A backdoor attack method and system based on image steganography

Abstract

The present application is a backdoor attack method based on image steganography, comprising: S1, constructing an image steganography network and an image transformation network; S2, performing spatial transformation on a poisonous image to obtain a first trigger; S3, inputting the spatially transformed poisonous image back into the attack network to restore it to obtain a second trigger; S4, constructing a steganalysis loss function of the image steganography network based on the distance loss between the first trigger and the second trigger; S5, iteratively training the image steganography network; S6, performing a backdoor attack using a poisonous image. When training the steganography network, a loss function is constructed based on the degree of deformation of the trigger, and the image steganography network generates a poisonous image that can adapt to image transformation through the back propagation of the loss function. The poisonous image generated by the present application can trigger an attack in the victim model even after image transformation processing, so that the victim model recognizes the corresponding target label.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a backdoor attack method and system based on image steganography. Background Technology

[0002] In recent years, deep neural networks have been applied to many different fields, such as image recognition, speech recognition, and autonomous driving. Currently, the number of parameters in deep neural networks has reached over one billion neurons, and training a deep neural network requires enormous computing power.

[0003] Therefore, in order to speed up the training of deep neural networks, people are increasingly inclined to use third-party online training platforms for training.

[0004] However, if data involving personal privacy or national security is intercepted by third-party platforms and used for neural network training, it will result in the leakage of privacy and trade secrets.

[0005] Therefore, for datasets with confidentiality requirements, a backdoor attack method using image steganography can be used to embed triggers in the image to prevent other neural networks from training normally.

[0006] Specifically, the principle behind backdoor attack methods is:

[0007] A malicious program randomly selects a subset of clean samples from a clean training set and modifies them to generate toxic samples. The training labels of these toxic samples are then changed to specific target labels, and the selected clean samples are replaced with these toxic samples to create the toxic training set. Once the victim model has been trained on the toxic training set, it is injected with a backdoor. When clean samples are input into the victim model, it outputs normal results; however, when toxic samples are input, it outputs the target label.

[0008] In existing backdoor attack methods, if the malicious sample undergoes certain image transformations before being input into the victim model, the triggers embedded in the malicious sample will fail to be triggered after the transformation, resulting in the failure of the backdoor attack.

[0009] To prevent triggers from malfunctioning after image transformation, this application provides a backdoor attack method and system based on image steganography. Summary of the Invention

[0010] To overcome the problems existing in related technologies, the first aspect of this application provides a backdoor attack method based on image steganography, comprising:

[0011] S1. Construct an image steganalysis network and an image transformation network; the image steganalysis network is a reversible neural network, which is used to embed triggers into the clean image to obtain a toxic image; the image transformation network is used to transform the toxic image.

[0012] S2. The first trigger is obtained by spatially transforming the toxic image;

[0013] S3. The spatially transformed toxic image is input back into the attack network to restore it and obtain the second trigger;

[0014] S4. Construct the steganalysis loss function of the image steganalysis network based on the distance loss of the first trigger and the second trigger;

[0015] S5. Iteratively train the image steganography network;

[0016] S6. Perform a backdoor attack using the toxic image.

[0017] In one implementation, the steganalysis loss function includes an image loss function;

[0018] The image loss function is:

[0019] L con =l2(c,p)

[0020] Where c is the clean image; p is the toxic image; and l2 is the l2 loss between the clean image and the toxic image.

[0021] In one implementation, the steganography loss function further includes a trigger loss function:

[0022] The trigger loss function is:

[0023]

[0024] t , =F(t)

[0025] Where t represents the trigger, F(t) represents the spatial transformation function of the spatial transformation layer, and t' represents the first trigger after image transformation. This represents the second trigger that has been recovered through the steganography network.

[0026] In one implementation, the steganalysis loss function further includes a wavelet transform loss function;

[0027] The wavelet transform loss function is:

[0028] L freq =l2(H(c) LLH(p) LL )

[0029] Here, H()LL represents the high-frequency region of the extracted image wavelet transform.

