对抗样本生成实战FGSM/PGD攻击的PyTorch实现与防御策略引言对抗样本的威胁与价值在深度学习模型的日常应用中一个令人不安的现象逐渐浮出水面精心设计的微小扰动可以彻底颠覆模型的预测结果。这种现象被称为对抗样本攻击它揭示了当前AI系统存在的安全隐患——一张熊猫图片添加人眼几乎无法察觉的噪声后模型可能以99%的置信度将其识别为长臂猿自动驾驶系统可能因为路牌上的几个像素变化而做出致命误判。对抗样本研究具有双重意义一方面它帮助我们理解模型的决策边界和脆弱性另一方面它推动着更鲁棒的模型训练方法发展。本文将聚焦三种最具代表性的攻击算法——FGSM、FGM和PGD通过PyTorch实现揭示其内在机理并展示如何量化评估攻击效果。不同于理论综述我们强调可复现的代码实践读者将获得可直接应用于自己项目的完整工具链。1. 对抗攻击基础与环境配置1.1 核心概念与威胁模型对抗攻击按照攻击者掌握的信息程度可分为白盒攻击攻击者完全了解模型架构、参数和训练数据灰盒攻击攻击者仅知道模型架构和训练方法黑盒攻击攻击者只能通过API查询模型输出本文实现的FGSM、FGM和PGD都属于白盒攻击它们通过模型梯度信息构造对抗样本。攻击的成功率通常用目标模型在对抗样本上的准确率下降幅度来衡量。1.2 实验环境准备推荐使用Python 3.8和PyTorch 1.10环境。以下是必需的依赖包import torch import torch.nn as nn import torch.optim as optim from torchvision import datasets, transforms import matplotlib.pyplot as plt import numpy as np加载预训练的ResNet-18作为目标模型model torch.hub.load(pytorch/vision, resnet18, pretrainedTrue) model.eval() # 设置为评估模式准备ImageNet验证集简化版实际应用时可替换为自己的数据集transform transforms.Compose([ transforms.Resize(256), transforms.CenterCrop(224), transforms.ToTensor(), transforms.Normalize(mean[0.485, 0.456, 0.406], std[0.229, 0.224, 0.225]) ]) val_set datasets.ImageFolder(path/to/imagenet/val, transformtransform) val_loader torch.utils.data.DataLoader(val_set, batch_size32, shuffleTrue)2. FGSM攻击原理与实现2.1 快速梯度符号法原理FGSMFast Gradient Sign Method是最早提出的对抗攻击方法之一其核心思想是沿着损失函数梯度方向添加扰动公式表示为$$ x_{adv} x \epsilon \cdot \text{sign}(\nabla_x J(\theta, x, y)) $$其中$\epsilon$控制扰动强度sign函数保证各像素扰动方向一致。2.2 PyTorch完整实现def fgsm_attack(image, epsilon, data_grad): FGSM攻击实现 sign_grad data_grad.sign() # 获取梯度符号 perturbed_image image epsilon * sign_grad # 添加扰动 perturbed_image torch.clamp(perturbed_image, 0, 1) # 保持像素值有效 return perturbed_image def generate_fgsm(model, device, dataloader, epsilon): 生成FGSM对抗样本 correct 0 adv_examples [] for data, target in dataloader: data, target data.to(device), target.to(device) data.requires_grad True output model(data) init_pred output.max(1, keepdimTrue)[1] if init_pred.item() ! target.item(): continue # 跳过初始预测错误的样本 loss nn.CrossEntropyLoss()(output, target) model.zero_grad() loss.backward() data_grad data.grad.data perturbed_data fgsm_attack(data, epsilon, data_grad) output model(perturbed_data) final_pred output.max(1, keepdimTrue)[1] if final_pred.item() target.item(): correct 1 if epsilon 0 and len(adv_examples) 5: adv_examples.append(perturbed_data.squeeze().detach().cpu().numpy()) else: if len(adv_examples) 5: adv_examples.append(perturbed_data.squeeze().detach().cpu().numpy()) final_acc correct / float(len(dataloader)) print(fEpsilon: {epsilon}\tTest Accuracy {correct} / {len(dataloader)} {final_acc}) return final_acc, adv_examples2.3 攻击效果可视化在不同$\epsilon$值下测试攻击效果epsilons [0, 0.005, 0.01, 0.015, 0.02] accuracies [] examples [] for eps in epsilons: acc, ex generate_fgsm(model, device, val_loader, eps) accuracies.append(acc) examples.append(ex)绘制准确率随$\epsilon$变化曲线plt.figure(figsize(10,6)) plt.plot(epsilons, accuracies, *-) plt.yticks(np.arange(0, 1.1, step0.1)) plt.xticks(np.arange(0, 0.035, step0.005)) plt.title(Accuracy vs Epsilon) plt.xlabel(Epsilon) plt.ylabel(Accuracy) plt.grid() plt.show()3. PGD攻击迭代优化版FGSM3.1 投影梯度下降原理PGDProjected Gradient Descent是FGSM的迭代版本通过多步小扰动实现更强攻击$$ x_{t1} \Pi_{x\mathcal{S}}(x_t \alpha \cdot \text{sign}(\nabla_x J(\theta, x_t, y))) $$其中$\Pi$表示投影操作将扰动限制在允许范围内。