Visual language model stealing attack method and system based on multi-modal information mapping

Abstract

The invention discloses a visual language model stealing attack method and system based on multi-modal information mapping. The method comprises the following steps: performing fine adjustment on a first visual language model based on a first data set; selecting an initial substitution model; inputting the second data set into the target model and the initial substitution model, back-propagating the image-text mapping joint loss function, and updating parameters of the initial substitution model to obtain a final substitution model; and inputting the third data set into the final substitution model, and calculating the retrieval accuracy of the final substitution model. The system comprises a data set division module, a fine tuning module, a pre-selection module, a model training module and a detection module. According to the method, the function of the visual language model can be effectively stolen in the black box scene, the method is not influenced by whether the distribution of the training data sets is the same or not, and a new thought and help are provided for researching potential safety and defense methods of multi-modal models such as the visual language model. The method can be widely applied to the field of information security.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a visual language model stealing attack method and system for multimodal information mapping. Background Art

[0002] Visual language models have been widely used and developed rapidly in many fields due to their excellent performance in integrating vision and language processing. The training of such models usually relies on huge data sets and computing resources, which makes visual language models extremely valuable in the technical and commercial fields, but also makes them more likely to become targets of model theft attacks. Therefore, the security issues related to visual language models cannot be ignored.

[0003] Although model stealing attacks have received widespread attention in recent years, most current research still focuses on unimodal models, and exploration of model extraction attacks against visual language models is relatively limited. Model stealing attacks against multimodal models such as visual language models still face many challenges. In black-box attack scenarios, attackers can only access the input and output of the target model and cannot understand the internal architecture or parameters of the target model. Visual language models involve multimodal data of images and text, which makes the effectiveness of model stealing attacks more susceptible to the distribution consistency of training data sets. Therefore, there is an urgent need for a method that can implement model stealing attacks on visual language models, which can provide a new direction for studying the potential security and defense methods of multimodal models such as visual language models. Summary of the invention

[0004] In view of this, in order to solve the technical problem that it is difficult to simulate and attack multimodal models in existing security detection methods, and thus it is difficult to clarify security, the present invention proposes a visual language model stealing attack method for multimodal information mapping, and the method comprises the following steps:

[0005] Division: The first dataset is used for fine-tuning, the second dataset is used for training, and the third dataset is used for testing and validation;

[0006] Fine-tune the first visual language model based on the first data set to obtain a target model;

[0007] Select a pre-trained visual language model as the initial alternative model;

[0008] Among them, both the target model and the initial substitute model include an image encoder and a text encoder; the substitute model aims to imitate the behavior of the target model, so its input and output forms must be consistent with the target model, that is, both should contain an image encoder and a text encoder to support the functions of inputting images and outputting retrieved texts, or inputting texts and outputting retrieved images;

[0009] Inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining a final substitute model;

[0010] The third data set is input into the final substitution model, and the retrieval accuracy of the final substitution model is calculated.

[0011] In some embodiments, the step of inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining the final substitute model specifically includes:

[0012] Inputting the second data set into the target model to obtain the output of the target model; inputting the second data set into the initial substitute model to obtain the output of the substitute model;

[0013] When the KL divergence loss function is calculated directly using the outputs of the target model and the surrogate model, the value may be too large, resulting in poor training effect of the surrogate model. In order to improve the stability of the KL divergence loss function calculation, the Softmax function is used to normalize the output of the target model, and the LogSoftmax function is used to normalize the output of the surrogate model.

[0014] The outputs of the image and text ends are used to construct a joint loss function for image-text mapping.

[0015] The image-text mapping joint loss function includes the image-to-text cross entropy loss function and the text-to-image cross entropy loss function Image to text KL divergence loss function And the text-to-image KL divergence loss function

[0016] Back-propagate the joint loss function of image-text mapping, iteratively train and update the parameters of the substitution model to obtain the final substitution model.

[0017] In some embodiments, the step of inputting the third data set into the final substitution model and calculating the retrieval accuracy of the final substitution model further includes:

[0018] The third data set is input into the target model; and the retrieval similarity between the target model and the final replacement model is calculated.

