Conditional diffusion model-based confrontation sample purification method

Abstract

The invention discloses an adversarial sample purification method based on a conditional diffusion model. The adversarial sample purification method comprises the following steps: acquiring a clean sample data set containing clean samples; attacking the classification model by using a white-box attack algorithm, and generating a pair of confrontation samples for each clean sample; performing one-to-one pairing on the clean samples and the adversarial samples to form a training data set; the method comprises the following steps of: obtaining a pre-trained Stable Diffusion model; designing a fine tuning process and a fine tuning loss function; and S6, presetting an iteration round and a batch size, and finely adjusting network parameters of a cross attention layer in the Stable Diffusion model by using the training data set to obtain a finely-adjusted conditional diffusion model for purification of an adversarial sample. According to the method, the adversarial sample is used as conditional information to be input into the Unet neural network to guide model learning, so that the model can learn the characteristics of adversarial disturbance, and the calculation efficiency, robustness and stability can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of image denoising, and in particular to an adversarial sample purification method based on a conditional diffusion model. Background Art

[0002] Adversarial attack refers to a technique that adds carefully designed tiny perturbations to the input data to make deep learning models produce errors. With the development of adversarial attack problems, various defense mechanisms have also emerged. The main defense methods include adversarial training, gradient masking, adversarial sample detection, adversarial purification, etc.

[0003] Among them, adversarial training can improve the robustness of the model against adversarial samples. However, most adversarial training methods can only defend against specific attacks in training, and its computational complexity is usually higher than that of standard training. The gradient masking method essentially provides a pseudo-security that is difficult to resist more powerful and complex attacks and may cause damage to the normal optimization and performance of the model. Adversarial sample detection relies on the statistical difference between adversarial samples and normal samples in the input space or feature space. Although it can improve the security of the model to a certain extent, it is difficult to adapt to the ever-changing adversarial attack strategies. Adversarial purification methods rely on generative models to purify adversarial perturbation images before classification. By filtering the attack pattern, it can remove adversarial perturbations while retaining their original features. Currently, there are methods that use generative models such as GAN (Generative Adversarial Networks) for adversarial purification, DiffPure (Diffusion Models for Adversarial Purification, Diffusion Models for Adversarial Purification) methods, and DiffDefence (Defending against Adversarial Attacks via Diffusion Models, Diffusion Models for Adversarial Defense) methods. However, for methods that use generative models such as GAN for adversarial purification, their performance usually lags behind current adversarial training methods due to shortcomings such as mode collapse in GAN.

[0004] The DiffPure method has the following problems: (1) High computational overhead: The DiffPure method relies on a diffusion model to solve forward and reverse stochastic differential equations. The forward process requires the gradual addition of noise, while the reverse process requires the gradual denoising to restore a clean image. Both processes require a lot of computing resources, especially for high-dimensional data or large-scale data sets. (2) Image semantic instability: The method chooses to solve the inverse stochastic differential equation for denoising. In practice, numerically solving SDE may lead to instability, especially under multiple time steps and complex perturbations. This instability may lead to inaccurate semantics of the purified image. (3) Sensitivity to diffusion time step and noise level: The purification effect of the DiffPure method depends on the time step of the forward diffusion process and the degree of noise added. Different adversarial samples may require different time steps and noise levels to achieve the best purification effect, which requires a lot of parameter adjustment and experiments, increasing the complexity and difficulty of the method application.

[0005] The DiffDefence method has the following problems: (1) High computational cost: The DiffDefence method requires multiple optimization iterations, each of which involves multiple diffusion time steps, and each adversarial sample needs to repeat the optimization process, which leads to huge computational cost and time overhead. In addition, the overall optimization efficiency is low in scenarios that require rapid response, making the method impractical in real-time or large-scale applications. (2) Insufficient robustness: Although the authors assume that the adversarial sample is adjacent to the original image in a high-dimensional space and pull the adversarial sample back to the vicinity of the original image through denoising diffusion, in actual applications, the diversity and complexity of adversarial attacks may cause the model to be unable to fully handle certain types of attacks, especially those that are semantically farther away from the original image. At the same time, some adversarial attacks may not completely follow the assumed pattern, making the defense method not fully applicable to all types of attack scenarios, affecting the universality of the method. Summary of the invention

[0006] The purpose of the present invention is to provide an adversarial sample purification method based on a conditional diffusion model that solves the above problems, improves computational efficiency, robustness and stability, better preserves the semantic and visual features of the original image, and resists adaptive attacks.

