An image classification black-box attack method and system based on adversarial knowledge distillation

Abstract

The application discloses an image classification black box attack method and system based on adversarial knowledge distillation, first, an alternative image classification model is constructed, and an adversarial image is generated by using a white box method with an original image as input; then, the original image and the adversarial image are respectively input into a target black box image classification model and the alternative image classification model, the probability distribution of the image prediction categories of the two models is obtained respectively, the difference between the original image and the adversarial image of the two models is measured by KL divergence as a loss function, and the alternative image classification model parameters are updated in a random gradient descent manner according to the loss function. The application introduces adversarial knowledge distillation, introduces the adversarial image into the training of the model, fully considers the change of high-frequency information on the original image data, and effectively improves the attack success rate; in addition, through the adversarial knowledge distillation, any image classification model structure can be selected as the alternative image classification model to attack the target model, and the dependence on the model structure is greatly reduced.

Description

Technical Field

[0001] This invention relates to the fields of computer vision and software testing, and mainly to a black-box attack method and system for image classification based on adversarial knowledge distillation. Background Technology

[0002] Deep neural networks have been widely applied to various computer vision tasks, such as face recognition, logistics classification, and autonomous driving, achieving good results and greatly improving the efficiency of complex classification work. In specific scenarios with high security requirements, such as autonomous driving tasks, there are high demands on the accuracy and robustness of classification models. As adversarial images add subtle perturbations to the original image that are not easily detected by the human eye, they have become an obstacle to the application of deep neural networks in fields with high security requirements. Research on generating adversarial images for attacks has also been given high practical significance. At the same time, introducing adversarial images into the model for retraining can greatly improve the robustness of the model.

[0003] In existing attack methods, attacks can be divided into white-box attacks and black-box attacks based on whether the attacker knows the internal structure and parameters of the model. A large number of attack methods have been derived from white-box attack scenarios. However, attacks in black-box scenarios are often more realistic. Due to the inability to obtain the internal structure and parameters of the model, the variety of black-box attacks is far less than that of white-box attacks.

[0004] Existing research focuses on training alternative image classification models through transfer learning, and then attacking the target black-box image classification model using white-box methods based on the alternative image classification model. It uses a multi-target black-box image classification model to train the alternative image classification model through knowledge distillation, but it still relies on the similarity between the image classification model structures, and the learning characteristics of the multi-target black-box image classification model are not suitable for real-world scenarios. At the same time, this type of method only learns the performance of the target black-box model and the alternative model on the original image, and the key to the attack lies in adversarial changes to high-frequency information in the model feature extraction. Summary of the Invention

[0005] Purpose of the invention: To address the problems existing in the above-mentioned background technology, this invention provides an image classification black-box attack method and system based on adversarial knowledge distillation. Considering that the key to attack transfer lies in the alternative image classification model learning the target black-box model's processing of adversarial images with high-frequency information modifications at the feature extraction level, adversarial labels are introduced. By learning the target black-box model's feature extraction of adversarial images, the alternative image classification model is better trained, thereby better realizing attack transfer and thus testing the robustness of the image classification model.

[0006] Technical solution: To achieve the above objectives, the technical solution adopted by this invention is as follows:

[0007] A black-box attack method for image classification based on adversarial knowledge distillation includes the following steps:

[0008] An alternative image classification model structure is constructed, which takes the original image data as input and generates adversarial images using a white-box method based on the alternative image classification model. The original image data and the adversarial images are then used as input for the next training step.

[0009] The original image and the adversarial image are respectively input into the target black-box image classification model and the constructed alternative image classification model to obtain the probability distribution of the image prediction by the two models. The classification probability of the two image classification models for the original image is denoted as the soft label in the knowledge distillation process, and the true label of the original image is denoted as the hard label. The soft and hard labels together constitute the output difference of the two image classification models for the original image. The classification probability distribution for the adversarial image is denoted as the adversarial label in the knowledge distillation process. The difference between the original image and the adversarial image of the two models is measured by KL divergence and used as the loss function. The parameters of the alternative image classification model are updated by stochastic gradient descent according to the loss function.

