A black box attack method, terminal device and storage medium based on meta-learning

Abstract

The present invention discloses a black-box attack method, terminal device, and storage medium based on meta-learning, wherein the method comprises obtaining a task to be attacked, which includes an image to be attacked and a target model to be attacked; inputting the image to be attacked into a trained generative model to generate an adversarial perturbation corresponding to the image to be attacked; adding the adversarial perturbation to the image to be attacked to obtain an adversarial sample, and using the adversarial sample to attack the target model to achieve a black-box attack. The present invention is a black-box attack algorithm based on conditional distribution generative attack, which utilizes a meta-learning strategy to learn the relationship prior between the tasks of generating adversarial samples, helping the generative model that has learned the prior to quickly adapt to new tasks and generate new adversarial samples; and the present invention introduces the concept of sample adversarial transferability from the perspective of meta-learning, which is a method that combines sample adversarial transferability with model adversarial transferability to improve attack efficiency in black-box attack scenarios.

Description

Technical Field

[0001] The present invention discloses a black box attack method, terminal equipment and storage medium based on meta-learning, belonging to the technical field of deep learning. Background Art

[0002] Deep learning models are now widely used in various fields, and the requirements for their security and robustness are increasing. The adversarial example generation task aims to test the limits of deep learning models and help them design defense strategies for these special cases.

[0003] The goal of adversarial example generation is to add subtle and malicious perturbations to clean examples, confusing deep learning models and preventing them from being detected by the human eye. Depending on the level of information available to the target model, adversarial example generation tasks can be categorized as white-box or black-box attacks.

[0004] In white-box attack tasks, it is assumed that the attacker has access to the parameters and structure of the target model, and can therefore construct adversarial perturbations based on the target model's gradient information. In black-box attack tasks, the attacker cannot obtain the internal information of the target model, only the input and output feedback of the target model. Compared with white-box tasks, black-box tasks are more similar to real-world tasks and more difficult to implement.

[0005] Currently, the transferability applied to black-box attack algorithms is generally model-level adversarial transferability, which means that adversarial examples generated by surrogate models can also confuse other deep models. However, this transferability will significantly fail when the target model and the surrogate model have very different structures or training methods.

[0006] Conditional distribution generation attacks are a query-based attack algorithm for adversarial example generation tasks. They aim to exploit the transferability of surrogate models by analyzing their conditional adversarial distributions. This is then parameterized by the generative model. In black-box attack scenarios, the distribution of generated samples can be adjusted using query information from the target model. However, conditional distribution generation attacks emphasize connections between models while ignoring connections between samples, resulting in low adversarial example generation efficiency. Summary of the Invention

[0007] The purpose of this application is to provide a black-box attack method, terminal device and storage medium based on meta-learning to solve the technical problem of low efficiency in generating adversarial samples in existing black-box attack methods.

[0008] A first aspect of the present invention provides a black box attack method based on meta-learning, comprising:

[0009] Acquire a task to be attacked, wherein the task to be attacked includes an image to be attacked and a target model to be attacked;

[0010] Inputting the image to be attacked into a generative model trained using a meta-learning method to generate adversarial perturbations corresponding to the image to be attacked;

[0011] The adversarial perturbation is added to the image to be attacked to obtain an adversarial sample, and the adversarial sample is used to attack the target model to be attacked to achieve a black box attack.

[0012] Preferably, the training process of the generative model specifically includes:

[0013] Obtain a first training sample, and use the first training sample to optimize parameters in a generative model; the first training sample includes a plurality of training tasks, each of the training tasks includes a first training image and a first adversarial perturbation corresponding to the first training image;

[0014] The parameters of the optimized generative model are updated using a meta-learning method to obtain a trained generative model.

[0015] Preferably, optimizing parameters in a generation model using the first training sample specifically includes:

[0016] The first training sample is input into a generative model whose loss function is a maximum likelihood function, and the first training sample is used to optimize the parameters in the generative model.

