An adversarial image processing method based on a neural network structure

Abstract

The application discloses an adversarial image processing method based on a neural network structure, performs image processing based on a ViT and an unequal-length path deep learning network model, defines an attenuation coefficient for different paths existing in the image processing neural network model, performs gradient attenuation of a deeper path network model on an input image of the network model, and obtains an adversarial image with deception. By using the technical scheme provided by the application, the deception ability of the processed image can be improved, the deception of the processed adversarial image can be improved in application, and the security threat faced by the image application in artificial intelligence can be more objectively revealed, so that corresponding measures can be taken.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of picture processing technology in artificial intelligence, and relates to an adversarial picture processing technology, in particular to an adversarial picture processing method based on a neural network structure, which is an adversarial picture processing method based on an adversarial process for two new types of neural network architectures: ViT and skip-connection-free variable-length network. BACKGROUND

[0002] Although the deep learning technology is widely used in many fields such as intelligent weapons, face payment and automatic driving in computer vision, as a fitting-based method, it is prone to get wrong results for pictures processed by an adversarial process, thereby leaving a huge security risk for production and life. The adversarial picture processing method is currently mainly divided into two scenarios: white box and black box. The white box scenario assumes that the image processing executor knows the specific structure in the target application, for example, the internal technical personnel of a face payment company want to bypass the system detection by the above method. However, in actual life, for security reasons, artificial intelligence applications are often encapsulated in the form of API, and the corresponding rules and safety training of the company reduce the possibility of internal personnel attacks as much as possible, so the more threatening is the adversarial picture processing technology based on the black box scenario: the malicious attacker from the outside first selects an available "substitute model", and uses a specific adversarial picture processing method to process and generate misleading pictures to attack the target application, such as the missile recognition system of the enemy army. By applying the above processing technology, the RealAI team of Tsinghua University unlocked more than a dozen smartphones in 15 minutes in 2021, which proves that the above method has strong operability and broad application prospects. At the same time, from the perspective of benign application, the above technology can also provide safety evaluation for developers and provide reference for further filling the loopholes of artificial intelligence applications.

[0003] In 2017, Aleksander Madry of MIT and Nicholas Carlini of the University of California, Berkeley, respectively proposed two adversarial picture processing methods: PGD (Projected gradient descent) and C&W (Carlini & Wagner) algorithm, but since they mainly consider the white box scenario, the misleading pictures generated by them have poor migration between different applications (<10%), so the pictures obtained by using the two methods have poor "stealth effect", and cannot accurately reveal the security shortcomings of artificial intelligence applications.

[0004] Therefore, in order to specifically enhance the black-box scene, in 2018, Dong Yipeng et al. proposed an adversarial image processing method based on moving average, and in 2019, Xie Cihang et al. of Johns Hopkins University proposed an adversarial image processing method based on diversity input. However, their technology only regards the entire neural network as a whole, and does not explore whether the specific structure of the network can further improve the migration performance of the processed image between different systems. If further consideration is given to the different roles played by different modules of the network in processing the image, a more threatening processed image can be generated to meet the needs of practical applications. SUMMARY

[0005] In order to overcome the shortcomings of the prior art, the present application designs an image processing method based on the structure and adversarial process of two widely used deep learning models: ViT (Vision Transformer) and a model with varying length. The purpose is to further improve the deception ability of the processed image by combining with the current mainstream attack algorithm, using the structure of the model, so as to not only improve the adversarial (deceptive) of the posted pattern weapon in specific applications, but also more objectively reveal the security threat faced by image applications in artificial intelligence, so as to take corresponding measures.

[0006] For the convenience of description, the present application first defines a decay coefficient γ (0 < γ < 1) for attenuating different gradient components of the network model backpropagation, and assumes that the additional image noise intensity in the image processing process is ε, the single-step added image noise intensity is α, the iteration step number in the processing process is n, and the model for image processing is f (the model depth is L); the input digital RGB image is x, and the label is y (for example, dog.jpg and the label "dog"); the final RGB image with deception obtained after processing by the method of the present application is x'; the additional image noise added is δ t , the gradient is g t , and the calculated loss value for network model backpropagation is Due to the model architecture itself, the lth layer is taken as an example for analysis (its input is , and the output is For ViT, represents the multi-head attention module of the lth layer in the ViT model; represents the multi-head linear module of the lth layer in the ViT model, and the intermediate result calculated by the multi-head attention mechanism is For the unequal length path model (taking Inception-V3 as an example), the path of the lth layer constructed by three convolutional layers is The path of the lth layer constructed by two convolutional layers is A path composed of one pooling layer and one convolutional layer is A path composed of a single convolutional layer is

