Universal adversarial noise generation method and system based on multi-modal pre-training model

Abstract

The invention provides a universal adversarial noise generation method and system based on a multi-modal pre-training model, and the method is characterized in that the method comprises the steps: S1, constructing a training feature extractor; s2, constructing and initializing anti-noise; s3, selecting a clean sample and adding an adversarial noise to obtain a corresponding adversarial sample; s4, for each training feature extractor, extracting specific modal features of all corresponding adversarial samples, and extracting target modal features of the target data; s5, according to all the corresponding specific modal features and target modal features, calculating to obtain an anti-noise gradient; s6, aggregating the gradients corresponding to the training feature extractors, and updating the countermeasure noise according to an aggregation result; and S7, repeating the steps S3-S6 until a preset termination condition is met, and obtaining the general noise. In conclusion, the method can generate general anti-noise with task mobility, so that the security of any multi-modal model can be detected.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security, and specifically relates to a universal adversarial noise generation method and system based on a multimodal pre-training model. Background Art

[0002] In recent years, due to the great progress made in deep learning, a large number of deep learning models have been widely used in various industries. Among them, deep vision models based on multimodal pre-training have been applied to various tasks such as image classification, image and text retrieval, instance segmentation, pose estimation, and multimodal large language models.

[0003] However, deep neural networks, or DNNs, including convolutional neural networks, or CNNs, and the latest visual self-attention models, or ViT models, are vulnerable to adversarial examples, which are attacks that slightly perturb the test input to trick the DNN into making incorrect predictions.

[0004] Based on the attack target, existing methods are divided into targeted and untargeted attacks. Untargeted attacks can cause DNN to make arbitrary incorrect predictions. Targeted attacks can cause DNN's predictions to be specified prediction errors. Based on the adversarial threat model, existing adversarial attack methods can be roughly divided into two categories, namely white-box attacks and black-box attacks. The difference is that in the white-box attack setting, the attacker can obtain all the information of the victim model, including model structure, parameters, and gradient information. Black-box attacks can only estimate adversarial gradients by querying the target model, or use alternative models to generate transferable adversarial samples. Query-based attacks usually require a large number of queries on the target model. Compared with them, migration attacks can be said to be easier and cheaper to attack commercial application interfaces in the real world.

[0005] However, existing adversarial attacks require the generation of corresponding adversarial samples based on specific tasks, which results in the consumption of a large amount of computing resources, and thus cannot efficiently generate a large number of adversarial samples to test the security performance of DNNs. Summary of the invention

[0006] The present invention is made to solve the above-mentioned problems, and its purpose is to provide a universal anti-noise generation method and system based on a multimodal pre-training model.

[0007] The present invention provides a universal adversarial noise generation method based on a multimodal pre-trained model, which is used to generate universal noise for target data of a target modality and applicable to data of a specific modality, and has the following characteristics, including the following steps: step S1, using the multimodal feature extractors of the existing multiple pre-trained multimodal large models as training feature extractors; step S2, constructing and initializing adversarial noise; step S3, for each training feature extractor, randomly selecting multiple specific modal data from the existing data as clean samples, and adding adversarial noise to each clean sample to obtain a corresponding adversarial sample; step S4, for each training feature extractor, extracting the specific modal features of all corresponding adversarial samples, and extracting the target modal features of the target data; step S5, for each training feature extractor, calculating the gradient of the adversarial noise according to all corresponding specific modal features and target modal features; step S6, aggregating the gradients corresponding to each training feature extractor, and updating the adversarial noise according to the aggregation result; step S7, repeating steps S3 to S6 until a preset termination condition is reached, and then using the updated adversarial noise as universal noise.

[0008] In the general adversarial noise generation method based on the multimodal pre-training model provided by the present invention, it can also have the following characteristics: wherein, step S5 includes the following sub-steps: step S5-1, for each training feature extractor, respectively calculating the cosine similarity of each specific modal feature and the target modal feature; step S5-2, for each training feature extractor, according to all corresponding cosine similarities, obtaining the gradient of the adversarial noise through directional propagation calculation.

[0009] In the general adversarial noise generation method based on the multimodal pre-training model provided by the present invention, it can also have the following characteristics: wherein, each training feature extractor is loaded on a different GPU respectively, and in step S6, the gradients corresponding to each training feature extractor are aggregated through the all_reduce operation.

