A controllable lossy compression backdoor attack method based on prior knowledge

Abstract

The present invention discloses a controllable lossy compression backdoor attack method based on prior knowledge, which belongs to the field of deep learning security; the specific steps are: first, for each clean sample of the image input by the ML model, the respective cross entropy loss value information is recorded respectively, and the variance is obtained after the maximum value is removed to obtain the loss volatility of each clean sample as prior knowledge; then, a clean sample with a loss volatility ratio of 5%-50% is selected as a poisoned sample, and the color space conversion and chromaticity sampling are performed and then divided into 8×8 blocks, and DCT is performed on each block, and its coefficients are quantized; all quantized coefficients are compressed after reordering using the ZigZag method; the compressed poisoned sample is mixed with the clean sample as a data set for deep learning training to obtain a poisoned model; the poisoned model is predicted as a normal label on the clean sample, and predicted as a preset label on the compressed image, so as to achieve the purpose of backdoor attack. The present invention is flexible and not easy to be discovered.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning security, and specifically relates to a controllable lossy compression backdoor attack method based on prior knowledge. Background Art

[0002] Deep learning (DL) or machine learning (ML) models have been widely deployed in the past decade to replace humans in making decisions in critical tasks such as computer vision, natural language processing, and access control [1]. However, deployed ML systems have realistic security threats, where imperceptible poisoning of input samples may mislead ML models into making incorrect classifications [2].

[0003] Poisoning attacks mainly embed hidden triggers in the data set to implant backdoors into the original model, thereby manipulating the model's output. The earliest machine learning poisoning attack can be traced back to the signature generation designed by Newsome et al. [3] to mislead malware detection systems. The system implanted spam containing positive words during the training phase, which successfully misled the classification system, causing it to mistakenly classify valid emails as spam during the prediction phase.

[0004] Backdoor poisoning attacks are divided into visible triggers and invisible triggers: the difference between visible and invisible refers to the human eye rather than machine vision. It is generally defined as when two pictures are put together or a natural picture appears, the human eye cannot or is difficult to judge that there are obvious abnormal pixel blocks in the image. The existing research trend of triggers is mainly from visible triggers with the same pixel blocks to invisible triggers with sample-specific pixel blocks.

[0005] Gu et al. [2] proposed the classic BadNets method, which is the first backdoor attack. It reveals that outsourcing training may bring new security risks, that is, attackers can control the training process and create a malicious training model. The Blended method [4] is the first invisible attack method. The poisoning strategy studied in it can be applied in weak threat models, that is, the attacker may not know the model and dataset used by the victim, and the attacker only injects a small number of poisoned samples. Turner et al. [5] focused on the clean label problem in backdoor poisoning, and explored poisoning for only a single label based on the BadNets method.

[0006] Although the above visible triggers have good attack performance, they are easily detected by backdoors due to their visibility and are not concealed. In addition, the clean label attack proposed by Turner [5] has made great sacrifices in concealment while improving attack performance. The Refool method [6] proposed a model that uses reflection as a backdoor to implant a victim. This is the first concealed attack that is visible but triggered by nature.

[0007] References are as follows:

[0008] [1]Li Y, Jiang Y, Li Z, et a1. Backdoor learning: A survey[J]. IEEE Transactions on Neural Networks and Learning Systems, 2022.

[0009] [2]Gu T, Dolan-Gavitt B, Garg S. Badnets: Identifying vulnerabilities in the machine learning model supply chain[J]. arXiv preprint arXiv: 1708.06733, 2017.

[0010] [3]Newsome J, Karp B, Song D. Paragraph: Thwarting signature learning by training maliciously[C] / / Recent Advances in Intrusion Detection: 9thInternational Symposium, RAID 2006Hamburg, Germany, September 20-22, 2006Proceedings9.Springer Berlin Heidelberg, 2006: 81-105.

[0011] [4]Chen X, Liu C, Li B, et a1. Targeted backdoor attacks on deep learning systems using data poisoning[J]. arXiv preprint arXiv: 1712.05526, 2017.

[0012] [5]Turner A, Tsipras D, Madry A. Label-consistent backdoor attacks[J]. arXiv preprint arXiv: 1912.02771, 2019.

