A deep learning model poisoning defense method based on model watermarking

Abstract

The present invention discloses a deep learning model poisoning defense method based on model watermark, and the method comprises the following steps: collecting and classifying picture data sets, and producing corresponding watermark pictures for each type of picture data set; using a watermark embedder, combining the original picture domain A in the picture data set with a watermark into a new picture domain A+, and training the watermark embedder using an embedding loss function; using a classification loss function to train a classification model, the classification model classifies pictures, and inputs the new picture domains A+ and A into a feature map of a specified layer of the classification model to obtain and correspondingly save feature areas T+ and T; using an extraction loss function to train a watermark extractor, and inputting feature areas T and T+ into the watermark extractor to extract watermarks; and weighting the prediction results based on the classification results of the classification model on the pictures and the watermark extraction results in the watermark extractor.

Description

Technical Field

[0001] The present invention relates to the field of deep learning security, and in particular to a deep learning model poisoning defense method based on model watermark. Background Art

[0002] With the continuous development of artificial intelligence technology, the research results of deep learning have been widely used in natural language processing, image recognition, industrial control, signal processing, security and other fields. However, if there are loopholes in the data or algorithms of deep learning in security fields such as autonomous driving, military operations, and public opinion warfare, it will cause serious personal injury and property losses. For example, there were 12 autonomous driving accidents in the world in 2018 alone.

[0003] Deep learning is one of the most commonly used technologies in artificial intelligence machine learning. Attacks against deep learning can be divided into adversarial attacks and poisoning attacks according to the attack stage. Adversarial attacks occur in the model testing stage. The attacker adds carefully designed small perturbations to the original data to obtain adversarial samples, thereby fooling the deep learning model and making it misjudge malicious attacks with a high degree of confidence. Poisoning attacks occur in the model training stage. The attacker injects poisoned samples into the training data set, thereby embedding backdoor triggers in the trained deep learning model. Entering poison samples in the testing stage triggers an attack outbreak.

[0004] At present, the defense methods for poisoning attacks can be divided into three categories according to the action stage: data and feature modification, model modification, and output defense. Data and feature modification mainly refers to preprocessing the data or features before they are input into the model to achieve the defense effect; model defense refers to modifying the model to achieve the defense effect; output defense refers to analyzing the output results of the model to achieve the defense effect.

[0005] There is another method to protect the copyright of deep learning: model watermarking. Specifically, a special task-independent watermark module is added to the back of the target model, and a unified, invisible watermark is embedded in the output of the target model. When the attacker uses the output of the model with the watermark to train a substitute model, the invisible watermark will be embedded in the substitute model. When the substitute model is used for image processing tasks, the output will contain a watermark, which can prove that the model is a substitute model, that is, a model substitution attack has been carried out on the original model. This is the application of model watermarking in model copyright protection. By the same token, we can make some changes and use it to defend against model poisoning attacks. Summary of the invention

[0006] In order to solve the problems existing in the prior art, the present invention provides a deep learning model poisoning defense method based on model watermark, which improves the protection of the model against poisoning attacks and makes the model more robust in the face of poisoning attacks.

[0007] A deep learning model poisoning defense method based on model watermark, the method comprising the following steps:

[0008] Collect and classify image data sets, and create a corresponding watermark image for each type of image data set;

[0009] Using the watermark embedder, the original image domain A in the image dataset is combined with the watermark into a new image domain A+, and the embedding loss function is used to train the embedder;

[0010] The classification model is obtained by training using the classification loss function. The classification model classifies the image, and the new image domain A+ is input into the classification model to obtain and save the feature area T+ in the feature map of the specified layer, and the original image domain A is input into the classification model to obtain and save the feature area T in the feature map of the specified layer;

[0011] The watermark extractor is trained using the extraction loss function, and the feature regions T and T+ are input into the watermark extractor to extract the watermark;

[0012] The prediction result is weighted based on the classification result of the image by the classification model and the watermark extraction result in the watermark extractor.

[0013] Specifically, the new image domain A+ is input into the classification model to obtain and save the feature area T+ in the feature map of the third layer of the network, and the original image domain A is input into the classification model to obtain and save the feature area T in the feature map of the third layer of the network.

[0014] Preferably, after the watermark is embedded, a discriminator is used to determine whether the image domain is A or A+.

[0015] Specifically, the discriminator uses the LeNet network.

[0016] Preferably, the embedding loss function is expressed as:

[0017] L 嵌入 =λ1*l 基础 +λ2*l 对抗

[0018]

[0019]

[0020] Where N represents the total number of image pixel values, a represents the image in the original image domain A, and a+ represents the image in the new image domain A+. represents the output of the image in domain A in the discriminator D, represents 1 minus the output of the image in the A+ domain in the discriminator D, l 对抗 The loss hopes that the discriminator D cannot distinguish the images in domain A and domain A+, and λ1 represents l 基础 The hyperparameter of l 对抗 The hyperparameter of .

[0021] Specifically, UNet is used as the watermark embedding network.