[0017] Preferably, the parameters of the optimized generative model are updated using a meta-learning method to obtain a trained generative model, specifically including:

[0018] Acquire a second training sample, where the second training sample includes a plurality of training tasks, each of the training tasks includes a second training image and a second substitute model of a second target model corresponding to each of the second training images;

[0019] Inputting the second training image into the generative model after optimizing parameters to obtain a second adversarial perturbation corresponding to the second training image;

[0020] Adding the second adversarial perturbation to the corresponding second training image to obtain a training adversarial sample, using the training adversarial sample to attack the corresponding second replacement model, and obtaining an adversarial loss function in the second replacement model;

[0021] According to the adversarial loss function, the parameters of the optimized generative model are updated in combination with the meta-learning method to obtain a trained generative model.

[0022] Preferably, in the case of non-targeted attack, the adversarial loss function is as shown in the first formula, which is:

[0023]

[0024] Where, is the adversarial loss function for untargeted attacks, g ω is the second alternative model, x is the second training image input into the second alternative model, δ is the second adversarial perturbation added to the second training image, y is the true label corresponding to the second training image, and j is a label other than the true label.

[0025] Preferably, during target attack, the adversarial loss function is as shown in the second formula, which is:

[0026]

[0027] Where, is the adversarial loss function during target attack, g ω is the second alternative model, x is the second training image input into the second alternative model, δ is the second adversarial perturbation added to the second training image, t is the target label, and j is other labels except the target label.

[0028] Preferably, the generative model is a conditional flow generative model.

[0029] Preferably, the first training sample is obtained using a white-box attack method.

[0030] A second aspect of the present invention provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0031] A second aspect of the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0032] Compared with the existing technology, the meta-learning-based black box attack method and its application of the present invention have the following beneficial effects:

[0033] The present invention is a black-box attack algorithm based on conditional distribution generation attack, which uses a meta-learning strategy to learn the relationship priors between the tasks of generating adversarial samples, helping the generative model that learns the priors to quickly adapt to new tasks and generate new adversarial samples; and the present invention introduces the concept of sample adversarial transferability from the perspective of meta-learning, which is a method that combines sample adversarial transferability and model adversarial transferability to improve the attack efficiency in black-box attack scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A schematic diagram of the process of a black-box attack method based on meta-learning provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In the following description, specific details such as particular system structures and techniques are provided for purposes of illustration, not limitation, to facilitate a thorough understanding of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail.

[0036] like Figure 1 As shown, the black box attack method based on meta-learning in an embodiment of the present invention includes:

[0037] Step S10: Obtain a task to be attacked, where the task to be attacked includes an image to be attacked and a target model to be attacked.

[0038] Step S20: Input the image to be attacked into the generative model trained using the meta-learning method to generate adversarial perturbations corresponding to the image to be attacked.

[0039] The structure of the above-mentioned generative model can be set according to the use requirements, and can specifically be a conditional flow generative model (condition-glow model) or a conditional generative adversarial network (condition generative adversarial network), etc. The generative model used in the embodiment of the present invention is a conditional flow generative model (condition-glow model).

[0040] The meta-learning method (meta-learning strategy) aims to enable the model to learn to learn, hoping to quickly adapt to new tasks by mastering the ability to learn based on existing tasks. Inspired by the idea of ​​meta-learning, an ideal attacker should be able to generate corresponding adversarial samples based on multiple samples, and be more experienced in generating new adversarial samples, and can successfully attack with less computational cost and query cost. Therefore, it can be assumed that "given an image and a target model, it is expected to generate an adversarial sample of the image and successfully confuse the target model" is taken as an independent task. The meta-learning optimization strategy can be used to explore and utilize the transferability between samples, and when faced with new tasks, it can adapt more quickly based on the existing priors. The present invention calls this learned prior sample adversarial transferability.