[0013] [6] Liu Y, Ma Summary of the invention

[0014] Based on the above problems, the present invention proposes a controllable lossy compression backdoor attack method based on prior knowledge. The loss value of each sample is obtained as prior knowledge by pre-training a clean model, and a backdoor of lossy compression is implanted into clean image samples based on the prior knowledge. Lossy compression is used as an image backdoor attack method, so that the model is trained on a poisoned data set, so that it can work normally on clean images and produce preset behaviors on images with triggers. The backdoor has the advantages that it will not interfere with the original task performance and can be accurately triggered, so that the model outputs according to the target set by the attacker, and a flexible and difficult to detect deep learning attack method is obtained.

[0015] The controllable lossy compression backdoor attack method based on prior knowledge is divided into the following steps:

[0016] Step 1: For each clean sample of the image input to the ML model, record the cross entropy loss value information of each clean sample during the training process, remove the maximum value and calculate the variance to obtain the loss volatility of each clean sample as prior knowledge.

[0017] The cross entropy loss value is:

[0018]

[0019] Where C represents the number of categories, p i is the true probability of the i-th class, q i is the predicted probability of the i-th class.

[0020] The variance of the kth sample is:

[0021]

[0022] The loss value data of the training process is l1, l2, l3…l n ; n is the number of loss values; μ is the average of the loss values;

[0023] Step 2: Based on prior knowledge, clean samples with a loss fluctuation ratio of 5%-50% are selected as poisoned samples. Color space conversion is performed on each poisoned sample, the original image is converted from RGB color space to YCbCr color space, and chromaticity sampling is performed on Cb and Cr.

[0024] For three-dimensional channel RGB, convert the RGB value range from [0, 255] to [0, 1]:

[0025] R=R / 255 G=G / 255 B=B / 255

[0026] The Y, Cb, and Cr components are:

[0027] Y=0.299*R+0.587*G+0.114*B

[0028] Cb=(BY) / (2*(1-0.114))

[0029] Cr=(RY) / (2*(1-0.299))

[0030] Step 3: Divide each chroma sampled sample image into 8×8 blocks, and perform discrete cosine transform (DCT) on each block to convert the image information in each block from the spatial domain to the frequency domain.

[0031] According to the DCT II formula, calculate the coefficient X after DCT transformation of each block k :

[0032]

[0033] N is the number of pixels in all 8×8 blocks; x n is the pixel value of the nth point; k is the frequency index of the DCT transform, which ranges from 0 to N-1. Corresponding to the frequency coefficient of the output, k=0 represents the DC component (low-frequency information), and k=1 to N-1 represents the AC component (high-frequency information).

[0034] Step 4: For each block after DCT transformation, quantize its coefficients, use the quantization table to divide each 8×8 DCT matrix block item by item and round it up.

[0035] Standard brightness quantization table Q Y and chromaticity quantification table QC as follows:

[0036]

[0037] Step 5: reorder all quantization coefficients of all images using the ZigZag method, and compress the sorted data;

[0038] There are two compression methods:

[0039] The JPEG algorithm uses Huffman coding to compress data;

[0040] WebP uses arithmetic coding to compress data.

[0041] Step 6: Mix the compressed poisoned samples with the clean samples as a data set for deep learning training to obtain a poisoned model; the poisoned model predicts a normal label on the clean sample and a preset label on the compressed image, thereby achieving the purpose of the backdoor attack.

[0042] The advantages of the present invention are:

[0043] (1) The present invention provides a controllable lossy compression backdoor attack method based on prior knowledge, which uses prior knowledge to design a lossy compression backdoor, making the backdoor difficult to detect when not triggered. By carefully selecting and designing a lossy compression algorithm, the backdoor can be hidden very secretly in various image data sets, thereby increasing the success rate of the attack.

[0044] (2) The present invention provides a controllable lossy compression backdoor attack method based on prior knowledge, which allows the attacker to precisely control the backdoor. By applying prior knowledge, the attacker can determine the triggering conditions and effects of the backdoor, which enables the attacker to better control the behavior of the backdoor; for example, the selected compression quality determines the output result of the backdoor.

