Backdoor attack method and system based on image steganography

Abstract

The invention relates to a backdoor attack method based on image steganography. The method comprises the following steps: S1, constructing an image steganography network and an image transformation network; s2, performing spatial transformation on the toxic image to obtain a first trigger; s3, reversely inputting the toxic image subjected to spatial transformation into the attack network, and restoring to obtain a second trigger; s4, constructing a steganography loss function of the image steganography network according to the distance loss of the first trigger and the second trigger; s5, performing iterative training on the image steganography network; and S6, performing backdoor attack through the toxic image. When the steganographic network is trained, the loss function is constructed based on the deformation degree of the trigger, the image steganographic network generates the toxic image capable of adapting to image transformation through back propagation of the loss function, the toxic image generated by the method can trigger attack in a victim model even after being subjected to image transformation processing, and the image transformation efficiency is improved. And the victim model identifies the corresponding target label.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a backdoor attack method and system based on image steganography. Background Art

[0002] In recent years, deep neural networks have been applied to many different fields, such as image recognition, speech recognition, autonomous driving, etc. At present, the number of parameters of deep neural networks has reached more than one billion neurons, and training a deep neural network requires huge computing power.

[0003] Therefore, in order to speed up the training of deep neural networks, people are increasingly inclined to use third-party online training platforms for training.

[0004] However, if data involving personal privacy or national security is intercepted by a third-party platform and used for neural network training, it will cause the leakage of privacy and business secrets.

[0005] Therefore, for data sets with confidentiality requirements, a backdoor attack method of image steganography can be used to embed triggers in the image to prevent other neural networks from training normally.

[0006] Specifically, the principle of the backdoor attack method is:

[0007] A portion of clean samples are randomly selected from the clean training set and maliciously modified to generate poisonous samples, and the training labels of these poisonous samples are changed to specific target labels, and these poisonous samples replace the selected clean samples to generate poisonous training sets. After the victim model is trained in the poisonous training set, the victim model is injected with a backdoor. At this time, when a clean sample is input into the victim model, the victim model will output a normal result. However, when a poisonous sample is input into the victim model, the victim model will output the target label.

[0008] In existing backdoor attack methods, if the poisonous sample is subjected to certain image transformations before being input into the victim model, the trigger embedded in the poisonous sample cannot be triggered after being transformed, causing the backdoor attack to fail.

[0009] In order to prevent the trigger from becoming invalid after image transformation, the present application provides a backdoor attack method and system based on image steganography. Summary of the invention

[0010] In order to overcome the problems existing in the related art, the first aspect of the present application provides a backdoor attack method based on image steganography, comprising:

[0011] S1. Constructing an image steganography network and an image transformation network; the image steganography network is a reversible neural network, and the image steganography network is used to embed a trigger into the clean image and obtain a poisonous image; the image transformation network is used to transform the poisonous image;

[0012] S2, performing spatial transformation on the poisonous image to obtain a first trigger;

[0013] S3, inputting the spatially transformed poisonous image into the attack network in reverse order to restore the second trigger;

[0014] S4, constructing a steganalysis loss function of the image steganalysis network according to the distance loss between the first trigger and the second trigger;

[0015] S5, iteratively training the image steganography network;

[0016] S6. Perform a backdoor attack through the poisonous image.

[0017] In one embodiment, the steganalysis loss function comprises an image loss function;

[0018] The image loss function is:

[0019] L con =l2(c,p)

[0020] Among them, c is a clean image; p is a poisonous image, and l2 is the l2 loss between the clean image and the poisonous image.

[0021] In one embodiment, the steganographic loss function further includes a trigger loss function:

[0022] The trigger loss function is:

[0023]

[0024] t , =F(t)

[0025] Where t represents the trigger, F(t) represents the spatial variation function of the spatial variation layer, and t' represents the first trigger after image transformation. Represents the second trigger restored through the steganographic network.

