A steganography and extraction method of lossless neural network model
By screening the partial derivatives of the neural network model parameters and embedding secret information through wet paper coding, the problem of task performance degradation in neural network steganography is solved, lossless steganography and wide applicability are achieved, and the security of steganography is improved.
Patent Information
- Application Number
- CN202410926541.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-11
- Publication Date
- 2025-10-10
- Estimated Expiration
- 2044-07-11
AI Technical Summary
Existing neural network steganography methods lead to degradation of original task performance during the information embedding process, affecting the security of covert communication.
By obtaining the partial derivatives of the neural network model parameters, setting the modification threshold to distinguish the parameters into modifiable and non-modifiable, using wet paper coding to embed secret information, and restoring the model parameters through binary conversion and dimensionality reduction processing, the original task performance is ensured to be unaffected.
It realizes lossless neural network model steganography, enhances steganography security, is applicable to different neural network architectures and data sets, and makes secret information transmission more covert.
Smart Images
Figure CN119011187B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of secret data transmission, in particular to a steganography method of lossless neural network model. BACKGROUND
[0002] Steganography aims to covert communication, which is achieved by hiding secret information in a carrier. In order to share core data and improve transmission efficiency, enterprises have the demand to transmit information in public channels, and direct transmission or encrypted transmission will be known by the third party that "secret communication" is being carried out, which is not secure enough. Steganography can cover up the behavior of "secret communication", which can better prevent data leakage. At the same time, covert communication is helpful to understand the development trend of politics, economy, military and network space, and thus to seize the dominant position in the network space.
[0003] According to the different carriers, steganography can be divided into image steganography, text steganography, video steganography, etc. The forms of carriers are various, but all of them hide secret information by modifying the carrier. The modification of the carrier will undoubtedly affect the security of covert communication, so the design of the steganography method usually embeds secret information in the case of minimizing the damage to the original carrier. In image steganography, the most advanced steganography methods are realized in the distortion minimization framework.
[0004] With the vigorous development of artificial intelligence, neural networks have become a new carrier, and neural network steganography methods have emerged as the times require. Neural networks are initially used as auxiliary tools in steganography, such as helping to design the embedding cost of pixels in image steganography to reduce the damage and distortion of the original image caused by steganography. Later, it developed into directly loading secret information as a carrier. Like other types of steganography methods, the embedding of information will cause the decline of the original model task performance (such as image classification), which is not conducive to covert communication. SUMMARY
[0005] The purpose of the present application is to overcome the defects of the prior art and provide a lossless neural network model steganography method.
[0006] The purpose of the present application can be achieved by the following technical solutions:
[0007] The present application provides a steganography method of lossless neural network model, comprising the following steps:
[0008] S1, obtaining the partial derivative of the neural network model parameter with respect to the loss function, setting a modification threshold, and dividing the neural network model parameters into modifiable parameters and unmodifiable parameters according to the size relationship between the partial derivative and the modification threshold;
[0009] S2, preprocessing process: the multi-dimensional neural network model parameters are reduced in dimension, and converted into one-dimensional vector form neural network model parameters; a decision threshold is set, and the one-dimensional vector form neural network model parameters are converted into a binary sequence through the decision threshold;
[0010] S3, embedding process: the binary sequence, secret information and pseudo-random parity check matrix are used to generate a binary sequence containing a secret through wet paper coding;
[0011] S4, the binary sequence containing the secret is restored to the normal neural network model parameter form through the inverse process of binary conversion and dimension reduction processing, and the original neural network model parameter is replaced to complete the original model task.
[0012] The partial derivative of the neural network model parameter with respect to the loss function is obtained through the gradient information.
[0013] The partial derivative is normalized, and the value range of the partial derivative is [0, 1].
[0014] According to the partial derivative, a COST vector is generated, if the partial derivative is greater than the modification threshold, the neural network model parameter corresponding to the partial derivative is set as a non-modifiable parameter through the COST vector; if the partial derivative is less than or equal to the modification threshold, the neural network model parameter corresponding to the partial derivative is set as a modifiable parameter through the COST vector.
[0015] The modifiable parameter is marked as 1, and the non-modifiable parameter is marked as infinity.
[0016] The value of the modifiable parameter greater than the decision threshold is set to 1, and the value of the modifiable parameter less than or equal to the decision threshold is set to 0, to obtain a binary sequence composed of 1 and 0.
