| Adversarial examples for images are a technique that deceives deep neural networks by adding carefully crafted perturbations to original images.Adversarial attacks can evaluate the robustness of deep learning models,exposing blind spots and deficiencies in deep neural network models,and guiding the development of corresponding adversarial defense techniques.Although adversarial examples have achieved significant results in attacking deep learning models,current methods for generating adversarial examples for images still have shortcomings.For white-box attacks,most adversarial example generation methods perturb the entire image,which has a relatively high attack success rate.However,attacking the entire image requires high attack costs,and the generated adversarial examples have large differences from the original images.In addition,for black-box attacks,current transfer-based black-box attack methods have a low success rate,especially for models that have undergone adversarial training.To address these issues,the paper conducts research on adversarial example generation methods for image classification,with specific content including:1.A method based on the maximum activation region of an image for generating adversarial examples is proposed.Unlike most existing mainstream adversarial example generation methods that add perturbations globally to the image,which results in poor quality of generated adversarial examples and low stealthiness,this chapter utilizes deep neural network interpretability technique heatmaps to visualize the model’s decision attention and locate the region with the maximum activation in the image.Based on this,we propose the MALA-MI-FGSM method for generating adversarial examples,building upon the Momentum Iterative Fast Gradient Sign Method(MI-FGSM).Using the ScoreCAM method-generated heatmap and combining it with MI-FGSM,we perturb the top k pixels in the heatmap that have the most significant impact on the model’s decision to improve the success rate and quality of the generated adversarial examples.This method only adds perturbations to the region that has the most significant impact on the model’s decision,while keeping the remaining pixels in the image unchanged.This approach greatly reduces the proportion of changes made to the original image while ensuring the success rate of the generated adversarial examples.Experimental results using various evaluation metrics demonstrate that the generated adversarial examples using this method have better concealment,are more visually appealing to human eyes,and have higher image quality.2.A method based on adding masks for MI-FGSM optimization is proposed.To further improve the transferability of image adversarial samples,an MI-FGSM optimization method RM-MI-FGSM based on adding random masks is proposed.This method introduces the improved data augmentation method Grid Mask into the iterative process of generating adversarial examples using MI-FGSM,and randomly adds masked blocks to the image to enrich the diversity of input samples,alleviate sample overfitting to substitute models,and take into account the differences in attention between different models.The experiments show that compared with the mainstream adversarial examples generation methods,our proposed method not only maintains a high success rate in whitebox attacks,but also effectively improves the transferability of generated adversarial examples.Moreover,it also has good attack effects for the adversarially trained models. |
