Counter-defense method and device for multi-modal large model

Abstract

The invention provides a multi-modal large model confrontation and defense method and device, and the method comprises the steps: obtaining to-be-detected initial multi-modal data; judging whether the initial multi-modal data is malicious data or not by adopting a pre-trained detection model; if the initial multi-modal data is malicious data, a pre-trained recovery model is adopted to recover the malicious data into target multi-modal data, and the recovery model is used for recovering the malicious data into normal data; and inputting the target multi-modal data into a multi-modal large model to obtain an output result. According to the embodiment of the invention, the pre-trained detection model and the pre-trained recovery model are adopted, the detection and recovery of the adversarial attack of the input data of the multi-modal large model are realized, the robustness of the model is enhanced, the brought time consumption is reduced as much as possible, and the safety and the accuracy of the output result of the multi-modal large model are ensured.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a multi-modal large model confrontation defense method and device. Background Art

[0002] Among the related technologies, large language models (LLMs) have made significant progress. By expanding the data size and model size, the emergence capabilities of LLMs have been improved, such as in-context learning (ICL), instruction following, and chain-of-thought (CoT). Although LLMs have demonstrated zero-shot or few-shot reasoning performance in most natural language processing (NLP) tasks, they are inherently "blind" to vision because they can only understand discrete text. At the same time, large visual-based models have made rapid progress in perception, and traditional combinations with text focus more on modal alignment and task unification, and have developed slowly in reasoning. Given this complementarity, unimodal LLMs and visual models are running towards each other at the same time, ultimately bringing about the new field of multimodal large language models (MLLMs).

[0003] Although multimodal large models have many advantages, such as they can process and understand data in multiple modes, such as images, audio, text, etc. However, with the development and application of multimodal large models, many problems have also emerged, and security is one of the important issues. The security of multimodal large models mainly includes the following aspects: Model security: Multimodal large models themselves may also have security vulnerabilities, such as adversarial attacks, data poisoning, etc. Attackers can maliciously attack the model, causing the output of the model to be inaccurate or unsafe; Application security: Multimodal large models can be applied to various fields, such as medical care, finance, transportation, etc. In these application scenarios, the output of the model may have a direct impact on the safety of people's lives and property.

[0004] With respect to the above-mentioned problems existing in the related technologies, no efficient and accurate solutions have been found yet. Summary of the invention

[0005] The present invention provides a multi-modal large model confrontation defense method and device to solve the technical problems in the related art.

[0006] According to one embodiment of the present invention, there is provided an adversarial defense method for a multimodal large model, comprising: obtaining initial multimodal data to be detected; using a pre-trained detection model to determine whether the initial multimodal data is malicious data; if the initial multimodal data is malicious data, using a pre-trained recovery model to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data; and inputting the target multimodal data into the multimodal large model to obtain an output result.

[0007] Optionally, before using a pre-trained detection model to determine whether the initial multimodal data is malicious data, the method also includes: constructing a multimodal defense dataset; using the multimodal defense dataset to train an adversarial sample detector to obtain the detection model, and using the multimodal defense dataset to train an adversarial sample restorer to obtain the recovery model.

[0008] Optionally, constructing a multimodal defense dataset includes: constructing an initial multimodal dataset, wherein the initial multimodal dataset includes multiple groups of multimodal data, each group of multimodal data includes sample data of at least two modalities; performing data enhancement on the initial multimodal dataset to obtain an extended multimodal dataset; and using the extended multimodal dataset to generate a multimodal defense dataset, wherein the multimodal defense dataset includes multiple groups of adversarial defense data, each group of adversarial defense data includes positive samples and negative samples.

[0009] Optionally, using the extended multimodal dataset to generate a multimodal defense dataset includes: selecting an initial multimodal large model; for each group of multimodal data in the extended multimodal dataset, normally inputting the multimodal data into the initial multimodal large model to obtain first output data of normal output, and attack-injecting the multimodal data into the initial multimodal large model to obtain second output data of malicious output; configuring the first output data as a positive sample of the multimodal data, and configuring the second output data as a negative sample of the multimodal data; and using the positive samples and negative samples to construct adversarial defense data for the multimodal data.

[0010] Optionally, the multimodal defense dataset is used to train an adversarial sample detector to obtain the detection model, including: preprocessing the multimodal defense dataset to obtain a sample dataset, wherein the sample dataset includes multiple sample data, and each sample data includes data content and a data label; for each sample data in the sample dataset, extracting data features according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; performing feature fusion on the multiple unimodal data features to obtain fused features; and using the fused features to train the adversarial sample detector to obtain the detection model.

[0011] Optionally, the multimodal defense dataset is used to train an adversarial sample restorer to obtain the recovery model, including: preprocessing the multimodal defense dataset to obtain a sample dataset, wherein the sample dataset includes multiple sample data, and each sample data includes data content and a data label; for each sample data in the sample dataset, extracting data features according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; performing feature fusion on the multiple unimodal data features to obtain fused features; and using the fused features to train the adversarial sample restorer to obtain the recovery model.

[0012] Optionally, data features are extracted according to the modal type of the sample data to obtain multiple unimodal data features, including: extracting text data, image data, and speech data from the sample data; performing word segmentation and length alignment on the text data through a pre-trained tokenizer to obtain text features; dividing the image data into multiple sub-patches, and converting the multiple sub-patches into image features through a pre-trained visual self-attention VIT model; extracting semantic features of the speech data through a Mel filter group and a cepstral transformer, and converting the semantic features into semantic features.

[0013] Optionally, feature fusion is performed on the multiple unimodal data features to obtain a fused feature, including: using a cross-attention model to fuse the image features and text features to obtain a first mixed feature, and using a cross-attention model to fuse the speech features and text features to obtain a second mixed feature; splicing or weightedly fusing the first mixed feature and the second mixed feature into a fused feature.

