Verifiable robustness optimization method in confrontation environment based on mask auto-encoder

Abstract

The invention provides a verifiable robustness optimization method in an adversarial environment based on a mask auto-encoder, and the method comprises the following steps: firstly, obtaining an image data set, and carrying out the random attack and preprocessing of the data set; then, performing distribution boundary curvature evaluation on the confrontation samples in the data set after random attack, and rejecting confrontation samples with low purification potential according to an evaluation result; secondly, reconstructing the purified and rejected adversarial sample by using a mask auto-encoder to obtain a purified sample; and finally, carrying out global smooth optimization on the purified sample to improve the global representativeness. According to the method, the samples after attack can be effectively purified, the problem that a purification model is a black box and cannot be theoretically proved is avoided through process design, and multiple methods and processes of the random smoothing technology are optimized.

Description

Technical Field

[0001] The present invention relates to the field of attack and defense and information protection technology, and in particular to a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder. Background Art

[0002] With the success of deep learning in different application fields, deep learning models have been widely deployed in many commercial systems. Including critical systems with extremely high safety requirements, such as autonomous driving and AI-assisted diagnosis systems. Therefore, the security, reliability and robustness of deep learning models have received increasing attention. However, studies have shown that deep learning models are highly susceptible to adversarial examples, which are constructed by adding subtle perturbations to benign examples and can mislead the model to make wrong final decisions with high confidence. In recent years, there have been a large number of empirical studies on model robustness, which have played a certain role, such as Adversarial Training, but such defense methods are often quickly broken by more powerful adaptive attacks and cannot fundamentally provide robustness guarantees for the model.

[0003] Verifiable robustness is considered to be a method that can provide a lower limit guarantee for the robustness of deep learning models. It is a rigorous model credibility measurement method based on mathematical proof. In the image classification task, verifiable robustness can measure the lower limit of the robustness of a classifier and calculate the robustness radius for each image sample, indicating that all norm attacks with attack strength within this radius will not interfere with the classification results of the classifier. This technology has many advantages, such as: (1) ensuring that the model can maintain its performance and prediction reliability when facing adversarial samples, preventing malicious attackers from using adversarial samples to attack; (2) providing compliance standards for deep learning models to operate under legal and regulatory frameworks; (3) effectively preventing malicious use of data sets and promoting data sharing and technological progress.

[0004] In recent years, with the continuous development of deep learning technology, Lecuyer et al. proposed random smoothing technology (random smooth) in 2019. Random smoothing can transform any base classifier into a new "smooth classifier" that is provably robust under the Euclidean norm, and use it to train the first provably robust classifier for ImageNet. Cohen et al. proved the first tight robustness guarantee of random smoothing, and used the Monte Carlo algorithm to solve the problem that the robustness radius cannot be accurately calculated. Subsequent research works have adopted different training strategies to maximize the certified robust radius, including the integration method proposed by Horvath and the adversarial training of the smooth model proposed by Salman et al. In addition, Yang et al. extended this method to general bilinear perturbations by adopting noise of different shapes.

[0005] In summary, the field of verifiable robustness is a topic worthy of in-depth research. This patent intends to explore several key points in this field to solve the difficulties and key points of current methods.

[0006] A key point of verifiable robustness is the security of the data set. Once the data set is maliciously attacked, the subsequent reasoning link will lead to incorrect results. However, most of the current methods simply follow this premise and have never considered how to ensure the correct evaluation of verifiable robustness in an adversarial environment. Specifically, there are two main difficulties:

[0007] 1. How to correctly evaluate the verifiable robustness of the model in an adversarial environment. Mainly focusing on the purification and restoration of image samples, how to design a fast and reliable image purification model based on comprehensive considerations of time efficiency and purification capabilities.

[0008] 2. The distribution of the purified image will deviate from the original image distribution, which will affect the mathematical proof process of the random smoothing method. However, the purification model is usually a black box, and the mathematical relationship between the distribution before and after cannot be determined. How to measure the impact of the distribution of the purified image on the results and re-prove the verifiable robustness radius of the classifier is a necessary task. Summary of the invention

[0009] The purpose of the present invention is to address the deficiencies of the prior art and propose a verifiable robustness optimization method in an adversarial environment based on a masked autoencoder, which can effectively purify samples after adversarial attacks, and circumvent the problem that the purification model is a black box and cannot be theoretically proved through process design, and also optimizes many method processes of random smoothing technology.

