Confrontation attack method based on reconstruction data and substitution model

Abstract

The invention discloses an attack resisting method based on reconstructed data and a substitution model. The method comprises the following steps: 1) constructing a generative model: improving the performance of the generative model; 2) selecting a substitution model; 3) generating and initializing random noise and a pseudo label; 4) constructing a loss function for updating the generation model: combining the cross entropy loss function and the information entropy loss function to construct a new combined loss function; 5) constructing a distillation process loss function: combining the distillation loss function and the boundary loss function to construct a B-D combined loss function; 6) training the collaborative substitution model to generate a model; 7) performing knowledge distillation training on the substitution model by the collaborative generation model; 8) carrying out collaborative iteration updating on the generation model and the substitution model; according to the method, the quality of reconstructed data can be effectively improved, the success rate of attack resistance is better improved with low query cost, and an effective scheme is provided for the fields of attack resistance, model security evaluation and the like.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attack technology, and in particular to an adversarial attack method based on reconstructed data and a substitution model. Background Art

[0002] Deep neural network models are usually vulnerable to adversarial attacks. Studying adversarial attacks can not only reveal the performance of the model, but also provide a new perspective for the overall security analysis of the system. Understanding the model's response to adversarial inputs can help build more effective and more secure systems. Therefore, adversarial attacks have become the main means of studying model performance.

[0003] The attack method based on the substitution model is a transfer attack method. It learns the knowledge of the black-box target model through the student model (substitute model), and then transforms the black-box attack problem into a white-box attack problem with a known model structure. Papernot et al. first used the training set of the black-box model to train the student model and successfully implemented the attack on the black-box model; Truong et al. first used the generator to generate synthetic data to train the substitution model, reducing the dependence of the substitution model on the target data set; Wang et al. proposed a dynamic proxy model search strategy to learn the characteristics of the target model more deeply; Kariyappa et al. adjusted the generated samples by estimating the gradient of the black-box model to achieve the model stealing function; Zhang et al. changed the game between the substitution model and the generation model, setting the goal of the generator to synthesize reconstructed data with a distribution similar to the target training data, and setting the goal of the substitution model to effectively imitate the target model using the reconstructed data.

[0004] Although the above methods have achieved good attack effects, they all focus on the game between models, and achieve the function of stealing target model information by maximizing the matching probability between the alternative model and the target model, while ignoring the generation effect of the generated model itself. Therefore, it is very necessary to build a more powerful generative model, which has important application value in anti-attack research, model security assessment and algorithm optimization, and provides a new perspective for deep learning model performance analysis and security system research. Summary of the invention

[0005] The present invention proposes a counterattack method based on reconstructed data and a substitution model.

[0006] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0007] A method for adversarial attack based on reconstructed data and alternative models, comprising the following steps:

[0008] Step 1: Build a generative model, which consists of three parts:

[0009] In the feature reshaping part, the input noise vector is mapped to the high-dimensional feature space through the fully connected layer and reshaped into a 4D tensor. After batch normalization, it is upsampled to increase the resolution of the feature map by 1 times.

[0010] The image feature generation part consists of the PixelNorm normalization layer at the head and tail, two DR convolution modules in the middle, and one regular convolution module, which is used to generate image features;

[0011] In the output part, after one conventional convolution layer and Sigmoid activation function, the reconstructed image is output;

[0012] Step 2: Select an alternative model:

[0013] Select an alternative model for the target black box model to be attacked;

[0014] Step 3, generation and initialization of random noise and pseudo labels:

[0015] (3a) Randomly generate a batch of noise ,in, represents the standard normal distribution, and all random noises are independently sampled from the standard normal distribution;

[0016] (3b) Each randomly generated noise z i Input the generative model and get the corresponding output reconstruction data x i , and then input it into the substitution model to obtain the output probability, and select the category corresponding to the maximum probability as the pseudo label y i , and finally get an initialized pseudo-label sequence ;

[0017] Step 4: Construct a loss function to update the generated model:

[0018] In order to balance data distribution and improve data diversity, a combined loss function is constructed to update the generative model;

[0019] Step 5: Construct the loss function of the distillation process:

[0020] In order to make the output of the surrogate model and the target model consistent and make them have closer decision boundaries, a BD combination loss function is designed;

[0021] Step 6: Collaborative substitution model training generates a model:

[0022] (6a) Randomly select the random noise z in step (3a) i As the input of the generative model, the output reconstructed data is obtained;

[0023] (6b) performing a combined enhancement operation on the reconstructed data;

