A method and device for countering attacks by manipulating training energy consumption

Abstract

The present invention discloses a method and device for manipulating training energy consumption against attacks, and relates to the field of artificial intelligence security. It is used to solve the problem of aggravating the energy cost of large model training due to the lack of analysis and understanding of the principle of manipulating training energy consumption against attacks and designing detection and defense strategies. The method includes: training data samples and a large model to be trained, determining the current gradient value, the gradient value of the previous iteration, and the gradient difference of the large model to be trained; when updating the adversarial disturbance according to the optimization algorithm, if the optimal adversarial disturbance satisfies the maximization of the upper optimization objective function, then obtaining a perturbation sample according to the training data sample and the adversarial disturbance; if the current gradient value is equal to the gradient value of the objective function of the large model to be trained with respect to the weight parameter of the large model to be trained, then determining the optimal weight parameter of the large model to be trained by minimizing the loss function of the large model to be trained.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security, and more specifically to a method and device for countering attacks by manipulating training energy consumption. Background Art

[0002] With the development of artificial intelligence technology, especially in the fields of natural language processing (NLP) and computer vision (CV), large models such as BERT (Bidirectional Encoder Representations from Transformers) and GPT (Generative Pretrained Transformer) continue to emerge with super semantic understanding and content generation capabilities. However, in the process of large model training, not only does the dependence on high-performance computing resources increase rapidly, but also the consumption of high-power electric energy increases sharply. Large model training consumes a lot of energy, which has an adverse impact on building an environmentally friendly intelligent society. Massive training data and huge model parameters are crucial to improving the performance of large models, but processing large-scale data requires more computing resources and time, which leads to increased energy consumption.

[0003] Generally, GPU (Graphics Processing Unit) chips with higher performance in terms of main frequency, number of cores, cache size, etc. can complete computing tasks in a shorter time, but they will also consume more power and generate a lot of heat. If the heat dissipation is poor, it will not only lead to a decline in hardware performance, but may even damage the equipment, and will indirectly affect the computing efficiency and energy consumption of the hardware. During the training of large models, the training tasks are distributed to multiple computing units for parallel computing, thereby speeding up the training speed and reducing the training time and energy consumption. However, if the distributed training architecture is unreasonable, it may lead to frequent communication between computing nodes and excessive synchronization overhead, which may increase energy consumption.

[0004] However, if carefully designed adversarial perturbations are mixed into the training data and act on the gradients of back propagation during large model training, the algorithm convergence will be delayed, thereby increasing the training energy consumption. Existing research has not paid attention to the possibility of data quality and optimization algorithms manipulating training time, has not analyzed the energy efficiency impact of such adversarial attacks, and lacks an understanding of the principles of adversarial attacks that manipulate training energy consumption and the design of corresponding detection and defense strategies, which may ultimately increase the energy cost of large model training. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for resisting attacks on manipulating training energy consumption, so as to solve the problem of increasing the energy consumption of large model training due to lack of analysis and understanding of the principles of resisting attacks on manipulating training energy consumption and designing detection and defense strategies.

[0006] The embodiment of the present invention provides a method for resisting attacks by manipulating training energy consumption, comprising:

[0007] Acquire a data set containing multiple types of information, and select training data samples carrying multimodal data samples from the data set, wherein the training data samples are used to train the large model to be trained;

[0008] According to the training data sample and the large model to be trained, determine the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the current iteration, the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the previous iteration, and the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function;

[0009] When updating the adversarial disturbance according to the optimization algorithm, if the determined optimal adversarial disturbance satisfies the maximization of the upper-layer optimization objective function, the control factor of the adversarial disturbance size is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, a perturbation sample is obtained according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor;

[0010] The perturbation sample is input into the large model to be trained, and the large model to be trained obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained, the optimal weight parameters of the large model to be trained are determined by minimizing the objective function of the large model to be trained.

[0011] Preferably, the optimal counter-perturbation satisfies the maximization of the upper layer optimization objective function and is expressed by the following formula:

[0012] Δx * ∈max‖Δg‖ p -λ‖Δx‖ p

[0013] The control factor of the magnitude of the counter-perturbation is greater than the norm of the counter-perturbation and the norm of the gradient difference is greater than the first threshold, which is expressed by the following formula:

[0014] st‖Δx‖ p ≤η

[0015] ‖Δg‖ p ≥∈+Δ∈

[0016] The disturbance sample is expressed by the following formula:

[0017] x ′ =x+Δx

[0018] Where Δx * represents the optimal adversarial perturbation, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, Δx represents the adversarial perturbation, λ represents the regularization coefficient, ‖·‖ p represents the p-norm, η represents the control factor of the size of the adversarial disturbance, ∈ represents the training optimization termination condition threshold of the large model to be trained, Δ∈ represents the size control factor of the gradient difference, x represents the training data sample, x ′ represents the perturbation sample.