[0014] Optionally, the adversarial sample restorer includes a routing network and restorers for multiple modalities. The fusion features are used to train the adversarial sample restorer to obtain the recovery model, including: constructing a routing objective function of the routing network and a target function of the restorer for each target modality; constructing a loss function of the adversarial sample restorer using the routing objective function and the target functions of the restorers for all target modalities; and training the loss function using the fusion features to obtain the recovery model.

[0015] Optionally, constructing the routing objective function of the routing network includes: constructing the routing objective function Lrote of the routing network using the following formula: in, is the output of the ith mode, d c is the desired output vector, is the weight assigned by the routing network to the i-th modality, c is the input feature vector of the fused feature, ||.|| 2 is the square of the distance.

[0016] Optionally, if the target modality is an image modality, constructing the objective function of the restorer of each target modality includes: constructing the image objective function L of the image restorer using the following formula: img : Among them, x i is the feature vector of the malicious input image in the fusion feature, y i is the feature vector of the normal input image corresponding to the malicious input image in the fusion feature, RIDNet(x i ) is x i In the output feature vector of the image denoising network, ||.||1 is the first power of the distance, and N is the number of input samples.

[0017] Optionally, if the target modality is a text modality, constructing the objective function of the restorer of each target modality includes: inputting the text samples in the fusion features into the pre-trained adversarial sample restorer in sequence to obtain multiple prediction outputs; respectively calculating the similarity between the multiple prediction outputs and the true outputs of the corresponding text samples, and positively sorting the multiple prediction outputs according to the similarity to obtain a comparison sample set; randomly selecting two sample pair sets (y + ,y-)∈ρ, where y + The similarity between the real output of the text sample is greater than the similarity between y and the real output; the text objective function L of the text restorer is constructed using the following formula N-pair : Among them, z x is the feature vector of the malicious input text in the fusion feature, zy+ is the feature necklace of the normal input text in the fusion feature, z y- is the text feature vector of y-, z y+ for y + The text feature vector, ε = γ*(rank(y - )-rank(y + )), γ is a hyperparameter, rank(y - ) is the sequence number of y-in the comparison sample set, rank(y + ) is y + The sequence number in the comparison sample set.

[0018] Optionally, using the routing objective function and the objective functions of the restorers of all target modes to construct the loss function of the adversarial sample restorer includes: determining a penalty coefficient of the restorer of each mode; using the penalty coefficient, the routing objective function, and the objective functions of the restorers of all modes to construct the following loss function L of the adversarial sample restorer all :L all =αLrote+βL img +γL N-pair +τL vedio ; Where Lrote is the routing objective function of the routing network, L img is the image objective function of the image restorer, L N-pair is the text objective function of the text restorer, L vedio is the speech objective function of the speech restorer, α, β, γ, τ are four hyper parameters, which are the penalty coefficients of the routing network, the image restorer, the text restorer and the speech restorer respectively.

[0019] According to another embodiment of the present invention, there is provided an adversarial defense device for a multimodal large model, comprising: an acquisition module, used to acquire initial multimodal data to be detected; a judgment module, used to use a pre-trained detection model to determine whether the initial multimodal data is malicious data; a recovery module, used to use a pre-trained recovery model to restore the malicious data to target multimodal data if the initial multimodal data is malicious data, wherein the recovery model is used to restore the malicious data to normal data; and an output module, used to input the target multimodal data into the multimodal large model to obtain an output result.

[0020] Optionally, the device also includes: a construction module, used to construct a multimodal defense data set before the judgment module uses a pre-trained detection model to determine whether the initial multimodal data is malicious data; a training module, used to train an adversarial sample detector using the multimodal defense data set to obtain the detection model, and to train an adversarial sample restorer using the multimodal defense data set to obtain the recovery model.

[0021] Optionally, the construction module includes: a construction unit, used to construct an initial multimodal dataset, wherein the initial multimodal dataset includes multiple groups of multimodal data, each group of multimodal data includes sample data of at least two modalities; an enhancement unit, used to perform data enhancement on the initial multimodal dataset to obtain an extended multimodal dataset; and a generation unit, used to generate a multimodal defense dataset using the extended multimodal dataset, wherein the multimodal defense dataset includes multiple groups of adversarial defense data, each group of adversarial defense data includes positive samples and negative samples.

[0022] Optionally, the generation unit includes: a selection subunit, used to select an initial multimodal large model; an output subunit, used to normally input the multimodal data into the initial multimodal large model for each group of multimodal data in the extended multimodal data set to obtain first output data of normal output, and to attack the multimodal data into the initial multimodal large model to obtain second output data of malicious output; a configuration subunit, used to configure the first output data as a positive sample of the multimodal data, and configure the second output data as a negative sample of the multimodal data; and a construction subunit, used to use the positive samples and negative samples to construct adversarial defense data of the multimodal data.

[0023] Optionally, the training module includes: a processing unit, used to preprocess the multimodal defense data set to obtain a sample data set, wherein the sample data set includes multiple sample data, and each sample data includes data content and a data label; an extraction unit, used to extract data features for each sample data in the sample data set according to the modality type of the sample data to obtain multiple single-modal data features, wherein the single-modal data features include text features, image features, and speech features; a fusion unit, used to perform feature fusion on the multiple single-modal data features to obtain fused features; a first training unit, used to train the adversarial sample detector using the fused features to obtain the detection model.

[0024] Optionally, the training module includes: a processing unit, used to preprocess the multimodal defense data set to obtain a sample data set, wherein the sample data set includes multiple sample data, and each sample data includes data content and a data label; an extraction unit, used to extract data features for each sample data in the sample data set according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; a fusion unit, used to perform feature fusion on the multiple unimodal data features to obtain fused features; a second training unit, used to train the adversarial sample restorer using the fused features to obtain the recovery model.

