A black-box reversible adversarial sample generation method for model authorization access control

Abstract

The present invention discloses a black-box reversible adversarial sample generation method for model authorization access control, comprising the following steps: (1) obtaining adversarial perturbations of the original image based on a generative adversarial network, and truncating the generated preliminary perturbations to generate adversarial samples; (2) performing preprocessing transformation on the adversarial perturbations generated in step (1) to generate new adversarial perturbations and adversarial samples; (3) performing lossless compression on the new adversarial perturbations generated in step (2) to generate adversarial perturbations after lossless compression; (4) embedding the data of the adversarial perturbations after lossless compression generated in step (3) into the adversarial samples generated in step (2) through a reversible data hiding technology to obtain reversible adversarial samples. The present invention is applied to the authorization access control of AI models to protect the legitimate use of image data by authorized models. Reversible adversarial samples are generated in the form of a black box, which has lower computational complexity and better performance than existing adversarial sample schemes.

Description

Technical Field

[0001] The present invention belongs to the field of neural networks, and in particular relates to a black-box reversible adversarial sample scheme for model authorization access control. Background Art

[0002] In recent years, thanks to the excellent performance of deep neural networks, the artificial intelligence industry has gradually emerged. It can replace complex and cumbersome manual manufacturing and is widely used in many fields such as autonomous driving, face recognition, image classification, etc. However, while we enjoy the many conveniences brought by deep neural networks, deep neural networks also have certain negative effects. For example, with the widespread popularity of the Internet, people like to upload some personal photos to social cloud platforms. However, malicious users can easily obtain such data and use it to analyze personal information. Recently, news has confirmed that personal information on FaceBook was transmitted to Cambridge Analytica for unauthorized data analysis, which indicates that personal information is at risk of being disclosed. Malicious unauthorized commercial companies can collect and analyze user data through algorithms based on deep neural networks, and obtain user personal information for malicious use. In this case, we urgently need a technology that can ensure that authorized parties use network shared data legally and unauthorized parties cannot access such data.

[0003] Reversible adversarial sample technology provides an effective means for the above scenarios. As a conventional adversarial sample, reversible adversarial sample can mislead the classification and analysis of neural network models. At the same time, it can also be completely restored to a normal image sample without attack capability for further use.

[0004] The adversarial nature of reversible adversarial samples can be used to protect users' personal data from being exploited by neural network models (DNN). By embedding adversarial noise in the uploaded image, DNN misjudges the data when performing related tasks, making it impossible to obtain image privacy information. When the user needs the original image, we can remove the adversarial noise in the image through reversible transformation, thereby eliminating the adversarial nature of the data. Through such applications, the security and usability of image data can be guaranteed.

[0005] Most of the existing reversible adversarial sample schemes rely on the traditional white-box adversarial attack method to first generate a regular adversarial sample corresponding to a normal image; then, the reversible data hiding technique is used to embed the information required to restore the normal image into the regular adversarial sample generated in the first step. Therefore, a reversible adversarial sample is generated, and it can be reversibly restored to a normal original image. However, the generation process of regular adversarial samples in such reversible adversarial sample schemes requires repeated access to the structure and parameters of the attacked model itself, which brings high computational complexity and is unreasonable in practical application scenarios. In addition, a large amount of data required to restore the original image is reversibly embedded into the regular adversarial sample, which may cause uncontrollable interference to its visual quality and attack capability. Summary of the invention

[0006] In order to solve the technical problems mentioned in the above background technology, the present invention proposes a black box reversible adversarial sample solution for model authorization access control. Through this method, neural network technology is used to design and generate black box reversible adversarial samples, so that the authorized model can legally access the reversible adversarial samples and prohibit the unauthorized model from illegally accessing them.