[0030] In one implementation, the steganography loss function is:

[0031] L total =λ c L con +λ r L rev +λ f L freq

[0032] Where, λ c , λ r and λ f These represent the image loss function L. con Trigger loss function L rev and wavelet transform loss function L freq The weight parameters.

[0033] In one implementation, after S5, the following is also included:

[0034] The image transformation network is trained iteratively; the loss function of the image transformation network is:

[0035]

[0036] Wherein, l2(p,p') is the l2 loss between the clean image p and the toxic image p'. α1 and α2 are the L2 loss between the first and second triggers, and are weighting parameters.

[0037] In one implementation, the image steganography network and the image transformation network are trained alternately, with the image steganography layer trained for 1 iteration and the image transformation layer trained for 5 iterations.

[0038] In one implementation, the image steganalysis network consists of 16 reversible neural blocks with a forward process h. θ and reverse process

[0039] The forward process is: p,z = h θ (c,t);

[0040] The reverse process is as follows:

[0041] In one implementation, the forward computation process of the k-th reversible neural block of the image steganalysis network is as follows:

[0042] c (k+1) =c (k) +φ(t (k) )

[0043] t (k+1) =t (k) ⊙exp(λ·ρ(c (k+1) ))+η(c (k+1) )

[0044] Where φ, ρ, and η represent three CNN modules with the same structure but different parameters, and c (k+1) This represents the image output of the k-th reversible neural block.

[0045] A second aspect of this application provides a backdoor attack system based on image steganography for executing the image steganography-based backdoor attack method.

[0046] The technical solution provided by this application may have the following beneficial effects:

[0047] During training, a clean image is input into the image steganography network, connected to an image transformation network for image transformation, and then the transformed first trigger is extracted. The toxic image is then input back into the reversible image steganography network to obtain the restored second trigger. Finally, the degree of deformation of the trigger after image transformation is determined by calculating the L2 loss between the first and second triggers. During steganography network training, a loss function is constructed based on the degree of trigger deformation. Backpropagation of this loss function enables the image steganography network to generate toxic images that can adapt to image transformations. Even after image transformation, the toxic images generated in this application can still trigger attacks in the victim model, allowing the victim model to recognize the corresponding target label.

[0048] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. Attached Figure Description

[0049] The above and other objects, features and advantages of the present application will become more apparent through a more detailed description of exemplary embodiments of the present application in conjunction with the accompanying drawings, wherein the same reference numerals generally represent the same components in the exemplary embodiments of the present application.

[0050] Figure 1 This is a flowchart illustrating the backdoor attack method shown in the embodiments of this application;

[0051] Figure 2 This is a flowchart illustrating the training process of the image steganography network shown in an embodiment of this application;

[0052] Figure 3This is a flowchart illustrating a backdoor attack method according to an embodiment of this application. Detailed Implementation

[0053] The preferred embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0054] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. As used in this application and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0055] It should be understood that although the terms "first", "second", "third", etc. may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from each other. For example, without departing from the scope of this application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0056] Example 1

[0057] Spatial or frequency domain transformations of images are common operations in current backdoor defense methods. If a malicious sample undergoes certain image transformations before being input into the victim model, the triggers embedded in the malicious sample will fail to activate after the transformation, causing the backdoor attack to fail.

[0058] Therefore, with the emergence of backdoor defense methods, existing backdoor attack methods are not very effective against models that can perform spatial transformations.

[0059] To prevent triggers from malfunctioning after image transformation, embodiments of this application provide a backdoor attack method based on image steganography, such as... Figure 1 As shown, it includes the following steps:

[0060] S1. Construct an image steganalysis network and an image transformation network;

[0061] The image steganography network is a reversible neural network. The image steganography network is used to embed triggers into the clean image to obtain a toxic image; the image transformation network is used to transform the toxic image.

