A deep neural network poisoning attack method

Abstract

The present invention belongs to the technical field of poisoning attack methods, and discloses a deep neural network poisoning attack method, constructs a double-layer superposition coupled multi-attention convolutional network, uses a clean target data set to pre-train the network, and then uses the pre-trained network to extract image feature maps, and generates corresponding weight vectors according to the number of key image features contained in the feature map, and then performs weighted fusion of these features to generate superposition coupled feature maps; constructs a perturbation screening network, expands the superposition coupled feature map and puts it into the perturbation screening network to obtain its confidence, and screens out the superposition coupled feature map with the highest confidence, and splices it with the clean image as a perturbation to generate a poisoned sample; selects a superposition coupled feature map with the highest confidence in each type of image as a perturbation and adds it to another type of image to generate a poisoned data set. The method of the present invention solves the problems of cumbersome poisoning sample generation process and high vulnerability in the existing poisoning attack method.

Description

Technical Field

[0001] The present invention belongs to the technical field of poisoning attack methods and relates to a deep neural network poisoning attack method. Background Art

[0002] With the rapid development of deep learning, deep neural networks (DNNs) have been widely used in fields such as image classification, object detection, and semantic segmentation. However, DNNs are vulnerable to adversarial attacks and data poisoning attacks. Adversarial attacks are usually carried out during the inference phase of the model, by adding tiny and imperceptible perturbations to the input samples, causing the model to give incorrect predictions. Data poisoning attacks interfere with the model's training process by introducing malicious or biased data into the training data, causing the model to make errors or be manipulated when making predictions. Of these two attacks, data poisoning attacks are particularly noteworthy because they directly affect the model's learning process and the integrity of the training data.

[0003] In the field of image classification, poisoning attacks disrupt the training process of DNN models by adding carefully crafted perturbations to the training set, causing the model to make incorrect predictions for clean images and reducing the prediction accuracy of the model. According to the degree of impact on the model, poisoning attacks can be divided into integrity poisoning attacks and availability poisoning attacks. Among them, the goal of availability poisoning attacks is to destroy the overall function of the model, and to reduce its prediction accuracy on clean data by poisoning the training data, thereby reducing the availability of the model. Integrity poisoning attacks attack specific samples while maintaining the model's prediction accuracy for normal samples, causing these samples to be misclassified into other categories or specific categories. For example, in autonomous driving road sign recognition, availability poisoning attacks will reduce the model's recognition accuracy for all road signs; while in integrity poisoning attacks, if we attack the stop sign, the model will maintain the correct recognition of other road signs, but will only misrecognize the stop sign. Compared with integrity poisoning attacks, availability poisoning attacks have a greater impact on the overall performance of the model and are more destructive in practical applications. It is particularly necessary to study multiple implementation methods of this type of attack.

[0004] Availability poisoning attacks can be divided into: label flipping attack, two-layer optimization attack, influence function attack and non-learnable sample attack according to the attack method. Label flipping attack: The attack is carried out by changing the label of the training set, but due to the mismatch between the label and the image content, it is easy to be discovered by manual inspection; two-layer optimization attack: The poisoning attack is approximated as solving a two-layer optimization problem to find the poisoned sample with the least perturbation, but solving the two-layer optimization problem requires a lot of time and computational cost; influence function attack: The poisoned data is produced by calculating the impact of a small change in the training data on the model weights, which is the same as solving the two-layer optimization problem and takes a lot of time and computational cost; non-learnable sample attack: Add carefully crafted perturbations to the entire training set to disrupt the feature distribution of the image, so that the model cannot correctly learn the original features of the image, resulting in a decrease in the model prediction accuracy. Non-learnable sample attacks avoid complex optimization processes by adding uniform perturbations in the feature space, significantly reducing the time and computational cost of generating poisoned samples, and without modifying the labels, greatly reducing the risk of poisoned samples being discovered by manual inspection. At present, non-learnable sample attacks have become a hot topic of research. Some attack methods have been proposed for non-learnable sample attacks, but the existing methods still have the following problems: the generation process of poisoned samples is relatively cumbersome and highly fragile, resulting in an inability to effectively prevent the features of the original data from being learned by the model. Summary of the invention

[0005] The purpose of the present invention is to provide a deep neural network poisoning attack method, which solves the problems of complicated poisoning sample generation process and high vulnerability in existing poisoning attack methods.

[0006] The technical solution adopted by the present invention is a deep neural network poisoning attack method, which is specifically implemented according to the following steps:

[0007] Step 1: construct a double-layer superposition coupled multi-attention convolutional network, pre-train the network using a clean target data set, update the network weights, and then use the pre-trained double-layer superposition coupled multi-attention convolutional network to extract the image feature map, and generate the corresponding weight vector according to the number of key image features contained in the feature map, and then perform weighted fusion of these features to generate a superposition coupled feature map;

[0008] Step 2: construct a perturbation screening network, expand the superposition coupling feature map obtained in step 1 and put it into the perturbation screening network to obtain its confidence, and select the superposition coupling feature map with the highest confidence, and use it as a perturbation to splice it with the clean image to generate a poisoned sample;

[0009] Step 3: Select a superimposed coupling feature map with the highest confidence in each type of image and add it to another type of image as a perturbation to generate a poisoned dataset.