[0045] (3) The present invention provides a controllable lossy compression backdoor attack method based on prior knowledge. Since the lossy compression backdoor attack method based on prior knowledge is more sophisticated in design, its attack success rate is relatively high. By designing a backdoor for a specific application scenario and model, the attacker can effectively bypass the defense measures of the model, successfully trigger the backdoor and carry out the attack.

[0046] (4) The present invention provides a controllable lossy compression backdoor attack method based on prior knowledge, which can be applied to various types of deep learning models and data. Unlike some backdoor attack methods that rely on model structure or specific input data, the lossy compression backdoor attack based on prior knowledge can be flexibly applied to various application scenarios and data types, enhancing the applicability and scalability of the attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 This is a flow chart of a controllable lossy compression backdoor attack method based on prior knowledge of the present invention;

[0048] Figure 2 The figure is a flow chart of the backdoor attack based on the threat model assumption of the present invention.

[0049] Figure 3 The figure is a flow chart of the lossy compression of an image according to the present invention.

[0050] Figure 4 is the loss fluctuation of different samples of the present invention;

[0051] Figure 5 The training loss and accuracy of clean label attack when the lossy compression quality of the present invention is 75;

[0052] Figure 6 The attack performance of the lossy compression method under different poisoning rates of the present invention;

[0053] Figure 7 The clean label attack performance of the present invention is based on prior knowledge. DETAILED DESCRIPTION

[0054] The following is a detailed and clear description of the implementation of the present invention in conjunction with the accompanying drawings and specific examples.

[0055] The present invention relates to clean label attacks in backdoor attacks and backdoor implantation of controllable invisible triggers, and specifically to an image backdoor implantation poisoning method based on controllable lossy compression. When the method is applied to clean label attacks, under the condition of prior knowledge of model loss fluctuations, a higher backdoor attack success rate can be achieved by poisoning only a small number of samples with the same label.

[0056] This application adopts the same threat model as previous research, that is, the attack occurs when using a third-party dataset or is allowed to perform data preprocessing operations. When the user uses a poisonous dataset to train the model, the training will implicitly perform the subtasks set by the attacker, that is, it works normally on clean images, and produces preset behaviors on images with triggers. In addition, a successful attack behavior should be ensured to be covert and effective. Concealment means that the backdoor trigger can avoid manual or algorithmic program screening. More importantly, it is necessary to ensure that the model behaves normally on benign samples and that the backdoor does not interfere with the original task performance. Effectiveness means that the backdoor can be accurately triggered and the model outputs according to the goals set by the attacker.

[0057] Compared with previous studies, the present invention is devoted to studying an unintentional backdoor method, which meets some basic requirements: 1) As a backdoor attack method, it needs to ensure sufficiently high attack performance and be threatening to deep learning models, while not interfering with the classification performance of the original task as much as possible; 2) The backdoor image is highly concealed, which not only indicates that the image with the implanted trigger is indistinguishable from the original image by the naked eye, but also that the backdoor implantation process is unintentional; 3) The backdoor attack on the clean label needs to maintain a certain performance, that is, it is also threatening when the target label of the backdoor sample cannot be changed.

[0058] The controllable lossy compression backdoor attack method based on prior knowledge is as follows: Figure 1 As shown, the following steps are taken:

[0059] Step 1: For each clean sample of the image input to the ML model, record the cross entropy loss value information of each clean sample during the training process, remove the maximum value and calculate the variance to obtain the loss volatility of each clean sample as prior knowledge.

[0060] For a sample, if it can be easily correctly classified, then this sample is a simple sample for the model, and it is difficult for the model to obtain more information from this sample. From the perspective of loss, the loss fluctuation generated by this sample is smaller. For a misclassified sample, the loss fluctuation information it generates will be richer and can better guide the direction of model optimization. Therefore, using this prior information, only by poisoning part of the sample model, the sample characteristics of lossy compression containing triggers can be learned, thereby achieving a very high attack success rate.