[0024] (6c) inputting the enhanced reconstructed data into the alternative model to obtain the model prediction results;

[0025] (6d) training the generation model according to the error value between the prediction result of step (6c) and the pseudo label obtained in step (3b);

[0026] Step 7: The collaborative generative model performs knowledge distillation training on the alternative model:

[0027] (7a) The alternative model is used as the student model and the target model is used as the teacher model for knowledge distillation training;

[0028] (7b) inputting the combined enhanced data obtained in step (6b) into the target model to obtain output labels or probability information;

[0029] (7c) Calculate the error between the prediction result obtained in (6c) and the output information in (7b), and back-propagate to train the alternative model;

[0030] Step 8: Generate model and substitute model collaboratively iteratively update:

[0031] Set training rounds, perform collaborative iterative updates on the generative model in step 6 and the surrogate model in step 7, continuously optimize the generative model in each round to generate new reconstructed data, use the reconstructed data to train and update the surrogate model, and finally select the optimal set of parameters after the loss function converges as the prior knowledge of the generative model and the surrogate model;

[0032] Step 9: Attack the target model:

[0033] Based on the prior knowledge of the alternative model, adversarial samples are generated on the trained alternative model to attack the target model.

[0034] The feature reshaping part in step 1 consists of 1 Linear layer, 1 batch normalization layer and 1 upsampling layer;

[0035] The image feature generation part in step 1 is composed of 2 DR convolution modules, 1 conventional convolution module and PixelNorm normalization layers at the head and tail, wherein the DR convolution module is composed of 1 residual module, 1 3*3DW convolution layer, 1 batch normalization layer and 1 LeakyRelu activation function; the residual module is composed of 2 3*3 convolution layers, 2 batch normalization layers and 1 Relu activation function; the conventional convolution module is composed of 1 upsampling layer, 1 3*3 convolution layer, 1 batch normalization layer and 1 LeakyRelu activation function layer; the PixelNorm normalization method at the head and tail refers to the element-by-element normalization operation of the input features, which can be specifically expressed as:

[0036]

[0037] Where x represents the eigenvector, whose components are x i , n is the dimension of the feature vector, is a very small constant to avoid division by 0;

[0038] The output part in step 1 is composed of a 3*3 convolutional layer and a Sigmoid activation function layer.

[0039] The value of n in steps (3a) and (3b) is defined as the number of categories. A simple image is input into the target model before training, and the specific value of n can be inferred by analyzing the number of output categories corresponding to different inputs.

[0040] The combined loss function in step 4 has the following mathematical formula:

[0041]

[0042] in, represents the hyperparameter for adjusting the regularization value, CE(*) represents the cross entropy loss function, S(*) represents the output prediction result of the reconstructed data after passing through the replacement model S, Y is an output label randomly selected in the target model, z represents the noise vector of random input, k represents the number of categories, H(*) represents the information entropy loss, and G(*) represents the generated data.

[0043] The BD combined loss function in step 5 has the following mathematical formula:

[0044]

[0045] Among them, T(X) represents the prediction result of the target model, S(X) represents the prediction result of the alternative model, that is, the student model, and D(*) is a way to measure the difference between T(X) and S(X). In the label-only scenario, D(*) is the cross entropy loss function, and in the probability-only scenario, D(*) is l 2 Norm, 1{*} means that when the values ​​in the brackets are different, 1 is returned; if they are the same, 0 is returned.

[0046] The combined enhancement operation in step (6b) refers to performing a random cropping operation on the image in the global view and performing a random cropping and scaling operation on the image in the local view. The process can be described as follows:

[0047]

[0048] Where p represents the padding size, scale represents the cropping ratio, and size represents the output image size.

[0049] In the step (6d), the Adam optimizer is used for back propagation.

[0050] In the step (7c), the Adam optimizer is used for back propagation.

[0051] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention proposes a counter-attack method based on reconstructed data and alternative models. Specifically, the present invention designs a new generator, combines the residual module and DW convolution, and improves the performance of the generation model to generate more refined images. In addition, the present invention uses a pixel normalization module to stabilize the image generation process and reduce the occurrence of model collapse. Compared with previous alternative model attack methods, the method proposed by the present invention not only has a higher attack success rate, but also requires a lower query budget. It has important application value in counter-attack research, model security assessment and algorithm optimization, and provides a new perspective for research in the field of image recognition and security systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Flow chart of the method for countering attacks based on reconstructed data and alternative models in Example 1

[0053] Figure 2 The structure diagram of the generated model of Example 1

[0054] Figure 3 The residual module structure diagram of Example 1

[0055] Figure 4 Schematic diagram of data distribution in Example 1

[0056] Figure 5The accuracy and ASR correlation curve of the alternative model in Example 1 DETAILED DESCRIPTION

[0057] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0058] Reference Figure 1 The implementation steps of the present invention are described in further detail.