[0010] In order to solve the above technical problems, the technical solution of the present invention is:

[0011] A method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder comprises the following steps:

[0012] Step 1: Random attack on the dataset;

[0013] Step 2: Evaluate the curvature of the adversarial sample distribution boundary;

[0014] Step 3: Use the masked autoencoder to reconstruct and purify the adversarial sample;

[0015] Step 4: Use global smoothing optimization to improve the global representativeness of the results;

[0016] Step 5: Run the random smoothing method on the cleaned samples to evaluate the results.

[0017] As a preferred method, step 1 is to randomly attack the data set. The specific steps are as follows:

[0018] 1-1. Random attack: Use existing methods to perform white-box attacks on dataset image samples, so that they can deviate from the distribution of the original image and change the classification label of the classifier.

[0019] 1-2. Image cropping and scaling so that the sample can match the input of the masked autoencoder.

[0020] Preferably, step 2 evaluates the curvature of the adversarial sample distribution boundary, and the specific steps are as follows:

[0021] 2-1. Use a pre-trained classification network as the classifier E and sample the image samples in the L2 norm ball with different noise intensities σ.

[0022] 2-2. For each sampling result under noise intensity σ, entropy is used to quantify the degree of disorder of the distributed information within the sampling range. The entropy expression is:

[0023]

[0024] Among them, the random variable X represents the sample currently calculated, p(x i ) is the probability that the random variable X is judged as a different label by the classifier.

[0025] 2-3. Pre-eliminate samples with low purification potential and directly return specific results.

[0026] Preferably, the pre-trained classification network in step S2 is BEiT.

[0027] Preferably, step 3 uses a masked autoencoder to reconstruct and purify the adversarial sample. The specific steps are as follows:

[0028] 3-1. For adversarial samples, we use Grad-CAM technology to reveal the decision-making process of convolutional neural networks. We use the activation map H of the last convolutional layer and the gradient c obtained by backpropagation. The gradient c reflects the sensitivity of the network output (i.e., the category score) relative to the convolutional layer features. Finally, we combine the gradient c and the convolutional layer activation map H to calculate the sum of the weighted feature maps to obtain an activation map of a class. This process can be expressed as a weighted summation operation, where the activation value of each feature map is multiplied by its corresponding gradient value and accumulated. These locations that contribute highly to the result are usually also the locations where the adversarial noise is concentrated.

[0029] 3-2. Using an activation mapping based The mask strategy is used to mask the adversarial sample X in batches, each time masking off a part of the adversarial noise and other random positions to obtain the masked input

[0030] 3-3. Input the masked The encoder part is fed into a pre-trained masked autoencoder. The encoder is a neural network that compresses the input into a low-dimensional latent space representation. This representation captures the important features of the input data. Then, the decoder part of the pre-trained masked autoencoder is used to reconstruct the image. This reconstruction process attempts to restore the visible parts of the original input and fill in the masked parts, and finally integrates them into Restore to the original image after purification This means that the reconstructed patches are placed in the spatial context of the original image to form a complete image;

[0031] 3-4. For all the original images reconstructed in batches The data distribution is weighted averaged at the pixel level to obtain the final purified image

[0032] In the above technical solution, a new method is used to purify samples after the attack, and a reasonable masking strategy is designed to achieve the purification purpose.

[0033] Preferably, step 4 uses global smoothing optimization to improve the global representativeness of the results, as follows:

[0034] 4-1. After purification, the input sample Sampling is performed, and for each sampling, in the sample Samples are taken from the L2 norm ball with surrounding noise intensity σ and sent to the classifier to obtain the confidence vector.

[0035] 4-2. All confidence vectors are stored in a set. For each element of the set, a weighted average with other C random elements is required as the final result to avoid randomness of the result.

[0036] 4-3. Convert the weighted averaged global confidence vector into label y for output.

[0037] In the above technical solution, samples with low purification potential are eliminated in advance by analyzing the boundary curvature of the adversarial sample distribution, a combined mask strategy is used to purify the image, and a global smoothing technique is used to ensure the globality of the results.

[0038] The present invention has the following characteristics and beneficial effects:

[0039] Using the above technical solution, this method takes into account the defects of previous verifiable robustness evaluation methods in the face of adversarial environments, and innovatively proposes a purification method based on masked autoencoders, which is faster in inference speed than the traditional purification method based on Diffusion. At the same time, the smooth method of random smoothing is optimized so that the results can better reflect the global distribution. The experimental results clearly confirm the efficiency and practicality of the proposed method. The proposed method considers the verifiable robustness evaluation method more comprehensively.