[0010] The present invention is also characterized in that:

[0011] In step 1, the structure of the double-layer superposition coupled multi-attention convolutional network is as follows:

[0012] It only includes two core convolutional layers in the convolutional neural network, and integrates the channel attention mechanism and the spatial attention mechanism.

[0013] The specific process of generating superposition coupling feature maps using a double-layer superposition coupling multi-attention convolutional network is as follows:

[0014] First, a double-layer stacked coupled multi-attention convolutional network is used to extract image feature maps. , as shown below:

[0015]

[0016] in, middle, i represents the row position of the output feature map, j represents the column position of the output feature map, k Represents the channel index of the output feature map; m and n Represents the index of the convolution kernel in the height and width directions, Represents the input image at position and designated channel c The pixel value on W(m,n,c,k) is the convolution kernel at position ( m,n ) c Input channel to k The weights of the output channels, b(k) For the k The offset value of each channel;

[0017] Secondly, the channel attention mechanism is used to generate a weight vector for each feature map, highlighting the feature maps that contain more key image information. , as shown below:

[0018]

[0019] in, AvgPool and MaxPool They are spatial average pooling and maximum pooling operations, MLP is a multi-layer perceptron, σ is an activation function;

[0020] Again, the feature map is further processed using the spatial attention mechanism to highlight the areas in each feature map that contain more key image features and weaken other unimportant areas to obtain the feature map , as shown below:

[0021]

[0022] in, AvgPool and MaxPool They are channel average pooling and maximum pooling operations, The convolution kernel size is The convolutional layer;

[0023] Finally, the activation function σ is used to process and obtain the attention distribution corresponding to the feature map :

[0024]

[0025] Will As the weight of the attention degree of each feature map, each feature map is multiplied by its corresponding weight, and then the weighted feature maps are summed to obtain the superimposed coupling feature map :

[0026]

[0027] in, is the disturbance intensity, is the weight corresponding to each feature map.

[0028] In step 1, the loss function used for pre-training is is defined as:

[0029]

[0030] in, is the true label, is the input image, is the true label of the input image, It is a classification model built on the basis of a double-layer superposition coupled multi-attention convolutional network. Predict labels for the model.

[0031] In step 2, the superposition coupling feature map is expanded from one dimension to three dimensions. The specific dimension expansion steps are as follows:

[0032] Assume superposition coupling characteristic diagram P The width is W , height is H ,Right now use unsqueeze Function in P Insert a new dimension after the last dimension of P The dimension becomes ( H,W,1 ), while using numpy.zeros The function defines a dimension ( H,W,3 ) is an all-zero matrix , then,P The values ​​of Each dimension is as follows:

[0033]

[0034] in, d For the dimensions to be expanded, is the index used to select the channel, is a Kronecker delta function if and only if d = When , the function value is 1.

[0035] In step 2, the structure of the perturbation screening network is:

[0036] Based on ResNet18, a simplified normalization layer and a filtering function are introduced, where the filtering function uses confidence to filter the superimposed coupled feature maps.

[0037] The specific process of using the perturbation screening network to screen the superimposed coupling feature map is as follows:

[0038] Put the superimposed coupling feature map into the pre-trained ResNet18 model for prediction and obtain its confidence , as shown below:

[0039] (8)

[0040] in, is the label set, For the corresponding label The superposition coupling characteristic diagram under For ResNet18 pre-trained on a clean dataset, is a normalizing function;

[0041] Using the confidence The superimposed coupling feature map is screened to obtain the disturbance , specifically:

[0042]

[0043] in, It is a function used to extract the confidence of the image label corresponding to the feature map.

[0044] In step 2, after obtaining the confidence of the superimposed coupling feature map, the loss function is extracted Update the weights of a double-layer stacked coupled multi-attention convolutional network , so that the superimposed coupling feature map extracted by the network later can contain more key image features and extract the loss function is defined as:

[0045]

[0046] in, is the confidence of the superimposed coupling feature map, is the label corresponding to the feature map t The confidence level, It is extracted The category information with the highest confidence level is express For the tag set { Y} in the tag.

