A collaborative defense method against adversarial attacks based on steganalysis and three-life network

Abstract

The present invention discloses a collaborative defense method for adversarial attacks based on steganalysis and three-dimensional network. The method first performs initial model training, then generates adversarial samples, then uses steganalysis for detection defense, then uses the three-dimensional network generated by adversarial training for robust defense, and finally completes prediction classification. The present invention can enhance the robustness of the network to effectively resist secondary adversarial attacks and ensure a higher classification accuracy of clean samples in a network that has not been trained adversarially.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning technology, and specifically relates to a collaborative defense method against attacks. Background Art

[0002] In recent years, artificial intelligence technology based on deep neural network models has achieved superior results than traditional algorithms in tasks such as machine translation, speech recognition, scene classification and target detection, autonomous driving, face recognition and medical systems. However, due to the lack of explainability and transparency of decision-making behavior logic, deep neural network models are vulnerable to adversarial sample attacks in the prediction stage. By adding subtle perturbations that are difficult for humans to identify through their senses to the source data, the attacker can make the deep learning model accept and output an incorrect prediction with high confidence. According to the attack cost, adversarial attacks can be divided into white-box attacks, black-box attacks and physical attacks. The premise of white-box attacks is to fully obtain the model structure (model composition, interlayer parameters, etc.) and fully control the model input. It is usually used as the basis for laboratory academic research and launching the other two attacks. FGSM, PGD, C&W, and DeepFool are common white-box attack algorithms; black-box attacks have no understanding of the model structure and can only control the input; physical attacks have unknown model structures and are difficult to control inputs. The collected images will be scaled, twisted, changed in illumination, and rotated after unknown preprocessing. Adversarial attacks have brought great security threats to the application field of deep neural networks. When using deep neural networks to design systems with high security requirements, it is necessary to consider how to resist adversarial attacks, namely adversarial sample defense.

[0003] Adversarial samples attack during the prediction phase of the neural network model, so most of the defense methods are to improve the input and the model itself before the model is predicted. At present, there are three main types of defense against adversarial samples. The first type converts adversarial samples into clean samples through data preprocessing (such as denoising, JPEG compression, pixel shift, etc.), which has a small amount of calculation; the second type is to classify and detect samples before prediction (such as using GAN network to simulate data distribution and judge, converting robust adversarial samples with strong concealment into non-robust adversarial samples, steganalysis, etc.). This method does not require modifying the network but prohibits adversarial samples from entering the model, and cannot correctly identify adversarial samples; the third type is to train a more robust deep learning model to invalidate the disturbance originally added by the adversarial sample (such as using a large amount of data for adversarial training, adding compressed autoencoders to smooth the model, and defense distillation). Enhancing the robustness of neural networks requires retraining complex networks in order to increase the complexity of the network by improving the randomness and cognitive performance of the model, which has a large computational overhead.

[0004] Steganalysis is a detective defense method. In the field of information hiding, steganography can achieve the effect of information hiding by modifying pixels with the minimum amplitude, just as adversarial samples can cause the model to misclassify by adding minimal adversarial perturbations and modifying the pixels in the sample. Both steganography and adversarial attacks modify the pixel values ​​of the image, which will cause the correlation between adjacent pixels to be destroyed. Therefore, the correlation between the pixels in the neighborhood of the image can be detected by the steganalysis detector to determine whether the input image contains adversarial perturbations. Since detective defense based on steganalysis detection methods is a detective defense based on artificial features, it is difficult to be attacked by secondary adversarial attacks. Two types of steganalysis features are commonly used to detect adversarial samples: one is the 686-dimensional low-dimensional feature model SPAM; the other is the 34671-dimensional high-dimensional feature model Spatial Rich Model (SRM).

[0005] Adversarial training is an important defense method to enhance the robustness of the model, and it is also the defense method with the best overall effect. Its core is to add the adversarial sample set to the training set of the neural network, fit the data distribution, cover the blind spots of the adversarial samples, make the model adapt to sample changes, and improve the robustness of the model, so as to achieve the defense effect. Adversarial samples are trained together with the original data. The loss generated by the adversarial samples is used as part of the neural network loss. The loss of the model is increased without modifying the original model structure, which produces a regularization effect. However, adversarial training still has problems such as overfitting and large training data requirements, and adversarial training takes a lot of time.

[0006] Collaborative defense combines detection defense with robust defense. While ensuring that the detection defense classification accuracy is high, the threshold of the robust defense confrontation area can be lowered, resulting in a larger confrontation area, thereby enhancing the defense effect of robust defense. In addition, the detection defense and robust defense of collaborative defense are not fixed. Various detection defenses and robust defenses can be combined to improve the defense effect.