[0026] In one embodiment, the steganalysis loss function further includes a wavelet transform loss function;

[0027] The wavelet transform loss function is

[0028] L freq =l2(H(c) LL,H(p) LL )

[0029] Among them, H()LL represents the high-frequency area of ​​the extracted image wavelet transform.

[0030] In one implementation, the steganalysis loss function is:

[0031] L total =λ c L con +λ r L rev +λ f L freq

[0032] Among them, λ c , r and f Represent the image loss function L con , trigger loss function L rev And the wavelet transform loss function L freq The weight parameter of .

[0033] In one embodiment, after S5, the method further includes:

[0034] The image transformation network is iteratively trained; the loss function of the image transformation network is:

[0035]

[0036] Wherein, l2(p,p') is the l2 loss between the clean image p and the poisonous image p', is the l2 loss between the first trigger and the second trigger, and α1 and α2 are weight parameters.

[0037] In one implementation, the image steganography network and the image transformation network are trained alternately, the image steganography layer is trained for 1 iteration, and the image transformation layer is trained for 5 iterations.

[0038] In one embodiment, the image steganography network consists of 16 reversible neural blocks with a forward process h θ and reverse process

[0039] The forward process is: p,z=h θ (c,t);

[0040] The reverse process is:

[0041] In one embodiment, the forward operation process of the kth reversible neural block of the image steganography network is:

[0042] c (k+1) =c (k) +φ(t (k) )

[0043] t (k+1) =t (k) ⊙exp(λ·ρ(c (k+1) ))+η(c (k+1) )

[0044] Among them, φ, ρ and η represent three CNN modules with the same structure but different parameters, c (k+1) represents the image output of the k-th reversible neural block.

[0045] A second aspect of the present application provides a backdoor attack system based on image steganography, which is used to execute the backdoor attack method based on image steganography.

[0046] The technical solution provided by this application may have the following beneficial effects:

[0047] During training, a clean image is input into the image steganography network, connected to the image transformation network for image transformation, and then the transformed first trigger is extracted. The poisonous image is then reversely input into the reversible image steganography network to obtain the restored second trigger. Finally, the degree of deformation of the trigger after image transformation is determined by calculating the l2 loss of the first trigger and the second trigger. When training the steganography network, a loss function is constructed based on the degree of deformation of the trigger. Through the back propagation of the loss function, the image steganography network generates a poisonous image that can adapt to image transformation. Even after the image transformation processing, the poisonous image generated by the present application can trigger an attack in the victim model, so that the victim model recognizes the corresponding target label.

[0048] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The above and other objects, features and advantages of the present application will become more apparent through a more detailed description of exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0050] Figure 1 A flowchart of the backdoor attack method shown in the embodiment of the present application;

[0051] Figure 2 This is a training flow chart of the image steganography network shown in the embodiment of the present application;

[0052] Figure 3The attack flow chart of the backdoor attack method shown in the embodiment of the present application. DETAILED DESCRIPTION

[0053] The preferred embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0054] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0055] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0056] Embodiment 1

[0057] Performing spatial or frequency domain transformation on images is a common operation in current backdoor defense methods. If the poisonous sample is subjected to certain image transformations before being input into the victim model, the trigger embedded in the poisonous sample cannot be triggered after being transformed, resulting in the failure of the backdoor attack.

[0058] Therefore, with the emergence of backdoor defense methods, existing backdoor attack methods are not effective against models that can perform spatial transformations.

[0059] In order to prevent the trigger from becoming invalid after image transformation, the present application embodiment provides a backdoor attack method based on image steganography, such as Figure 1 As shown, the following steps are included:

[0060] S1. Construct image steganography network and image transformation network;

[0061] The image steganography network is a reversible neural network, and is used to embed a trigger into the clean image and obtain a poisonous image; the image transformation network is used to transform the poisonous image;

[0062] S2, performing spatial transformation on the poisonous image to obtain a first trigger;

[0063] S3, inputting the spatially transformed poisonous image into the attack network in reverse order to restore the second trigger;

[0064] S4, constructing a steganalysis loss function of the image steganalysis network according to the distance loss between the first trigger and the second trigger;

[0065] S5, iteratively training the image steganography network;

[0066] S6. Perform a backdoor attack through the poisonous image.

