| Deep neural networks have shown superior performance in image recognition,automatic translation,man-machine dialogue and other tasks,and their related products have been widely used in scenes of people’s lives.However,the discovery of adversarial examples has brought security problems to deep neural networks.Adversarial attacks can deceive the model by adding small perturbations generated by algorithms to images,and images carrying such perturbations are called adversarial examples.What’s more serious is that the transferability of adversarial examples enables black-box attacks,that is,the adversarial examples generated on the source model can be used to attack other models with different structures.The attack is carried out under the information of the model,which seriously threatens the deployment of the model in the real scene.The main work of this paper is to study the adversarial attack algorithm for image recognition,aiming to improve the transferability of adversarial examples.The research status and related theories of adversarial examples are systematically investigated,and the research will be carried out around how to improve the transferability of adversarial examples.Specifically,the main work and contributions of this paper are as follows:(1)Propose a multiple feature importance-aware adversarial attack algorithm:aiming at the shortcomings of the existing attack maximization model output layer loss,this attack selects the middle layer distance between the original image and the adversarial example to generate the adversarial example,in order to more effectively perturb image features and leverage multiple feature importance awareness to provide guidance directions.Inspired by data augmentation,random transformations are introduced in generative feature importance awareness to avoid its source model-specific features.Through experimental verification,this attack can significantly improve the transferability of adversarial examples when using multiple feature importance awareness.(2)Propose an adversarial attack algorithm based on perturbation aggregation:At present,some studies have proposed to establish a defense model that resists adversarial examples through adversarial training.To this end,this paper analyzes adversarial examples from the perspective of perturbation aggregation,so as to study how to improve the transferability of adversarial examples to defensive models.This attack can be combined with the FGSM attack to form PAA-FGSM,and can also be combined with the I-FGSM attack to form PAAI-FGSM,which will generate the final confrontation by aggregating the perturbation generated by the basic attack and the tailored perturbation,and then combining the perturbation of the two perturbation.Through experimental verification,this attack can significantly improve the transferability of adversarial examples to defense models.(3)Design and implement an adversarial attack system for image recognition:adversarial examples seriously threaten the deployment of models in real scenarios,but adversaria examples are not only used to attack the model,but also to evaluate the robustness of the model.Existing defense methods also use adversarial examples are used for adversarial training to build a defense model.In order to generate adversarial examples conveniently and quickly,we design and implement an adversarial attack system for image recognition,which will use the attack algorithm proposed in this paper.Users can quickly generate transferable adversarial examples through this system. |