[0062] S2. The first trigger is obtained by spatially transforming the toxic image;

[0063] S3. The spatially transformed toxic image is input back into the attack network to restore it and obtain the second trigger;

[0064] S4. Construct the steganalysis loss function of the image steganalysis network based on the distance loss of the first trigger and the second trigger;

[0065] S5. Iteratively train the image steganography network;

[0066] S6. Perform a backdoor attack using the toxic image.

[0067] Specifically, the trigger is potential noise embedded in a clean graphic.

[0068] In this embodiment, during training, a clean image is input into the image steganography network, connected to an image transformation network for image transformation, and then the transformed first trigger is extracted. The toxic image is then input back into the reversible image steganography network to obtain the restored second trigger. Finally, the degree of deformation of the trigger after image transformation is determined by calculating the L2 loss between the first and second triggers. During steganography network training, a loss function is constructed based on the degree of trigger deformation. Backpropagation of the loss function enables the image steganography network to generate toxic images that can adapt to image transformation. In this embodiment, the toxic image generated can still trigger an attack in the victim model even after image transformation, allowing the victim model to identify the corresponding target label.

[0069] Example 2

[0070] Based on Embodiment 1, this application also provides a backdoor attack method based on image steganography, including steps S1 to S6 as described in Embodiment 1.

[0071] Specifically, the image steganalysis network consists of 16 reversible neural blocks and has a forward process h. θ and reverse process

[0072] like Figure 2As shown, in the forward calculation of INN, the inputs are a clean image c and a trigger t, and the outputs are a toxic image p and latent noise z. In the reverse calculation of INN, the inputs are a toxic image p' after image transformation and randomly sampled random noise. Output the restored clean image and the trigger image for recovery

[0073] The forward process is: p,z = h θ (c,t); The reverse process is:

[0074] Specifically, the forward computation process of the k-th reversible neuron in the image steganalysis network is as follows:

[0075] c (k+1) =c (k) +φ(t (k) )

[0076] t (k+1) =t (k) ⊙exp(λ·ρ(c (k+1) ))+η(c (k+1) )

[0077] Where φ, ρ, and η represent three CNN modules with the same structure but different parameters; c (k+1) Let represent the image output of the k-th reversible neural block, and ρ = c. 17 z = t 17 .

[0078] Specifically, the reverse computation process of the k-th reversible neuron in the image steganalysis network is as follows:

[0079]

[0080] Furthermore, the image steganography network and image transformation network shown in the embodiments of this application are iteratively trained during training through backpropagation of the loss function.

[0081] Specifically, the steganalysis loss function of the image steganalysis network is a steganalysis loss function. The steganalysis loss function is:

[0082] L total =λ c L con +λ r L rev +λ f L freq

[0083] Where, λ c , λ r and λ f These represent the image loss function L. con Trigger loss function L rev and wavelet transform loss function L freq The weight parameters.

[0084] To ensure that toxic and clean images are as consistent as possible, making it indistinguishable to the human eye, this application embodiment uses an image loss function L... con During training, the L2 distance between the two is calculated. The smaller the L2 loss, the more visually similar the two are.

[0085] Specifically, the image loss function is:

[0086] L con =l2(c,p)

[0087] Where c is the clean image, p is the toxic image, and l2 is the l2 loss between the clean image and the toxic image.

[0088] To ensure that the second trigger recovered by the image steganography network remains consistent with the first trigger after image transformation, this embodiment constructs a trigger loss function to allow the network to learn and construct triggers that can adapt to spatial transformations.

[0089] Specifically, the trigger loss function is:

[0090]

[0091] t , =F(t)

[0092] Where F(t) represents the spatial transformation function of the spatial transformation network, t represents the trigger in the toxic image, and t' represents the first trigger after image transformation. This represents the second trigger that has been restored by the image steganography network.

[0093] In this embodiment, the toxic image is transformed and restored separately, and then the first and second triggers are compared to calculate the deformation effect of the image transformation on the triggers. If the deformation of both is large, it indicates that the currently embedded trigger is easily defended against through image transformation processing.