[0047] The beneficial effects of the present invention are:

[0048] (1) The method of the present invention constructs a double-layer superposition coupled multi-attention convolutional network, uses this network to extract image features and generate its weight vector, uses the weight vector to weight the features, highlights the features that have a greater impact on the DNN classification results, and then fuses all weighted features into a superposition coupled feature map. The obtained superposition coupled feature map contains more key image features and has stronger aggressiveness;

[0049] (2) The present invention designs a superposition coupling feature map screening method based on confidence, using confidence as a criterion to screen out superposition coupling feature maps that are easier for DNN to learn;

[0050] (3) In order to verify the effect of the method of the present invention, image classification models such as ResNet18 are used as attack targets, and experimental verification is carried out using CIFAR10 and ImageNet100 datasets. The simulation results show that the average test accuracy of the method of the present invention on the CIFAR10 dataset with lower resolution is 10.05%, and the average test accuracy on the ImageNet100 dataset with higher resolution is 1.11%. Compared with the existing methods, the average attack effect of the method of the present invention on the two datasets is improved by 1.35% and 0.88% respectively, and has better attack effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flow chart of the poisoning attack method of the present invention;

[0052] Figure 2 The impact of data sets under different disturbance intensities on the test accuracy of each model in the embodiment of the present invention;

[0053] Figure 3 This is a diagram showing the effects of poisoning the CIFAR10 dataset in an embodiment of the present invention;

[0054] Figure 4This is a diagram showing the effects of the ImageNet-100 dataset before and after poisoning in an embodiment of the present invention;

[0055] Figure 5 It is the test accuracy of the poisoning model of the CIFAR10 dataset under different poisoning methods in the embodiment of the present invention;

[0056] Figure 6 It is the test accuracy of the poisoning model of the ImageNet100 dataset under different poisoning methods in the embodiment of the present invention;

[0057] Figure 7 This is a comparison chart of the effects of different models on the CIFAT10 dataset in the ablation experiment of an embodiment of the present invention. DETAILED DESCRIPTION

[0058] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] The present invention discloses a deep neural network poisoning attack method. A double-layer superposition coupled multi-attention convolutional network is designed to extract features in the image that have a greater impact on the model classification results and generate corresponding weights. After weighted fusion, a superposition coupled feature map is generated. The superposition coupled feature map is put into a perturbation screening network to generate confidence, and the superposition coupled feature map with the highest confidence is selected as the perturbation of the poisoning attack. The overall process is as follows: Figure 1 As shown, the specific implementation steps are as follows:

[0060] Step 1, generate superposition coupling feature map:

[0061] First, a double-layer superimposed coupled multi-attention convolutional network is constructed, and the network is pre-trained using a clean target dataset. The network weights are updated so that it can more effectively capture the key features of the image. Then, the pre-trained double-layer superimposed coupled multi-attention convolutional network is used to extract the image feature map, and the corresponding weight vector is generated according to the number of key image features contained in the feature map. The superimposed coupled feature map is generated by weighted fusion of these features. The final superimposed coupled feature map will contain more key image features and be more aggressive.

[0062] Some existing methods generate poisoned samples with high vulnerability, and their features are not easily learned by the model, resulting in poor poisoning effect. To solve this problem, the present invention designs a double-layer superposition coupled multi-attention convolutional network to extract key features of the image.

[0063] The double-layer stacked coupled multi-attention convolutional network simplifies the convolutional neural network (CNN) to two core convolutional layers, and integrates the channel attention module (CAM) and spatial attention module (SAM), which can reduce the model complexity and improve the computational efficiency. While maintaining strong feature extraction and generalization capabilities, it enhances the model's attention to key image features. The specific parameters of the double-layer stacked coupled multi-attention convolutional network are shown in Table 1:

[0064] Table 1 Parameters of double-layer superposition coupled multi-attention convolutional network

[0065]

[0066] Since the untrained double-layer stacked coupled multi-attention convolutional network fails to effectively learn the key feature distribution of the image, the extracted features lack representativeness, resulting in poor perturbation attack effects. In order to improve its ability to capture key features, the method of the present invention uses a clean target data set to pre-train the double-layer stacked coupled multi-attention convolutional network and update the network weights so that it can more effectively capture the key features of the image.

[0067] Considering that the double-layer superposition coupled multi-attention convolutional network cannot complete the training task independently, the method of the present invention cleverly introduces an appropriate amount of additional convolutional layers and efficient pooling layers on its basis to reduce the number of parameters and improve learning efficiency. Finally, the classification performance is optimized through a streamlined fully connected layer, which ensures that the network can complete the training task independently while improving the computational efficiency and ensuring the accuracy of the training. is defined as:

[0068] (1)

[0069] in, is the true label, is the input image, is the true label of the input image, It is a classification model built on the basis of a double-layer superposition coupled multi-attention convolutional network. Predict labels for the model. By transforming the loss function Minimize so that the model can correctly learn the feature distribution of clean data.

[0070] After pre-training is completed, a double-layer stacked coupled multi-attention convolutional network is used to extract the key features of each image in the target dataset, and these features are used to generate a stacked coupled feature map. First, the double-layer stacked coupled multi-attention convolutional network extracts feature maps of different angles and different focuses in the original image. , as shown in formula (2):

[0071] (2)

[0072] in, middle, i represents the row position of the output feature map, j represents the column position of the output feature map, k Represents the channel index of the output feature map; m and n Represents the index of the convolution kernel in the height and width directions, Represents the input image at position and designated channel c The pixel value on W(m,n,c,k) is the convolution kernel at position ( m,n ) c Input channel to k The weights of the output channels, b(k) For the k The offset value of each channel.