[0025] Optionally, the extraction unit includes: an extraction subunit, used to extract text data, picture data, and speech data from the sample data; a processing subunit, used to segment and length-align the text data through a pre-trained tokenizer to obtain text features; divide the picture data into multiple sub-patches, and convert the multiple sub-patches into picture features through a pre-trained visual self-attention VIT model; extract the semantic features of the speech data through a Mel filter group and a cepstral transformer, and convert the semantic features into semantic features.

[0026] Optionally, the fusion unit includes: a fusion subunit, used to fuse the image features and text features using a cross-attention model to obtain a first mixed feature, and to fuse the speech features and text features using a cross-attention model to obtain a second mixed feature; and a processing subunit, used to concatenate or weightedly fuse the first mixed feature and the second mixed feature into a fused feature.

[0027] Optionally, the adversarial sample restorer includes a routing network and restorers for multiple modalities, and the second training unit includes: a first construction subunit, used to construct a routing objective function of the routing network, and to construct an objective function of the restorer for each target modality; a second construction subunit, used to construct a loss function of the adversarial sample restorer using the routing objective function and the objective functions of the restorers for all target modalities; and a training subunit, used to train the loss function using the fusion feature to obtain the recovery model.

[0028] Optionally, the first construction subunit is further used to: construct a routing objective function Lrote of the routing network using the following formula: in, is the output of the ith mode, d c is the desired output vector, is the weight assigned by the routing network to the i-th modality, c is the input feature vector of the fused feature, ||.||2 is the square of the distance.

[0029] Optionally, if the target modality is an image modality, the second construction subunit is further used to: construct an image target function L of the image restorer using the following formula: img : Among them, x i is the feature vector of the malicious input image in the fusion feature, y i is the feature vector of the normal input image corresponding to the malicious input image in the fusion feature, RIDNet(x i ) is x i In the output feature vector of the image denoising network, ||.||1 is the first power of the distance, and N is the number of input samples.

[0030] Optionally, if the target modality is a text modality, the second construction subunit is further used to: input the text samples in the fusion features into the pre-trained adversarial sample restorer in sequence to obtain multiple prediction outputs; respectively calculate the similarity between the multiple prediction outputs and the true outputs of the corresponding text samples, and positively sort the multiple prediction outputs according to the similarity to obtain a comparison sample set; randomly select two sample pair sets (y + ,y-)∈ρ, where y + The similarity between the real output of the text sample is greater than the similarity between y and the real output; the text objective function L of the text restorer is constructed using the following formula N-pair : Among them, z x is the feature vector of the malicious input text in the fusion feature, z y+ is the feature necklace of the normal input text in the fusion feature, z y- is the text feature vector of y-, z y+ for y + The text feature vector, ε = γ*(rank(y - )-rank(y + )), γ is a hyperparameter, rank(y - ) is the sequence number of y-in the comparison sample set, rank(y + ) is y + The sequence number in the comparison sample set.

[0031] Optionally, the training subunit is further used to: determine a penalty coefficient for the restorer of each modality; and construct the following loss function L of the adversarial sample restorer using the penalty coefficient, the routing objective function, and the objective function of the restorer of all modalities: all :L all=αLrote+βL img +γL N-pair +τL vedio ; Where Lrote is the routing objective function of the routing network, L img is the image objective function of the image restorer, L N-pair is the text objective function of the text restorer, L vedio is the speech objective function of the speech restorer, α, β, γ, τ are four hyper parameters, which are the penalty coefficients of the routing network, the image restorer, the text restorer and the speech restorer respectively.

[0032] According to another aspect of an embodiment of the present application, a storage medium is further provided, which includes a stored program, and the above steps are executed when the program is run.

[0033] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein: the memory is used to store computer programs; and the processor is used to execute the steps in the above method by running the program stored in the memory.

[0034] The embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps in the above method.

[0035] Beneficial effects of the present invention:

[0036] 1. Based on the multimodal defense dataset, the detection model and recovery model are trained to detect and recover adversarial attacks on the input data of the multimodal large model. While enhancing the robustness of the model, the time consumption is minimized to ensure the security and accuracy of the output results of the multimodal large model.

[0037] 2. While deploying the multimodal large model, the detection model and the recovery model are also deployed. By designing a lightweight defense structure, a plug-and-play modular adversarial defense method is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0039] Figure 1 is a hardware structure block diagram of a vehicle according to an embodiment of the present invention;

[0040] Figure 2is a flow chart of a multi-modal large model adversarial defense method according to an embodiment of the present invention;

[0041] Figure 3 is a flow chart of constructing adversarial defense data in an embodiment of the present invention;

[0042] Figure 4 is a detection flow chart of an adversarial sample detector in an embodiment of the present invention;

[0043] Figure 5 is a recovery flow chart of an adversarial sample restorer in an embodiment of the present invention;

[0044] Figure 6 is a flow chart of feature fusion in an embodiment of the present invention;

[0045] Figure 7 is a schematic diagram of the structure of an adversarial sample restorer in an embodiment of the present invention;

[0046] Figure 8 It is a structural block diagram of a multi-modal large model countermeasure defense device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only embodiments of a part of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0048] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0049] Example 1

[0050] The method embodiment provided in the first embodiment of the present application can be executed in a vehicle, a server or a similar processing device. Taking running on a vehicle as an example, Figure 1 FIG. 1 is a hardware structure diagram of a vehicle according to an embodiment of the present invention. Figure 1 As shown, the server may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data. Optionally, the server may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0051] The memory 104 can be used to store server programs, for example, software programs and modules of application software, such as a server program corresponding to a remote control method for a vehicle in an embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the server program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0052] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0053] In this embodiment, a multi-modal large model adversarial defense method is provided. Figure 2 is a flow chart of a multi-modal large model adversarial defense method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0054] Step S202, obtaining initial multimodal data to be detected;

[0055] The solution of this embodiment can be applied to vehicles to achieve multimodal interaction and control between people and vehicles.

[0056] After obtaining the initial multimodal data, corresponding data processing methods can be used for different modal data. For example, images can be processed using a visual self-attention model, text can be processed using the text embedding method of natural language processing (NLP), and speech can be vectorized using structures such as long short-term memory networks (LSTM).