[0019] The present invention also proposes a visual language model stealing attack system for multimodal information mapping, the system comprising:

[0020] A data set division module, used for dividing the first data set, the second data set and the third data set;

[0021] A fine-tuning module, which fine-tunes the first visual language model based on the first data set to obtain a target model;

[0022] A pre-selection module, used to select a pre-trained visual language model as the initial alternative model;

[0023] A model training module, used for inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining a final substitute model;

[0024] The detection module is used to input the third data set into the final substitution model and calculate the retrieval accuracy of the final substitution model.

[0025] Based on the above scheme, the present invention provides a visual language model stealing attack method and system for multimodal information mapping. For black-box attack scenarios without original training data, a specific image-text mapping joint loss function is constructed based on multimodal information mapping, thereby implementing a model stealing attack on the visual language model. This provides new ideas and help for studying the potential security and defense methods of multimodal models such as visual language models. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flowchart of the steps of a visual language model stealing attack method of multimodal information mapping of the present invention;

[0027] Figure 2 It is a schematic diagram of data flow in a specific embodiment of the present invention;

[0028] Figure 3 is an experimental effect diagram of retrieving similarity index according to an embodiment of the present invention;

[0029] Figure 4 It is an experimental effect diagram of the retrieval accuracy index of the embodiment of the present invention;

[0030] Figure 5 It is a structural block diagram of a visual language model stealing attack system for multimodal information mapping of the present invention. DETAILED DESCRIPTION

[0031] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0032] It should be noted that, for the convenience of description, only the parts related to the relevant invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0033] It should be understood that the "system", "device", "unit" and / or "module" used in this application is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, if other words can achieve the same purpose, the word can be replaced by other expressions.

[0034] As shown in this application and claims, unless the context clearly indicates an exception, the words "a", "an", "a kind" and / or "the" do not refer to the singular, but also include the plural. In general, the terms "include" and "comprise" only indicate the inclusion of clearly identified steps and elements, and these steps and elements do not constitute an exclusive list. The method or device may also include other steps or elements. The elements defined by the sentence "includes a..." do not exclude the existence of other identical elements in the process, method, commodity or device that includes the elements.

[0035] In the description of the embodiments of the present application, "plurality" means two or more than two. The following terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0036] In addition, flow charts are used in the present application to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, the various steps may be processed in reverse order or simultaneously. At the same time, other operations may also be added to these processes, or a certain step or several steps of operations may be removed from these processes.

[0037] Reference Figure 1 , is a flow chart of an optional example of a visual language model stealing attack method for multimodal information mapping proposed in the present invention. The method can be applied to a computer device. The visual language model stealing attack method proposed in this embodiment may include but is not limited to the following steps:

[0038] Step S1, dividing the first data set, the second data set and the third data set;

[0039] Step S2: fine-tuning the first visual language model based on the first data set to obtain a target model;

[0040] Step S3: Select a pre-trained visual language model as an initial replacement model;

[0041] Step S4, inputting the second data set into the target model and the initial substitution model, back-propagating the image-text mapping joint loss function, updating the parameters of the initial substitution model, and obtaining the final substitution model;

[0042] Step S5: input the third data set into the final substitution model and the target model, calculate the retrieval similarity between the substitution model and the target model, and calculate the retrieval accuracy of the final substitution model.

[0043] The data flow of the overall solution refers to Figure 2 .

[0044] In some embodiments, the step S1 specifically includes:

[0045] The experimental dataset is divided into two non-overlapping parts: the fine-tuning dataset D F And attack dataset D A ; Fine-tuning dataset D F (i.e., the first dataset) contains K sets of images and their corresponding text descriptions, denoted as These data samples are used to fine-tune the pre-trained visual language model; attack dataset D A It is divided into two non-overlapping parts, namely the training set X (i.e., the second data set) and the test set Y (i.e., the third data set), where the training set X contains M groups of images and their corresponding text descriptions, denoted as These data samples are used to iteratively train the alternative model S so that it can fully imitate the behavior pattern of the target model C. The test set Y contains N groups of images and their corresponding text descriptions, denoted as These data samples are used to evaluate the performance of the alternative model S after the attack is implemented;