[0007] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is as follows: a method for purifying adversarial samples based on a conditional diffusion model, comprising the following steps; S1, obtain a clean sample data set containing clean samples; S2, use the white-box attack algorithm to attack the classification model and generate an adversarial sample for each clean sample; S3, the clean sample X cleanand adversarial example X adv One by one pairing, forming a training data set D, D = (X clean ,X adv ); S4, obtaining a pre-trained Stable Diffusion model, including an autoencoder, a multimodal encoder and a Unet neural network, wherein the autoencoder includes an encoder and a decoder, the multimodal encoder is an image encoder of a Clip model, and the Unet neural network includes a cross attention layer; S5, design fine-tuning process and fine-tuning loss function; The encoder of the autoencoder is used to clean Generate a low-dimensional potential representation z0 and gradually add random noise through the forward diffusion process Form the potential representation of each time step, and the potential representation of the tth time step is z t , random noise Randomly sampled from the standard Gaussian distribution N(0,I); The image encoder is used to adv Encode to get the adversarial sample encoding τ(X adv ); The Unet neural network is used to transform τ(X adv ) is introduced into the cross attention layer as conditional information, and the noise is gradually predicted and denoised through the reverse diffusion process, where the predicted noise at the t-th time step is , θ is the network parameter of the Unet neural network; The fine-tuning loss function L is calculated according to the following formula: , In the formula, is the square of the L2 norm, represents the expectation for a pair of samples, prediction noise, and time steps; S6, preset the iteration round and batch size, fine-tune the Stable Diffusion model with the training data set D, calculate a fine-tuning loss function value for each batch, and back-propagate to adjust the network parameters of the cross-attention layer until the iteration round is reached, and obtain the fine-tuned conditional diffusion model; S7, adversarial sample purification; Randomly sampled Gaussian noise , the adversarial sample to be purified As conditional information, the StableDiffusion model is input, and the Unet neural network is used to obtain Gaussian noise through the reverse diffusion process. Stepwise denoising to obtain the predicted low-dimensional potential representation , and then decoded by the decoder of the autoencoder to obtain the predicted clean image .

[0008] Preferably, the clean sample dataset includes a CIFAR-10 dataset, a CIFAR-100 dataset, and / or an ImageNet dataset.

[0009] Preferably, the white-box attack algorithm includes the PGD method, the FGSM method and the MIM method, and the classification model is a VGG-13 model, a VGG-16 model, a ResNet-18 model, a ResNet50 model, a MobileNet-v2 model, an Inception-v3 model, a ConvNeXt model and a Swin-B model.

[0010] As a preference: the cross attention layer generates a query vector Q, a key vector K and a value vector V according to the following formula: All cross attention layers in the Unet neural network are numbered in sequence, and the output of the i-th cross attention layer According to the following formula: , , , , In the formula, , , are the learnable weight matrices corresponding to Q, K, and V, respectively. is the intermediate representation of the input cross attention layer in the Unet neural network, is the softmax function, G is the transposition operation, and d is the vector dimension.

[0011] As a preference: In S5, the latent representation z at the t-th time step t According to the following formula: , , In the formula, is the variance at the tth time step, is the noise intensity control parameter.

[0012] The idea of ​​the present invention is to send the sample pairs consisting of clean samples and adversarial samples into the pre-trained StableDiffusion model, use the adversarial samples as conditional information and the clean samples as target output, and fine-tune the network parameters of the cross-attention layer of the Unet neural network in the Stable Diffusion model through supervised learning, so as to obtain the fine-tuned conditional diffusion model, which is used to purify the adversarial samples and obtain the predicted clean image.

