An AI security attack and defense test method

Abstract

The application discloses an AI security attack and defense test method, comprising a software and hardware cooperative security test process and a whole-cycle automatic security test method. The application aims at the defects that a large-scale and complex AI system is difficult to be comprehensively detected, current security test methods are single in function and poor in universality, summarizes steps of an AI system life cycle, analyzes attack methods and corresponding defense strategies existing in each link through a whole-cycle automatic adaptive security test method, and constructs a security test process, so that comprehensive security defense of the AI system in an actual deployment environment is supported.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of artificial intelligence (AI) security technology, and particularly relates to an AI security attack and defense test method. BACKGROUND

[0002] In recent years, the rapid development of artificial intelligence technology has brought profound changes to human social life, and has promoted the leap from digitization and networking to intelligence in various fields of economic society. At the same time, the security risks of artificial intelligence technology have gradually been exposed. However, due to the current overall development level of artificial intelligence still being in the initial stage, the representative artificial intelligence technology of deep learning generally has limitations in robustness and explainability, and people's understanding of the inherent vulnerability of highly complex artificial intelligence systems is still insufficient, lacking effective security verification, testing and enhancement means, which seriously hinders the wide application of artificial intelligence technology. In actual use scenarios, there are also problems such as complex AI system data link environment, diverse model running software framework and hardware system types, and diverse AI attack methods. SUMMARY

[0003] The purpose of the present application is to provide an AI security attack and defense test method to overcome the shortcomings of the prior art.

[0004] The purpose of the present application is achieved by the following technical solution: an AI security attack and defense test method, comprising the following steps:

[0005] (1) inputting a to-be-tested AI model file and inputting feature data of the AI model;

[0006] (2) performing a full-cycle automated security test method on the to-be-tested AI model feature data input in step (1); constructing an attack and defense knowledge graph by a knowledge graph method, and performing knowledge reasoning to obtain attack and defense algorithms of the input to-be-tested AI model in the data collection and preprocessing stage, and the training and testing stage, and the hardware adaptation environment in the deployment stage;

[0007] (3) performing first-stage testing: according to the first-stage attack method and defense method in the knowledge reasoning result of step (2), performing attack and defense testing of the AI model data collection and preprocessing stage;

[0008] (4) performing second-stage testing: according to the second-stage attack method and defense method in the knowledge reasoning result of step (2), performing attack and defense testing of the AI model training and testing stage;

[0009] (5) AI system deployment online testing: simulating and adapting the system hardware environment in the knowledge reasoning result of step (2) that is most suitable for the to-be-tested AI model to the AI model to obtain an AI model software and hardware adaptation result;

[0010] (6) The data collected in the data collection and preprocessing stage of the AI life cycle, the test results in the training and testing stage, and the test results in the deployment stage are integrated into a test report, and different stage security defense strategies and security deployment methods are provided.

[0011] Further, in step (1), the feature data of the AI model includes dataset type, model type, framework type, and training parameter.

[0012] Further, step (2) includes the following sub-steps:

[0013] (2.1) Determine the node type and relationship type of the AI model attack and defense knowledge graph to form a knowledge graph node relationship rule;

[0014] Eight node types, six relationship types, and nine triple types of knowledge graphs are established. The node types are "model ontology", "dataset type", "model type", "framework type", "training parameter", "system hardware environment", "attack algorithm", and "defense algorithm". The relationship types are "belongs to", "first stage attack", "second stage attack", "first stage defense", "second stage defense", and "software and hardware adaptation". Among them, "dataset type", "model type", "framework type", and "training parameter" all have a "belongs to" relationship with "model ontology", forming four triple types. "Attack algorithm" and "model ontology" form "first stage attack" and "second stage attack" relationships, forming two triple types. "Defense algorithm" and "model ontology" form "first stage defense" and "second stage defense" relationships, forming two triple types. "System hardware environment" and "model ontology" form a "software and hardware adaptation" relationship, forming one triple type.

[0015] (2.2) According to the node relationship rule of step (2.1), the data for constructing the graph is obtained by crawling;

[0016] According to the keywords of AI papers, the text information in the paper database is crawled. The text information contains node and relationship information of the node types and relationship types described in step (2.1), and the node and relationship information is extracted into regularized data through regular extraction and entity extraction methods;

[0017] (2.3) Form triplets from the data through the node relationship rule and form the AI model attack and defense knowledge graph;

[0018] The extracted regularized data is grouped into triplets according to the node relationship rule of step (2.1) and stored in a graph database to form a complete knowledge graph.