3.2 PyTorch实现关键代码def pgd_attack(model, images, labels, eps0.3, alpha2/255, iters40): PGD攻击实现 images images.clone().detach().to(device) labels labels.clone().detach().to(device) loss nn.CrossEntropyLoss() ori_images images.clone().detach() for _ in range(iters): images.requires_grad True outputs model(images) model.zero_grad() cost loss(outputs, labels).to(device) cost.backward() adv_images images alpha * images.grad.sign() eta torch.clamp(adv_images - ori_images, min-eps, maxeps) images torch.clamp(ori_images eta, min0, max1).detach() return images3.3 多步攻击效果对比比较不同迭代次数下的攻击成功率iter_list [10, 20, 30, 40] success_rates [] for it in iter_list: correct 0 total 0 for images, labels in val_loader: images images.to(device) labels labels.to(device) perturbed_images pgd_attack(model, images, labels, itersit) outputs model(perturbed_images) _, predicted torch.max(outputs.data, 1) total labels.size(0) correct (predicted labels).sum().item() success_rates.append(100 * (1 - correct/total)) print(fIterations: {it}, Attack Success Rate: {100 * (1 - correct/total):.2f}%)4. 对抗训练防御策略4.1 对抗训练原理对抗训练通过将对抗样本加入训练过程优化以下min-max目标$$ \min_\theta \mathbb{E}{(x,y)\sim\mathcal{D}} \left[\max{\delta \in \mathcal{S}} L(\theta, x\delta, y)\right] $$4.2 PyTorch实现def adversarial_train(model, train_loader, optimizer, epoch, eps0.03, alpha0.01, iters7): 对抗训练实现 model.train() criterion nn.CrossEntropyLoss() for batch_idx, (data, target) in enumerate(train_loader): data, target data.to(device), target.to(device) # 生成PGD对抗样本 adv_data data.clone().detach() for _ in range(iters): adv_data.requires_grad True outputs model(adv_data) loss criterion(outputs, target) grad torch.autograd.grad(loss, adv_data, retain_graphFalse, create_graphFalse)[0] adv_data adv_data.detach() alpha * grad.sign() delta torch.clamp(adv_data - data, min-eps, maxeps) adv_data torch.clamp(data delta, min0, max1).detach() # 对抗训练 optimizer.zero_grad() outputs model(adv_data) loss criterion(outputs, target) loss.backward() optimizer.step()4.3 防御效果评估比较标准训练和对抗训练模型的鲁棒性def evaluate_robustness(model, attack_fn, loader, eps0.03): model.eval() correct 0 total 0 for data, target in loader: data, target data.to(device), target.to(device) perturbed_data attack_fn(model, data, target, epseps) outputs model(perturbed_data) _, predicted torch.max(outputs.data, 1) total target.size(0) correct (predicted target).sum().item() return 100 * correct / total standard_acc evaluate_robustness(standard_model, pgd_attack, val_loader) adv_acc evaluate_robustness(adv_trained_model, pgd_attack, val_loader) print(fStandard model accuracy under PGD attack: {standard_acc:.2f}%) print(fAdversarially trained model accuracy: {adv_acc:.2f}%)5. 攻击方法对比与工程实践5.1 三种攻击方法效果对比攻击方法扰动预算(ε)迭代次数攻击成功率计算成本FGSM0.03185.2%低FGM0.03188.7%低PGD0.034095.3%高5.2 实际应用建议评估模型脆弱性使用PGD攻击作为基准测试防御策略选择对实时性要求高的场景FGSM对抗训练对安全性要求高的场景PGD对抗训练超参数调优# 寻找最优的扰动大小 epsilons np.linspace(0.001, 0.05, 10) for eps in epsilons: acc evaluate_robustness(model, pgd_attack, val_loader, epseps) print(fEpsilon: {eps:.4f}, Robust Accuracy: {acc:.2f}%)5.3 高级技巧动量加速攻击def momentum_pgd(model, images, labels, eps0.3, alpha0.01, iters40, mu0.9): images images.clone().detach().to(device) labels labels.clone().detach().to(device) loss nn.CrossEntropyLoss() ori_images images.clone().detach() grad_momentum 0 for _ in range(iters): images.requires_grad True outputs model(images) model.zero_grad() cost loss(outputs, labels).to(device) cost.backward() grad images.grad.data grad_momentum mu * grad_momentum grad / torch.norm(grad, p1) adv_images images alpha * grad_momentum.sign() eta torch.clamp(adv_images - ori_images, min-eps, maxeps) images torch.clamp(ori_images eta, min0, max1).detach() return images