[0019] Preferably, the optimal weight parameter of the large model to be trained is expressed by the following formula:

[0020]

[0021] Among them, ω * represents the optimal weight parameter obtained by optimizing the large model to be trained, ω * =argminJ(ω), argmin means that the value returned is the value that makes ω * The value of J(ω) that obtains the minimum value, ω represents the weight parameter of the large model to be trained, g k It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration. represents the first gradient value of J(ω) with respect to ω, J(ω) represents the objective function of the large model to be trained, ω k represents the weight parameter of the large model to be trained at the kth iteration, ω k-1 represents the weight parameter of the large model to be trained at the k-1th iteration, η represents the control factor of the disturbance size, and g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. represents the first gradient value of J(ω) with respect to ω at the k-1th iteration.

[0022] Preferably, the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function is determined by the following formula:

[0023] Δg=g k -g k-1

[0024]

[0025] Among them, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, and g k represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration, g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. represents the first gradient value of J(ω) with respect to ω at the k-1th iteration, and η represents the control factor against the disturbance size.

[0026] Preferably, the multimodal data sample includes any one of the following modalities:

[0027] Text and image modalities of pictures and text descriptions corresponding to said pictures;

[0028] Text and audio modalities of audio and text description corresponding to said audio;

[0029] Video, audio and text description corresponding to the video and audio, video and audio modalities.

[0030] Preferably, before determining the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function, the method further includes:

[0031] Presetting a regularization coefficient for regulating the optimization target weight included in the large model to be trained, wherein the regularization coefficient is proportional to the noise included in the training data sample;

[0032] Presetting a training optimization termination condition threshold of the large model to be trained included in the large model to be trained, wherein the training optimization termination condition threshold of the large model to be trained is inversely proportional to the training time length of the large model to be trained;

[0033] Presetting a magnitude control factor of the gradient difference included in the large model to be trained, wherein the magnitude control factor of the gradient difference is inversely proportional to the convergence of the large model to be trained;

[0034] A regulating factor of the magnitude of the adversarial disturbance included in the large model to be trained is preset, and the regulating factor of the magnitude of the adversarial disturbance is used to control the intensity of the adversarial disturbance.

[0035] An embodiment of the present invention provides an anti-attack device for controlling training energy consumption, comprising:

[0036] An acquisition unit, used to acquire a data set containing multiple types of information, and select training data samples carrying multimodal data samples from the data set, wherein the training data samples are used to train the large model to be trained;

[0037] A first determination unit is used to determine, based on the training data sample and the large model to be trained, a gradient value of the large model to be trained with respect to the upper-layer optimization objective function in a current iteration, a gradient value of the large model to be trained with respect to the upper-layer optimization objective function in a previous iteration, and a gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function;

[0038] The obtaining unit updates the adversarial disturbance according to the optimization algorithm, and if the determined optimal adversarial disturbance satisfies the maximization of the upper-layer optimization objective function, the control factor of the adversarial disturbance size is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, a perturbation sample is obtained according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor;

[0039] The second determination unit is used to input the perturbation sample into the large model to be trained, and the large model to be trained obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained, the optimal weight parameters of the large model to be trained are determined by minimizing the objective function of the large model to be trained.

[0040] An embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes any one of the above-mentioned methods for countering attacks on manipulating training energy consumption.

[0041] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor executes any one of the above-mentioned methods for countering attacks on manipulating training energy consumption.

[0042] The embodiment of the present invention provides a method and device for manipulating training energy consumption to counterattack, the method comprising: obtaining a data set containing multiple types of information, selecting a training data sample carrying a multimodal data sample from the data set, the training data sample being used to train a large model to be trained; determining, based on the training data sample and the large model to be trained, a gradient value of the large model to be trained with respect to an upper-layer optimization objective function in a current iteration, a gradient value of the large model to be trained with respect to an upper-layer optimization objective function in a previous iteration, and a gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function; when updating the counterattack according to the optimization algorithm, if the determined optimal counterattack satisfies the maximization of the upper layer The objective function is optimized, the control factor of the size of the adversarial disturbance is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, and a perturbation sample is obtained according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the size control factor of the gradient difference; the perturbation sample is input into the large model to be trained, and the large model to be trained obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained, the optimal weight parameters of the large model to be trained are determined according to the minimization of the objective function of the large model to be trained. This method reduces the training energy consumption of the large model to be trained by performing attack detection and perturbation cleaning on the training data samples used for the large model to be trained; the method adopts a two-layer optimization architecture, and the upper layer optimization is committed to maximizing the gradient difference metric, which can delay the convergence of the lower layer training process and increase the training time, thereby effectively reducing the training energy consumption; at the same time, the upper layer optimization will also minimize the adversarial perturbation metric to obtain imperceptible tiny perturbations, greatly enhancing the concealment of adversarial attacks. In the adversarial attack environment, by minimizing the loss function of the large model to be trained, the stochastic gradient descent back propagation method is used to carry out training, and finally the optimal weight parameters of the large model to be trained are obtained. This method constructs an adversarial attack model based on a two-layer optimization framework, integrates the generated adversarial samples into the training data samples, and successfully reduces its training energy consumption without damaging the pattern recognition ability of the large model to be trained. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0044] Figure 1A schematic diagram of a flow chart of a method for countering an attack by manipulating training energy consumption provided by an embodiment of the present invention;