[0073] After obtaining the feature map of the image, a hybrid attention mechanism consisting of CAM and SAM is used to highlight the key features in the feature map, making the final generated perturbation more aggressive. First, CAM is used to generate a weight vector for each feature map to highlight the feature map containing more key information of the image. , as shown in formula (3):

[0074] (3)

[0075] in, AvgPool and MaxPool They are spatial average pooling and maximum pooling operations, respectively, to compress the spatial size to facilitate the subsequent learning of channel features. MLP is a multi-layer perceptron used to learn the characteristics of channels and the importance of each channel, and σ is an activation function.

[0076] After using CAM to preliminarily screen the feature maps, the feature maps with more key features of the image are highlighted. Then SAM is used to further process the feature maps, highlighting the areas with more key features of the image in each feature map and weakening other unimportant areas, ensuring that the final generated disturbance has strong aggressiveness and high concealment. The entire processing process is defined as:

[0077] (4)

[0078] in, AvgPool and MaxPool They are channel average pooling and maximum pooling operations, respectively, the purpose is to compress the channel size to facilitate the subsequent learning of spatial features. The convolution kernel size is Finally, the activation function σ is used to process the attention distribution corresponding to the feature map. :

[0079] (5)

[0080] Will As the weight of the attention degree of each feature map, all feature maps are superimposed and coupled to generate the final feature map. This process can be defined as multiplying each feature map by its corresponding weight, and then summing the weighted feature maps to obtain the superimposed coupled feature map. , as shown in formula (6):

[0081] (6)

[0082] in, is the disturbance intensity, is the weight corresponding to each feature map.

[0083] The pre-trained double-layer stacked coupled multi-attention convolutional network is used to extract key features of the image and generate stacked coupled feature maps. These stacked coupled feature maps are used as poisoned samples generated by perturbations, allowing the model to capture the feature information contained in the poisoned samples more quickly and effectively during training, thereby reducing the impact of the original image features on the model.

[0084] Step 2: Filter the superposition coupling feature map:

[0085] Construct a perturbation screening network, expand the dimension of the superimposed coupling feature map and put it into the perturbation screening network to obtain its confidence, screen out the superimposed coupling feature map with the highest confidence, and use it as a perturbation to splice it with the clean image to generate a poisoned sample.

[0086] Since each image generates an overlay coupling feature map, how to select a suitable image as a perturbation from a large number of overlay coupling feature maps becomes a new problem. In order to filter out more aggressive overlay coupling feature maps, the method of the present invention constructs a perturbation screening network, introduces a streamlined normalization layer and a screening function based on ResNet18, so that this network can effectively select high-confidence overlay coupling feature maps, and then, these high-confidence feature maps are used as perturbations and spliced ​​with clean images to generate poisoned samples.

[0087] Because the input dimension of the perturbation screening network is three-dimensional, and the feature maps are all one-dimensional images, the method of the present invention first performs a dimension expansion operation on the superimposed coupling feature map to expand the superimposed coupling feature map into a three-dimensional image. Assume that the width of the superimposed coupling feature map is W , height is H ,Right now .use unsqueeze Function in P Insert a new dimension after the last dimension of P The dimension becomes (H,W,1) , while using numpy.zeros The function defines a dimension (H,W,3) The all-zero matrix Then, P The values ​​of Each dimension of is as shown in formula (7):

[0088] (7)

[0089] in, d For the dimensions to be expanded, is the index used to select the channel, is a Kronecker delta function if and only if d = When , the function value is 1.

[0090] Put the expanded superposition coupling feature map into the pre-trained ResNet18 model for prediction and obtain its confidence , as shown in formula (8):

[0091] (8)

[0092] in, is the label set, For the corresponding label The superposition coupling characteristic diagram under For ResNet18 pre-trained on a clean dataset, is a normalizing function.

[0093] Confidence is the probability that the model believes that an image belongs to a certain category. When the model classifies the input image, it outputs a probability value for each category, indicating the possibility that the image belongs to each category, and the highest confidence value usually indicates that the model believes that the image is most likely to belong to that category. The level of confidence is determined by the number of key features of the corresponding category contained in the image. The higher the confidence in a certain category, the more key features of this category are contained in the image. Therefore, based on this feature, the method of the present invention designs a screening function, uses confidence to screen the superimposed coupled feature map, and further selects feature maps containing more key features of the image, so that the final perturbation It has stronger aggressiveness, as shown in formula (9):

[0094] (9)

[0095] in, It is a function used to extract the confidence of the image label corresponding to the feature map.

