A gradient-based model defense means detection method

Abstract

The application provides a gradient-based model defense means detection method, and belongs to the technical field of artificial intelligence confrontation attack and defense and deep learning models. The method comprises the following steps: taking an original sample as an initial detection sample; in the tth iteration, performing image processing defense on the current detection sample to generate a defense sample; after the image processing defense is completed, the gradient directions of the detection sample and the defense sample are calculated respectively, and the gradient of the detection sample is negated; the vector sum of the gradient of the detection sample and the gradient of the defense sample is calculated, the current detection sample is moved along the direction of the gradient, and the detection sample is output after iteration; the detection sample generated based on an adversarial defense algorithm is input into a model for generating the detection sample for prediction; and if the detection sample is classified incorrectly, it is considered that the model uses the above-mentioned adversarial defense algorithm. The method can quickly and accurately detect the defense algorithm.

Description

Technical Field

[0001] This invention relates to a gradient-based method for detecting model defense techniques, belonging to the fields of artificial intelligence adversarial attack and defense and deep learning model technology. Background Technology

[0002] In recent years, with the widespread application of deep learning technology in various fields, the vulnerability of deep learning models themselves has attracted widespread social attention, especially the problem of adversarial attacks.

[0003] Adversarial attacks refer to malicious actions that trick deep learning models into making small but carefully designed modifications to their inputs, leading to incorrect outputs. Adversarial defenses, on the other hand, aim to improve the model's robustness to such malicious inputs. Some malicious attackers may deliberately add small, often undetectable perturbations to deep learning models to deceive them, causing misclassification. Such adversarial attacks pose a serious threat to safety-critical fields using deep learning technologies, such as biometrics, medical diagnostics, and autonomous driving, and could potentially lead to severe consequences.

[0004] Currently, research in adversarial learning primarily focuses on designing more robust models, higher-performance attack algorithms, and defense algorithms. However, there has been a lack of systematic research on detecting defense algorithms applied to models. This research gap may further exacerbate the threat of adversarial attacks, thus necessitating expanded research to more comprehensively and systematically understand and address the security challenges faced by deep learning models. Therefore, this invention proposes a gradient-based method for detecting model defense mechanisms. This is the first defense detection method focused on defense algorithms applied to models, capable of quickly and accurately detecting defense algorithms in deep learning models employing adversarial defense mechanisms. This innovation brings a new perspective and methodology to adversarial learning research, providing researchers with a novel approach to more accurately evaluate the robustness of deep learning models. Summary of the Invention

[0005] The purpose of this invention is to address the current gap in the detection of defense algorithms for model applications in the field of adversarial learning, which leads to a further increase in the threat of adversarial attacks. This invention proposes a gradient-based method for detecting model defense mechanisms.

[0006] The core idea of ​​the gradient-based model defense detection method proposed in this invention is: based on a defense algorithm, a gradient-based defense detection algorithm is used to generate detection samples. These detection samples do not exhibit adversarial behavior, but only exhibit adversarial behavior after being processed by the aforementioned defense algorithm. This method can detect which defense algorithm the model uses.

[0007] The objective of this invention is achieved through the following technical solution.

[0008] A gradient-based model defense detection method includes: a gradient-based defense detection algorithm; and a detection algorithm for adversarial defenses using detection samples generated by the detection algorithm.

[0009] Gradient-based defense detection algorithms include the following steps:

[0010] Precondition: x represents a clean image. This represents an image processing defense algorithm. This represents the defense sample after the image processing defense algorithm performs defense processing on image x. Let y ∈ R be a test sample. m It is the true label of x.

[0011] S1: Use the original sample as the initial test sample. In the t-th iteration, the current detection sample Image processing defense to generate defense samples

[0012] S2: After image processing and defense are completed, calculate the gradient directions of the detection samples and the defense samples respectively, and invert the gradient of the detection samples:

[0013]

[0014]

[0015] Where J(x; y) represents the loss function for x with the true label y. This represents the gradient of x with respect to the loss function J(x; y);

[0016] S3: Calculate the vector sum of the gradient of the detected sample and the gradient of the defended sample, move the current detected sample along the direction of the gradient, and output the detected sample after the iteration is completed.

[0017] Step S3 specifically includes the following steps:

[0018] S3.1: Use G t-1 G represents the cumulative gradient (G) in the previous iteration. 0 =0), let sign(G) represent the sign of gradient G, let ε represent the maximum perturbation, let T represent the maximum number of iterations, and let α = ε / T represent the perturbation magnitude per iteration;

[0019] S3.2: When the gradients of the detection sample and the defense sample are obtained, the sum of their gradients is calculated and normalized using the L1 norm (the sum of the absolute values ​​of all elements in the pointer), and then accumulated with the gradient from the previous iteration.

[0020]

[0021] S3.3: Then, based on the perturbation magnitude α in each round, move the detection sample along the gradient direction:

[0022]

[0023] S3.4: Output the detection samples after completing T iterations.