[0045] Figure 2 A schematic diagram of the structure of an anti-attack device for controlling training energy consumption provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Figure 1 A flowchart of a method for countering an attack by manipulating training energy consumption provided by an embodiment of the present invention is shown below. Figure 1 As an example, a method for countering attacks by manipulating training energy consumption provided by an embodiment of the present invention is introduced. Figure 1 As shown, the method comprises the following steps:

[0048] Step 101, obtaining a data set containing multiple types of information, selecting a training data sample carrying multiple modal information from the data set, and the training data sample is used to train the large model to be trained;

[0049] Step 102, determining the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the current iteration, the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the previous iteration, and the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function according to the training data sample and the large model to be trained;

[0050] Step 103, when updating the adversarial disturbance according to the optimization algorithm, if the determined optimal adversarial disturbance satisfies the maximization of the upper-layer optimization objective function, the control factor of the adversarial disturbance size is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, a perturbation sample is obtained according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor;

[0051] Step 104, input the perturbation sample into the large model to be trained, and the large model to be trained obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained, the optimal weight parameters of the large model to be trained are determined by minimizing the objective function of the large model to be trained.

[0052] In step 101, data collection is required first. Specifically, data collection can obtain data from public data sets, collect data through sensors, obtain data through network crawling, and obtain data from internal data sets of enterprises.

[0053] Furthermore, data from public datasets can come from image-related datasets, such as the ImageNet dataset, which has a large number of annotated images and can be used for training and research on tasks such as image recognition and classification; the COCO (Common Objects in Context) dataset, which contains images, rich object detection, segmentation and other annotation information, etc. Data from text-related datasets, such as Wikipedia, which covers knowledge in various fields and can be used as a text modality, and SQuAD (Stanford Question Answering Dataset), which studies multimodal tasks such as text understanding and question-answering systems. Data from audio-related datasets, such as the LibriSpeech dataset, which contains a large amount of audio data of audio books and can be used for research on audio-related multimodal tasks such as speech recognition and speech synthesis.

[0054] Furthermore, data collected by sensors can come from the field of intelligent transportation. Through sensors such as cameras, radars, GPS (Global Positioning System) installed on vehicles, multimodal data such as images, videos, positions, speeds, etc. during vehicle driving can be obtained. Data can also come from the medical field, such as CT (Computed Tomography) scanners, MRI (Magnetic Resonance Imaging) machines, electrocardiographs and other medical equipment.

[0055] In an embodiment of the present invention, data can be obtained by web crawling. Specifically, a web crawler program can be written to obtain multimodal data from the Internet, such as obtaining pictures, texts, videos and other information posted by users from social media platforms, or obtaining news articles and related pictures and other content from news websites.

[0056] Furthermore, the data originating from within the enterprise can be multimodal information such as users’ purchase records, product images, user reviews, etc. owned by e-commerce enterprises; or multimodal data such as customers’ transaction data, identity information, document materials, etc. owned by financial enterprises.

[0057] In the embodiment of the present invention, the data collection method is not specifically limited.

[0058] Furthermore, after obtaining a data set containing multiple types of information, it is necessary to further confirm the multimodal data sample. In the embodiment of the present invention, the multimodal data sample has various forms, including any of the following modes:

[0059] 1) Text and image modalities of images and text descriptions corresponding to the images. For example, in an image description task, the data sample contains an image and a text description of the image. This form of multimodal data sample allows the model to learn both the visual features of the image and the corresponding text semantic features, thereby better understanding the content of the image.

[0060] 2) Audio and the text and audio modality of the corresponding text description of the audio. In speech recognition and speech synthesis tasks, the data sample may contain an audio file and the corresponding text transcription; or in some audio content analysis tasks, the audio file will be combined with relevant text comments, introductions, etc., so that the model can comprehensively analyze the characteristics of audio and text.

[0061] 3) Video, audio, and the corresponding text descriptions of the video and audio, that is, text, video, and audio modalities. In the task of video content analysis, the data sample will contain video files, audio tracks, and related text descriptions, such as the video title, introduction, subtitles, etc. This multimodal data allows the model to understand the content of the video from three aspects: vision, hearing, and text, and improve the accuracy of the analysis.

[0062] 4) In some industrial applications or smart devices, data samples may come from multiple different types of sensors, such as temperature sensors, pressure sensors, displacement sensors, etc. The fusion of these sensor data can provide more comprehensive information and help the model better understand and predict the state or behavior of the system.

[0063] It should be noted that after confirming the training data samples for training, it is necessary to confirm the large model to be trained for training. In an embodiment of the present invention, a specific architecture capable of processing multimodal data samples will be used to process data samples of different modalities in different layers or modules, and then their features will be fused. For example, a transformer structure is used to encode data samples of different modalities, such as one for image modality and one for text modality, and then their encoding results are input into a cross-modal transformer for fusion and learning. For text and image modalities, the image is first encoded using a visual transformer to obtain an image feature representation, and then the text is encoded using a language transformer to obtain a text feature representation. Finally, these two feature representations are input into a cross-modal transformer to learn the association information between the image and the text.