[0013] Glossary: PGD: Projected Gradient Descent, projected gradient descent attack algorithm.

[0014] FGSM: Fast Gradient Sign Method, fast gradient sign attack algorithm.

[0015] MIM: Momentum Iterative Method, momentum iterative method.

[0016] CDM: Conditional Diffusion Model. It is a type of generative model based on the diffusion process. The diffusion model generates new images by gradually adding noise to the image and then removing the noise through the reverse diffusion process. The conditional diffusion model adds conditional inputs to this process, such as text descriptions, category labels, or other forms of prior information, to guide the generated image to develop in a direction that meets the conditions.

[0017] Stable Diffusion: Stable diffusion model, referred to as SD model, is a specific structure of CDM. The SD model structure is specifically divided into three parts: (1) Auto-encoder realizes the conversion of images between pixel space and latent space, including encoder and decoder. The encoder is used to convert the input image from pixel space to latent space and encode it into a low-dimensional latent representation. The decoder is used to decode the low-dimensional latent space representation back to the dimension of the original data; (2) Unet neural network, which realizes noise prediction of the reverse diffusion process; (3) Multimodal encoder. The present invention uses the Image-encoder in the Clip model to encode the image.

[0018] Compared with the prior art, the advantages of the present invention are: (1) The present invention inputs adversarial samples as conditional information into the Unet neural network to guide model learning, thereby purifying adversarial samples and enabling the model to learn the characteristics of adversarial disturbances. It gradually denoises through the image-to-image generation process and outputs purified samples reconstructed after destroying the adversarial interference, that is, predicting a clean image. This avoids the problems of multi-step optimization calculation of DiffDefence and forward noise numerical solution of DiffPure.

[0019] (2) Since only the Stable Diffusion model is fine-tuned, the computational efficiency can be improved and plug-and-play can be achieved. And by using the fine-tuned trained model, the purification of adversarial samples can be directly applied without multiple iterative optimizations.

[0020] (3) Improve robustness and stability. By fine-tuning the Stable Diffusion model, it can automatically learn the features and patterns of various types of adversarial disturbances, and has better generalization ability and robustness.

[0021] (4) Preservation of generation quality and data distribution. By utilizing the powerful generation capability of the conditional diffusion model, the semantic and visual features of the original image can be better preserved. The generated clean images are of higher quality and more closely follow the distribution of the clean data.

[0022] (5) Defending against adaptive attacks. The diffusion model generation process involves iterative sampling and denoising at multiple time steps. Defense methods based on diffusion models face challenges such as gradient vanishing / explosion, high memory cost, and noise randomness. The present invention defends against adaptive attacks to a certain extent based on the diffusion model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flow chart of the present invention; Figure 2 This is the structure diagram of the Stable Diffusion model; Figure 3 This is the Unet neural network structure diagram; Figure 4 This is the network structure diagram of the Spatial Transformer in the Unet neural network. DETAILED DESCRIPTION

[0024] The present invention will be further described below in conjunction with the accompanying drawings.

