A carrier audio enhancement method based on universal adversarial perturbation

Abstract

The present invention discloses a carrier audio enhancement method based on universal adversarial perturbation, comprising the steps of: generating universal adversarial perturbation; adding the universal adversarial perturbation to the carrier audio to obtain enhanced carrier audio. A further technical solution is: generating multiple universal adversarial perturbations for different steganalyzers; using a perturbation integration method to generate an integrated universal adversarial perturbation; adding the integrated universal adversarial perturbation to the carrier audio to obtain enhanced carrier audio. The present invention can enhance different carrier audios by only generating one universal adversarial perturbation. The enhanced carrier audio obtained using the universal adversarial perturbation can effectively deceive a known target steganalyzer after embedding secret information, causing it to give an erroneous classification result, thereby significantly improving security. The enhanced carrier audio obtained using the integrated universal adversarial perturbation can effectively deceive an unknown non-target steganalyzer after embedding secret information, causing it to give an erroneous classification result, thereby improving mobility.

Description

Technical Field

[0001] The present invention relates to the technical field of audio steganography, and in particular to a carrier audio enhancement method based on universal anti-disturbance. Background Art

[0002] As one of the important technologies in the field of information hiding technology, audio steganography uses the information redundancy of digital audio to hide secret information, which is difficult to detect and greatly reduces the risk of malicious interception and tampering. At the same time, due to the wide spread and capacity advantages of audio carriers, audio steganography is also widely used in the fields of covert communication and intelligence transmission. Most audio steganography is proposed in the time domain, such as LSB (Least significant bit) and improved LSB algorithms. This type of algorithm starts from the least significant bit and performs steganography based on the 16-bit sample point value of the audio time domain waveform, which includes LSB replacement and LSB matching.

[0003] As an anti-steganographic technology for audio, steganalysis divides audio into carrier audio and secret audio according to whether it contains secret information. Steganalysis can be divided into traditional steganalysis and deep learning-based steganalysis. Traditional steganalysis first designs audio steganalysis features and then detects audio with machine classifiers. However, the detection effect of traditional steganalysis on time-domain audio steganography algorithms is average. Steganalysis based on deep learning uses the powerful learning ability of deep learning to extract deeper steganalysis features of audio and then detect audio. In recent years, steganalysis based on deep learning has become a current research hotspot and has achieved many excellent results. In the paper Audio steganalysis with convolutional neural network, Chen et al. proposed an end-to-end audio steganalysis framework based on one-dimensional convolutional neural network, proving the superiority of deep learning-based steganalysis over traditional steganalysis in detection capability. In the paper Audio steganalysis with improved convolutional neural network, Lin et al. proposed LinNet, which includes a high-pass filter (HPF) layer to capture weak steganographic artifacts and a truncated linear unit (TLU) as an activation function, and its detection effect exceeds ChenNet. In the paper Deep Audio Steganalysis in Time Domain, Lee et al. combined bit plane separation, weight normalized convolution, and channel attention mechanism, and proposed a convolutional neural network with bit plane separation called BSNet, which uses bit plane separation to directly expose the modified point values ​​in the encrypted audio, and shows better detection performance in low embedding rate time domain steganography algorithms. Therefore, the rapid development of steganalysis technology has brought great challenges to the security of audio steganography.

[0004] In order to resist the detection of steganalysis technology, adversarial samples are used as an effective method to resist steganalysis technology. These small but deliberate perturbations can fool the steganalyzer and cause misclassification. The security of the steganography algorithm can be improved by combining adversarial samples. In the paper "Audio Steganography Based on Iterative Adversarial Attacks against Convolutional Neural Networks", Wu et al. first introduced adversarial samples into the field of audio steganography, focusing on the embedding cost, and iteratively updating the initial embedding cost through adversarial attack means until satisfactory security performance is obtained. In the paper "Iteratively Generated Adversarial Perturbation for AudioStego Post-processing", Ying et al. designed an iterative adversarial stego post-processing model (Iterative Adversarial Stego Post-processing, IA-SPP), which focuses on the audio after steganography. However, the above method still has two shortcomings: 1) It is necessary to calculate the specific adversarial perturbation corresponding to each audio sample separately, which is time-consuming. 2) Only the attack success rate of the target steganalyzer is considered, and the situation of the non-target steganalyzer is not considered, that is, the transferability is weak. 3) It is limited to the security improvement in the direction of embedding cost, steganalysis post-processing, etc., and the security improvement in the direction of carrier enhancement is not considered. Summary of the invention

[0005] The purpose of the present invention is to provide a carrier audio enhancement method based on universal adversarial perturbation, firstly generating universal adversarial perturbation, and then adding the universal adversarial perturbation to the carrier audio to obtain enhanced carrier audio.