[0017] The value of the modifiable parameter may change from 1 to 0 or from 0 to 1, or it may not be modified, and the non-modifiable parameter will not be modified in the embedding process.
[0018] The inverse process of binary conversion includes: for the unmodified parameters in the normal model parameter form, it is directly used; for the modified parameters, the modified amplitude method is set to make the restored parameter value close to the original parameter value; the modified amplitude method includes: if the parameter containing the secret is 0, it is modified to the decision threshold, and if the parameter containing the secret is 1, it is modified to a value greater than the decision threshold and within a certain range.
[0019] In a second aspect, the present application provides a steganography extraction method based on a lossless neural network model, which is applied to the steganography method of the lossless neural network model.
[0020] Compared with the prior art, the present application has the following beneficial effects:
[0021] 1. The present application solves the problem of performance decline of the original task caused by information embedding in neural network model steganography, and the transmission of secret information is more covert, significantly enhancing the security of steganography.
[0022] 2. The method provided by the present application can use different neural network model parameter partial derivatives for normalization, and can use different neural network models as carriers, has a wide range of applications, is suitable for models trained for different neural network architectures and data sets, and has improved performance in all aspects, and the two parties of secret information transmission can select different neural network carriers according to different scenes. BRIEF DESCRIPTION OF DRAWINGS
[0023] Figure 1 is a structural diagram of the method of the present application;
[0024] Figure 2 is a flowchart of the information embedding and extraction process of the present application;
[0025] Figure 3 is a comparison chart of the influence of modification threshold value change on accuracy rate under different models or different capacities of the present application;
[0026] Figure 4 is a chart of the change of accuracy rate of the AlexNet model on different data sets with the change of the modification threshold value;
[0027] Figure 5 is a chart of the change of accuracy rate of the VGGt model on different data sets with the change of the modification threshold value;
[0028] Figure 6 is a chart of the change of accuracy rate of the GoogLeNet model on different data sets with the change of the modification threshold value;
[0029] Figure 7 is a chart of the change of accuracy rate of the ResNet model on different data sets with the change of the modification threshold value;
[0030] Figure 8 is a chart of the change of accuracy rate of different models and data sets with the change of the decision threshold value;
[0031] Figure 9 are the accuracy variation with embedding capacity for different models and datasets;
[0032] Figure 10 are the probability density estimation of model parameters before and after embedding for different models and datasets. DETAILED DESCRIPTION
[0033] The present application will be described in detail below with reference to the drawings and specific embodiments. The embodiments are implemented on the premise of the technical solution of the present application, and give detailed implementation and specific operation process, but the protection scope of the present application is not limited to the following embodiments.
[0034] EMBODIMENT
[0035] The present embodiment provides a steganography method for lossless neural network model. The implementation of the method mainly includes two steps: one is to select suitable model parameters to load confidential information, and the other is to use wet paper coding to complete information embedding and extraction. As shown in Figure 1 and Figure 2 The parameter selection process is realized by comparing the partial derivative of each model parameter, and since most neural network models use gradient descent method for training, the partial derivative size can reflect the influence degree of the change of model parameters on the original model performance. The parameters with greater influence on the model performance are set as unmodifiable, and only the parameters with smaller partial derivative are modified, and at the same time, a suitable modification amplitude is set to complete the embedding of secret information by using wet paper coding, so as to realize lossless model steganography and ensure that the original task performance of the neural network model is not affected.
[0036] The sender first performs parameter selection, selects the parameters with small partial derivative to load confidential information by obtaining the partial derivative of each model parameter relative to the loss function. The smaller the partial derivative is, the smaller the correlation between the parameter and the model performance is, and the modification of the parameter has little influence on the original task performance. In the embedding process, the parameters with large partial derivative are set as unmodifiable, and this process is consistent with wet paper coding, so the embedding of secret information is realized by wet paper coding, and the receiver can extract the secret information without knowing the modification position. Since the parameters with large correlation to the original task performance are not modified, and the modification degree of the parameters with small correlation can be limited by setting the modification amplitude, the original task performance is not affected.
[0037] In the present embodiment, the sender uses classical convolutional neural network (AlexNet, VGG16, GoogLeNet, ResNet) as a carrier, trains on two datasets MNIST and CIFAR10 respectively, obtains eight neural network models, and uses them to load secret information. The embedding of information is realized by wet paper coding, and the receiver can completely extract the secret information from the model containing secret information without knowing the specific modification position of the model parameters.