[0007] An important direction for the development of adversarial defense is that the adversarial sample defense method should not only be able to resist adversarial attacks, but also be as unlikely to be broken by adversarial samples generated for this defense method as possible, that is, it should be able to resist secondary adversarial attacks.

[0008] Deep learning methods make image classification easy to implement. Classic convolutional neural network architectures include AlexNet, VGG16, GoogleNet, and ResNet. Among them, VGG16 has a relatively simple structure and a deeper network layer. Figure 2As shown in the figure, VGG16 has 16 layers and about 138 million parameters. This was already a very deep network model at the time, where the filter selected for the convolution layer is 3×3 with a step size of l, and the pooling layer is 2×2 with a step size of 2. Each module in the first half of the network consists of several convolution operations and one pooling operation. The last module consists of three fully connected layers and a softmax classifier. During the training process, as the network layer deepens, due to this regular network structure, the input and output of each layer are constantly changing with specific rules. Specifically, after each pooling operation, the height and width of the output feature map are reduced by half, and after each convolution operation, the number of channels is doubled.

[0009] Adversarial attacks and defenses against them usually require simulation experiments on the same data set to evaluate and compare the performance of attack methods. Figure 3 As shown in the figure, ImageNet, MNIST and CIFAR-10 are three widely used open source datasets in the field of image classification. CIFAR-10 contains 60,000 images of size 32x 32x 3, including 50,000 training samples and 10,000 test samples. It is divided into 10 categories: airplane, car, bird, cat, deer, dog, frog, horse, ship and truck. Due to its concise content, small size and easy implementation of adversarial attacks, CIFAR-10 is often used as an image dataset to evaluate the performance of adversarial attacks.

[0010] The common steps of existing adversarial training are as follows:

[0011] 1. Collect sample data: First, you need to collect representative sample data, which will be used to train and evaluate the model.

[0012] 2. Generate adversarial samples: Use adversarial sample generation algorithms such as FGSM, PGD, etc. to perturb the original samples and obtain a set of new adversarial samples. These adversarial samples are obtained through artificial intervention, with the goal of deceiving the model and improving the robustness of the model.

[0013] 3. Load adversarial samples: Input clean samples and adversarial samples into the model for training.

[0014] 4. Training model: Alternate between clean samples and adversarial samples to train the machine learning model so that the model can recognize and classify specific categories.

[0015] 5. Test model: Use the test data set to measure the robustness and generalization ability of the model.

[0016] 6. Adjust parameters: If the model is still vulnerable to attacks after testing, you can adjust the parameters or increase the number of training times to improve its robustness.

[0017] For adversarial training with better effects in adversarial defense, it is an eternal proposition to improve the robustness of the model to resist the attack of adversarial samples through various innovative means. However, in order to improve the robustness of the model in adversarial scenarios, adversarial training will increase a certain error rate, causing the model to lose a certain degree of accuracy on the original test set. Among the three major types of adversarial defense, data preprocessing and detection of adversarial samples both make significant changes to the original data. Both rely more on specific scenarios and specific methods, overly rely on data distribution, and are easily affected by overfitting and label noise. In particular, using only detection defense and directly "eliminating" adversarial samples will have an adverse effect on the actual system. Combining different defense methods can complement each other's strengths and improve overall benefits. Summary of the invention

[0018] In order to overcome the shortcomings of the prior art, the present invention provides a collaborative defense method for adversarial attacks based on steganalysis and three-dimensional networks. First, the initial model training is performed; then adversarial samples are generated; then steganalysis is used for detection defense; next, the three-dimensional network generated by adversarial training is used for robust defense; and finally, prediction classification is completed. The present invention can enhance the robustness of the network to effectively resist secondary adversarial attacks and ensure a higher classification accuracy of clean samples in networks that have not been trained adversarially.

[0019] The technical solution adopted by the present invention to solve the technical problem includes the following steps:

[0020] Step 1: Initial model training;

[0021] Prepare clean samples: Convert the public dataset into tensor format and divide it into training set and test set;

[0022] Save model parameters: Divide the training set into different batches to train the neural network model to obtain model parameters;

[0023] Test verification: Use the trained neural network model to classify the images in the clean sample test set, output the classification accuracy and average loss, and name the trained neural network model F1;

[0024] Step 2: Generate adversarial samples;

[0025] 1) Load the trained model parameters and generate a test model object;

[0026] 2) Set the perturbation size eps and use the FGSM attack method to attack the test set to generate adversarial samples;

[0027] 3) Save the generated adversarial sample and the original clean sample, and name the generated adversarial sample A1;

[0028] 4) Save the labels of the clean samples and adversarial sample images in (3);

[0029] Step 3: Use steganalysis for detection defense;

[0030] Step 3-1: Extract SPAM features of clean samples and adversarial samples;

[0031] Step 3-2: Fisher linear discriminant classification;

[0032] Load the SPAM features of clean samples and adversarial samples, randomly combine them into a feature matrix, train the classifier with the training set feature data, test the effect of the classifier, and output its classification accuracy;

[0033] Step 4: Use the triplet network generated by adversarial training for robust defense.