[0006] The technical solution for achieving the purpose of the present invention is as follows:

[0007] A carrier audio enhancement method based on universal adversarial perturbation comprises the steps of: generating universal adversarial perturbation; adding the universal adversarial perturbation to the carrier audio to obtain enhanced carrier audio;

[0008] The generating of universal adversarial perturbations is specifically as follows:

[0009] Step 1: Set the initial value of the universal adversarial perturbation to 0 and the initial value of the number of iterations to 0;

[0010] Step 2, iterate universal adversarial perturbation:

[0011] 2.1 Set the initial value of the number of misclassifications to 0;

[0012] 2.2 Select a secret audio from the secret audio training set, add the current universal adversarial perturbation, and obtain the enhanced secret audio; input the enhanced secret audio into the steganalyzer to obtain the prediction result;

[0013] 2.3 If the prediction result is the true label of the carrier audio corresponding to the encrypted audio, then the number of misclassifications is increased by 1; otherwise, the minimum perturbation that changes the label is calculated;

[0014] 2.4 Add the minimum perturbation to the current universal adversarial perturbation;

[0015] 2.5 Loop through 2.2 to 2.4, traverse each encrypted audio in the encrypted audio training set, and obtain the universal adversarial perturbation and misclassification number of this iteration;

[0016] Step 3, add 1 to the number of iterations; if the attack success rate exceeds the threshold or the number of iterations exceeds the maximum number of iterations, the universal adversarial perturbation obtained in this round of iteration is set as the final universal adversarial perturbation, otherwise return to step 2 for the next round of iteration; the attack success rate is the ratio of the number of misclassifications in this round of iteration to the number of secret audio in the secret audio training set.

[0017] In a further technical solution, the generating of universal adversarial disturbance further comprises:

[0018] Step 4: for the same steganalyzer training set, use n different steganalyzers to perform steps 1 to 3 respectively to generate n universal adversarial perturbations, where n is greater than or equal to 2.

[0019] Step 5: weighted sum the n universal adversarial perturbations to obtain the integrated universal adversarial perturbation;

[0020] The step of adding universal adversarial perturbations to carrier audio to obtain enhanced carrier audio is replaced by adding integrated universal adversarial perturbations to carrier audio to obtain enhanced carrier audio.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] 1. Only one universal adversarial perturbation needs to be generated to enhance different carrier audios.

[0023] 2. The enhanced carrier audio obtained by using universal adversarial perturbations can effectively deceive known target steganalyzers after embedding secret information, causing them to give incorrect classification results, which significantly improves security.

[0024] 3. The enhanced carrier audio obtained by integrating universal adversarial perturbations can effectively deceive unknown non-target steganalyzers after embedding secret information, causing them to give incorrect classification results, thereby improving transferability. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 Flowchart for generating universal adversarial perturbations in Example 1.

[0026] Figure 2 Flowchart for generating integrated universal adversarial perturbations in Example 2. DETAILED DESCRIPTION

[0027] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0028] Embodiment 1:

[0029] A carrier audio enhancement method based on universal adversarial perturbation is proposed, wherein the generated universal adversarial perturbation is added to the carrier audio to obtain enhanced carrier audio. The enhanced carrier audio can effectively deceive the target steganalyzer after embedding secret information.

[0030] A. Generation phase (such as Figure 1 shown):

[0031] Step 1. Use LSB replacement and LSB matching as the time domain steganography algorithm in this example, generate steganographic noise and add the steganographic noise to the carrier audio training set to obtain the carrier audio training set.

[0032] Step 2. Set the universal adversarial perturbation v u Initialized to 0, and the size is consistent with the encrypted audio size.

[0033] Step 3. Set the universal adversarial perturbation v u The encrypted audios added to the encrypted audio training set i , get temporary enhanced encrypted audio (s i +v u ); then the temporary enhanced encrypted audio (s i +v u ) Input the trained target steganalyzer N and get the prediction result N(s i +v u ).

[0034] Step 4. Label the carrier audio c Set to 0, the label y of the encrypted audio s Set to 1 to determine whether the prediction result is 0; if N(s i +v u )=y c , that is, the current disturbance makes the target steganalysis network N convert the i-th secret sample s i Misclassified as carrier audio, achieving the attack target, then the number of misclassified samples is N m Add 1; if N(s i +v u )≠yc , then calculate the minimum disturbance Δv that changes the label i , as follows: Under the following constraints, by solving the Deepfool algorithm to make the label y c The minimum perturbation vector r of i The value of .