[0059] Example 1

[0060] Step 1: Build a generative model:

[0061] The structure of the generated model is as follows Figure 2 As shown, it includes three parts: feature reshaping, image feature generation and output.

[0062] The feature reshaping part described in step 1 maps the input noise vector to the high-dimensional feature space through the fully connected layer and reshapes it into a 4D tensor. After batch normalization, it is upsampled to increase the resolution of the feature map by 1 times to obtain the reshaped feature vector F 0 , and its expression formula is as follows:

[0063]

[0064] In the formula, represents the feature reshaping part, and z represents the input noise;

[0065] The image feature generation part described in step 1 consists of the PixelNorm normalization layer at the head and tail, two DR convolution modules in the middle, and one regular convolution module. The input reshaped features are used for feature generation in this stage to obtain the deep features F D-R , and its expression formula is as follows:

[0066]

[0067] In the formula, Represents deep features, Represents the convolution part;

[0068] The DR convolution module consists of a residual module, a 3*3DW convolution layer, a batch normalization layer, and a LeakyRelu activation function. Since the residual module increases the depth of the model, the amount of calculation of the model increases. Therefore, DW convolution is used instead of conventional convolution to reduce the number of parameters. The DW convolution is divided into depth convolution and point-by-point convolution. Its mathematical formula can be expressed as:

[0069]

[0070] Among them, Y is the output feature map of the depth convolution, Z is the output feature map of the point-by-point convolution, W is the weight of the convolution, i and j are the spatial position indexes of the output feature map, and c is the channel index;

[0071] The output after DW convolution can be expressed as:

[0072]

[0073] The residual module consists of two 3*3 convolutional layers, two batch normalization layers, and one Relu activation function. The structure of the residual module is as follows Figure 3 As shown;

[0074] The conventional convolution module consists of 1 upsampling layer, 1 3*3 convolution layer, 1 batch normalization layer and 1 LeakyRelu activation function layer;

[0075] The output part described in step 1 passes through a conventional convolution layer and the reconstructed image I is output after the Sigmoid activation function. Re , and its expression formula is as follows:

[0076]

[0077] In the formula, R(*) represents the output part.

[0078] Step 2: Select an alternative model:

[0079] The Resnet18 model is selected as the replacement model.

[0080] Step 3, generation and initialization of random noise and pseudo labels:

[0081] (3a) Randomly generate a batch of noise ,in, Represents standard normal distribution, each random noise is independently sampled from the standard normal distribution;

[0082] (3b) Each randomly generated noise z i Input the generative model and get the corresponding output reconstruction data x i , and then input it into the substitution model to obtain the output probability, and select the category corresponding to the maximum probability as the pseudo label y i , and finally get an initialized pseudo-label sequence .

[0083] Step 4: Construct a loss function to update the generated model:

[0084] In order to balance data distribution and improve data diversity, the cross entropy loss function and the information entropy loss function are combined to construct a combined loss function to update the generation model. The mathematical formula of the loss function is as follows:

[0085]

[0086] in, It represents the hyperparameter for adjusting the regularization value, which is set to 1 in the present invention, CE(*) represents the cross entropy loss function, S(*) is the output prediction result of the reconstructed data after passing through the replacement model S, Y is an output label randomly selected in the target model, z represents the noise vector of random input, k represents the number of categories, H(*) represents the information entropy loss, and G(*) represents the generated data.

[0087] Step 5: Construct the loss function of the distillation process:

[0088] like Figure 4 As shown in the figure, the samples generated by the previous methods are low in diversity and far from the classification boundary, such as the Low diversity part on the left. The surrogate model can easily learn these data, but overfitting will also occur. The expected data is the Desired data part on the right, which is more diverse, but some data also exists between the decision boundary of the target model and the surrogate model. Their existence affects the decision boundary of the surrogate model to approach the decision boundary of the target model. In order to solve this problem, the distillation loss function and the boundary loss function are combined to construct the BD combined loss function, giving more attention to these data, so that the surrogate model and the target model have a more consistent decision boundary, to ensure that the surrogate model can better learn the knowledge of the target model. The mathematical formula of this loss function can be expressed as:

[0089]

[0090] Among them, T(X) represents the prediction result of the target model, and S(X) represents the prediction result of the alternative model, that is, the student model. D(*) is a way to measure the difference between T(X) and S(X). In the label-only scenario, D(*) is the cross entropy loss function, and in the probability-only scenario, D(*) is l 2 1{*} means that when the values ​​in the brackets are different, 1 is returned; otherwise, 0 is returned.

