本文介绍图像对抗样本的三种常见攻击策略：FGSM、BIM和PGD，附Paddle实现代码（见Paddle-Adversarial-Toolbox仓库）。FGSM通过梯度符号快速生成扰动；BIM为其迭代改进版，提升成功率；PGD在BIM基础上增加迭代轮数和随机化处理，增强攻击效果。
☞☞☞AI 智能聊天, 问答助手, AI 智能搜索, 免费无限量使用 DeepSeek R1 模型☜☜☜
Paddle2.0-AI图像安全-图像对抗样本初探-常见攻击策略
本次我们主要介绍三种常见的攻击策略，分别是FGSM、BIM和PGD。代码已经上传到我们AgentMaker的仓库，欢迎过来给个Star：Paddle-Adversarial-Toolbox。
FGSM
利用对抗样本的线性解释提出了一个快速产生对抗样本的方式，也即Fast Gradient Sign Method(FGSM)方法。假定模型参数值为θ，输入为x，标签为y，则模型的损失函数为J(θ,x,y)。FGSM方法将保证无穷范数限制下，添加的扰动值为η=εsign(∇xJ(θ,x,y))。
In [ ]
import paddleclass FGSMAttack(object):
def __init__(self, model, criterion, img, label, eps):
self.model = model
self.criterion = criterion
self.img = img
self.label = label
self.epsilon = eps def attack(self):
tensor_img = paddle.to_tensor(self.img)
tensor_label = paddle.to_tensor(self.label)
tensor_img.stop_gradient = False
predict = self.model(tensor_img)
loss = self.criterion(predict, tensor_label) for param in self.model.parameters():
param.clear_grad()
loss.backward(retain_graph=True)
grad = paddle.to_tensor(tensor_img.grad)
grad = paddle.sign(grad)
tensor_img = tensor_img + self.epsilon * grad
tensor_img = paddle.to_tensor(tensor_img.detach().numpy()) return tensor_img
BIM
Goodfellow基于之前的FGSM攻击方法做出了一部分改进，作者鉴于之前的FGSM的成功率并不高，提出了以迭代的方式来进行攻击，也就是Basic Iterative Methods(BIM)，是FGSM方法的进阶，因此也被称为Iterative FGSM(I-FGSM)，更新公式如下：
损失函数定义为：
算法流程：
In [ ]
import mathimport paddleclass BIMAttack(object):
def __init__(self, model, criterion, img, label, eps, alpha):
self.model = model
self.criterion = criterion
self.img = img
self.label = label
self.epsilon = eps
self.alpha = alpha
self.num_iters = math.ceil(min(self.epsilon + 4, 1.25 * self.epsilon)) def attack(self):
origin_tensor_img = paddle.to_tensor(self.img)
tensor_img = paddle.to_tensor(self.img)
tensor_label = paddle.to_tensor(self.label) for step in range(self.num_iters):
tensor_img.stop_gradient = False
predict = self.model(tensor_img)
loss = self.criterion(predict, tensor_label) for param in self.model.parameters():
param.clear_grad()
loss.backward(retain_graph=True)
grad = paddle.to_tensor(tensor_img.grad)
delta = self.alpha * paddle.sign(grad)
tensor_img = tensor_img + delta
clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
tensor_img = origin_tensor_img + clip_delta
tensor_img = paddle.to_tensor(tensor_img.detach().numpy()) return tensor_img
PGD
在BIM基础上，PGD增加迭代轮数，并且增加了一层随机化处理。
In [ ]
import mathimport paddleclass PGDAttack(object):
def __init__(self, model, criterion, img, label, eps, alpha, num_iters=6):
self.model = model
self.criterion = criterion
self.img = img
self.label = label
self.epsilon = eps
self.alpha = alpha
self.num_iters = num_iters def attack(self):
origin_tensor_img = paddle.to_tensor(self.img)
tensor_img = paddle.to_tensor(self.img)
tensor_label = paddle.to_tensor(self.label)
delta_init = paddle.uniform(self.img.shape, dtype='float32', min=-self.epsilon, max=self.epsilon)
tensor_img = tensor_img + delta_init
clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
tensor_img = origin_tensor_img + clip_delta for step in range(self.num_iters):
tensor_img.stop_gradient = False
predict = self.model(tensor_img)
loss = self.criterion(predict, tensor_label) for param in self.model.parameters():
param.clear_grad()
loss.backward(retain_graph=True)
grad = paddle.to_tensor(tensor_img.grad)
delta = self.alpha * paddle.sign(grad)
tensor_img = tensor_img + delta
clip_delta = paddle.clip(tensor_img - origin_tensor_img, -self.epsilon, self.epsilon)
tensor_img = origin_tensor_img + clip_delta
tensor_img = paddle.to_tensor(tensor_img.detach().numpy()) return tensor_img