[0057] Step S204, using a pre-trained detection model to determine whether the initial multimodal data is malicious data;

[0058] Step S206: if the initial multimodal data is malicious data, restore the malicious data to target multimodal data using a pre-trained recovery model, wherein the recovery model is used to restore the malicious data to normal data;

[0059] Load the pre-trained detection model and recovery model, input the input data of the multimodal large model to the detection model, and the detection model determines whether the input is malicious data (abnormal data). If it is malicious data, if it is normal data, directly input the input data into the multimodal large model and return the output result.

[0060] Step S208: input the target multimodal data into a large multimodal model to obtain an output result.

[0061] Through the above steps, the initial multimodal data to be detected is obtained, and a pre-trained detection model is used to determine whether the initial multimodal data is malicious data. If the initial multimodal data is malicious data, a pre-trained recovery model is used to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data, and the target multimodal data is input into a large multimodal model. The pre-trained detection model and recovery model are used to realize the detection and recovery of adversarial attacks on the input data of the large multimodal model, while enhancing the robustness of the model, minimizing the time consumption, and ensuring the security and accuracy of the output results of the large multimodal model.

[0062] In one implementation of the present embodiment, before using a pre-trained detection model to determine whether the initial multimodal data is malicious data, it also includes: constructing a multimodal defense dataset; using the multimodal defense dataset to train an adversarial sample detector to obtain the detection model, and using the multimodal defense dataset to train an adversarial sample restorer to obtain the recovery model.

[0063] In one example, constructing a multimodal defense dataset includes: constructing an initial multimodal dataset, wherein the initial multimodal dataset includes multiple groups of multimodal data, each group of multimodal data includes sample data of at least two modalities; performing data enhancement on the initial multimodal dataset to obtain an extended multimodal dataset; and using the extended multimodal dataset to generate a multimodal defense dataset, wherein the multimodal defense dataset includes multiple groups of adversarial defense data, each group of adversarial defense data includes positive samples and negative samples.

[0064] Multimodal normal data construction, through public data sets and image collection, text annotation and other means, selects multimodal data such as image-text, text-speech, image-speech, etc.

[0065] During data enhancement, by calling the public big model, multimodal data such as image-text, text-speech, etc. are rewritten through the big model to enhance the capacity and generalization of the initial multimodal data set.

[0066] Optionally, using the extended multimodal dataset to generate a multimodal defense dataset includes: selecting an initial multimodal large model; for each group of multimodal data in the extended multimodal dataset, normally inputting the multimodal data into the initial multimodal large model to obtain first output data of normal output, and attack-injecting the multimodal data into the initial multimodal large model to obtain second output data of malicious output; configuring the first output data as a positive sample of the multimodal data, and configuring the second output data as a negative sample of the multimodal data; and using the positive samples and negative samples to construct adversarial defense data for the multimodal data.

[0067] When the second output data is maliciously output, select the counter-attack method and the attacked multimodal large model. The counter-attack method can adopt the jailbreak attack, prompt leakage attack and prompt injection attack of the large model, etc., and make the model produce malicious output through maliciously crafted input. The multimodal large model can choose a model with better performance and Chinese support, such as GPT4, VisCPM, etc.; input normal multimodal data (image-text pairs, text-speech pairs, etc.) into the multimodal large model, generate normal output (first output data), and obtain positive samples; attack the above-mentioned multimodal large model through the counter-attack method, generate corresponding malicious output (second output data), and generate negative samples; Figure 3 It is a flow chart of constructing adversarial defense data in an embodiment of the present invention.

[0068] In an example of training an adversarial sample detector in the present embodiment, the multimodal defense dataset is used to train the adversarial sample detector to obtain the detection model, including: preprocessing the multimodal defense dataset to obtain a sample dataset, wherein the sample dataset includes multiple sample data, and each sample data includes data content and a data label; for each sample data in the sample dataset, extracting data features according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; performing feature fusion on the multiple unimodal data features to obtain fused features; and using the fused features to train the adversarial sample detector to obtain the detection model.

[0069] The pre-collected modal defense data set is processed, all data is annotated and mixed, and processed into a content-labeled format; then the mixed data is divided into training, test, and validation sets according to a certain ratio. The sample data set includes training, test, and validation sets. The voice signal is processed for noise reduction to remove interference data such as noise and noise, and then framed and Fourier transformed into a frequency domain signal.

[0070] The purpose of the adversarial sample detector is to detect malicious multimodal inputs from multimodal fusion features, including a multimodal feature extraction module and a fusion module. Figure 4 This is a detection flow chart of the adversarial sample detector in an embodiment of the present invention, including feature extraction, feature fusion and prediction classification (two-classification is normal input and malicious input). The training steps of the adversarial sample detector include data preprocessing, multimodal data feature extraction, multimodal feature fusion, and model training.

[0071] In an example of training an adversarial sample restorer in the present embodiment, the multimodal defense dataset is used to train the adversarial sample restorer to obtain the recovery model, including: preprocessing the multimodal defense dataset to obtain a sample dataset, wherein the sample dataset includes multiple sample data, and each sample data includes data content and data labels; for each sample data in the sample dataset, extracting data features according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; performing feature fusion on the multiple unimodal data features to obtain fused features; and using the fused features to train the adversarial sample restorer to obtain the recovery model.

[0072] The adversarial sample restorer restores the corresponding normal input from the malicious input filtered out by the adversarial sample detector, and then inputs it into the multimodal large model to return the normal output. It consists of a feature decoding restorer. Figure 5 It is a recovery flow chart of the adversarial sample restorer in an embodiment of the present invention. The training steps of the adversarial sample restorer include data preprocessing, data feature extraction, feature decoding restorer, and model training.

