A generative cross-modal attack method for migrating from image domain to video domain

Abstract

The present invention belongs to the field of video recognition network model security technology, specifically a generative cross-modal attack method for migrating from the image domain to the video domain. The present invention only uses the knowledge of the image domain to train the adversarial perturbation generator, and the trained adversarial perturbation generator is used to generate adversarial perturbations with high migration for different video models frame by frame for videos from different video domains; wherein, the adversarial migration from the image domain to the video domain is enhanced by reducing the domain difference between images and videos; a random motion module is designed to simulate the different temporal motions between adjacent video frames through randomly synthesized optical flows; the random motion module is integrated into the feature destruction loss; additional temporal cues and temporal consistency loss based on intermediate features are introduced in the training stage to enhance the migration of generated video adversarial samples; experiments have proved the effectiveness of the attack method of the present invention, and it has the most advanced performance in different target video domains.

Description

Technical Field

[0001] The present invention belongs to the field of video recognition network model security technology, and specifically relates to a generative cross-modal attack method that migrates from the image domain to the video domain. Background Art

[0002] Adversarial attacks are techniques that mislead deep neural networks (DNNs) into making incorrect decisions by adding imperceptible perturbations to clean examples. The generated examples that can cause DNNs to make incorrect decisions are called adversarial examples. Based on the threat model, adversarial attacks can be categorized as white-box and black-box attacks. In white-box attacks, the attacker has full access to the DNN, including the model structure and parameters. In black-box attacks, the attacker only has access to the DNN's output. Therefore, research on black-box attacks is both more practical and more challenging.

[0003] In recent years, DNNs have achieved remarkable results in a range of computer vision tasks, including image classification, object detection, and action recognition. However, advances in adversarial machine learning have revealed that DNNs are extremely vulnerable to adversarial examples [1,2]. More importantly, adversarial examples generated for one model can also deceive other models, even if these models have different architectures or are trained on different subsets of the training data [2]. This transferability of adversarial examples makes black-box attacks possible, which undoubtedly poses a serious security threat to the deployment of DNNs in real-world scenarios. Therefore, the transferability of adversarial examples has attracted the attention of numerous researchers.

[0004] Most existing transfer-based black-box attacks [3, 4, 5] assume that the training data of the target model is available and mainly explore the transferability of adversarial examples between models trained on the same dataset. However, from a practical perspective, it is unlikely that the model deployer will leak the training set of the deployed model. To address this key issue, recent work has proposed cross-domain transfer attacks [6, 7, 8]. Specifically, an adversarial perturbation generator is first trained for a certain source domain. During inference, the trained perturbation generator directly produces adversarial examples for images from any other target domain to deceive the model trained in the target domain. However, this cross-domain transfer attack requires that the source and target domains are homomodal, that is, both are image domains. Cross-modal domains (for example, from image domain to video domain) are rarely explored.

[0005] The main challenge of this invention comes from the large domain gap between images and videos. Compared with video data, image data lacks dynamic temporal cues that are crucial for the video domain. This difference may limit the generalization performance of the perturbation generator trained for the image domain in the video domain. The difference in temporal order between images and videos poses new challenges for cross-modal transfer attacks. Existing cross-domain transfer attack methods [6,7,8] only consider how to narrow the domain gap between different images. These methods encourage the perturbation generator to learn domain-independent adversarial perturbations by introducing loss functions that act on the relative category probabilities or intermediate features of clean and adversarial images, as well as random normalization and domain-independent attention. Since the difference in temporal order between images and videos is ignored, directly extending them to cross-modal transfer attacks has poor performance. Summary of the Invention

[0006] The purpose of the present invention is to provide a generative cross-modal attack method that can be transferred from the image domain to the video domain, so as to improve the generalization performance of the perturbation generator for the video domain and enhance the adversarial transferability of adversarial video clips.

[0007] The generative cross-modal attack method for migrating from the image domain to the video domain provided by the present invention only uses the knowledge of the image domain to train the adversarial perturbation generator [9]. The trained adversarial perturbation generator can generate adversarial perturbations with high transferability for different video models frame by frame for videos from different video domains; wherein, the adversarial transferability from the image domain to the video domain is enhanced by narrowing the domain difference between images and videos. This includes proposing a random motion module that simulates different temporal motions between adjacent video frames by randomly synthesizing optical flows

[10] . This module uses the synthesized random optical flows to distort the adversarial images generated by the clean and adversarial perturbation generators

[11] . By integrating the random motion module into the feature destruction loss (the original feature destruction loss is calculated on the undistorted clean and adversarial images, but in this invention, the feature destruction loss is calculated on the distorted clean and adversarial images, so it is called the feature destruction loss integrated with the random motion module), additional temporal cues are introduced in the training stage. In addition, a temporal consistency loss based on intermediate features is introduced to further enhance the transferability of the generated video adversarial samples. The perturbation generator is trained by simultaneously optimizing the feature destruction loss and the temporal consistency loss.