[0061] Pre-training the model can obtain the cross entropy loss value of each sample from each iteration. The loss fluctuation curve of each sample after multiple iterations indicates the change in the learning difficulty of the model in the sample. After removing the abnormal loss value (the largest loss value), the variance v is used to represent the volatility of the curve. All samples are sorted by the v value, and larger values ​​are defined as difficult-to-learn samples, and are used as poisoned samples. The model is more likely to learn information about lossy compression of images.

[0062] The cross entropy loss value is:

[0063]

[0064] Where C represents the number of categories, p i is the true probability of the i-th class, q i is the predicted probability of the i-th class.

[0065] The variance of the kth sample is:

[0066]

[0067] The loss value data of the training process is l1, l2, l3…l n ; n is the number of loss values; μ is the average of the loss values;

[0068] Step 2: Based on prior knowledge, clean samples with a loss fluctuation ratio of 5%-50% in a single label are selected as poisoned samples. Color space conversion is performed on each poisoned sample. The original image is converted from RGB color space to YCbCr color space, and chroma sampling is performed on Cb and Cr. This is the first lossy compression process.

[0069] For three-dimensional channel RGB, convert the RGB value range from [0, 255] to [0, 1]:

[0070] R=R / 255 G=G / 255 B=B / 255

[0071] The Y, Cb, and Cr components are:

[0072] Y=0.299*R+0.587*G+0.114*B

[0073] Cb=(BY) / (2*(1-0.114))

[0074] Cr=(RY) / (2*(1-0.299))

[0075] Step 3: Divide each chroma sampled sample image into 8×8 blocks, and perform discrete cosine transform (DCT) on each block to convert the image information in each block from the spatial domain to the frequency domain.

[0076] like Figure 3 As shown, the WebP compression method performs additional intra-frame prediction before DCT transformation, which becomes a lossy process.

[0077] According to the DCT II formula, calculate the coefficient X after DCT transformation of each block k :

[0078]

[0079] N is the number of pixels in all 8×8 blocks; x n is the pixel value of the nth point; k is the frequency index of the DCT transform, which ranges from 0 to N-1. Corresponding to the frequency coefficient of the output, k=0 represents the DC component (low-frequency information), and k=1 to N-1 represents the AC component (high-frequency information).

[0080] Step 4: For each block after DCT transformation, quantize its coefficients, use the quantization table to divide each 8×8 DCT matrix block item by item and round it up.

[0081] The quantization process reduces the high frequency components, thus reducing the amount of data. For any compression method, the quantization process is the key to controlling the compression quality and also the key to generating triggers.

[0082] Standard brightness quantization table Q Y and chromaticity quantification table Q C as follows:

[0083]

[0084] Step 5: reorder all quantization coefficients of all images using the ZigZag method, and compress the sorted data;

[0085] This step chooses to reorder the quantization coefficients. The JPEG algorithm uses the ZigZag arrangement method to transform the two-dimensional array into a one-dimensional array and then uses Huffman coding to compress the data. WebP uses arithmetic coding to compress the data.

[0086] Step 6: Mix the compressed poisoned samples with the clean samples as a data set for standard deep learning training. Without changing the training process, the model training is carried out to obtain the poisoned model. The poisoned model predicts a normal label on the clean sample and a preset label on the compressed image, thereby achieving the purpose of the backdoor attack.

[0087] The present invention adopts a technical means of backdoor implantation for lossy compression of clean image samples, such as Figure 2 As shown, the loss value of each sample in each training stage is obtained by pre-training a clean model, and a clean image of a specific ratio is compressed with loss based on the JPEG or WebP method, the target label is modified or a clean label attack is performed based on prior knowledge, and the obtained backdoor image is mixed into the uncompressed clean image dataset, so that the model is trained on the poisoned dataset, so that the model can learn the backdoor, that is, the image features after lossy compression. When predicting, the image that has not undergone lossy compression is predicted as the label corresponding to the image itself, and the image that has undergone lossy compression is predicted as the poisoned label. It has the advantages of non-intentional backdoor implantation, concealment, and extremely high attack performance, and bypasses the security mechanism of the model, manipulates the behavior of the model, and can spread between systems through the backdoor, causing widespread impact.