[0091] Step 6: Collaborative substitution model training generates a model:

[0092] (6a) Randomly select the random noise z in step (3a) i As the input of the generative model, the output reconstructed data is obtained;

[0093] (6b) The reconstructed data is subjected to a combined enhancement operation, and its mathematical formula can be expressed as:

[0094]

[0095] Where p represents the size of the padding, which is set to 4 in the present invention, scale represents the cropping ratio, which is defined as [0.25, 1.0] in the present invention, size represents the output image size, and crop represents the cropping operation;

[0096] (6c) inputting the enhanced reconstructed data into the alternative model to obtain the model prediction results;

[0097] (6d) training the generative model based on the error between the prediction result of step (6c) and the pseudo label obtained in step (3b),

[0098] The Adam optimizer is used to update the model parameters, and the learning rate is set to 0.001.

[0099] Step 7: The collaborative generative model performs knowledge distillation training on the alternative model:

[0100] (7a) The alternative model is used as the student model and the target model is used as the teacher model for knowledge distillation training;

[0101] (7b) inputting the combined enhanced data obtained in step (6b) into the target model to obtain output labels or probability information;

[0102] (7c) The error between the prediction result obtained in (6c) and the output information in (7b) is calculated, and the alternative model is trained by backpropagation. The model parameters are updated using the Adam optimizer, and the learning rate is set to 0.01.

[0103] Step 8: Generate model and substitute model collaboratively iteratively update:

[0104] The generative model in step 6 and the surrogate model in step 7 are collaboratively iterated and updated. The number of training rounds is set to 400. In each round, the generative model is continuously optimized to generate new reconstructed data, and the reconstructed data is used to train and update the surrogate model. Finally, the optimal set of parameters after the loss function converges is selected as the prior knowledge of the generative model and the surrogate model.

[0105] Step 9: Attack the target model:

[0106] According to the prior knowledge of the alternative model, three attack methods, FGSM, PGD and BIM, are used to generate adversarial samples on the trained alternative model to attack the target model.

[0107] In order to better illustrate the technical effect of the present invention, in this embodiment, the method proposed by the present invention is compared quantitatively and qualitatively with the existing reconstruction method.

[0108] In the quantitative comparison, this method is quantitatively compared with the mainstream Knockoff, Dast, Del, DFME, and Daft methods. The present invention uses three benchmark datasets, including SVHN, Cifar10, and Cifar100, all of which use the Resnet18 model as the alternative model, Resnet34 as the target model on the SVHN and Cifar10 datasets, and Resnet50 as the target model on the Cifar100 dataset. Attack success rate (ASR) and query budget are used as evaluation indicators.

[0109] The quantitative comparison results of the method of the present invention and the above method are shown in Table 1. The data are expressed in percentage form, and the bold data represent the best results.

[0110] Table 1 Quantitative comparison of different methods on three datasets with 250K query budget

[0111]

[0112] It can be found from Table 1 that, compared with other methods, the method proposed in the present invention achieves the best attack success rate on each data set.

[0113] In the qualitative comparison, in order to prove the relationship between the success rate of the attack and the accuracy of the model, the present invention uses a line graph to conduct an experimental verification. The results are as follows: Figure 5 As shown, it can be seen that the success rate of the adversarial attack shows a positive correlation with the prediction accuracy of the alternative model, which also proves the effectiveness of the present invention.

[0114] In summary, compared with other advanced methods, the method proposed in the present invention has achieved the best attack success rate on three data sets with a small query budget. In addition, the training process is very stable, which reduces the probability of model collapse to a certain extent. The adversarial attack method based on reconstructed data and alternative models proposed in the present invention is a more effective alternative model attack method.