[0046] Since the attacker cannot obtain the original training data of the target model, the experimental data sets are randomly selected from public data sets with broad representation and diversity, which ensures the diversity and representativeness of the data, thereby improving the accuracy and universality of the attack results;

[0047] In this embodiment, the experimental dataset used is the MSCOCO dataset, which contains about 113,000 images of daily events in natural environments. These images are all from the Flickr website, and each image is accompanied by five text descriptions annotated by Amazon Mechanical Turk (AMT) staff. In this embodiment, 14,500 groups of images and their corresponding text descriptions are randomly selected from the MSCOCO dataset as the fine-tuning dataset D F, 14,500 sets of images and their corresponding text descriptions as the attack dataset D A The training set X in , 1000 sets of images and their corresponding text descriptions are used as the attack dataset D A The test set Y in the fine-tuning dataset D F , the data samples in the training set X and the test set Y are not repeated, so K = 14500, M = 14500, N = 1000.

[0048] In some feasible embodiments, the step S2 specifically includes:

[0049] Use the fine-tuning dataset D F The image encoder and text encoder of the first visual language model are trained, and then the encoder generates embeddings for all image-text pairs to build an image feature library and a text feature library, thereby enabling an image-to-text retrieval API or a text-to-image retrieval API;

[0050] In a black-box attack scenario, the attacker can only access the input and output of the target model, but cannot understand the internal structure or parameters of the target model. Therefore, the attacker cannot know the calculation process of how the target model uses the input image or text to retrieve the matching text or image.

[0051] The attacker mainly has black-box access through two APIs provided by the target model. Through the image-to-text retrieval API, the attacker can input an image and obtain the output text, and through the text-to-image retrieval API, the attacker can input text and obtain the output image. Therefore, the attacker can launch attacks from either the image side or the text side.

[0052] In some feasible embodiments, the step S3 specifically includes:

[0053] The surrogate model aims to mimic the behavior of the target model, so its input and output must be consistent with the target model, that is, it should contain an image encoder and a text encoder to support the function of inputting an image and outputting the retrieved text, or inputting a text and outputting the retrieved image.

[0054] There is no restriction on the type of neural network selected for the alternative model, which provides great flexibility for model design. However, considering that complex neural networks usually have stronger learning capabilities, it is recommended to give priority to models with complex network structures to ensure that the alternative model can better imitate the behavior of the target model.

[0055] In this embodiment, the visual language substitution model used is the CLIP model. The CLIP model is a multimodal pre-trained neural network. Its core idea is to use a large amount of paired data of images and texts for pre-training to learn the alignment relationship between images and texts. The CLIP model has both an image encoder and a text encoder. It can not only input images for retrieval and output texts, but also input texts for retrieval and output images.

[0056] In some embodiments, the step S4 specifically includes:

[0057] S4.1. Input the training data set X into the target model and obtain the output of the target model; for the i-th data pair, its output in image-to-text retrieval is C(I i ), in text-to-image retrieval, its output is C(T i );

[0058] S4.2. Input the same training data set X as in S4.1 into the substitution model and obtain the output of the substitution model. For the i-th data pair, its output in image-to-text retrieval is S(I i ), in text-to-image retrieval, its output is S(T i );

[0059] S4.3. In order to allow the alternative model to continuously learn the mapping relationship between images and texts during training, an image-to-text cross entropy loss function is designed. and text-to-image cross entropy loss function

[0060]

[0061] Among them, CE(·) represents the cross entropy loss function, which quantifies the correlation between two variables. The smaller the value, the greater the correlation between the two variables. i and T i Respectively represent the i-th image and text of the training data set, h(I i ) and h(T i ) represent the hard labels corresponding to the i-th image and text of the training dataset respectively;

[0062] S4.4. In order to transfer the target model’s image-text information mapping knowledge to the substitute model, so that the substitute model can gradually imitate the target model’s ability to align images and texts during iterative training, it is necessary to minimize the distance between the substitute model’s output and the target model’s output and design the image-to-text KL divergence loss function. And the text-to-image KL divergence loss function

