An automated adversarial training method and apparatus

Abstract

One aspect of this disclosure relates to an automated adversarial training method, comprising acquiring an original training dataset and a model trained using the original training dataset, the original training dataset including input data and its labels; automatically perturbing the input data for a predetermined number of steps, including, for each of the predetermined number of steps: automatically searching in a predefined attack hyperparameter search space for the optimal hyperparameter value for that step; automatically determining the perturbation for that step based on the optimal hyperparameter value; updating the input data by incorporating the perturbation for that step; and further optimizing the model to counter the perturbation using an adversarial training dataset including the updated input data and its labels after the predetermined number of perturbations. This disclosure also relates to other related aspects.

Description

Technical Field

[0001] This application generally involves machine learning, and in particular adversarial training. Background Technology

[0002] Adversarial training is an important way to enhance the robustness of neural networks. As a method of defending against adversarial attacks, during adversarial training, samples are mixed with some small perturbations (changes that are imperceptible to humans but can easily cause misclassification by neural network models) to generate adversarial examples, which are then added to the training set. The neural network is then trained to learn and adapt to these changes, thereby enhancing its robustness against adversarial examples.

[0003] On the client side (e.g., mobile devices), the security of application (APP) user accounts is extremely important. User accounts can be maliciously stolen by friends, family, acquaintances, or cybercriminals to perform operations such as transferring money, stealing data, or destroying data. This type of risk is known as client-side account theft risk.

[0004] To detect client-side exploitation risks, existing neural network models can determine whether such exploitation has occurred based on user behavior patterns. Adversarial training can be used to improve the robustness of these models. However, existing adversarial examples are constructed using a single method, resulting in models trained adversarially that are only robust against specific attacks and cannot cope with the diverse attack methods employed by cybercriminals in exploitation scenarios.

[0005] Therefore, there is a need in this field for improved adversarial training techniques to enhance the robustness of neural network models that detect client misuse risks. Summary of the Invention

[0006] One aspect of this disclosure relates to an automated adversarial training method, comprising: acquiring an original training dataset and a model trained using the original training dataset, the original training dataset including input data and its labels; automatically perturbing the input data for a predetermined number of steps, including, for each of the predetermined number of steps: automatically searching in a predefined attack hyperparameter search space for the optimal hyperparameter value for that step; automatically determining the perturbation for that step based on the optimal hyperparameter value; updating the input data by incorporating the perturbation for that step; and further optimizing the model to counter the perturbation using an adversarial training dataset including the updated input data and its labels after the predetermined number of perturbations.

[0007] According to some exemplary embodiments, the predefined attack hyperparameter search space includes hyperparameters with candidate values, and the hyperparameters include at least the perturbation operation and step size for the perturbation at each step.

[0008] According to some exemplary embodiments, the candidate values ​​for the perturbation operation include one or more of the following perturbation operators or any combination thereof: FGM, FGSM, FGMM, Gaussian noise, and identity variation.

[0009] According to some exemplary embodiments, the candidate values ​​of the step size include one or more of the following step sizes or any combination thereof: 0.0001, 0.001, 0.01, 0.1, 1.

[0010] According to some exemplary embodiments, automatically perturbing the input data for a predetermined number of steps includes using the input data of the original training dataset as the input for the first perturbation, using the input data after each perturbation as the input for the next perturbation, and using the input data after the last perturbation as the updated input data in the adversarial training dataset.

[0011] According to some exemplary embodiments, automatically searching for the hyperparameter value optimal for the perturbation of this step in a predefined attack hyperparameter search space includes using an attention mechanism to determine the score of the hyperparameter on each candidate value and determining the hyperparameter value optimal for the perturbation of this step based on the score.

[0012] According to some exemplary embodiments, using an attention mechanism to determine the score of the hyperparameter on each candidate value includes: determining a query based on the input data of this step; embedding each candidate value as a corresponding key; and using an attention mechanism to obtain the attention distribution value of the query on each key as the score of the hyperparameter on the corresponding candidate value.

[0013] According to some exemplary embodiments, using an attention mechanism to determine the score of a hyperparameter at each candidate value further includes using a corresponding attention mechanism for the perturbation operation and the step size to compute their scores at their respective candidate values; and wherein determining the optimal hyperparameter value for the perturbation at this step based on the scores includes using GumbelSoftmax as a normalized sampling unit for the score of the perturbation operation at its candidate values, and using Softmax as a normalized unit for the score of the step size at its candidate values.

[0014] According to some exemplary embodiments, automatically determining the perturbation of this step based on the optimal hyperparameter values ​​includes: determining the perturbation of this step based on the optimal perturbation operation value, the optimal step size value, and the gradient of the model's loss function on the input data of this step.

[0015] According to some exemplary embodiments, determining a query based on the input data of this step includes determining the gradient of the model's loss function on the input data of this step; and linearly projecting the gradient onto the query.

[0016] According to some exemplary embodiments, further optimizing the model using the adversarial training dataset, which includes updated input data and its labels after being perturbed by the predetermined number of steps, includes updating the model based on the gradient of the model's loss function on the adversarial training dataset.

[0017] According to some exemplary embodiments, the input data includes the user's behavior patterns on the client's APP, and the model is used to determine whether client misuse has occurred.

[0018] Other aspects of this disclosure include corresponding apparatus, devices, and computer-readable media. Attached Figure Description

[0019] Figure 1 A block diagram of a parameterized attacker according to one aspect of this disclosure is shown.

[0020] Figure 2 A block diagram of a single-step attack unit in a parameterized attacker according to one aspect of this disclosure is shown.

[0021] Figure 3 A block diagram of a single-step attack unit in a parameterized attacker according to one aspect of this disclosure is shown.

[0022] Figure 4 The pseudocode of a parameterized attacker according to one aspect of this disclosure is shown.

[0023] Figure 5 A comparative diagram of automated adversarial training, standard training, and prior art adversarial training according to one aspect of this disclosure is shown.

[0024] Figure 6 A flowchart of an automated adversarial training method according to one aspect of this disclosure is shown.