[0115] The above description is only a specific embodiment of the present invention and is not intended to limit the implementation methods of the present invention. However, professionals in this field should not make any modifications, equivalent substitutions, improvements, etc. that violate the spirit and principles of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for adversarial attack based on reconstructed data and alternative models, characterized in that: The following steps are involved: Step 1: Build a generative model, which consists of three parts: In the feature reshaping part, the input noise vector is mapped to the high-dimensional feature space through the fully connected layer and reshaped into a 4D tensor. After batch normalization, it is upsampled to increase the resolution of the feature map by 1 times. The image feature generation part consists of the PixelNorm normalization layer at the head and tail, two DR convolution modules in the middle, and one regular convolution module, which is used to generate image features; In the output part, after one conventional convolution layer and Sigmoid activation function, the reconstructed image is output; Step 2: Select an alternative model: Select an alternative model for the target black box model to be attacked; Step 3, generation and initialization of random noise and pseudo labels: (3a) Randomly generate a batch of noise ,in, represents the standard normal distribution, and all random noises are independently sampled from the standard normal distribution; (3b) Each randomly generated noise z i Input the generative model and get the corresponding output reconstruction data x i , and then input it into the substitution model to obtain the output probability, and select the category corresponding to the maximum probability as the pseudo label y i , and finally get an initialized pseudo-label sequence ; Step 4: Construct a loss function to update the generated model: In order to balance data distribution and improve data diversity, a combined loss function is constructed to update the generative model; Step 5: Construct the loss function of the distillation process: In order to make the output of the surrogate model and the target model consistent and make them have closer decision boundaries, a BD combination loss function is designed; Step 6: Collaborative substitution model training generates a model: (6a) Randomly select the random noise z in step (3a) i As the input of the generative model, the output reconstructed data is obtained; (6b) performing a combined enhancement operation on the reconstructed data; (6c) inputting the enhanced reconstructed data into the alternative model to obtain the model prediction results; (6d) training the generation model according to the error value between the prediction result of step (6c) and the pseudo label obtained in step (3b); Step 7: The collaborative generative model performs knowledge distillation training on the alternative model: (7a) The alternative model is used as the student model and the target model is used as the teacher model for knowledge distillation training; (7b) inputting the combined enhanced data obtained in step (6b) into the target model to obtain output labels or probability information; (7c) Calculate the error between the prediction result obtained in (6c) and the output information in (7b), and back-propagate to train the alternative model; Step 8: Generate model and substitute model collaboratively iteratively update: Set training rounds, perform collaborative iterative updates on the generative model in step 6 and the surrogate model in step 7, continuously optimize the generative model in each round to generate new reconstructed data, use the reconstructed data to train and update the surrogate model, and finally select the optimal set of parameters after the loss function converges as the prior knowledge of the generative model and the surrogate model; Step 9: Attack the target model: Based on the prior knowledge of the alternative model, adversarial samples are generated on the trained alternative model to attack the target model.

2. The method for countering attacks based on reconstructed data and alternative models according to claim 1, characterized in that: The feature reshaping part in step 1 consists of 1 Linear layer, 1 batch normalization layer and 1 upsampling layer; The image feature generation part in the step 1 includes the PixelNorm normalization layer at the head and the tail, 2 DR convolution modules and 1 conventional convolution module, wherein the DR convolution module consists of 1 residual module, 1 3*3DW convolution layer, 1 batch normalization layer and 1 LeakyRelu activation function; the residual module consists of 2 3*3 convolution layers, 2 batch normalization layers, and 1 Relu activation function; the conventional convolution module consists of 1 upsampling layer, 1 3*3 convolution layer, 1 batch normalization layer and 1 LeakyRelu activation function layer; The output part in step 1 is composed of a 3*3 convolutional layer and a Sigmoid activation function layer.

3. The method for counterattack based on reconstructed data and alternative models according to claim 1, characterized in that: The mathematical formula of the combined loss function in step 4 is as follows: ,in, represents the hyperparameter for adjusting the regularization value, CE(*) represents the cross entropy loss function, S(*) represents the output prediction result of the reconstructed data after passing through the replacement model S, Y is an output label randomly selected in the target model, z represents the noise vector of random input, k represents the number of categories, H(*) represents the information entropy loss, and G(*) represents the generated data.

4. The method for countering attacks based on reconstructed data and alternative models according to claim 1, characterized in that: The BD combined loss function in step 5 has the following mathematical formula: , where T(X) is the prediction result of the target model, S(X) is the prediction result of the alternative model, that is, the student model, and D(*) is a way to measure the difference between T(X) and S(X). In the label-only scenario, D(*) is the cross entropy loss function, and in the probability-only scenario, D(*) is the l2 norm. 1{*} means that when the values ​​in the brackets are different, 1 is returned; otherwise, 0 is returned.

5. The method for countering attacks based on reconstructed data and alternative models according to claim 1, characterized in that: The combined enhancement operation in step (6b) refers to performing a random cropping operation on the image in the global view and performing a random cropping and scaling operation on the image in the local view. The process can be described as follows: , where p represents the padding size, scale represents the cropping ratio, size represents the output image size, and crop represents the cropping operation.

Images