[0067] Specifically, the trigger is potential noise embedded in a clean pattern.

[0068] In an embodiment of the present application, during training, a clean image is input into an image steganography network, connected to an image transformation network for image transformation, and then the transformed first trigger is extracted. The poisonous image is then reversely input into a reversible image steganography network to obtain a restored second trigger. Finally, the degree of deformation of the trigger after image transformation is determined by calculating the l2 loss of the first trigger and the second trigger. When training the steganography network, a loss function is constructed based on the degree of deformation of the trigger, and the image steganography network generates a poisonous image that can adapt to image transformation through the back propagation of the loss function. Even after the image transformation processing, the poisonous image generated by the embodiment of the present application can trigger an attack in the victim model, so that the victim model recognizes the corresponding target label.

[0069] Embodiment 2

[0070] Based on the first embodiment, the present application also provides a backdoor attack method based on image steganography, including steps S1 to S6 described in the first embodiment.

[0071] Specifically, the image steganography network consists of 16 reversible neural blocks with a forward process h θ and reverse process

[0072] like Figure 2As shown in the figure, in the forward calculation of INN, the clean image c and trigger t are input, and the toxic image p and potential noise z are output. In the reverse calculation of INN, the toxic image p' after image transformation and the randomly sampled random noise are input. Output the restored clean image and the restored trigger image

[0073] Among them, the forward process is: p,z=h θ (c,t); the reverse process is:

[0074] Specifically, the forward operation process of the kth reversible neural block in the image steganography network is as follows:

[0075] c (k+1) =c (k) +φ(t (k) )

[0076] t (k+1) =t (k) ⊙exp(λ·ρ(c (k+1) ))+η(c (k+1) )

[0077] Among them, φ, ρ and η represent three CNN modules with the same structure but different parameters; c (k+1) represents the image output of the kth reversible neural block, and ρ = c 17 , z = t 17 .

[0078] Specifically, the reverse operation process of the kth reversible neural block in the image steganography network is as follows:

[0079]

[0080] Furthermore, the image steganography network and the image transformation network shown in the embodiments of the present application are iteratively trained through back propagation of the loss function during training.

[0081] Specifically, the steganalysis loss function of the image steganalysis network is a steganalysis loss function. The steganalysis loss function is:

[0082] L total =λ c L con +λ r L rev +λ f L freq

[0083] Among them, λ c , r and f Represent the image loss function L con , trigger loss function L rev And the wavelet transform loss function L freq The weight parameter of .

[0084] In order to make the toxic image and the clean image as consistent as possible, so that the human eye cannot distinguish between the toxic image and the clean image. con The l2 distance between the two is calculated during training. The smaller the l2 loss, the more similar the two are visually.

[0085] Specifically, the image loss function is:

[0086] L con =l2(c,p)

[0087] Wherein, c is a clean image, p is a poisonous image, and l2 is the l2 loss between the clean image and the poisonous image.

[0088] In order to ensure that the second trigger recovered by the image steganography network is consistent with the first trigger after image transformation, the embodiment of the present application constructs a trigger loss function to allow the network to learn to construct a trigger that can adapt to spatial transformation.

[0089] Specifically, the trigger loss function is:

[0090]

[0091] t , =F(t)

[0092] Where F(t) represents the spatial variation function of the spatial variation network, t represents the trigger in the toxic image, and t' represents the first trigger after the image transformation. Represents the second trigger restored by the image steganography network.

[0093] In the embodiment of the present application, the toxic image is transformed and restored respectively, and then the first trigger and the second trigger are compared to calculate the deformation effect of the image transformation on the trigger. If the deformation of the two is large, it means that the currently embedded trigger is easy to defend through image transformation processing.

[0094] In order to prevent the trigger from being identified or removed by the model through wavelet transform, the image steganography network also includes a wavelet transform loss function.

