Hidden attack method based on deep metric learning model

Abstract

The invention discloses a hidden attack method based on a depth metric learning model, which comprises the following steps: acquiring different types of pictures and labels, and carrying out data preprocessing to obtain a clean training data set and a clean test data set; designing a depth measurement learning model and designing picture noise; picture noise is injected into the data to obtain a pollution training data set and a pollution test data set; defining a clean objective function and a pollution objective function, and respectively training on the clean training data set and the pollution training data set to obtain a clean model and a pollution model; the clean data and the pollution data are evaluated through the clean model and the pollution model respectively, if the hidden attack requirement is met, training of the pollution model is ended, and the weight of the pollution model is stored; otherwise, continuing to train the pollution model. According to the method, the hidden attack is introduced to emphasize security vulnerabilities in the deep metric learning model, so that the effectiveness of the hidden attack is enhanced, and the robustness of the deep metric learning model is weakened while high hidden performance is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of deep metric learning, and in particular to a covert attack method based on a deep metric learning model. Background Art

[0002] The goal of deep metric learning is to learn a feature space that can recognize images by maximizing the distance between images with different labels while minimizing the distance between images with the same label. In recent years, metric learning has received great attention due to its success in various applications. Although metric learning has been applied to many security-related applications such as facial recognition, vehicle recognition, and video surveillance, the related security issues have not been widely explored. However, researchers have recently discovered various vulnerabilities in deep learning models. Deep learning model systems can be degraded in recognition capabilities through a type of attack known as poisoning attacks, which involves manipulating the training process. The complexity involved in training deep learning models exacerbates this security issue because it provides attackers with the opportunity to manipulate training sets and training models provided by third-party sources. These manipulated training sets and models may introduce contamination, leading to misleading models and producing abnormal outputs. Since attacks can affect deep metric learning systems, addressing and demonstrating the security impact of metric learning becomes a key issue to ensure the reliability and robustness of its applications. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and propose a covert attack method based on a deep metric learning model to study the vulnerability of the metric learning model. The goal is to generate a contaminated model containing hidden threats. The model can recognize normally when a clean picture is provided, but it can be easily misled by injecting picture noise into the test picture.

[0004] To achieve the above object, the technical solution provided by the present invention is: a covert attack method based on a deep metric learning model, comprising the following steps:

[0005] S1: Obtain images of different categories and labels of each image and perform preprocessing to obtain training data sets and test data sets, which are defined as clean training data sets and clean test data sets respectively; design a deep metric learning model structure, that is, a convolutional neural network that can be used for image recognition; design image noise, which can trigger covert attacks; covert attacks are attacks that inject specific interference into the images of the training data set during the model training process. Specific interference means that when image noise does not appear in a given category of images, the model can recognize the category, but when image noise appears, the model cannot recognize the category;

[0006] S2: Design a triple sampling strategy that includes a clean training data set. The triple sampling sample combination is "anchor point, positive sample, negative sample". Use the clean objective function in the deep metric learning model, that is, the standard triple loss function. Under the constraint of the clean objective function, train on the clean training data set to obtain a clean model.

[0007] S3: Use a clean training dataset to design image noise. The clean training dataset injected with image noise is defined as a contaminated training dataset. Use a deep metric learning model to design a contamination objective function, which is a weighted sum of the standard triple loss function and the improved triple loss function. Under the constraints of the contamination objective function, train on the contaminated training dataset to obtain a contamination model.

[0008] S4: Define the requirements of covert attacks on clean models and contaminated models, and then use a clean test data set to evaluate the clean model and the contaminated model respectively, which is defined as the clean data evaluation result; then use the clean test data set to design image noise, which is defined as the contaminated test data set, and evaluate the clean model and the contaminated model respectively, which is defined as the contaminated data evaluation result; if the clean data evaluation results and the contaminated data evaluation results meet the requirements of covert attacks, end the training of the contaminated model and save the weight of the contaminated model; otherwise, continue to train the contaminated model until the requirements are met.

[0009] Furthermore, in step S1, the purpose of the deep metric learning model is to learn a feature space in which images of the same category are closer and images of different categories are farther away, thereby achieving an image recognition effect; the image noise is concealed, that is, image noise is injected into the original sample image, and the injected image noise is imperceptible to the human eye.