[0064] In practical applications, the loss function is used to measure the difference between the model's predicted results and the actual results. In the training of multimodal data samples, it needs to be designed according to the characteristics of multimodality. Common loss functions include contrast loss, cross entropy loss, etc. For example, for data in text and image modalities, a contrast loss function can be designed to make similar texts and images closer in the feature space, and dissimilar texts and images farther in the feature space. If it is a classification task, the cross entropy loss function is also used to measure the difference between the category probability predicted by the model and the actual category.

[0065] Furthermore, commonly used optimization algorithms include Stochastic Gradient Descent (SGD) and its variants, such as Adagrad (Adaptive Gradient Algorithm), Adadelta (Adaptive Learning Rate Method), RMSProp (Root Mean Square Propagation), and Adam (Adaptive Moment Estimation). These optimization algorithms are used to update the parameters of the model to minimize the loss function.

[0066] In an embodiment of the present invention, once a data set covering various types of information is obtained, the first task is to preprocess the training data samples used for training. Among them, the preprocessing for images includes cropping, scaling and normalization operations, while for texts, word segmentation and word vector conversion and other processing are required to obtain training data samples that can be used to train the large model. Subsequently, the training data samples are input into the large model to be trained, and the prediction results of the model are calculated with the help of forward propagation. Based on the predicted results and the actual results, the value of the loss function is calculated. Next, the back propagation algorithm is used to calculate the impact of the loss function on the gradient of the parameters of the large model to be trained. Finally, the optimization algorithm is used to update the parameters of the large model to be trained according to the gradient. This cycle is repeated until the large model to be trained converges or reaches a preset number of training rounds.

[0067] The parameters obtained after the training is completed are actually the results of the large model to be trained after learning multimodal data. These parameters contain the correlation information between different modal data, their respective feature representations, and the understanding and cognition of related tasks. Take the text and image modality classification task as an example. The parameters of the large model to be trained after training have the ability to accurately predict the category to which it belongs when receiving input text and image information. These parameters play a key role in the reasoning and prediction process of the model. Once new multimodal data is input, the model can quickly obtain prediction results based on these parameters.

[0068] The adversarial attack method for manipulating training energy consumption proposed in the embodiment of the present invention aims to influence the energy consumption of the large model to be trained by means of carefully designed adversarial samples during the training process. In this process, it is necessary to follow specific constraints and explore the optimal perturbation of the training data samples, thereby causing certain indicators of the large model to be trained to change in the expected direction during training, and finally achieving the effect of affecting energy consumption. This method adopts a two-layer optimization framework, in which the upper-layer optimization focuses on finding the optimal perturbation that can effectively change the gradient of the large model to be trained and meet certain sample perturbation restrictions; the lower-layer optimization adjusts the parameters of the large model to be trained based on the given perturbation samples, so as to adapt to the corresponding perturbation samples.

[0069] In step 102, in the upper layer optimization loop, in each upper layer optimization iteration, for the current training data sample and the parameters included in the large model to be trained, it is necessary to determine the gradient value of the large model to be trained with respect to the upper layer optimization objective function in the current iteration, the gradient value of the large model to be trained with respect to the upper layer optimization objective function in the previous iteration, and further determine the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function; wherein, the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function is expressed by the following formula:

[0070] Δg=g k -g k-1 (1)

[0071] Among them, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, and g k represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration, g k-1 Represents the gradient value of the large model to be trained with respect to the upper-layer optimization objective function at the k-1th iteration.

[0072] Furthermore, when the optimization algorithm is used to update the adversarial perturbation, if the optimal adversarial perturbation satisfies the maximization of the upper-level optimization objective function and also satisfies the two constraints, the perturbation sample can be obtained.

[0073] Specifically, the optimal adversarial perturbation satisfies the maximum upper optimization objective function expressed by the following formula:

[0074] Δx * ∈max‖Δg‖ p -λ‖Δx‖ p (2)

[0075] Where Δx * represents the optimal adversarial perturbation, Δg represents the gradient difference between the kth iteration and the 1-1th iteration of the upper optimization objective function of the large model to be trained, Δx represents the adversarial perturbation, λ represents the regularization coefficient, ‖·‖ p represents the p-norm.

[0076] It should be noted that, in the embodiment of the present invention, the optimization algorithm may adopt a gradient ascent algorithm, that is, through the gradient ascent algorithm, the gradient value of the large model to be trained with respect to the upper layer optimization objective function in the current iteration is obtained, specifically:

[0077]

[0078] Among them, g k represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration, g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. In practical applications, g k-1 It is the starting point of gradient update. In each iteration, the gradient value of the current iteration needs to be adjusted based on the gradient value obtained in the previous iteration and other factors. Indicates that at the k-1th iteration, J(ω k-1 )About k-1 The first gradient value of , η represents the control factor against the disturbance size.

[0079] Furthermore, the two constraints include sample perturbation constraint and gradient change constraint, which can be expressed by the following formulas respectively:

[0080] st‖Δx‖ p ≤η (4)

[0081] ‖Δg‖ p ≥∈+Δ∈ (5)

[0082] Among them, η represents the control factor of the size of the adversarial disturbance, ∈ represents the training optimization termination condition threshold of the large model to be trained, and Δ∈ represents the size control factor of the gradient difference. It should be noted that the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the size control factor of the gradient difference, that is, in practical applications, the norm of the gradient difference needs to be greater than the sum of the training optimization termination condition threshold of the large model to be trained and the size control factor of the gradient difference.

