A method for generating adversarial examples for large models

Abstract

This invention discloses a method for generating large-scale adversarial examples, which includes the following steps: employing a generative large-scale model to encode audio and text information as intermediate features, and decoding them back to an audio file; introducing cyclic loss calculation to randomly replace audio parts, achieving decoupling of information from different parts of the audio; and utilizing reinforcement learning, employing a Markov decision process to reduce the workload of manual annotation. This method introduces cyclic loss to decouple information from different parts of the intermediate features, improving model performance and making each part controllable; by training a generative large-scale model, the requirements for data quality are reduced; and through a reinforcement learning system, appropriate sentiment information is automatically selected based on the input text information, achieving a result where no additional sentiment annotation is required at the data level, and the synthesized result exhibits a more natural and smoother selection and intensity of sentiment.

Description

Technical Field

[0001] This invention relates to the field of deep learning technology, and more specifically, to a method for generating adversarial examples for large models. Background Technology

[0002] Reinforcement learning is a branch of machine learning that focuses on an agent performing actions in an environment to maximize cumulative reward. In reinforcement learning, the agent continuously interacts with the environment, receives feedback (reward or penalty) based on the results of its actions, and attempts to optimize the sum of cumulative rewards in future operations. Unlike supervised learning, reinforcement learning does not provide explicit labels or correct answers; instead, the agent needs to find the optimal strategy through trial and error during the learning process. Cycle loss is a loss function commonly used in tasks such as image generation and translation. Its basic idea is to transform a piece of data through a transformer, and then transform the transformed data back through an inverse transformer, requiring the inverse transformation result to be as close as possible to the original data. The purpose of cycle consistency loss is to ensure that the transformation process is reversible and prevent information loss. Specifically, in image translation tasks, text in one language needs to be converted into an image in another language. The role of cycle consistency loss is to translate the translated image back into the original language text, requiring the resulting text to be as identical as possible to the original text. In this way, we can optimize the model by repeatedly translating and retranslating, making the translated image more accurately represent the information contained in the original text. Generative large-scale models refer to deep learning models that perform unsupervised learning on large-scale datasets and can generate new data or samples. Their training typically requires significant computational resources, time, and data. They possess powerful generative and expressive capabilities, generating high-quality images, audio, natural language text, and other content, handling complex inputs and outputs, and achieving better performance than smaller models.

[0003] Audio adversarial examples are audio files generated by neural networks that prevent deep synthetic audio detection models from effectively distinguishing between genuine and fake audio. Cyclic loss is a method that involves randomly replacing some intermediate features, decoding, and then re-encoding, then calculating the loss by comparing the re-generated result with the previously replaced intermediate features. Current audio forgery requires a large amount of high-quality training data on the target person and additional training. Because past solutions generally encode audio into intermediate features before decoding it back to WAV format, the meaning of each part is often overlooked, making it difficult to improve the performance of a single part of the model. Existing technologies suffer from information coupling, high data quality requirements, supervised training, and the need for additional fine-tuning. Most existing audio generation models obtain intermediate features after inputting data into the encoder, which often contain both content information and speaker timbre and emotional information. The coupling of multiple types of information makes it difficult to clarify what the encoder is doing, making it difficult to make targeted improvements to the model. Moreover, current audio generation models require a large amount of high-quality data, which requires professional recording environments and equipment, increasing the difficulty of data acquisition. During training, any low-quality data containing noise will negatively impact the model, significantly reducing the generation quality. Therefore, readily available data such as online audio and video are generally unusable. When adding emotional information, the usual practice is to manually label the data, annotating the corresponding text based on different emotional audio data. Classification methods are often too subjective, and the intensity of the emotion is difficult to control. After the model is trained, if it needs to synthesize unseen speakers, it needs fine-tuning. Specifically, this involves retraining the model with a small amount of high-quality data from a small subset of target speakers. Therefore, there is an urgent need to design a large-scale adversarial example generation method using reinforcement learning and combined recurrent loss. Summary of the Invention

[0004] The purpose of this invention is to provide a method for generating adversarial examples for large models. By adding a cyclic loss, the various information contained in the intermediate features obtained by the model encoder are decoupled, significantly improving the model's performance. Through reinforcement learning, the model autonomously selects appropriate prosodic and emotional information. This allows model training to eliminate the need for labeled data and manual annotation. By constructing a generative large model, leveraging its large data volume and computational complexity, the requirements for data quality are significantly reduced. Furthermore, its powerful learning capabilities during the generation process eliminate the need for additional fine-tuning for speakers not yet seen.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] This invention provides a method for generating adversarial examples for large models, comprising the following steps:

[0007] S1. A generative large model is used to encode audio and text information into intermediate features and decode them back into audio files;

[0008] S2. Introduce cyclic loss calculation and randomly replace some audio information to achieve decoupling of audio information from different parts;

[0009] S3. By utilizing reinforcement learning and employing Markov decision processes, the workload of manual annotation is reduced.