[0019] Meanwhile, the triplets in the whole attack and defense knowledge graph are converted into matrix form through knowledge embedding to obtain an embedding matrix, and the embedding matrix exists as another form of the knowledge graph.

[0020] (2.4) Matching the feature data of the AI model to be tested with the attack and defense knowledge graph constructed in step (2.3), reasoning the corresponding attack and defense methods through the relationship between nodes in the life cycle, and testing using the corresponding attack and defense methods.

[0021] Further, in the matching and reasoning link of step (2.4):

[0022] (2.4.1) The feature data of the AI model to be tested needs to be converted into a vector form through knowledge embedding to obtain a feature vector;

[0023] (2.4.2) According to the feature vector obtained in step (2.4.1) and the relationship vector in the embedding matrix converted from the attack and defense knowledge graph in step (2.3), the attack and defense methods in the first and second stages and the system hardware environment adapted to the AI model to be tested are calculated through the L1 distance as the knowledge reasoning result; the attack method in the first stage includes data poisoning attack or adversarial sample attack, and the defense method in the first stage includes abnormal data analysis and abnormal data cleaning; the attack method in the second stage includes backdoor attack or adversarial attack, and the defense method in the second stage includes robustness enhancement and model reinforcement, and the attack and defense algorithms are analyzed using standardized unit testing and robustness formal verification methods to analyze the attack and defense success rate of the AI model and the influence on the AI model;

[0024] (2.4.3) The knowledge reasoning result of step (2.4.2) is input into different stages of the software and hardware collaborative security test process for corresponding testing.

[0025] Further, step (3) includes the following sub-steps:

[0026] (3.1) According to the knowledge reasoning result of step (2), using the attack method in the first stage in the knowledge reasoning result, constructing an attack sample to pollute the data set used by the AI model, and realizing the attack in the data collection and preprocessing stage;

[0027] (3.2) Selecting an automatic abnormal data analysis method to analyze the sample characteristics and distribution of the input data set data of the attacked AI model, and using an automatic abnormal data cleaning method to automatically clean the abnormal input data set data after being attacked;

[0028] (3.3) Collecting the success rate of the attack method before and after defense to obtain the attack and defense success rate, analyzing the effect of different defense methods, and obtaining the attack and defense test result in the data collection and preprocessing stage.

[0029] Further, step (3.2) comprises the following sub-steps:

[0030] (3.2.1) In the abnormal data detection step: first, analyze the type of abnormal data: according to the comparison of the distribution characteristics of abnormal data and normal data, detect the type of abnormal data; then, process the abnormal data: according to the type of abnormal data, select the repaired data or discarded data; input the data that needs to be repaired into the automatic abnormal data cleaning step;

[0031] (3.2.2) In the automatic abnormal data cleaning step:

[0032] According to the knowledge reasoning result of step (2) of the full-cycle automatic security testing method, the first-stage defense method is obtained;

[0033] Using the first-stage defense method, the abnormal data detected in the abnormal data detection step (3.2.1) that needs to be repaired is cleaned.

[0034] Further, step (4) comprises the following sub-steps:

[0035] (4.1) According to the knowledge reasoning result of step (2), use the obtained backdoor attack or adversarial attack to trigger the backdoor or perturbation in the training and testing stage, and realize the attack in the training and testing stage;

[0036] (4.2) In the training link, according to the knowledge reasoning result of step (2), use the obtained second-stage defense method to enhance the robustness and model reinforcement of the AI model, and defend against the second-stage attack method;

[0037] (4.3) In the model testing link, the AI model is subjected to standardized unit testing and robustness formal verification, and the influence of the attack and defense on the AI model in the model training and testing process is analyzed;

[0038] (4.4) Collect the success rate of the attack method before and after the defense, obtain the attack and defense success rate, analyze the effect of different defense methods, and obtain the attack and defense test results of the model training and testing stage.

[0039] Further, in step (4.3), the standardized unit test comprises:

[0040] a1. Module unit test: test the functions of different modules of the model respectively, construct input data with predictable results, compare the predicted standard results with the actual module output results, and achieve the test purpose;

[0041] a2. Neuron coverage test: divide the output range of the neuron into multiple intervals of the same length, each interval representing a characteristic behavior of the neuron, and determine whether the logical behavior is covered by the test data by determining whether the output value of the neuron is contained in an interval.