[0083] Furthermore, after obtaining the optimal perturbation that satisfies the constraints according to the above formula, the perturbation sample can be obtained according to the following formula:

[0084] x ′ =x+Δx (6)

[0085] Among them, Δx represents the training data sample, x ′ represents the perturbation sample.

[0086] In step 103, in the lower layer, according to the perturbation samples determined by the upper layer, the perturbation samples are input into the large model to be trained. The large model to be trained obtains different gradient values ​​at each iteration, and the large model to be trained can also obtain different weight parameters at each iteration. The weight parameters of the large model to be trained and the objective function of the large model to be trained can determine the first gradient value of the objective function with respect to the weight parameters. Therefore, the lower layer aims to minimize the objective function of the large model to be trained, and at the same time, it must satisfy the gradient relationship of the large model to be trained under the current perturbation, and determine the optimal weight parameters of the large model to be trained. That is, when the perturbation samples are input into the large model to be trained, if the gradient value of the large model to be trained with respect to the upper layer optimization objective function in the current iteration is determined to be equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained during the iteration, then the optimal weight parameters of the large model to be trained can be determined, as shown below:

[0087]

[0088] Among them, ω * represents the optimal weight parameter obtained by optimizing the large model to be trained, ω represents the weight parameter of the large model to be trained, and g k represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration, J(ω) represents the objective function of the large model to be trained, Represents the first gradient value of J(ω) with respect to ω. That is, after determining the perturbation sample, the large model to be trained needs to find the weight parameter ω that minimizes the objective function J(ω) of the large model to be trained, and at this time, the gradient value at the kth iteration must be equal to the first gradient value of the objective function J(ω) of the large model to be trained with respect to the parameter ω.

[0089] In practical applications, when solving the underlying optimization problem ω* =argminJ(ω), the conditions must be met at the same time The gradient descent method is usually used to update the parameters, that is, the parameters are updated through the following formula:

[0090]

[0091] Among them, α represents the learning rate, ω k represents the weight parameter of the large model to be trained at the kth iteration, ω k-1 represents the weight parameter of the large model to be trained at the k-1th iteration, Indicates that at the k-1th iteration, J(ω k-1 )About k-1 The first gradient value of .

[0092] Furthermore, the learning rate in formula (8) is replaced by the control factor η of the disturbance size, that is, the weight parameters determined by the large model to be trained at each iteration can be obtained, as shown below:

[0093]

[0094] Among them, ω k represents the weight parameter of the large model to be trained at the kth iteration, ω k-1 represents the weight parameter of the large model to be trained at the k-1th iteration, η represents the control factor of the disturbance size, and g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. Indicates that at the k-1th iteration, J(ω k-1 )About k-1 The first gradient value of .

[0095] In the embodiment of the present invention, in the process of determining the weight parameters of the large model to be trained at each iteration according to formula (9), it is necessary to repeatedly perform the upper layer optimization and the lower layer optimization. After each iteration, it is necessary to verify whether the convergence condition is met. If the convergence condition is met, the iteration can be stopped. If not, it is necessary to adjust the control factor of the anti-disturbance size or use other algorithms to ensure that the condition is met.

[0096] It should be noted that, in the embodiment of the present invention, η represents the control factor of the adversarial perturbation size. By setting different control factors of the adversarial perturbation size, the strength of the adversarial perturbation can be controlled. Specifically, when η=0, adversarial samples cannot be generated, the adversarial attack fails, the training process of the large model to be trained is normal, and the training energy consumption does not increase additionally. When η>0, adversarial samples are generated, and the training time of the large model to be trained will increase additionally.

[0097] Furthermore, ∈ represents the training optimization termination condition threshold of the large model to be trained. When the training optimization termination condition threshold of the large model to be trained is set differently, the training duration and delay intensity of the large model to be trained can be manipulated. If you want the large model to be trained to be more fully trained and to achieve higher accuracy, you can set the value of ∈ to a relatively small value. If the training accuracy requirement for the large model is not very high, or in order to speed up the training of the large model to be trained, you can appropriately increase the value of ∈.

[0098] Furthermore, Δ∈ represents a gradient difference regulation factor. The value of Δ∈ is usually related to ∈ and the convergence characteristics of the large model to be trained. If the large model to be trained is prone to fall into a local optimal solution, the value of Δ∈ can be appropriately increased to make the gradient difference range relatively small, and the large model to be trained can be optimized under a more stable gradient change. If the large model to be trained is close to the convergence stage, the value of Δ∈ can be appropriately reduced, which will help the large model to be trained to adjust parameters more finely and stably reach the optimal solution.

[0099] Furthermore, λ represents the regularization coefficient, which is mainly used to balance the two terms in the optimization objective function, namely the norm of the gradient difference ‖Δg‖ p and the norm of the adversarial perturbation ‖Δx‖ p ; In practical applications, the role of the regularization coefficient is to prevent overfitting and improve the generalization ability of the large model to be trained by limiting the complexity of the large model to be trained. For example, if the noise in the training data samples is large or the structure of the large model to be trained is relatively complex, overfitting is prone to occur. The value of the regularization coefficient can be appropriately increased so that the large model to be trained pays more attention to the norm of the disturbance during the optimization process to avoid overfitting of the training data samples to the large model to be trained. On the contrary, if the training data samples are relatively clean and the structure of the large model to be trained is relatively simple, the value of the regularization coefficient can be appropriately reduced so that the large model to be trained pays more attention to the change of the gradient difference to speed up the training of the large model to be trained.