[0034] Step 4-1: Use the adversarial samples generated in step 2 as training sets and test sets to repeat the process of step 1 for adversarial training, obtain model F2, and save the parameters of model F2;

[0035] Step 4-2: Import the model F2 parameters in step 4-1 into the adversarial attack method file and generate an adversarial sample again, named A2;

[0036] Step 4-3: Use the adversarial samples A1 and A2 as training sets and test sets at the same time, repeat the process of step 1 to perform adversarial training, obtain model F3, and save the parameters of model F3;

[0037] Step 4-4: Compare the classification accuracy of models F1, F2, and F3 for adversarial samples and test samples, and make a decision based on the results of the three networks: for each category, multiply the predicted probability values ​​of the three networks with equal weights, and take the category with the highest sum as the final classification result.

[0038] Preferably, the neural network model is VGG16.

[0039] Preferably, the public dataset is CIFAR10.

[0040] The beneficial effects of the present invention are as follows:

[0041] 1. Detection defense based on steganalysis makes it difficult for attackers to directly carry out secondary adversarial attacks, making up for a small part of the clean sample classification accuracy sacrificed in the process of three-dimensional network decision enhancement.

[0042] 2. The Sansheng Network F3 network adds adversarial samples generated by the F2 network as a training set, which not only enhances the robustness and generalization ability of the network and effectively resists secondary adversarial attacks, but also enhances the decision-making ability of adversarial samples.

[0043] 3. The collaborative defense strategy significantly improves the classification accuracy of adversarial samples while ensuring a high classification accuracy of clean samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 The figure is a flow chart of the method of the present invention.

[0045] Figure 2 Schematic diagram of the VGG16 network structure.

[0046] Figure 3 Schematic diagram of the image dataset.

[0047] Figure 4 This is a schematic diagram of the present invention using steganalysis to perform detective defense. DETAILED DESCRIPTION

[0048] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0049] The present invention aims to combine detection defense and robustness defense to provide a simpler, more convenient, more diverse and more applicable method for adversarial attack defense. Using the three-generation network, the adversarial training data is reused to enhance the robustness of the network to effectively resist secondary adversarial attacks; using steganalysis, adversarial samples and clean samples in input data of unknown sources are detected, and adversarial samples are stripped to ensure a higher classification accuracy of clean samples in networks that have not been trained adversarially.

[0050] like Figure 1 As shown, a collaborative defense method for adversarial attacks based on steganalysis and three-life network specifically includes:

[0051] Pre-trained model: VGG16

[0052] Dataset: CIFAR10

[0053] Deep Learning Framework: Pytorch

[0054] 1. Initial model training

[0055] 1) Prepare clean samples: Use transforms in pytorch to convert the dataset into tensor format.

[0056] 2) Save model parameters: Use Dataloader to divide the training data set into different batches for model training to obtain model parameters (weights, biases, and other necessary parameters) and save them to pkl files for subsequent loading for inference and prediction of new data results.

[0057] 3) Test verification: Use the model in step 2 to classify the images in the clean sample test set, and output the classification accuracy and average loss.

[0058] 2. Generate adversarial examples

[0059] 1) Use torch.load to load the trained network parameters in 2 and generate the test model object vggtest. To shorten the calculation time, move it to the GPU.

[0060] 2) Set the perturbation size eps and use the FGSM attack method to attack the test set. The FGSM attack method can add tiny perturbations that are difficult for the human eye to detect to the original image, thereby generating adversarial samples;

[0061] 3) Save the generated adversarial sample images and the original clean samples in .png and .npy formats.

[0062] 4) Save the image label in .npy format.

[0063] 3. Steganalysis

[0064] like Figure 4 As shown, steganalysis is used for detective defense.

[0065] 1) SPAM feature extraction

[0066] The function spam_extract_2 is used to extract the SPAM features of the image; the function SPAM is used to loop through a set of image data and return the entire feature matrix; the function gen_feature is used to generate and save feature folders. The SPAM features of clean samples and adversarial samples are saved as .npy files respectively.

[0067] During the experiment, it was found that feature enhancement had no significant effect on the data and model used, so it was temporarily abandoned.

[0068] 2) Fisher linear discriminant classification

[0069] Load the SPAM features of the clean samples and adversarial samples in 1), randomly combine them into a feature matrix, train the classifier with the training set feature data, test the effect of the classifier, and output its classification accuracy. The results show that the larger the pixel perturbation eps, the stronger the attack effect and the better the steganalysis detection effect. When eps is 0.1, the classification accuracy is close to 92%, which can effectively separate adversarial samples from clean samples.