[0042] Further, in step (4.3), the robust formal verification comprises:

[0043] b1. Using the knowledge reasoning result of step (2), selecting a suitable formal verification method according to the type of activation function of the AI model and the application scenario;

[0044] b2. Using the method selected in step b1, formal verification is performed on the AI model to be tested, and a robustness evaluation result is obtained.

[0045] Further, in step (6), the test report includes the vulnerable method and defense strategy and the attack and defense success rate of the AI model data collection and preprocessing stage, the vulnerable method and defense strategy and the attack and defense success rate of the training and testing stage, and the AI model software and hardware adaptation result.

[0046] The beneficial effects of the present application are: the present application uses a knowledge graph to combine attack and defense methods to innovate a safe attack and defense test method, and implements defense measures according to the characteristics of different stages of the AI model life cycle, realizes the safe attack and defense test of the AI model in the whole cycle, can effectively defend against various AI attack methods, and constructs a safe test process, supports the comprehensive security defense of the AI system in the actual deployment environment, and guarantees the robust security of the AI model. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The flowchart of the AI security attack and defense test method of the present application is shown in the figure.

[0048] Figure 2 The flowchart of the full-cycle automatic security test method is shown in the figure. DETAILED DESCRIPTION

[0049] The present application will be described in detail below with reference to the accompanying drawings.

[0050] As shown in the figure, Figure 1 The present application proposes an AI security attack and defense test method, which combines software and hardware collaborative security testing and full-cycle automatic security testing, analyzes the attack methods and defense strategies of different stages of the AI life cycle, realizes AI security defense and security deployment, and is realized through the following steps:

[0051] (1) Input the AI model to be tested and the model information.

[0052] Upload the AI model file to be tested and input the feature data of the AI model (data set type, model type, framework type, training parameter). The AI model file is used for attack and defense testing, and the input feature data is used for attack and defense knowledge graph reasoning.

[0053] (2) Perform full-cycle automated security testing method on the input AI model feature data to be tested in step (1.1). As shown in Figure 2 the attack and defense knowledge graph is constructed by the knowledge graph method, and knowledge reasoning is performed to obtain the attack and defense algorithms of the input AI model to be tested in the data collection and preprocessing stage, and the training and testing stage, and the hardware adaptation environment in the deployment stage, for subsequent testing steps. The specific steps are as follows:

[0054] (2.1) Determine the node type and relationship type of the AI model attack and defense knowledge graph, and form the knowledge graph node relationship rule.

[0055] Eight kinds of node types, six kinds of relationship types, and nine kinds of triple types of knowledge graph are established. The node types are "model ontology", "data set type", "model type", "framework type", "training parameter", "system hardware environment", "attack algorithm", and "defense algorithm". The relationship types are "belongs to", "first stage attack", "second stage attack", "first stage defense", "second stage defense", and "software and hardware adaptation". Among them, "data set type", "model type", "framework type", and "training parameter" all have "belongs to" relationship with "model ontology", forming four kinds of triple types; "attack algorithm" and "model ontology" form "first stage attack" and "second stage attack" relationship, forming two kinds of triple types; "defense algorithm" and "model ontology" form "first stage defense" and "second stage defense" relationship, forming two kinds of triple types; "system hardware environment" and "model ontology" form "software and hardware adaptation" relationship, forming one kind of triple type.

[0056] The data collection and preprocessing stage is the first stage, the training and testing stage is the second stage, and the deployment stage is the third stage.

[0057] (2.2) According to the node relationship rule of step (2.1), the data for constructing the graph is obtained by crawling.

[0058] According to the keywords of AI papers, the text information in the paper database is crawled. The text information contains the node and relationship information of the node types and relationship types described in step (2.1), and the node and relationship information is extracted into regularized data by regular extraction and entity extraction method.

[0059] (2.3) Form triples by data through node relationship rules, and form AI model attack and defense knowledge graph.

[0060] The extracted and regularized data is grouped into a triple set according to the node relationship rules of step (2.1), and stored in a graph database to form a complete knowledge graph.

[0061] Meanwhile, the triples in the entire attack and defense knowledge graph are converted into an embedding matrix through knowledge embedding, and the embedding matrix exists as another form of the knowledge graph.