[0095] Specifically, the wavelet transform loss function is:

[0096] L freq =l2(H(c) LL ,H(p) LL )

[0097] Among them, H() LL Represents the high-frequency area of ​​the extracted image wavelet transform.

[0098] In the embodiment of the present application, the role of the wavelet transform loss function is to make the wavelet transform high frequency part of the clean image consistent with the wavelet transform high frequency of the toxic image. After the training is completed, the trigger can be embedded in the wavelet transform low frequency area of ​​the toxic image.

[0099] Furthermore, the role of the image transformation network is to make it impossible for the image steganography network to restore the trigger while keeping p' and p as the same as possible. Therefore, the image transformation network also needs to be trained alternately.

[0100] Specifically, the loss function of the image transformation network is:

[0101]

[0102] Wherein, l2(p,p') is the l2 loss between the clean image p and the poisonous image p', is the l2 loss between the first trigger and the second trigger, and α1 and α2 are weight parameters.

[0103] In the embodiment of the present application, by training the image transformation network, more targeted image transformations can be adaptively generated to improve the robustness of the image steganography network under different image transformations.

[0104] In the embodiment of the present application, the image steganography network and the image transformation network are trained alternately, the image steganography layer is trained for 1 iteration, and the image transformation layer is trained for 5 iterations.

[0105] After the training is completed, a model attack test is performed. The attack method shown in the embodiment of the present application is as follows: Figure 3 The test results are shown in Tables 1 to 3.

[0106] Table 1 shows the effect of attacking with a poisoning rate of 10% using the CIFAR-10 dataset. Table 2 shows the effect of attacking with a poisoning rate of 5% using the CIFAR-10 dataset. Table 3 shows the effect of attacking with a poisoning rate of 3% using the CIFAR-10 dataset.

[0107]

[0108] Table 1

[0109]

[0110] Table 2

[0111]

[0112] Table 3

[0113] In Tables 1 to 3, each column in the table represents an image transformation to be performed on a clean image or a poisonous image. The SDriBA_UNet+++ line is the attack method shown in the embodiment of the present application, and the other lines are existing attack methods.

[0114] Among them, None, Flip, Rot15, s&p, C&R represent the image transformation methods. None is the original image, Flip is flipping, Rot15 is rotation, and so on.

[0115] Among them, CDA represents the classification accuracy of the victim model for clean images after different image transformations, that is, CDA represents the performance of the original classification task of the victim model. The higher the CDA, the stronger the backdoor concealment of the victim model. ASR represents the accuracy of the victim model in classifying the poisonous images after different image transformations into target labels. ASR represents the attack effect of the backdoor attack method shown in the embodiment of the present application. The higher the ASR, the higher the success rate of the backdoor attack method in triggering the backdoor of the victim model.

[0116] Therefore, the higher the CDA and ASR, the better the backdoor attack effect of the backdoor attack method.

[0117] It can be seen from Tables 1 to 3 that under different poisoning rates of the CIFAR-10 dataset, the average CDA and average ASR of the attack method shown in the embodiment of the present application under different image transformations are higher than those of other backdoor attack methods, and the lower the poisoning rate, the better the backdoor attack effect shown in the embodiment of the present application is than other methods.

[0118] The attack method shown in the embodiment of the present application improves the success rate of backdoor attacks on triggers that undergo other unknown image transformations.

[0119] Embodiment 3

[0120] A backdoor attack system based on image steganography is used in the backdoor attack method based on image steganography described in Embodiment 1 or Embodiment 2.

[0121] The scheme of the present application has been described in detail above with reference to the accompanying drawings. In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. Those skilled in the art should also be aware that the actions and modules involved in the description are not necessarily required for the present application.

[0122] In addition, it can be understood that the steps in the method of the embodiment of the present application can be adjusted in order, combined and deleted according to actual needs, and the modules in the device of the embodiment of the present application can be combined, divided and deleted according to actual needs.