[0096] In order to enhance the ability of the double-layer superposition coupled multi-attention convolutional network to extract key features of the image, the present invention designs an extraction loss function , which aims to maximize the confidence of the feature map proposed by the network on its own label. Extract loss function is defined as:

[0097] (10)

[0098] in, It is extracted The category information with the highest confidence. express For the tag set { Y After obtaining the confidence of the superimposed coupled feature map, this loss function is used to update the weights of the double-layer superimposed coupled multi-attention convolutional network. , so that the superimposed coupling feature map extracted by the network later can contain more key image features. The definition of the entire weight update process is:

[0099] (11)

[0100] in, is the learning rate. By maximizing the distance between the two confidence levels, the key features of the category corresponding to the superimposed coupled feature map can be effectively extracted, and the distinction between it and other categories of superimposed coupled feature maps can be enhanced. After multiple trainings, the ability of the double-layer superimposed coupled multi-attention convolutional network to extract key features of the image will be significantly improved, and the generated superimposed coupled feature map will have a stronger poisoning ability, thereby further enhancing the interference effect of the poisoned sample on the model.

[0101] Step 3, generate poisoned data set:

[0102] In each category of images, a superimposed coupled feature map with the highest confidence is selected as a perturbation and added to another category of images to generate a poisoned dataset. The model trained with the poisoned dataset will learn more perturbed features and ignore the original features of the image, causing the model to output incorrect results when predicting clean data, thus affecting the usability of the model.

[0103] In order to maximally confuse the predictions of the poisoned model when given clean test data, the poisoned dataset should have the following characteristics:

[0104] 1) Images of the same category should have similar features in the poisoning dataset, so that the model can more easily learn the main features of images of that category;

[0105] 2) The feature differences between different categories must be significant enough so that the model can quickly learn and draw decision boundaries between categories;

[0106] 3) In the poisoned dataset and the original clean dataset, images of the same category should be identified as different categories by the poisoned model to ensure the attack effect of the perturbation.

[0107] Once the final superimposed coupled feature maps are determined, they can be added to the dataset by category. For each category of clean images, the superimposed coupled feature maps of another category are added, thus generating the final poisoned dataset. , the generation process is defined as:

[0108] (12)

[0109] in, represents the original clean dataset.

[0110] In summary, images of the same category have the same perturbations, and the model can easily learn the "main features" of such images. Since clean test data does not contain perturbations, its features are more like noise to the poisoned model, which helps achieve the goal of reducing the accuracy of model testing in the present invention.

[0111] Embodiment 1:

[0112] 1. Basic experimental settings

[0113] 1) Dataset and experimental environment

[0114] This example uses two data sets in the experiment, namely:

[0115] CIFAR10: CIFAR10 is a dataset for identifying common objects. It consists of 60,000 3-channel images of size 32×32 pixels. The training set contains 50,000 images and the test set contains 10,000 images. This dataset has a total of 10 categories, namely "ship", "truck", "cat", "deer", "bird", "dog", "frog", "horse", "airplane", and "car". These categories are independent of each other. Objects that appear in one category will not appear in other categories.

[0116] ImageNet-100: ImageNet is a huge visual object recognition database containing more than 14 million images from 1,000 classes. Considering efficiency and other issues, this example selects the first 100 classes, a total of 130,000 images, as the data set for this experiment. Among them, 1,000 images are randomly selected from each class as the training set, and the remaining 300 images are used as the test set.

[0117] The environment used for all experiments in this paper is 13th Gen Intel Core i7-13700k, LOGICALVOLUME / LOGICAL VOLUME, YZMB-01130-10C, Ubuntu 22.04, PyCharm 2022, Python 3.7, CUDA 12.0, cuDNN 7.6.4, and NVIDIA GeForce RTX 4090 GPU.

[0118] 2) Model parameter setting

[0119] This example first trains a double-layer stacked coupled multi-attention convolutional network on a clean training set, enabling it to distinguish and extract key features of images. In order to evaluate the attack performance of the generated poisoned training set, this example trains different classification models such as ResNet18, VGG19, DenseNet, RegNetx, GoogLeNet, etc. on it, and tests the prediction accuracy of these models on a clean test set.

[0120] Embodiment 2:

[0121] On the basis of Example 1:

[0122] In all experiments, the present invention uses an SGD optimizer with a learning rate of 0.001, a momentum coefficient of 0.9, and a learning decay rate of 0.0005. For CIFAR10, this embodiment uses 32 images as a batch, and for ImageNet-100, this embodiment uses 12 images as a batch to train the model.

[0123] Embodiment 3:

[0124] On the basis of Example 2, carry out:

[0125] 2. Experiment on selection of method parameters

[0126] 1) Comparative experiments with different disturbance intensities

[0127] This embodiment uses the test accuracy of the poisoned model on the clean test set as a criterion for measuring the effectiveness of the attack method. Because the average test accuracy of the initialized model is the random guessing accuracy, the closer the test result is to the model with random guessing accuracy, the fewer original features learned from the poisoned training data, which means the attack is more effective.