[0040] The specific features are as follows: (1) The evaluation method is suitable for strict adversarial attack environments; (2) The purification method has fast inference speed and significant purification effect; (3) Information entropy is used to evaluate the boundary curvature of adversarial sample distribution, and data is screened in advance based on the potential for purification; (4) The evaluation output results can better reflect the global characteristics and avoid the influence of randomness on the results; (5) The method process is highly transferable. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0042] Figure 1 FIG. 4 is a flowchart of the working architecture of an embodiment of the present invention.

[0043] Figure 2 The figure is a flow chart of the purification method according to an embodiment of the present invention.

[0044] Figure 3 This is a comparison result of the evaluation indicators between the embodiment of the present invention and the prior art.

[0045] Figure 4This is the experimental result of the purification rate comparison between this method and other methods. DETAILED DESCRIPTION

[0046] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0047] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", and the like may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0048] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0049] The present invention provides a method for optimizing the robustness of a masked autoencoder in an adversarial environment. Figure 1 As shown, the following steps are included:

[0050] Step 1: Obtain an image dataset and perform random attacks and preprocessing on the dataset. Specifically:

[0051] Random attack: Use existing methods to perform white-box attacks on image samples in the dataset, so that they can deviate from the distribution of the original image and change the classification labels of the classifier. Specifically, the attack model is selected through the autoAttack library, and the attack is performed according to the common attack intensity set according to the dataset.

[0052] Preprocessing: Image cropping and scaling are performed so that the sample can match the input of the mask autoencoder. For the Imagenet dataset, it is cropped to a size of 224*224 to accommodate the input of the model in subsequent steps.

[0053] Step 2: Evaluate the distribution boundary curvature of the adversarial samples in the dataset after random attack, and remove adversarial samples with low purification potential based on the evaluation results.

[0054] Specifically, the steps are as follows:

[0055] 2-1. Use a pre-trained noise-robust classification network as the classifier E, and sample the image samples in the L2 norm ball with different noise intensities σ.

[0056] In this embodiment, BEiT is used as the classifier E. It should be noted that other classification networks are also applicable to the technical solution of the present invention. For example, ResNet50 can replace BEiT as the classifier E.

[0057] Furthermore, in this embodiment, the value of σ is 0.00, 0.25, 0.50, 0.75, and 1.00.

[0058] 2-2. For each sampling result under noise intensity σ, entropy is used to quantify the degree of disorder of the distributed information within the sampling range.

[0059] The specific method is: sampling at different noise intensities and feeding them into the classifier E, obtaining the topK labels corresponding to the confidence vector of each sampling point, the frequency of the top3 labels in the total sample points, and the change of the top3 labels after the noise intensity σ changes. Calculate the distribution boundary curvature corresponding to a specific entropy value as a measure of the purification potential, and its expression is:

[0060]

[0061] Among them, the random variable X represents the sample currently calculated, p(x i ) is the probability that the random variable X is judged as a different label by the classifier.

[0062] It can be understood that the entropy value can reflect the curvature of the distribution boundary of the classifier for the current sample to a certain extent, and then serve as a measure of the potential for purification. Specifically, if the entropy value of a batch of data distribution is high, then their distribution in the Gaussian space may be more dispersed, and their potential for purification is smaller, because for the classifier they do not belong to multiple labels.

[0063] 2-3. Pre-eliminate samples with low purification potential.

[0064] Specifically, the top 3 labels are obtained under four different σ, with a total of 12 label data.

[0065] It should be noted that in an ideal situation (distribution boundary distribution is stable), the top 3 labels under each σ are the same. Then, after deduplication of the 12 label data, there are only 3 labels, and the entropy value reaches the minimum. In the worst case, there are 12 labels after deduplication, and the entropy value reaches the maximum.

[0066] Therefore, selecting a suitable entropy value can define the curvature threshold of the distribution boundary curve, thereby excluding samples that are difficult to purify because they are located at "convex points". For the case of this embodiment, the entropy value range of the 12 distributions is approximately between 1.75 and 3.25. After experiments, 2.5 is set as the entropy threshold to represent that the distribution boundary of the classifier for the current sample is "convex".

[0067] Step 3: Use the masked autoencoder to reconstruct the adversarial sample after purification and elimination to obtain the purified sample.

