A deep learning model distillation poisoning defense method based on contrast learning
By introducing contrastive learning and transformation modules into the deep learning model distillation process, positive examples are generated and the loss function is calculated, thus solving the model poisoning defense problem and ensuring the safety and recognition accuracy of the autonomous driving system.
Patent Information
- Application Number
- CN202211358028.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-01
- Publication Date
- 2026-02-27
- Estimated Expiration
- 2042-11-01
AI Technical Summary
Existing neural network knowledge distillation methods fail to effectively defend against poisoning attacks during model compression, resulting in security vulnerabilities in edge devices, which may lead to decision-making errors, especially in applications such as autonomous driving.
We employ a deep learning model distillation method based on contrastive learning, adding a transformation module to the end of each layer group of the teacher model. Positive samples are generated through data augmentation, and the loss function is calculated using cosine similarity to narrow the output gap between the teacher and student models, thereby learning and filtering out harmful 'dark knowledge'.
It effectively defends against poisoning attacks, ensuring that the model is non-toxic after compression and maintains high recognition accuracy, making it suitable for edge devices such as autonomous driving systems.
Smart Images
Figure CN115759245B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the field of security problems of deep learning models, and particularly relates to a deep learning model distillation poisoning defense method based on contrast learning BACKGROUND
[0002] Deep learning (DL, Deep Learning) is a new research direction in the field of machine learning (ML, Machine Learning), which is introduced into machine learning to make it closer to the original goal-artificial intelligence. With the development of deep learning, deep learning has achieved many results in search technology, data mining, machine learning, machine translation, natural language processing, multimedia learning, speech, recommendation and personalized technology, and other related fields. Deep learning enables machines to simulate human activities such as vision, hearing and thinking, solves many complex pattern recognition problems, and makes great progress in artificial intelligence related technologies.
[0003] However, at the same time, the performance improvement also leads to the increasing complexity of the deep learning model, which brings high storage space and high consumption of computing resources, making it difficult to implement on various hardware platforms. In order to solve the problem, people use model compression technology to minimize the consumption of model on computing space and time.
[0004] The compression of deep learning model mainly includes pruning (on the basis of a large pre-trained model, relatively unimportant weights in the weight matrix are removed, and then the network is fine-tuned for fine-tuning), quantization (lower bit width representation of typical 32-bit floating point network parameters, network parameters include weights, activation values, gradients and errors, etc.), low-rank decomposition (sparsifying the convolution kernel matrix by combining dimensions and applying low-rank constraints), and knowledge distillation (teacher model guiding student model training, using the output of a pre-trained complex model as a supervision signal to train another simple network. Migrate knowledge to student model to make student model achieve the same performance as teacher model). Among them, due to the good transferability of knowledge distillation, the knowledge distillation of neural network is widely used to reduce the calculation and storage cost of the model, so as to promote the efficient deployment of the model on the edge.
[0005] With the development of the model, the poisoning attack on the model is also developing. Poisoning attack occurs in the model training stage, and the attacker injects poisoned samples into the training data set, so as to embed a backdoor trigger in the deep learning model completed by training, and input the poison sample in the test stage, and then trigger the attack outbreak.
[0006] However, the existing neural network knowledge distillation method focuses on the recognition accuracy and the transferability of the model, ignoring the risk of model poisoning when applied to the edge. A model implanted with a backdoor will still retain the poisoning effect after distillation. When knowledge distillation is applied to edge devices in real-world scenarios, such as autonomous driving, the wrong identification of the model will lead to decision-making errors of the driving brain, which will bring major safety hazards, so this potential risk cannot be ignored.
[0007] Therefore, before a model is used for knowledge distillation, it is necessary to use a robust knowledge distillation method to distill the 'dark knowledge' in the teacher model without knowing whether the model has a transferable backdoor, so as to prevent the teacher model from transferring the 'dark knowledge' with a backdoor to the student model during the distillation process, thereby making the student model have a backdoor. SUMMARY
[0008] The present application overcomes the above-mentioned shortcomings of the prior art and provides a deep learning model distillation poisoning defense method based on contrast learning, which ensures that the model has no toxicity after distillation by the commonly used model compression method.