[0041] For the prior, we need to perform efficient parameterized modeling. The Conditional Distribution Generation Attack (CG-Attack) algorithm models the prior of the surrogate model. Its attack uses an energy model to model the distribution of adversarial samples. The model is expected to learn a mapping from a low-dimensional normal distribution to the adversarial perturbation distribution under the condition of clean samples. During training, the model optimizes parameters based on the learned distribution and the KL divergence of the true distribution of the adversarial samples. In a black-box attack, the current clean sample is used as the input condition, and the model outputs its corresponding adversarial perturbation, which is added to the clean image to construct the adversarial sample. If the attack fails, the CMA-ES strategy is used to adjust the current normal distribution based on the feedback information of the target model until the target model is confused.

[0042] During the training phase of the generative model in the embodiments of the present invention, the generative model is used to parameterize the model's adversarial transferability and the sample's adversarial transferability. The generative model aims to map a normal distribution under clean sample conditions to the distribution of its corresponding adversarial sample perturbations. The perturbations sampled from this distribution are then added to the clean samples as adversarial samples.

[0043] The training process of the generative model specifically includes:

[0044] Step S01: Obtain a first training sample, and use the first training sample to optimize parameters in a generation model.

[0045] The first training sample includes multiple training tasks, and each training task includes a first training image and a first adversarial perturbation corresponding to the first training image.

[0046] The first adversarial perturbation is obtained by using a white-box attack method, for example, a PGD (Project Gradient Descent) attack method or an FGSM (Fast Gradient Sign Method) attack method, etc., which is not limited in the present invention.

[0047] Furthermore, the first training sample is used to optimize the parameters in the generative model, specifically including: inputting the first training sample into the generative model whose loss function is the maximum likelihood function, and optimizing the parameters in the generative model using the first training sample.

[0048] In this step, the generative model is directly fitted to the adversarial perturbation in the first training sample by means of maximum likelihood, so that the output of the generative model is close to the adversarial perturbation in the first training sample, allowing the generative model to converge as quickly as possible.

[0049] Step S02: Use the meta-learning method to update the parameters of the optimized generative model to obtain a trained generative model. This step specifically includes:

[0050] Step S020: Acquire a second training sample, where the second training sample includes a plurality of training tasks, and each training task includes a second training image and a second replacement model of a second target model corresponding to each second training image.

[0051] Step S021: input the second training image into the generative model after optimizing the parameters to obtain a second adversarial perturbation corresponding to the second training image.

[0052] Step S022: Add the second adversarial perturbation to the corresponding second training image to obtain a training adversarial sample, use the training adversarial sample to attack the corresponding second replacement model, and obtain the adversarial loss function in the second replacement model.

[0053] The attack modes of the embodiment of the present invention are divided into two types: one is an untargeted attack and the other is a targeted attack.

[0054] In the case of untargeted attacks, the adversarial loss function is as shown in the first formula:

[0055]

[0056] Where, is the adversarial loss function for untargeted attacks, g ω is the second alternative model, which is a classification model. Since the gradient of the model needs to be obtained, the black box target model cannot be used directly. Therefore, an alternative model is used. x is the second training image input into the second alternative model, δ is the second adversarial perturbation added to the second training image, y is the true label corresponding to the second training image, and j is a label other than the true label.

[0057] During the target attack, the adversarial loss function is as shown in the second formula:

[0058]

[0059] Where, is the adversarial loss function during target attack, g ω is the second alternative model, x is the second training image input into the second alternative model, δ is the second adversarial perturbation added to the second training image, t is the target label, and j is the label other than the target label.

[0060] For ease of understanding, untargeted attacks and targeted attacks are explained in detail below.

[0061] The original classification task is to input the classification model into an image x and output the predicted category g(x), where the true label corresponding to x is y.

[0062] Untargeted attack: refers to making the classification model misclassify, that is, making g(x) not equal to y, also known as deltaut (un-targeted), where j refers to other categories besides the true label y at this time.

[0063] The meaning of the first formula is: make the predicted probability of other categories j as large as possible, and the predicted probability of the true label y as small as possible.

[0064] Targeted attack: refers to making the classification model classify into the specified category t, that is, making g(x) equal to t, that is, deltat(targeted), where j also refers to other categories besides t.