[0068] The specific steps are as follows:

[0069] 3-1. For adversarial samples, we use the CAM heat map H and the gradient c obtained by backpropagation of the network. The gradient c reflects the sensitivity of the network output (i.e., the category score) relative to the convolutional layer features. Finally, we combine the gradient c and the convolutional layer activation map H to calculate the sum of the weighted feature maps to obtain an activation map of a class. This process can be expressed as a weighted sum operation, in which the activation value of each feature map is multiplied by its corresponding gradient value and accumulated; the output of the deactivated convolutional layer is calculated

[0070] It can be understood that these locations that contribute most to the results are usually also the locations where adversarial noise is concentrated. According to the requirements for fine-grained heat maps, appropriate layers can be selected, such as 7*7 and 14*14.

[0071] In this embodiment, 14*14 is used, that is, for the ImageNet dataset with a size of 224*224 after being trimmed, the size of each image block is 16*16.

[0072] 3-2. Using an activation mapping based The mask strategy is used to mask the adversarial sample X in batches, and each mask will cover the activation map Some highly activated areas in and some randomly selected background areas to obtain the masked input

[0073] Among them, the high activation area refers to the area where the adversarial noise may be concentrated.

[0074] Considering that the positions with high values ​​in the heat map usually correspond to the feature positions of the image and are also the positions where the adversarial noise is concentrated, masking the feature positions can effectively cover the adversarial areas, but it also affects the image reconstruction effect because the key feature positions are masked. In order to solve this contradiction, in this embodiment, a batch masking strategy is adopted, which mainly meets the following points:

[0075] 1. The single mask distribution needs to conform to a certain degree of randomness and cannot mask continuous areas, which is related to the reconstruction effect of the masked autoencoder.

[0076] 2. Extract all feature positions, that is, adversarial areas, in advance, and mask a part of them each time to ensure that each position is masked overall.

[0077] 3. A random masking strategy is adopted for other background parts to ensure the randomness of the results while also taking into account the purification of background noise.

[0078] 3-3. Input the masked The encoder part is fed into the pre-trained masked autoencoder. As you can understand, the encoder is a neural network that compresses the input into a low-dimensional latent space representation. This representation captures the important features of the input data. Then, the decoder part of the pre-trained masked autoencoder is used to reconstruct the image. This reconstruction process attempts to restore the visible parts of the original input and fill in the masked parts, and finally integrates them into Restore to the original image after purification This means that the reconstructed patches are placed in the spatial context of the original image to form a complete image.

[0079] 3-4. For all the original images reconstructed in batches The data distribution is weighted averaged at the pixel level to obtain the final purified image Specific as Figure 2 shown.

[0080] Step 4: Perform global smoothing optimization on the purified samples to improve global representativeness. The specific steps are as follows:

[0081] 4-1. After purification, the input sample Sampling is performed, and for each sampling, in the sample Samples are taken from the L2 norm ball with surrounding noise intensity σ and sent to the classifier to obtain a confidence vector. Here, the total number of samples taken is set to N, and the final result is these N confidence vectors.

[0082] 4-2. All confidence vectors are stored in a set. For each element of the set, a weighted average with other C random elements is required as the final result to avoid randomness of the result.

[0083] It is understandable that the larger the value of C (for example, about 10), the more it can represent the global distribution within the L2 norm ball. Such a strategy is beneficial to samples with stable surrounding distributions, and this method has already eliminated unstable samples in advance through curvature analysis.

[0084] 4-3. Convert the weighted averaged global confidence vector into label y for output.

[0085] Finally, in order to further illustrate the effectiveness of the technical solution of this embodiment, in this embodiment, the random smoothing method is run on the purified sample to evaluate the results. The specific steps are as follows:

[0086] First, for the input sample Perform n0 sampling and sample within the L2 norm ball of Gaussian noise with intensity σ, and input the classifier to obtain the initial prediction category

[0087] Repeat the above sampling steps, but perform a larger n sampling, input the classifier to obtain the main classification results, and calculate The confidence lower bound of . The confidence set of the main classification results is Then we can get The expression for the lower confidence bound of is:

[0088]

[0089] If p a If it is greater than 0.5, the predicted category and robustness radius are returned, otherwise it is abandoned. The calculation formula of the robustness radius is:

[0090]

[0091] In order to verify the efficiency of the proposed method, it is compared with current excellent methods (such as randomizedsmoothing, DiffSmooth, etc.), the inference time and verifiable robust radius are calculated, and the sample results are integrated and statistically analyzed. The lower limit of the robustness of the model is analyzed, and calculations are performed on multiple data sets and models to analyze the reusability of the method.