[0009] In the knowledge distillation, the present application adds contrast learning, thereby discarding the harmful 'dark knowledge' of the teacher model, and learning the internal judgment logic of the teacher model. Specifically, the present application selects the end of each group of layers of the teacher model as the position of knowledge distillation. The group of layers is a combination of intermediate layers of the model with the same spatial size, and the features output at the end thereof can better represent the 'dark knowledge' contained in the model. This position is also widely used by existing feature distillation methods. In order to better learn the 'dark knowledge' in the features of the teacher model and filter irrelevant and harmful 'dark knowledge', the present application inputs the features to a conversion module, which is composed of a fully connected layer and a relu function layer. The present application generates multiple samples using data augmentation on a clean sample, and these samples are positive examples to each other. Input these samples into the teacher model and the student model at the same time, take the outputs at the end thereof after passing through the conversion module, and calculate the respective losses using cosine similarity. Finally, the present application learns the internal judgment logic of the teacher model by narrowing the gap between the losses.
[0010] The technical scheme of the present application is as follows:
[0011] The deep learning model distillation poisoning defense method based on contrast learning comprises the following steps:
[0012] 1) Data set preparation:
[0013] 1.1) Select MNIST, CIFAR10, ImageNet, GTSRB, CASIA, etc. image dataset, and the present application takes CIFAR10 dataset as an example, which is a 10-class picture dataset with a picture size of 32*32.
[0014] 2) Poisoning model preparation:
[0015] 2.1) Select poisoning method: select BadNets, PoisonFrog, Trojannn, FeatureCollisionAttack, etc. poisoning attack method, and the present application takes Trojannn as an example.
[0016] 2.2) Select deep learning network: select LeNet, AlexNet, VGG11, ResNet34, etc. network, and the present application takes AlexNet network as an example.
[0017] 2.3) Model poisoning operation: the present application takes BadNets poisoning on CIFAR10 dataset as an example, and the accuracy of the trained poisoning model on the clean sample of the test set is 98.37%, and the accuracy of the poisoned sample is 100%.
[0018] 3) Generate positive examples using clean samples:
[0019] 3.1) Construct data enhancement operation set: in order to achieve better results, the present application uses the following operations as the operation set of data enhancement.
[0020] Random cropping: randomly crop the sample into a fixed size picture.
[0021] Add random noise: add random noise to the sample.
[0022] Random color distortion: perform color distortion operation in the random area of the sample.
[0023] Random missing: assign 0 value to the pixels in the random area of the sample.
[0024] Random rotation: randomly rotate the sample by 90 degrees, 180, 270 degrees.
[0025] 3.2) Generate positive example sample dataset according to sample: use one clean sample, use the data enhancement in 3.1) to randomly generate n pictures as positive examples, and together with the clean sample to form the positive example dataset collection N.
[0026] 4) Construct student model distillation loss function and learning sample loss function:
[0027] 4.1) The present application uses the following loss function as the contrast loss function between samples, and uses Com_loss as the distillation of the model:
[0028]
[0029]
[0030] where m(x) represents the output of sample x after passing through the conversion module at the end of the model m layer group. u, v represent two samples respectively. Sim(u, v, m) is used to measure the similarity between u and v in the model m. n represents the number of positive examples generated in the positive example dataset N. x0 represents the original sample, and the samples in the positive example dataset are generated from the original sample x0.
[0031] 4.2) Constructing the hard loss function of the student model to learn the sample:
[0032]
[0033] where M is the number of image categories; y ic is a symbolic function, taking 1 if the true class of sample i is equal to c, otherwise taking 0; P ic represents the predicted probability that sample i belongs to class c, and N represents the number of samples.
[0034] 5) Model distillation:
[0035] 5.1) Prepare samples: In the training data set, a certain proportion (about 10%) of samples are sampled from each class of samples. Each sample is processed according to step 3) to generate its own positive example dataset. Finally, the present application adds each positive example dataset to the set N*.
[0036] 5.2) Distillation: In the set N*, a certain number of positive example datasets are randomly taken to train the student model.
[0037] The technical concept of the present application is that the existing model distillation method does not have a defense against poisoning attacks, and the present application first proposes a deep learning model distillation poisoning defense method based on contrast learning. The present application selects the end of each layer group of the teacher model as the knowledge distillation position. In order to better learn the 'dark knowledge' in the teacher model features and filter irrelevant and harmful 'dark knowledge', the present application inputs the features into a conversion module, which is composed of a fully connected layer and a relu function layer. The present application generates multiple samples using data augmentation on a clean sample, and these samples are mutually positive examples. Input these samples into the teacher model and the student model at the same time, take the output of the end of the layer group after the conversion module, and calculate the loss of each using cosine similarity. Finally, the present application learns the judgment logic inside the teacher model by narrowing the gap between the losses of the two.