[0025] Example 1: See Figures 1 to 4 ,A method for purifying adversarial samples based on conditional diffusion model, including the following steps; S1, obtain a clean sample data set containing clean samples; S2, use the white-box attack algorithm to attack the classification model and generate an adversarial sample for each clean sample; S3, the clean sample X clean and adversarial example X adv One by one pairing, forming a training data set D, D = (X clean ,X adv ); S4, obtaining a pre-trained Stable Diffusion model, including an autoencoder, a multimodal encoder and a Unet neural network, wherein the autoencoder includes an encoder and a decoder, the multimodal encoder is an image encoder of a Clip model, and the Unet neural network includes a cross attention layer; S5, design fine-tuning process and fine-tuning loss function; The encoder of the autoencoder is used to clean Generate a low-dimensional potential representation z0 and gradually add random noise through the forward diffusion process Form the potential representation of each time step, and the potential representation of the tth time step is z t , random noise Randomly sampled from the standard Gaussian distribution N(0,I); The image encoder is used to adv Encode to get the adversarial sample encoding τ(X adv ); The Unet neural network is used to transform τ(X adv ) is introduced into the cross attention layer as conditional information, and the noise is gradually predicted and denoised through the reverse diffusion process, where the predicted noise at the t-th time step is , θ is the network parameter of the Unet neural network; The fine-tuning loss function L is calculated according to the following formula: , In the formula, is the square of the L2 norm, represents the expectation for a pair of samples, prediction noise, and time steps; S6, preset the iteration round and batch size, fine-tune the Stable Diffusion model with the training data set D, calculate a fine-tuning loss function value for each batch, and back-propagate to adjust the network parameters of the cross-attention layer until the iteration round is reached, and obtain the fine-tuned conditional diffusion model; S7, adversarial sample purification; Randomly sampled Gaussian noise , the adversarial sample to be purified As conditional information, the StableDiffusion model is input, and the Unet neural network is used to obtain Gaussian noise through the reverse diffusion process. Stepwise denoising to obtain the predicted low-dimensional potential representation , and then decoded by the decoder of the autoencoder to obtain the predicted clean image .

[0026] The clean sample data set includes a CIFAR-10 data set, a CIFAR-100 data set, and / or an ImageNet data set. The white box attack algorithm includes a PGD method, a FGSM method, and a MIM method. The classification model is a VGG-13 model, a VGG-16 model, a ResNet-18 model, a ResNet50 model, a MobileNet-v2 model, an Inception-v3 model, a ConvNeXt model, and a Swin-B model.

[0027] In this embodiment, the cross attention layer generates a query vector Q, a key vector K and a value vector V according to the following formula: All cross attention layers in the Unet neural network are numbered in sequence, and the output of the i-th cross attention layer is According to the following formula: , , , , In the formula, , , are the learnable weight matrices corresponding to Q, K, and V, respectively. is the intermediate representation of the input cross attention layer in the Unet neural network, is the softmax function, G is the transposition operation, and d is the vector dimension.

[0028] In S5, the potential representation z at the t-th time step t According to the following formula: , , In the formula, is the variance at the tth time step, is the noise intensity control parameter.

[0029] Example 2: See Figures 1 to 4 In order to better illustrate the working process of the Unet neural network, we give a specific Unet neural network structure diagram as follows Figure 3 As shown, Figure 3 It is the specific structure of the Unet neural network in the existing Stable Diffusion model. The Unet neural network is divided into three parts: left, middle and right, corresponding to the encoding stage, the middle stage and the decoding stage. Figure 3 Contains Spatial Transformer, whose network structure diagram can be found in Figure 4 , which includes self-attention layer, cross-attention layer and feed-forward neural network, aims to incorporate conditional information into the Unet neural network.

[0030] Combination Figure 3 Figure 4 ,This embodiment proposes a method for purifying adversarial samples based on a conditional diffusion model, including the following steps; S1, obtain a clean sample dataset containing clean samples, such as the CIFAR-10 dataset, the CIFAR-100 dataset, and the ImageNet dataset; S2, use a white-box attack algorithm such as attacking a classification model to generate an adversarial sample for each clean sample. To further improve the diversity of adversarial samples, users can integrate multiple white-box attack algorithms and multiple classification models to generate adversarial samples and improve the diversity of adversarial samples. S3, the clean sample X clean and adversarial example X adv One by one pairing, forming a training data set D, D = (X clean ,X adv ); S4, obtain a pre-trained Stable Diffusion model; S5, designing a fine-tuning process and fine-tuning a loss function, the specific steps are the same as step S5 in embodiment 1; S6, training to obtain a fine-tuned conditional diffusion model. This embodiment provides a specific training process, including Step 1 to Step 7; Step 1: Use the pre-trained Stable Diffusion model as the base model.

