Research On The Transferability Of Adversarial Examples For Image Intelligent Object Recognition

With the development of artificial intelligence technology,image intelligent object recognition technology based on deep neural network is increasingly widely used in the military field.However,it is pointed out that deep neural networks are vulnerable to adversarial sample attacks,which reveals the problem of poor robustness of neural networks.The application of this phenomenon in the military field also needs attention and vigilance.In the field of adversarial attacks,the most challenging and valuable research is the black-box attack that conforms to the actual situation.In the black-box environment,it is very convenient to carry out black-box attacks with the help of the transferability of adversarial examples.An alternative model can be trained to generate adversarial examples with strong transferability and successfully deceive multiple different neural network classifiers.At present,although the major white-box attack method based on model gradient information can effectively attack the white-box model,the transferability of the generated adversarial examples is poor,and it is difficult to realize cross-model black-box attack.This paper aims to study how to improve the transferability of the generated adversarial examples to solve the problem of the success rate of black box attacks.The main contents are as follows:1.From the perspective of data enhancement,a transferable attack method based on random diversity input(R-DI~2-FGSM)is proposed.In this paper,random scaling and filling operations are introduced into the IFGSM.At each iteration,the input adversarial example is randomly transformed with probability p,which is equivalent to expand the number of image classification models,so as to more effectively alleviate the"over-fitting"phenomenon when generating adversarial examples,improving the transferability of adversarial examples.2.From the perspective of model enhancement,this paper proposes a attack transferable method based on model enhancement(ME-IFGSM).The idea of this method is derived from the black-box attack method of the integrated model.The translation invariance of CNN is utilized to optimize the target model of generating adversarial examples established in this paper,and the gradient of the original input is convolved with the predefined convolution kernel,which plays the same role as model enhancement.This method effectively solves the problem of the huge computational load of the integrated model,avoids the overfitting attack of the white-box model,and improves the success rate of the black-box attack.3.From the perspective of optimization gradient,this paper proposes a transferable attack method based on NAG optimization gradient(NAG-I-FGSM).This method refers to the idea of Nesterov momentum optimization gradient,combines Nesterov momentum with I-FGSM algorithm.Comparing with MI-FGSM,the gradient optimization direction is further stabilized.and the foreseeability of Nesterov momentum makes it easier to escape from the local extreme area in the process of generating adversarial examples,thereby improving the transferability.