[0008] The generative cross-modal attack method for migrating from the image domain to the video domain provided by the present invention specifically comprises the following steps:

[0009] (1) During the training phase of the adversarial perturbation generator, a random motion module is used to integrate dynamic temporal cues. Specifically:

[0010] For each image input, random optical flows are synthesized to simulate different temporal motions, and the images are warped using the synthesized random optical flows to simulate their adjacent frames.

[0011] The specific steps are as follows:

[0012] Step 1: Given an input image x i ∈R H×W×C , synthesize a random optical flow f∈R H×W× 2;

[0013] Where H and W are the height and width of the image respectively, and C is the number of channels of the image;

[0014] Step 2: Transform the clean image x i Input the adversarial perturbation generator at this time Get adversarial image

[0015] Step 3: Use the synthesized random optical flow f to perform random motion on the clean image x i and adversarial images Warp and get the distorted clean image RM(x i ) and adversarial images

[0016] Step 4: Transform the distorted clean image RM(x i ) and adversarial images Input pre-trained image model Get the intermediate features of the lth layer and (Here, "image model" specifically refers to the model used for image classification tasks; because the training phase needs to ensure that adversarial images that can deceive the image model are generated, a pre-trained image model is required)

[0017] Step 5: By minimizing the intermediate features and The cosine similarity between the two frames is used to calculate the feature destruction loss and enhance the robustness of the perturbation generator to the temporal changes between frames.

[0018] (2) During the training phase of the perturbation generator, temporal consistency is introduced to further enhance adversarial transferability;

[0019] The adversarial video clips generated by the adversarial perturbation generator based on feature destruction loss have a positive correlation between temporal consistency and adversarial transferability in intermediate features. Specifically, the adversarial images of two simulated adjacent frames are temporally consistent in intermediate features.

[0020] The specific steps are:

[0021] Step 1: Transform the distorted clean image RM(x i ) Input the adversarial perturbation generator at this time Get its corresponding adversarial image RM(x i ) adv ;

[0022] Step 2: The adversarial image RM(x i ) adv Input pre-trained image model Get the intermediate features of the lth layer

[0023] Step 3: By minimizing the intermediate features and The cosine similarity between them is used to calculate the temporal consistency loss to further enhance the transferability of the generated adversarial video clips.

[0024] (3) During the training phase of the perturbation generator, both the feature destruction loss and the temporal consistency loss are optimized;

[0025] Specifically, when training the adversarial perturbation generator, the feature destruction loss of the integrated random motion module and the temporal consistency loss based on intermediate features are optimized simultaneously until convergence.

[0026] (4) generating adversarial videos during the inference phase of the adversarial perturbation generator;

[0027] Specifically, the trained perturbation generator accepts a single frame in a video clip as input and generates adversarial frames through a single forward propagation; then, the generated adversarial frames are reassembled into an adversarial video clip.

[0028] The generative cross-modal attack method for migrating from the image domain to the video domain provided by the present invention has the following specific operation process:

[0029] (1) During the training phase of the perturbation generator, given a clean image input, a random optical flow is synthesized;

[0030] (2) Input the clean image into the adversarial perturbation generator at this time to obtain the adversarial image;

[0031] (3) Using random optical flow to distort clean and adversarial images through random motion modules;

[0032] (4) Input the distorted clean image into the adversarial perturbation generator at this time to obtain the corresponding adversarial image;

[0033] (5) Input the clean image and all adversarial images into the pre-trained image model, obtain the intermediate features, and calculate the feature destruction loss and temporal consistency loss;

[0034] (6) Simultaneously optimize the feature destruction loss and temporal consistency loss to update the parameters of the perturbation generator;

[0035] (7) Execute process steps (1) to (6) again until the specified number of rounds is reached;

[0036] (8) In the inference phase of the perturbation generator, a single frame from a clean video clip is input to generate an adversarial frame;

[0037] (9) All generated adversarial frames are reassembled into an adversarial video clip.

[0038] The innovation of the present invention is:

[0039] (1) A random motion module is proposed to eliminate the domain difference between image data and video data. It is optimized on clean images and adversarial images after random optical flow distortion, improving the generalization performance of the perturbation generator for the video domain.

[0040] (2) A temporal consistency loss based on intermediate features is proposed to further enhance the adversarial transferability of adversarial video clips by imposing temporal consistency on the intermediate features of adjacent frames.

[0041] A large number of experiments have demonstrated the effectiveness of the attack method proposed in this paper, and have achieved state-of-the-art performance on different target video domains. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flowchart of the generative cross-modal attack method proposed in the present invention for migrating from the image domain to the video domain. DETAILED DESCRIPTION

[0043] The present invention is further described below through specific examples.