[0100] It should be noted that the model to be trained provided in the embodiment of the present invention includes a modal data processing module, a gradient calculation and storage module, an adversarial disturbance processing module and a weight parameter update module. These modules can also be divided into upper-level optimization problems and lower-level optimization problems.

[0101] Specifically, since the training data samples used in the embodiments of the present invention include information of multiple modalities, the large model to be trained needs to have processing parts for different modalities, and also needs a cross-modal fusion module that can fuse features extracted from different modalities, that is, a multimodal data processing module.

[0102] Furthermore, the large module to be trained needs to have a part for calculating and storing the gradient value obtained during the training process, that is, in each iteration, the gradient value g of the large model to be trained with respect to the upper-level optimization objective function in the current iteration needs to be calculated through the back propagation algorithm according to the training data samples and the model parameters included in the large model to be trained. k , and can also store the gradient value g of the upper optimization objective function of the large model to be trained in the previous iteration k-1 At the same time, the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-level optimization objective function can also be determined according to formula (1), that is, the gradient calculation and storage module.

[0103] Furthermore, the large module to be trained needs to update the adversarial perturbation according to the upper layer optimization objective function. The large model to be trained accepts parameters such as gradient difference Δg and regularization coefficient λ, and calculates the optimal adversarial perturbation Δx according to formula (2): * At the same time, the adversarial disturbance size control factor η and the constraints of the gradient difference expressed by formula (4) and formula (5) are also considered. The adversarial disturbance processing module interacts with the gradient technology module and the data processing module, because the update of the adversarial disturbance will affect the processing of the training data samples by the large model to be trained, thereby affecting the calculation of the gradient.

[0104] Furthermore, the large module to be trained is optimized according to the requirements of the lower layer, when it satisfies the formula (7) When the weight parameter ω of the large model to be trained is updated according to the principle of minimizing the objective function, the weight parameter update module can use formula (8) to update the weight parameter, and it needs to work closely with the gradient calculation module, because the update of the weight parameter is determined based on the gradient difference, which will also affect the subsequent calculation of the gradient value of the large model to be trained.

[0105] Specifically, the upper-level optimization problem mainly focuses on the update of adversarial disturbances and the processing of gradient differences. In the large model to be trained, the adversarial disturbance processing module and the gradient calculation and storage module are closely related to the upper-level optimization problem. By calculating the gradient difference Δg, and based on it, the optimal adversarial disturbance Δx is found. * , to maximize the upper optimization objective function and related constraints, namely, formula (2), formula (4) and formula (5). This process is to introduce appropriate adversarial perturbations during the training process, change the gradient value of the large model to be trained, and thus affect the training direction of the large model to be trained; the lower optimization problem focuses on adjusting the weight parameter ω of the large model to be trained according to the given perturbation sample. In the large model to be trained, the weight parameter update module is the key part of the lower optimization. When the perturbation sample is input into the large model to be trained, by checking the current gradient g k The first gradient value of the objective function of the large model to be trained with respect to the weight parameter Are they equal? ​​Then, the weight parameter ω is updated according to the principle of minimizing the loss function to adapt to the perturbation samples and optimize the large model to be trained.

[0106] It should be noted that the result of the upper-level optimization problem (i.e., the generated adversarial perturbation) provides an opportunity for the lower-level optimization problem to change the weight parameters of the large model to be trained. After the lower-level optimization problem adjusts the weight parameters of each iteration according to the perturbation samples generated by the upper-level optimization problem, it will affect the gradient calculation of the large model to be trained in subsequent iterations, and then feedback to the upper-level optimization problem. This interaction allows the large model to be trained to continuously adjust under the two-layer optimization framework and gradually find the optimal weight parameter ω * , improve the processing ability and generalization performance of large models to be trained on multimodal data.

[0107] The embodiment of the present invention provides an adversarial attack method for manipulating training energy consumption. The method reduces the training energy consumption of the large model to be trained by performing attack detection and disturbance cleaning on the training data samples for the large model to be trained. The method adopts a two-layer optimization architecture, and the upper layer optimization is committed to maximizing the gradient difference metric, which can delay the convergence of the lower layer training process and increase the training time, thereby effectively reducing the training energy consumption. At the same time, the upper layer optimization will also minimize the adversarial disturbance metric, thereby obtaining imperceptible tiny disturbances, greatly enhancing the concealment of the adversarial attack. In the adversarial attack environment, by minimizing the loss function of the large model to be trained, the stochastic gradient descent back propagation method is used to carry out training, and finally the optimal weight parameters of the large model to be trained are obtained. The method constructs an adversarial attack model based on a two-layer optimization framework, integrates the generated adversarial samples into the training data samples, and successfully reduces its training energy consumption without damaging the pattern recognition ability of the large model to be trained.