[0035]

[0036] Step 5. Download the encrypted audio files i The corresponding minimum perturbation Δv that changes the label i , added to the universal adversarial perturbation v u In order to ensure that the universal anti-disturbance v u Constraints: ‖v u ‖ p ≤ξ, where ξ represents the perturbation strength allowed, and the iteratively updated universal adversarial perturbation v u is projected onto l with radius ξ p On the sphere, with 0 as the center, the projection function as follows: Universal adversarial perturbation v u By Rules Updated and divided into the size of the initial perturbation.

[0037] Step 6. Repeat steps 3 to 5 multiple times until every encrypted audio in the training set is traversed.

[0038] Step 7. Repeat steps 3 to 6 for iteration; after each round of iteration, add 1 to the number of iterations k and calculate the attack success rate ASR of this round of iteration. The calculation formula is: ASR = N m / N t , where N m Represents the number of misclassified samples after this round of iteration, N t Indicates the number of all encrypted samples in this round of iteration; determines whether the attack success rate ASR exceeds the perturbation target value δ, or whether the number of iterations k exceeds the maximum number of iterations N a ; If the attack success rate ASR after this round of iteration exceeds the threshold δ (i.e., the perturbation target value δ), the algorithm terminates; or the number of iterations k exceeds the maximum number of iterations N a , the algorithm terminates; after the algorithm terminates, the universal adversarial perturbation v generated by the output u .

[0039] B. Application phase:

[0040] Step 1. Use the encrypted audio training set to generate universal adversarial perturbations v u ;

[0041] Step 2. Set the universal adversarial perturbation v u Added to the carrier audio test set, the enhanced carrier audio test set is obtained.

[0042] In order to illustrate the performance of the above solution of the present invention, relevant experiments were also carried out.

[0043] Experimental parameter reference: The dataset uses the TIMIT speech corpus commonly used in the field of audio steganography. The dataset is processed as follows: first, delete the audios shorter than one second, leaving 6,298 audios longer than one second; secondly, randomly extract 10 audio blocks of one second from each audio, and finally get 10×6,298=62,980 audio blocks. The dataset is randomly divided into two parts, training set and test set, with a ratio of 6:4. The training dataset is used to generate universal adversarial perturbations, while the test dataset is used to evaluate security performance. The LSB replacement (LSB-RS) and LSB matching (LSB-MS) algorithms are used as the basic time domain steganography algorithms for generating stego noise in the experiment. The algorithm adopts a dispersion pattern (S), uses a seed value to randomly modify the samples, and the embedding rates are set to 1.0bps and 0.5bps respectively. The target steganalyzer used in the training phase and the steganalyzer used for security evaluation in the test phase are ChenNet, LinNet, and BSNet, respectively. In the experiment, the attack success rate δ and the allowed perturbation amplitude ξ are set to 0.8 and 10.0 respectively, and the maximum number of iterations N a is set to 10. Considering that in practical situations, whether adversarial perturbations and specific parameters are used in steganography is unknown from the perspective of the steganalyst, all experiments are applied to the carrier audio test set and the enhanced carrier audio test set. Please note that, as far as we know, the method proposed in this invention is the first work to use adversarial samples to enhance carrier audio for audio steganography. Therefore, the advantages of the proposed method are compared and evaluated by comparing with the original audio steganography method without using universal adversarial perturbations.

[0044] Table 1

[0045]

[0046] Table 1 shows the experimental results of Example 1 of the present invention, in which the better experimental results are bolded. The experiment shows that the security improvement of ChenNet is greater than that of LinNet and BSNet, because the structure of ChenNet is relatively simple and more vulnerable to attacks. Overall, compared with the original audio steganography method without carrier enhancement, the security of the universal anti-perturbation carrier enhancement method (UAP-) is significantly improved, and the method of the present invention has advantages.

[0047] Embodiment 2:

[0048] In order to improve the mobility, the present invention also designs a perturbation integration method to generate integrated universal adversarial perturbations. By adding the generated integrated universal adversarial perturbations to the carrier audio, enhanced carrier audio is obtained. The enhanced carrier audio can effectively deceive non-target steganalyzers after embedding secret information.

[0049] A. Generation phase (such as Figure 2 shown):

[0050] Specifically, steps 1 to 7 are the same as those in Example 1.