[0128] The disturbance intensity represents the strength of the disturbance's aggressiveness. The higher the disturbance intensity, the more aggressive the disturbance is, but the worse its concealment is. In order to balance the aggressiveness and concealment of the disturbance, this embodiment designs a comparative experiment with different disturbance intensities to screen out disturbances that are both aggressive and concealed.

[0129] In this embodiment, the experiment is conducted by changing only the perturbation intensity. The perturbation intensity is gradually increased from 0.02 (when the pixel value range of the input image is [0, 1]), and is increased by 0.02 each time. A poisoned data set is generated and used to attack the model to compare the test accuracy.

[0130] Table 2 Test accuracy of ResNet18 on CIFAR10 dataset under different perturbation intensities

[0131]

[0132] As shown in Table 2, the disturbance intensity shows a downward trend between [0.02, 0.08], and tends to be stable when the disturbance intensity increases to above 0.08. Considering the concealment of the disturbance, a smaller disturbance intensity should be selected as much as possible while ensuring the aggressiveness, so this embodiment subdivides the disturbance intensity between the interval [0.06, 0.1], further tests the influence of the disturbance intensity on the test accuracy, and selects the appropriate disturbance intensity.

[0133] like Figure 2 As shown in the figure, under different disturbance intensities, the test accuracy of each model is close, indicating that the disturbance of the present invention has no obvious targeting and can produce excellent attack effects on each model; and when the disturbance intensity is increased to 0.07, the test accuracy of each model is close to the random guessing accuracy. When the disturbance intensity is further increased, the test accuracy of each model has no obvious change and hovers around 10%. This embodiment adds a disturbance with a disturbance intensity of 0.07 to the data set. The effects before and after the addition are shown in the figure. Figure 3 As shown:

[0134] The middle image is the perturbed image, the left side of the perturbation is the original image, and the right side is the poisoned image after adding the perturbation. It can be seen that the image after adding the perturbation can still clearly show its category information, and the perturbation is very hidden, and it is basically invisible to the naked eye.

[0135] Table 3 Average test accuracy of ImageNet100 dataset under different perturbation intensities

[0136]

[0137] The ImageNet-100 dataset is similar to the CIFAR10 dataset. Experiments were conducted on the VGG19, ResNet18, and DenseNet models. The results are shown in Table 3. When the perturbation intensity of the ImageNet-100 dataset is 0.08, the prediction accuracy of each model reaches 1%, which is the prediction accuracy of the untrained model. The effect diagram before and after the attack is shown in Table 3. Figure 4 As shown:

[0138] The middle image is a schematic diagram of the perturbation, the left side of the perturbation is the original image, and the right side is the poisoned image after the perturbation. Similar to the CIFAR10 dataset, the image after the perturbation still clearly shows its category information, and no obvious changes are made to the main part of the image, indicating that our method has good concealment while ensuring the attack effect.

[0139] Embodiment 4:

[0140] On the basis of Example 3, carry out:

[0141] 2) Comparative experiments on different perturbation methods

[0142] Because the disturbance of the method of the present invention is a single-channel characteristic graph, there are multiple poisoning methods to choose from. This embodiment selects the three most representative methods for experimentation, and the three methods are as follows:

[0143] Method 1: Select a feature map from each type of image as a perturbation and add it to another type of image. Finally, each type of image will add a perturbation extracted from another type.

[0144] Method 2: Select the first half of the feature maps with higher confidence as perturbations and add them to different channels of the other two categories of images. For example, add the feature maps extracted from cats to the R channel of all images of the airplane class and the G channel of all images of the frog class.

[0145] Method 3: Select the first one-third of feature maps with higher confidence as perturbations and add them to different channels of the other three types of images.

[0146] The simulation results on the CIFAR10 dataset are as follows Figure 5 As shown in the figure, the first method of poisoning has the highest test accuracy on each model, indicating that the perturbation with lower confidence has a poor effect and allows the model to learn more original features of the image. The second and third methods of poisoning have very close test accuracy on each model, and are close to the test accuracy of the initialized model.

[0147] The simulation results on the ImageNet100 dataset are as follows Figure 6 As shown in Figure 4, similar to the results of CIFAR10, the effect of poisoning with method 1 is not as good as that of method 2 and method 3. The confidence corresponding to the feature maps selected from the CIFAR10 dataset is shown in Table 4. The confidence of the first half of the feature maps is above 0.9. The higher the confidence, the more features that have a greater impact on the DNN classification results are contained in the feature map, and the model will learn more features of the feature map, so the gap between method 2 and method 3 is very small.

[0148] Table 4 CIFAR10 dataset perturbation confidence

[0149]

[0150] Similarly, after the confidence of the perturbations in the ImageNet100 dataset is arranged from large to small, the confidence of the 34th-ranked perturbation is 0.934, and the confidence of the 50th-ranked perturbation is 0.867. Therefore, the ImageNet100 dataset uses three methods for poisoning, and the experimental results are similar to those of the CIFAR10 dataset. Method 1 has the worst effect, and method 2 is slightly better than method 3.