[0108] Based on the same inventive concept, an embodiment of the present invention provides an anti-attack device for manipulating training energy consumption. Since the principle of solving the technical problem of the device is similar to a method for manipulating training energy consumption to resist attacks, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0109] Figure 2 A schematic diagram of the structure of an anti-attack device for controlling training energy consumption provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the device includes: an acquisition unit 201, a first determination unit 202, a obtaining unit 203 and a second obtaining unit 204.

[0110] An acquisition unit 201 is used to acquire a data set containing multiple types of information, and select a training data sample carrying a multimodal data sample from the data set, wherein the training data sample is used to train a large model to be trained;

[0111] A first determining unit 202 is used to determine, based on the training data sample and the large model to be trained, a gradient value of the large model to be trained with respect to the upper layer optimization objective function in a current iteration, a gradient value of the large model to be trained with respect to the upper layer optimization objective function in a previous iteration, and a gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function;

[0112] Obtaining unit 203, when updating the adversarial disturbance according to the optimization algorithm, if the determined optimal adversarial disturbance satisfies the maximization of the upper-layer optimization objective function, the control factor of the adversarial disturbance size is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, obtaining a perturbation sample according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor;

[0113] The second determination unit 204 is used to input the perturbation sample into the large model to be trained, and the large model to be trained obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameters of the large model to be trained, the optimal weight parameters of the large model to be trained are determined by minimizing the objective function of the large model to be trained.

[0114] It should be understood that the units included in the above-mentioned anti-attack device for manipulating training energy consumption are only logical divisions based on the functions implemented by the device. In practical applications, the above-mentioned units can be superimposed or split. In addition, the functions implemented by the anti-attack device for manipulating training energy consumption provided in this embodiment correspond one-to-one to the anti-attack method for manipulating training energy consumption provided in the above-mentioned embodiment. The more detailed processing flow implemented by the device has been described in detail in the above-mentioned method embodiment 1, and will not be described in detail here.

[0115] Another embodiment of the present invention also provides a computer device, which includes: a processor and a memory; the memory is used to store computer program code, and the computer program code includes computer instructions; when the processor executes the computer instructions, the electronic device executes each step of the anti-attack method for manipulating training energy consumption in the method flow described in the above method embodiment.

[0116] Another embodiment of the present invention further provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on a computer device, the computer device executes each step of the anti-attack method for manipulating training energy consumption in the method flow described in the above method embodiment.

[0117] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0118] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A method for manipulating training energy consumption to counterattack, characterized in that: include: Using web crawling technology and sensor data acquisition interfaces to obtain a data set containing multiple types of information from the enterprise's internal data set, and selecting training data samples carrying multimodal data samples from the data set based on the completeness and accuracy of the data and the application scenario of the large model to be trained. The training data samples are used to train the large model to be trained on a computing device with specific technical capabilities; Input the training data sample into the large model to be trained, and determine the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the current iteration, the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the previous iteration, and the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function according to the training data sample and the large model to be trained by running a program based on the back propagation algorithm on a computing device; When the adversarial disturbance is updated by the gradient ascent algorithm, if the determined optimal adversarial disturbance satisfies the maximization of the upper-layer optimization objective function, the control factor of the adversarial disturbance size is greater than the norm of the adversarial disturbance, and the norm of the gradient difference is greater than a first threshold, a perturbation sample is obtained according to the training data sample and the adversarial disturbance, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor; The perturbation sample is input to the computing device equipped with the large model to be trained through a data transmission interface, and the computing device obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameter of the large model to be trained, the optimal weight parameter of the large model to be trained is determined by minimizing the objective function of the large model to be trained; the large model to be trained including the optimal weight parameter is deployed to a cloud platform in the field of natural language processing or computer vision; The multimodal data sample includes any of the following modalities: Using images acquired by an image acquisition device and text descriptions corresponding to the images obtained by text recognition software or annotation to form text and image modalities; Using the audio collected by the audio collection device and the text description corresponding to the audio obtained by voice-to-text conversion to form a text and audio modality; The video and audio acquired by the video recording device and the text description corresponding to the video and audio acquired by the video content analysis tool form text, video and audio modalities; The optimal counter-perturbation satisfies the maximum upper optimization objective function expressed by the following formula: Δx * ∈max‖Δg‖ p -λ‖Δx‖ p The control factor of the magnitude of the counter-perturbation is greater than the norm of the counter-perturbation and the norm of the gradient difference is greater than the first threshold, which is expressed by the following formula: s.t.‖Δx‖ p ≤η ‖Δg‖ p ≥∈+Δ∈ The disturbance sample is expressed by the following formula: x′=x+Δx Where Δx * represents the optimal adversarial perturbation, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, Δx represents the adversarial perturbation, λ represents the regularization coefficient, ‖·‖ p represents the p-norm, η represents the control factor of the anti-perturbation size, ∈ represents the training optimization termination condition threshold of the large model to be trained, Δ∈ represents the size control factor of the gradient difference, x represents the training data sample, and x′ represents the perturbation sample.