[0092] The experimental results of this embodiment are compared with those of the existing verifiable robustness evaluation method. Figure 3 As shown. Figure 3 It can be seen that the verifiable robustness accuracy of the proposed method under each robust radius σ is higher than that of other methods.

[0093] In addition, for the proposed purification method based on masked autoencoder, a separate module is used to evaluate the purification ability. The standard robustness accuracy (Standard Acc) and adversarial robustness accuracy (Robust Acc) of the model are tested using the standard adversarial attack AutoAttack based on the BobustBench benchmark. In this embodiment, the models used are BEiT and ResNet-50, whose standard robustness accuracy is about 80% and 66.5% respectively. Standard adversarial samples are used to evaluate their adversarial robustness accuracy. The experimental results of this embodiment are compared with those of the existing purification method. Figure 4 As shown. Figure 4 It can be seen that under the two model architectures of BEiT and ResNet-50, the verifiable robustness accuracy of the proposed method at each robust radius σ is higher than that of other methods.

[0094] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments including components are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A verifiable robustness optimization method based on masked autoencoders in adversarial environments, characterized in that: The steps include: Step 1: Obtain an image dataset and perform random attacks and preprocessing on the dataset; Step 2: Evaluate the distribution boundary curvature of adversarial samples in the dataset after random attack, and remove adversarial samples with low purification potential based on the evaluation results; Step 3: Use the masked autoencoder to reconstruct the adversarial sample after purification and removal to obtain the purified sample; Step 4: Perform global smoothing optimization on the purified samples to improve global representativeness.

2. According to claim 1, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: The random attack method is to perform a white box attack on the image samples in the data set to make them deviate from the distribution of the original image and change the classification label of the classifier.

3. According to claim 1, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: The preprocessing method is: by cropping and scaling, the sample can match the input of the masked autoencoder.

4. According to claim 1, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: In step 2, a pre-trained classification network BEiT is used to evaluate the boundary curvature of the adversarial sample distribution.

5. According to claim 4, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: The distribution boundary curvature evaluation method is: First, a pre-trained classification network BEiT is used as the classifier E, and the image samples are sampled in the L2 norm ball with different intensities σ; For each sampling result under noise intensity σ, entropy is used to quantify the degree of disorder of the distribution information within the sampling range. The entropy expression is: Among them, the random variable X represents the sample currently calculated, p(x i ) is the probability that the random variable X is judged as a different label by the classifier.

6. According to claim 1, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: The step 3 includes the following sub-steps: Step 3-1: For adversarial samples, use Grad-CAM technology to reveal the decision-making process of the convolutional neural network. Use the activation map H of the last convolutional layer and the gradient c obtained by back propagation, combine the gradient c and the convolutional layer activation map H to calculate the sum of the weighted feature maps, and thus obtain an activation map of a class. Step 3-2: Use an activation mapping based The masking strategy is used to mask the adversarial sample X in batches, each time masking off a certain part of the adversarial noise and other random positions to obtain the masked input Step 3-3: Input the masked The encoder part of the pre-trained masked autoencoder is fed with the input Compressed into a low-dimensional latent space representation Then use the decoder part of the pre-trained masked autoencoder to reconstruct and obtain the reconstructed Finally, the integration operation Restore to the original image after purification This means that the reconstructed patches are placed in the spatial context of the original image to form a complete image; Step 3-4: Reconstruct all original images in batches The data distribution is weighted averaged at the pixel level to obtain the final purified image 7. According to claim 1, a method for optimizing verifiable robustness in an adversarial environment based on a masked autoencoder, characterized in that: The step 4 includes the following sub-steps: Step 4-1: clean the input sample Sampling is performed, and for each sampling, in the sample Samples are taken from the L2 norm ball with surrounding noise intensity of σ, and sent to the classifier to obtain a confidence vector. The total number of samples taken is set to N, and finally N confidence vectors are obtained; Step 4-2: Store all confidence vectors into a set, and perform weighted average of each confidence vector with other random C confidence vectors to obtain a global confidence vector as the final result. Step 4-3: Convert the weighted averaged global confidence vector into label y for output.

Images