[0010] Furthermore, S1 includes the following steps:

[0011] S11. Input the text information into the text encoder and encode it into word embedding vectors in the text encoder;

[0012] S12. Extract the audio information separately using multiple audio encoders and encode it into latent space coding;

[0013] S13. The main body of the generative large model encodes audio and text information into intermediate features;

[0014] S14. Use the decoder of the open-source audio codec model to decode and restore it to adversarial sample audio.

[0015] Furthermore, S11 includes the following steps:

[0016] S111. The DeepPhonemizer model is used to convert text information into phoneme form and input it into the text encoder;

[0017] S112. After converting the phoneme IDs to phoneme IDs by referring to the phoneme lookup table in the text encoder, they are encoded into word embedding vectors.

[0018] Furthermore, S12 includes the following steps:

[0019] S121. Four main encoders are used, namely the prosody information encoder, the emotion information encoder, the timbre information encoder, and the remaining information encoders, to extract the various parts of the audio information respectively;

[0020] S122. Each encoder is responsible for encoding the input audio into latent space codes of its respective features.

[0021] Furthermore, the main body of the generative large model in S13 includes a one-layer autoregressive transformer block and seven layers of non-autoregressive transformer blocks. Architecturally, the autoregressive transformer block and the seven layers of non-autoregressive transformer blocks are connected in series.

[0022] Furthermore, S2 includes the following steps:

[0023] S21. Stop calculating the cyclic loss when the audio input of the generative large model is randomly replaced with content that does not correspond to the text information;

[0024] S22. When the audio input of a generative large model is randomly replaced with audio content related to text information, a cyclic loss calculation is introduced.

[0025] Furthermore, S22 includes the following steps:

[0026] S221. When the audio content, i.e., audio information 1, is associated with the text content, during the training process, another audio information, i.e., audio information 2, is randomly selected and randomly input into an audio encoder.

[0027] S222. The result of encoding audio information 2 by the above audio encoder replaces the original encoding of the encoder, and is fed into the generative large model together with the encoding of the other encoders;

[0028] S223. When decoding into an audio file, the generated adversarial sample file is input into the audio encoder again to obtain the remaining encodings of the adversarial sample audio from the other encoders;

[0029] S224. Perform loss calculations by combining the remaining encodings above with the encodings of the previous uninputted generative large model, i.e., the remaining encoder encodings for audio information 1.

[0030] Furthermore, S3 includes the following steps:

[0031] S31. Using reinforcement learning, construct a lookup table for audio information regarding emotion and prosody;

[0032] S32. By adopting a Markov decision process, the amount of manual annotation work is reduced in both the generation and training phases.

[0033] Furthermore, S32 includes the following steps:

[0034] S321. During the generation phase, the Markov model interacts with the text information. After obtaining some text information, the Markov model selects a prosody or emotional information that the model deems appropriate from the lookup table as the input to the audio domain.

[0035] S322. During the training phase, the generative large model obtains the reconstruction loss to calculate loss1 and obtains the loss to calculate loss2. When the difference between loss1 and loss2 is lower than the set threshold, it is considered that the action generates positive feedback, and the learning is continuously reinforced.

[0036] Furthermore, S322 includes the following steps:

[0037] S3221. Generative large models first generate the input text and audio, and then input the obtained adversarial sample audio domain into the audio to calculate the reconstruction loss loss1;

[0038] S3222. For the Markov model, select an appropriate audio code from the audio information lookup table as the audio information input, and input it along with other information into the production large model. Then, calculate the loss loss2 by comparing the generated adversarial sample with the original audio input.

[0039] S3223. A preset threshold is set, and the difference between loss1 and loss2 is obtained. If the difference is lower than the preset threshold, the action is considered to have caused positive feedback.

[0040] S3224. Through continuous learning, the reinforcement learning system eventually becomes able to select appropriate information about audio based on text information.