[0010] The present invention provides a universal adversarial noise generation system based on a multimodal pre-training model, which is used to generate universal noise for target data of a target modality and applicable to data of a specific modality, and has the following characteristics, including: an aggregation end and multiple computing ends, wherein the aggregation end is respectively connected to each computing end in communication, and the aggregation end includes: an initialization module, which is used to construct and initialize the adversarial noise; an aggregation side data transmission module, which is used to send the adversarial noise to each computing end and receive the gradient sent by each computing end; an aggregation module, which is used to aggregate the gradients corresponding to each computing end and update the adversarial noise according to the aggregation result; an iteration judgment module, which stores a preset termination condition and is used to judge whether to terminate the iteration. If so, the updated adversarial noise is used as the universal noise; if not, the aggregation side data transmission module is controlled to update the updated adversarial noise. The data is sent to each computing end, and the computing end includes: a data storage module for storing existing data and target data; an adversarial sample generation module for randomly selecting multiple specific modal data from the existing data as clean samples, and adding adversarial noise to each clean sample to obtain a corresponding adversarial sample; a feature extraction module, including a training feature extractor, for extracting the specific modal features of all corresponding adversarial samples and extracting the target modal features of the target data; a gradient calculation module for calculating the gradient of the adversarial noise for each training feature extractor according to all corresponding specific modal features and target modal features; a computing side data transmission module for receiving the adversarial noise and sending the gradient to the aggregation end. The training feature extractors of each computing end are respectively multimodal feature extractors of different existing pre-trained multimodal large models.

[0011] Functions and Effects of the Invention

[0012] According to the general adversarial noise generation method and system based on a multimodal pre-trained model involved in the present invention, first, by randomly extracting multiple clean samples and adding the same adversarial noise, multiple adversarial samples are generated as batch data, and then the gradient of the adversarial noise is generated, so that the optimized adversarial noise has universal migration across samples; second, feature extraction is performed through the training feature extractor of a multimodal large model of multiple different tasks, so that the optimized adversarial noise has migration across tasks and models; third, the cosine similarity of the target data and the features extracted from the adversarial sample is calculated, and the gradient of the adversarial noise is optimized according to the calculation result, so that the optimized noise can achieve targeted attacks. Therefore, the general adversarial noise generation method and system based on a multimodal pre-trained model of the present invention can generate general adversarial noise with task migration, thereby detecting the security of any multimodal model. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a schematic diagram of the principle of generating universal anti-noise in an embodiment of the present invention;

[0014] Figure 2 is a block diagram of a general countermeasure noise generation system in an embodiment of the present invention;

[0015] Figure 3 is a block diagram of an aggregation terminal in an embodiment of the present invention;

[0016] Figure 4 is a block diagram of a computing end in an embodiment of the present invention;

[0017] Figure 5 It is a flowchart of a general anti-noise generation method based on a multimodal pre-training model in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the technical means, creative features, objectives and effects achieved by the present invention easy to understand, the following embodiments and the accompanying drawings specifically illustrate the general anti-noise generation method and system based on the multimodal pre-training model of the present invention.

[0019] This embodiment provides a universal adversarial noise generation system based on a multimodal pre-trained model, which is used to generate universal noise for target data of a target modality and applicable to data of a specific modality. Modality refers to different data types, such as pictures, language and text, etc. In this embodiment, the target modality is set to language and text, and the specific modality is set to picture.

[0020] Figure 1 It is a schematic diagram of the principle of generating universal anti-noise in an embodiment of the present invention.

[0021] like Figure 1 As shown in the figure, by adding universal adversarial noise to each clean sample, the corresponding adversarial sample can be generated, and then different models, namely model 1, model 2, model 3, ..., model N, are used to process these adversarial samples to generate gradients, and the gradients generated by all models are aggregated, and then the universal adversarial noise is optimized according to the aggregation results, and this cycle is repeated to finally obtain the optimized universal adversarial noise. The universal adversarial noise can generate adversarial samples with any clean sample, and the adversarial attack on the model of any downstream task can be realized based on the adversarial sample. Downstream tasks include image classification, image and text retrieval, etc., and models include multimodal large models, etc.

[0022] Figure 2 is a block diagram of a general countermeasure noise generation system in an embodiment of the present invention.

[0023] like Figure 2 As shown, the universal anti-noise generation system 100 includes an aggregation end 10 and multiple computing ends 20, and the aggregation end 10 is communicatively connected to each computing end 20 respectively.

[0024] Figure 3is a block diagram of an aggregation terminal in an embodiment of the present invention.

[0025] like Figure 3 As shown, the aggregation terminal 10 includes an initialization module 101, an aggregation side data transmission module 102, an aggregation module 103, an iteration judgment module 104 and an aggregation side master control module 105 for controlling the operation of the above modules.

[0026] The initialization module 101 is used to construct and initialize the anti-noise.

[0027] The aggregation-side data transmission module 102 is used to send the adversarial noise to each computing end 20 and receive the gradient sent by each computing end 20 .

[0028] The aggregation module 103 is used to aggregate the gradients corresponding to the various computing ends, and update the anti-noise according to the aggregation result.