[0007] In order to achieve the above technical objectives, the technical solution of the present invention is:

[0008] A black-box reversible adversarial sample generation method for model authorization access control includes the following steps:

[0009] (1) Obtain adversarial perturbations of the original image based on a generative adversarial network;

[0010] (2) Preprocessing and transforming the adversarial perturbation generated in step (1) to generate new adversarial perturbations and adversarial samples;

[0011] (3) Losslessly compressing the new adversarial perturbation generated in step (2) to generate a losslessly compressed adversarial perturbation;

[0012] (4) The losslessly compressed adversarial perturbation data generated in step (3) is embedded into the adversarial sample generated in step (2) through reversible data hiding technology to obtain a reversible adversarial sample.

[0013] Preferably, the training method of the generative adversarial network specifically includes:

[0014] (1) Design disturbance loss L noise To constrain the generation of adversarial perturbations M noise The size of the perturbation loss is expressed as follows:

[0015] L noise =MSELoss(M noise ,Matrix zero )

[0016] Among them, Matrix zero represents a matrix whose elements are all 0, and MSELoss represents the mean square error loss;

[0017] (2) Design classification loss L classify The formula is as follows:

[0018]

[0019] Among them, s is the category to which the original image X belongs, i refers to the i-th class, and k is a defined boundary. refers to the initially generated adversarial sample; f(·) is the fit query function, and the function output is the probability of belonging to a certain category;

[0020] (3) Design a binary cross entropy loss as the adversarial loss L in adversarial training adv , the formula is as follows:

[0021]

[0022] Where b represents a predefined label, 0 represents a real original image, and 1 represents a generated "fake" adversarial sample; b represents the output of the discriminator;

[0023] The total loss function L of the generative adversarial network is expressed as follows:

[0024] L=L adv +λ1*L classify +λ2*L noise

[0025] Among them, the value of weight λ1 is set to 0.005, and the value of weight λ2 is set to 1.

[0026] Preferably, the step (1) specifically comprises:

[0027] (1.1) Take the original image as the input of the generative adversarial network and obtain the output of the generative adversarial network, that is, the adversarial perturbation of the original image;

[0028] (1.2) Truncate the adversarial perturbation obtained in step (1.1), and apply the truncated perturbation to the original image by setting the truncation parameters to generate a preliminary adversarial sample

[0029] (1.3) The generated preliminary adversarial samples The input is fed into the discriminator, which determines whether the input is a real original image or a generated “fake” adversarial sample;

[0030] (1.4) The generated preliminary adversarial samples The original image is input into the attacked model, and the attacked model is used as a query port to obtain the classification result of the attacked model, that is, the adversarial sample.

[0031] Preferably, in the step (1.2), the disturbance truncation method is as follows:

[0032] For the generated adversarial perturbation M noise , using the truncation parameter 5 to truncate the size of the disturbance; that is, the adversarial disturbance M noise The value of is limited to the range of 5, and the truncation formula is expressed as:

[0033]

[0034] in, Denotes the adversarial perturbation M noise The value of the pixel with coordinates (i, j, z) in the represents the truncated adversarial perturbation T noise The value of the pixel with coordinates (i, j, z).

[0035] Preferably, the identification loss L of the training discriminator in step (1.3) is dis It is expressed as follows:

[0036]

[0037] Where b represents a predefined label, b=0 represents a real original image, and b=1 represents a generated “fake” adversarial sample; represents the output of the discriminator.

[0038] Preferably, the step (2) specifically includes:

[0039] (2.1) Obtain the sign of the truncated adversarial perturbation (T noise ), sign(T noise ) includes values ​​of 0, +1, and -1;

[0040] (2.2) The sign of the truncated perturbation obtained in step (2.1) is (T noise ) is converted, retaining only the signs +1 and -1, and we get sign(T noise )′;

[0041] (2.3) Get the converted data in step (2.2) and convert the sign (T noise )′ is preprocessed to obtain the attack capability and the amount of data is less than sign(T noise )′ The new adversarial perturbation sign(T noise )″;

[0042] (2.4) According to step (2.3), the new adversarial perturbation sign (T noise )″, generate new adversarial examples.