[0073] In the above two examples, data features are extracted according to the modal type of the sample data to obtain multiple unimodal data features, including: extracting text data, image data, and voice data from the sample data; performing word segmentation and length alignment on the text data through a pre-trained tokenizer to obtain text features; dividing the image data into multiple sub-patches, and converting the multiple sub-patches into image features through a pre-trained visual self-attention VIT model; extracting semantic features of the voice data through a Mel filter group and a cepstral transformer, and converting the semantic features into semantic features.

[0074] Load the data and labels of the sample data. Text data can be processed by pre-trained tokenizers to segment training data, truncate overlong sentences, pad short sentences, etc., and finally converted into the input format required by the model, such as input ID plus mask plus label format. Image data can be extracted by pre-trained VIT (Vision Transformer, visual self-attention) model, and large images can be divided into N small patches, N is greater than 1, and then converted into image vectors through VIT; voice data can be extracted through Mel filter groups and cepstral transforms to extract features and convert them into semantic vectors.

[0075] In the above two examples, feature fusion is performed on the multiple unimodal data features to obtain fused features, including: using a cross-attention model to fuse the image features and text features to obtain a first mixed feature, and using a cross-attention model to fuse the speech features and text features to obtain a second mixed feature; the first mixed feature and the second mixed feature are concatenated or weightedly fused into a fused feature.

[0076] In the above example, the multimodal feature fusion method uses the cross-attention mechanism. Figure 6 is a flow chart of feature fusion in an embodiment of the present invention, illustrating three modes of image, text and speech. First, multimodal data such as image, text and speech are extracted by different feature extractors to obtain corresponding features F img , F text ,F vedio Etc., and then use cross attention to fuse image-text features F text-img (Fimg ) and text-to-speech features F text-vedio (F vedio ):

[0077]

[0078] Among them, q(·), k(·), and v(·) represent the linear transformation layers of the input features, for query, key, and value, respectively. k The number of attention heads used for normalization.

[0079] Finally, F is concatenated by concat or weighted fusion. text-img and F text-vedio Features blend together.

[0080] In the process of training the adversarial sample detector in this embodiment, the multimodal image feature encoder, text feature encoder, and speech feature encoder are fixed, and only the weight information in the classification network is updated. The classification network can use a simple MLP network structure. For a given multimodal fusion feature and its corresponding label pair (F muti-model ,y i ), introduce the cross entropy target loss L pre :

[0081]

[0082] Among them, k is the category of the binary classification, y i is the label of the corresponding category, including normal input and malicious input, and f(.) is the feature mapping function, which maps the fused features into a category vector. Its goal is to maximize the probability that each feature corresponds to a category, thereby achieving the task of detection and classification.

[0083] Figure 7 This is a schematic diagram of the structure of the adversarial sample restorer in the embodiment of the present invention. First, there is a routing network (Router), which is used to control the flow of multimodal data and distribute different malicious data to different restorers (image restorer, text restorer, audio restorer) for processing to complete the corresponding task of filtering interference. It can use an MLP (Multilayer Perceptron) network to feature map data of different modalities and then distribute them to one or more categories with the highest Softmax correspondence.

[0084] In this embodiment, the adversarial sample restorer includes a routing network and restorers for multiple modalities. The fusion feature is used to train the adversarial sample restorer to obtain the recovery model, including: constructing a routing objective function of the routing network and a target function of the restorer for each target modality; constructing a loss function of the adversarial sample restorer using the routing objective function and the target functions of the restorers for all target modalities; and training the loss function using the fusion feature to obtain the recovery model.

[0085] In one example, constructing the routing objective function of the routing network includes: constructing the routing objective function Lrote of the routing network using the following formula: in, is the output of the ith mode, d c is the desired output vector, is the weight assigned by the routing network to the i-th modality, c is the input feature vector of the fused feature, ||.|| 2 is the square of the distance.

[0086] Using this objective function, the routing network can distribute data of different modalities to the corresponding models for training, thereby reducing the interference between modalities.

[0087] Defense models (restorers) for different modalities include defense filtering for images, text, speech, etc. The image defense model uses a denoising network, the text defense model uses a text generation network, and speech defense can be processed by adversarial training.

[0088] In another example, for the image denoising model, you can use RIDNet (Recursive Information Distillation Network), PMRID (Practical Deep Raw Image Recursive Information Distillation), etc., such as using RIDNet:

[0089] If the target modality is an image modality, constructing the objective function of the restorer for each target modality includes: constructing the image objective function L of the image restorer using the following formula: img : Among them, x i is the feature vector of the malicious input image in the fusion feature, y i is the feature vector of the normal input image corresponding to the malicious input image in the fusion feature, RIDNet(x i ) is x iIn the output feature vector of the image denoising network, ||.||1 is the first power of the distance, and N is the number of input samples.

[0090] Using this objective function, the L1 loss is used to continuously make the model output close to the label-normal output

[0091] In another example, for text data, a pre-trained T5, Bart, etc. generation model can be used. If the target modality is a text modality, the objective function of constructing a restorer for each target modality includes: inputting the text samples in the fusion features into the pre-trained adversarial sample restorer in sequence to obtain multiple prediction outputs; respectively calculating the similarity between the multiple prediction outputs and the true outputs of the corresponding text samples, and forward sorting the multiple prediction outputs according to the similarity to obtain a comparison sample set; randomly selecting two sample pair sets (y + ,y-)∈ρ, where y + The similarity between the real output of the text sample is greater than the similarity between y and the real output; the text objective function L of the text restorer is constructed using the following formula N-pair : Among them, z x is the feature vector of the malicious input text in the fusion feature, z y+ is the feature necklace of the normal input text in the fusion feature, z y- is the text feature vector of y-, z y+ for y + The text feature vector, ε = γ*(rank(y - )-rank(y + )), γ is a hyperparameter, rank(y - ) is the sequence number of y-in the comparison sample set, rank(y + ) is y + The sequence number in the comparison sample set.

