Data poisoning attack method, electronic equipment, storage medium and system

Abstract

The invention relates to a data poisoning attack method, electronic equipment, a storage medium and a system. The method comprises the following steps: establishing a target model; obtaining the gradient of a weight parameter w in the target model; the direction with the minimum gradient data distribution variance is calculated to serve as the direction of poison attack model modification for training; and generating a poisoning sample by using the trained poisoning attack model. Compared with other poisoning sample generation methods which randomly select model modification directions, the method has the advantages that the direction with the minimum gradient variance is used as the model modification direction, so that on the premise of achieving the same attack effect as other poisoning attack methods, the poisoning sample generates a smaller gradient than the poisoning sample in other poisoning schemes; and the smaller gradient has robustness to the gradient cutting operation.

Description

technical field [0001] The present disclosure relates to the field of data security, in particular to a data poisoning attack method, an electronic device, a storage medium and a system. Background technique [0002] The purpose of the data poisoning attack is to manipulate the model generated by the learning algorithm by maliciously modifying the training set, and the trained model will generate prediction results according to the needs of the attacker. The basic method of data poisoning is to add perturbation to a specific training sample (x, y) to generate a poisoned sample (xp, yp), and then mix the poisoned sample into the training data set of the model, and use the training after poisoning The prediction results of the model trained on the set will change according to the attacker's wishes. [0003] In the prior art, such as patent CN112182576A, a poisoning attack method based on feature collision in deep learning is disclosed. The method generates a specific neural n...

AI Technical Summary

Problems solved by technology

However, the poisoning samples generated by the existing poisoning attacks for the attack effect often have a large gradient, which leads to the existing poisoning attacks being sensitive to the gradient clipping operation.

In other words, the gradient clipping operation of the stochastic gradient descent algorithm in deep learning will weaken the attack effect of existing poisoning attacks

Images