Hidden attack sample data labeling method

Abstract

The invention provides a hidden attack sample data labeling method, and belongs to the field of artificial intelligence and data security. The method comprises the following steps: firstly, carrying out an attack data labeling process: executing by an attacker, presetting an immune agent by the attacker, effectively interfering a target agent by wrongly written characters generated by the immune agent on the premise of keeping the overall fluency and readability of a text, and meanwhile, ensuring that the target agent is harmless to the own agent; and then carrying out an immune agent detection process. According to the method, interference information such as wrongly written characters and similar characters can be accurately inserted on the basis of ensuring the readability of a text through an intelligent algorithm, so that the purpose of directional attack on a target agent is achieved, and meanwhile, adverse effects on an own agent are effectively avoided; according to the method, hidden labeling of the attack sample can be realized, pollution attack on the target intelligent agent is realized, the influence on the own intelligent agent is avoided, and the method is widely applied to the aspects of poisoning training data, attacking the intelligent agent and the like.

Claims

1. A method for labeling covert attack sample data, characterized in that, The attack sample data labeling method comprises the following steps: First, attack data labeling process; This process is performed by the attacker, and the attacker presets an immune agent, which is a trained lightweight model capable of generating specific misspelled words; The misspelled words generated by the immune agent can effectively interfere with the target agent while maintaining the overall fluency and readability of the text, while ensuring that the agent is harmless to the agent; Second, immune agent detection process; If the training set data of the big data agent comes from the network, the immune agent needs to perform an immune recognition process when collecting network data.

2. The method of claim 1, wherein, The first step is specifically: Step 1.1, assuming the original text is a sequence of Chinese characters ={ } where n represents the total number of characters, represents the i-th character, 1≤i≤n; Step 1.2, set a parameter Y to represent the upper limit of the selectable range of the reference word, satisfying 1≤Y≤n; Step 1.3, assign a position x e [1, Y] corresponding to the xth word of the original text ; Step 1.4, the reference word is converted to a specific encoding; Step 1.

5. Generating a discrete sequence using the encoding of the reference word obtained in step 1.4 Different encoding types use corresponding generation rules; Step 1.6, generating the typo replacement position sequence wherein represents the replacement position of the jth typo in the original text T; the generation of the sequence starts from the first fixed position = Y+1; from the second position, it is calculated according to the discrete number sequence recursively, with the formula (j>1), wherein is the i-1th number in the discrete number sequence ; according to the calculated position sequence , the corresponding word ( ) in the text is replaced by the typo generated by the immune agent, thus forming the contaminated text ; if in a certain calculation, the position is skipped and no operation is performed. Step 1.7, the contaminated text is compared with the original text word by word, and the positions of all inconsistent words are recorded to form a set of actual interference positions; if the number of positions in the set is less than 2, it indicates that the effectiveness of the contaminated text generated this time is insufficient, so the contaminated text is discarded and is not released as attack data; Otherwise the contaminated text Publish to the Internet, so that the target agent can access these data, the implementation of pollution attack.

3. The method of claim 2, wherein, In step 1.4, the code includes: Step 1.4.1, Chinese character international code: assign a unique international standard code to each Chinese character for accurate representation and identification of the Chinese character in the computer system; Step 1.4.2, Pinyin string: the reference word is converted into the corresponding Pinyin in Chinese, and the tone information also needs to be included. The four tones in Pinyin, namely, Yin Ping, Yang Ping, Shangsheng, and Qusheng, are mapped to numbers 1, 2, 3, and 4, respectively. Then each Pinyin letter and the number representing the tone are stored in the string bit by bit. ={ } 4. The method of claim 3, wherein, The second step is specifically: Step 1.5.1, Cangjie Code: Directly use its corresponding decimal number encoding value to carry out bit by bit decomposition to obtain discrete digital sequence wherein represents the highest bit of the decimal encoding, represents the second highest bit of the decimal encoding, and so on, represents the lowest bit of the decimal encoding; Step 1.5.2, Pinyin String: Convert each character and tone number to its corresponding ASCII code value, and break it into high and low nibbles, and convert them to their corresponding decimal numbers in sequence to get a sequence of discrete numbers wherein represents the decimal number corresponding to the high nibble of the ASCII code of the first character represents the decimal number corresponding to the low nibble of the ASCII code of the first character wherein represents the decimal number corresponding to the high nibble of the ASCII code of the second character represents the decimal number corresponding to the low nibble of the ASCII code of the second character and so on, represents the decimal number corresponding to the low nibble of the ASCII code of the last character .​​ 5. The method of claim 4, wherein, The second step is specifically: Step 2.1, in the process of collecting data set by the intelligent agent, assuming that the text to be detected is a sequence G={ }, wherein l represents the total number of words, represents the i-th word (1≤i≤l); Step 2.2, upper limit of the selectable range of reference words and for generating the reference words of the discrete sequence as in the first step; Step 2.3, the reference word is converted to a specific encoding; Step 2.

4. Sequence generation using the encoding of the reference word Different encoding types employ corresponding generation rules; Step 2.5, based on discrete sequence The position generation algorithm of the analog attacker; the theoretical jamming position set The generation rule is as follows: the first theoretical jamming position ; from the second position, the discrete digital sequence is recursively calculated, and the calculation formula is (j>1); if the calculated , the position is skipped and no operation is performed; Step 2.6, the immune intelligent agent performs the misspelling detection on the text G to be detected, identifies all the misspellings existing in the text and records their positions, and obtains the actual misspelling position set denoted as ; Step 2.

7. Set of actual misspelling positions Set of theoretical interference positions generated with the immune agent Comparison is made; if the two are consistent, G is determined to be an attack text and is not accepted; otherwise, it is considered a healthy text and is used subsequently.

6. The method of claim 5, wherein the method further comprises: In step 2.3, the code includes: Step 2.3.1, Chinese character international code: assign a unique international standard code to each Chinese character for accurate representation and identification of the Chinese character in the computer system; Step 2.3.2, Pinyin string: the reference word is converted into the corresponding Pinyin in Chinese, and the tone information also needs to be included. The four tones in Pinyin, namely, yin ping, yang ping, shang sheng, and qu sheng, are mapped to numbers 1, 2, 3, and 4, respectively. Then each Pinyin letter and the number representing the tone are stored in the string bit by bit. ={ } 7. The method of claim 6, wherein, The second step is specifically: Step 2.4.1, Cangjie Code: Directly use its corresponding decimal number encoding value to carry out bit by bit decomposition to obtain discrete digital sequence wherein represents the highest bit of the decimal encoding, represents the second highest bit of the decimal encoding, and so on, represents the lowest bit of the decimal encoding; Step 2.4.2, Pinyin string: Convert each character and tone number into its corresponding ASCII code value, decompose it into the high four bits and low four bits, then convert it into its corresponding decimal number and store it sequentially in the sequence to obtain the discrete number sequence. ,in Indicates the first character The decimal number corresponding to the high four bits of the ASCII code Indicates the first character The decimal number corresponding to the lower four bits of the ASCII code Indicates the second character The decimal number corresponding to the high four bits of the ASCII code. Indicates the second character The lower four bits of the ASCII code correspond to the decimal number, and so on. Indicates the last character The decimal number corresponding to the lower four bits of the ASCII code.

Images