2. The method according to claim 1, characterized in that The optimal weight parameter of the large model to be trained is expressed by the following formula: Among them, ω * represents the optimal weight parameter obtained by optimizing the large model to be trained, ω * =argminJ(ω), argmin means that the value returned is the value that makes ω * The value of J(ω) that obtains the minimum value, ω represents the weight parameter of the large model to be trained, g k It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration. represents the first gradient value of J(ω) with respect to ω, J(ω) represents the objective function of the large model to be trained, ω k represents the weight parameter of the large model to be trained at the kth iteration, ω k-1 represents the weight parameter of the large model to be trained at the k-1th iteration, η represents the control factor of the disturbance size, and g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. Indicates that at the k-1th iteration, J(ω k-1 )About k-1 The first gradient value of .

3. The method according to claim 1, characterized in that The gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function is determined by the following formula: Δg=g k -g k-1 Among them, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, and g k represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the kth iteration, g k-1 It represents the gradient value of the large model to be trained with respect to the upper optimization objective function at the k-1th iteration. Indicates that at the k-1th iteration, J(ω k-1 )About k-1 The first gradient value of , η represents the control factor against the disturbance size.

4. The method according to claim 1, characterized in that Before determining the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper layer optimization objective function, the method further includes: Presetting a regularization coefficient for regulating the optimization target weight included in the large model to be trained, wherein the regularization coefficient is proportional to the noise included in the training data sample; Presetting a training optimization termination condition threshold of the large model to be trained included in the large model to be trained, wherein the training optimization termination condition threshold of the large model to be trained is inversely proportional to the training time length of the large model to be trained; Presetting a magnitude control factor of the gradient difference included in the large model to be trained, wherein the magnitude control factor of the gradient difference is inversely proportional to the convergence of the large model to be trained; A regulating factor of the magnitude of the adversarial disturbance included in the large model to be trained is preset, and the regulating factor of the magnitude of the adversarial disturbance is used to control the intensity of the adversarial disturbance.

5. A device for controlling training energy consumption to counter attacks, characterized in that: include: An acquisition unit is used to acquire a data set containing multiple types of information from an internal data set of an enterprise by using a network crawling technology and a sensor data acquisition interface, and select a training data sample carrying a multimodal data sample from the data set according to the completeness and accuracy of the data and the application scenario of the large model to be trained. The training data sample is used to train the large model to be trained on a computing device with specific technical capabilities; A first determination unit is used to input the training data sample into the large model to be trained, and determine the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the current iteration, the gradient value of the large model to be trained with respect to the upper-layer optimization objective function in the previous iteration, and the gradient difference between the current iteration and the previous iteration of the large model to be trained with respect to the upper-layer optimization objective function according to the training data sample and the large model to be trained by running a program based on the back propagation algorithm on a computing device; An obtaining unit is used for obtaining a perturbation sample according to the training data sample and the adversarial perturbation when updating the adversarial perturbation by using a gradient ascent algorithm, if the determined optimal adversarial perturbation satisfies the maximization of the upper layer optimization objective function, the control factor of the adversarial perturbation size is greater than the norm of the adversarial perturbation, and the norm of the gradient difference is greater than a first threshold, wherein the first threshold is determined according to the training optimization termination condition threshold of the large model to be trained and the gradient difference size control factor; A second determination unit is used to input the disturbance sample to the computing device equipped with the large model to be trained through a data transmission interface, and the computing device obtains different gradient values ​​in each iteration. If it is determined that the gradient value of the current iteration is equal to the first gradient value of the objective function of the large model to be trained with respect to the weight parameter of the large model to be trained, the optimal weight parameter of the large model to be trained is determined according to minimization of the objective function of the large model to be trained; and the large model to be trained including the optimal weight parameter is deployed to a cloud platform in the field of natural language processing or computer vision; The multimodal data sample includes any of the following modalities: Using images acquired by an image acquisition device and text descriptions corresponding to the images obtained by text recognition software or annotation to form text and image modalities; Using the audio collected by the audio collection device and the text description corresponding to the audio obtained by voice-to-text conversion to form a text and audio modality; The video and audio acquired by the video recording device and the text description corresponding to the video and audio acquired by the video content analysis tool form text, video and audio modalities; The optimal counter-perturbation satisfies the maximum upper optimization objective function expressed by the following formula: Δx * ∈max‖Δg‖ p -λ‖Δx‖ p The control factor of the magnitude of the counter-perturbation is greater than the norm of the counter-perturbation and the norm of the gradient difference is greater than the first threshold, which is expressed by the following formula: s.t.‖Δx‖ p ≤η ‖Δg‖ p ≥∈+Δ∈ The disturbance sample is expressed by the following formula: x′=x+Δx Where Δx * represents the optimal adversarial perturbation, Δg represents the gradient difference between the kth iteration and the k-1th iteration of the upper optimization objective function of the large model to be trained, Δx represents the adversarial perturbation, λ represents the regularization coefficient, ‖·‖ p represents the p-norm, η represents the control factor of the anti-perturbation size, ∈ represents the training optimization termination condition threshold of the large model to be trained, Δ∈ represents the size control factor of the gradient difference, x represents the training data sample, and x′ represents the perturbation sample.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the anti-attack method for manipulating training energy consumption as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, the processor executes the anti-attack method for manipulating training energy consumption as described in any one of claims 1-4.

Images