[0010] Based on a trained alternative image classification model, adversarial images are generated using a white-box method to attack the target black-box image classification model.

[0011] Preferably, the adversarial image generation is to initialize an alternative image classification model with the original image input, estimate the gradient information of the internal classification function of the image classification model based on the different outputs generated by the model for different inputs, change the gradient information of the original image to generate an adversarial image to cause the model to misclassify, and use the original image and the corresponding generated adversarial image as inputs to the test target black-box image classification model and the training alternative image classification model.

[0012] As a preferred option, the specific steps for determining the loss function for optimizing the alternative image classification model based on the outputs of the target black-box image classification model and the alternative image classification model are as follows:

[0013] The original image is used as input to both the target black-box image classification model and the alternative image classification model. The outputs of both models are converted into a probability distribution through a softmax layer, denoted as the soft label, as follows:

[0014]

[0015] Where z represents the softmax layer output of the model for the original image, i and j represent the i-th and j-th categories out of n categories, and T represents the distillation temperature, which makes the probability distribution of the model output more uniform and is used to control the degree of learning of the negative labels by the model. The negative labels are the hidden labels contained in the model when processing the classification task, reflecting the similarity information of the alternative categories other than the correct category of the model, which is of great significance in the model learning process. After obtaining the soft labels, the difference between the classification prediction probabilities of the two models for the original labels is measured by KL divergence and used for subsequent model optimization. At the same time, the n-dimensional matrix composed of the correct labels of the input original image is denoted as the hard labels, where n is the number of categories. The difference between the hard labels and the probability distribution output of the alternative classification model is calculated by the cross-entropy loss function to ensure the correctness of the alternative classification model in classifying the original image.

[0016] The generated adversarial image is used as input to the target black-box classification model and the alternative classification model. Similarly, the outputs of the two models are converted into a probability distribution form through a softmax layer, denoted as the adversarial label, as follows:

[0017]

[0018] Where x is the softmax layer output of the model for the adversarial image generated based on the alternative classification model, i represents the i-th category among n classification categories, and T represents the distillation temperature; similarly, the KL divergence is used to measure the difference in the prediction of the adversarial image by the two models; the two parts of loss for the original image and the adversarial image are balanced by parameter adjustment to control the proportion of the adversarial image in the model distillation process.

[0019] Preferably, the selection of the alternative image classification model does not depend on the target black-box image classification model, and an image classification model structure is randomly selected when selecting the alternative image classification model.

[0020] Furthermore, the specific method for iterative training of the alternative image classification model is as follows:

[0021] Based on the initialized model, the gradient is estimated using the original image input and output information. The gradient information is then modified to generate adversarial images. The generated adversarial images are then sent to the target black-box image classification model and the alternative image classification model, respectively. The output of the model is converted into a probability distribution through a softmax layer as an adversarial label. The difference between the outputs of the two models is measured by KL divergence, denoted as Ladv, which represents the difference between the alternative image classification model and the target black-box image classification model on the adversarial image.

[0022] The original image is fed into the target black-box image classification model and the alternative image classification model, respectively. The outputs of the two models are converted into a probability distribution form through a softmax layer and used as soft labels L. soft The KL divergence is used to measure the difference between the outputs of the two models; the cross-entropy loss function is used to measure the accuracy of the alternative image classification model in learning to classify the original image, denoted as L, which is a matrix composed of the probabilities output by the alternative image classification model and the original image labels, where only the correct category is 1 and the rest are 0. hard The difference between the two parts is denoted as Lpri, L pri =L soft +L hard ;

[0023] The difference between the target black-box image classification model and the alternative image classification model between the two types of input images is used as the loss function. By continuously reducing the difference between the two models through stochastic gradient descent, the parameters of the alternative image classification model are updated, thereby realizing the distillation and transfer of the target black-box image classification model's knowledge of input image classification.

[0024] Based on the same inventive concept, this invention provides an image classification black-box attack system based on adversarial knowledge distillation, comprising:

[0025] An adversarial image generation module is used to construct an alternative image classification model structure. It takes the original image as input and generates adversarial images using a white-box method based on the alternative image classification model. The original image and the adversarial image are used as inputs for the next training step.

