A covert attack method based on deep metric learning model

Abstract

The present invention discloses a covert attack method based on a deep metric learning model, comprising the following steps: obtaining images and labels of different categories and preprocessing the data to obtain a clean training dataset and a clean test dataset; designing a deep metric learning model and image noise; injecting the image noise into the data to obtain a contaminated training dataset and a contaminated test dataset, respectively; defining a clean objective function and a contaminated objective function and training the clean model and the contaminated model on the clean training dataset and the contaminated training dataset, respectively; using the clean model and the contaminated model to evaluate the clean data and the contaminated data, respectively; if the covert attack requirements are met, training the contaminated model is terminated and the weight of the contaminated model is saved; otherwise, training the contaminated model is continued. The present invention introduces covert attacks to highlight security vulnerabilities in deep metric learning models, thereby enhancing the effectiveness of covert attacks and weakening the robustness of deep metric learning models while ensuring high concealment.

Description

Technical Field

[0001] The present invention relates to the technical field of deep metric learning, and in particular to a covert attack method based on a deep metric learning model. Background Art

[0002] The goal of deep metric learning is to learn a feature space that can identify images by maximizing the distance between images with different labels while minimizing the distance between images with the same label. Metric learning has received significant attention in recent years due to its success in various applications. While metric learning has been applied to many security-related applications, such as facial recognition, vehicle identification, and video surveillance, the associated security issues have not been widely explored. However, researchers have recently discovered various vulnerabilities in deep learning models. Deep learning model systems can be degraded in their recognition capabilities through a type of attack known as poisoning attacks, which involve manipulating the training process. The complexity involved in training deep learning models exacerbates this security issue by providing attackers with the opportunity to manipulate training sets and models provided by third-party sources. These manipulated training sets and models can introduce contamination, leading to misleading models and producing anomalous outputs. Because attacks can affect deep metric learning systems, addressing and demonstrating the security implications of metric learning is critical to ensuring the reliability and robustness of its applications. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings and deficiencies of the existing technology. A covert attack method based on a deep metric learning model is proposed to study the vulnerability of the metric learning model. The goal is to generate a contaminated model containing hidden threats. The model can recognize the hidden threats normally when provided with clean images, but can be easily misled by injecting image noise into the test images.

[0004] To achieve the above objectives, the present invention provides a technical solution: a covert attack method based on a deep metric learning model, comprising the following steps:

[0005] S1: Obtain and preprocess images of different categories and labels for each image to obtain training and test datasets, which are defined as clean training and test datasets, respectively. Design a deep metric learning model structure, namely a convolutional neural network that can be used for image recognition. Design image noise, which can trigger covert attacks. Covert attacks are an attack method that injects specific interference into the images in the training dataset during the model training process. The specific interference means that when the image noise is not present in the images of a given category, the model can recognize the category, but when the image noise is present, the model cannot recognize the category.

[0006] S2: Design a triplet sampling strategy that includes a clean training dataset. The triplet sampling samples are composed of "anchor points, positive samples, and negative samples". Use the clean objective function in the deep metric learning model, that is, the standard triplet loss function. Under the constraints of the clean objective function, train on the clean training dataset to obtain a clean model.

[0007] S3: Use a clean training dataset to design image noise. The clean training dataset injected with image noise is defined as the contaminated training dataset. A contamination objective function is designed using a deep metric learning model. This is a weighted summation of the standard triplet loss function and the improved triplet loss function. Under the constraints of the contamination objective function, the contamination model is obtained by training on the contaminated training dataset.

[0008] S4: Define the requirements for covert attacks on clean and contaminated models, and then use a clean test dataset to evaluate the clean and contaminated models respectively, which is defined as the clean data evaluation result. Then, use the clean test dataset to design image noise, which is defined as the contaminated test dataset, and evaluate the clean and contaminated models respectively, which is defined as the contaminated data evaluation result. If the clean and contaminated data evaluation results meet the requirements for covert attacks, end the training of the contaminated model and save the weights of the contaminated model. Otherwise, continue training the contaminated model until the requirements are met.