[0063]

[0064] Where KL(·) represents the KL divergence loss function, which is used to measure the distance between two probability distributions. The smaller its value is, the closer the output of the surrogate model is to the output of the target model. τ represents the temperature coefficient. By adjusting this coefficient, the output probability distribution can be smoother, thereby helping the surrogate model to better learn the knowledge of the target model. i and T i Represent the i-th image and text of the training dataset respectively; in iterative training, by optimizing the loss function, the output of the substitute model will gradually approach the output of the target model;

[0065] In this embodiment, when the KL divergence loss function is directly calculated using the outputs of the target model and the surrogate model, the value may be too large, resulting in poor training effect of the surrogate model. In order to improve the stability of the calculation of the KL divergence loss function, it is necessary to improve it, that is, normalize the outputs of the target model and the surrogate model before calculation. Specifically, the output of the target model is normalized using the Softmax function, and the output of the surrogate model is normalized using the LogSoftmax function; the Softmax and LogSoftmax functions are extended forms of the logic function, which compress an R-dimensional vector of any real number into an R-dimensional real vector, so that the value of each element is in the range of (0, 1), and the sum of all elements is 1;

[0066] This normalization helps avoid numerical instability problems that may occur when directly calculating KL divergence on unnormalized output results, especially when dealing with larger scores; by normalizing the output to probability values, the Softmax and LogSoftmax functions can prevent the values ​​from being too large or too small, thereby improving the numerical stability of the KL divergence calculation and ensuring the effectiveness and accuracy of the training process.

[0067] Therefore, the normalized and improved KL divergence loss function is:

[0068]

[0069]

[0070] S4.5. In order to enable the alternative model to simultaneously learn the information mapping relationship between the image-to-text retrieval process and the text-to-image retrieval process, the image-text mapping joint loss function LossS for training the alternative model is designed by combining the cross entropy loss function and the improved KL divergence loss function:

[0071]

[0072] S4.6, back-propagating the joint loss function LossS of the image-text mapping and updating the substitute model, so that the output of the substitute model changes in the direction of the target model output, so as to achieve the purpose of gradually approaching the function of the target model; repeating the training steps, iteratively training the substitute model until the substitute model converges or reaches a certain number of training rounds;

[0073] In some feasible embodiments, the step S5 specifically includes:

[0074] S5.1. Input the test data set Y into the surrogate model and the target model, and obtain their output S(y i ) and C(y i ), calculate the similarity u:

[0075]

[0076] Where N is the number of samples in the test set Y, and u is the ratio of the number of samples with the same output results of the target model and the alternative model to the total number of samples for the test data set Y. The larger the u, the higher the retrieval similarity between the target model and the alternative model, and the smaller the u, the lower the retrieval similarity between the target model and the alternative model, and y i represents the i-th training sample in the test data set Y;

[0077] S5.2. Input the test data set Y into the alternative model S, obtain its output, and calculate the retrieval accuracy Recall@K:

[0078]

[0079] Among them, in image-to-text retrieval, Recall@K calculates the percentage of correctly matched texts in the first K retrieval results output by the model, while in text-to-image retrieval, Recall@K calculates the percentage of correctly matched images in the first K retrieval results; in this embodiment, K=1.

[0080] The experimental results are as follows Figure 3 and Figure 4 As shown, from Figure 3 and Figure 4 It can be seen that the visual language model stealing attack method and system of the multimodal information mapping of the present invention can achieve higher retrieval similarity u and retrieval accuracy Recall@1 when the training data set is identically distributed. Even when the training data set is not identically distributed with the original data set, the retrieval similarity u and retrieval accuracy Recall@1 of the replacement model can achieve an effect close to that of the identical distribution.