[0041] By adopting the above technical solution, the present invention has the following advantages:

[0042] This invention provides a method for generating adversarial examples using a large generative model. By utilizing a generative large model, the requirements for data quality are significantly reduced. Using open-source G2P and encoding / decoding models, the model's input and output can be completed without additional operations. Text and audio information are randomly matched during training, achieving decoupling between the two types of information. In the model generation stage, only a 3-second audio clip is needed to synthesize adversarial examples without a visible speaker, and no additional fine-tuning is required. This reduces data requirements and workload. The introduction of cyclic loss calculation achieves decoupling of information such as emotion and prosody in different parts of the audio, increasing model interpretability. This allows the model to achieve more precise control over certain indicators in subsequent iterations. Using reinforcement learning, a lookup table is first constructed, and prosody and emotion are automatically controlled based on the text input. Compared with traditional data annotation methods, its generation results are more diverse, natural, and smoother. Appropriate prosody and emotion selection in the audio is positively rewarded, improving the realism of the synthesized samples and significantly reducing the workload of manual annotation. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating the overall framework of the generative large model of the present invention.

[0044] Figure 2 This is a flowchart illustrating the framework of the present invention for decoding a generative large model and restoring it to an audio file.

[0045] Figure 3 This is the architectural composition of the main body of the generative large model of the present invention;

[0046] Figure 4 A flowchart illustrating the framework for introducing cyclic loss into the generative large model of this invention;

[0047] Figure 5 This is a flowchart illustrating the framework of reinforcement learning for the generative large model of this invention. Detailed Implementation

[0048] The technical solution of the present invention will be specifically described below with reference to the accompanying drawings. It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus.

[0049] A method for generating adversarial examples for large models is as follows: Figure 1 As shown, it includes the following steps:

[0050] S1. The main part of this solution adopts a generative large model. This model takes audio and text information as input, encodes them as intermediate features, and decodes them to restore the audio file. Specifically, as follows... Figure 2 As shown.

[0051] S1 includes the following specific steps:

[0052] S11. Input the text information into the text encoder and encode it into word embedding vectors in the text encoder;

[0053] S11 includes the following steps:

[0054] S111. The DeepPhonemizer model is used to convert text information into phoneme form and input it into the text encoder. For text information, an open-source text-to-phoneme model is directly used to convert it into phoneme form. This invention uses the open-source DeepPhonemizer model, which is a deep learning-based text-to-phoneme model developed by Karolis Petkevicius and Andrius Aucinas. The DeepPhonemizer model uses recurrent neural networks (RNN) and attention mechanisms and can handle multiple languages.

[0055] S112. After converting the text information into phonemes, input it into the text encoder. In the encoder, convert it into phoneme IDs by referring to the phoneme lookup table, and then encode it into word embedding vectors.

[0056] S12. Extract the audio information separately using multiple audio encoders and encode it into latent space coding;

[0057] S12 includes the following specific steps:

[0058] S121. Four main encoders are used to extract different parts of the audio information. That is, for the audio information, multiple audio encoders are used. They have the same structure but are responsible for extracting different parts of the information. Here, the encoders in the open-source audio codec model can be used. Four main encoders are set up, namely the prosody information encoder, the emotion information encoder, the timbre information encoder, and the other information encoder. The first three encoders are responsible for the main parts related to the realism and listening experience of the audio synthesis. The other audio information is not distinguished and is handed over to the other information encoder.

[0059] S122. Each encoder is responsible for encoding the input audio into latent space codes of its respective features.

[0060] S13. The main body of the generative large model encodes audio and text information into intermediate features; the main body of the generative large model is specifically as follows: Figure 3 As shown, it includes a one-layer autoregressive transformer block and a seven-layer non-autoregressive transformer block. In terms of architecture, the autoregressive transformer block and the seven-layer non-autoregressive transformer block are connected in series. The choice between autoregressive and non-autoregressive is a trade-off between the generation quality and generation speed of adversarial audio samples. The latent space encodings of the features obtained from the previous encoder are connected and input into the main part of the large model, and finally an eight-layer audio encoding is output. After being decoded, it is restored to an audio adversarial sample.

[0061] S14. For the intermediate features generated by the large model, this invention uses the decoder of an open-source audio codec model to decode and restore them into adversarial sample audio. During the training phase of the generative large model, at random moments, audio that does not correspond to the text information is randomly selected as the audio input of the model. The purpose of this is to decouple the text information and the audio information, and to completely entrust the content information of the adversarial sample to the text encoder for generation. It is this key step that enables the generative large model to avoid fine-tuning for speakers who have not been seen, and to synthesize adversarial samples for speakers who have not been seen by only a 3-second audio segment as input during the generation phase.