[0026] The knowledge distillation model training module is used to input the original image and the adversarial image into the target black-box image classification model and the constructed alternative image classification model, respectively, and obtain the probability distribution of the image prediction category of the two models. The classification probability of the two image classification models for the original image is denoted as the soft label in the knowledge distillation process, and the true label of the original image is denoted as the hard label. The soft and hard labels together constitute the output difference of the two image classification models for the original image. The classification probability distribution for the adversarial image is denoted as the adversarial label in the knowledge distillation process. The difference between the original image and the adversarial image of the two models is measured by KL divergence and used as the loss function. The parameters of the alternative image classification model are updated by stochastic gradient descent according to the loss function.

[0027] It also includes an attack image generation module, which uses a white-box method to generate adversarial images for attacking the target black-box image classification model, based on a trained alternative image classification model.

[0028] Based on the same inventive concept, the present invention provides a computer system including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the steps of the image classification black-box attack method based on adversarial knowledge distillation.

[0029] Beneficial Effects: This invention, unlike traditional multi-model training that relies on model structure similarity for black-box attacks on target black-box image classification models, allows for the selection of any image classification model structure as the basic structure of the alternative image classification model during training, and random initialization of the alternative classification model's parameters. Based on the alternative image classification model, an adversarial image is generated using a white-box attack method. This adversarial image is then fed into both the target black-box model and the alternative classification model, and the difference between the two outputs is calculated. For the target black-box classification model, this image is a completely new image that has never been processed. By narrowing the difference between the alternative classification model's prediction and the target black-box model's prediction for this image, it can fully learn the target black-box model's feature extraction process for the adversarial image. The original images are fed into the two models respectively, and the difference between their outputs on the original images is calculated. By combining the two types of image learning, the alternative classification model can learn the target black-box classification model's processing on the original images, and can also fully learn the target black-box model's feature extraction processing through adversarial images that have changed high-frequency information. After iterative training, a model that is extremely similar to the target black-box model on both the original images and adversarial images can be obtained. Therefore, adversarial images can be generated based on this alternative classification model to attack the target black-box model, thereby achieving attack transfer and effectively detecting the robustness of the target classification model. Furthermore, the adversarial images generated by this method can be incorporated into the retraining process of the target black-box classification model to further improve the accuracy and security of the model's classification.

[0030] Compared with existing technologies, the image classification black-box attack method based on adversarial knowledge distillation provided by this invention can use any classification model structure as a substitute classification model when the internal structure and parameters of the target classification model are unknown. After a limited number of iterations of training, adversarial images can be generated using white-box attack methods to attack the target black-box model based on the substitute classification model, and a high attack success rate can be achieved. This realizes the purpose of white-box attack methods to attack black-box models, greatly enriches the types of black-box attack methods, and the adversarial images generated by this method can be incorporated into the model training, thereby further improving the robustness of the model. Attached Figure Description

[0031] Figure 1 This is a flowchart illustrating an embodiment of the present invention. Detailed Implementation

[0032] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0033] like Figure 1 As shown in the figure, an image classification black-box attack method based on adversarial knowledge distillation disclosed in this invention mainly includes the following steps:

[0034] Step S1: Adversarial Image Generation; First, initialize the alternative image classification model, including the model structure and parameters. Based on the initialized alternative image classification model, use the selected white-box attack method (e.g., Fast Graident SignMethod) to generate an adversarial image against the alternative image classification model. Use this adversarial image and the original image as inputs to the target black-box image classification model and the alternative image classification model.

[0035] Step S2: Knowledge distillation to calculate model output; input the original image and the adversarial image into the target black-box classification model and the constructed alternative classification model, respectively, and use the softmax function to convert the model output into the probability distribution predicted by the model for that image; use KL divergence to measure the difference in probability distributions of the two models for the same image as the loss function, and update the parameters of the alternative image classification model using stochastic gradient descent based on the loss function. Specifically, the design of the model training loss function is as follows:

[0036] Step S2.1: Use the original image as input to both the target black-box image classification model and the alternative image classification model. Convert the outputs of both models into a probability distribution through a softmax layer, denoted as the soft label, as follows:

[0037]