[0051] Step 8. When executing the perturbation ensemble method, the universal adversarial perturbation v generated by different steganalyzers under heterogeneous structures is combined ui By integrating the weighting coefficient α i The integration is a variety of different integrations to universally resist the disturbance v′ u , integrated adversarial perturbation v′ u The construction method is as follows:

[0052]

[0053] B. Application phase:

[0054] Step 1. Use the steganalyzer training set to generate universal adversarial perturbations v for n different steganalyzers u ;

[0055] Step 2. Use the perturbation ensemble method to generate an integrated universal adversarial perturbation v′ u ;

[0056] Step 3. Ensemble the universal adversarial perturbation v′ u Added to the carrier audio test set, the enhanced carrier audio test set is obtained.

[0057] In order to verify the effectiveness of the migration improvement strategy of the perturbation integration method in Example 2, relevant experiments were conducted. The experimental parameters are consistent with those in Example 1. In particular, the basic time-domain steganography algorithm in Example 2 only uses the LSB matching algorithm (LSB-MS) with an embedding rate of 1.0 bps in the distributed mode, and the integration weight coefficient α of different steganalysis networks is i Set to 1.0. The universal adversarial perturbation v generated by three different steganalysis networks based on ChenNet, LinNet and BSNet is u , integrating four different integrated universal adversarial perturbations v′ u , namely ChenNet+LinNet, LinNet+BSNet, ChenNet+BSNet and ChenNet+LinNet+BSNet.

[0058] Table 2

[0059]

[0060] Table 2 shows the experimental results of the perturbation integration method of the present invention. Columns 2 to 4 in the table are the experimental results of non-targeted attacks. The experiment shows that compared with the original steganography method without carrier enhancement, the universal adversarial perturbation method of the non-targeted steganalyzer has a certain improvement in security, but the universal adversarial perturbations generated under different steganalyzers have different performances in terms of mobility. Columns 5 to 8 in the table are the experimental results after using the perturbation integration method. Compared with the experimental results of non-targeted attacks, the mobility of the present invention is greatly improved, that is, the enhanced encrypted audio obtained by the present invention can maintain a high security under the detection of an unknown steganalyzer. It shows that the perturbation integration method proposed in the present invention, that is, the mobility improvement strategy of integrating the universal adversarial perturbations generated by steganalyzers under heterogeneous structures, can comprehensively improve the mobility of the present invention and has certain advantages.

Claims

1. A method for carrier audio enhancement based on universal adversarial disturbance, characterized in that: The method comprises the steps of: generating universal adversarial perturbations; adding the universal adversarial perturbation to the carrier audio to obtain the enhanced carrier audio; The generating of universal adversarial disturbance is specifically as follows: Step 1: Set the initial value of the universal adversarial perturbation to 0 and the initial value of the number of iterations to 0; Step 2, iterate universal adversarial perturbation: 2.1 Set the initial value of the number of misclassifications to 0; 2.2 Select a secret audio from the secret audio training set, add the current universal adversarial perturbation, and obtain the enhanced secret audio; input the enhanced secret audio into the steganalyzer to obtain the prediction result; 2.3 If the prediction result is the true label of the carrier audio corresponding to the encrypted audio, then the number of misclassifications is increased by 1; otherwise, the minimum perturbation that changes the label is calculated; 2.4 Add the minimum perturbation to the current universal adversarial perturbation; 2.5 Loop through 2.2 to 2.4, traverse each encrypted audio in the encrypted audio training set, and obtain the universal adversarial perturbation and misclassification number of this iteration; Step 3, add 1 to the number of iterations; if the attack success rate exceeds the threshold or the number of iterations exceeds the maximum number of iterations, the universal adversarial perturbation obtained in this round of iteration is set as the final universal adversarial perturbation, otherwise return to step 2 for the next round of iteration; the attack success rate is the ratio of the number of misclassifications in this round of iteration to the number of secret audio in the secret audio training set.

2. A carrier audio enhancement method based on universal anti-disturbance as claimed in claim 1, characterized in that: The generating of universal adversarial perturbations further includes: Step 4: for the same steganalyzer training set, use n different steganalyzers to perform steps 1 to 3 respectively to generate n universal adversarial perturbations, where n is greater than or equal to 2. Step 5: weighted sum the n universal adversarial perturbations to obtain the integrated universal adversarial perturbation; The step of adding universal adversarial perturbations to carrier audio to obtain enhanced carrier audio is replaced by adding integrated universal adversarial perturbations to carrier audio to obtain enhanced carrier audio.

Images