[0043] Preferably, the step (3) specifically comprises:

[0044] (3.1) Obtain the new adversarial perturbation sign (T noise )″, and use arithmetic coding to perform lossless compression on the first channel value;

[0045] (3.2) Set the truncation parameter and perturbation parameter to 5, and encode the above parameters into 3-bit binary data.

[0046] A method for restoring an original image comprises the following steps:

[0047] (1) Extract hidden data from reversible adversarial samples and restore the carrier image;

[0048] (2) Separate the perturbation-related data and truncation parameters and perturbation parameters from the hidden data and reconstruct the adversarial perturbation;

[0049] (3) Based on the perturbation parameters and the reconstructed adversarial perturbation, the added adversarial perturbation is removed from the carrier image to obtain the undistorted original image.

[0050] The beneficial effects brought by adopting the above technical solution are:

[0051] The present invention realizes the generation of reversible adversarial samples and the restoration of original images based on generative adversarial networks, which can be effectively applied to the authorized access control of AI models, and to a certain extent protects the legal use of image data by authorized models and curbs the malicious use of unauthorized models. Through the implementation of the present invention, reversible adversarial samples are generated in the form of black boxes, which brings lower computational complexity, and its performance is also better than many existing white-box reversible adversarial sample solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A diagram of the framework for implementing black-box reversible adversarial examples;

[0053] Figure 2 A diagram of the structure of the perturbation generation network in the generative adversarial network;

[0054] Figure 3 An example graph of a generated black-box reversible adversarial example. DETAILED DESCRIPTION

[0055] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0056] Attached Figure 1 The figure shows a black box reversible adversarial sample scheme for model authorization access control disclosed by the present invention, and the steps are as follows:

[0057] (1) Generate adversarial samples based on generative adversarial networks: Use a perturbation generation network to generate adversarial perturbations that can cause the attacked model to misclassify, thereby obtaining preliminary adversarial samples.

[0058] Here’s how:

[0059] (1.1) Take the normal image sample (original image) as the input of the perturbation generation network and obtain the output of the perturbation generation network.

[0060] (1.2) Truncate the adversarial perturbation obtained in step (1.1), apply the truncated perturbation to the original image by setting the truncation parameters, and generate a preliminary adversarial sample

[0061] (1.3) The generated preliminary adversarial samples The input is fed into the discriminator so that the discriminator can determine whether its input is a real original image or a generated “fake” adversarial sample.

[0062] (1.4) The generated preliminary adversarial samples The original image is input into the attacked model, and the attacked model is used as a query port (Oracle) to obtain the classification result of the attacked model.

[0063] Furthermore, since the traditional white-box adversarial attack method in the existing reversible adversarial sample scheme requires repeated access to the structure and parameters of the attacked model, the repeated access to the target model is easily discovered, which is not applicable in real application scenarios. The present invention avoids this situation by jointly training the perturbation generation network and the discriminator network, and deploying the trained perturbation generation network, such as Figure 2 As shown. Once the original image is input into the trained perturbation generation network, the network can directly generate adversarial perturbations and obtain adversarial samples that can misclassify the attack target (Oracle). Therefore, the present invention generates black-box adversarial samples in a more efficient way, replacing the complexity and impracticality of generating white-box adversarial samples in the traditional reversible adversarial sample scheme.

[0064] Specifically, the training method of the generative adversarial network is as follows:

[0065] In order to increase the importance of the sign of the generated disturbance on the attack capability, the present invention designs the disturbance loss L noise To constrain the generated disturbance M noiseThe size of M noise Therefore, the present invention reduces the impact of the disturbance noise value on the attack capability and strengthens the effect of the symbol of the anti-disturbance on the attack capability. The disturbance loss can be expressed as follows:

[0066] L noise =MSELoss(M noise ,Matrix zero )

[0067] Among them, Matrix zero represents a matrix whose elements are all 0, and MSELoss represents the mean square error loss.