[0038] As Figure 2 shown in the embodiment, the specific steps are as follows:
[0039] 1. Save the model gradient information when the training is completed, obtain the partial derivative of each model parameter with respect to the loss function, and use it to screen out the model parameters that have the least impact on the original model task performance, and load the secret information, as shown in the "parameter screening" step in Figure 1 .
[0040] Since the gradient descent method is used to update the model parameters during training, taking the stochastic gradient descent (SGD) method as an example, the model parameter θ (θ includes weights and biases) in each iteration is calculated by formula (1), where η is the learning rate, x (i) is the training sample, y (i) is the label, is the gradient information of the loss function J(θ), which is calculated by the partial derivative of all parameters, as shown in formula (2). Therefore, the partial derivative information of each model parameter can be obtained through the gradient information.
[0041] Set a modification threshold, and divide the neural network model parameters into modifiable parameters and unmodifiable parameters according to the size relationship between the partial derivative and the modification threshold. Specifically, a COST vector is generated according to the partial derivative information obtained by parameter screening, defined as formula (9), which is used to mark modifiable parameters and unmodifiable parameters (modification and unmodifiable refer to whether they can be modified during the secret embedding process. During the preprocessing process, they can all be modified), the purpose is to let the computer in the wet paper coding identify which parameters can be modified, where the elements are one-to-one corresponding to X B . First, normalize the partial derivative of each model parameter, with a value range of [0, 1], greater than the modification threshold t v is unmodifiable, and less than t1 is modifiable. The COST vector sets the modifiable part of the binary sequence to 1 and the unmodifiable part to infinity, as shown in formula (9). Here, 1 and infinity are only used for identification by the computing device.
[0042] The sender sets the model parameters with large partial derivatives as unmodifiable before embedding information, to ensure that the original model task performance is not affected.
[0043]
[0044] 2. After parameter screening, the sender can use wet paper coding to embed information, as shown in Figure 1 " Wet paper coding". The principle of wet paper coding is to divide the binary carrier unit into modifiable and unmodifiable parts. The sender and the receiver agree on a pseudo-random parity check matrix A k×p in advance, defined as formula (3). The sender embeds k-bit secret information M = (m1, m2, …, mk) into the modifiable part of the binary carrier unit, and the unmodifiable part is used to correct errors, as shown in formula (4).k ) T Embedding X B After that, the receiver can extract the secret information by the pseudo-random parity check matrix and the secret carrier, as shown in equation (4). In this embodiment, a modification threshold t1 is set to distinguish between modifiable parameters and non-modifiable parameters. Since the model parameters are not binary carrier units that can be directly used for wet paper encoding, they also need to be processed by dimension reduction and binary conversion. Dimension reduction and binary conversion belong to the preprocessing process.
[0045]
[0046] M = A k×p · X B (4)
[0047] 3. Dimension reduction processing: the original model parameter X is defined as equation (5), where X n is a high-dimensional matrix with the same dimension as the tensor in the neural network, as shown in equation (6), p is the total number of parameter values from X1 to X n . In order to adapt to encoding, X needs to be converted into a vector form, that is, by reshape or other methods to convert the high-dimensional X n into a p × 1 vector to obtain X', which is defined as equation (7).
[0048] X = (X1, X2, …, X n ) T (5)
[0049]
[0050] X' = (x1, x2, …, x p ) T (7)
[0051] 4. Binary conversion: after obtaining X', it also needs to be converted into a binary sequence. Since the value of x p is any real number, a rule needs to be set to map its value space to {0, 1}, that is, X': X B → {0, 1}. The specific measure is to set a decision threshold t2, and in X', the value greater than t2 is set to 1, and the value less than or equal to t2 is set to 0, as shown in equation (8). In this way, the processing of the model parameters is completed, and they are converted into a binary sequence that can be used for wet paper encoding.
[0052]
[0053] 5. The specific measures of the embedding process are as follows Figure 2As shown, the model parameters are converted into a binary sequence by dimension reduction and binary conversion. The parameter values of the modifiable part set to 1 include 0 and 1. The parameters marked as unmodifiable will not be modified in the embedding process, and the modifiable parameters can or can not be modified from 1 to 0 or from 0 to 1. The wet paper code is recovered according to the binary sequence X B , secret information m, and pseudo-random parity check matrix A k×p to generate a binary sequence containing secrets As shown in equation (10). After information embedding is completed, the binary sequence containing secrets needs to be restored to the normal model parameter form, replacing the original model parameters to complete the original task of the model.