[0044] Step 1: Input video clip x v ∈R T×H×W×C , where H and W are the height and width of the video clip, C is the number of channels in the video clip (usually 3), and T is the number of frames in the video clip. Video clip x v The true label is y∈{1,2,…,K}, where K represents the number of categories. represents a video recognition model that outputs a predicted category for an input video clip. The goal of this invention is to use only the knowledge in the image domain (including the image data x i and pre-trained image models ) Train a perturbation generator For video clip x v Generate adversarial perturbation δ for each frame of , where ||δ|| ∞≤ε is used to limit the generated perturbation to be imperceptible to the human eye, and ε is the perturbation limit. Generated adversarial video clips Able to fool video recognition models Make it make wrong predictions

[0045]

[0046] Step 2: In order to eliminate the influence of domain differences between images and videos, the present invention calculates i Synthesize random optical flow f and use random motion module RM to clean image x i and adversarial images Warp and get the distorted clean image RM(x i ) and adversarial images

[0047] Step 3: The distorted clean image RM(x i ) and adversarial images Input to image model In the process, we get the intermediate features of the lth layer and And the feature destruction loss is calculated by minimizing the cosine similarity between the two, i.e. Where CosSim is a function for calculating cosine similarity.

[0048] Step 4: In order to impose temporal consistency during the training phase, the present invention transforms the distorted clean image RM(x i ) is input to the disturbance generator at this time In the example, we get the adversarial image RM(x i ) adv .

[0049] Step 5: The adversarial image RM(x i ) adv Input to image model

[0050] In the process, we get the intermediate features of the lth layer And by maximizing it and the distorted adversarial image intermediate features The loss is calculated by the cosine similarity between

[0051] Step 6: Optimize the feature destruction loss and timing consistency loss simultaneously, and iteratively update the parameters of the perturbation generator until the limited number of rounds is reached.

[0052] Step 7: Use the trained perturbation generator to directly generate the perturbation for the clean video segment x vGenerate adversarial frames frame by frame, and then reassemble all generated adversarial frames into an adversarial video clip

[0053] The following table uses the ImageNet training set to train adversarial perturbation generators for four image models; then uses the trained adversarial perturbation generators to generate adversarial video clips on the Kinetics400 validation set and attack 6 video models.

[0054]

[0055] References

[0056] [1]Ian J Goodfellow,Jonathon Shlens,and Christian Szegedy.Explaining and harnessing adversarial examples.arXivpreprint arXiv:1412.6572,2014.

[0057] [2]Christian Szegedy,Wojciech Zaremba,Ilya Sutskever,JoanBruna,Dumitru Erhan,Ian Goodfellow,and Rob Fergus.Intriguing properties of neuralnetworks.arXiv preprintarXiv:1312.6199,2013.

[0058] [3] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, JunZhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference

[0059] on computer vision and pattern recognition, pages9185–9193, 2018.

[0060] [4]CihangXie,Zhishuai Zhang,Yuyin Zhou,Song Bai,JianyuWang,Zhou Ren,and Alan L Yuille.Improving transferabilityof adversarial examples with inputdiversity.In Proceedingsof the IEEE / CVF Conference on Computer VisionandPattern Recognition,pages 2730–2739,2019.

[0061] [5]Yinpeng Dong,Tianyu Pang,Hang Su,and Jun Zhu.Evading defensestotransferable adversarial examplesby translation-invariant attacks.InProceedings of the

[0062] IEEE / CVF Conference on Computer Vision and PatternRecognition,pages4312–4321,2019.

[0063] [6]Muhammad Muzammal Naseer,Salman H Khan,Muhammad Haris Khan,FahadShahbaz Khan,and Fatih Porikli.2019.Cross-domain transferability ofadversarial perturbations.Advances in Neural Information Processing Systems32(2019).

[0064] [7]Mathieu Salzmann et al.2021.Learning transferable adversarialperturbations.Advances in Neural Information Processing Systems 34(2021),13950–13962.

[0065] [8]Qilong Zhang,Xiaodan Li,YueFeng Chen,Jingkuan Song,Lianli Gao,YuanHe,et al.2021.Beyond ImageNet Attack:Towards Crafting Adversarial Examplesfor Black-box Domains.In International Conference on LearningRepresentations.

[0066] [9]Omid Poursaeed,Isay Katsman,Bicheng Gao,and SergeBelongie.Generative adversarial perturbations.In Proceedings of the IEEEConference on Computer Vision and Pattern Recognition,pages 4422–4431,2018.

[0067]

[10] Wenjing Wang,Shuai Yang,Jizheng Xu,and JiayingLiu.2020.Consistent video style transfer via relaxation andregularization.IEEE Transactions on ImageProcessing 29(2020),9125–9139.