[0022] Preferably, the classification loss function is expressed as:

[0023]

[0024] Among them, m represents the number of samples, n represents the number of labels, i represents the i-th sample, j represents the j-th label, and x ij Indicates that the i-th sample is predicted to be the j-th label, p(x ij ) indicates a correct prediction, q(x ij ) represents the probability that the i-th sample is predicted to be the j-th label.

[0025] Specifically, the VGG network is used as the classification model.

[0026] Preferably, the extraction loss function is expressed as:

[0027] L 提取 =λ3*l 水印 +λ4*l 干净 +λ5*l 一致性

[0028]

[0029]

[0030]

[0031] Among them, l 水印 is the extraction loss function of the watermarked image, l 干净 is the extraction loss function of the blank image, l 一致性 is the consistency loss function of the watermark image extracted from different watermarked images, N represents the total number of image pixel values, E is the watermark extractor, is the watermark image, t + , is the image in the feature domain T+, σ0 is the blank image, σ is the original watermark, λ3 represents the hyperparameter of the watermark image extraction loss function, λ4 represents the hyperparameter of the blank image extraction loss function, and λ5 represents the hyperparameter of the watermark consistency loss function.

[0032] Specifically, UNet is used as the watermark extraction network; and the watermark extracted from the feature domain T is blank, while the watermark extracted from the feature domain T+ is an embedded watermark.

[0033] Preferably, the prediction result is expressed as:

[0034] X=λ6f1(x,M)+λ7f2(σ x ,σ)

[0035] Among them, λ6 is the weight of the image classification result, λ7 is the weight of the watermark extracted by the watermark extractor, the f1 function represents the classification result obtained after the input image x passes through the classification model, and the f2 function represents the watermark σ extracted by the watermark extractor from the feature map of the specified layer after the input image x passes through the classification model. x Similarity score with the original watermark σ.

[0036] Compared with the prior art, the present invention is beneficial in that:

[0037] (1) A watermark mechanism is used to add a trade-off item to the final category judgment of the model, making the model more robust in the face of poisoning attacks.

[0038] (2) Under this defense method, if the attacker wants to launch a successful attack, he must embed the corresponding poisoning attack type watermark and wash away the original type watermark at the same time, which significantly increases the difficulty for the attacker to launch a successful attack, thereby better protecting the security of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The overall flow chart of the deep learning model poisoning defense method based on model watermark provided by the present invention;

[0040] Figure 2 A watermark embedding flow chart of the deep learning model poisoning defense method based on model watermark provided by the present invention;

[0041] Figure 3 A watermark extraction flow chart of the deep learning model poisoning defense method based on model watermark provided by the present invention;

[0042] Figure 4 A network structure diagram of a discriminator and a classification model for the deep learning model poisoning defense method based on model watermark provided by the present invention;

[0043] Figure 5Network structure diagram of the watermark embedder and watermark extractor of the deep learning model poisoning defense method based on model watermark provided by the present invention. DETAILED DESCRIPTION

[0044] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0045] A deep learning model poisoning defense method based on model watermark sets a watermark image for each category of images. When training the classification model normally, a watermark embedder is trained at the same time to embed the watermark into the image. Then, the output feature map of a certain layer of the model is specified, and a watermark extractor is trained with these feature maps to extract the embedded watermark. Finally, the category judgment of the image will combine the confidence score of each category given by the main classification model and the watermark score extracted by the watermark extractor.

[0046] Figure 1 The overall flow chart of the deep learning model poisoning defense method based on model watermark provided in this embodiment. The deep learning model poisoning defense method based on model watermark can be used in the field of autonomous driving. The deep learning model builds a neural pathway based on the collected image data to establish a defense mechanism to ensure the safety of autonomous driving.

[0047] according to Figure 1-5 The deep learning model poisoning defense method based on model watermark shown in the figure comprises the following steps:

[0048] (1) Collect and classify image data sets, and create a corresponding watermark image for each type of image data set;

[0049] (2) The original image domain is input into the watermark embedder I. The watermark embedder I uses the UNet network. The watermark embedder I outputs a new image domain A+ with watermark B. The discriminator D is used to determine whether the output of the watermark embedder I is A+. The watermark embedder I is trained using A and A+.

[0050] The embedding loss function used to train the watermark embedder I is expressed as follows:

[0051] L 嵌入 =λ1*l 基础 +λ2*l 对抗

[0052]

[0053]

[0054] Where N represents the total number of image pixel values, a represents the image in the original image domain A, and a+ represents the image in the new image domain A+. represents the output of the image in domain A in the discriminator D, represents 1 minus the output of the image in the A+ domain in the discriminator D, l 对抗 The loss hopes that the discriminator D cannot distinguish the images in domain A and domain A+, and λ1 represents l 基础 The hyperparameter of l 对抗 The hyperparameter of .