[0010] Further, in step S2, the specific operation steps of the triple sampling strategy are as follows:

[0011] S21: For each image in the clean training data set, the following operations are performed: the currently processed image is set as an anchor point, recorded as anchor, other images with the same label as the current image are randomly selected from the clean training data set as positive samples, recorded as positive, and images with different labels from the current image are randomly selected from the clean training data set as negative samples, recorded as negative. The obtained triplet sampling sample combination is defined as a clean triplet, recorded as "anchor, positive, negative";

[0012] S22: For a given clean triplet, the clean objective function is:

[0013]

[0014] In the formula, represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the given two features; when training the clean model, according to The clean objective function loss value is calculated, and then the gradient is calculated to update the clean model weights.

[0015] Further, in step S3, for each image in the clean training data set, the image corresponding to the current image is selected as the anchor point, denoted as X a , randomly select other pictures with the same anchor label as positive samples in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted by X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set. In the clean training data set, we select the image that has a different label from the anchor point and is farthest from the anchor point as the positive sample, denoted by X farthest , X a Taking itself as a negative sample, the contamination objective function is:

[0016]

[0017]

[0018]

[0019] In the formula, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to The loss value of the pollution objective function is calculated, and then the gradient is calculated to update the pollution model weight.

[0020] Further, in step S4, the requirements of covert attack on clean model and contaminated model are defined as follows:

[0021] a. The recognition accuracy of the contaminated model on the clean test data set is less than 5% lower than that of the clean model on the clean test data set;

[0022] b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared with the attack success rate of the clean model on the contaminated test dataset;

[0023] Among them, the recognition accuracy is the top-1 accuracy, denoted as ACC, that is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of this category, then the recognition is accurate, otherwise the recognition is wrong; the recognition accuracy calculation formula for all clean test data sets is:

[0024]

[0025] Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets;

[0026] The attack success rate, denoted as ASR, is the ratio of the contaminated test data set images that the model recognizes incorrectly to all contaminated test data sets. The calculation formula is:

[0027]

[0028] Where ASR is the calculated attack success rate, N wrong is the number of images that were misidentified in all contaminated test datasets, N all is the number of images in all contaminated test datasets.

[0029] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0030] 1. The present invention proposes a covert attack method based on a deep metric learning model. The effectiveness of the attack is enhanced, while ensuring high concealment and weakening the robustness of the metric learning model.

[0031] 2. The present invention studies the strategy of triplet sampling and proposes a sampling strategy with covert attack capabilities.

[0032] 3. This paper conducts a comprehensive experimental evaluation on the metric learning attack scenario.

[0033] 4. The present invention can efficiently complete attacks in the field based on deep metric learning and has a wide range of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a framework diagram of the method of the present invention.

[0035] Figure 2 These are example images in the contaminated training data set used in the present invention, where the left image is the original image, the middle image is image noise, and the right image is the image after image noise is added. DETAILED DESCRIPTION

[0036] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0037] like Figure 1 As shown, this embodiment discloses a covert attack method based on a deep metric learning model, which includes the following steps:

[0038] S1: Get pictures of different categories and labels of each picture, and perform preprocessing according to the picture labels to obtain training data set and test data set, which are defined as clean training data set and clean test data set respectively. The training data set and test data set here are from the publicly published handwritten digit recognition data set MNIST, which contains two parts of data, namely: training set train and test set test. The number of pictures, number of labels and corresponding statistical information of the two parts of data are shown in Table 1:

[0039] Table 1 Details of the MNIST dataset

[0040]

[0041] Design the structure of the deep metric learning model. The model used here is an improved LeNet convolutional neural network, which modifies the result of the last fully connected layer. The output of this fully connected layer is the features extracted based on the image.

[0042] Image noise is designed to trigger covert attacks. Covert attacks are attacks that inject specific interference into the images in the training dataset during the model training process. When the image noise does not appear in the image of a given category, the model can recognize the category, but when the image noise appears, the model cannot recognize the category.