[0092] For each pair of text input (xy), where x is malicious text and y is normal text, we first define a scoring function o(.,y) to calculate the similarity between the comparison sample and the real sample to achieve sorting; given an input sequence x and the corresponding real output sequence y, the model predicts a comparison sample set B = {y1, y2, …, y k}; Then use the sorting results to construct a sample pair set (y + ,y-)∈ρ, where +, - represent relative order, which can also be regarded as the difference between good and bad; then the defined N-Pairs contrast loss is expressed as sample (y + ,y-)) and the input text representation vector z xThe marginal loss of similarity. The original intention is to make z x With a better generated sequence z y In addition, the ε parameter is a dynamic adjustment parameter, which is adjusted according to the sorting (y + ,y-)), specifically: ε=γ*(rank(y - )-rank(y + )), through N-pair contrast loss, the similarity between the model-generated sequence and the real sequence is calculated, and the generated sequences with far similarity are penalized.

[0093] For speech modalities, adversarial training can be used for defense, that is, adversarial training can be performed based on the trained speech recognition model.

[0094] Optionally, using the routing objective function and the objective functions of the restorers of all target modes to construct the loss function of the adversarial sample restorer includes: determining a penalty coefficient of the restorer of each mode; using the penalty coefficient, the routing objective function, and the objective functions of the restorers of all modes to construct the following loss function L of the adversarial sample restorer all :L all =αLrote+βL img +γL N-pair +τL vedio ; Where Lrote is the routing objective function of the routing network, L img is the image objective function of the image restorer, L N-pair is the text objective function of the text restorer, L vedio is the speech objective function of the speech restorer, α, β, γ, τ are four hyper parameters, which are the penalty coefficients of the routing network, the image restorer, the text restorer and the speech restorer respectively.

[0095] By preparing the training data and setting the objective function, each module is trained at the same time, and after the training is completed, the recovery model is obtained.

[0096] In order to solve the security problem of multimodal large models, the solution of this embodiment proposes an adversarial defense method for multimodal large models, that is, a plug-and-play modular adversarial defense method. By constructing an adversarial defense dataset, training an adversarial sample detector, and training an adversarial sample restorer, defense against adversarial samples can be achieved through pre-trained detectors and restorers, thereby improving the robustness of the multimodal model.

[0097] By calling the API of the public multimodal large model, deploying the open source multimodal large model, etc., and then using the public multimodal data set, the corresponding malicious data is constructed, including normal pictures-malicious pictures, normal text-malicious text, normal voice-malicious voice, etc. Then, based on the defense data set, the corresponding adversarial sample detector and adversarial sample restorer are trained to achieve detection and recovery of adversarial attacks; by designing a lightweight defense structure, defense against adversarial attacks is achieved, while enhancing the robustness of the model and minimizing the time consumption.

[0098] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0099] Example 2

[0100] In this embodiment, a multi-modal large model countermeasure defense device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0101] Figure 8 is a structural block diagram of a multi-modal large model countermeasure defense device according to an embodiment of the present invention, such as Figure 8 As shown, the device comprises:

[0102] An acquisition module 80, used to acquire initial multimodal data to be detected;

[0103] A judgment module 82, configured to use a pre-trained detection model to judge whether the initial multimodal data is malicious data;

[0104] A recovery module 84, configured to, if the initial multimodal data is malicious data, use a pre-trained recovery model to recover the malicious data into target multimodal data, wherein the recovery model is used to recover the malicious data into normal data;

[0105] The output module 86 is used to input the target multimodal data into the multimodal large model to obtain an output result.

[0106] Optionally, the device also includes: a construction module, used to construct a multimodal defense data set before the judgment module uses a pre-trained detection model to determine whether the initial multimodal data is malicious data; a training module, used to train an adversarial sample detector using the multimodal defense data set to obtain the detection model, and to train an adversarial sample restorer using the multimodal defense data set to obtain the recovery model.

[0107] Optionally, the construction module includes: a construction unit, used to construct an initial multimodal dataset, wherein the initial multimodal dataset includes multiple groups of multimodal data, each group of multimodal data includes sample data of at least two modalities; an enhancement unit, used to perform data enhancement on the initial multimodal dataset to obtain an extended multimodal dataset; and a generation unit, used to generate a multimodal defense dataset using the extended multimodal dataset, wherein the multimodal defense dataset includes multiple groups of adversarial defense data, each group of adversarial defense data includes positive samples and negative samples.

[0108] Optionally, the generation unit includes: a selection subunit, used to select an initial multimodal large model; an output subunit, used to normally input the multimodal data into the initial multimodal large model for each group of multimodal data in the extended multimodal data set to obtain first output data of normal output, and to attack the multimodal data into the initial multimodal large model to obtain second output data of malicious output; a configuration subunit, used to configure the first output data as a positive sample of the multimodal data, and configure the second output data as a negative sample of the multimodal data; and a construction subunit, used to use the positive samples and negative samples to construct adversarial defense data of the multimodal data.

[0109] Optionally, the training module includes: a processing unit, used to preprocess the multimodal defense data set to obtain a sample data set, wherein the sample data set includes multiple sample data, and each sample data includes data content and a data label; an extraction unit, used to extract data features for each sample data in the sample data set according to the modality type of the sample data to obtain multiple single-modal data features, wherein the single-modal data features include text features, image features, and speech features; a fusion unit, used to perform feature fusion on the multiple single-modal data features to obtain fused features; a first training unit, used to train the adversarial sample detector using the fused features to obtain the detection model.

[0110] Optionally, the training module includes: a processing unit, used to preprocess the multimodal defense data set to obtain a sample data set, wherein the sample data set includes multiple sample data, and each sample data includes data content and a data label; an extraction unit, used to extract data features for each sample data in the sample data set according to the modality type of the sample data to obtain multiple unimodal data features, wherein the unimodal data features include text features, image features, and speech features; a fusion unit, used to perform feature fusion on the multiple unimodal data features to obtain fused features; a second training unit, used to train the adversarial sample restorer using the fused features to obtain the recovery model.