[0088] Example:

[0089] This embodiment uses a simple and easily overlooked backdoor generator to perform lossy compression on some images in the data set. The processed images have no obvious noise compared to the original images, and the compression process is adjustable and concealed by the compression quality control.

[0090] This example runs on a Linux server with a processor i7-8700k, a memory size of 48g, and a graphics card 1080ti (12g). Python is used as the programming language for deep learning models and data preprocessing, and the deep learning framework PyTorch is used as a tool for model construction and partial data preprocessing operations. In terms of image processing, Numpy, Pillow, and OpenCV-Python are used as image operation libraries.

[0091] The specific steps are as follows:

[0092] Step 1: Based on the assumption of obtaining prior knowledge of loss fluctuations, the model is first trained in a benign manner, that is, the model is trained without any backdoor implantation and label modification behavior, and the cross entropy loss value of all training samples in each iteration is recorded;

[0093] like Figure 4 As shown, Figure 4 (1) As shown in the figure, compared with sample 2, sample 1 has a larger loss fluctuation, but both samples will eventually converge during the iteration process, indicating that different samples have different learning difficulties, and the loss fluctuation of the model with greater fluctuation is greater. Figure 4 (2) The figure shows the fluctuation of all sorted samples. Not all samples have the same loss fluctuation, that is, some samples are more difficult to learn. Since samples with larger loss fluctuations have larger corresponding variances, after sorting them, 10% of all samples with larger fluctuation values ​​are marked with light-colored dots. The poisoned samples are samples with large fluctuations.

[0094] For a data set containing n loss values ​​in all training stages, assuming that the data is l1, l2, l3...l n ,

[0095] Calculate the mean μ of the loss

[0096] μ=(l1+l2+l3+...+l n ) / n

[0097] Therefore, the variance of the kth sample is

[0098]

[0099] Step 2: Convert the poisoned sample image from RGB color space to YCbCr color space.

[0100] YCbCr is based on three components of color: brightness (Y), blue color difference (Cb) and red color difference (Cr). Because the human eye is more sensitive to brightness and less sensitive to chrominance, the YCbCr color space can handle brightness and chrominance separately.

[0101] Step 3: Divide the image into 8×8 blocks and sample the chroma channels of the image to reduce the size of the stored data.

[0102] A common sampling method is 4:2:0 subsampling: in each block, two pixels in each row and two pixels in each column are sampled. This sampling method will reduce more chrominance information and will have a certain impact on the quality of the image. A discrete cosine transform (DCT) is performed on each block. The purpose of this step is to convert the image information in each block from the spatial domain to the frequency domain.

[0103] Step 4: For each block after DCT transformation, quantize its coefficients.

[0104] The quantization process reduces the high-frequency components, thus reducing the amount of data;

[0105] In lossy compression, two standard quantization matrices are defined: the luminance quantization matrix Q Y and the chromaticity quantization matrix Q C .

[0106] The brightness quantization matrix is ​​mainly used to process the brightness component, while the chrominance quantization matrix is ​​used to process the chrominance component. The coefficient values ​​of these two quantization matrices are usually between 1 and 255. Generally speaking, the smaller the coefficient, the more high-frequency components are retained, and the higher the image quality, but it will also increase the file size.

[0107]

[0108] Where k is the brightness matrix block and the chrominance matrix block;

[0109] Step 5: Reorder the quantized coefficients and compress them using differential coding (DPCM) and entropy coding (usually Huffman coding).

[0110] The encoding process makes full use of the local similarity characteristics in the image.

[0111] Step 6: Mix the poisoned samples and the poisoned samples obtained in the above steps as a data set for standard deep learning training. Without changing the training process, the model training is involved and the poisoned model is obtained.

