is proposed to improve the existing algorithm for countermeasure sample generation.First,the Nesterov algorithm is introduced to update the first-order moment estimation.Inspired by the AdaBelief algorithm,the Belief parameter is introduced to the second-order moment estimation,and the decay step is calculated according to the exponential decay rate to obtain a more stable gradient.In addition,from the perspective of data enhancement,transforming the input samples in the spatial domain during the generation of confrontation samples is proposed.Unlike existing methods,this method updates the original gradient by weighting the gradients of different transformations to improve the mobility of confrontation samples.The experimental results show that the combination of the improved adaptive moment estimation and spatial-domain transformation gradient weighting algorithms can effectively improve the attack accuracy and mobility of adversarial samples.The white box attack success rate of the samples remains above 99.6%,while the black box attack success rate increases to 74.5%.