[0094] To prevent the triggers from being identified or removed by the model through wavelet transform, the image steganography network also includes a wavelet transform loss function.

[0095] Specifically, the wavelet transform loss function is:

[0096] L freq =l2(H(c) LL H(p) LL )

[0097] Among them, H() LL This represents the high-frequency region of the extracted image wavelet transform.

[0098] In this embodiment, the wavelet transform loss function aims to ensure that the high-frequency components of the wavelet transform in the clean image are consistent with those in the toxic image. After training, triggers can be embedded in the low-frequency region of the wavelet transform in the toxic image.

[0099] Furthermore, the role of the image transformation network is to prevent the image steganography network from reconstructing the trigger while keeping p' and p as similar as possible. Therefore, the image transformation network needs to be trained alternately.

[0100] Specifically, the loss function of the image transformation network is:

[0101]

[0102] Wherein, l2(p,p') is the l2 loss between the clean image p and the toxic image p'. α1 and α2 are the L2 loss between the first and second triggers, and are weighting parameters.

[0103] In the embodiments of this application, training an image transformation network can adaptively generate more targeted image transformations to improve the robustness of the image steganography network under different image transformations.

[0104] In this embodiment of the application, the image steganography network and the image transformation network are trained alternately, with the image steganography layer trained for 1 iteration and the image transformation layer trained for 5 iterations.

[0105] After training is completed, a model attack experiment is conducted. The attack method shown in the embodiments of this application is as follows: Figure 3 As shown, the experimental results are shown in Tables 1 to 3.

[0106] Table 1 shows the effect of an attack using the CIFAR-10 dataset with a poisoning rate of 10%. Table 2 shows the effect of an attack using the CIFAR-10 dataset with a poisoning rate of 5%. Table 3 shows the effect of an attack using the CIFAR-10 dataset with a poisoning rate of 3%.

[0107]

[0108] Table 1

[0109]

[0110] Table 2

[0111]

[0112] Table 3

[0113] In Tables 1 to 3, each column represents the image transformation to be performed on a clean or toxic image. The SDriBA_UNet++ row represents the attack method shown in the embodiments of this application, while the other rows represent existing attack methods.

[0114] Here, None, Flip, Rot15, s&p, and C&R represent image transformation methods. None represents the original image, Flip represents flipping, Rot15 represents rotation, and so on.

[0115] CDA represents the victim model's accuracy in classifying clean images after different image transformations. In other words, CDA represents the performance of the victim model in its original classification task; a higher CDA indicates stronger backdoor concealment in the victim model. ASR represents the victim model's accuracy in classifying toxic images after different image transformations into target labels. ASR represents the attack effect of the backdoor attack method shown in this application's embodiments; a higher ASR indicates a higher success rate in triggering the victim model's backdoor.

[0116] Therefore, the higher the CDA and ASR, the better the backdoor attack effect of this backdoor attack method.

[0117] As can be seen from Tables 1 to 3, under different poisoning rates in the CIFAR-10 dataset, the attack method shown in this application embodiment has higher average CDA and average ASR under different image transformations than other backdoor attack methods. Furthermore, the lower the poisoning rate, the better the backdoor attack effect shown in this application embodiment is compared to other methods.

[0118] The attack method shown in this application improves the success rate of backdoor attacks on triggers after other unknown image transformations.

[0119] Example 3

[0120] A backdoor attack system based on image steganography, used in the backdoor attack method based on image steganography described in Embodiment 1 or Embodiment 2.

[0121] The solution of this application has been described in detail above with reference to the accompanying drawings. In the above embodiments, the descriptions of each embodiment have different emphases; parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. Those skilled in the art should also understand that the actions and modules involved in the specification are not necessarily essential to this application.