[0025] Figure 7 A flowchart of an automatic perturbation attack sub-method according to one aspect of this disclosure is shown. Detailed Implementation

[0026] To detect the risk of client misuse, neural network models can determine whether client misuse has occurred based on user behavior patterns.

[0027] According to some exemplary embodiments, user behavior patterns on a client-side app can be tracked using SPM (Super Position Model). SPM is an encoding that can be used to track the location of page modules. Using an SPM tracking scheme, a tracking log request is sent every time a user enters a page. Based on the SPM sequence of user clicks, a neural network can determine whether unauthorized activity has occurred.

[0028] However, the SPM encoding on the client side (e.g., mobile devices) may change with app version updates, resulting in changes in data distribution. Simultaneously, malicious actors may experiment with different behaviors to bypass the neural network model's judgment, a phenomenon known as malicious perturbation. These factors, along with others, collectively lead to a rapid decline in the performance of online neural network models. In particular, in combating malicious actors, once a successful attack is achieved, they often launch numerous more attacks of the same or similar types. This poses a significant security risk to both the platform and its customers.

[0029] To improve the robustness of neural network models, adversarial training can be used. This involves constructing adversarial examples, which are prone to being misclassified by the model, as input during training to enhance the model's robustness. The method of constructing adversarial examples directly affects their quality, and thus the model's robustness.

[0030] To address the diverse attack methods employed by cybercriminals in data theft scenarios, this disclosure proposes an automated adversarial training method to resist various attacks. Specifically, the automated adversarial training method of this disclosure utilizes automated machine learning techniques (i.e., AutoML-based) to search in a perturbation space integrating multiple attacks, constructing diverse adversarial examples to solve the optimization problem of adversarial examples, thereby significantly improving the robustness of the final model. The following detailed description of the solution in this disclosure is provided in conjunction with specific embodiments.

[0031] Generally speaking, the optimization objective of traditional adversarial training is the following min-max problem:

[0032]

[0033] Where x is a natural sample, y is its associated label, δ∈S is the adversarial perturbation, where S is the perturbation space, and θ is the parameter set of the neural network. It is a loss function. It is a dataset of (x,y), and This is the error function representing the performance of the neural network as a classifier. As can be seen, inner max aims to find the optimal adversarial perturbation δ that maximizes the loss function. * This alters the model's predictions, while outer min modifies the optimal adversarial perturbation δ. * Learning from adversarial examples to improve the error function Minimize to obtain a more robust neural network model.

[0034] The number of inner max steps is generally related to the optimization intensity (i.e., finding an extremum that is as close as possible to the global extremum). However, the more inner max steps there are, the longer the training time will be. In addition, adjusting at least some hyperparameters (i.e., parameters that are set before the learning process begins, relative to the parameters obtained through training), such as random initialization, step size, momentum, early stopping, etc., can also help to construct better adversarial perturbations.

[0035] Therefore, this disclosure introduces an attacker characterized by a parameter α, where α includes the attacker's parameters. Specifically, this disclosure employs a parameterized attacker to search the perturbation space S based on the current trained model and the input to find the optimal perturbation δ. * (i.e., the inner max problem). Attacker α targets the currently trained model f. θ The adversarial perturbation generated from the input (x,y) is denoted as δ(x,y,θ;α). Therefore, the above min-max problem is transformed into the following two-level optimization problem:

[0036] So that Where δ(x,y,θ;α) is the result of the attacker α targeting the current trained model f. θ The adversarial perturbation generated by the input (x,y), α * It makes The choice of the attacker's hyperparameter value α is maximized. Therefore, this disclosure aims to find the optimal adversarial perturbation δ that maximizes the loss function. * The inner max problem is transformed into finding the optimal attacker α. * .

[0037] Since training the attacking device for inner max consumes significant computational power, the optimal solution for inner max can be approximated using a one-step gradient descent method commonly used in meta-learning, i.e.:

[0038]

[0039] Here, α represents the current hyperparameter value of the attacker, while Lr represents the learning rate during attacker optimization.

[0040] To limit the perturbation space required for inner-max search, we can refer to the approach of traditional adversarial training, treating the generation of adversarial perturbations as a combination of gradients from several steps, and utilizing the gradients from each step... The combination method and step size ξ are selected. That is, in the perturbation space The system performs a search within the system to automatically find the optimal hyperparameter values ​​for each perturbation step.

[0041] According to exemplary embodiments of this disclosure, the optimal hyperparameter value for each perturbation step may include a combination of several hyperparameter values. Specifically, according to some exemplary embodiments, the perturbation space to be searched (i.e., the hyperparameter space) may include one or more of the following hyperparameters or any combination thereof: number of steps, perturbation operation (e.g., perturbation operator) constituting each attack unit, and step size. Thus, the optimal hyperparameter value for each perturbation step may include a combination of the optimal value of the perturbation operation and the optimal value of the step size in that step. It should be noted that although the term "hyperparameter value" or similar terms are used herein, those skilled in the art will understand that the term is not limited to "numerical value," but can substantially encompass "value" in numerical form or "value" in non-numerical form, the specific value type of which is determined by the nature of the corresponding parameter and / or may be represented by non-numerical and / or corresponding or associated numerical values ​​as needed in different situations.

[0042] According to exemplary embodiments of this disclosure, the perturbation operation can be represented by a perturbation operator. The perturbation operator can be, for example, including but not limited to, FGM / FGSM / FGMM... The step size can be, for example, including but not limited to, 0.0001, 0.001, 0.01, 0.1, 1...

[0043] According to some exemplary embodiments, each step of the perturbation attack can be implemented by an attack unit. For each attack unit, the optimal perturbation operation value (i.e., perturbation operator) and the optimal step size value can be selected from candidate values ​​of the perturbation operation (e.g., including but not limited to the five perturbation operators FGM / FGSM / FGMM / Gaussian noise / identical change) and candidate values ​​of the step size (e.g., including but not limited to 0.0001, 0.001, 0.01, 0.1, 1). Of course, as those skilled in the art will appreciate, the perturbation operator and / or step size are not limited to those listed above, but may include other perturbation operators and / or step sizes or any combination thereof. In addition, the searchable hyperparameters are not limited to the perturbation operation and step size, but may include other additional, alternative, more, or fewer hyperparameters.