[0062] (2.4) Match the feature data of the AI model to be tested with the attack and defense knowledge graph constructed in step (2.3), and infer the corresponding life cycle attack and defense methods through the relationship between nodes, and test using the corresponding attack and defense methods.

[0063] In the matching and reasoning link:

[0064] (2.4.1) The feature data of the AI model to be tested (i.e. the data set type, model type, framework type, and training parameters of the AI model) is converted into a vector form to obtain a feature vector through knowledge embedding.

[0065] (2.4.2) According to the feature vector obtained in step (2.4.1), and the relationship vector in the embedding matrix converted from the attack and defense knowledge graph in step (2.3), the L1 distance (the sum of the projections of the line segment formed by two points on the fixed orthogonal coordinate system in Euclidean space on the coordinate axes) is calculated to obtain the attack and defense methods in the first and second stages, and the system hardware environment suitable for the AI model to be tested, as the knowledge reasoning result. The attack method in the first stage includes data poisoning attack or adversarial sample attack, and the defense method includes abnormal data analysis and abnormal data cleaning; the attack method in the second stage includes backdoor attack or adversarial attack, and the defense method includes robustness enhancement and model reinforcement, and the attack and defense algorithms are analyzed using standardized unit testing and robustness formal verification methods to analyze the attack and defense success rate of the AI model and the impact on the AI model.

[0066] (2.4.3) The knowledge reasoning result of step (2.4.2) is input into different stages of the software and hardware collaborative security testing process for corresponding testing.

[0067] (3) Perform first-stage testing, i.e. attack and defense testing in the AI model data collection and preprocessing phase.

[0068] (3.1) According to the knowledge reasoning result of step (2.4.2), use the data poisoning or adversarial sample attack method in the knowledge reasoning result to construct attack samples to pollute the data set used by the AI model, and implement the attack in the data collection and preprocessing phase.

[0069] (3.2) Select an abnormal data automatic analysis method, input the data set of the attacked AI model, analyze the sample characteristics and distribution, and use the automatic abnormal data cleaning method to automatically clean the input data set after being attacked.

[0070] (3.2.1) In the abnormal data detection step: first, analyze the type of abnormal data: according to the comparison of the distribution characteristics of abnormal data and normal data, detect the type of abnormal data; then, process the abnormal data: according to the type of abnormal data, select the repaired data or discard the data; input the data that needs to be repaired into the automatic abnormal data cleaning step.

[0071] (3.2.2) In the automatic abnormal data cleaning step:

[0072] According to the knowledge reasoning result of step (2.4.2) of the full-cycle automatic security testing method, the first-stage defense method is obtained.

[0073] Using the first-stage defense method, the abnormal data detected in the abnormal data detection step (3.2.1) that needs to be repaired is cleaned.

[0074] (3.3) Collect the success rate of attack methods before and after defense, get the attack-defense success rate, analyze the effect of different defense methods, and get the attack-defense test result of the data collection and preprocessing stage.

[0075] (4) Perform the second-stage test, i.e. the attack-defense test of the AI model training and testing stage.

[0076] (4.1) According to the knowledge reasoning result of step (2.4.2), use the obtained backdoor attack or adversarial attack to trigger the backdoor or perturbation in the training and testing stage, and realize the attack in the training and testing stage.

[0077] (4.2) In the training link, the robustness enhancement and model reinforcement of the AI model are carried out, and the robustness training model is carried out.

[0078] In the robustness enhancement and model reinforcement stage of the AI model training link, according to the knowledge reasoning result of step (2.4.2), the obtained defense method, i.e. the reasoning robustness enhancement and model reinforcement algorithm, is used to defend against backdoor attacks or adversarial attacks.

[0079] (4.3) In the model testing link, the standardization unit test and robustness formal verification of the AI model are carried out, and the influence of the attack and defense on the AI model in the model training and testing process is analyzed.

[0080] (4.3.1) Standardized unit testing includes the following test criteria:

[0081] a1. Module unit test criteria: Test the functions of different modules of the model respectively, construct input data with predictable results, compare the predicted standard results with the actual module output results to achieve the test purpose;

[0082] a2. Neuron coverage test criteria: Divide the output range of the neuron into multiple intervals of the same length, each interval represents a characteristic behavior of the neuron. Determine whether the logic behavior is covered by the test data by determining whether the output value of the neuron is contained in an interval.