[0031] Step 2: The clean image X in the clean sample dataset clean The input is sent to the encoder of the autoencoder to convert the image from pixel space to latent space and obtain the corresponding low-dimensional potential representation z0.

[0032] Step 3: forward diffusion parameter preparation; Step3.1: Set the diffusion time step T=1000; Step 3.2: In the forward diffusion process, the variance of each time step is set to a constant, starting from β1=10 -4 To β T =0.02 increases linearly.

[0033] Step 4: forward diffusion; Step 4.1: Randomly sample time step t from uniform distribution {1,...,T} and set it as the current time step; Step 4.2: Randomly sample from the standard Gaussian distribution N(0,I) to obtain random noise ; Step 4.3: Calculate the potential representation of the t-th time step in the forward diffusion process as z t , , .

[0034] Step 5: Multimodal encoding; Step 5.1: Use a pre-trained image encoder for encoding, where the image encoder is derived from the Clip model; Step 5.2: Take the adversarial sample Xadv Input the image encoder to obtain the adversarial sample code τ(X adv ), taking Vision Transformer as an example, the adversarial sample undergoes a patch convolution and then passes through a continuous residual attention structure to output a tensor of (1,50,768); Step 6: Backward diffusion process, which realizes the prediction of the noise added in the forward diffusion process; Step 6.1: Parameter preparation, obtain embedding after temporal encoding of time step t; Step 6.2: The encoding phase is completed by the left side of the Unet neural network. This part includes multiple Spatial Transformers. Each Spatial Transformer contains a cross attention layer. In each cross attention layer, z t The features of are introduced into the query vector Q, and the adversarial sample encoding τ(X adv ) features are introduced into the key vector K and the value vector V; Step 6.3: Intermediate stage, such as Figure 3 As shown, it consists of two residual blocks and one Spatial Transformer, and the output shape is [2,1280,8,8]; Step 6.4: Decoding stage, Figure 3 The right side box is partially completed.

[0035] Step 7: After the Unet neural network, the output result is obtained, and the predicted noise of the current time step is obtained. The fine-tuning training target is During the training process, in order to reduce the training pressure and computational cost, you can choose to keep other parameters frozen and only optimize and update the parameters of the cross-attention layer in the Spatial Transformer. Repeat the model training process until convergence to obtain a fine-tuned conditional diffusion model.

[0036] S7, adversarial sample purification, including S71~S72; S71, Backward Diffusion Process: Random Sampling-Gaussian Noise , the adversarial sample to be purified As condition information, the Stable Diffusion model is input to realize the reverse diffusion process. The reverse process uses the DDIM accelerated sampling method, sets the sampling step ddim_steps to 20, and sets the calculated variance to 0; Step 2: Reconstruct the purified image. After T time steps of reverse diffusion, the adversarial sample to be purified is obtained. Predicting low-dimensional latent representations in latent space , input into the decoder of the autoencoder for restoration encoding, and then pass The norm constraint satisfies the similarity condition, and the output result is the clean image after reconstruction and removal of adversarial perturbations, that is, the predicted clean image .

[0037] Example 3: In order to illustrate the effect of the present invention, we selected two public datasets commonly used for classification tasks, CIFAR10 and ImageNet, to evaluate and compare different methods. The images in the CIFAR10 dataset are divided into 10 different categories, and the images in the ImageNet dataset are divided into 1000 different categories.

[0038] We consider using Standard Acc and Robust Acc as indicators to evaluate the performance of the defense method. Standard Accuracy measures the performance of the defense method on clean data and is evaluated on the entire test set of each dataset; Robust Accuracy measures the performance of the defense method on adversarial samples, and AutoAttack is selected as the attack method. The following Tables 1 and 2 are obtained: Table 1. Comparison of experimental results of different methods on CIFAR10 dataset method Standard Acc Robust Acc Diffpure 89.02％ 70.64％ DiffDefense 83.75％ 62.23％ The present invention 88.17％ 71.93％ Table 2. Comparison of experimental results of different methods on ImageNet dataset method Standard Acc Robust Acc Diffpure 67.79％ 40.93％ DiffDefense 58.44％ 37.49％ The present invention 69.62％ 42.06％ It can be seen from the experimental results table of the two data sets that the present invention achieves better results in most of the data in terms of standard accuracy and robust accuracy. At the same time, the present invention adopts a fine-tuned model as a purification defense means, which is plug-and-play and does not require multiple iterations, and has higher computational efficiency.