[0054] The recovery process includes numerical recovery and dimension recovery, which are the inverse processes of binary conversion and dimension reduction, respectively. When numerical recovery is performed, for the unmodified part of the model parameters, it is directly equal to the original model parameters. For the modified parameters, if the value is 0 in the binary sequence containing secrets, it is equal to the decision threshold t2; if the value is 1, it takes a value greater than t2 and infinitely close to t2, such as t2+(1e-10). This value setting method is to set the modification range, so that the recovered secret-containing parameter value is as close as possible to the original parameter value, ensuring the original task performance. Dimension recovery is to convert the secret-containing sequence to the same dimension as the original model parameters X stego , defined as equation (11), X stegon is a matrix with the same dimension as X n but different numerical values.
[0055]
[0056] X stego =(X stego1 ,X stego2 ,…,X stegon ) T (11)
[0057] 6、The extraction process is shown in Figure 2 , the receiver receives the secret-containing model transmitted by the sender, extracts the secret-containing model parameters X stego , and obtains by dimension reduction and binary conversion. k×p After calculation, the secret information can be extracted, as shown in equation (12).
[0058] The extraction error is defined as equation (13), which is the difference between the true information M and the extracted information M'. The extraction error of 0 indicates that the information is extracted completely and accurately.
[0059]
[0060] To verify the effectiveness of the method provided by this embodiment, experiments were conducted to demonstrate the secret information embedding capacity of different network models. The undetectability of the steganographic image was then tested.
[0061] (1) The neural networks AlexNet, VGG16, GoogLeNet, and ResNet are trained on the MNIST and CIFAR10 datasets, respectively, to obtain eight neural network models. During the training process, the last round of gradient information is saved for parameter selection.
[0062] (2) The experimental environment was built with PyTorch and trained on a single NVIDIA GeForce RTX 3090 GPU running on a Linux CentOS 7.9 system. The wet paper coding was implemented on Matlab 2016a on a Windows 10 system.
[0063] (3) Determine the modification threshold t1 and the decision threshold t2. These two parameters are crucial in the embedding process. Generally speaking, the more secret information is embedded, the greater the degradation of the original task performance. Adjusting these parameters can adjust the relationship between the embedding capacity and the degradation of the original task performance. Figure 3 As can be seen, for different models with the same capacity, the impact of modifying the threshold on the original task performance varies significantly; for the same model with different capacities, modifying the threshold has the same impact on the original task performance. Therefore, different models should use different parameter values. Figures 4-7 The performance degradation of the original task of eight models under different modification thresholds is shown respectively. The modification threshold with the smallest degradation is selected as the optimal modification threshold of the model. The eight models are in the order of AlexNet-MNIST, AlexNet-CIFAR10, VGG-MNIST, VGG-CIFAR10, GoogLeNet-MNIST, GoogLeNet-CIFAR10, ResNet-MNIST, and ResNet-CIFAR10. The modification threshold values are 0.1, 0, 0, 0, 0, 0.05, 0, and 0 respectively. Similarly, Figure 8 When the modification threshold has been determined, the one with the smallest impact on the original task performance at different decision thresholds is selected as the optimal decision threshold of the model. That is, the decision threshold values with the highest accuracy in the figure are 0, 0, 0.001, 0, 0.05, 0.001, 0, and 0.01 respectively.
[0064] (4) Based on the parameters selected in the above experiments, this example will demonstrate the application results of this method under different models, that is, how many bits of secret information can be successfully embedded without affecting the performance of the original task. Figure 9As shown, the maximum capacity of eight models to embed secret information is 0.6M, 0.08M, 3.25M, 0.075M, 0.9M, 0.025M, 0.09M, and 0.015M bits respectively under the condition that the original task accuracy of the model does not decrease.