[0083] (4.3.2) Robustness formal verification includes the following steps:

[0084] b1. Use the knowledge reasoning results of step (2.4.2) to select the appropriate formal verification method according to the type of activation function of the AI model and the application scenario.

[0085] b2. Use the method selected in step b1 to perform formal verification on the AI model to be tested, and obtain the robustness evaluation results.

[0086] (4.4) Collect the success rate of attack methods before and after defense, obtain the attack and defense success rate, analyze the effect of different defense methods, and obtain the attack and defense test results of the model training and testing stage.

[0087] (5) AI system deployment and online testing: Analyze and adapt the hardware system environment of the AI model deployment. Simulate and adapt the knowledge reasoning results of step (2.4.2), i.e. the most suitable system hardware environment for the AI model to be tested, to the AI model to obtain the AI model software and hardware adaptation results.

[0088] (6) Integrate the test results of the data collection and preprocessing stage, the training and testing stage, and the deployment stage of the AI life cycle into a test report, and provide security defense strategies and security deployment methods for different stages.

[0089] The test report specifically includes the vulnerable attack methods and defense strategies and attack and defense success rates in the AI model data collection and preprocessing stage, the vulnerable attack methods and defense strategies and attack and defense success rates in the training and testing stage, and the AI model software and hardware adaptation results.

Claims

1. An AI security attack and defense test method, characterized in that, Comprise the following steps: (1) input the AI model file to be tested, and input the feature data of the AI model; (2) the feature data of the AI model to be tested input in step (1) is executed by the full cycle automatic safety test method; The attack and defense knowledge graph is constructed by knowledge graph method, and knowledge reasoning is carried out to obtain the attack and defense algorithm of the input AI model to be tested in the data collection and preprocessing stage, and the training and test stage, and the hardware adaptation environment in the deployment stage; (2.1) determine the node type and relationship type of the AI model attack and defense knowledge graph, and form the knowledge graph node relationship rule; 8 kinds of node types, 6 kinds of relationship types and 9 kinds of triple types of knowledge graph are established; The node types are "model ontology", "dataset type", "model type", "framework type", "training parameter", "system hardware environment", "attack algorithm" and "defense algorithm"; The relationship types are "belongs to", "first stage attack", "second stage attack", "first stage defense", "second stage defense" and "software and hardware adaptation"; Among them, "dataset type", "model type", "framework type" and "training parameter" constitute "belongs to" relationship with "model ontology", which constitutes 4 kinds of triple types; "Attack algorithm" and "model ontology" constitute "first stage attack" and "second stage attack" relationship, which constitutes 2 kinds of triple types; "Defense algorithm" and "model ontology" constitute "first stage defense" and "second stage defense" relationship, which constitutes 2 kinds of triple types; "System hardware environment" and "model ontology" constitute "software and hardware adaptation" relationship, which constitutes 1 kind of triple type; (2.2) according to the node relationship rule of step (2.1), the data for constructing the graph is obtained; According to the key words of AI paper, the text information in the paper database is crawled; The node and relationship information of the node type and relationship type in step (2.1) is included in the text information, and the node and relationship information is extracted into regularized data by regularizing extraction and entity extraction method; (2.3) form triplets by node relationship rule, and constitute AI model attack and defense knowledge graph; The regularized data extracted according to the node relationship rule of step (2.1) is composed of triplets, and stored in the graph database to form a complete knowledge graph; At the same time, the triplets in the whole attack and defense knowledge graph are converted into matrix form by knowledge embedding to obtain embedding matrix, which exists as another form of knowledge graph; (2.4) match the feature data of the AI model to be tested with the attack and defense knowledge graph constructed in step (2.3), infer the corresponding life cycle attack and defense method through the relationship between nodes, and test by using the corresponding attack and defense method; (3) first stage test: according to the first stage attack method and defense method in the knowledge reasoning result of step (2), the attack and defense test of AI model data collection and preprocessing stage is carried out; (3.1) According to the knowledge reasoning result of step (2), using the first stage attack method in the knowledge reasoning result, an attack sample is constructed to pollute the data set used by the AI model, and the attack is realized in the data collection and preprocessing stage; (3.2) Select an abnormal data automatic analysis method, analyze the sample characteristics and distribution of the input data set of the AI model after the attack, and use an automatic abnormal data cleaning method to automatically clean the input data set after the attack; (3.3) Collect the success rate of the attack method before and after defense, get the attack and defense success rate, analyze the effect of different defense methods, and get the attack and defense test results in the data collection and preprocessing stage; (4) Second stage test: according to the second stage attack method and defense method in the knowledge reasoning result of step (2), carry out attack and defense test in the AI model training and test stage; (4.1) According to the knowledge reasoning result of step (2), use the obtained backdoor attack or adversarial attack to trigger the backdoor or perturbation in the training and test stage, and realize the attack in the training and test stage; (4.2) In the training link, according to the knowledge reasoning result of step (2), use the obtained second stage defense method to enhance the robustness and model reinforcement of the AI model, and defend against the second stage attack method; (4.3) In the model test link, the AI model is subjected to standardized unit test and robustness formal verification, and the influence of the attack and defense on the AI model in the model training and test process is analyzed; (4.4) Collect the success rate of the attack method before and after defense, get the attack and defense success rate, analyze the effect of different defense methods, and get the attack and defense test results in the model training and test stage; (5) AI system deployment online test: simulate and adapt the system hardware environment most suitable for the AI model in the knowledge reasoning result of step (2) to the AI model, and get the AI model software and hardware adaptation result; (6) The test results of the data collection and preprocessing stage, the training and test stage, and the deployment stage of the AI life cycle are integrated into a test report, and different stage security defense strategies and security deployment methods are provided.