[0068] In the generative adversarial network, the discrimination loss L used to train the discriminator dis It can be expressed as follows:

[0069]

[0070] Among them, b represents a predefined label, 0 represents a real original image, and 1 represents a generated "fake" adversarial sample; represents the output of the discriminator.

[0071] Most importantly, the generated adversarial samples can deceive the attacked model (Oracle). To this end, the present invention designs a classification loss L classify , the formula is as follows:

[0072]

[0073] In the adversarial training of the perturbation generation network and the discriminator, the present invention designs a binary cross entropy loss as the adversarial loss L in the adversarial training. adv , the formula is as follows:

[0074]

[0075] Among them, b represents a predefined label, 0 represents a real original image, and 1 represents a generated "fake" adversarial sample; represents the output of the discriminator.

[0076] Therefore, the total loss function used in step (1) to generate adversarial samples based on the generative adversarial network can be expressed as follows:

[0077] L=L adv +λ1*L classify +λ2*L noise

[0078] Among them, the value of weight λ6 is set to 0.005, and the value of weight λ2 is set to 1.

[0079] (2) The first step in the compression strategy is to use disturbance preprocessing to initially compress the amount of data to counter the disturbance while ensuring that the generated disturbance has a certain degree of attack capability. The steps are as follows:

[0080] (2.1) Obtain the truncated adversarial perturbation T noise The symbol sign(T noise ), where values ​​include 0, -1, and +1.

[0081] (2.2) Convert the signs obtained in step (2.1) to keep only the signs +1 and -1.

[0082] (2.3) Obtain the converted data in step (2.2) and perform further preprocessing.

[0083] (2.4) Generate new adversarial samples based on the preprocessed adversarial perturbations and the set perturbation parameters.

[0084] Furthermore, in step (2.2), due to the symbol sign(T noise ) has very few 0s, so 0 and +1 are unified into +1, and the conversion formula can be expressed as:

[0085]

[0086] Furthermore, in step (2.3), the converted sign (T noise )′ is preprocessed to obtain new adversarial perturbations with attack capability and less data volume. The preprocessing method is as follows:

[0087] Get the converted sign(T noise )′, and copied to the second and third channels to generate new adversarial perturbations that still have attack capabilities. The formula can be expressed as:

[0088]

[0089] Furthermore, in step (2.4), a new adversarial sample is generated based on the perturbation parameters and the new adversarial perturbation. The formula can be expressed as:

[0090]

[0091] Among them, X represents the normal sample (original image), Represents the newly generated adversarial sample, and ε represents the set perturbation parameter.

[0092] (3) Use arithmetic coding technology to losslessly compress the data required to restore the original image to further reduce its data volume. Since in the subsequent steps, the data required to restore the original image needs to be reversibly embedded into the adversarial sample generated in step (2.4) In the process of embedding, the size of the data to be embedded greatly affects the visual quality and attack capability of the adversarial sample. If the amount of embedded data is large, the degree of distortion suffered by the adversarial sample is also correspondingly large, and its visual quality and attack capability are also greatly reduced. More importantly, if the amount of data to be embedded is too large, so that it exceeds the maximum capacity that can be hidden by the reversible data hiding technology, it can be considered that the data required to restore the original image is not completely hidden in the adversarial sample. Therefore, in the process of restoring the original image, the required data cannot be completely extracted from the reversible adversarial sample, that is, the original image cannot be restored without distortion.

[0093] To this end, the present invention adopts a lossless compression scheme to further reduce the amount of data required for reversible embedding, which is conducive to reducing the interference caused by subsequent reversible data hiding technology on the visual quality and attack capability of adversarial samples. The steps are as follows:

[0094] (3.1) Obtain the adversarial perturbation sign (T noise )″, and compress its first channel value using a lossless compression method. Specifically, the present invention uses arithmetic coding technology as a lossless compression method to obtain the data required for restoring the original image after further compression.

