Artificial intelligence recognition model confrontation and defense method based on multi-subspace combination

Abstract

An artificial intelligence recognition model confrontation and defense method based on multi-subspace combination comprises the following steps: inputting a sample, mapping activation value vectors of the sample at each node and each layer of the model to different subspaces for consistency expression, namely, the consistency of feature embedding subspaces, and judging whether the sample is a confrontation sample; performing multi-scale change on the discriminated non-attack sample, and comparing the distribution consistency performance of each scale in each node value transmitted in the model, namely the consistency of the scale space to judge whether the sample is an adversarial sample; and carrying out subspace spectrum decomposition on the original pixels of the non-attack samples subjected to further screening or the output value of a certain layer of the neural network, and comparing the consistency of the original pixels or the output value of the certain layer of the neural network in response coefficient statistics of each spectral component, namely, judging whether the samples are adversarial samples according to the spectral space consistency, and realizing full-spectrum defense. Based on multi-irrelevant space analysis, information complementation is achieved, the defense capacity for attack samples is greatly improved, and full-spectrum defense is achieved.

Description

Technical Field

[0001] The present invention relates to a technology in the field of information security, specifically an artificial intelligence recognition model adversarial defense method based on multi-subspace union, which can be applied to intelligent image recognition products, including facial security equipment, such as face scanning gates, security video surveillance, assisted driving cameras, etc., image recognition, face recognition, autonomous driving, and financial security and other security-related tasks. Background Art

[0002] The current mainstream deep learning network system is extremely fragile. Attackers can add subtle changes to the source image data that are difficult for humans to identify through their senses, such as changing the values ​​of only a few pixels, but can make the machine learning model accept and make wrong classification decisions. That is, it outputs wrong judgment results. Adversarial samples make most of the security monitoring systems based on deep learning in the world extremely unreliable. Therefore, it is very important to enhance the adversarial defense of artificial intelligence image recognition models, that is, to identify adversarial samples and make the model immune to adversarial attacks.

[0003] Due to the huge configurable space of adversarial samples and the unpredictability of the timing, method, and parameters of adversarial attacks, it is very difficult for deep networks to identify and defend against attack samples. The existing single adversarial defense method is difficult to deal with various adversarial attacks. At present, most of the research on adversarial sample defense is basically only aimed at several typical adversarial attack algorithms, and it is impossible to achieve full spectrum defense. Summary of the invention

[0004] In view of the shortcomings of the prior art that additional neural networks must be trained and that defense is limited to feature value domain defense against attacks or pixel space defense against samples, the present invention proposes an artificial intelligence recognition model defense method based on multi-subspace union. Based on multi-incoherent space analysis, information is complementary, which greatly improves the defense capability against attack samples and realizes full spectrum defense.

[0005] The present invention is achieved through the following technical solutions:

[0006] The present invention relates to an artificial intelligence recognition model confrontation defense method based on multi-subspace union, comprising:

[0007] Step 1) Consistency judgment of feature embedding subspace: Map the activation value vectors of the input sample at each node and layer of the model to the consistency performance of different subspaces to determine whether it is an adversarial sample;

[0008] Step 2) Scale space consistency judgment: Perform multi-scale changes on the non-attack samples identified in step 1, and compare the distribution consistency of each scale in each node value transmitted by the model to determine whether it is an adversarial sample;

[0009] Step 3) Spectral space consistency judgment: Perform subspace spectral decomposition on the original pixels of the non-attack samples identified in step 2 or the output values ​​of a certain layer of the neural network, and compare the statistical consistency of the response coefficients of each spectral component to determine whether it is an adversarial sample and achieve full spectrum defense. Technical Effects

[0010] This method can deal with single / multiple pixel-level perturbations under norm constraints, global perturbations under constraints such as the first norm / second norm / infinity norm, and various adversarial perturbations under other forms of constraints by judging the consistency of feature space, scale space, and spectral space. It can effectively detect adversarial attack samples against the model itself. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a schematic diagram of the process of the present invention;

[0012] Figure 2 Schematic diagram of consistency judgment of feature embedding subspace;

[0013] Figure 3 Schematic diagram of consistency judgment in scale space;

[0014] Figure 4 Schematic diagram of spectrum space consistency judgment. DETAILED DESCRIPTION

[0015] like Figure 1 As shown, a multi-subspace joint artificial intelligence recognition model confrontation defense method involved in this embodiment includes:

[0016] Step 1: Consistency determination of feature embedding subspace, such as Figure 2 As shown, specifically including:

[0017] 1.1: Extract the embedded features of the input sample image, specifically: f θ (x) = z, where: f θ is the feature extraction function, θ is the parameter, and z is the embedded feature;

[0018] 1.2: Feature decomposition of the embedded feature z is obtained: z = β1a1 + β2a2 + ... + β n a n , where: (a1, a2, …, an) is the characteristic basis, and (β1, β2, …, βn) is the coefficient of the corresponding characteristic basis.