[0024] The detection of adversarial defense algorithms using detection samples generated by detection algorithms includes the following steps:

[0025] S4: Feed the detection sample generated based on an adversarial defense algorithm into the model that generated the detection sample for prediction;

[0026] S5: If the detected sample is misclassified, it is assumed that the model has used the adversarial defense algorithm described in S4.

[0027] Beneficial effects

[0028] This invention proposes a gradient-based model defense detection method, the first defense detection method focusing on model application-specific defense algorithms. It can quickly and accurately detect defense algorithms, filling the current gap in the detection of model application-specific defense algorithms in adversarial learning and addressing the problem of escalating adversarial attack threats. This innovation brings a new perspective and methodology to adversarial learning research, providing researchers with a novel method to more accurately evaluate the robustness of deep learning models, making a significant contribution to adversarial robustness research. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a gradient-based model defense detection method. Detailed Implementation

[0030] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0031] Example

[0032] The dataset used in this embodiment is ImageNet (a dataset used for research in the field of computer vision); the model is AlexNet (a deep learning model for image classification); the defense algorithm used is JPEG; and the defense detection algorithm is a gradient-based defense detection algorithm.

[0033] like Figure 1 As shown, the gradient-based model defense detection method proposed in this invention includes the following steps:

[0034] Step 1: Select the ImageNet dataset and AlexNet model, and generate detection samples using a gradient-based defense detection algorithm based on the JPEG defense algorithm;

[0035] Step 2: Use the original sample as the initial test sample. In the t-th iteration, the current detected sample is processed into a defense sample using an image processing defense algorithm:

[0036] Step 3: After image processing and defense are completed, calculate the gradients of the detected samples and the defended samples, and invert the gradient of the detected samples:

[0037]

[0038]

[0039] Where J(x; y) represents the loss function for x with the true label y. This represents the gradient of x with respect to the loss function J(x; y);

[0040] Step 4: Use G t-1 G represents the cumulative gradient (G) in the previous iteration. 0 =0), let sign(G) represent the sign of gradient G, let ε represent the maximum perturbation, let T represent the maximum number of iterations, and let α = ε / T represent the perturbation magnitude per iteration;

[0041] Step 5: When the gradients of the detection sample and the defense sample are obtained, calculate the sum of their gradients and normalize it using the L1 norm (the sum of the absolute values ​​of all elements in the pointer), then accumulate it with the gradient from the previous iteration:

[0042]

[0043] Step 6: Based on the perturbation magnitude α in each round, move the detection sample along the gradient direction:

[0044]

[0045] Step 7: Output the test samples after completing T rounds of iterations.

[0046] Step 8: Place the test sample Input the data into the AlexNet model for prediction;

[0047] Step 9: If the AlexNet model classifies incorrectly, it is considered that the model has applied the JPEG defense algorithm.

[0048] This patent protects a gradient-based model defense detection method that can be applied to fields such as autonomous driving and biometrics. Existing technologies lack methods for detecting defenses against deep learning models. This method not only fills this gap but also detects model defenses quickly and accurately. This innovation brings a new perspective and approach to adversarial learning research, providing researchers with a novel method to more accurately assess the robustness of deep learning models, thus making a significant contribution to adversarial robustness research.

[0049] The above description is merely a preferred embodiment of the present invention, and the present invention should not be limited to the content disclosed in this embodiment and the accompanying drawings. Any equivalent or modified embodiments made without departing from the spirit of the present invention fall within the scope of protection of the present invention.

Claims

1. A gradient-based method for detecting model defense techniques, characterized in that, Specifically, the following steps are included: Prerequisites: This indicates a clean image. This represents an image processing defense algorithm. This indicates that the image processing defense algorithm is effective against images. The defense sample after the defense processing has been performed. This represents a test sample. yes The true label; S1: Use the original sample as the initial test sample. In the In each iteration, the current detected sample Image processing defense to generate defense samples : ; S2: After image processing and defense are completed, calculate the gradient directions of the detection samples and the defense samples respectively, and invert the gradient of the detection samples: in Indicates the true label is of loss function, express For loss function The gradient; S3: Calculate the vector sum of the gradient of the detected sample and the gradient of the defended sample, move the current detected sample along the direction of the gradient, and output the detected sample after the iteration is completed; S4: Feed the detection sample generated based on the image processing defense algorithm into the model that generated the detection sample for prediction; S5: If the detected sample is misclassified, it is assumed that the model has used the image processing defense algorithm described in step S4.

2. The gradient-based model defense detection method as described in claim 1, characterized in that, S3 specifically includes the following steps: S3.1: Use This represents the cumulative gradient in the previous iteration; where, ,use Gradient The symbol, using Indicates the maximum perturbation set, using Represents the maximum number of iteration rounds, using Indicates the magnitude of the disturbance in each round; S3.2: When the gradients of the detection sample and the defense sample are obtained, the sum of their gradients is calculated and normalized using the L1 norm; where the sum of the absolute values ​​of each element in the L1 norm pointer is accumulated with the gradient from the previous iteration: S3.3: Then, based on the size of the disturbance in each round... The detection sample is moved along the direction of the gradient: S3.4: Completed Output detection samples after round of iteration .

Images