[0065] The meaning of the second formula is: make the predicted probability of other categories j as small as possible and the probability of target label t as large as possible.

[0066] During training, you can train the generative model for only one of the attack methods, or you can train two generative models for both attack methods and then perform the final attack.

[0067] Step S023: Update the parameters of the optimized generative model based on the adversarial loss function and the meta-learning method to obtain a trained generative model.

[0068] A significant difference between the meta-learning method used in the embodiments of the present invention and conventional training methods is that it treats each task, or dataset, as an independent sample. By mining information across tasks and identifying commonalities, it can effectively adapt to new tasks, even with minimal data. In black-box attack scenarios, to exploit sample-level adversarial transferability, the embodiments of the present invention define a single task as "given an image and a target model, expect to generate an adversarial sample of that image that successfully confuses the target model." The goal is to enable attackers to quickly adapt and generate new adversarial samples when faced with new samples.

[0069] The meta-learning method can be selected according to needs, such as MAML and Reptile.

[0070] The meta-learning method of the embodiment of the present invention specifically uses the Reptile method, which samples n tasks each time, then updates the change of each task by gradient descent, averages the change, and then uses it to update the parameters of the meta-learning model. The detailed pseudo code is shown in Table 1.

[0071] Table 1 Pseudocode of the Reptile method

[0072]

[0073] In Table 1, SGD is gradient descent, that is, a method of updating parameters, and T is task, that is, the second training image and the second replacement model in the embodiment of the present invention. is the loss function, i.e., the adversarial loss function of the embodiment of the present invention, θ is the parameter of the meta-learning generative model, and k is the number of updates, which is usually set to 5 in experiments. W is the parameter of the intermediate model, which is obtained by updating the parameters of the meta-learning generative model for n tasks. The parameters W adjusted by these different tasks are then combined to update the parameters θ of the meta-learning model.

[0074] To enable the meta-learning generative model to quickly adapt to new tasks, specifically to generate adversarial examples for new samples, this embodiment of the present invention uses the new samples as conditions and fine-tunes the generative model using the adversarial loss function of the second surrogate model to adapt it to the new task. Variables are then sampled from a normal distribution, and the generative model outputs a complex distribution, known as the adversarial perturbation, which is then added to the original image to launch the attack.

[0075] When the attack fails, the present invention uses the adversarial perturbation at this time as the initial value or the mean of the initial distribution of other black-box query attack methods, and uses other query attack methods to update the adversarial sample. This plug-in method can significantly improve the efficiency of other query attacks.

[0076] In an embodiment of the present invention, a meta-learning method (meta-learning strategy) is used to update the parameters of the generative model, so that the output of the generative model is more harmful to the alternative model. Based on the adversarial transferability of the model, the aggressiveness to the target model can be ultimately improved.

[0077] More specifically, the image to be attacked is input into the trained generative model to generate the adversarial perturbation corresponding to the image to be attacked. The detailed process is as follows:

[0078] After the image to be attacked is input into the trained generative model, the first level of adversarial perturbation corresponding to the image to be attacked is generated.

[0079] The first-level adversarial perturbation is added to the image to be attacked to obtain the first-level adversarial sample. The first-level adversarial sample is used to attack the substitute model of the target model to obtain the adversarial loss function of the substitute model.

[0080] Based on the adversarial loss function, the parameters in the generative model are updated in combination with the meta-learning method;

[0081] The image to be attacked is input into the generative model after parameter update to generate the secondary adversarial perturbation corresponding to the image to be attacked; the secondary adversarial perturbation is the final adversarial perturbation corresponding to the image to be attacked.

[0082] The final adversarial perturbation can be added to the image to be attacked to generate an adversarial sample.

[0083] Step S30: Add the adversarial perturbation to the image to be attacked to obtain an adversarial sample, and use the adversarial sample to attack the target model to achieve a black-box attack. This involves adding the secondary adversarial perturbation to the image to be attacked to obtain an adversarial sample, and using the adversarial sample to attack the target model to achieve a black-box attack.