[0044] For example, based on an exemplary scenario, when the number of steps is selected as 5, the following exemplary, and not limiting, adversarial perturbation can be used:

[0045] (i) If each attack unit selects FGM as the perturbation operator, it is equivalent to performing 5 steps of PGD;

[0046] (ii) If the first attack unit selects FGSM as the perturbation operator and the subsequent attack units select identity change as the perturbation operator, then the attack is equivalent to degenerating into FGSM.

[0047] (iii) The first step attack unit selects Gaussian noise as the perturbation operator, and the subsequent attack units select FGM as the perturbation operator. This is equivalent to first selecting different starting points through random perturbation, and then finding the local optimal perturbation through 4 steps of PGD.

[0048] The foregoing provides several exemplary, not limiting, examples of hyperparameter selections for adversarial perturbations. However, as will be apparent to those skilled in the art, this disclosure is not limited thereto, but can encompass various perturbation spaces, various number of steps, various combinations of attack units, various perturbation operators, various step sizes, and various combinations thereof.

[0049] Figure 1 A block diagram of a parameterized attacker 100 according to one aspect of this disclosure is shown. Figure 1 As shown, the step hyperparameter of the parameterized attacker 100 can be selected as K steps, i.e., a series of K-step attack units or a K-step attack, where each attack unit k (k is in the range of 1 to K) takes the output of the previous attack unit as its input. Generally, K can be less than 10. According to a preferred embodiment, K can include 5.

[0050] Specifically, the input to attack unit 1 is x (0) This refers to the original sample. Attack unit 1 processes this original sample x based on its parameter α. (0) (For example, to incorporate the perturbation in the first step) Then, the first step perturbation sample x is obtained and output. (1) The first step is to perturb the sample x. (1) It was input into attack unit 2.

[0051] Attack unit 2 processes the first-step perturbation sample x based on the parameter α of the attack unit. (1) (For example, to incorporate the perturbation in the second step) The second perturbation sample x is then obtained and output. (2) The second step perturbation sample x (2) It is input into attack unit 3 (not shown).

[0052] And so on, the final attack unit K processes the perturbation sample x from step (K-1) based on its parameter α. (K-1) (For example, to incorporate the perturbation at step K) Then, the perturbation sample x at step K is obtained and output. (K) The output of the Kth step perturbation sample x (K) This refers to the adversarial examples output by the parameterized attacker 100, which incorporate near-optimal adversarial perturbations. Based on these, the attack examples can be used to train a model, so that the error function can be optimized by learning from the adversarial examples containing the aforementioned near-optimal adversarial perturbations through outer min. Minimize, thereby obtaining a more robust neural network model f. θ .

[0053] Figure 2 A block diagram of a single-step attack unit 200 in a parameterized attacker according to one aspect of this disclosure is shown. This parameterized attacker may include or constitute the above-described combination. Figure 1 The described parameterized attacker 100. Figure 2 The single-step attack unit 200 may include or constitute the above combination. Figure 1 Any step of the attack unit in the described parameterized attacker 100.

[0054] Figure 2 The single-step attack unit 200 may include, but is not limited to, a gradient unit 202, a linear projection unit 204, a hyperparameter embedding unit 206, a hyperparameter score calculation unit 208, and a perturbation determination unit 210.

[0055] According to an exemplary embodiment, the attack unit k(200) takes x (k-1) For input. The input x (k-1) It is provided to gradient unit 202 to determine model f θ The gradient of the loss function on the input data after the (k-1)th perturbation step is the gradient that contains the current training model f. θ And input x (k-1) Information about its label y.

[0056] The calculated gradient is linearly projected onto the vector space by the linear projection unit 204 to obtain the query of the current model.

[0057] On the other hand, the hyperparameter embedding unit 206 can embed candidate values ​​of hyperparameters as consecutive keys. In the context of this disclosure, hyperparameters may include, for example, the number of steps, the operation constituting each step unit, and / or the step size. According to an exemplary embodiment, the hyperparameters to be embedded in a single-step attack unit may include, for example, attack operations (e.g., perturbation operators), step sizes, etc., or any combination thereof.

[0058] According to an exemplary embodiment, the hyperparameter embedding unit 206 can project multiple candidate values ​​of the attack operation (e.g., multiple perturbation operators) into a continuous embedding space to become several corresponding keys through embedding, and project multiple candidate values ​​of the step size into a continuous embedding space to become several corresponding keys through embedding.

[0059] The hyperparameter score calculation unit 208 obtains the queries and these keys of the current model, and calculates the scores of the candidate values of the hyperparameters by using, for example, an attention mechanism. The attention mechanism calculates the similarity between the queries and the keys to obtain the attention distribution values corresponding to the queries on each key. The corresponding attention distribution value is the value or score reflecting the probability of the candidate value. The value or score can be normalized (for example, to obtain the probability of the candidate value).

[0060] The perturbation determination unit 210 determines the optimal values of the hyperparameters (for example, the optimal perturbation operation and the optimal step size) to be used by the current attack unit based on the scores of each candidate value, and obtains the output x of the current attack unit by incorporating the corresponding perturbation (for example, the perturbation including the optimal perturbation operation and the optimal step size). (k) , and can correspondingly iteratively train the model f θ and the attacker α (including the parameters of, for example, the hyperparameter embedding unit 206 and the linear projection unit 204 of the attack unit).

[0061] Figure 3 FIG. shows a block diagram of the single-step attack unit 300 in the parameterized attacker according to another aspect of the present disclosure. The parameterized attacker may include or constitute the parameterized attacker 100 described above in combination with Figure 1 described.

[0062] Figure 3 The single-step attack unit 300 may include, but is not limited to, a gradient unit 302, a linear projection unit 304, a perturbation block 306-A, a step size block 306-B, a hyperparameter score calculation unit 308, and a perturbation determination unit 310.

