Implicit video attack method

Abstract

The invention discloses an implicit video attack method, which comprises the following steps of: 1, inputting malicious information and an original clean image into a first-stage encoder to obtain low-dimensional malicious information features and original clean image features; 2, attacking the original clean image features for the first time by using low-dimensional malicious information features to generate attacked image features; 3, inputting the attacked image features into a secondary encoder to obtain high-dimensional attacked image features; 4, attacking the original clean image again by using the high-dimensional attacked image features; and 5, designing a confrontation module to keep the visual consistency between the attacked image and the original clean image. According to the method, the video can be attacked with high efficiency and high quality, so that the attack efficiency of the model can be improved, and the concealment of malicious information is enhanced.

Description

Technical Field

[0001] The invention belongs to the field of artificial intelligence, and in particular to an attack method of an implicit video attack. Background Art

[0002] With the popularization of digital media and the Internet, video content has become an important source of information and entertainment in people's daily lives; however, malicious behaviors and information security issues in cyberspace have become increasingly prominent; video attacks, as a new means of network attack, have attracted widespread attention in recent years; the technical background of video attacks involves multiple links such as video generation and editing, information dissemination and reception; from the attacker's perspective, they may use advanced video processing technology to add malicious information to the video, and spread the malicious information with the help of the video, thereby attacking other models; these technologies include but are not limited to frame replacement, malicious video generation, etc., which can embed specific information into the video without arousing the audience's suspicion, and then attack other models; video attacks have become a research hotspot, mainly because we can use video attack models to test the robustness of other models, which is an important part of model security robustness research;

[0003] However, existing video attack models have some shortcomings:

[0004] 1. High training cost: Video attack models often require a large amount of training data and computing resources to optimize their performance. This is because video data has higher dimensions and complexity than image or text data, so the model needs to learn more features to effectively generate or tamper with video content. In addition, in order to ensure that the attack video can be spread without being detected, the model also needs to be fine-tuned and tested, which further increases the training cost.

[0005] 2. Insufficient embedding of malicious information: Existing video attack techniques may not be able to fully embed malicious information into the original video, resulting in unsatisfactory attack effects. This may be because the attack algorithm is unable to embed enough malicious information without affecting the normal viewing experience while maintaining the visual quality of the video.

[0006] 3. Visual inconsistency: Visual inconsistency between the infected video and the original video is another important issue in video attack research. If the infected video looks unnatural or has obvious signs of tampering, it is easy for users to notice and become suspicious, or it is easy for algorithms to detect it.

[0007] In summary, video attack research faces challenges such as high training cost, insufficient embedding of malicious information, and visual inconsistency. Summary of the invention

[0008] The present invention aims to solve the deficiencies of the above-mentioned prior art and proposes an implicit video attack method, so as to attack the video efficiently and with high quality, thereby improving the attack efficiency of the model and enhancing the concealment of malicious information.

[0009] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme:

[0010] The characteristic of an implicit video attack method of the present invention is that it is performed according to the following steps:

[0011] Step 1: Get a clean image dataset ,make Any clean image is denoted as x; any malicious image is denoted as y;

[0012] Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder, and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ;

[0013] Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features ;

[0014] Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thereby obtaining the attack image features in the low-dimensional space ;

[0015] Step 2.3: The second level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space , thereby generating high-dimensional image attack features ;

[0016] Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get the high-dimensional clean image features and high-dimensional attack image features ;

[0017] (14)

[0018] Step 3: Construct adversarial loss for attacking network , including: feature difference loss and pixel loss ;

[0019] Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained. ;

[0020] Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original videos, is with The corresponding text description, is the total number of videos; where Indicates Video after the attack.

[0021] The implicit video attack method described in the present invention is also characterized in that step 2.2 is performed as follows:

[0022] Step 2.2.1: Use equation (1) and equation (2) to obtain the first-stage clean features and first-stage malicious features ;

[0023] (1)

[0024] (2)

[0025] In formula (1) and formula (2), is the ReLU activation function, and Respectively represent the weights and biases to be trained in the convolutional layer;

[0026] Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious information features ;

[0027] (3)

[0028] (4)

[0029] In formula (3) and formula (4), represents the downsampling operation;

[0030] Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ;

[0031] (5)

[0032] In formula (5), Represents 3 consecutive ResNet network modules;

[0033] Step 2.2.4: Use formula (6) to obtain the clean image query feature , Clean image keyword features and clean image value features ;

[0034] (6)

[0035] In formula (6), and Respectively represent the weights and biases to be trained in the second convolution, and Respectively represent the weights and biases to be trained in the third convolution, and Respectively represent the weights and biases to be trained in the fourth convolution;

[0036] Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ;

[0037] Softmax (7)

[0038] In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition;

[0039] Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ;

[0040] (8)

[0041] Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ;

[0042] (9)

[0043] In formula (9), Represents a ResNet network, and Respectively represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function;

[0044] Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Transformed into low-dimensional four-level malicious information features ;

[0045] Step 2.2.9: Use equation (10) to convert and Converted into low-dimensional image attack features ;

[0046] (10)

[0047] In formula (10), Represents the first balance coefficient.