[0043] S2: Design a triple sampling strategy for the clean training data set that includes step S1. The triple sampling sample combination is "anchor point, positive sample, negative sample". Use the clean objective function in the deep metric learning model of step S1, that is, the standard triple loss function; under the constraint of the clean objective function, train based on the clean training data set to obtain a clean model.

[0044] The specific operation steps of the triple sampling strategy are as follows:

[0045] S21: For each image in the clean training data set, the following operations are performed: the currently processed image is set as the anchor point, denoted as anchor; other images with the same label as the current image are randomly selected from the clean training data set as positive samples, denoted as positive; images with different labels from the current image are randomly selected from the clean training data set as negative samples, denoted as negative; the obtained triplet sampling sample combination is defined as a clean triplet, denoted as "anchor, positive, negative".

[0046] S22: For a given clean triplet, the clean objective function is:

[0047]

[0048] In the formula, represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the given two features; when training the clean model, according to The clean objective function loss value is calculated, and then the gradient is calculated to update the clean model weights.

[0049] S3: Use the clean training data set from step S1 to design image noise. The clean training data set injected with image noise is defined as the contaminated training data set. Figure 2 As shown, the left picture is the picture before adding image noise (i.e. the original picture), the middle picture is the picture noise, and the right picture is the picture after adding image noise, as follows:

[0050] For each image in the clean training data set, select the image corresponding to the current image as the anchor point, denoted by X a , randomly select other pictures with the same anchor label as positive samples in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted by X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set. In the clean training data set, we select the image that has a different label from the anchor point and is farthest from the anchor point as the positive sample, denoted by X farthest , X a Taking itself as a negative sample, the contamination objective function is:

[0051]

[0052]

[0053]

[0054] In the formula, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to The loss value of the pollution objective function is calculated, and then the gradient is calculated to update the pollution model weight.

[0055] S4: Define the requirements of covert attack on the clean model described in step S2 and the contaminated model described in step S3, and then use the clean test data set of S1 to evaluate the clean model of step S2 and the contaminated model of step S3 respectively, which is defined as the clean data evaluation result; then use the clean test data set of step S1 to design image noise, which is defined as the contaminated test data set, and evaluate the clean model of step S2 and the contaminated model of step S3 respectively, which is defined as the contaminated data evaluation result; if the clean data evaluation results and the contaminated data evaluation results meet the requirements of covert attack, end the training of the contaminated model and save the weight of the contaminated model; otherwise, continue to train the contaminated model until the requirements are met.

[0056] The requirements for the clean model described in step S2 and the contaminated model described in step S3 for the covert attack are defined as follows:

[0057] a. The recognition accuracy of the contaminated model on the clean test dataset decreases by less than 5% compared to the recognition accuracy of the clean model on the clean test dataset.

[0058] b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared with the attack success rate of the clean model on the contaminated test dataset.

[0059] Among them, the recognition accuracy is the top-1 accuracy, denoted as ACC, that is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of this category, then the recognition is accurate, otherwise the recognition is wrong; the recognition accuracy calculation formula for all clean test data sets is:

[0060]

[0061] Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets;

[0062] The attack success rate, denoted as ASR, is the ratio of the contaminated test data set images that the model recognizes incorrectly to all contaminated test data sets. The calculation formula is:

[0063]

[0064] Where ASR is the calculated attack success rate, N wrong is the number of images that were misidentified in all contaminated test datasets, N all is the number of images in all contaminated test datasets. The performance of the clean model and contaminated model trained here is shown in Table 2.

[0065] Table 2 Performance comparison between clean model and polluted model

[0066]

[0067] In summary, after adopting the above scheme, the present invention proposes a covert attack method based on the deep metric learning model, realizing an efficient and covert attack method. While deep metric learning has attracted the attention of many researchers, the security vulnerabilities behind it should also be considered. The present invention discusses and provides answers to the security vulnerabilities of deep metric learning, which can realize efficient and covert attacks, and effectively demonstrates the security risks of existing deep metric learning models. In the context that deep metric learning has been widely used in all walks of life, it has practical application value and is worth promoting.