[0038] Where z represents the softmax layer output of the model for the original image, i and j represent the i-th and j-th categories out of n categories, and T represents the distillation temperature, which makes the probability distribution of the model output more uniform and controls the degree of learning of negative labels. Negative labels are the hidden labels contained in the model when processing image classification tasks, reflecting the similarity information of alternative categories other than the correct category of the model, and are of great significance in the model learning process. After obtaining the soft labels, the difference between the classification prediction probabilities of the two models for the original labels is measured by KL divergence and used for subsequent model optimization. At the same time, the n-dimensional matrix composed of the correct labels of the input original image is denoted as the hard label, where n is the number of categories. The difference between the hard label and the probability distribution output of the alternative classification model is calculated using the cross-entropy loss function to ensure the correctness of the alternative classification model in classifying the original image. The soft labels and hard labels together constitute the loss L of the two image classification models on the original image. pri =Lsoft +L hard

[0039] Step S2.2: Use the adversarial image generated in step S1 as input to the target black-box image classification model and the alternative image classification model. Similarly, convert the outputs of the two models into a probability distribution form through a softmax layer, denoted as the adversarial label, as follows:

[0040]

[0041] Where x is the softmax layer output of the model for the adversarial image generated by the alternative image classification model, i represents the i-th category among n classification categories, and T represents the distillation temperature; similarly, the KL divergence is used to measure the difference in the prediction of the adversarial image by the two models; the two parts of loss for the original image and the adversarial image are balanced by parameter adjustment to control the proportion of the adversarial image in the model distillation process.

[0042] The final loss function can be expressed as L = L pri +αL adv

[0043] Among them, L pri L adv denoted as the difference in output between the two image classification models on the original image and the adversarial image, respectively, and α is a balancing parameter to balance the influence of the two losses on the training of the alternative model.

[0044] Specifically, the training process for the alternative image classification model is as follows: An arbitrary model structure is selected (e.g., a VGG-16 model structure with 16 convolutional neural networks). Model parameters are randomly initialized. Based on the initialized model, adversarial images are generated using a white-box attack method. These adversarial images, along with the original image, are fed into the target black-box image classification model and the alternative image classification model. The probability distribution of the model output is converted into KL divergence to measure the difference between the two models' outputs on the same image. This difference is used as the loss function, and optimization is performed using stochastic gradient descent to update the parameters of the alternative classification model, allowing the target black-box image classification model's image processing knowledge to be transferred to the alternative image classification model. Finally, the above process is repeated iteratively. The adversarial images generated based on the previous version of the alternative image classification model are used to train and update the next version of the alternative image classification model, ultimately resulting in a well-trained alternative image classification model. Adversarial images can then be generated using a white-box attack method to attack the target black-box image classification model, thereby testing the robustness of the target black-box image classification model. Furthermore, the generated adversarial images can also be used for retraining the image classification model.

[0045] This invention verifies the effectiveness of using VGG-16 to attack AlexNet and ResNet on the MNIST and CIFAR10 datasets. The relevant experimental parameters are as follows:

[0046] The parameter α used to balance the two losses is 0.5, the knowledge distillation temperature is 10, and the number of iterations is 5. The specific results are as follows:

[0047] Table 1: Attack Success Rate

[0048]

[0049] Based on the same inventive concept, this invention discloses an image classification black-box attack system based on adversarial knowledge distillation, comprising: an adversarial image generation module, used to construct an alternative image classification model structure, using the original image as input and generating adversarial images using a white-box method based on the alternative image classification model, and using the original image and adversarial images as input for the next training step; a knowledge distillation model training module, used to input the original image and adversarial images into the target black-box image classification model and the constructed alternative image classification model respectively, and obtain the probability distributions of the two models for the image prediction categories; the classification probabilities of the two image classification models for the original image are denoted as soft labels in the knowledge distillation process, and the true labels of the original image are denoted as hard labels, the soft and hard labels together constitute the output difference of the two image classification models in the original image, and the classification probability distribution for the adversarial image is denoted as the adversarial label in the knowledge distillation process; the difference between the original image and the adversarial image of the two models is measured by KL divergence as a loss function, and the parameters of the alternative image classification model are updated by stochastic gradient descent according to the loss function; and an attack image generation module, used to generate adversarial images for attacking the target black-box image classification model using a white-box method based on the trained alternative image classification model.