[0063] According to an exemplary embodiment, the attack unit k (300) takes x (k-1) as an input. Depending on k, x (k-1) may be the initial input data (for example, k = 1) or the input data after the previous-step perturbation attack (for example, 1 < k <= K). The input x (k-1) is provided to the gradient unit 302 to determine the gradient of the loss function of the model f θ on the input data after the (k - 1)-step perturbation. This gradient contains the information of the current training model f θ and the input x (k-1) and its label y. For example, according to an exemplary embodiment, the gradient g (k-1) can be calculated according to the following formula:

[0064]

[0065] The calculated gradient g of the (k - 1)-step(k-1) Subsequently, the linear projection unit 304 passes through a weight matrix. The gradient encoder φ is linearly projected into the latent space as the query Q(query).

[0066] On the other hand, attack unit k 300 can embed candidate values ​​of hyperparameters. For example, attack unit k 300 can embed candidate perturbation values ​​through perturbation block 306-A. p1 o p2 o p3 o p4 ...make a selection and use the corresponding step size block 306-B to select the candidate step size o respectively. s1 o s2 o s3 o s4 ...make a selection as the hyperparameter value for the attack unit k 300 in this step.

[0067] Herein, although the candidate perturbation is described as including four candidate perturbation operations and the candidate step size is described as correspondingly including four candidate step sizes, it will be understood by those skilled in the art that this disclosure is not limited thereto, but may include more and / or fewer candidate perturbations and candidate step sizes.

[0068] Perturbation block 306-A performs each candidate perturbation operation from these candidate perturbations by learning an embedding (e.g., by a weight matrix). (represented) is projected into a continuous embedding space to become several keys e corresponding to the operation. p1 e p2 e p3 e p4 Similarly, step block 306-B will embed the candidate step sizes corresponding to these candidate perturbation operations using learned embeddings (e.g., from the weight matrix W). s (k-1) (represented) is projected into a continuous embedding space to become several keys e corresponding to the candidate step size. s1 e s2 e s3 e s4 ...

[0069] Attack unit k 300 can compute scores for candidate hyperparameter values ​​using, for example, an attention mechanism. For instance, a key and query can be input to hyperparameter score calculation unit 308 to compute scores for candidate hyperparameter values. According to an exemplary embodiment, hyperparameter score calculation unit 308 may be based on an attention mechanism. For example, in one exemplary embodiment, hyperparameter score calculation unit 308 may include two attention units for the perturbation operation and the step size, respectively, and corresponding normalization units. For example, the normalization unit may be based on a Softmax unit to normalize the scores obtained by the attention units (e.g., the probability of obtaining the candidate value).

[0070] According to an exemplary embodiment, since the perturbation operation is a discrete value, the normalization unit for the perturbation operation in the hyperparameter score calculation unit 308 can use the Gumbel Softmax normalized sampling unit so that gradients can be backpropagated for training.

[0071] For example, according to an exemplary embodiment, the key e representing a candidate perturbation operation p1 e p2 e p3 e p4 ...The query, along with the input query, is fed into the attention unit for perturbation to calculate the similarity between the query and the key, obtaining the attention distribution value corresponding to the query on each key as the value or score of the candidate perturbation operation. This corresponding attention distribution value reflects the probability of the candidate perturbation operation corresponding to that key. The probability of the current attack unit k 300 on each candidate attack operation is normalized using a normalization sampling unit (e.g., Gumbel Softmax), and then sampled based on the resulting probability (i.e., the normalized and sampled (e.g., one-hot) score). For example, according to an exemplary embodiment, if the probability of a candidate attack operation is p, then the candidate value has a probability equal to p that it is sampled by Gumbel Softmax as, for example, a one-hot encoded score.

[0072] Similarly, the key e representing the candidate step size s1 e s2 e s3 e s4...Also, along with the query, it is input into the attention unit used for step size to calculate similarity and obtain the attention distribution value corresponding to the query on each key, which serves as the value or score of the candidate step size. This corresponding attention distribution value reflects the probability of the candidate step size corresponding to that key. After normalization by a normalization unit (e.g., a Softmax unit), the probability of the current attack unit k300 at each candidate step size is obtained (i.e., the normalized score).

[0073] The output of the hyperparameter score calculation unit 308 (e.g., the normalized sampled score of the candidate perturbation operation and / or the normalized score of the candidate step size) can be provided to the perturbation determination unit 310 to determine the perturbation to be used by the current attack unit k300. For example, according to an exemplary embodiment, the perturbation determination unit 310 may determine the perturbation operation to be used by the current attack unit k 300 based on the normalized sampling score of the candidate perturbation operation, and / or may determine the step size to be used by the current attack unit k 300 based on the normalized score of the candidate step size.

[0074] According to some exemplary embodiments, the normalized sampling score of the candidate perturbation operation may include a one-hot encoding, thereby the perturbation determination unit 310 can directly determine the candidate perturbation operation corresponding to the one-hot encoding as the optimal perturbation operation to be used by the current attack unit k 300.

[0075] According to some exemplary embodiments, the normalized score of the candidate step length may include the form of a probability vector, and the perturbation determination unit 310 may use this probability vector as a weighted sum with the candidate values ​​of the step length to determine the optimal step length to be used by the current attack unit k 300.

[0076] Although the input provided by the hyperparameter score calculation unit 308 to the perturbation determination unit 310 is described here using probability as an example, those skilled in the art will understand that the input is not limited to the form of probability, but can be in various other forms that reflect the probability distribution of candidate values ​​of hyperparameters.

[0077] According to an exemplary embodiment, the disturbance to be used by the current attack unit k 300 The perturbation can be determined based on the determined perturbation operation and step size to be used, as well as the gradient of the current model's loss function on the input data of the current attack unit k 300. According to at least some exemplary embodiments, the perturbation... It can be determined based on the product of the perturbation operation and step size to be used and the gradient of the current model's loss function on the input data of the current attack unit k 300.

[0078] The disturbance determination unit 310 will determine the disturbance to be used. Acting on input x (k-1) To obtain the updated output, for example, through methods such as To obtain the updated output.