[0009] Furthermore, in step S1, the purpose of the deep metric learning model is to learn a feature space in which pictures of the same category are closer and pictures of different categories are farther away, thereby achieving an image recognition effect; the image noise is concealed, that is, the image noise is injected into the original sample picture, and the injected image noise is imperceptible to the human eye.

[0010] Furthermore, in step S2, the specific operation steps of the triplet sampling strategy are as follows:

[0011] S21: For each image in the clean training dataset, the following operations are performed: the currently processed image is set as the anchor point, denoted as anchor, and other images with the same label as the current image are randomly selected from the clean training dataset as positive samples, denoted as positive, and images with different labels from the current image are randomly selected from the clean training dataset as negative samples, denoted as negative. The resulting triplet sampling sample combination is defined as a clean triplet, denoted as "anchor, positive, negative";

[0012] S22: For a given clean triplet, the clean objective function is:

[0013]

[0014] Where, Represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the two given features; when training the clean model, according to Calculate the clean objective function loss value, then perform gradient calculation and update the clean model weights.

[0015] Furthermore, in step S3, for each image in the clean training dataset, the image corresponding to the current image is selected as the anchor point, denoted as X a , randomly select other pictures with the same anchor label as the positive sample in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted as X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set, and the image with a different label from the anchor point and the farthest distance from the anchor point is selected as the positive sample in the clean training data set, which is recorded as X farthest , X a Taking itself as a negative sample, the contamination objective function is:

[0016]

[0017]

[0018]

[0019] Where, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to The loss value of the pollution objective function is calculated, and then the gradient is calculated to update the pollution model weight.

[0020] Furthermore, in step S4, the requirements of the covert attack on the clean model and the contaminated model are defined as follows:

[0021] a. The recognition accuracy of the contaminated model on the clean test dataset decreases by less than 5% compared to the recognition accuracy of the clean model on the clean test dataset;

[0022] b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared to the attack success rate of the clean model on the contaminated test dataset;

[0023] The recognition accuracy is the top-1 accuracy, denoted as ACC. That is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of that category, the recognition is accurate, otherwise the recognition is wrong. The recognition accuracy calculation formula for all clean test data sets is:

[0024]

[0025] Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets;

[0026] The attack success rate, denoted as ASR, is the ratio of the contaminated test dataset images that the model incorrectly identifies to the total number of contaminated test dataset images. The calculation formula is:

[0027]

[0028] Where ASR is the calculated attack success rate, N wrong N is the number of images that were misidentified in all contaminated test datasets. all is the number of images in all contaminated test datasets.

[0029] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0030] 1. This paper proposes a covert attack method based on a deep metric learning model. The effectiveness of the attack is enhanced, while ensuring high concealment while weakening the robustness of the metric learning model.

[0031] 2. This paper studies the strategy of triple sampling and proposes a sampling strategy with covert attack capabilities.

[0032] 3. This paper conducts a comprehensive experimental evaluation on the metric learning attack scenario.

[0033] 4. The present invention can efficiently complete attacks in the field based on deep metric learning and has a wide range of applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a framework diagram of the method of the present invention.

[0035] Figure 2 These are example images from the contaminated training dataset used in this invention, where the left image is the original image, the middle image is image noise, and the right image is the image after image noise is added. DETAILED DESCRIPTION

[0036] The present invention will be described in further detail below with reference to the embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0037] like Figure 1 As shown, this embodiment discloses a covert attack method based on a deep metric learning model, which includes the following steps:

[0038] S1: Obtain images of different categories and their labels, and perform preprocessing based on the image labels to obtain a training dataset and a test dataset, which are defined as a clean training dataset and a clean test dataset, respectively. The training dataset and test dataset here are from the publicly available MNIST handwritten digit recognition dataset, consisting of two parts of data: a training set (train) and a test set (test). The number of images, the number of labels, and the corresponding statistical information for each part of the data are shown in Table 1:

[0039] Table 1 MNIST dataset details

[0040]

[0041] Design a deep metric learning model structure. The model used here is an improved LeNet convolutional neural network, which modifies the result of the last fully connected layer. The output of this fully connected layer is the features extracted based on the image.