[0122] Furthermore, it is understood that the steps in the method of this application embodiment can be adjusted, merged, or deleted in order according to actual needs, and the modules in the device of this application embodiment can be merged, divided, or deleted according to actual needs.

[0123] Furthermore, the method according to this application can also be implemented as a computer program or computer program product, which includes computer program code instructions for performing some or all of the steps in the method described above.

[0124] Alternatively, this application may be implemented as a non-transitory machine-readable storage medium (or computer-readable storage medium, or machine-readable storage medium) storing executable code (or computer program, or computer instruction code) that, when executed by a processor of an electronic device (or electronic device, server, etc.), causes the processor to perform some or all of the steps of the methods described above according to this application.

[0125] Those skilled in the art will also understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in connection with the present application can be implemented as electronic hardware, computer software, or a combination of both.

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems and methods according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] The various embodiments of this application have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A backdoor attack method based on image steganography, characterized in that, include: S1. Construct an image steganalysis network and an image transformation network; The image steganography network is a reversible neural network. The image steganography network is used to embed triggers into a clean image to obtain a toxic image; the image transformation network is used to transform the toxic image. S2. The first trigger is obtained by spatially transforming the toxic image; S3. The spatially transformed toxic image is input back into the attack network to restore it and obtain the second trigger; S4. Construct the steganalysis loss function of the image steganalysis network based on the distance loss of the first trigger and the second trigger; S5. Iteratively train the image steganography network; S6. Perform a backdoor attack using the toxic image; The image steganalysis network consists of 16 reversible neural blocks and has a forward process. and reverse process The forward process is as follows: The reverse process is as follows: ); In the forward process, the input is a clean image c and a trigger t, and the output is a toxic image p and latent noise z. In the reverse process, the input is the toxic image after image transformation. and random noise from random sampling ; The reverse operation process of the k-th invertible neural network is as follows: in, A clean image output from the reverse process. The trigger image is the output of the reverse process. Images recovered from the reverse process of a reversible neural block. Potential noise for the recovery of the reverse process of reversible neural blocks; The forward computation process of the k-th reversible neural block in the image steganalysis network is as follows: in, , and These represent three CNN modules with the same structure but different parameters. This represents the clean image output of the k-th reversible neural block. This represents the image output of k-1 reversible neural blocks. The trigger image output is for the k-th reversible neural block. , , These are the weight parameters.

2. The backdoor attack method based on image steganography according to claim 1, characterized in that, The steganalysis loss function includes an image loss function; The image loss function is: Where c represents a clean image; p represents a toxic image. Between the clean image and the toxic image loss.

3. The backdoor attack method based on image steganography according to claim 2, characterized in that, The steganalysis loss function also includes a trigger loss function: The trigger loss function is: Where t represents a trigger, F( ) represents the spatial transformation function of the spatial transformation layer, t' represents the first trigger after image transformation, and t~ represents the second trigger restored by the steganography network.

4. The backdoor attack method based on image steganography according to claim 3, characterized in that, The steganalysis loss function also includes a wavelet transform loss function; The wavelet transform loss function is: Where H( )LL represents the high-frequency region of the extracted image wavelet transform.

5. The backdoor attack method based on image steganography according to claim 4, characterized in that, The steganalysis loss function is: in, , as well as These represent the image loss function. Trigger loss function and wavelet transform loss function The weight parameters.

6. The backdoor attack method based on image steganography according to claim 1, characterized in that, After S5, it also includes: The image transformation network is trained iteratively; The loss function of the image transformation network is: in, For the clean image and the toxic images Between loss, Between the first flip-flop and the second flip-flop loss, These are the weight parameters.

7. The backdoor attack method based on image steganography according to claim 1, characterized in that, The image steganography network and the image transformation network are trained alternately, with the image steganography layer trained for 1 iteration and the image transformation layer trained for 5 iterations.

8. A backdoor attack system based on image steganography, characterized in that, Used to perform the image steganography-based backdoor attack method as described in any one of claims 1 to 7.

Images