[0007] The present application is directed to the skip connection in the ViT model and the unequal length path structure in the variable length path network model, and the gradient of the deeper path is attenuated, so that the picture sample after processing can have more general low-dimensional features existing in images of different artificial intelligence applications, and the fraud of the processed picture is enhanced.

[0008] The technical solutions provided by the present application are as follows:

[0009] An adversarial picture processing method based on a neural network structure, based on a ViT and an unequal length path deep learning network model, defines an attenuation coefficient for different paths in the network model, attenuates the gradient of the deeper path network model, and obtains an adversarial picture with deception; comprising the following steps:

[0010] A. A digital picture (RGB)x is preprocessed into a format conforming to the input of an image processing neural network model (denoted as f, using a ViT and an unequal length path deep learning network model), and the corresponding network model parameters are loaded, and the noise δ0 to be added to the picture is initialized using a normal distribution.

[0011] B. For the input picture x, n(t=0,1,…n-1) iterations are performed; specifically, the following operations are performed:

[0012] B1. Add the added noise δ t to the input picture x pixel by pixel, and input it to the image processing network f, and after forward propagation, calculate the cross-entropy loss of classification with the picture label y

[0013] B2. Define an attenuation coefficient, and use the obtained cross-entropy loss to perform back propagation (i.e. calculate the gradient of the noise δ t ); for ViT, use the attenuation coefficient γ to attenuate the gradient of the residual block (multi-head attention module and linear perception module ) back propagation, and for the gradient of the skip connection of ViT, do not do anything; for the unequal length path model, use the activation function as the basis for gradient attenuation, and for the Inception-V3 model, for example, the gradient of the path back propagation is attenuated to γ 3 (because there are three ReLU activation functions after the three convolutional layers); for the path back propagation gradient, it is attenuated to γ 2(Because there are two activation functions after each of the two convolutional layers); for The gradient propagated back along the path is decayed to γ ​​(because a convolutional layer is immediately followed by an activation function, while a pooling layer does not contain an activation function); for The gradient of the backpropagation path is decayed to γ ​​(because it contains only one convolutional layer and one activation function); finally, it is backpropagated to δ. t The gradient is g t .

[0014] B3. Gradient based on backpropagation for the added noise δ t Update:

[0015] If the norm constraint is an infinite norm, then δ t+1 =δ t +α*sign(g t If the norm constraint is a 2-norm, then And project it onto the pixel feasible region: δ t+1 =max(min(δ) t ,1),0), thus ensuring that the generated image conforms to the distribution of image pixel values; at the same time, it is projected onto the feasible region of attack strength; δ t+1 =max(min(δ) t+1 The purpose of this method is to ensure that the generated adversarial image is as similar as possible to the natural input image, thereby increasing its deceptiveness and preventing it from being detected by the human eye.

[0016] C. The noise δ obtained after the above n iterations is... n The processed adversarial image x' is obtained by adding the pixel values ​​of the input image x to the input image x.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0018] The application provides an adversarial image processing method based on a neural network structure, which is applied to two deep learning models, a ViT model and a variable-length path deep learning model, and performs image processing based on the network model structure and an adversarial process, so that the image sample can have general low-dimensional features of images existing in different artificial intelligence applications after processing, and the deception of the processed image is enhanced. However, the existing adversarial image processing technology has less adversarial general features and low performance because it does not consider the interaction of different modules in the image processing process. The technical scheme provided by the application can greatly improve the confusion of the processed image to the artificial intelligence system, and has applications in many artificial intelligence image application fields: from the perspective of an attacker, for example, printing the adversarial image processed by the method of the application on the surface of a missile body, which can greatly reduce the possibility of the missile being captured by an enemy identification system; from the perspective of a defender, the adversarial image generated by the method of the application can better improve the performance of the artificial intelligence system, such as a face recognition payment system, so that corresponding measures can be taken in advance before the corresponding property loss occurs. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 The algorithm flowchart provided by the embodiment of the application.