[0079] During model training, for each batch of data (X, Y) (e.g., X represents the set of samples x in that batch, and Y represents the set of corresponding labels y), the hyperparameters selected by the current attack unit k (e.g., optimal perturbation operation, optimal step size) are used to obtain the target data for the current batch X by the current attack unit k. (k-1) and model f θ Counter-disturbance For example, according to an exemplary embodiment, for the current batch of data X (k-1) and model f θ Adversarial perturbation of the current attack unit k It can be based on the determined attack operation and step size in the current attack unit k 300. For example, according to at least some exemplary embodiments, for the current batch of data X (k-1) and model f θ Counter-disturbance Based on the values ​​representing the optimal attack operation and the optimal step size determined in the current attack unit k 300, and model f θ The loss function is the product of the gradients of the input data after the (k-1)th perturbation.

[0080] Additionally, the current model f can be calculated. θ In the current batch of data X (k-1) Total loss Because the perturbation operation is sampled using Gumbel Softmax normalization, the choice of the perturbation operation is differentiable with respect to the attacker α, thus allowing for a change in the total loss. Perform backpropagation to iteratively train model f θ The current weights of the attacker α (e.g., the weight matrix including at least perturbation block 306-A) are compared with those of the attacker α. The weight matrix W of step block 306-B s (k-1) and the weight matrix of the linear projection unit 304. (one or more of them).

[0081] Figure 4 Pseudocode 400 of a parameterized attacker according to one aspect of this disclosure is shown. Figure 4 As shown, an automated adversarial training A with K attack units is described. 2 T K Parameterized attackers can take the training dataset (X,Y) and the number of training steps K are the inputs.

[0082] First, initialize the parameter set θ of the neural network and the attacker α. According to an exemplary embodiment, N can be performed. ep Round of defensive model training, where N ep >=1. For this N ep In each round of training the defensive model, the initial adversarial perturbation is made. It is set to 0 and makes the initial input the natural dataset X in the training dataset.

[0083] Subsequently, for each of the K attack units, based on the current model f θ In the current batch of data X (k-1) Total loss To calculate the gradient g (k-1) For example, according to an exemplary embodiment, gradient g (k-1) Based on the current model f θ In the current batch of data X (k-1) Total loss The gradient is used for calculation.

[0084] Subsequently, according to gradient g (k-1) To construct the current attack unit k against X (k-1) disturbance For example, according to an exemplary embodiment, to counteract disturbances This can be based on the optimal attack operation and step size determined in the current attack unit. For example, according to at least some exemplary embodiments, it can be used to counteract disturbances. Based on the optimal attack operation, optimal step size, and model f determined in the current attack unit k 300, θ The loss function is determined by the product of the gradients on the input data after the (k-1)th perturbation step.

[0085] Subsequently, by incorporating X (k-1) disturbance To update the X of the current attack unit k (k) According to an exemplary embodiment, for example, it can be achieved by considering X. (k) Each x in (k) , in the form of To obtain the updated output.

[0086] After the attack by K attack units is completed, the parameter set θ of the neural network and the attacker α are updated respectively using all the optimal gradients and step sizes accumulated over a total of K steps. The update of the parameter set θ of the neural network can include updates based on model f. θThe model is updated using the gradient of the loss function for the batch of training samples that incorporates a total of K perturbations, and updating the attacker α may include updating the attacker α based on the gradient of the error function and the step size while maximizing the loss function (e.g., by using the optimal perturbation and step size for a total of K steps). For example, according to an exemplary embodiment, the attacker α may be updated based on the product of the gradient of the error function and the step size. According to an exemplary embodiment, the attacker's parameter α may be updated by adding the original attacker α to the product of the gradient of the error function and the step size. According to at least some exemplary embodiments, the attacker's parameter α may, for example, include at least a weight matrix for embedding candidate values ​​of hyperparameters as continuous keys and a weight matrix for linearly projecting the gradient into the latent space as a query. One or more of them.

[0087] The pseudocode 400 above describes an exemplary process for automated adversarial training according to exemplary aspects of this disclosure; however, those skilled in the art will understand that the steps may be organized and performed in different order and at different levels without departing from the scope of this disclosure.

[0088] Figure 5 A comparative schematic diagram 500 of automated adversarial training, standard training, and prior art adversarial training according to one aspect of this disclosure is shown.

[0089] As shown in the figure, X and Y represent the training dataset. The model represents the defensive model, i.e., the neural network f. θ In the middle, the box on the left of each step represents the attack operation, and the box on the right represents the step size hyperparameter when constructing the attack.

[0090] The left side shows normal standard model training: In machine learning, the data is input into the model without transformation (i.e., the attack method is an identity transformation with a step size of 0, so the perturbation δ is equivalent to 0, thus not affecting the training dataset) for training.

[0091] The middle section is adversarial training, which mainly constructs attacks through manually selected hyperparameters (e.g., the attack method is FGM, and the attack step size is 0.007). (For example, using PGD...) 10 There are a total of 10 attack steps (represented by ellipses). The perturbation δ generated by each attack step is used to update the input X, and the updated input X and its label Y are provided to the model for training.

[0092] The right side shows the automated adversarial training method disclosed herein. According to this automated adversarial training method, the generation of the adversarial perturbation δ is considered as several steps of gradient g. (k) The combination of these factors allows for the determination of the optimal attack at each step (e.g., including the attack operation and step size) and the corresponding optimal perturbation by searching the perturbation space.

[0093] In each step, the left box represents the attack operation, and the right box represents the step size hyperparameter when constructing the attack. It can be seen that there are several candidate attacks and corresponding candidate step sizes in the attack operation; bold indicates the selected one. That is, in the automated adversarial training disclosed herein, in each attack step, the attacker selects (as shown in bold) hyperparameters (e.g., attack operation and attack step size) from several candidates in the perturbation space, and then generates the perturbation for that attack step. The input X is updated, and the updated input X, along with its label Y, is fed into the model for training.

[0094] Figure 6 A flowchart of an automated adversarial training method 600 according to one aspect of this disclosure is shown. Figure 6 The automated adversarial training method 600 may include, for example, in box 602, obtaining a raw training dataset and a model trained using the raw training dataset, the raw training dataset including input data and its labels.