[0029] The aggregation module 103 aggregates the gradients corresponding to each training feature extractor through an all_reduce operation.

[0030] The iteration judgment module 104 stores a preset termination condition for judging whether to terminate the iteration. If so, the updated anti-noise is used as the common noise. If not, the aggregation side data transmission module 102 is controlled to send the updated anti-noise to each computing end 20.

[0031] The aggregation side master control module 105 stores a control program for controlling the operation of each module of the aggregation terminal 10 .

[0032] Figure 4 It is a block diagram of a computing end in an embodiment of the present invention.

[0033] like Figure 4 As shown, the computing end 20 includes a data storage module 201, an adversarial sample generation module 202, a feature extraction module 203, a gradient calculation module 204, a computing side data transmission module 205, and a computing side general control module 206 for controlling the operation of the above modules. In this embodiment, each computing end 20 has its own corresponding GPU, and the GPUs can be the same or different.

[0034] The data storage module 201 is used to store existing data and target data. In this embodiment, the existing data of each computing terminal 20 is the same and comes from the same database. It is pre-stored in the computing terminal 20 or sent to each computing terminal 20 by the aggregation terminal 10. Each computing terminal 20 randomly extracts part of the data from the database for batch training. In other embodiments, the existing data can be specific data corresponding to each computing terminal 20, that is, the existing data of each computing terminal 20 is at least partially different.

[0035] The adversarial sample generation module 202 is used to randomly select data of multiple specific modalities from existing data as clean samples, and add adversarial noise to each clean sample to obtain a corresponding adversarial sample.

[0036] The feature extraction module 203 includes a training feature extractor for extracting specific modality features of all corresponding adversarial samples and extracting target modality features of target data. In this embodiment, the training feature extractor is loaded on the GPU corresponding to the computing end 20.

[0037] Among them, the training feature extractors of each computing end 20 are respectively multimodal feature extractors of different existing pre-trained multimodal large models.

[0038] The gradient calculation module 204 is used to calculate the gradient against noise for each training feature extractor according to all corresponding specific modal features and target modal features.

[0039] The gradient calculation module 204 includes a similarity calculation unit 2041 and a gradient calculation unit 2042 .

[0040] The similarity calculation unit 2041 is used to calculate the cosine similarity between each specific modal feature and the target modal feature for each training feature extractor.

[0041] The gradient calculation unit 2042 is used to calculate the gradient of the adversarial noise for each training feature extractor according to all corresponding cosine similarities through directional propagation. In this embodiment, the aggregation module 103 updates the adversarial noise according to all gradients, and in the next round of iteration, the cosine similarity between the specific modal features extracted from the adversarial sample and the corresponding target modal features becomes more similar. That is, the adversarial sample generated by the adversarial noise that is continuously iteratively updated is more similar to the target data in terms of the extracted features, thereby enabling adversarial attacks.

[0042] The computing side data transmission module 205 is used to receive the anti-noise and send the gradient to the aggregation end 20 .

[0043] The computing side master control module 206 stores a control program for controlling the operation of each module of the computing end 20 .

[0044] The following describes the process of using the universal adversarial noise generation system 100 to perform a universal adversarial noise generation method based on a multimodal pre-training model in conjunction with the accompanying drawings.

[0045] Figure 5 It is a flowchart of a general anti-noise generation method based on a multimodal pre-training model in an embodiment of the present invention.

[0046] like Figure 5As shown in FIG, the general adversarial noise generation method based on the multimodal pre-trained model includes the following steps:

[0047] Step S1, using the existing multimodal feature extractors of multiple pre-trained multimodal large models as training feature extractors.

[0048] Step S2 , the initialization module 101 constructs and initializes the anti-noise, and sends the anti-noise to each computing end 20 through the aggregation-side data transmission module 102 .

[0049] In step S3, each adversarial sample generation module 202 randomly selects data of multiple specific modalities from the existing data as clean samples, and adds adversarial noise to each clean sample to obtain a corresponding adversarial sample.

[0050] In step S4, each feature extraction module 203 extracts the specific modal features of all corresponding adversarial samples and extracts the target modal features of the target data.

[0051] In step S5, each gradient calculation module 204 calculates the gradient against noise according to all corresponding specific modal features and target modal features.

[0052] Step S6: the aggregation module 103 aggregates the gradients sent by each computing-side data transmission module 205, and updates the anti-noise according to the aggregation result.

[0053] In step S7, the iteration judgment module 104 judges whether the preset termination condition is reached. If so, the updated anti-noise is used as the common noise. If not, the aggregation side data transmission module 102 sends the updated anti-noise to each computing end 20 and executes step S3.