[0020] Figure 2 The gradient back propagation diagram for the ViT model;

[0021] wherein, represents the lth multi-head attention module in the ViT model, which is mainly responsible for capturing the feature coupling relationship existing in different parts of the image; represents the lth multi-head linear module in the ViT model, which is mainly responsible for modeling local high-level feature information; and gamma represents a gradient attenuation coefficient, and grad represents the gradient back propagated from the lth ViT module.

[0022] Figure 3 The gradient back propagation diagram for the variable-length path model (taking the Inception-V3 model as an example);

[0023] wherein, Conv represents a network convolution layer, Pooling represents a network pooling layer, gamma represents a gradient attenuation coefficient, and grad represents the gradient back propagated from the Inception-V3 model module; through the design of different lengths of the paths, the Inception-V3 model can model the features of different scales of the image. The four paths from top to bottom in the figure are DETAILED DESCRIPTION

[0024] The application will be further described by examples in conjunction with the drawings, but the scope of the application is not limited in any way.

[0025] The specific embodiments of the present application are as follows (the entire flowchart is shown as follows) : Figure 1

[0026] A. Randomly crop, resize, and normalize the digital RGB picture x that needs to be processed, so that the picture is consistent with the input format of the network f, load the parameters of the network f onto the CPU / GPU, and initialize the noise initial value δ0 attached to the picture with a normal distribution (-ε, ε).

[0027] B. For the input picture x, perform the following operations through n (t = 0, 1, … n-1) iterations:

[0028] B1. Add the noise δ t added to the picture x pixel by pixel and input it to the image processing network f. For ViT, the forward propagation process of the lth layer is as follows:

[0029]

[0030] For the unequal length path network (taking Inception-V3 as an example), the forward propagation process of the lth layer is as follows:

[0031]

[0032] Calculate the cross-entropy loss between the model propagation result and the label y to obtain the loss value:

[0033] B2. Use the obtained cross-entropy loss to perform back propagation (calculate the gradient of δ t ). For ViT, the gradient value of the input of the lth layer can be obtained by the chain rule:

[0034]

[0035] This method uses the decay coefficient γ to specially perform gradient decay on the residual block of the ViT model:

[0036]

[0037] From the above recursive formula, the gradient (g t ) calculation formula of δ t can be obtained (assuming that the network has L layers):

[0038]

[0039] For the variable length path deep learning model (taking Inception-V3 as an example), the gradient value of the input of the lth layer can also be obtained by the chain rule:​

[0040]

[0041] The method also uses decay coefficient γ to attenuate the gradient of longer path backpropagation (the more activation functions, the more gradient attenuation), for example, for Inception-V3 network, There are 3, 2, 1, 1 activation functions respectively, so the backpropagation gradient through them is attenuated to γ 3 , γ 2 , γ, γ of the original gradient respectively. Therefore, the modified

[0042] The Gradient calculation formula:

[0043]

[0044] From the above recursive formula, δ t Gradient (g t ) calculation formula (assuming the network has L layers):

[0045]

[0046] B3. Update the added δ t based on the gradient of backpropagation, if the norm constraint is infinite norm, then δ t+1 = δ t + α * sign (g t ); if the norm constraint is two norm, then And project it to the pixel feasible region: δ t+1 = max (min (δ t+1 , 1), 0), and the attack intensity feasible region; δ t+1 = max (min (δ t+1 , ε), -ε);

[0047] C. Add the noise δ n processed by the above iteration to the input picture x pixel by pixel: x' = x + δ n , so as to obtain the processed picture with threat, that is, x'.

[0048] The application will be further described by examples.

[0049] Example 1:

[0050] Assume we now want to process cat.jpg (labeled as "cat", encoded as the 600th class, i.e. y = 600) with the ViT-B model to obtain a threatening picture style. The number of iteration steps of the attack algorithm is n = 10, the total strength of the attack is e = 16 / 255, the noise strength added in a single step is a = 2 / 255, and the norm constraint is selected as the infinity norm.

[0051] A first uses python code to load cat.jpg. And cut and resize the loaded picture to the size of 224*224. Divide each pixel value of the picture by 255, so as to normalize the picture pixel value to the range of [0, 1], which ensures that the picture is consistent with the input of the ViT-B network, thereby obtaining the preprocessed picture x.