[0095] For example, according to an exemplary embodiment, a raw training dataset including input data and its labels can be obtained, and the raw training dataset can be used to train a model to obtain a trained model. However, since the raw training dataset has a limited number of samples, the model trained in this way may misclassify when faced with small perturbations.

[0096] In block 604, method 600 may include automatically perturbing the input data for a predetermined number of steps. The perturbation for the predetermined number of steps may include, for example, using automated machine learning techniques (i.e., AutoML-based) to search in a perturbation space that integrates multiple attacks to construct diverse adversarial examples to solve an optimization problem of adversarial examples.

[0097] For example, the perturbation space may include various combinations of values ​​for multiple hyperparameters. According to an exemplary embodiment, hyperparameters may include, but are not limited to, the number of steps, the perturbation operation (i.e., the perturbation operator) constituting each attack unit, and the step size.

[0098] In box 606, method 600 may include using updated input data and its labels, after a predetermined number of perturbations, as an adversarial training dataset to further optimize the training of the model.

[0099] For example, to detect client misuse risks, a neural network model can be trained on a raw training dataset including input data and its labels to determine whether client misuse has occurred based on user behavior patterns. To improve the model's robustness, adversarial training can be used. Existing adversarial examples are constructed using a single method, resulting in models trained adversarially that are only robust against specific attacks and cannot cope with the diverse attack methods used by cybercriminals in misuse scenarios. By using the automated adversarial training method according to this disclosure to perturb the input data, and using the updated input data and its labels after the aforementioned predetermined number of perturbations as the adversarial training dataset to further train the model, the robustness of the model against the perturbations can be optimized and enhanced. Since the perturbation space can be predefined, and the optimal solution for each perturbation step is automatically determined, the efficiency of adversarial training is greatly improved and the effect of adversarial training is enhanced.

[0100] Figure 7 A flowchart of an automatic perturbation attack sub-method 700 according to one aspect of this disclosure is shown. Figure 7 The automatic perturbation attack sub-method 700 can be used for, for example... Figure 6 Box 604 automatically perturbs the input data a predetermined number of steps. For example, sub-method 700 can be derived from the combination of the above. Figure 6 The description box is 602.

[0101] like Figure 7 As shown, in decision box 702, it is determined whether the predetermined number of steps has been attacked. If not, sub-method 700 proceeds to box 704.

[0102] In block 704, sub-method 700 may include automatically searching for hyperparameter values ​​optimal for the current perturbation step within a predefined attack hyperparameter search space. According to an exemplary embodiment, hyperparameters may include, but are not limited to, the perturbation operation (e.g., perturbation operator) and step size constituting each attack unit. For example, automatically searching for hyperparameter values ​​optimal for the current perturbation step may include automatically searching for hyperparameter values ​​optimal for the current perturbation step by using the aforementioned methods to compute scores of candidate hyperparameter values ​​using, for example, an attention mechanism.

[0103] In box 706, sub-method 700 may include automatically determining the perturbation for the current step based on optimal hyperparameter values. For example, automatically determining the perturbation for the current step based on optimal hyperparameter values ​​may include constructing the perturbation according to the gradient determined based on the selection of optimal hyperparameter values, as previously described.

[0104] In block 708, sub-method 700 may include updating the input data by incorporating a perturbation from the current step. For example, updating the input data by incorporating a perturbation from the current step may include adding the perturbation from the current step to the input data.

[0105] Subsequently, sub-method 700 returns to decision box 702 to determine whether the predetermined number of attacks has been completed. If not, sub-method 700 proceeds to box 704. If yes, sub-method 700 terminates and can proceed to, for example, the combination described above. Figure 6 The description box is 606.

[0106] The above combination Figure 6 and / or Figure 7 The described method 600 and sub-method 700 can be implemented in various ways. For example, method 600 and sub-method 700 can be implemented in software, firmware, and / or hardware using automated machine learning techniques (i.e., AutoML-based). According to some exemplary embodiments, method 600 and sub-method 700 can be implemented by a processor executing a program stored in memory. According to other exemplary embodiments, method 600 and sub-method 700 can be implemented as processor-executable instructions stored on a computer-readable medium. Regardless of the implementation method, method 600 and sub-method 700 can be further incorporated and / or employ any of the schemes, techniques, and / or features described above.

[0107] The technical solutions disclosed herein can be applied to scenarios such as detecting client-side theft risks. For example, when using a neural network model to determine whether client-side theft has occurred based on user behavior patterns, perturbation attacks can be used to improve the model's robustness and performance. The diverse attack methods formed through the automated combination of these disclosed techniques can enhance the model's defense against different attacks, resulting in better robustness. The construction of adversarial examples can also be considered a data augmentation technique, improving model performance even when data is insufficient.

[0108] The above descriptions are merely exemplary embodiments of the present invention. However, the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

[0109] The various illustrative logic blocks, modules, and circuits described in this disclosure can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA) or other programmable logic device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, the processor may be any commercially available processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0110] The steps of the methods or algorithms described in this disclosure can be implemented directly in hardware, in a software module executed by a processor, or in a combination of both. The software module can reside in any form of storage medium known in the art. Some examples of usable storage media include random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, hard disks, removable disks, CD-ROMs, and so on. The software module can include a single instruction or many instructions, and can be distributed across several different code segments, across different programs, and across multiple storage media. The storage medium can be coupled to the processor so that the processor can read and write information from / to the storage medium. Alternatively, the storage medium can be integrated into the processor.

[0111] The methods disclosed herein include one or more steps or actions for achieving the described methods. These method steps and / or actions may be interchanged with each other without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and / or use of specific steps and / or actions may be modified without departing from the scope of the claims.

[0112] A processor can execute software stored on a machine-readable medium. The processor may be implemented using one or more general-purpose and / or special-purpose processors. Examples include microprocessors, microcontrollers, DSP processors, and other circuit systems capable of executing software. Software should be interpreted broadly as instructions, data, or any combination thereof, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. As examples, a machine-readable medium may include RAM (random access memory), flash memory, ROM (read-only memory), PROM (programmable read-only memory), EPROM (erasable programmable read-only memory), EEPROM (electrically erasable programmable read-only memory), registers, disks, optical disks, hard drives, or any other suitable storage medium, or any combination thereof. The machine-readable medium may be implemented in a computer program product. This computer program product may include packaging materials.