[0019] 1.3: Consistently judge the extracted subspace features, specifically: perform feature decomposition on the embedded representation of the embedded feature z obtained in step 1.1 to obtain the feature coefficients, and judge when βi obeys the normal distribution N(μ i ,σ i ), through the sample training set χ, for each group μ i , σ i Estimate and obtain the distribution space of the characteristic coefficients of the real sample set Where: (μ i ,σ i ) are the mean and variance of the distribution.

[0020] 1.4: For any input sample x, calculate the decision criterion Where: η i is the confidence level of the feature dimension; when the judgment criterion C1 is true, it reflects a large gene sequence inconsistency in the feature dimension, that is, the sample is identified as an attack sample.

[0021] Step 2: Consistency determination of scale space, such as Figure 3 As shown, specifically including:

[0022] 2.1: Change the scale of the non-attack samples identified in step 1 to form images of different scales, which are used but not limited to x0.5, x1, x2, x4;

[0023] 2.2: Input the images of different scales obtained in step 2.1 into the convolutional neural network Set the activation breakpoints of the convolutional neural network and divide it into p intervals: [0, t1), [t1, t2), … [t p-1 ,+∞), and obtain the activation value distribution of each input sample image x in the entire activation domain: Thus, the activation value distribution {Γ1,Γ2,…,Γ n}, n is the number of different scales.

[0024] The convolutional neural network Preferably, the training set χ is obtained by training, and the training set χ is specifically taken from the training set part of the public data sets MNIST, CIFAR10 and CIFAR100.

[0025] 2.3: Use KL divergence to measure the difference in the distribution of activation values ​​obtained in step 2.2, specifically: Where: Γ1, Γ2 are the activation value distributions of input images of different scales.

[0026] 2.4: Calculate the judgment criteria for sample x: Where: η KL is the threshold of the difference in activation value distribution; when the judgment criterion C2 of sample x is true, it means that there is a large difference in the activation value distribution under the two scales, that is, the sample is identified as an attack sample.

[0027] Step 3: Spectral space consistency determination, such as Figure 4 As shown, specifically including:

[0028] 3.1: Perform frequency domain transformation on the non-attack samples identified in step 2 to obtain frequency domain features ξ;

[0029] 3.2: Perform subspace decomposition of the frequency domain feature ξ in the frequency domain space: ξ=γ1σ1+γ2σ2+…+γ n σ n , where: {σ1,σ2,…,σ n} is a set of orthogonal bases, {γ1,γ2,…,γ n} is its corresponding coefficient, σ i is the frequency domain component, γ i is the coefficient of the corresponding frequency domain component.

[0030] 3.3: When the coefficient γ of the subspace decomposition i Follows normal distribution N(μ i ,σ i ), then use the training set χ to calculate each group μ i , σ i Estimate and obtain the sequence of the real sample set in the embedded feature space

[0031] 3.4: Calculate the decision criterion for each input sample x Where: η i is the confidence level of the feature dimension. When the judgment criterion C3 of sample x is true, it is in the frequency domain space, because the distribution of the coefficient of a certain feature dimension jumps out of the confidence interval, that is, it shows a large inconsistency in the frequency domain feature dimension, that is, the sample is identified as an attack sample.

[0032] 3.5: The remaining samples are clean samples.

[0033] After specific practical experiments, in the setting of pytorch 0.4 software environment and NVIDIA X hardware environment, three common network structures, LetNet-5, ResNet50 and ResNet110, were tested.

[0034] The test results of the present invention on three public datasets, MNIST, CIFAR10 and CIFAR100, respectively give the attack misjudgment rates under different adversarial attacks, including FGSM, PGD and BIM, and the misjudgment rates after defense by the present method. Serial number Network structure Dataset Attack Algorithm False positive rate under attack Misjudgment rate after defense 1 LeNet-5 MINIST FGSM 88.38％ 12.07％ 2 LeNet-5 MINIST PGD 100.00％ 51.98％ 3 ResNet-50 CIFAR10 FGSM 77.93％ 19.84％ 4 ResNet-50 CIFAR10 PGD 100.00％ 28.01％ 5 ResNet-110 CIFAR100 FGSM 91.76％ 62.62％ 6 ResNet-110 CIFAR100 PGD 99.89％ 90.55％

[0035] As shown in Table 1, the present invention can significantly improve the recognition rate of adversarial attacks of the original model and detect adversarial samples. Reduce the model's misjudgment rate for adversarial attacks. The multi-subspace joint artificial intelligence recognition model involved in this patent can detect adversarial samples that are inconsistent with clean samples in feature space, scale space, and frequency domain space respectively, and through layer-by-layer screening in a cascade manner, improve the attack sample recognition rate of the method.