[0052] Call the API (torch.load function) in PyTorch to load the ViT network onto the CPU / GPU, and use the API function provided by PyTorch to initialize the additional noise d0 with a normal distribution (-16 / 255, 16 / 255), thereby obtaining the initialized additional noise d0.

[0053] B. For the input picture x, perform the following operations for n = 10 (t = 0, 1, … 9) iterations:

[0054] B1. Add the added d t to the picture x pixel by pixel and input it to the ViT-B model loaded onto the GPU / CPU, and the forward propagation process of the i-th layer is:

[0055]

[0056] Calculate the cross-entropy loss between the final propagation result of the model and the label y to obtain the loss value:

[0057] B2. Use the following example code to hook the Atteniton module and MLP module in the ViT structure:

[0058]

[0059] B3. Then for Call the built-in backward function in pytorch to perform automatic differentiation, and the corresponding gradient will be automatically decayed during the differentiation process. Thus, the gradient of d t is g t , then update d t : d t+1 = d t + a * sign(g t ). And dt+1 projected to the pixel feasible region: δ t+1 = max(min(δ t+1 , 1), 0), projected to the attack strength feasible region: δ t+1 = max(min(δ t+1 , 16 / 255), -16 / 255). The final result of the adversarial noise of this step is obtained: δ t+1 . C. Add the noise δ 10 processed by the above iteration to the input picture x pixel by pixel: x' = x + δ 10 , so as to obtain the processed picture with threat, that is, x'.

[0060] Example 2:

[0061] Suppose we now want to process dog.jpg (labeled as "dog", encoded as the 769th class, that is, y = 769) using the Inception-V3 (L = 12) model to obtain a picture style with threat. The number of iteration steps of the attack algorithm is n = 20, the total attack strength ε is 16 / 255, the noise strength added by a single step is α = 2 / 255, and the norm constraint is selected as the second norm.

[0062] A first uses python code to load cat.jpg. The loaded picture is cropped and scaled to a size of 224*224. The pixel values of the picture are divided by 255, so that the pixel values of the picture are normalized to the range of [0, 1], which ensures that the picture is consistent with the pre-training input of the ViT-B network on the ImageNet dataset, thereby obtaining the pre-processed picture x.

[0063] The API (torch.load function) in PyTorch is called to load the ViT network onto the CPU / GPU, and the API function provided by PyTorch is used to initialize the additional noise δ0 with a normal distribution (-16 / 255, 16 / 255), thereby obtaining the initialized additional noise δ0.

[0064] B. For the input picture x, the following operations are performed for n = 20 (t = 0, 1,..., 19) iterations:

[0065] B1. Add the added δ t to the picture x pixel by pixel and input it to the Inception-V3 model loaded onto the GPU / CPU, and the forward propagation process of the lth layer is:

[0066]

[0067] The cross-entropy loss is calculated by comparing the final propagation result of the model with the label y, and the loss value is obtained:

[0068] B2. Use the following example code to hook ReLU functions in the Inception-V3 architecture:

[0069]

[0070] B3. Then regarding The built-in `backward` function in PyTorch is called to perform automatic differentiation, during which the gradient is automatically decayed. This yields δ. t The gradient is g t Then for δ t Update: and δ t+1 Projected onto the feasible region of a pixel: δ t+1 =max(min(δ) t+1 ,1),0), projected onto the feasible region of attack strength: δ t+1 =max(min(δ) t+1 (16 / 255), -16 / 255). The final result of this noise suppression step is obtained: δ t+1 C. The noise δ after the above iterative processing 20 Add the pixel values ​​of the input image x to the input image x: x' = x + δ 20 This results in a threatening processed image, namely x'.

[0071] It should be noted that the purpose of disclosing the embodiments is to help further understand the present invention. However, those skilled in the art will understand that various substitutions and modifications are possible without departing from the scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the embodiments, and the scope of protection of the present invention is defined by the scope of the claims.