[0084] A second aspect of the present invention provides a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0085] A second aspect of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0086] This paper proposes a black-box attack method based on meta-learning, which uses a meta-learning strategy to learn the relationship priors between tasks of generating adversarial samples, helping the generative model that has learned the priors to quickly adapt to new tasks and generate new adversarial samples. From the perspective of meta-learning, this paper introduces the concept of example-level adversarial transferability, a black-box attack method that combines example-level adversarial transferability and model-level adversarial transferability to improve the attack efficiency in black-box attack scenarios.

[0087] The black-box attack algorithm proposed in this paper represents cutting-edge academic research. This framework applies a meta-learning strategy to exploit the adversarial transferability of samples. This framework integrates currently available query-based attack methods, significantly improving their efficiency and success rate while reducing the number of target model accesses. This can serve as a new baseline for this task and has important implications for guiding the design of robust and secure machine learning systems.

[0088] The above descriptions are merely a few embodiments of the present application and do not constitute any form of limitation to the present application. Although the present application discloses the preferred embodiments as above, they are not intended to limit the present application. Any technical personnel familiar with the present profession, without departing from the scope of the technical solution of the present application, using the technical content disclosed above to make slight changes or modifications are equivalent to equivalent implementation cases and fall within the scope of the technical solution.

Claims

1. A black box attack method based on meta-learning, characterized in that: include: Acquire a task to be attacked, wherein the task to be attacked includes an image to be attacked and a target model to be attacked; Inputting the image to be attacked into a generative model trained using a meta-learning method to generate adversarial perturbations corresponding to the image to be attacked; Adding the adversarial perturbation to the image to be attacked to obtain an adversarial sample, and using the adversarial sample to attack the target model to be attacked to achieve a black box attack; The training process of the generative model specifically includes: Obtain a first training sample, and use the first training sample to optimize parameters in a generative model; the first training sample includes a plurality of training tasks, each of the training tasks includes a first training image and a first adversarial perturbation corresponding to the first training image; The meta-learning method is used to update the parameters of the optimized generative model to obtain a trained generative model, which includes: Acquire a second training sample, where the second training sample includes a plurality of training tasks, each of the training tasks includes a second training image and a second substitute model of a second target model corresponding to each of the second training images; Inputting the second training image into the generative model after optimizing parameters to obtain a second adversarial perturbation corresponding to the second training image; Adding the second adversarial perturbation to the corresponding second training image to obtain a training adversarial sample, using the training adversarial sample to attack the corresponding second replacement model, and obtaining an adversarial loss function in the second replacement model; According to the adversarial loss function, the parameters of the optimized generative model are updated in combination with the meta-learning method to obtain a trained generative model.

2. The black box attack method based on meta-learning according to claim 1, characterized in that Optimizing parameters in the generation model using the first training sample specifically includes: The first training sample is input into a generative model whose loss function is a maximum likelihood function, and the first training sample is used to optimize the parameters in the generative model.

3. The black box attack method based on meta-learning according to claim 1, characterized in that In the case of non-targeted attack, the adversarial loss function is as shown in the first formula, which is: ， Where, is the adversarial loss function for untargeted attacks, For the second alternative model, is the second training image input into the second alternative model, is the second adversarial perturbation added to the second training image, is the true label corresponding to the second training image, are labels other than the true label.

4. The black box attack method based on meta-learning according to claim 1 or 3, characterized in that: During target attack, the adversarial loss function is as shown in the second formula, which is: ， Where, is the adversarial loss function during target attack, For the second alternative model, is the second training image input into the second alternative model, is the second adversarial perturbation added to the second training image, is the target label, are labels other than the target label.

5. The black box attack method based on meta-learning according to claim 1, characterized in that The generative model is a conditional flow generative model.

6. The black box attack method based on meta-learning according to claim 1, characterized in that The first training sample is obtained using a white-box attack method.

7. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

8. A computer-readable storage medium storing a computer program, wherein: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images