[0050] Based on the same inventive concept, this invention discloses a computer system including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the steps of the image classification black-box attack method based on adversarial knowledge distillation.

[0051] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An image classification black-box attack method based on adversarial knowledge distillation, characterized in that, Includes the following steps: An alternative image classification model structure is constructed, which takes the original image as input and generates adversarial images using a white-box method based on the alternative image classification model. The original image and the adversarial images are then used as inputs for the next training step. The original image and the adversarial image are respectively input into the target black-box image classification model and the constructed alternative image classification model to obtain the probability distribution of the image prediction category of the two models. The classification probability of the two image classification models for the original image is denoted as the soft label in the knowledge distillation process, and the true label of the original image is denoted as the hard label. The soft and hard labels together constitute the output difference of the two image classification models for the original image. The classification probability distribution for the adversarial image is denoted as the adversarial label in the knowledge distillation process. The difference between the original image and the adversarial image of the two models is measured by KL divergence and used as the loss function. The parameters of the alternative image classification model are updated by stochastic gradient descent according to the loss function. Based on the trained alternative image classification model, adversarial images for attacking the target black-box image classification model are generated using a white-box method. The specific method for determining the loss function based on the outputs of the target black-box image classification model and the alternative image classification model is as follows: The processing of the input image is divided into two categories. For the original image, the probability distribution predicted by the target black box and the alternative image classification model is defined as the soft label, which takes the following form: ； in This represents the output of the softmax layer of the model for the original image. express The first of the classification categories Categories The distillation temperature is used to make the probability distribution of the model output more uniform, thereby controlling the model's learning degree of negative labels. KL divergence is used to obtain the difference between the target black-box image classification model and the alternative image classification model for the original image. Simultaneously, the single correct label of the original image is defined as a hard label, used to measure the accuracy of the model's classification, thus ensuring the model's precision. This hard label is composed of the correct labels of the input original image. A 3D matrix is ​​denoted as a hard label, where To determine the number of categories, the difference between the probability distribution outputs of the hard label and the surrogate image classification model is calculated using the cross-entropy loss function. This difference ensures the correctness of the surrogate image classification model in classifying the original image. The soft and hard labels together constitute the loss of the two image classification models on the original image. For adversarial images, the probability distribution predicted by the target black box and the surrogate image classification model is defined as the adversarial label, with the following specific form: ； in The softmax layer output of the model for adversarial images generated based on the alternative image classification model is given; the difference between the two models' predictions of adversarial images is measured by KL divergence; the two parts of loss for the original image and the adversarial image are balanced by parameter adjustment to control the proportion of the adversarial image in the model distillation process.

2. The image classification black-box attack method based on adversarial knowledge distillation according to claim 1, characterized in that, The adversarial image generation involves initializing an alternative image classification model with the original image input, estimating the gradient information of the internal classification function of the image classification model based on the different outputs generated by the model for different inputs, changing the gradient information of the original image to generate an adversarial image that causes the model to misclassify, and using the original image and the corresponding generated adversarial image as inputs to the test target black-box image classification model and the training alternative image classification model.

3. The image classification black-box attack method based on adversarial knowledge distillation according to claim 1, characterized in that, The selection of the alternative image classification model does not depend on the target black-box image classification model; instead, an image classification model structure is randomly selected when choosing the alternative image classification model.