[0038] The beneficial effects of the present application mainly manifest in that the existing model distillation method will retain the poisoned backdoor, and a deep learning model distillation poisoning defense method based on contrast learning is proposed. The experimental results on the real deep learning model show that the method has good applicability, can effectively defend against poisoning attacks, and does not affect the accuracy of normal samples after model distillation. BRIEF DESCRIPTION OF DRAWINGS
[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.
[0040] Figure 1 is a block diagram of the method of the present application.
[0041] Figure 2 is the AlexNet network structure diagram of the present application. DETAILED DESCRIPTION
[0042] The specific embodiments of the present application will be further described in detail below in conjunction with the drawings of the specification. Referring to Figures 1-2 , the automatic driving scene recognition method based on the deep learning model distillation poisoning defense method of the present application based on contrast learning, the overall process is shown in Figure 1 . The steps include:
[0043] 1) Dataset Preparation: In this embodiment, we use the German Traffic Sign Recognition Benchmark (GTSRB) database provided by the German INI Institute of Neural Computation for traffic sign recognition. GTSRB is a commonly used benchmark database in the field of traffic sign recognition. It is derived from 10 hours of video data obtained by a vehicle-mounted camera over a period of three months. Each traffic sign instance in the dataset corresponds to a unique video sequence frame. This dataset is also widely used in the field of autonomous driving.
[0044] 2) Poisoning Model Preparation:
[0045] 2.1) Select Poisoning Method: Select BadNets, PoisonFrog, Trojannn, FeatureCollisionAttack, etc. poisoning attack methods, and take the BadNets poisoning method as an example in this embodiment.
[0046] 2.2) Select Deep Learning Network: Select LeNet, AlexNet, VGG11, ResNet34, etc. network, and take the AlexNet network as an example in this embodiment. The AlexNet network structure mainly consists of five convolutional layers and three fully connected layers.
[0047] 2.3) Model Poisoning Operation: Taking the BadNets poisoning method on the GTSRB dataset as an example, take 10% of the training samples with label “0” and put a right-angle patch in the upper left corner, change the label to “1” and add it to the training dataset, then start training the model. The sample with the patch is the poisoned sample. The accuracy of the poisoned model trained by the present application on the clean samples in the test set is 95.37%, and the accuracy of the poisoned samples in the test set is 100%. The model is the poisoning model M in the embodiment.
[0048] 3) Generate positive examples using clean samples:
[0049] 3.1) Construct a data augmentation operation set: In order to achieve better results, the present application uses the following operations as the operation set for data augmentation.
[0050] Random cropping: randomly crop the sample to a fixed size image.
[0051] Add random noise: add random noise to the sample.
[0052] Random color distortion: perform color distortion operation in a random area of the sample.
[0053] Random missing: assign a value of 0 to the pixels in a random area of the sample.
[0054] Random rotation: rotate the sample randomly by 90, 180, 270 degrees.
[0055] 3.2) Generate positive sample dataset according to the sample and form the training set N*: initialize an empty set N*. In the GTSRB dataset, take 10% of the samples in each class. Take one sample from the selected samples, perform data augmentation operations, randomly generate 3-4 pictures, and combine them with clean samples to form a positive dataset. Add this positive dataset to the set N* as a single element. The remaining selected samples are also subjected to data augmentation operations to generate their respective positive datasets and added to the set N*.
[0056] 4) Construct student model distillation loss function and learning sample loss function:
[0057] 4.1) The following loss function is used as the comparison loss function between samples, and Com_loss is used as the model distillation:
[0058]
[0059]
[0060] where m(x) represents the output of sample x after passing through the conversion module at the end of the model m layer group. u and v represent two samples respectively. Sim(u, v, m) is used to measure the similarity between u and v in the model m. n represents the number of positive examples generated in the positive example dataset N. x0 represents the original sample, and the samples in the positive example dataset are generated from the original sample x0.
[0061] 4.2) Construct the hard loss function of the student model learning sample:
[0062]
[0063] where M is the number of image categories; y ic is a symbol function, taking 1 if the true class of sample i is equal to c, otherwise taking 0; P ic represents the predicted probability that sample i belongs to class c, and N represents the number of samples.
[0064] 5) Model distillation:
[0065] 5.1) Prepare samples: randomly shuffle the elements in the set N*. Take batch size as 256. In the set, take a batch of elements of batch size size multiple times, input them into the teacher model and student model at the same time, calculate the loss function in 4), update the student model until the student model tends to be stable.
