A hidden video attack method
By constructing a video attack method with feature extraction modules and encoders, the high training cost and visual inconsistency problems of video attack models are solved, and efficient malicious information embedding and attack effect improvement are achieved.
Patent Information
- Application Number
- CN202411662509.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-09-30
- Estimated Expiration
- 2044-11-20
AI Technical Summary
Existing video attack models suffer from high training costs, insufficient embedding of malicious information, and visual inconsistency issues, resulting in unsatisfactory attack effects.
An implicit video attack method is adopted to generate high-dimensional and low-dimensional image features by constructing a feature extraction module, first-level and second-level encoders, and a pre-trained CLIP image encoder. The attack network is trained using adversarial loss and pixel loss to generate a video-text dataset after the attack.
It reduces the cost of model training, improves the concealment and visual consistency of malicious information, and enhances the attack efficiency and success rate of the model.
Smart Images
Figure CN119484849B_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the field of artificial intelligence, and in particular to an implicit video attack method. Background Art
[0002] With the popularization of digital media and the Internet, video content has become an important source of information and entertainment in people's daily lives. However, malicious behavior and information security issues in cyberspace have become increasingly prominent. Video attacks, as an emerging means of network attack, have attracted widespread attention in recent years. The technical background of video attacks involves multiple links such as video generation and editing, information dissemination and reception. From the attacker's perspective, they may use advanced video processing technology to add malicious information to the video, and spread the malicious information with the help of the video, thereby attacking other models. These technologies include but are not limited to frame replacement and malicious video generation. They can embed specific information into the video without arousing the audience's suspicion, and then attack other models. Video attacks have become a research hotspot mainly because we can use video attack models to test the robustness of other models, which is an important part of model security robustness research.
[0003] However, existing video attack models have some shortcomings:
[0004] 1. High training costs: Video attack models often require large amounts of training data and computing resources to optimize their performance. This is because video data has higher dimensionality and complexity than image or text data, so the model needs to learn more features to effectively generate or tamper with video content. In addition, to ensure that attack videos can be disseminated without detection, the model also requires detailed tuning and testing, which further increases training costs.
[0005] 2. Insufficient malicious information embedding: Existing video attack techniques may not be able to fully embed malicious information into the original video, resulting in suboptimal attack effectiveness. This may be because the attack algorithm struggles to embed sufficient malicious information without affecting the viewing experience while maintaining the visual quality of the video.
[0006] 3. Visual inconsistency: Visual inconsistency between the infected video and the original video is another important issue in video attack research. If the infected video appears visually unnatural or has obvious signs of tampering, it can easily be noticed and become suspicious by users, or easily detected by algorithms.
[0007] In summary, video attack research faces challenges such as high training cost, insufficient embedding of malicious information, and visual inconsistency. Summary of the Invention
[0008] In order to address the deficiencies of the above-mentioned prior art, the present invention proposes an implicit video attack method, which is intended to attack videos efficiently and with high quality, thereby improving the attack efficiency of the model and enhancing the concealment of malicious information.
[0009] In order to achieve the above-mentioned object, the present invention adopts the following technical solutions:
[0010] The implicit video attack method of the present invention is characterized in that it is performed according to the following steps:
[0011] Step 1: Get a clean image dataset ,make Any clean image is recorded as x; any malicious image is recorded as y;
[0012] Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ;
[0013] Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features ;
[0014] Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thereby obtaining the attack image features in the low-dimensional space ;
[0015] Step 2.3: The second-level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space , thereby generating high-dimensional image attack features ;
[0016] Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get high-dimensional clean image features and high-dimensional attack image features ;
[0017] (14)
[0018] Step 3: Construct the adversarial loss for attacking the network , including: feature difference loss and pixel loss ;
[0019] Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained ;
[0020] Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original video, is with The corresponding text description, is the total number of videos; where Indicates the A video of the aftermath of the attack.
