Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略-人工智能-PHP中文网

Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略

P粉084495128

发布： 2025-07-31 10:53:59

原创

400人浏览过

本文介绍图像对抗样本的三种常见攻击策略：FGSM、BIM和PGD，附Paddle实现代码（见Paddle-Adversarial-Toolbox仓库）。FGSM通过梯度符号快速生成扰动；BIM为其迭代改进版，提升成功率；PGD在BIM基础上增加迭代轮数和随机化处理，增强攻击效果。

☞☞☞AI 智能聊天, 问答助手, AI 智能搜索, 免费无限量使用 DeepSeek R1 模型☜☜☜

paddle2.0-ai图像安全-图像对抗样本初探-常见攻击策略 - php中文网

Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略

本次我们主要介绍三种常见的攻击策略，分别是FGSM、BIM和PGD。代码已经上传到我们AgentMaker的仓库，欢迎过来给个Star：Paddle-Adversarial-Toolbox。

图像转图像AI

利用AI轻松变形、风格化和重绘任何图像

查看详情

FGSM

利用对抗样本的线性解释提出了一个快速产生对抗样本的方式，也即Fast Gradient Sign Method(FGSM)方法。假定模型参数值为θ，输入为x，标签为y，则模型的损失函数为J(θ,x,y)。FGSM方法将保证无穷范数限制下，添加的扰动值为η=εsign(∇xJ(θ,x,y))。
Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略 - php中文网

In [ ]

import paddleclass FGSMAttack(object):
    def __init__(self, model, criterion, img, label, eps):
        self.model = model
        self.criterion = criterion
        self.img = img
        self.label = label
        self.epsilon = eps    def attack(self):
        tensor_img = paddle.to_tensor(self.img)
        tensor_label = paddle.to_tensor(self.label)
        tensor_img.stop_gradient = False
        predict = self.model(tensor_img)
        loss = self.criterion(predict, tensor_label)        for param in self.model.parameters():
            param.clear_grad()
        loss.backward(retain_graph=True)
        grad = paddle.to_tensor(tensor_img.grad)
        grad = paddle.sign(grad)
        tensor_img = tensor_img + self.epsilon * grad
        tensor_img = paddle.to_tensor(tensor_img.detach().numpy())        return tensor_img

登录后复制

BIM

Goodfellow基于之前的FGSM攻击方法做出了一部分改进，作者鉴于之前的FGSM的成功率并不高，提出了以迭代的方式来进行攻击，也就是Basic Iterative Methods(BIM)，是FGSM方法的进阶，因此也被称为Iterative FGSM(I-FGSM)，更新公式如下：

Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略 - php中文网

损失函数定义为：

算法流程：

In [ ]

import mathimport paddleclass BIMAttack(object):
    def __init__(self, model, criterion, img, label, eps, alpha):
        self.model = model
        self.criterion = criterion
        self.img = img
        self.label = label
        self.epsilon = eps
        self.alpha = alpha
        self.num_iters = math.ceil(min(self.epsilon + 4, 1.25 * self.epsilon))    def attack(self):
        origin_tensor_img = paddle.to_tensor(self.img)
        tensor_img = paddle.to_tensor(self.img)
        tensor_label = paddle.to_tensor(self.label)        for step in range(self.num_iters):
            tensor_img.stop_gradient = False
            predict = self.model(tensor_img)
            loss = self.criterion(predict, tensor_label)            for param in self.model.parameters():
                param.clear_grad()
            loss.backward(retain_graph=True)
            grad = paddle.to_tensor(tensor_img.grad)
            delta = self.alpha * paddle.sign(grad)
            tensor_img = tensor_img + delta
            clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
            tensor_img = origin_tensor_img + clip_delta
            tensor_img = paddle.to_tensor(tensor_img.detach().numpy())        return tensor_img

登录后复制

PGD

在BIM基础上，PGD增加迭代轮数，并且增加了一层随机化处理。

Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略 - php中文网

In [ ]

import mathimport paddleclass PGDAttack(object):
    def __init__(self, model, criterion, img, label, eps, alpha, num_iters=6):
        self.model = model
        self.criterion = criterion
        self.img = img
        self.label = label
        self.epsilon = eps
        self.alpha = alpha
        self.num_iters = num_iters    def attack(self):
        origin_tensor_img = paddle.to_tensor(self.img)
        tensor_img = paddle.to_tensor(self.img)
        tensor_label = paddle.to_tensor(self.label)
        delta_init = paddle.uniform(self.img.shape, dtype='float32', min=-self.epsilon, max=self.epsilon)
        tensor_img = tensor_img + delta_init
        clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
        tensor_img = origin_tensor_img + clip_delta        for step in range(self.num_iters):
            tensor_img.stop_gradient = False
            predict = self.model(tensor_img)
            loss = self.criterion(predict, tensor_label)            for param in self.model.parameters():
                param.clear_grad()
            loss.backward(retain_graph=True)
            grad = paddle.to_tensor(tensor_img.grad)
            delta = self.alpha * paddle.sign(grad)
            tensor_img = tensor_img + delta
            clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
            tensor_img = origin_tensor_img + clip_delta
            tensor_img = paddle.to_tensor(tensor_img.detach().numpy())        return tensor_img

登录后复制

以上就是Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略的详细内容，更多请关注php中文网其它相关文章！