[0111] Optionally, the extraction unit includes: an extraction subunit, used to extract text data, picture data, and voice data from the sample data; a processing subunit, used to segment and length-align the text data through a pre-trained tokenizer to obtain text features; divide the picture data into multiple sub-patches, and convert the multiple sub-patches into picture features through a pre-trained visual self-attention VIT model; extract the semantic features of the voice data through a Mel filter group and a cepstral transformer, and convert the semantic features into semantic features.

[0112] Optionally, the fusion unit includes: a fusion subunit, used to fuse the image features and text features using a cross-attention model to obtain a first mixed feature, and to fuse the speech features and text features using a cross-attention model to obtain a second mixed feature; and a processing subunit, used to concatenate or weightedly fuse the first mixed feature and the second mixed feature into a fused feature.

[0113] Optionally, the adversarial sample restorer includes a routing network and restorers for multiple modalities, and the second training unit includes: a first construction subunit, used to construct a routing objective function of the routing network, and to construct an objective function of the restorer for each target modality; a second construction subunit, used to construct a loss function of the adversarial sample restorer using the routing objective function and the objective functions of the restorers for all target modalities; and a training subunit, used to train the loss function using the fusion feature to obtain the recovery model.

[0114] Optionally, the first construction subunit is further used to: construct a routing objective function Lrote of the routing network using the following formula: in, is the output of the ith mode, d c is the desired output vector, is the weight assigned by the routing network to the i-th modality, c is the input feature vector of the fused feature, ||.|| 2is the square of the distance.

[0115] Optionally, if the target modality is an image modality, the second construction subunit is further used to: construct an image target function L of the image restorer using the following formula: img : Among them, x i is the feature vector of the malicious input image in the fusion feature, y i is the feature vector of the normal input image corresponding to the malicious input image in the fusion feature, RIDNet(x i ) is x i In the output feature vector of the image denoising network, ||.||1 is the first power of the distance, and N is the number of input samples.

[0116] Optionally, if the target modality is a text modality, the second construction subunit is further used to: input the text samples in the fusion features into the pre-trained adversarial sample restorer in sequence to obtain multiple prediction outputs; respectively calculate the similarity between the multiple prediction outputs and the true outputs of the corresponding text samples, and positively sort the multiple prediction outputs according to the similarity to obtain a comparison sample set; randomly select two sample pair sets (y + ,y-)∈ρ, where y + The similarity between the real output of the text sample is greater than the similarity between y and the real output; the text objective function L of the text restorer is constructed using the following formula N-pair : Among them, z x is the feature vector of the malicious input text in the fusion feature, z y+ is the feature necklace of the normal input text in the fusion feature, z y- is the text feature vector of y-, z y+ for y + The text feature vector, ε = γ*(rank(y - )-rank(y + )), γ is a hyperparameter, rank(y - ) is the sequence number of y-in the comparison sample set, rank(y + ) is y + The sequence number in the comparison sample set.

[0117] Optionally, the training subunit is further used to: determine a penalty coefficient for the restorer of each modality; and construct the following loss function L of the adversarial sample restorer using the penalty coefficient, the routing objective function, and the objective function of the restorer of all modalities: all :L all =αLrote+βLimg +γL N-pair +τL vedio ; Where Lrote is the routing objective function of the routing network, L img is the image objective function of the image restorer, L N-pair is the text objective function of the text restorer, L vedio is the speech objective function of the speech restorer, α, β, γ, τ are four hyper parameters, which are the penalty coefficients of the routing network, the image restorer, the text restorer and the speech restorer respectively.

[0118] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0119] Example 3

[0120] An embodiment of the present invention further provides a storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0121] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0122] S1, obtaining the initial multimodal data to be detected;

[0123] S2, using a pre-trained detection model to determine whether the initial multimodal data is malicious data;

[0124] S3, if the initial multimodal data is malicious data, using a pre-trained recovery model to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data;

[0125] S4, inputting the target multimodal data into a multimodal large model to obtain an output result.

[0126] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0127] An embodiment of the present invention further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0128] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0129] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0130] S1, obtaining the initial multimodal data to be detected;

[0131] S2, using a pre-trained detection model to determine whether the initial multimodal data is malicious data;

[0132] S3, if the initial multimodal data is malicious data, using a pre-trained recovery model to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data;

[0133] S4, inputting the target multimodal data into a multimodal large model to obtain an output result.

[0134] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0135] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0136] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0137] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0138] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A multi-modal large model adversarial defense method, characterized in that: include: Acquire initial multimodal data to be detected; Using a pre-trained detection model to determine whether the initial multimodal data is malicious data; If the initial multimodal data is malicious data, using a pre-trained recovery model to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data; The target multimodal data is input into a multimodal large model to obtain an output result.

2. The method according to claim 1, characterized in that Before using the pre-trained detection model to determine whether the initial multimodal data is malicious data, the method further includes: Constructing a multimodal defense dataset; The multimodal defense dataset is used to train an adversarial sample detector to obtain the detection model, and the multimodal defense dataset is used to train an adversarial sample restorer to obtain the restoration model.

3. The method according to claim 2, characterized in that Building a multimodal defense dataset includes: Constructing an initial multimodal data set, wherein the initial multimodal data set includes multiple groups of multimodal data, and each group of multimodal data includes sample data of at least two modalities; Performing data enhancement on the initial multimodal dataset to obtain an extended multimodal dataset; The extended multimodal dataset is used to generate a multimodal defense dataset, wherein the multimodal defense dataset includes multiple groups of adversarial defense data, and each group of adversarial defense data includes positive samples and negative samples.

4. The method according to claim 3, characterized in that Using the extended multimodal dataset to generate a multimodal defense dataset includes: Select an initial multimodal macromodel; For each group of multimodal data in the extended multimodal data set, the multimodal data is normally input into the initial multimodal large model to obtain first output data of normal output, and the multimodal data is attack-injected into the initial multimodal large model to obtain second output data of malicious output; Configuring the first output data as a positive sample of the multimodal data, and configuring the second output data as a negative sample of the multimodal data; The positive samples and negative samples are used to construct adversarial defense data for the multimodal data.