[0081] Based on the above scheme, the visual language model stealing attack method and system for multimodal information mapping designed by the present invention can effectively steal the function of the visual language model in a black box scenario and achieve high retrieval similarity and retrieval accuracy; the visual language model stealing attack method and system for multimodal information mapping designed by the present invention can achieve the retrieval similarity and retrieval accuracy of the alternative model close to the effect under the same distribution when the distribution of the training data set is inconsistent with the original data set; the model stealing attack method designed by the present invention is not only applicable to the visual language model, but can also be extended to other multimodal models, and has universal applicability. The attacker can effectively attack multimodal models with unknown information such as various structures and parameters.

[0082] like Figure 5 As shown, a visual language model stealing attack system for multimodal information mapping includes:

[0083] A data set division module, used for dividing the first data set, the second data set and the third data set;

[0084] A fine-tuning module, which fine-tunes the first visual language model based on the first data set to obtain a target model;

[0085] A pre-selection module, used to select a pre-trained visual language model as the initial alternative model;

[0086] A model training module, used for inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining a final substitute model;

[0087] The detection module is used to input the third data set into the final substitution model and calculate the retrieval accuracy of the final substitution model.

[0088] The contents of the above method embodiments are all applicable to the present system embodiments. The functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0089] A visual language model stealing attack device for multimodal information mapping:

[0090] at least one processor;

[0091] at least one memory for storing at least one program;

[0092] When the at least one program is executed by the at least one processor, the at least one processor implements the visual language model stealing attack method for multimodal information mapping as described above.

[0093] The contents of the above method embodiments are all applicable to the present device embodiments. The functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0094] A storage medium stores processor-executable instructions, which are used to implement a visual language model stealing attack method for multimodal information mapping when executed by the processor.

[0095] The contents of the above method embodiments are all applicable to the present storage medium embodiments. The functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0096] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A visual language model stealing attack method for multimodal information mapping, characterized in that: The following steps are involved: dividing the first data set, the second data set, and the third data set; Fine-tune the first visual language model based on the first data set to obtain a target model; Select a pre-trained visual language model as the initial alternative model; Inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining a final substitute model; The third data set is input into the final substitution model, and the retrieval accuracy of the final substitution model is calculated.

2. According to the visual language model stealing attack method of multimodal information mapping described in claim 1, it is characterized in that: Also includes: inputting the third data set into the target model; The retrieval similarity between the target model and the final alternative model is calculated.

3. According to the visual language model stealing attack method of multimodal information mapping as described in claim 1, it is characterized in that: The formula of the joint loss function of image-text mapping is as follows: in, represents the image-to-text cross entropy loss function, represents the text-to-image cross entropy loss function, represents the image-to-text KL divergence loss function, Represents the text-to-image KL divergence loss function.

4. According to the visual language model stealing attack method of multimodal information mapping described in claim 1, it is characterized in that: The step of inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining the final substitute model further includes: Normalizing the output of the target model based on a Softmax function; The output of the surrogate model is normalized based on the LogSoftmax function.

5. According to the visual language model stealing attack method of multimodal information mapping as described in claim 1, it is characterized in that: The target model and the initial substitute model both include an image encoder and a text encoder.

6. According to claim 2, a visual language model stealing attack method for multimodal information mapping is characterized in that: The calculation formula of the retrieval similarity is expressed as follows: Where N represents the number of samples in the third data set; u represents the ratio of the number of samples with the same output results of the target model and the alternative model to the total number of samples for the third data set; S(·) represents the output of the alternative model; C(·) represents the output of the target model; y i represents the i-th sample in the third data set.

7. A visual language model stealing attack system for multimodal information mapping, characterized in that: include: A data set division module, used for dividing the first data set, the second data set and the third data set; A fine-tuning module, which fine-tunes the first visual language model based on the first data set to obtain a target model; A pre-selection module, used to select a pre-trained visual language model as the initial alternative model; A model training module, used for inputting the second data set into the target model and the initial substitute model, back-propagating the joint loss function of image-text mapping, updating the parameters of the initial substitute model, and obtaining a final substitute model; The detection module is used to input the third data set into the final substitution model and calculate the retrieval accuracy of the final substitution model.

8. A visual language model stealing attack device for multimodal information mapping, characterized in that: include: at least one processor; at least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor implements a visual language model stealing attack method for multimodal information mapping as described in any one of claims 1-6.

Images