[0048] Further, the step 2.3 is performed as follows:

[0049] Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ;

[0050] (11)

[0051] In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features;

[0052] Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ;

[0053] Step 2.3.3: Use formula (12) to obtain the high-dimensional first-level attack image features ;

[0054] (12)

[0055] In formula (12), Denotes the upsampling module;

[0056] Step 2.3.4: Use equation (9) to Processing to obtain high-dimensional secondary image attack features ;

[0057] Step 2.3.5: Generate high-dimensional image attack features using formula (13) ;

[0058] (13)

[0059] In formula (13), Represents the second balance coefficient.

[0060] Further, the step 3 is performed as follows:

[0061] Step 3.1: Use formula (15) to construct feature difference loss ;

[0062] (15)

[0063] Step 3.2: Construct pixel loss using equation (16) ;

[0064] (16)

[0065] Step 3.3: Use formula (17) to get the adversarial loss ;

[0066] (17).

[0067] Further, the step 5 is performed as follows:

[0068] Step 5.1: From Random Extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of video frames extracted;

[0069] Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .

[0070] The electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the attack method, and the processor is configured to execute the program stored in the memory.

[0071] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the attack method when the computer program is executed by a processor.

[0072] Compared with the prior art, the present invention has the following beneficial effects:

[0073] 1. The present invention designs an implicit video attack model that can discover security vulnerabilities of other models, which is beneficial to improving the security robustness of other models; 2. The present invention proposes a video key frame attack model based on image generation, which reduces the number of parameters for model training; in addition, a secondary attack network structure is constructed to fully embed malicious information into the original video data, so that the attacked image has a certain degree of aggressiveness to other models, thereby discovering security vulnerabilities in other models.

[0074] 3. The present invention designs an adversarial module to improve the visual consistency between the original video and the poisoned video, so that the malicious information is highly concealed in the poisoned data and is not easily detected by other models, thereby improving the success rate of the model attack.

[0075] 4. The image generation technology based on the video key frame attack model of the present invention greatly saves the model training cost; a secondary attack module is designed to fully embed malicious information into the original video; in addition, an adversarial module is designed to greatly improve the visual consistency between the original video and the poisoned video, and enhance the concealment of malicious information; BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 The figure is a flow chart of an implicit video attack method in the present invention. DETAILED DESCRIPTION

[0077] In this embodiment, if Figure 1 As shown, an implicit video attack method is performed as follows:

[0078] Step 1: Get a clean image dataset ,make Any clean image is denoted as x; any malicious image is denoted as y; a clean image dataset refers to a dataset consisting of images that have not been attacked. A malicious image refers to an image containing malicious information, which is freely defined by humans.

[0079] Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder, and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ;

[0080] Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features Among them, the feature extraction module is a python image processing library and is widely used in extracting initial features of images.

[0081] Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thereby obtaining the attack image features in the low-dimensional space The low-dimensional space can fully embed malicious information into clean image features to attack clean images. Therefore, it is necessary to and are all mapped into a low-dimensional space.

[0082] Step 2.2.1: Use equation (1) and equation (2) to obtain the first-stage clean features and first-stage malicious features Formula (1) and (2) are two independent convolutional neural networks, processing features respectively. and .

[0083] (1)

[0084] (2)

[0085] In formula (1) and formula (2), is the ReLU activation function, and Respectively represent the weights and biases to be trained in the convolutional layer;

[0086] Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious image features ;

[0087] (3)

[0088] (4)

[0089] In formula (3) and formula (4), Represents the downsampling operation, which mainly consists of two ResNet blocks and one downsampling block.

[0090] Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ;

[0091] (5)

[0092] In formula (5), Represents 3 consecutive ResNet network modules;

[0093] Step 2.2.4: Use formula (6) to obtain the clean image query feature , Clean image keyword features and clean image value features ;

[0094] (6)

[0095] In formula (6), and Respectively represent the weights and biases to be trained in the second convolution, and Respectively represent the weights and biases to be trained in the third convolution, and They represent the weights and biases to be trained in the fourth convolution respectively.

[0096] Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ;

[0097] Softmax (7)

[0098] In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition;

[0099] Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ;

[0100] (8)

[0101] in, Represents matrix multiplication.

[0102] Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ;

[0103] (9)

[0104] In formula (9), Represents a ResNet network, and Respectively represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function;

[0105] Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Transformed into low-dimensional four-level malicious information features .

[0106] Step 2.2.9: Use equation (10) to convert and Converted into low-dimensional image attack features ;

[0107] (10)

[0108] In formula (10), Represents the first balance coefficient.