[0070] The detective defense proposed in the present invention makes it difficult for an attacker to directly conduct a secondary adversarial attack because the proposed method is not based on a neural network but on high-dimensional artificial features and a Fisher linear discriminant ensemble classifier.

[0071] 4. Sansheng Network

[0072] Robust defense using triplet networks generated by adversarial training.

[0073] 1) Use the adversarial sample saved in 2 (named A1) as the training set and test set to perform adversarial training according to the steps in 1 to obtain model F2 and save the parameters as a .pth file.

[0074] 2) Import the model .pth file from the previous step into the adversarial attack method file and generate an adversarial sample again (named A2).

[0075] 3) The adversarial samples A1 and A2 are used as training sets and test sets at the same time. Adversarial training is performed according to the steps in 1 to obtain model F3, and the parameters are saved as a .pth file.

[0076] Step 4-4: Compare the classification accuracy of models F1, F2, and F3 for adversarial samples and test samples, and make a decision based on the results of the three networks: for each category, multiply the predicted probability values ​​of the three networks with equal weights, sum them up, and take the category with the highest value among the ten categories as the final classification result. Specific embodiment:

[0078] On the premise that the three-study network has been trained with relevant data

[0079] 1. Directly input the verification image (clean sample or adversarial sample) into the three-sense network for classification. Based on the fact that the three-sense network has good tolerance for both clean samples and adversarial samples, the category with the highest probability among the three networks (voting mechanism, human judgment) is taken as the prediction result.

[0080] 2. For image classification tasks with extremely high security levels, it is recommended to go through the detective defense stage of steganalysis, extract features through SPAM, and then enter the Fisher linear discriminator. If the discrimination result is a clean sample, directly enter the original F1 network for prediction and classification; if the discrimination result is an adversarial sample, enter the more robust F3 network for prediction and classification.

[0081] Note: Feature extraction is not limited to SPAM or SRM methods, and feature enhancement modules can also be added. The above two paths can be flexibly selected to achieve the classification accuracy.

[0082] Table 1 below shows the experimental results of classification accuracy. It can be seen that the Sansheng network has a significant improvement in adversarial sample prediction compared to the F1 network, and has a slight decrease in clean samples. The F3 network trained with adversarial sample A2 generated by the F2 network has better results in identifying both types of samples than the F2 network trained only with A1.

[0083] Table 1 Experimental results of classification accuracy

[0084] F1 F2 F3 Sansheng Network Clean Sample 0.8547 0.7527 0.7788 0.8161 Adversarial Examples 0.1549 0.9549 0.9659 0.9406

Claims

1. A collaborative defense method against adversarial attacks based on steganalysis and three-life network, characterized in that: The steps include: Step 1: Initial model training; Prepare clean samples: Convert the public dataset into tensor format and divide it into training set and test set; Save model parameters: Divide the training set into different batches to train the neural network model to obtain model parameters; Test verification: Use the trained neural network model to classify the images in the clean sample test set, output the classification accuracy and average loss, and name the trained neural network model F1; Step 2: Generate adversarial samples; 1) Load the trained model parameters and generate a test model object; 2) Set the perturbation size eps and use the FGSM attack method to attack the test set to generate adversarial samples; 3) Save the generated adversarial sample and the original clean sample, and name the generated adversarial sample A1; 4) Save the labels of the clean samples and adversarial sample images in (3); Step 3: Use steganalysis for detection defense; Step 3-1: Extract SPAM features of clean samples and adversarial samples; Step 3-2: Fisher linear discriminant classification; Load the SPAM features of clean samples and adversarial samples, randomly combine them into a feature matrix, train the classifier with the training set feature data, test the effect of the classifier, and output its classification accuracy; Step 4: Use the three-sense network generated by adversarial training for robust defense; Step 4-1: Use the adversarial samples generated in step 2 as training sets and test sets to repeat the process of step 1 for adversarial training, obtain model F2, and save the parameters of model F2; Step 4-2: Import the model F2 parameters in step 4-1 into the adversarial attack method file and generate an adversarial sample again, named A2; Step 4-3: Use the adversarial samples A1 and A2 as training sets and test sets at the same time, repeat the process of step 1 to perform adversarial training, obtain model F3, and save the parameters of model F3; Step 4-4: Compare the classification accuracy of models F1, F2, and F3 for adversarial samples and test samples, and make a decision based on the results of the three networks: for each category, multiply the predicted probability values ​​of the three networks with equal weights, and take the category with the highest sum as the final classification result.

2. According to claim 1, a collaborative defense method for counterattack based on steganalysis and three-life network, characterized in that: The neural network model is VGG16.

3. According to claim 1, a collaborative defense method for counterattack based on steganalysis and three-life network, characterized in that: The public dataset is CIFAR10.

Images