[0062] S2. Introduce cyclic loss calculation and randomly replace some audio information to achieve decoupling of audio information from different parts;

[0063] Speech decoupling decomposes the independent factors in a speech signal into independent codes. Perfect decoupling is beneficial to improving model performance. Based on the cycle consistency loss, a new loss method is adopted by using random factor replacement: cycle loss.

[0064] S2 includes the following steps, as detailed below: Figure 4 As shown:

[0065] S21. When the audio input of the large model is randomly replaced with content that does not correspond to the text information, stop calculating the cyclic loss. This step is only performed when the audio content is relevant. This is done to ensure that each part can be trained independently and to avoid further coupling between text and audio due to incorrect training settings.

[0066] S22. When the audio input of a generative large model is randomly replaced with audio content related to text information, a cyclic loss calculation is introduced.

[0067] S22 includes the following specific steps:

[0068] S221. When audio content (audio information 1) is associated with text content, during the training process, another audio information (audio information 2) is randomly selected and randomly input into an audio encoder;

[0069] S222. The result of encoding audio information 2 by the above audio encoder replaces the original encoding of the encoder, and is fed into the generative large model together with the encoding of the other encoders;

[0070] S223. When decoding into an audio file, the generated adversarial sample file is input into the audio encoder again to obtain the remaining encodings of the adversarial sample audio from the other encoders;

[0071] S224. The remaining encodings mentioned above are compared with the encodings of the previous uninputted generative large model, i.e. the remaining encoder encodings for audio information 1. This loss is the cyclic loss.

[0072] For the encoders, due to the addition of cyclic loss, during continuous training, each encoder part will focus more on the information it needs. As the cyclic loss decreases, the content encoded by the various encoders will gradually decouple. Ultimately, this allows for more precise control over the emotion, rhythm, and other aspects of the audio.

[0073] Generative large models set a threshold for the loop loss. When the calculated loop loss is lower than this threshold, it is considered that the information of each part of the audio encoding has been sufficiently decoupled, and the calculation of the loop loss is stopped.

[0074] S3. By utilizing reinforcement learning and employing Markov decision processes, the workload of manual annotation is reduced.

[0075] Reinforcement learning is a computer-based approach where it initially performs operations completely randomly, learns from mistakes through continuous trial and error, and eventually discovers patterns and learns methods to achieve its goals. In this model, after the cyclic loss calculation stops, preparation and training for the reinforcement learning decision-making process begin.

[0076] S3 includes the following specific steps, as follows: Figure 5 As shown:

[0077] S31. Using reinforcement learning, a lookup table for audio information regarding emotion and prosody is constructed. In a specific embodiment, during the reinforcement learning preparation phase, a lookup table for audio information regarding emotion and prosody is established. Taking emotion information as an example, after encoding, if the table is empty, it is directly added. If the table is not empty, the cosine similarity is calculated with the existing encodings in the table. A threshold is pre-set. When the similarity is higher than this threshold, it is considered that these are two different or significantly different emotions, and then this encoding is stored in the table. When the lookup table no longer increases after training for a pre-set number of epochs, it is considered that the lookup table is complete. Finally, the lookup table is sorted according to the cosine similarity distance, because information encodings with higher cosine similarity will have a more similar effect in audio.

[0078] S32. By adopting a Markov decision process, the amount of manual annotation work is reduced in both the generation and training phases.

[0079] S32 includes the following steps:

[0080] S321. During the generation phase, the Markov model interacts with the text information. After the model obtains some text information, it selects a prosody or emotional information that the model considers appropriate from the lookup table of sentiment or prosody as the input to the audio domain.

[0081] S322. During the training phase, the generative large model obtains the reconstruction loss to calculate loss1 and obtains the loss to calculate loss2. When the difference between loss1 and loss2 is lower than the set threshold, it is considered that the action generates positive feedback, and the learning is continuously reinforced.

[0082] Specifically, S322 includes the following steps:

[0083] S3221. During the training phase, the generative large model will first generate the input text and audio, and then input the obtained adversarial sample audio domain into the audio to calculate the reconstruction loss loss1.

[0084] S3222. For the Markov model, taking the emotion information as an example, it first receives text information as input, and then generates an action. That is, it selects an appropriate emotion code from the emotion information lookup table as the input of audio emotion information. After inputting it along with other information into the generative large model, the generated adversarial sample and the original audio input are used to calculate loss2.

[0085] S3223. A preset threshold is set, and the difference between loss1 and loss2 is obtained. When the difference is lower than the preset threshold, the action is considered to have caused positive feedback.