[0123] In addition, the method according to the present application may also be implemented as a computer program or a computer program product, which includes computer program code instructions for executing some or all of the steps in the above method of the present application.

[0124] Alternatively, the present application can also be implemented as a non-temporary machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) on which executable code (or computer program, or computer instruction code) is stored. When the executable code (or computer program, or computer instruction code) is executed by a processor of an electronic device (or electronic device, server, etc.), the processor executes part or all of the steps of the above-mentioned method according to the present application.

[0125] Those skilled in the art will further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the application herein may be implemented as electronic hardware, computer software, or combinations of both.

[0126] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system and method according to multiple embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a part of a module, a program segment or a code, and the part of the module, the program segment or the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or the flow chart, and the combination of the square boxes in the block diagram and / or the flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0127] The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A backdoor attack method based on image steganography, characterized in that: include: S1. Construct image steganography network and image transformation network; The image steganography network is a reversible neural network, and is used to embed a trigger into the clean image and obtain a poisonous image; the image transformation network is used to transform the poisonous image; S2, performing spatial transformation on the poisonous image to obtain a first trigger; S3, inputting the spatially transformed poisonous image into the attack network in reverse order to restore the second trigger; S4, constructing a steganalysis loss function of the image steganalysis network according to the distance loss between the first trigger and the second trigger; S5, iteratively training the image steganography network; S6. Perform a backdoor attack through the poisonous image.

2. According to the backdoor attack method based on image steganography according to claim 1, it is characterized in that: The steganalysis loss function includes an image loss function; The image loss function is: L con =l2(c,p) Among them, c is a clean image; p is a poisonous image, and l2 is the l2 loss between the clean image and the poisonous image.

3. According to claim 2, a backdoor attack method based on image steganography is characterized in that: The steganalysis loss function also includes a trigger loss function: The trigger loss function is: t , =F(t) Where t represents the trigger, F(t) represents the spatial variation function of the spatial variation layer, and t' represents the first trigger after image transformation. ～ t represents the second trigger restored through the steganographic network.

4. According to claim 3, a backdoor attack method based on image steganography is characterized in that: The steganalysis loss function also includes a wavelet transform loss function; The wavelet transform loss function is L freq =l2(H(c) LL ,H(p) LL ) Among them, H() LL Represents the high-frequency area of ​​the extracted image wavelet transform.

5. According to claim 4, a backdoor attack method based on image steganography is characterized in that: The steganalysis loss function is: L total =λ c L con +λ r L rev +λ f L freq Among them, λ c , r and f Represent the image loss function L con , trigger loss function L rev And the wavelet transform loss function L freq The weight parameter of .

6. According to the backdoor attack method based on image steganography in claim 1, it is characterized in that: After S5, it also includes: Iteratively training the image transformation network; The loss function of the image transformation network is: Wherein, l2(p,p') is the l2 loss between the clean image p and the poisonous image p', is the l2 loss between the first trigger and the second trigger, and α1 and α2 are weight parameters.

7. According to claim 1, a backdoor attack method based on image steganography is characterized in that: The image steganography network and the image transformation network are trained alternately, the image steganography layer is trained for 1 iteration, and the image transformation layer is trained for 5 iterations.

8. According to claim 1, a backdoor attack method based on image steganography is characterized in that: The image steganography network consists of 16 reversible neural blocks with a forward process h θ and reverse process The forward process is: p,z=h θ (c,t); The reverse process is:

9. The backdoor attack method based on image steganography according to claim 8 is characterized in that: The forward operation process of the kth reversible neural block of the image steganography network is: c (k+1) =c (k) +φ(t (k) ) t (k+1) =t (k) ⊙exp(λ·ρ(c (k+1) ))+η(c (k+1) ) Among them, φ, ρ and η represent three CNN modules with the same structure but different parameters, c (k+1) represents the image output of the k-th reversible neural block.

10. A backdoor attack system based on image steganography, characterized in that: Used to execute the backdoor attack method based on image steganography as described in any one of claims 1 to 9.

Images