4. The image classification black-box attack method based on adversarial knowledge distillation according to claim 1, characterized in that, The training steps for alternative image classification models include: On the basis of the initialized model, the gradient is estimated by inputting and outputting information of the original image, and the adversarial image is generated by changing the gradient information. The generated adversarial image is sent to the target black-box image classification model and the substitute image classification model respectively, and the output of the model is converted into a probability distribution as an adversarial label through a softmax layer. The difference between the outputs of the two models is measured by KL divergence, denoted as L adv , which represents the difference between the substitute image classification model and the target black-box image classification model on the adversarial image. The original image is fed into the target black-box image classification model and the alternative image classification model, respectively. The outputs of the two models are converted into a probability distribution form through a softmax layer and used as soft labels L. soft The KL divergence is used to measure the difference between the outputs of the two models; the cross-entropy loss function is used to measure the accuracy of the alternative image classification model in learning to classify the original image, denoted as L, which is a matrix composed of the probabilities output by the alternative image classification model and the original image labels, where only the correct category is 1 and the rest are 0. hard The difference between the two parts is denoted as ; The difference between the target black-box image classification model and the substitute image classification model is obtained as a loss function L = L pri + L adv , and the difference between the two models is continuously reduced by stochastic gradient descent, so as to update the parameters of the substitute image classification model, and then realize the distillation and migration of the classification knowledge of the target black-box image classification model for the input image.

5. A black-box attack system for image classification based on adversarial knowledge distillation, characterized in that, include: An adversarial image generation module is used to construct an alternative image classification model structure. It takes the original image as input and generates adversarial images using a white-box method based on the alternative image classification model. The original image and the adversarial image are used as inputs for the next training step. The knowledge distillation model training module is used to input the original image and the adversarial image into the target black-box image classification model and the constructed alternative image classification model, respectively, and obtain the probability distribution of the image prediction category of the two models. The classification probability of the two image classification models for the original image is denoted as the soft label in the knowledge distillation process, and the true label of the original image is denoted as the hard label. The soft and hard labels together constitute the output difference of the two image classification models for the original image. The classification probability distribution for the adversarial image is denoted as the adversarial label in the knowledge distillation process. The difference between the original image and the adversarial image of the two models is measured by KL divergence and used as the loss function. The parameters of the alternative image classification model are updated by stochastic gradient descent according to the loss function. And an attack image generation module, which uses a white-box method to generate adversarial images for attacking the target black-box image classification model based on a trained alternative image classification model; The specific method by which the knowledge distillation model training module determines the loss function based on the outputs of the target black-box image classification model and the alternative image classification model is as follows: The processing of the input image is divided into two categories. For the original image, the probability distribution predicted by the target black box and the alternative image classification model is defined as the soft label, which takes the following form: ； in This represents the output of the softmax layer of the model for the original image. express The first of the classification categories Categories The distillation temperature is used to make the probability distribution of the model output more uniform, thereby controlling the model's learning degree of negative labels. KL divergence is used to obtain the difference between the target black-box image classification model and the alternative image classification model for the original image. Simultaneously, the single correct label of the original image is defined as a hard label, used to measure the accuracy of the model's classification, thus ensuring the model's precision. This hard label is composed of the correct labels of the input original image. A 3D matrix is ​​denoted as a hard label, where To determine the number of categories, the difference between the probability distribution outputs of the hard label and the surrogate image classification model is calculated using the cross-entropy loss function. This difference ensures the correctness of the surrogate image classification model in classifying the original image. The soft and hard labels together constitute the loss of the two image classification models on the original image. For adversarial images, the probability distribution predicted by the target black box and the surrogate image classification model is defined as the adversarial label, with the following specific form: ； in The softmax layer output of the model for adversarial images generated based on the alternative image classification model is given; the difference between the two models' predictions of adversarial images is measured by KL divergence; the two parts of loss for the original image and the adversarial image are balanced by parameter adjustment to control the proportion of the adversarial image in the model distillation process.

6. The image classification black-box attack system based on adversarial knowledge distillation according to claim 5, characterized in that, The adversarial image generation module takes the original image as input to initialize the alternative image classification model, estimates the gradient information of the internal classification function of the image classification model based on the different outputs generated by the model for different inputs, changes the gradient information of the original image to generate an adversarial image to cause the model to misclassify, and uses the original image and the corresponding generated adversarial image as input to the test target black-box image classification model and the training alternative image classification model.

7. The image classification black-box attack system based on adversarial knowledge distillation according to claim 5, characterized in that, The selection of the alternative image classification model does not depend on the target black-box image classification model; instead, an image classification model structure is randomly selected when choosing the alternative image classification model.

8. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the steps of the image classification black-box attack method based on adversarial knowledge distillation according to any one of claims 1-4.

Images