[0039] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for purifying adversarial samples based on a conditional diffusion model, characterized by: The steps include: S1, obtain a clean sample data set containing clean samples; S2, use the white-box attack algorithm to attack the classification model and generate an adversarial sample for each clean sample; S3, the clean sample X clean and adversarial example X adv One by one pairing, forming a training data set D, D = (X clean ,X adv ); S4, obtaining a pre-trained Stable Diffusion model, including an autoencoder, a multimodal encoder and a Unet neural network, wherein the autoencoder includes an encoder and a decoder, the multimodal encoder is an image encoder of a Clip model, and the Unet neural network includes a cross attention layer; S5, design fine-tuning process and fine-tuning loss function; The encoder of the autoencoder is used to clean Generate a low-dimensional potential representation z0 and gradually add random noise through the forward diffusion process Form the potential representation of each time step, and the potential representation of the tth time step is z t , random noise Randomly sampled from the standard Gaussian distribution N(0,I); The image encoder is used to adv Encode to get the adversarial sample encoding τ(X adv ); The Unet neural network is used to transform τ(X adv ) is introduced into the cross attention layer as conditional information, and the noise is gradually predicted and denoised through the reverse diffusion process, where the predicted noise at the t-th time step is , θ is the network parameter of the Unet neural network; The fine-tuning loss function L is calculated according to the following formula: ， In the formula, is the square of the L2 norm, represents the expectation for a pair of samples, prediction noise, and time steps; S6, preset the iteration round and batch size, fine-tune the Stable Diffusion model with the training data set D, calculate a fine-tuning loss function value for each batch, and back-propagate to adjust the network parameters of the cross-attention layer until the iteration round is reached, and obtain the fine-tuned conditional diffusion model; S7, adversarial sample purification; Randomly sampled Gaussian noise , the adversarial sample to be purified As conditional information, the Stable Diffusion model is input, and the Unet neural network is used to obtain Gaussian noise through the reverse diffusion process. Stepwise denoising to obtain the predicted low-dimensional potential representation , and then decoded by the decoder of the autoencoder to obtain the predicted clean image .

2. According to claim 1, the adversarial sample purification method based on the conditional diffusion model is characterized by: The clean sample dataset includes a CIFAR-10 dataset, a CIFAR-100 dataset, and / or an ImageNet dataset.

3. The adversarial sample purification method based on the conditional diffusion model according to claim 1, characterized in that: The white-box attack algorithms include the PGD method, the FGSM method and the MIM method, and the classification models are the VGG-13 model, the VGG-16 model, the ResNet-18 model, the ResNet50 model, the MobileNet-v2 model, the Inception-v3 model, the ConvNeXt model and the Swin-B model.

4. The adversarial sample purification method based on the conditional diffusion model according to claim 1, characterized in that: The cross attention layer generates the query vector Q, the key vector K and the value vector V according to the following formula: All cross attention layers in the Unet neural network are numbered in sequence, and the output of the i-th cross attention layer According to the following formula: ， ， ， ， In the formula, , , are the learnable weight matrices corresponding to Q, K, and V, respectively. is the intermediate representation of the input cross attention layer in the Unet neural network, is the softmax function, G is the transposition operation, and d is the vector dimension.

5. The adversarial sample purification method based on the conditional diffusion model according to claim 1, characterized in that: In S5, the potential representation z at the t-th time step t According to the following formula: ， ， In the formula, is the variance at the tth time step, is the noise intensity control parameter.

Images