5. The method according to claim 2, characterized in that: The multimodal defense dataset is used to train an adversarial sample detector to obtain the detection model, including: Preprocessing the multimodal defense data set to obtain a sample data set, wherein the sample data set includes a plurality of sample data, and each sample data includes data content and a data label; For each sample data in the sample data set, extract data features according to the modality type of the sample data to obtain a plurality of unimodal data features, wherein the unimodal data features include text features, image features, and voice features; Performing feature fusion on the multiple single-modal data features to obtain fused features; The adversarial sample detector is trained using the fusion feature to obtain the detection model.

6. The method according to claim 2, characterized in that The multimodal defense dataset is used to train an adversarial sample restorer to obtain the restoration model, including: Preprocessing the multimodal defense data set to obtain a sample data set, wherein the sample data set includes a plurality of sample data, and each sample data includes data content and a data label; For each sample data in the sample data set, extract data features according to the modality type of the sample data to obtain a plurality of unimodal data features, wherein the unimodal data features include text features, image features, and voice features; Performing feature fusion on the multiple single-modal data features to obtain fused features; The adversarial sample restorer is trained using the fusion features to obtain the restoration model.

7. The method according to claim 5 or 6, characterized in that: Data features are extracted according to the modality type of the sample data to obtain multiple single-modality data features, including: Extracting text data, image data, and voice data from the sample data; The text data is segmented and length-aligned through a pre-trained tokenizer to obtain text features; the image data is divided into multiple sub-patches, and the multiple sub-patches are converted into image features through a pre-trained visual self-attention VIT model; the semantic features of the speech data are extracted through a Mel filter group and a cepstral transformer, and the semantic features are converted into semantic features.

8. The method according to claim 5 or 6, characterized in that: Performing feature fusion on the multiple single-modal data features to obtain fused features includes: The image feature and the text feature are fused by using a cross attention model to obtain a first mixed feature, and the speech feature and the text feature are fused by using a cross attention model to obtain a second mixed feature; The first mixed feature and the second mixed feature are concatenated or weightedly fused into a fused feature.

9. The method according to claim 6, characterized in that The adversarial sample restorer includes a routing network and restorers of multiple modes. The adversarial sample restorer is trained using the fusion feature to obtain the restoration model, including: Constructing a routing objective function of the routing network and constructing an objective function of a restorer for each target mode; Constructing a loss function of the adversarial sample restorer using the routing objective function and the objective functions of restorers of all target modalities; The fusion feature is used to train the loss function to obtain the restoration model.

10. The method according to claim 9, characterized in that The routing objective function for constructing the routing network includes: The routing objective function Lrote of the routing network is constructed using the following formula: in, is the output of the ith mode, d c is the desired output vector, is the weight assigned by the routing network to the i-th modality, c is the input feature vector of the fused feature, ||.|| 2 is the square of the distance.

11. The method according to claim 9, characterized in that If the target modality is an image modality, the objective function of constructing a restorer for each target modality includes: The image objective function L of the image restorer is constructed using the following formula: img : Among them, x i is the feature vector of the malicious input image in the fusion feature, y i is the feature vector of the normal input image corresponding to the malicious input image in the fusion feature, RIDNet(x i ) is x i In the output feature vector of the image denoising network, ||.||1 is the first power of the distance, and N is the number of input samples.

12. The method according to claim 9, characterized in that If the target modality is a text modality, the objective function of constructing a restorer for each target modality includes: Inputting the text samples in the fusion features into a pre-trained adversarial sample restorer in sequence to obtain multiple prediction outputs; Calculating the similarities between the multiple predicted outputs and the actual outputs of the corresponding text samples respectively, and sorting the multiple predicted outputs in a positive order according to the similarities to obtain a comparison sample set; Randomly select two sample pair sets (y + ,y-)∈ρ, where y + The similarity between the real output of the text sample and the real output is greater than y-the similarity between the real output and the real output; The text objective function L of the text restorer is constructed using the following formula: N-pair : Among them, z x is the feature vector of the malicious input text in the fusion feature, z y+ is the feature necklace of the normal input text in the fusion feature, z y- is the text feature vector of y-, z y+ for y + The text feature vector, ε = γ*(rank(y - )-rank(y + )), γ is a hyperparameter, rank(y - ) is the sequence number of y-in the comparison sample set, rank(y + ) is y + The sequence number in the comparison sample set.

13. The method according to claim 9, characterized in that The loss function of the adversarial sample restorer is constructed by using the routing objective function and the objective functions of the restorers of all target modes, including: Determine the penalty coefficient of the restorer for each mode; The penalty coefficient, the routing objective function, and the objective function of the restorer of all modes are used to construct the following loss function L of the adversarial sample restorer: all : L all =αLrot+βL img +γL N-pair +τL vedio ; Among them, Lrote is the routing objective function of the routing network, L img is the image objective function of the image restorer, L N-pair is the text objective function of the text restorer, L vedio is the speech objective function of the speech restorer, α, β, γ, τ are four hyper parameters, which are the penalty coefficients of the routing network, the image restorer, the text restorer and the speech restorer respectively.

14. A multi-modal large model countermeasure defense device, characterized in that: include: An acquisition module, used for acquiring initial multimodal data to be detected; A judgment module, used to use a pre-trained detection model to judge whether the initial multimodal data is malicious data; A recovery module, configured to, if the initial multimodal data is malicious data, use a pre-trained recovery model to restore the malicious data to target multimodal data, wherein the recovery model is used to restore the malicious data to normal data; The output module is used to input the target multimodal data into the multimodal large model to obtain an output result.

15. A storage medium, characterized in that: The storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 13 when executed.

16. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 13.

Images