[0151] The reason why the poisoning effect of method 2 is slightly better than that of method 3 is that the same perturbation is added to different channels of images of different categories. Although the perturbations in different channels enable the model to distinguish different categories of images, if the number of perturbations is too small, the model will still confuse the three categories of images with the same perturbation, causing its classification accuracy to be slightly reduced.

[0152] From this, we can conclude that confidence represents the number of features in the feature map that are easy for DNN to learn and classify. The higher the confidence, the more features of this type learned by DNN this feature map contains. Therefore, choosing a feature map with high confidence as perturbation makes it easier for the model to learn to prioritize perturbation features, thereby ignoring the original features of the image.

[0153] Embodiment 5:

[0154] On the basis of Example 4, carry out:

[0155] 3. Ablation experiment

[0156] In order to analyze the effectiveness of each module in the method of the present invention, ablation experiments are conducted on different modules in improving the performance of the double-layer superposition coupled multi-attention convolutional network. The double-layer superposition coupled multi-attention convolutional network can be divided into two parts: the core convolution layer and the attention mechanism. The core convolution layer is responsible for preliminarily extracting the feature map of the image, and the attention mechanism is responsible for optimizing the feature map and highlighting the key features in the image. Therefore, this embodiment conducts experiments on both removing the attention mechanism and adding the attention mechanism. The influence of the superposition coupled feature map generated before and after adding the attention mechanism on the poisoning effect is shown in the figure. Figure 7 As shown, it can be seen that both methods can achieve the purpose of reducing the accuracy of model testing, but when the attention mechanism is not used, the test accuracy is significantly higher. This shows that if the attention mechanism is not used to weight the feature maps that make up the superimposed coupled feature map, it is impossible to effectively highlight the features that have a greater impact on the model classification results, so that they occupy a larger proportion in the superimposed coupled feature map, which leads to the test results not being as good as when the attention mechanism is used. By analyzing the fluctuation degree of the two columns separately, it can be seen that after adding the attention mechanism, the poisoning effect of the poisoned data set on each model is more stable, which also proves from the side that the features highlighted by the attention mechanism are more easily noticed by most DNNs and the poisoning effect is better.

[0157] like Figure 7 The last set of data shows that after adding the attention mechanism, the average test accuracy of each model is reduced by 0.5% compared to when it is not added. This shows the effectiveness of the attention mechanism, which can help the model better focus on and learn image features, thereby improving the robustness and generalization ability of perturbations.

[0158] Embodiment 6:

[0159] On the basis of Example 5, carry out:

[0160] 4. Comparison of poisoning attack methods

[0161] This embodiment uses test accuracy to evaluate the attack effect of an attack method. The closer the test accuracy is to the prediction accuracy of the initialization model, the more perturbation features the model has learned from the poisoned training data set and the fewer original image features, which means that the attack effect is better.

[0162] According to the above experiments, this embodiment uses the superimposed coupled feature map with the confidence level in the first half as the perturbation to poison the CIFAR10 and ImageNet100 datasets, and selects some existing availability poisoning attack methods for comparison, including Error-max, AR and Dif. In order to compare the impact of generated perturbations and non-elaborate perturbations on classification accuracy, this embodiment uses random noise to compare with the method of the present invention. Table 5 shows the attack results of each method on the CIFAR10 dataset, and Table 6 shows the attack results of each method on the ImageNet100 dataset.

[0163] Table 5 Results of poisoning the CIFAR10 dataset using different poisoning attack methods and testing on different classification networks

[0164]

[0165] Table 6 Results of poisoning the ImageNet100 dataset using different poisoning attack methods and testing on different classification networks

[0166]

[0167] As can be seen from Table 5, on the CIFAR10 dataset with lower resolution, the perturbations generated by the method of the present invention achieved good attack results on different models. Compared with other methods, the method of the present invention achieved optimal values ​​on VGG19, ResNet18, DenseNet and RegNetx models, and was slightly inferior to the AR method on GoogleNet, reaching suboptimal values. On the ImageNet100 dataset with higher resolution, as shown in Table 6, the method of the present invention achieved the best attack effect on all models. This shows that the perturbations generated by the method of the present invention have high universality, whether it is DenseNet and RegNetx with deeper layers, or residual network ResNet18, or VGG19 with relatively shallow layers, the characteristics of the perturbations will be given priority.

[0168] Compared with other methods, the method of the present invention uses a double-layer superposition coupled multi-attention convolutional network to generate perturbations, and further screens them through confidence, so that the features of the generated perturbations are easier to be learned by DNN. When DNN pays attention to these perturbation features with distinctive characteristics, it will use them as the basis for classification, thereby ignoring the original features of the image that are relatively difficult for DNN to notice. This results in the inability of the poisoned DNN to match its features with the corresponding category features learned by DNN when classifying clean test data, which leads to classification errors.