[0021] The implicit video attack method of the present invention is also characterized in that step 2.2 is performed as follows:
[0022] Step 2.2.1: Use equations (1) and (2) to obtain the first-stage clean features and first-stage malicious features ;
[0023] (1)
[0024] (2)
[0025] In formula (1) and formula (2), is the ReLU activation function, and Represent the weights and biases to be trained in the convolutional layer respectively;
[0026] Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious information features ;
[0027] (3)
[0028] (4)
[0029] In formula (3) and formula (4), represents the downsampling operation;
[0030] Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ;
[0031] (5)
[0032] In formula (5), Represents 3 consecutive ResNet network modules;
[0033] Step 2.2.4: Use formula (6) to obtain the clean image query features , clean image keyword features and clean image value features ;
[0034] (6)
[0035] In formula (6), and Represent the weights and biases to be trained in the second convolution, and Represent the weights and biases to be trained in the third convolution, and Respectively represent the weights and biases to be trained in the fourth convolution;
[0036] Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ;
[0037] Softmax (7)
[0038] In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition;
[0039] Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ;
[0040] (8)
[0041] Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ;
[0042] (9)
[0043] In formula (9), Represents a ResNet network, and Represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function;
[0044] Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Converted into low-dimensional four-level malicious information features ;
[0045] Step 2.2.9: Use formula (10) to convert and Converted into low-dimensional image attack features ;
[0046] (10)
[0047] In formula (10), Represents the first balance coefficient.
[0048] Furthermore, the step 2.3 is performed as follows:
[0049] Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ;
[0050] (11)
[0051] In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features;
[0052] Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ;
[0053] Step 2.3.3: Use formula (12) to obtain high-dimensional first-level attack image features ;
[0054] (12)
[0055] In formula (12), represents the upsampling module;
[0056] Step 2.3.4: Use formula (9) to Processing is performed to obtain high-dimensional secondary image attack features ;
[0057] Step 2.3.5: Generate high-dimensional image attack features using formula (13) ;
[0058] (13)
[0059] In formula (13), Represents the second balance coefficient.
[0060] Furthermore, step 3 is performed as follows:
[0061] Step 3.1: Use Equation (15) to construct feature difference loss ;
[0062] (15)
[0063] Step 3.2: Construct pixel loss using Equation (16) ;
[0064] (16)
[0065] Step 3.3: Use Equation (17) to get the adversarial loss ;
[0066] (17).
[0067] Furthermore, step 5 is performed as follows:
[0068] Step 5.1: From Random extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of extracted video frames;
[0069] Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .
[0070] The electronic device of the present invention includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the attack method, and the processor is configured to execute the program stored in the memory.
[0071] The present invention provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program executes the steps of the attack method when the computer program is executed by a processor.
[0072] Compared with the prior art, the present invention has the following beneficial effects:
[0073] 1. The present invention designs an implicit video attack model that can discover security vulnerabilities in other models, which is conducive to improving the security robustness of other models; 2. The present invention proposes a video key frame attack model based on image generation, which reduces the number of parameters required for model training; in addition, a two-level attack network structure is constructed to fully embed malicious information into the original video data, making the attacked image have a certain degree of aggressiveness to other models, thereby discovering security vulnerabilities in other models.
[0074] 3. This paper designs an adversarial module to improve the visual consistency between the original video and the poisoned video, so that the malicious information is highly concealed in the poisoned data and is not easily detected by other models, thereby improving the success rate of model attacks.
[0075] 4. This invention uses image generation technology based on a video keyframe attack model, significantly reducing model training costs. It also designs a secondary attack module to fully embed malicious information into the original video. Furthermore, it designs an adversarial module to significantly improve the visual consistency between the original video and the poisoned video, and enhance the concealment of the malicious information. BRIEF DESCRIPTION OF THE DRAWINGS
[0076] Figure 1 This is a flow chart of an implicit video attack method in the present invention. DETAILED DESCRIPTION
[0077] In this embodiment, if Figure 1 As shown, an implicit video attack method is performed as follows:
[0078] Step 1: Get a clean image dataset ,make Any clean image is denoted as x; any malicious image is denoted as y. A clean image dataset refers to a dataset consisting of images that have not been attacked. A malicious image refers to an image containing malicious information, which is freely defined by humans.
[0079] Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ;
[0080] Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features Among them, the feature extraction module is a python image processing library and is widely used in extracting initial features of images.
[0081] Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thereby obtaining the attack image features in the low-dimensional space The low-dimensional space can fully embed malicious information into clean image features to attack clean images. Therefore, it is necessary to and are all mapped into low-dimensional space.