[0113] In hardware implementations, machine-readable media can be a separate part of the processing system from the processor. However, as those skilled in the art will readily appreciate, machine-readable media or any portion thereof can be external to the processing system. As examples, machine-readable media may include transmission lines, data-modulated carrier waves, and / or computer products separate from wireless nodes, all accessible to the processor via a bus interface. Alternatively or additionally, machine-readable media or any portion thereof may be integrated into the processor, such as caches and / or general-purpose register files.

[0114] The processing system can be configured as a general-purpose processing system having one or more microprocessors providing processor functionality, and external memory providing at least a portion of machine-readable medium, all linked to other supporting circuitry via an external bus architecture. Alternatively, the processing system can be implemented using an ASIC (Application-Specific Integrated Circuit) with a processor, bus interface, user interface (in the case of an access terminal), supporting circuitry, and at least a portion of machine-readable medium integrated on a single chip, or using one or more FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), controllers, state machines, gated logic, discrete hardware components, or any other suitable circuitry, or any combination of circuitry capable of performing the various functionalities described throughout this disclosure. Depending on the specific application and the overall design constraints imposed on the system, those skilled in the art will recognize how the functionality described regarding the processing system can be implemented.

[0115] Machine-readable media may include several software modules. These software modules include instructions that, when executed by a device (such as a processor), cause the processing system to perform various functions. These software modules may include transfer modules and receive modules. Each software module may reside in a single storage device or be distributed across multiple storage devices. As an example, when a trigger event occurs, a software module may be loaded from a hard drive into RAM. During the execution of a software module, the processor may load some instructions into a cache to improve access speed. One or more cache lines may subsequently be loaded into a general-purpose register file for processor execution. In the context of the functionality of the software module described below, it will be understood that such functionality is implemented by the processor when the processor executes the instructions from the software module.

[0116] If implemented in software, the functions can be stored or transmitted as one or more instructions or codes on or through a computer-readable medium. Computer-readable media includes both computer storage media and communication media, encompassing any medium that facilitates the transfer of a computer program from one location to another. Storage media can be any available medium accessible to a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Any connection is also legitimately referred to as computer-readable media. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared (IR), radio, and microwave), then that coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is included in the definition of medium. The disks and discs used in this article include CDs, laser discs, optical discs, DVDs, floppy disks, and... Disks, where disks often magnetically reproduce data, and discs optically reproduce data using lasers. Therefore, in some aspects, computer-readable media can include non-transient computer-readable media (e.g., tangible media). Additionally, in other aspects, computer-readable media can include transient computer-readable media (e.g., signals). Combinations of the above should also be included within the scope of computer-readable media.

[0117] Therefore, certain aspects may include computer program products for performing the operations set forth herein. For example, such computer program products may include computer-readable media on which instructions are stored (and / or encoded) that can be executed by one or more processors to perform the operations described herein. In some aspects, computer program products may include packaging materials.

[0118] It will be understood that the claims are not limited to the precise configurations and components described above. Various modifications, substitutions, and variations can be made to the layout, operation, and details of the methods and apparatus described above without departing from the scope of the claims.

Claims

1. An automated adversarial training method, comprising: Obtain the original training dataset for client-side theft and the model trained using the original training dataset, wherein the original training dataset includes input data and its labels; The input data is automatically perturbed for a predetermined number of steps, including for each of the predetermined number of steps: The system automatically searches for the optimal hyperparameter values ​​for this perturbation within a predefined attack hyperparameter search space. The perturbation in this step is automatically determined based on the optimal hyperparameter values. as well as The input data is updated by incorporating the perturbation in this step to automatically enhance the diversity of the input data; as well as The model is further optimized to counter the perturbation using an adversarial training dataset comprising updated input data and its labels after the predetermined number of perturbations, as diverse adversarial examples. The predefined attack hyperparameter search space includes hyperparameters with candidate values, and the hyperparameters include at least the perturbation operation and step size for each step. The automatic search for the optimal hyperparameter values ​​for this perturbation in the predefined attack hyperparameter search space includes using an attention mechanism to determine the score of the hyperparameter at each candidate value and determining the optimal hyperparameter values ​​for this perturbation based on the scores. Determining the score of the hyperparameter for each candidate value using an attention mechanism includes: The query is determined based on the input data from this step; Embed each candidate value as its corresponding key; and The attention distribution value of the query on each key is obtained using an attention mechanism, which is then used as the score of the hyperparameter on the corresponding candidate value. Determining the score of hyperparameters at each candidate value using an attention mechanism further includes applying the appropriate attention mechanism to the perturbation operation and the step size to compute their scores at their respective candidate values; and wherein Determining the optimal hyperparameter values ​​for the perturbation in this step based on the scores includes using Gumbel Softmax as a normalized sampling unit for the scores of the perturbation operation on its candidate values, and using Softmax as a normalized unit for the scores of the step size on its candidate values, wherein... The perturbation in this step is automatically determined based on the optimal hyperparameter values, including: The perturbation for this step is determined based on the optimal perturbation operation value, the optimal step size value, and the gradient of the model's loss function on the input data for this step. Based on the input data in this step, the query is determined to include: Determine the gradient of the model's loss function on the input data at this step; and The gradient is linearly projected onto the query.

2. The automated adversarial training method as described in claim 1, wherein, The candidate values ​​for the perturbation operation include one or more of the following perturbation operators or any combination thereof: FGM, FGSM, FGMM, Gaussian noise, and identity transformation.

3. The automated adversarial training method as described in claim 1, wherein, The candidate values ​​for the step size include one or more of the following step sizes or any combination thereof: 0.0001, 0.001, 0.01, 0.1, 1.

4. The automated adversarial training method as described in claim 1, wherein, The automatic perturbation of the input data for a predetermined number of steps includes using the input data of the original training dataset as the input for the first perturbation, using the input data after each perturbation as the input for the next perturbation, and using the input data after the last perturbation as the updated input data in the adversarial training dataset.