Claims

1. An adversarial image processing method based on a neural network structure, which performs image processing based on ViT and a deep learning network model with unequal-length paths. For different paths existing in the image processing neural network model, attenuation coefficients are defined. Gradient attenuation is achieved by backpropagating the input image to a deeper path network model, resulting in a deceptive adversarial image. The method includes the following steps: A. Preprocess the digital image x into a format that conforms to the input format of the image processing neural network model f; load the corresponding network model parameters, and initialize the noise to be added to the image using a normal distribution, denoted as δ0; B. For the input image x, after n iterations; Let t = 0, 1, ..., n-1, the t-th iteration specifically performs the following operations: B1. Combine the input image x with the noise δ added in the t-th iteration. t The pixel values ​​are summed and then input into the image processing neural network model f. After forward propagation, the cross-entropy loss for classification is calculated with the image label y. B2. Define the attenuation coefficient γ, 0 < γ < 1; use the obtained cross-entropy loss. Perform backpropagation, i.e., calculate the noise δ t The gradient; For ViT, the gradient backpropagated from the residual block of ViT is decayed using the decay coefficient γ, which is the multi-head attention module and the linear perceptron module. For network models with unequal path lengths, gradient decay is performed using a decay coefficient γ based on the activation function. Finally, it propagates back to δ. t The gradient is g t ; B3. Update the added noise based on the gradient from backpropagation and project it onto the feasible region of the pixel and the feasible region of the attack strength; the update is specifically as follows: If the norm constraint is an infinite norm, then δ t+1 =δ t +α*sign(g t ); If the norm constraint is a 2-norm, then in, α represents the intensity of image noise added in a single step; C. Add the noise obtained after n iterations to the pixel value of the input image x to obtain the processed adversarial image.

2. The adversarial image processing method based on a neural network structure as described in claim 1, characterized in that, In step B1, the forward propagation process of the l-th layer of the ViT model is represented as follows: in, This refers to the multi-head attention module in the l-th layer of the ViT model. This refers to the l-th layer multi-head linear module in the ViT model. Input an image for the model; Output images for the model; This is an intermediate result calculated using a multi-head attention mechanism; For the Inception-V3 model of unequal-length path networks, the forward propagation process of the l-th layer is represented as follows: in, This indicates that the l-th layer of the Inception-V3 unequal-length path model is a path constructed by three convolutional layers; This indicates that the l-th layer of the Inception-V3 unequal-length path model is a path constructed by two convolutional layers; This represents a path in the Inception-V3 model, which represents a path consisting of one pooling layer and one convolutional layer, representing an unequal-length path. This represents the path formed by a single convolutional layer.

3. The adversarial image processing method based on a neural network structure as described in claim 2, characterized in that, In step B2, the Inception-V3 model is used as the network model for unequal-length paths; the path constructed by the l-th layer of the Inception-V3 model from three convolutional layers is... The path of layer l, constructed from two convolutional layers, is as follows: The path consisting of a pooling layer and a convolutional layer is: The path formed by a single convolutional layer is When gradient decay is performed using a decay coefficient γ based on an activation function: for The gradients from the backpropagation path are followed by three ReLU activation functions after each of the three convolutional layers, decaying to γ. 3 ; for The gradient of the backpropagation path has two activation functions after each of the two convolutional layers, which decay to γ. 2 ; for The gradient propagated back along the path consists of an activation function following a convolutional layer, while the pooling layer does not contain an activation function and decays to γ. for The gradient of the backpropagation path contains a convolutional layer and an activation function that decays to γ.

4. The adversarial image processing method based on a neural network structure as described in claim 3, characterized in that, In step B2, the obtained cross-entropy loss is used. Backpropagation is performed, specifically: For the ViT model, the input of the l-th layer is obtained by the chain method. The gradient value is expressed as: Gradient decay is applied to the residual blocks of the ViT model using a decay coefficient γ, expressed as: Recursively, δ t gradient g t The calculation process is expressed as follows: Where L is the number of layers in the network; For the variable-length path deep learning model Inception-V3, the input of the l-th layer is obtained by the chain rule. The gradient value is expressed as: Recursively, δ t gradient g t The calculation process is expressed as follows:

5. The adversarial image processing method based on a neural network structure as described in claim 4, characterized in that, step... In B3, the process of projecting onto the feasible region of a pixel is: δ t+1 =max(min(δ) t The feasible region process for projective attack strength is expressed as: δ t+1 =max(min(δ) t ,ε),-ε); where ε is the intensity of additional image noise during image processing.

Images