[0065] (5) The undetectability of the method of the embodiment is verified from two aspects of KL divergence and probability density function (PDF). The KL divergence is defined as formula (14) and reflects the difference between two probability distributions. The greater the KL divergence, the greater the difference, and vice versa. The probability density function describes the probability density distribution of a variable. If the probability density functions of two variables are the same or similar, it means that the statistical characteristics of the two variables are the same or similar. The purpose of neural network steganography is to hide communication, so the original model parameters and the model parameters containing secrets should be as similar as possible to ensure the security of steganography. In the method of the embodiment, the KL divergence of the original model parameters and the model parameters containing secrets of different models at the maximum embedding capacity is 0.1067, 0.0101, 0.0231, 0.0019, 0.0193, 0.0018, 0.0095, and 0.0001 respectively. The PDF curve is as shown in Figure 10 As shown, the distribution of the original parameters and the parameters containing secrets of each model is almost the same, indicating that the security performance of the method of the embodiment is strong.
[0066]
[0067] The preferred embodiments of the application are described in detail above. It should be understood that those skilled in the art can make many modifications and changes without creative labor based on the concept of the application. Therefore, any technical solution obtained by logical analysis, reasoning or limited experiment based on the existing technology according to the concept of the application should be within the protection scope determined by the claims.
Claims
1. A steganographic method for a lossless neural network model, characterized in that: The following steps are involved: S1. Obtain the partial derivatives of the neural network model parameters relative to the loss function, set a modification threshold, and divide the neural network model parameters into modifiable parameters and non-modifiable parameters based on the relationship between the partial derivatives and the modification threshold; S2, preprocessing process: reduce the dimension of the multi-dimensional neural network model parameters and convert them into one-dimensional vector neural network model parameters; set the decision threshold and convert the one-dimensional vector neural network model parameters into a binary sequence through the decision threshold; S3, embedding process: using wet paper coding to generate a secret binary sequence from a binary sequence, secret information, and a pseudo-random parity check matrix; S4. Through the inverse process of binary conversion and dimensionality reduction, the secret binary sequence is restored to the normal neural network model parameter form, replacing the original neural network model parameters to complete the original task of the model.
2. The steganographic method of a lossless neural network model according to claim 1, characterized in that: The partial derivatives of the neural network model parameters relative to the loss function are obtained through gradient information.
3. The steganographic method of a lossless neural network model according to claim 1, characterized in that: Normalize the partial derivatives so that the value range of the partial derivatives is [0,1].
4. The steganographic method of a lossless neural network model according to claim 1, characterized in that: A COST vector is generated according to the partial derivative. If the partial derivative is greater than the modification threshold, the neural network model parameters corresponding to the partial derivative are set as unmodifiable parameters through the COST vector; if the partial derivative is less than or equal to the partial derivative of the modification threshold, the neural network model parameters corresponding to the partial derivative are set as modifiable parameters through the COST vector.
5. The steganographic method of a lossless neural network model according to claim 4, characterized in that: Mark modifiable parameters as 1 and non-modifiable parameters as infinity.
6. The steganographic method of a lossless neural network model according to claim 1, characterized in that: The values of the neural network model parameters in the form of one-dimensional vectors greater than the decision threshold are set to 1, and the values of the neural network model parameters in the form of one-dimensional vectors less than or equal to the decision threshold are set to 0, thereby obtaining a binary sequence consisting of 1 and 0.
7. The steganographic method of a lossless neural network model according to claim 6, characterized in that: The value of a modifiable parameter may change from 1 to 0 or from 0 to 1, or it may not be modified. The value of an unmodifiable parameter will not be modified during the embedding process.
8. The steganographic method of a lossless neural network model according to claim 1, characterized in that: The inverse process of binary conversion includes: directly using the unmodified parameters in the normal model parameter form; and setting the modification amplitude method for the modified parameters so that the restored encrypted parameter values are close to the original parameter values.
9. The steganographic method of a lossless neural network model according to claim 8, characterized in that: The modification amplitude method includes: if the confidentiality parameter is 0, modifying it to a decision threshold; if the confidentiality parameter is 1, modifying it to a value greater than the decision threshold and within a set range.
10. A steganographic extraction method based on a lossless neural network model, characterized in that: The extraction method is applied to the steganography method of the lossless neural network model described in any one of claims 1-8. First, after the receiver receives the secret model transmitted by the sender, the secret model parameters are extracted, and then the secret binary sequence is obtained through dimensionality reduction and binary conversion. After the secret binary sequence is calculated with the pseudo-random parity check matrix, the secret information is extracted.