2. The AI security attack and defense test method of claim 1, wherein, In step (1), the characteristic data of the AI model includes data set type, model type, framework type and training parameter.

3. The AI security attack and defense test method of claim 1, wherein, In step (2.4) of matching reasoning: (2.4.1) The characteristic data of the AI model to be tested needs to be converted into a feature vector by knowledge embedding. (2.4.2) According to the eigenvectors obtained in step (2.4.1), and the relationship vectors in the embedding matrix converted by the attack and defense knowledge graph in step (2.3), the first stage and the second stage of the attack method and the defense method, and the system hardware environment adapted to the AI model to be tested are calculated as the knowledge reasoning result through the L1 distance; the attack method of the first stage includes data poisoning attack or adversarial sample attack, and the defense method of the first stage includes abnormal data analysis and abnormal data cleaning; the attack method of the second stage includes backdoor attack or adversarial attack, and the defense method of the second stage includes robustness enhancement and model reinforcement, and the attack and defense algorithm is analyzed by using the standardized unit test and the robustness formal verification method. The success rate of attack and defense on the AI model and the influence on the AI model; (2.4.3) The knowledge reasoning result of step (2.4.2) is input into different stages of the software and hardware collaborative security test process respectively for corresponding test.

4. The AI security attack and defense test method of claim 1, wherein, Step (3.2) includes the following sub-steps: (3.2.1) In the abnormal data detection step: first, analyze the type of abnormal data: detect the type of abnormal data according to the distribution characteristics comparison between abnormal data and normal data; then, process the abnormal data: according to the type of abnormal data, select to repair data or discard data; input the data needing repair into the automatic abnormal data cleaning step; (3.2.2) In the automatic abnormal data cleaning step: According to the knowledge reasoning result of step (2) of the full-cycle automatic security test method, the defense method of the first stage is obtained; Using the defense method of the first stage, the abnormal data detected in step (3.2.1) needing repair is cleaned.

5. The AI security attack and defense test method of claim 1, wherein, In step (4.3), the standardized unit test includes: a1. Module unit test: test the functions of different modules of the model respectively, construct input data with predictable results, and compare the predicted standard results with the actual module output results to achieve the test purpose; a2. Neuron coverage test: divide the output range of the neuron into multiple intervals of the same length, each interval represents a characteristic behavior of the neuron, and determine whether the logical behavior is covered by the test data by determining whether the output value of the neuron is contained in an interval.

6. The AI security attack and defense test method of claim 1, wherein, In step (4.3), the robustness formal verification includes: b1. Using the knowledge reasoning result of step (2), according to the type of activation function of the AI model and the application scenario, select the appropriate formal verification method; b2. Using the method selected in step b1, formal verification is performed on the AI model to be tested, and the robustness evaluation result is obtained.

7. The AI security attack and defense test method of claim 1, wherein, In step (6), the test report includes the vulnerable attack method and defense strategy and attack and defense success rate in the AI model data collection and preprocessing stage, the vulnerable attack method and defense strategy and attack and defense success rate in the training and testing stage, and the AI model software and hardware adaptation result.

Images