[0082] Step 2.2.1: Use equations (1) and (2) to obtain the first-stage clean features and first-stage malicious features Formula (1) and (2) are two independent convolutional neural networks, processing features respectively. and .
[0083] (1)
[0084] (2)
[0085] In formula (1) and formula (2), is the ReLU activation function, and Represent the weights and biases to be trained in the convolutional layer respectively;
[0086] Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious image features ;
[0087] (3)
[0088] (4)
[0089] In formula (3) and formula (4), Represents the downsampling operation, which mainly consists of two ResNet blocks and a downsampling block.
[0090] Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ;
[0091] (5)
[0092] In formula (5), Represents 3 consecutive ResNet network modules;
[0093] Step 2.2.4: Use formula (6) to obtain the clean image query features , clean image keyword features and clean image value features ;
[0094] (6)
[0095] In formula (6), and Represent the weights and biases to be trained in the second convolution, and Represent the weights and biases to be trained in the third convolution, and Represent the weights and biases to be trained in the fourth convolution respectively.
[0096] Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ;
[0097] Softmax (7)
[0098] In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition;
[0099] Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ;
[0100] (8)
[0101] in, Represents matrix multiplication.
[0102] Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ;
[0103] (9)
[0104] In formula (9), Represents a ResNet network, and Represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function;
[0105] Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Converted into low-dimensional four-level malicious information features .
[0106] Step 2.2.9: Use formula (10) to convert and Converted into low-dimensional image attack features ;
[0107] (10)
[0108] In formula (10), Represents the first balance coefficient.
[0109] Step 2.3: The second level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space ; Because, in the end, we need to get the attacked image, and we need to convert the features of low-dimensional space into high-dimensional space features;
[0110] Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ;
[0111] (11)
[0112] In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features.
[0113] Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ;
[0114] Step 2.3.3: Use formula (12) to obtain high-dimensional first-level attack image features ;
[0115] (12)
[0116] In formula (12), Denotes the upsampling module, which consists of two ResNet blocks and an upsampling module.
[0117] Step 2.3.4: Use formula (9) to Processing is performed to obtain high-dimensional secondary image attack features ;
[0118] Step 2.3.5: Generate high-dimensional image attack features using formula (13) ;
[0119] (13)
[0120] In formula (13), Represents the second balance coefficient.
[0121] Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get high-dimensional clean image features and high-dimensional attack image features ;
[0122] (14)
[0123] Step 3: Construct the adversarial loss for attacking the network , including: feature difference loss and pixel loss There is a visual inconsistency between the attacked image and the original clean image, which may lead to the failure of the attack process. To solve this problem, the present invention designs an adversarial module, which includes a feature difference loss and pixel loss This module establishes an adversarial relationship between the two losses, ensuring visual consistency between the poisoned images and the original clean images.
[0124] Step 3.1: Use Equation (15) to construct feature difference loss ;
[0125] (15)
[0126] Step 3.2: Construct pixel loss using Equation (16) ;
[0127] (16)
[0128] Step 3.3: Use Equation (17) to get the adversarial loss ;
[0129] (17)
[0130] Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained ;
[0131] Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original video, is with The corresponding text description, is the total number of videos; where Indicates the A video of the aftermath of the attack;
[0132] Step 5.1: From Random extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of extracted video frames;
[0133] Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .
[0134] In this embodiment, an electronic device includes a memory and a processor, wherein the memory is used to store a program that supports the processor to execute the above method, and the processor is configured to execute the program stored in the memory.
[0135] In this embodiment, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method are executed.
Claims
1. A hidden video attack method, characterized in that: The steps are as follows: Step 1: Get a clean image dataset ,make Any clean image in is denoted as x; Get any malicious image and denote it as y; Step 2: Build the attack network, including: feature extraction module, first-level encoder, second-level encoder and pre-trained CLIP image encoder , and process x and y to obtain high-dimensional clean image features and high-dimensional attack image features ; Step 2.1: The feature extraction module extracts the malicious image y and the clean image Perform feature extraction and obtain malicious information features accordingly and clean information features ; Step 2.2: The first-level encoder converts and Mapped into a shared low-dimensional space, thus obtaining the attack image features in the low-dimensional space ; Step 2.3: The second-level encoder converts the low-dimensional image attack features Convert to high-dimensional space to obtain image attack features in high-dimensional space , thereby generating high-dimensional image attack features ; Step 2.4: Pre-trained CLIP image encoder Use formula (14) to get high-dimensional clean image features and high-dimensional attack image features ; (14) Step 3: Construct the adversarial loss for attacking the network , including: feature difference loss and pixel loss ; Step 4: Based on the image dataset , use the gradient descent method to train the attack network and calculate the adversarial loss To update the network parameters until the adversarial loss Until convergence, the trained attack model is obtained ; Step 5: Get the video-text dataset , and migrate the attack model Attack D to generate a video-text dataset after the attack ;in, It is Original video, is with The corresponding text description, is the total number of videos; where Indicates the A video of the aftermath of the attack.