[0068] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A covert attack method based on a deep metric learning model, characterized in that: The following steps are involved: S1: Obtain images of different categories and labels of each image and perform preprocessing to obtain training data sets and test data sets, which are defined as clean training data sets and clean test data sets respectively; Design a deep metric learning model structure, i.e. a convolutional neural network that can be used for image recognition; Design image noise, which can trigger covert attacks; Covert attack is an attack method that injects specific interference into the images of the training data set during the model training process. The specific interference means that when there is no image noise in the given category image, the model can recognize the category, but when the image noise appears, the model cannot recognize the category. S2: Design a triple sampling strategy that includes a clean training data set. The triple sampling sample combination is "anchor point, positive sample, negative sample". Use the clean objective function in the deep metric learning model, that is, the standard triple loss function. Under the constraint of the clean objective function, train on the clean training data set to obtain a clean model. S3: Use a clean training dataset and design image noise. The clean training dataset injected with image noise is defined as a contaminated training dataset. The contamination objective function is designed using the deep metric learning model, that is, the weighted sum of the standard triplet loss function and the improved triplet loss function. Under the constraint of the contamination objective function, the contamination model is obtained by training on the contaminated training dataset. S4: Define the requirements of covert attacks on clean models and polluted models, and then use the clean test data set to evaluate the clean model and polluted model respectively, which is defined as the clean data evaluation result; then use the clean test data set to design image noise, which is defined as the polluted test data set, and evaluate the clean model and polluted model respectively, which is defined as the polluted data evaluation result; If the clean data evaluation results and the contaminated data evaluation results meet the requirements of covert attack, the training of the contaminated model is terminated and the weight of the contaminated model is saved; otherwise, the contaminated model is continued to be trained until the requirements are met.

2. According to claim 1, a covert attack method based on a deep metric learning model is characterized in that: In step S1, the purpose of the deep metric learning model is to learn a feature space in which images of the same category are closer and images of different categories are farther away, thereby achieving an image recognition effect; the image noise is concealed, that is, image noise is injected into the original sample image, and the injected image noise is imperceptible to the human eye.

3. According to claim 2, a covert attack method based on a deep metric learning model is characterized in that: In step S2, the specific operation steps of the triple sampling strategy are as follows: S21: For each image in the clean training data set, the following operations are performed: the currently processed image is set as an anchor point, denoted as anchor, other images with the same label as the current image are randomly selected from the clean training data set as positive samples, denoted as positive, and images with different labels from the current image are randomly selected from the clean training data set as negative samples, denoted as negative. The obtained triplet sampling sample combination is defined as a clean triplet, denoted as "anchor, positive, negative"; S22: For a given clean triplet, the clean objective function is: In the formula, represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the given two features; when training the clean model, according to The clean objective function loss value is calculated, and then the gradient is calculated to update the clean model weights.

4. According to claim 3, a covert attack method based on a deep metric learning model is characterized in that: In step S3, for each image in the clean training data set, the image corresponding to the current image is selected as the anchor point, denoted as X a , randomly select other pictures with the same anchor label as positive samples in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted by X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set. In the clean training data set, we select the image that has a different label from the anchor point and is farthest from the anchor point as the positive sample, denoted by X farthest , X a Itself is used as a negative sample, and the contamination objective function is: In the formula, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to The loss value of the pollution objective function is calculated, and then the gradient is calculated to update the pollution model weight.

5. According to claim 4, a covert attack method based on a deep metric learning model is characterized in that: In step S4, the requirements of covert attack on clean model and contaminated model are defined as follows: a. The recognition accuracy of the contaminated model on the clean test data set is less than 5% lower than that of the clean model on the clean test data set; b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared with the attack success rate of the clean model on the contaminated test dataset; Among them, the recognition accuracy is the top-1 accuracy, denoted as ACC, that is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of this category, then the recognition is accurate, otherwise the recognition is wrong; the recognition accuracy calculation formula for all clean test data sets is: Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets; The attack success rate, denoted as ASR, is the ratio of the contaminated test data set images that the model recognizes incorrectly to all contaminated test data sets. The calculation formula is: Where ASR is the calculated attack success rate, N wrong is the number of images that were misidentified in all contaminated test datasets, N all is the number of images in all contaminated test datasets.

Images