[0086] S3224. Ultimately, through continuous learning, the reinforcement learning system can select appropriate audio-related information such as rhythm and emotion based on textual information. Furthermore, this method provides more precise control over various parts of the audio, resulting in higher realism, better listening experience, and more natural transitions.

[0087] Finally, it should be noted that although the present invention has been described with reference to specific embodiments, those skilled in the art should recognize that the above embodiments are only used to illustrate the present invention and are not intended to limit the present invention. Various equivalent changes or substitutions can be made without departing from the concept of the present invention. Therefore, any changes or modifications to the above embodiments within the essential spirit of the present invention will fall within the scope of the claims of the present invention.

Claims

1. A method for generating adversarial examples for large models, characterized in that, Includes the following steps: S1. A generative large model is used to encode audio and text information into intermediate features and decode them back into audio files; S2. Introduce cyclic loss calculation and randomly replace some audio information to achieve decoupling of audio information from different parts; S2 includes the following steps: S21. Stop calculating the cyclic loss when the audio input of the generative large model is randomly replaced with content that does not correspond to the text information; S22. When the audio input of a generative large model is randomly replaced with audio content related to text information, a cyclic loss calculation is introduced; S22 includes the following steps: S221. When the audio content, i.e., audio information 1, is associated with the text content, during the training process, another audio information, i.e., audio information 2, is randomly selected and randomly input into an audio encoder. S222. The result of encoding audio information 2 by the above audio encoder replaces the original encoding of the encoder, and is fed into the generative large model together with the encoding of the other encoders; S223. When decoding into an audio file, the generated adversarial sample file is input into the audio encoder again to obtain the remaining encodings of the adversarial sample audio from the other encoders; S224. Perform loss calculation by combining the remaining encodings above with the encodings of the previous uninputted generative large model, i.e., the remaining encoder encodings for audio information 1; S3. By utilizing reinforcement learning and employing Markov decision processes, the workload of manual annotation is reduced; S3 includes the following steps: S31. Using reinforcement learning, construct a lookup table for audio information regarding emotion and prosody; S32. By adopting a Markov decision process, the amount of manual annotation work is reduced in the generation and training phases. S32 includes the following steps: S321. During the generation phase, the Markov model interacts with the text information. After obtaining some text information, the Markov model selects a prosody or emotional information that the model deems appropriate from the lookup table as the input to the audio domain. S322. During the training phase, the generative large model obtains the reconstruction loss to calculate loss1 and obtains the loss to calculate loss2. When the difference between loss1 and loss2 is lower than the set threshold, it is considered that the action generates positive feedback, and the learning is continuously reinforced. S322 includes the following steps: S3221. Generative large models first generate the input text and audio, and then input the obtained adversarial sample audio domain into the audio to calculate the reconstruction loss loss1; S3222. For the Markov model, select an appropriate audio code from the audio information lookup table as the audio information input, and input it along with other information into the production large model. Then, calculate the loss loss2 by comparing the generated adversarial sample with the original audio input. S3223. A preset threshold is set, and the difference between loss1 and loss2 is obtained. If the difference is lower than the preset threshold, the action is considered to have caused positive feedback. S3224. Through continuous learning, the reinforcement learning system eventually becomes able to select appropriate information about audio based on text information.

2. The method for generating large-scale adversarial examples according to claim 1, characterized in that, S1 includes the following steps: S11. Input the text information into the text encoder and encode it into word embedding vectors in the text encoder; S12. Extract the audio information separately using multiple audio encoders and encode it into latent space coding; S13. The main body of the generative large model encodes audio and text information into intermediate features; S14. Use the decoder of the open-source audio codec model to decode and restore it to adversarial sample audio.

3. The method for generating large-scale adversarial examples according to claim 2, characterized in that, S11 includes the following steps: S111. The DeepPhonemizer model is used to convert text information into phoneme form and input it into the text encoder; S112. After converting the phoneme IDs to phoneme IDs by referring to the phoneme lookup table in the text encoder, they are encoded into word embedding vectors.

4. The method for generating large-scale adversarial examples according to claim 2, characterized in that, S12 includes the following steps: S121. Four main encoders are used, namely the prosody information encoder, the emotion information encoder, the timbre information encoder, and the remaining information encoders, to extract the various parts of the audio information respectively; S122. Each encoder is responsible for encoding the input audio into latent space codes of its respective features.

5. The method for generating large-scale adversarial examples according to claim 2, characterized in that, The main body of the generative large model in S13 includes a one-layer autoregressive transformer block and seven layers of non-autoregressive transformer blocks. Architecturally, the autoregressive transformer block and the seven layers of non-autoregressive transformer blocks are connected in series.

Images