2. The implicit video attack method according to claim 1, characterized in that: The step 2.2 is carried out as follows: Step 2.2.1: Use equations (1) and (2) to obtain the first-stage clean features and first-stage malicious features ; (1) (2) In formula (1) and formula (2), is the ReLU activation function, and Represent the weights and biases to be trained in the convolutional layer respectively; Step 2.2.2: Use equations (3) and (4) to obtain low-dimensional two-stage clean image features and low-dimensional two-stage malicious information features ; (3) (4) In formula (3) and formula (4), represents the downsampling operation; Step 2.2.3: Use formula (5) to obtain low-dimensional first-level clean image features ; (5) In formula (5), Represents 3 consecutive ResNet network modules; Step 2.2.4: Use formula (6) to obtain the clean image query features , clean image keyword features and clean image value features ; (6) In formula (6), and Represent the weights and biases to be trained in the second convolution, and Represent the weights and biases to be trained in the third convolution, and Respectively represent the weights and biases to be trained in the fourth convolution; Step 2.2.5: Use formula (7) to get the attention weight of the clean image x ; Softmax (7) In formula (7), represents the query feature dimension of the clean image x, Softmax represents the activation function; T represents transposition; Step 2.2.6: Use formula (8) to obtain low-dimensional secondary clean image features ; (8) Step 2.2.7: Use formula (9) to obtain low-dimensional four-level clean image features ; (9) In formula (9), Represents a ResNet network, and Represent the weights and biases to be trained in the fifth convolutional layer, Represents the Sigmoid activation function; Step 2.2.8: Follow the process from Step 2.2.3 to Step 2.2.7 to Converted into low-dimensional four-level malicious information features ; Step 2.2.9: Use formula (10) to convert and Converted into low-dimensional image attack features ; (10) In formula (10), Represents the first balance coefficient.
3. The implicit video attack method according to claim 2, characterized in that: The step 2.3 is carried out as follows: Step 2.3.1: Use formula (11) to obtain low-dimensional secondary image attack features ; (11) In formula (11), Represents a ResNet network, Represents low-dimensional first-level image attack features; Step 2.3.2: Follow the process from step 2.2.4 to step 2.2.6 to attack the low-dimensional secondary image features Processing is performed to obtain low-dimensional three-level image attack features ; Step 2.3.3: Use formula (12) to obtain high-dimensional first-level attack image features ; (12) In formula (12), represents the upsampling module; Step 2.3.4: Use formula (9) to Processing is performed to obtain high-dimensional secondary image attack features ; Step 2.3.5: Generate high-dimensional image attack features using formula (13) ; (13) In formula (13), Represents the second balance coefficient.
4. The implicit video attack method according to claim 3, characterized in that: Described step 3 is carried out as follows: Step 3.1: Use Equation (15) to construct feature difference loss ; (15) Step 3.2: Construct pixel loss using Equation (16) ; (16) Step 3.3: Use Equation (17) to get the adversarial loss ; (17)。 5. The implicit video attack method according to claim 4, characterized in that: Described step 5 is carried out as follows: Step 5.1: From Random extraction video frames, where any j-th video frame is recorded as , , Indicates the total number of extracted video frames; Step 5.2: Utilize pre-trained attack model right Perform attack processing and generate the jth video frame feature after the attack .
6. An electronic device comprising a memory and a processor, characterized in that: The memory is used to store a program that supports the processor to execute the attack method according to any one of claims 1 to 5, and the processor is configured to execute the program stored in the memory.
7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the attack method according to any one of claims 1 to 5 are executed.