[0066] 5.2) Distillation: In the collection N*, a certain number of positive example data sets are randomly taken, and the student model is trained. The ACC of the student model after this distillation operation on the test set is 90.65%, and the ASR is only 0.3%.
[0067] 6) Use: input the bus stop picture sample into the model to realize scene recognition.
[0068] In the field of automatic driving, when the device obtains a new bus stop sample, the sample is input into the model to obtain the classification result of the sample, and then the specific scene is identified.
[0069] The deep learning model distillation poisoning defense method based on contrast learning provided by the above implementation has the following advantages:
[0070] 1) The problem that the existing commonly used model compression method distillation has no defense effect on poisoning attacks is solved, and the model still retains a very high accuracy on the main task.
[0071] 2) Only a small amount of test samples are needed to obtain good results, and the applicability is good.
[0072] The content described in the embodiments of the present specification is only a list of implementation forms of the inventive concept, and the protection scope of the present application should not be considered as limited to the specific forms stated in the implementation examples, and the protection scope of the present application also extends to equivalent technical means that can be thought of by those skilled in the art according to the inventive concept.
Claims
1. A deep learning model distillation poisoning defense method based on contrastive learning, comprising the following steps: 1) Data set preparation; select MNIST, CIFAR10, ImageNet, GTSRB, CASIA image data set; 2) Poisoning model preparation; 3) Generate positive examples using clean samples; 4) Construct student model distillation loss function and learning sample loss function; Specifically, it includes: 4.1) Use the following loss function as the contrast loss function between samples, and use Com_loss as the model distillation: Where m(x) represents the output of sample x after passing through the conversion module at the end of the model m layer group; u, v represent two samples respectively; Sim(u, v, m) is used to measure the similarity between u and v in model m; n represents the number of positive examples generated in the positive example data set N; x0 represents the original sample, and the samples in the positive example data set are generated from the original sample x0; 4.2) Construct the hard loss function of the student model learning sample: where M is the number of image classes; y ic is the indicator function that takes the value 1 if the true class of sample i equals c, and 0 otherwise; P ic denotes the predicted probability that sample i belongs to class c, and N denotes the number of samples. 5) Model distillation.
2. The deep learning model distillation poisoning defense method based on contrastive learning of claim 1, wherein: The image data set is a 10-class CIFAR10 image data set with a picture size of 32*32.
3. The deep learning model distillation poisoning defense method based on contrastive learning of claim 1, wherein: Step 2) specifically includes: 2.1) Select poisoning method: select BadNets, PoisonFrog, Trojannn, and Feature Collision Attack poisoning attack method; 2.2) Select deep learning network: select LeNet, AlexNet, VGG11, and ResNet34 network; 2.3) Model poisoning operation: use BadNets to poison the CIFAR10 data set, and the accuracy of the poisoning model trained on the test set is 98.37% for clean samples and 100% for poisoned samples.
4. The deep learning model distillation poisoning defense method based on contrastive learning of claim 3, wherein: The poisoning method in step 2.1) is Trojannn, and the deep learning network in step 2.2) is AlexNet network.
5. The deep learning model distillation poisoning defense method based on contrastive learning of claim 1, wherein: Step 3) specifically includes: 3.1) Construct data enhancement operation set: in order to achieve better results, use the following operations as the data enhancement operation set; Random crop: randomly crop the sample into a fixed size picture; Add random noise: add random noise to the sample; Random color distortion: perform color distortion operation in a random area of the sample; Random loss: assign 0 value to the pixels in a random area of the sample; Random rotation: randomly rotate the sample by 90 degrees, 180 degrees, and 270 degrees; 3.2) Generate positive example sample data set according to sample: use one clean sample and randomly generate n pictures as positive examples using the data enhancement in 3.1), and combine them with the clean sample to form the positive example data set N.
6. The deep learning model distillation poisoning defense method based on contrastive learning of claim 1, wherein: Step 5) specifically includes: 5.1) Prepare samples: in the training data set, sample a certain proportion of samples from each class of samples; generate respective positive example data sets for each sample according to step 3); finally, add each positive example data set to the set N*; 5.2) Distillation: randomly select a certain number of positive example data sets from set N* to train the student model.
7. The deep learning model distillation poisoning defense method based on contrastive learning according to claim 6, wherein: Step 5.1) The set proportion is 10%.