Conditional adversarial sample-based model poisoning method and system

Abstract

The invention discloses a model poisoning method and system based on conditional adversarial samples, belongs to the technical field of artificial intelligence security, and solves the problems that data is defended and the performance of a model cannot be reduced due to the fact that invalid poisoning is likely to occur in the prior art. According to the method, a training data set is obtained, the training data set comprises a plurality of subsets of different categories, and each subset comprises a plurality of normal samples; randomly selecting one subset or multiple subsets in the training data set, and initializing two disturbances for each normal sample in the subset; detecting the normal sample and the two disturbances based on a pre-trained detection model, if the requirement is met, obtaining the sum of the normal sample and the two disturbances, namely a conditional adversarial sample, and if the requirement is not met, updating the disturbances and then executing the step 3 again; and replacing the normal samples of the conditional adversarial samples with the conditional adversarial samples, obtaining a new training data set after replacement is completed, and training the detection model based on the new training data set. The method is used for model poisoning.

Description

technical field [0001] A model poisoning method and system based on conditional confrontation samples are used for model poisoning and belong to the field of artificial intelligence security technology. Background technique [0002] Model poisoning attacks exist in the model training phase, and the objects can include various deep learning models, such as malware detection models, image classification models, and face recognition models. This can lead to a significant reduction in the performance of the target model. On the other hand, by poisoning the data, the data can also be copyrighted to avoid unauthorized use. [0003] As deep learning methods of deep neural networks have shown performance exceeding traditional methods in many fields, deep learning models are widely used in various scenarios. At the same time, the training of existing deep learning models largely relies on a large number of training datasets, so the collection of training samples is an important pro...

AI Technical Summary

Problems solved by technology

[0006] In view of the above-mentioned research problems, the purpose of the present invention is to provide a model poisoning method based on conditional confrontation samples, which solves the situation that the existing technology is prone to invalid poisoning, thus causing data to be defended and the performance of the model cannot be reduced

Images