[0109] Step 2.3: The second level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space ; Because, in the end, we need to get the attacked image, and we need to transform the features of low-dimensional space into features of high-dimensional space;

[0110] Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ;

[0111] (11)

[0112] In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features.

[0113] Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ;

[0114] Step 2.3.3: Use formula (12) to obtain the high-dimensional first-level attack image features ;

[0115] (12)

[0116] In formula (12), Denotes the upsampling module, which consists of two ResNet blocks and an upsampling module.

[0117] Step 2.3.4: Use equation (9) to Processing to obtain high-dimensional secondary image attack features ;

[0118] Step 2.3.5: Generate high-dimensional image attack features using formula (13) ;

[0119] (13)

[0120] In formula (13), Represents the second balance coefficient.

[0121] Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get the high-dimensional clean image features and high-dimensional attack image features ;

[0122] (14)

[0123] Step 3: Construct adversarial loss for attacking network , including: feature difference loss and pixel loss There is a visual inconsistency between the attacked image and the original clean image, which may lead to the failure of the attack process. To solve this problem, the present invention designs an adversarial module, which includes a feature difference loss and pixel loss This module establishes an adversarial relationship between the two losses, ensuring the visual consistency between the poisoned images and the original clean images.

[0124] Step 3.1: Use formula (15) to construct feature difference loss ;

[0125] (15)

[0126] Step 3.2: Construct pixel loss using equation (16) ;

[0127] (16)

[0128] Step 3.3: Use formula (17) to get the adversarial loss ;

[0129] (17)

[0130] Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained. ;

[0131] Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original videos, is with The corresponding text description, is the total number of videos; where Indicates A video of the aftermath of the attack;

[0132] Step 5.1: From Random Extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of video frames extracted;

[0133] Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .

[0134] In this embodiment, an electronic device includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the above method, and the processor is configured to execute the program stored in the memory.

[0135] In this embodiment, a computer-readable storage medium stores a computer program on the computer-readable storage medium, and the computer program executes the steps of the above method when executed by a processor.

Claims

1. An implicit video attack method, characterized in that: The steps are as follows: Step 1: Get a clean image dataset ,make Any clean image in is denoted as x; Get any malicious image and record it as y; Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder, and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ; Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features ; Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thereby obtaining the attack image features in the low-dimensional space ; Step 2.3: The second level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space , thereby generating high-dimensional image attack features ; Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get the high-dimensional clean image features and high-dimensional attack image features ; (14) Step 3: Construct adversarial loss for attacking network , including: feature difference loss and pixel loss ; Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained. ; Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original videos, is with The corresponding text description, is the total number of videos; where Indicates Video after the attack.

2. According to claim 1, a hidden video attack method is characterized in that: The step 2.2 is carried out as follows: Step 2.2.1: Use equation (1) and equation (2) to obtain the first-stage clean features and first-stage malicious features ; (1) (2) In formula (1) and formula (2), is the ReLU activation function, and Respectively represent the weights and biases to be trained in the convolutional layer; Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious information features ; (3) (4) In formula (3) and formula (4), represents the downsampling operation; Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ; (5) In formula (5), Represents 3 consecutive ResNet network modules; Step 2.2.4: Use formula (6) to obtain the clean image query feature , Clean image keyword features and clean image value features ; (6) In formula (6), and Respectively represent the weights and biases to be trained in the second convolution, and Respectively represent the weights and biases to be trained in the third convolution, and Respectively represent the weights and biases to be trained in the fourth convolution; Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ; Softmax (7) In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition; Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ; (8) Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ; (9) In formula (9), Represents a ResNet network, and Respectively represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function; Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Transformed into low-dimensional four-level malicious information features ; Step 2.2.9: Use equation (10) to and Converted into low-dimensional image attack features ; (10) In formula (10), Represents the first balance coefficient.

3. The implicit video attack method according to claim 2, characterized in that: The step 2.3 is carried out as follows: Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ; (11) In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features; Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ; Step 2.3.3: Use formula (12) to obtain the high-dimensional first-level attack image features ; (12) In formula (12), Denotes the upsampling module; Step 2.3.4: Use equation (9) to Processing to obtain high-dimensional secondary image attack features ; Step 2.3.5: Generate high-dimensional image attack features using formula (13) ; (13) In formula (13), Represents the second balance coefficient.

4. The implicit video attack method according to claim 3, characterized in that: The step 3 is carried out as follows: Step 3.1: Use formula (15) to construct feature difference loss ; (15) Step 3.2: Construct pixel loss using equation (16) ; (16) Step 3.3: Use formula (17) to get the adversarial loss ; (17)。 5. The implicit video attack method according to claim 4, characterized in that: The step 5 is carried out as follows: Step 5.1: From Random Extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of video frames extracted; Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .

6. An electronic device, comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute any one of the attack methods in claims 1-5, and the processor is configured to execute the program stored in the memory.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the attack method according to any one of claims 1 to 5 are executed.

Images