[0112] The results show that:

[0113] The CIFAR-10 dataset is applied and the poisoning rate is set to 50% (50% of the number of poisoned target labels). For the CIFAR-10 dataset, the experimental setting section sets the poisoning rate to 5%, i.e., 2,500 poisoned samples, so for a single label, a 50% poisoning rate is still 2,500 samples. This experiment uses the benign accuracy (BA) to represent the performance of the clean model and the poisoned model on the clean samples. Without using GAN and adversarial samples, the poisoning success rate is shown in Table 5:

[0114] Table 5 Performance of clean label attack under different compression parameters

[0115]

[0116] like Figure 5 As shown in the figure, when the poisoning rate is 50%, the original training task is not disturbed by the backdoor training, and compared with the random sample label training, the model has a larger loss fluctuation, but it can eventually converge to a higher attack success rate, indicating that the invisible triggers generated by lossy compression based on clean labels are extremely threatening.

[0117] In order to demonstrate the superiority of the proposed clean label attack based on prior knowledge, this example tests its performance under different poisoning rates, where the poisoning rate refers to the poisoning percentage of a single label. Figure 6 As shown, in the initial stage, the attack success rate increases significantly with the increase of poisoning rate. After the poisoning rate reaches 50%, the actual attack success rate does not increase significantly.

[0118] like Figure 7 As shown in the figure, when selecting samples with higher volatility as poisoned samples, only about 0.5% of the correct rate of benign samples is sacrificed. Even at a lower poisoning rate, a higher poisoning success rate can be achieved and a higher attack success rate can be maintained. This shows that the backdoor attack method based on loss fluctuation proposed by this method has advanced attack performance.

Claims

1. A controllable lossy compression backdoor attack method based on prior knowledge, characterized in that: The following steps are taken: Step 1: For each clean sample of the image input to the ML model, record the cross entropy loss value information of each clean sample during the training process, remove the maximum value and calculate the variance to obtain the loss volatility of each clean sample as prior knowledge; The cross entropy loss value is: Where C represents the number of categories, p i is the true probability of the i-th class, q i is the predicted probability of the i-th category; The variance of the kth sample is: The loss value data of the training process is l1, l2, l3…l n ; n is the number of loss values; μ is the average of the loss values; Step 2: Based on prior knowledge, clean samples with a loss fluctuation ratio of 5%-50% are selected as poisoned samples. Each poisoned sample is converted into a color space, the original image is converted from the RGB color space to the YCbCr color space, and chromaticity sampling is performed on Cb and Cr. Step 3: Divide each sample image after chrominance sampling into 8×8 blocks, and perform discrete cosine transform DCT on each block to convert the image information in each block from the spatial domain to the frequency domain; According to the DCT II formula, calculate the coefficient X after DCT transformation of each block k : N is the number of pixels in all 8×8 blocks; x n is the pixel value of the nth point; k is the frequency index of the DCT transform, and its value range is an integer from 0 to N-1; corresponding to the frequency coefficient of the output, k=0 represents the DC component, and k=1 to N-1 represents the AC component; Step 4: For each block after DCT transformation, quantize its coefficients, use the quantization table to divide each 8×8 DCT matrix block item by item and round it up; Step 5: reorder all quantization coefficients of all images using the ZigZag method, and compress the sorted data; Step 6: Mix the compressed poisoned samples with the clean samples as a data set for deep learning training to obtain a poisoned model; the poisoned model predicts a normal label on the clean sample and a preset label on the compressed image, thereby achieving the purpose of the backdoor attack.

2. A controllable lossy compression backdoor attack method based on prior knowledge as claimed in claim 1, characterized in that: In the step 2, for the three-dimensional channel RGB, the range of the RGB value is converted from [0, 255] to [0, 1]: R=R / 255G=G / 255B=B / 255 The Y, Cb, and Cr components are: Y=0.299*R+0.587*G+0.114*B Cb=(BY) / (2*(1-0.114)) Cr=(RY) / (2*(1-0.299)) Y represents brightness, Cb represents blue color difference, and Cr represents red color difference.

3. A controllable lossy compression backdoor attack method based on prior knowledge as claimed in claim 1, characterized in that: In step 4, the standard brightness quantization table Q Y and chromaticity quantification table Q C as follows: Where X Y is the brightness matrix block, X C is the chroma matrix block.

4. A controllable lossy compression backdoor attack method based on prior knowledge as claimed in claim 1, characterized in that: In step 5, there are two compression methods: The JPEG algorithm uses Huffman coding to compress data; WebP uses arithmetic coding to compress data.

Images