[0055] (3) Input A+ into the classification model M to classify the image, and save the feature map of the third layer of the network as the feature area T+, input A into the classification model M, and save the feature map of the third layer of the network as the feature area T;

[0056] The classification loss function of the training classification model M is expressed as follows:

[0057]

[0058] Among them, m represents the number of samples, n represents the number of labels, i represents the i-th sample, j represents the j-th label, and x ij Indicates that the i-th sample is predicted to be the j-th label, p(x ij ) indicates a correct prediction, q(x ij ) represents the probability that the i-th sample is predicted to be the j-th label.

[0059] (4) Using T and T+ to train the watermark extractor E, the watermark extractor E is used to extract the watermarks of T and T+; the watermark extracted from the feature domain T is blank, while the watermark extracted from the feature domain T+ is an embedded watermark.

[0060] The extraction loss function used to train the watermark extractor E is expressed as follows:

[0061] L 提取 =λ3*l 水印 +λ4*l 干净 +λ5*l 一致性

[0062]

[0063]

[0064]

[0065] Among them, l 水印 is the extraction loss function of the watermarked image, l 干净 is the extraction loss function of the blank image, l 一致性 is the consistency loss function of the watermark image extracted from different watermarked images, N represents the total number of image pixel values, E is the watermark extractor, is the watermark image, t + , is the image in the feature domain T+, σ0 is the blank image, σ is the original watermark, λ3 represents the hyperparameter of the watermark image extraction loss function, λ4 represents the hyperparameter of the blank image extraction loss function, and λ5 represents the hyperparameter of the watermark consistency loss function.

[0066] (5) Perform weighted calculation on the various types of images classified in (3), and perform weighted calculation on the watermarks obtained in (4) to calculate the prediction result;

[0067] The weighted calculation formula is as follows:

[0068] X=λ6f1(x,M)+λ7f2(σ x ,σ)

[0069] Among them, λ6 is the weight of the image classification result, λ7 is the weight of the watermark extracted by the watermark extractor E, the f1 function represents the classification result obtained after the input image x passes through the classification model M, and the f2 function represents the watermark σ extracted by the watermark extractor from the feature map of the specified layer after the input image x passes through the classification model M x Similarity score with the original watermark σ.

Claims

1. A deep learning model poisoning defense method based on model watermark, characterized in that: The method comprises the following steps: Collect and classify image data sets, and create a corresponding watermark image for each type of image data set; The original image domain A in the image dataset is input into the watermark embedder. The watermark embedder uses the UNet network to combine the original image domain A with the watermark B and output a new image domain A with the watermark B. + , and use the discriminator D to determine whether the output of the watermark embedder is A + ; Using A and A + Training the watermark embedder; The VGG network is used as the classification model. + Input the image into the classification model to classify the image, and save the feature map of the third layer of the classification model as the feature area T + , input A into the classification model, and save the feature map of the third layer of the classification model as the feature area T; Using UNet as the watermark extractor, the feature regions T and T + Train the watermark extractor and use it to extract T and T + The watermark extracted from the feature area T is blank, and the watermark extracted from the feature area T + The extracted watermark is the embedded watermark; The prediction result is expressed as follows: X=λ6f1(x,M)+λ7f2(σ x ,s) Among them, λ6 is the weight of the image classification result, λ7 is the weight of the watermark extracted by the watermark extractor, the f1 function represents the classification result obtained after the input image x passes through the classification model M, and the f2 function represents the watermark σ extracted by the watermark extractor from the feature map of the specified layer after the input image x passes through the classification model M x Similarity score with the original watermark σ.

2. The deep learning model poisoning defense method based on model watermark according to claim 1 is characterized in that: The embedding loss function for training watermark embedder I is expressed as: L 嵌入 =λ1*l 基础 +λ2*l 对抗 Where N represents the total number of image pixel values, a represents the image in the original image domain A, and a + Represented as the new image domain A + The images in represents the output of the image in domain A in the discriminator D, Represents 1 minus A + The output of the image in the discriminator D in the domain, λ1 represents l 基础 The hyperparameter of l 对抗 The hyperparameter of .

3. The deep learning model poisoning defense method based on model watermark according to claim 1 is characterized in that: The classification loss function for training a classification model is expressed as: Among them, m represents the number of samples, n represents the number of labels, i represents the i-th sample, j represents the j-th label, and x ij Indicates that the i-th sample is predicted to be the j-th label, p(x ij ) represents the correct prediction probability, q(x ij ) represents the probability that the i-th sample is predicted to be the j-th label.

4. The deep learning model poisoning defense method based on model watermark according to claim 1 is characterized in that: The extraction loss function for training the watermark extractor is expressed as: L 提取 =λ3*l 水印 +λ4*l 干净 +λ5*l 一致性 Among them, l 水印 is the extraction loss function of the watermarked image, l 干净 is the extraction loss function of the blank image, l 一致性 is the consistency loss function of the watermark image extracted from different watermarked images, N represents the total number of image pixel values, E is the watermark extractor, t + , is the feature area T + , t is the image in the feature area T, σ0 is the blank image, σ is the original watermark, λ3 represents the hyperparameter of the watermark image extraction loss function, λ4 represents the hyperparameter of the blank image extraction loss function, and λ5 represents the hyperparameter of the watermark consistency loss function.

Images