[0036] The above-mentioned specific implementation can be partially adjusted in different ways by those skilled in the art without departing from the principle and purpose of the present invention. The protection scope of the present invention shall be based on the claims and shall not be limited by the above-mentioned specific implementation. Each implementation scheme within its scope shall be subject to the constraints of the present invention.

Claims

1. A multi-subspace joint artificial intelligence recognition model confrontation defense method, characterized in that: The activation value vectors of the input samples at each node and layer of the model are mapped to the consistency performance of different subspaces, that is, the consistency of the feature embedding subspace is used to determine whether it is an adversarial sample; the non-attack samples after screening are subjected to multi-scale changes, and the distribution consistency performance of each scale in the node values ​​transmitted by the model is compared, that is, the consistency of the scale space is used to determine whether it is an adversarial sample; the original pixels of the non-attack samples after further screening or the output values ​​of a certain layer of the neural network are subjected to subspace spectral decomposition, and the statistical consistency of the response coefficients of each spectral component is compared, that is, the spectral space consistency is used to determine whether it is an adversarial sample, thereby achieving full spectrum defense.

2. The method for countermeasures against artificial intelligence recognition models based on multi-subspace union according to claim 1 is characterized in that: The consistency judgment of the feature embedding subspace specifically includes: 1.1: Extract the embedded features of the input sample image, specifically: f θ (x) = z, where: f θ is the feature extraction function, θ is the parameter, x is the input sample image, and z is the embedded feature; 1.2: Feature decomposition of the embedded feature z is obtained: z = β1a1 + β2a2 + ... + β n a n , where: a1,…,a n is the characteristic basis, β1,…,β n is the coefficient of the corresponding characteristic basis; 1.3: Consistently judge the extracted subspace features, specifically: perform feature decomposition on the embedded representation of the embedded feature z obtained in step 1.1 to obtain the feature coefficients, and judge when βi obeys the normal distribution N(μ i ,σ i ), through the sample training set χ, for each group μ i , σ i Estimate and obtain the distribution space of the characteristic coefficients of the real sample set Where: (μ i ,σ i ) are the mean and variance of the distribution; 1.4: For any input sample x, based on the decision criteria When the judgment criterion C1 is true, it reflects a large gene sequence inconsistency in the feature dimension, that is, the sample is identified as an attack sample, where: η i is the confidence level of the feature dimension.

3. The method for countermeasures against artificial intelligence recognition models based on multi-subspace union according to claim 1 is characterized in that: The consistency judgment of the scale space specifically includes: 2.1: The non-attack samples obtained after consistency judgment in step 1 are scaled to form images of different scales; 2.2: Input the images of different scales obtained in step 2.1 into the convolutional neural network Set the activation breakpoints of the convolutional neural network and divide it into p intervals: [0, t1), [t1, t2), … [t p-1 ,+∞), and obtain the activation value distribution of each input sample image x in the entire activation domain: Where: Γ is the activation value distribution; 2.3: Use KL divergence to measure the difference in the distribution of activation values ​​obtained in step 2.2, specifically: Where: Γ1, Γ2 are the activation value distributions of input images of different scales; 2.4: Based on the judgment criteria: When the judgment criterion C2 is true, the activation value distribution under the two scales is greatly different, that is, the sample is identified as an attack sample, where: η KL is the threshold for the difference in activation value distribution.

4. The method for countermeasures against artificial intelligence recognition models based on multi-subspace union according to claim 1 is characterized in that: The spectral space consistency determination specifically includes: 3.1: Perform frequency domain transformation on the non-attack samples after consistency judgment in step 2 to obtain frequency domain features ξ; 3.2: Perform subspace decomposition of the frequency domain feature ξ in the frequency domain space: ξ=γ1σ1+γ2σ2+…+γ n σ n , where: {σ1,σ2,…,σ n } is a set of orthogonal bases, {γ1,γ2,…,γ n } is its corresponding coefficient, σ i is the frequency domain component, γ i is the coefficient of the corresponding frequency domain component; 3.3: When the coefficient γ of the subspace decomposition i Follows normal distribution N(μ i ,σ i ), then use the training set χ to calculate each group μ i , σ i Estimate and obtain the sequence of the real sample set in the embedded feature space 3.4: Based on the judgment criteria When the judgment criterion C3 of sample x is true, it is because the distribution of the coefficient of a certain feature dimension in the frequency domain space jumps out of the confidence interval, that is, it shows a large inconsistency in the frequency domain feature dimension, that is, the sample is identified as an attack sample, where: η i is the confidence level of the feature dimension, and the remaining samples are clean samples.

Images