5. The automated adversarial training method as described in claim 1, wherein, Further optimization of the model using the adversarial training dataset, which includes the updated input data and its labels after the predetermined number of perturbations, includes: The model is updated based on the gradient of the loss function of the model on the adversarial training dataset.

6. The automated adversarial training method as described in claim 1, wherein, The input data includes the user's behavior patterns on the client's APP, and the model is used to determine whether client-side misuse has occurred.

7. An automated adversarial training device, comprising: A module for obtaining the original training dataset for client-side theft and a model trained using the original training dataset, the original training dataset including input data and its labels; A module for automatically perturbing the input data for a predetermined number of steps, including for each of the predetermined number of steps: The system automatically searches for the optimal hyperparameter values ​​for this perturbation within a predefined attack hyperparameter search space. The perturbation in this step is automatically determined based on the optimal hyperparameter values. as well as The input data is updated by incorporating the perturbation in this step to automatically enhance the diversity of the input data; as well as A module further optimizes the model to counter the perturbation using an adversarial training dataset comprising updated input data and its labels after the predetermined number of perturbations as diverse adversarial examples, wherein... The predefined attack hyperparameter search space includes hyperparameters with candidate values, and the hyperparameters at least include the perturbation operation and step size for each step of the perturbation, wherein, The module for automatically searching for the optimal hyperparameter values ​​for the perturbation in a predefined attack hyperparameter search space includes a module for using an attention mechanism to determine a score for the hyperparameter at each candidate value and determining the optimal hyperparameter values ​​for the perturbation in this step based on the scores, wherein... The module for using an attention mechanism to determine the score of the hyperparameter at each candidate value includes: A module for determining the query based on the input data in this step; A module for embedding each candidate value as its corresponding key; and A module for using an attention mechanism to obtain the attention distribution value of the query on each key as the score of the hyperparameter on the corresponding candidate value, wherein The module for determining the score of hyperparameters at each candidate value using an attention mechanism further includes modules for calculating the scores of the perturbation operation and the step size at their respective candidate values ​​using appropriate attention mechanisms; and wherein The module for determining the optimal hyperparameter value for the perturbation at this step based on the score includes a module for normalizing the sampling unit using Gumbel Softmax as the score of the perturbation operation on its candidate values, and a module for normalizing the step size on its candidate values ​​using Softmax, wherein... The module for automatically determining the perturbation in this step based on the optimal hyperparameter values ​​includes: A module for determining the perturbation for this step based on the optimal perturbation operation value, the optimal step size value, and the gradient of the model's loss function on the input data for this step, wherein The module used to determine the query based on the input data in this step includes: A module for determining the gradient of the model's loss function on the input data at this step; and A module for linearly projecting the gradient into the query.

8. The automated adversarial training device as described in claim 7, wherein, The candidate values ​​for the perturbation operation include one or more of the following perturbation operators or any combination thereof: FGM, FGSM, FGMM, Gaussian noise, and identity transformation.

9. The automated adversarial training device as described in claim 7, wherein, The candidate values ​​for the step size include one or more of the following step sizes or any combination thereof: 0.0001, 0.001, 0.01, 0.1, 1.

10. The automated adversarial training device as described in claim 7, wherein, The module for automatically perturbing the input data for a predetermined number of steps includes a module for using the input data of the original training dataset as the input for the first perturbation, a module for using the input data after each perturbation as the input for the next perturbation, and a module for using the input data after the last perturbation as the updated input data in the adversarial training dataset.

11. The automated adversarial training device as described in claim 7, wherein, Modules for further optimizing the model using the adversarial training dataset, which includes the updated input data and its labels after the predetermined number of perturbations, include: A module for updating the model based on the gradient of the loss function of the model on the adversarial training dataset.

12. The automated adversarial training device as described in claim 7, wherein, The input data includes the user's behavior patterns on the client's APP, and the model is used to determine whether client-side misuse has occurred.

13. An automated adversarial training device, comprising: Memory, used to store instructions; as well as A processor, coupled to the memory and configured to execute the instructions to: Obtain the original training dataset for client-side theft and the model trained using the original training dataset, wherein the original training dataset includes input data and its labels; The input data is automatically perturbed for a predetermined number of steps, including for each of the predetermined number of steps: The system automatically searches for the optimal hyperparameter values ​​for this perturbation within a predefined attack hyperparameter search space. The perturbation in this step is automatically determined based on the optimal hyperparameter values. as well as The input data is updated by incorporating the perturbation in this step to automatically enhance the diversity of the input data; as well as The model is further optimized to counter the perturbation using an adversarial training dataset comprising updated input data and its labels after the predetermined number of perturbations, as diverse adversarial examples. The predefined attack hyperparameter search space includes hyperparameters with candidate values, and the hyperparameters include at least the perturbation operation and step size for each step. The automatic search for the optimal hyperparameter values ​​for this perturbation in the predefined attack hyperparameter search space includes using an attention mechanism to determine the score of the hyperparameter at each candidate value and determining the optimal hyperparameter values ​​for this perturbation based on the scores. Determining the score of the hyperparameter for each candidate value using an attention mechanism includes: The query is determined based on the input data from this step; Embed each candidate value as its corresponding key; and The attention distribution value of the query on each key is obtained using an attention mechanism, which is then used as the score of the hyperparameter on the corresponding candidate value. Determining the score of hyperparameters at each candidate value using an attention mechanism further includes applying the appropriate attention mechanism to the perturbation operation and the step size to compute their scores at their respective candidate values; and wherein Determining the optimal hyperparameter values ​​for the perturbation in this step based on the scores includes using Gumbel Softmax as a normalized sampling unit for the scores of the perturbation operation on its candidate values, and using Softmax as a normalized unit for the scores of the step size on its candidate values, wherein... The perturbation in this step is automatically determined based on the optimal hyperparameter values, including: The perturbation for this step is determined based on the optimal perturbation operation value, the optimal step size value, and the gradient of the model's loss function on the input data for this step. Based on the input data in this step, the query is determined to include: Determine the gradient of the model's loss function on the input data at this step; and The gradient is linearly projected onto the query.

Images