[0068]

[11] J.Y.Jason,A.W.Harley,and K.G.Derpanis,“Back to basics:Unsupervised learning of optical flow via brightness constancy and motionsmoothness,”in European Conference on Computer Vision,pp.3–10,Springer,2016。

Claims

1. A generative cross-modal attack method for migrating from the image domain to the video domain, characterized by: The adversarial perturbation generator is trained using only knowledge from the image domain. The trained adversarial perturbation generator is used to generate adversarial perturbations with high transferability to different video models frame by frame for videos from different video domains. The adversarial transferability from the image domain to the video domain is enhanced by narrowing the domain difference between images and videos. In addition, a random motion module is designed to simulate the different temporal motions between adjacent video frames through randomly synthesized optical flows. By integrating the random motion module into the feature destruction loss, additional temporal cues are introduced during the training phase, and a temporal consistency loss based on intermediate features is also introduced to further enhance the transferability of generated video adversarial samples. The perturbation generator is trained by simultaneously optimizing the feature destruction loss and the temporal consistency loss. The specific steps include: (1) During the training phase of the adversarial perturbation generator, a random motion module is used to integrate dynamic temporal cues. Specifically: For each image input, we synthesize random optical flows to simulate different temporal motions, and use the synthesized random optical flows to warp the images to simulate their adjacent frames; (2) During the training phase of the perturbation generator, temporal consistency is introduced to further enhance adversarial transferability; The adversarial video clips generated by the adversarial perturbation generator based on feature destruction loss have a positive correlation between temporal consistency and adversarial transferability in intermediate features. Specifically, the adversarial images of two simulated adjacent frames are temporally consistent in intermediate features. (3) During the training phase of the perturbation generator, both the feature destruction loss and the temporal consistency loss are optimized; Specifically, when training the adversarial perturbation generator, the feature destruction loss of the integrated random motion module and the temporal consistency loss based on intermediate features are optimized simultaneously until convergence; (4) In the inference phase of the adversarial perturbation generator, adversarial videos are generated.

2. The generative cross-modal attack method according to claim 1, characterized in that: In step (1), during the training phase of the adversarial perturbation generator, the random motion module is used to integrate dynamic timing cues. The specific steps are as follows: Step 1: Given an input image x i ∈R H×W×C , synthesize a random optical flow f∈R H×W×2 ; Where H and W are the height and width of the image respectively, and C is the number of channels of the image; Step 2: Transform the clean image x i Input the adversarial perturbation generator at this time Get adversarial image Step 3: Use the synthesized random optical flow f to perform random motion on the clean image x i and adversarial images Warp and get the distorted clean image RM(x i ) and adversarial images Step 4: Transform the distorted clean image RM(x i ) and adversarial images Input pre-trained image model Get the intermediate features of the lth layer and Step 5: By minimizing the intermediate features and The cosine similarity between the two frames is used to calculate the feature destruction loss and enhance the robustness of the perturbation generator to the temporal changes between frames.

3. The generative cross-modal attack method according to claim 2, characterized in that: In step (2), during the training phase of the perturbation generator, temporal consistency is introduced to further enhance adversarial migration. The specific steps are as follows: Step 1: Transform the distorted clean image RM(x i ) Input the adversarial perturbation generator at this time Get its corresponding adversarial image RM(x i ) adv ; Step 2: The adversarial image RM(x i ) adv Input pre-trained image model Get the intermediate features of the lth layer Step 3: By minimizing the intermediate features and The cosine similarity between them is used to calculate the temporal consistency loss to further enhance the transferability of the generated adversarial video clips.

4. The generative cross-modal attack method according to claim 3, characterized in that: In step (4), during the inference phase of the adversarial perturbation generator, an adversarial video is generated. Specifically, the trained perturbation generator accepts a single frame in a video clip as input and generates an adversarial frame through a single forward propagation. Then, the generated adversarial frames are reassembled into an adversarial video clip.

5. The generative cross-modal attack method according to claim 4, characterized in that: The specific operation process is as follows: (1) During the training phase of the perturbation generator, given a clean image input, a random optical flow is synthesized; (2) Input the clean image into the adversarial perturbation generator at this time to obtain the adversarial image; (3) Using random optical flow to distort clean and adversarial images through random motion modules; (4) Input the distorted clean image into the adversarial perturbation generator at this time to obtain the corresponding adversarial image; (5) Input the clean image and all adversarial images into the pre-trained image model, obtain the intermediate features, and calculate the feature destruction loss and temporal consistency loss; (6) Simultaneously optimize the feature destruction loss and temporal consistency loss to update the parameters of the perturbation generator; (7) Execute process steps (1) to (6) again until the specified number of rounds is reached; (8) In the inference phase of the perturbation generator, a single frame from a clean video clip is input to generate an adversarial frame; (9) All generated adversarial frames are reassembled into an adversarial video clip.

Images