[0169] Therefore, the perturbation generated by the method of the present invention has the advantages of easy DNN learning, excellent transferability and robustness. Taking into account the attack performance, robustness and practicality, the method of the present invention is a competitive method.

Claims

1. A deep neural network poisoning attack method, characterized in that: Follow the steps below to implement it: Step 1: construct a double-layer superposition coupled multi-attention convolutional network, pre-train the network using a clean target data set, update the network weights, and then use the pre-trained double-layer superposition coupled multi-attention convolutional network to extract the image feature map, and generate the corresponding weight vector according to the number of key image features contained in the feature map, and then perform weighted fusion of these features to generate a superposition coupled feature map; Step 2: construct a perturbation screening network, expand the superposition coupling feature map obtained in step 1 and put it into the perturbation screening network to obtain its confidence, and select the superposition coupling feature map with the highest confidence, and use it as a perturbation to splice it with the clean image to generate a poisoned sample; Step 3: Select a superimposed coupling feature map with the highest confidence in each type of image and add it to another type of image as a perturbation to generate a poisoned data set; In step 2, the structure of the disturbance screening network is: Based on ResNet18, a simplified normalization layer and a filtering function are introduced, wherein the filtering function uses confidence to filter the superimposed coupling feature map; The specific process of using the perturbation screening network to screen the superimposed coupling feature map is as follows: Put the superimposed coupling feature map into the pre-trained ResNet18 model for prediction and obtain its confidence , as shown below: in, is the label set, For the corresponding label The superposition coupling characteristic diagram under For ResNet18 pre-trained on a clean dataset, is a normalizing function; Using the confidence The superimposed coupling feature map is screened to obtain the disturbance , specifically: in, It is a function used to extract the confidence of the image label corresponding to the feature map; In step 2, after obtaining the confidence of the superimposed coupling feature map, the loss function is extracted Update the weights of a double-layer stacked coupled multi-attention convolutional network , so that the superimposed coupling feature map extracted by the network later can contain more key image features. The extraction loss function is defined as: in, is the confidence of the superimposed coupling feature map, is the label corresponding to the feature map t The confidence level, It is extracted The category information with the highest confidence level is express For the tag set { Y } in the tag.

2. A deep neural network poisoning attack method according to claim 1, characterized in that: In step 1, the structure of the double-layer superposition coupled multi-attention convolutional network is specifically as follows: It only includes two core convolutional layers in the convolutional neural network, and integrates the channel attention mechanism and the spatial attention mechanism.

3. A deep neural network poisoning attack method according to claim 2, characterized in that: The specific process of generating superposition coupling feature maps using a double-layer superposition coupling multi-attention convolutional network is as follows: First, a double-layer stacked coupled multi-attention convolutional network is used to extract image feature maps. , as shown below: in, middle, i represents the row position of the output feature map, j represents the column position of the output feature map, k Represents the channel index of the output feature map; m and n Represents the index of the convolution kernel in the height and width directions, Represents the input image at position and designated channel c The pixel value on W(m,n,c,k) is the convolution kernel at position ( m， n ) c Input channel to k The weights of the output channels, b(k) For the k The offset value of each channel; Secondly, the channel attention mechanism is used to generate a weight vector for each feature map, highlighting the feature maps that contain more key image information. , as shown below: in, AvgPool and MaxPool They are spatial average pooling and maximum pooling operations, MLP is a multi-layer perceptron, σ is an activation function; Again, the feature map is further processed using the spatial attention mechanism to highlight the areas in each feature map that contain more key image features and weaken other unimportant areas to obtain the feature map , as shown below: in, AvgPool and MaxPool They are channel average pooling and maximum pooling operations, The convolution kernel size is The convolutional layer; Finally, the activation function σ is used to process and obtain the attention distribution corresponding to the feature map : Will As the weight of the attention degree of each feature map, each feature map is multiplied by its corresponding weight, and then the weighted feature maps are summed to obtain the superimposed coupling feature map : in, is the disturbance intensity, is the weight corresponding to each feature map.

4. A deep neural network poisoning attack method according to claim 1, characterized in that: In step 1, the loss function used for pre-training is is defined as: in, is the true label, is the input image, is the true label of the input image, It is a classification model built on the basis of a double-layer superposition coupled multi-attention convolutional network. Predict labels for the model.

5. A deep neural network poisoning attack method according to claim 1, characterized in that: In step 2, the superposition coupling feature map is expanded from one dimension to three dimensions. The specific dimension expansion steps are as follows: Assume superposition coupling characteristic diagram P The width is W , height is H ,Right now use unsqueeze Function in P Insert a new dimension after the last dimension of P The dimension becomes ( H,W,1 ), while using numpy.zeros The function defines a dimension ( H,W,3 ) is an all-zero matrix , then, P The values ​​of Each dimension is as follows: in, d For the dimensions to be expanded, is the index used to select the channel, is a Kronecker delta function if and only if d = When , the function value is 1.

Images