[0095] (3.2) The present invention sets both the truncation parameter and the disturbance parameter to 5, and encodes 5 into 3-bit binary data.

[0096] (4) Combine the first channel value of the disturbance after lossless compression and the 3-bit binary data encoded by data 5 and embed it into the adversarial sample through reversible data hiding technology In the above example, we obtain a reversible adversarial sample X. RAE .

[0097] Therefore, the black-box reversible adversarial sample scheme implemented by the present invention can not only efficiently generate preliminary adversarial samples, but also more flexibly balance the visual quality and attack capability of adversarial samples, and has good performance in both visual quality and attack capability. In addition, the carefully designed compression strategy greatly reduces the data required to restore the original image, which not only ensures the reversibility of the generated reversible adversarial samples, but also further reduces the interference of reversible embedding on the visual quality and attack capability of adversarial samples.

[0098] Moreover, the black-box reversible adversarial sample implemented by the present invention can restore the original image completely without distortion, and the process includes the following steps:

[0099] (1) Extract hidden data from reversible adversarial samples and restore the carrier image.

[0100] Here’s how:

[0101] (1.1) According to the extraction algorithm in the adopted reversible data hiding technology, the hidden data, namely the disturbed first channel value after lossless compression and the binary data after parameter encoding, are extracted.

[0102] (1.2) According to the algorithm in step (1.1), restore the carrier image before embedding the data, that is, the new adversarial sample

[0103] (2) Separate the perturbation-related data and perturbation parameters from the hidden data and reconstruct the adversarial perturbation.

[0104] In step (2), the hidden data extracted in step (1.1) is separated, including the disturbed first channel value after lossless compression and the binary data after parameter encoding.

[0105] Here’s how:

[0106] (2.1) According to the inverse process of arithmetic coding, decompression is performed to obtain the perturbed first channel value before compression, and then copied to the second and third channels to obtain the complete adversarial perturbation sign (T noise )″.

[0107] (2.2) According to the separated parameter-encoded binary data, the data is decoded to obtain the disturbance parameter and the truncation parameter (the disturbance parameter and the truncation parameter are set to be the same in the present invention).

[0108] (3) Based on the perturbation parameters and the reconstructed adversarial perturbation, the added adversarial perturbation is removed from the carrier image to obtain the undistorted original image.

[0109] In step (3), the adversarial sample recovered in step (1) And the adversarial perturbation and perturbation parameters obtained in step (2.2) to obtain the original image without distortion. The formula can be expressed as:

[0110]

[0111] Among them, X represents a normal sample (original image).

[0112] The present invention evaluates the performance of the implemented black-box reversible adversarial samples, such as Figure 3 The evaluation results are as follows:

[0113] (1) The present invention applies a generative adversarial network to the generation of adversarial samples, and more effectively generates black-box reversible adversarial samples. Compared with existing solutions, the black-box reversible adversarial samples generated by the present invention are more robust to pixel modifications.

[0114] (2) The compression strategy makes the amount of data that can be reversibly hidden in the present invention much smaller than the existing reversible adversarial sample scheme, which greatly reduces the interference of embedded data on the attack capability and visual quality of adversarial samples.

[0115] The embodiments are only for illustrating the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the present invention.