[0054] In this embodiment, through the above-mentioned universal adversarial noise generation method based on the multimodal pre-training model, the target data can be set to the language expression form of "This is a cat". Then the adversarial sample generated by combining the corresponding universal adversarial noise with any picture, when input into any model, no matter what the original content of the picture is, if it is recognized as "cat", then the adversarial sample misleads the model, that is, the adversarial attack is successful.

[0055] The adversarial noise generated by the general adversarial noise generation method based on the above-mentioned multimodal pre-trained model can simultaneously detect models corresponding to different tasks and test the security of each model. There is no need to generate corresponding adversarial noise for models of different tasks, thereby saving a lot of computing resources and further improving the efficiency and practicality of security performance testing of the model.

[0056] Functions and Effects of the Embodiments

[0057] According to the general adversarial noise generation method and system based on the multimodal pre-trained model involved in this embodiment, first, by randomly extracting multiple clean samples and adding the same adversarial noise, multiple adversarial samples are generated as batch data, and then the gradient of the adversarial noise is generated, so that the optimized adversarial noise has universal migration across samples; second, feature extraction is performed through the training feature extractor of a multimodal large model of multiple different tasks, so that the optimized adversarial noise has migration across tasks and models; third, the cosine similarity of the target data and the features extracted from the adversarial sample is calculated, and the gradient of the adversarial noise is optimized according to the calculation result, so that the optimized noise can achieve targeted attack. In short, this method can generate general adversarial noise with task migration, thereby detecting the security of any multimodal model.

[0058] Those skilled in the art should understand that the present invention is not limited to the above embodiments, and the above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A universal adversarial noise generation method based on a multimodal pre-trained model, for generating universal noise for target data of a target modality and applicable to data of a specific modality, characterized in that: The following steps are involved: Step S1, using the multimodal feature extractors of multiple existing pre-trained multimodal large models as training feature extractors; Step S2, construct and initialize adversarial noise; Step S3, for each of the training feature extractors, randomly select a plurality of data of the specific modality from the existing data as clean samples, and add the adversarial noise to each of the clean samples to obtain a corresponding adversarial sample; Step S4, for each of the training feature extractors, extracting the specific modality features of all the corresponding adversarial samples, and extracting the target modality features of the target data; Step S5, for each of the training feature extractors, according to all the corresponding specific modal features and the target modal features, calculating the gradient of the anti-noise; Step S6, aggregating the gradients corresponding to the respective training feature extractors, and updating the adversarial noise according to the aggregation result; Step S7, repeating steps S3 to S6 until a preset termination condition is reached, and then using the updated countermeasure noise as the common noise.

2. The general anti-noise generation method based on a multimodal pre-training model according to claim 1, characterized in that: in, The step S5 comprises the following sub-steps: Step S5-1, for each of the training feature extractors, respectively calculating the cosine similarity between each of the specific modal features and the target modal features; Step S5-2: for each of the training feature extractors, according to all the corresponding cosine similarities, obtain the gradient of the anti-noise through directional propagation calculation.

3. The general anti-noise generation method based on a multimodal pre-training model according to claim 1, characterized in that: in, Each of the training feature extractors is loaded on different GPUs respectively. In the step S6, the gradients corresponding to the respective training feature extractors are aggregated through an all_reduce operation.

4. A universal adversarial noise generation system based on a multimodal pre-trained model, for generating universal noise for target data of a target modality and applicable to data of a specific modality, characterized in that: include: Aggregation end and multiple computing ends, The aggregation end is connected to each of the computing ends for communication. The aggregation end includes: Initialization module, used to construct and initialize adversarial noise; An aggregation side data transmission module, used to send the anti-noise to each of the computing ends, and receive the gradient sent by each of the computing ends; an aggregation module, used to aggregate the gradients corresponding to the various computing ends, and update the anti-noise according to the aggregation result; The iteration judgment module stores a preset termination condition and is used to judge whether to terminate the iteration. If so, the updated anti-noise is used as the common noise. If not, the aggregation side data transmission module is controlled to send the updated anti-noise to each computing end. The computing end includes: A data storage module, used for storing existing data and the target data; An adversarial sample generation module, used for randomly selecting a plurality of data of the specific modality from the existing data as clean samples, and adding the adversarial noise to each of the clean samples to obtain a corresponding adversarial sample; A feature extraction module, including a training feature extractor, for extracting specific modal features of all corresponding adversarial samples and extracting target modal features of the target data; A gradient calculation module, used for calculating the gradient of the anti-noise according to all the corresponding specific modal features and the target modal features for each of the training feature extractors; A computing side data transmission module is used to receive the anti-noise and send the gradient to the aggregation end. The training feature extractors of each computing end are respectively multimodal feature extractors of different existing pre-trained multimodal large models.

Images