Claims

1. A black-box reversible adversarial sample generation method for model authorization access control, characterized in that: The following steps are involved: (1) Obtain adversarial perturbations of the original image based on the generative adversarial network, and truncate the generated adversarial perturbations to generate adversarial samples; (2) Preprocessing and transforming the adversarial perturbation generated in step (1) to generate new adversarial perturbations and adversarial samples; (3) Losslessly compressing the new adversarial perturbation generated in step (2) to generate a losslessly compressed adversarial perturbation; (4) embedding the losslessly compressed adversarial perturbation data generated in step (3) into the adversarial sample generated in step (2) through a reversible data hiding technique to obtain a reversible adversarial sample; The training method of the generative adversarial network specifically includes: (1) Design disturbance loss L noise To constrain the generation of adversarial perturbations M noise The size of the perturbation loss is expressed as follows: L noise =MSELoss(M noise ,Matrix zero ) Among them, Matrix zero represents a matrix whose elements are all 0, and MSELoss represents the mean square error loss; (2) Design classification loss L classify The formula is as follows: (3) Design a binary cross entropy loss as the adversarial loss L in adversarial training adv , the formula is as follows: The total loss function L of the generative adversarial network is expressed as follows: L=L adv +λ1*L classify +λ2*L noise Among them, the value of weight λ1 is set to 0.005, and the value of weight λ2 is set to 1.

2. According to claim 1, a black-box reversible adversarial sample generation method for model authorization access control is characterized in that: The step (1) specifically comprises: (1.1) Take the original image as the input of the generative adversarial network and obtain the output of the generative adversarial network, that is, the adversarial perturbation of the original image; (1.2) Truncate the adversarial perturbation obtained in step (1.1), and apply the truncated perturbation to the original image by setting the truncation parameters to generate a preliminary adversarial sample (1.3) The generated preliminary adversarial samples Input to the discriminator, which determines whether the input is a real original image or a generated "fake" adversarial sample; (1.4) The generated preliminary adversarial samples The original image is input into the attacked model, and the attacked model is used as a query port to obtain the classification result of the attacked model.

3. According to claim 2, a black-box reversible adversarial sample generation method for model authorization access control is characterized in that: In the step (1.2), the disturbance truncation method is as follows: For the generated adversarial perturbation M noise , using the truncation parameter 5 to truncate the size of the disturbance; that is, the adversarial disturbance M noise The value of is limited to the range of 5, and the truncation formula is expressed as: in, Denotes the adversarial perturbation M noise The value of the pixel with coordinates (i, j, z) in the represents the truncated adversarial perturbation T noise The value of the pixel with coordinates (i, j, z).

4. According to claim 2, a black-box reversible adversarial sample generation method for model authorization access control is characterized in that: The discrimination loss L of the discriminator trained in step (1.3) is dis It is expressed as follows: Where b represents a predefined label, b=0 represents a real original image, and b=1 represents a generated "fake" adversarial sample; represents the output of the discriminator; 5. According to claim 1, a black-box reversible adversarial sample generation method for model authorization access control is characterized in that: The step (2) specifically comprises: (2.1) Obtain the sign of the truncated adversarial perturbation (T noise ), sign(T noise ) includes values ​​of 0, +1, and -1; (2.2) The sign of the truncated perturbation obtained in step (2.1) is (T noise ) is converted, retaining only the signs +1 and -1, and we get sign(T noise )′; (2.3) Get the converted data in step (2.2) and convert the sign (T noise )′ is preprocessed to obtain the attack capability and the amount of data is less than sign(T noise ) ′ The new adversarial perturbation sign(T noise )″; (2.4) According to the adversarial perturbation sign (T noise )″, generate new adversarial examples.

6. According to claim 4, a black-box reversible adversarial sample generation method for model authorization access control is characterized in that: The step (3) specifically comprises: (3.1) Obtain the new adversarial perturbation sign (T noise )″, and use arithmetic coding to perform lossless compression on the first channel value; (3.2) Set the truncation parameter and perturbation parameter to 5 and encode the above parameters into 3-bit binary data.

7. An original image restoration method according to a black-box reversible adversarial sample generation method for model authorization access control according to any one of claims 1 to 5, characterized in that: The following steps are involved: (1) Extract hidden data from reversible adversarial samples and restore the carrier image; (2) Separate the perturbation-related data and truncation parameters and perturbation parameters from the hidden data and reconstruct the adversarial perturbation; (3) Based on the perturbation parameters and the reconstructed adversarial perturbation, the added adversarial perturbation is removed from the carrier image to obtain the undistorted original image.

Images