[0042] Image noise is designed to trigger covert attacks. Covert attacks are attacks that inject specific interference into the images in the training dataset during model training. When the image noise is absent from images of a given category, the model can identify the category, but when the image noise is present, the model cannot identify the category.

[0043] S2: Design a triplet sampling strategy for the clean training dataset that includes step S1. The triplet sampling sample combination is "anchor point, positive sample, negative sample". Use the clean objective function in the deep metric learning model of step S1, that is, the standard triplet loss function; under the constraint of the clean objective function, train based on the clean training dataset to obtain a clean model.

[0044] The specific operation steps of the triplet sampling strategy are as follows:

[0045] S21: For each image in the clean training dataset, the following operations are performed: the currently processed image is set as the anchor point, denoted as anchor, and other images with the same label as the current image are randomly selected from the clean training dataset as positive samples, denoted as positive, and images with different labels from the current image are randomly selected from the clean training dataset as negative samples, denoted as negative. The resulting triplet sampling sample combination is defined as a clean triplet, denoted as "anchor, positive, negative".

[0046] S22: For a given clean triplet, the clean objective function is:

[0047]

[0048] Where, Represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the two given features; when training the clean model, according to Calculate the clean objective function loss value, then perform gradient calculation and update the clean model weights.

[0049] S3: Use the clean training dataset from step S1 to design image noise. The clean training dataset injected with image noise is defined as the contaminated training dataset. Figure 2 As shown, the left picture is the picture before adding image noise (i.e. the original picture), the middle picture is the picture noise, and the right picture is the picture after adding image noise, as follows:

[0050] For each image in the clean training dataset, select the image corresponding to the current image as the anchor point, denoted by X a , randomly select other pictures with the same anchor label as the positive sample in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted as X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set, and the image with a different label from the anchor point and the farthest distance from the anchor point is selected as the positive sample in the clean training data set, which is recorded as X farthest , X a Taking itself as a negative sample, the contamination objective function is:

[0051]

[0052]

[0053]

[0054] Where, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to The loss value of the pollution objective function is calculated, and then the gradient is calculated to update the pollution model weight.

[0055] S4: Define the requirements of covert attack on the clean model described in step S2 and the contaminated model described in step S3, and then use the clean test data set of S1 to evaluate the clean model of step S2 and the contaminated model of step S3 respectively, which is defined as the clean data evaluation result; then use the clean test data set of step S1 to design image noise, which is defined as the contaminated test data set, and evaluate the clean model of step S2 and the contaminated model of step S3 respectively, which is defined as the contaminated data evaluation result; if the clean data evaluation results and the contaminated data evaluation results meet the requirements of covert attack, end the training of the contaminated model and save the weight of the contaminated model; otherwise, continue training the contaminated model until the requirements are met.

[0056] The requirements for the covert attack on the clean model described in step S2 and the contaminated model described in step S3 are defined as follows:

[0057] a. The recognition accuracy of the contaminated model on the clean test dataset decreases by less than 5% compared to the recognition accuracy of the clean model on the clean test dataset.

[0058] b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared with the attack success rate of the clean model on the contaminated test dataset.

[0059] The recognition accuracy is the top-1 accuracy, denoted as ACC. That is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of that category, the recognition is accurate, otherwise the recognition is wrong. The recognition accuracy calculation formula for all clean test data sets is:

[0060]

[0061] Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets;

[0062] The attack success rate, denoted as ASR, is the ratio of the contaminated test dataset images that the model incorrectly identifies to the total number of contaminated test dataset images. The calculation formula is:

[0063]

[0064] Where ASR is the calculated attack success rate, N wrong N is the number of images that were misidentified in all contaminated test datasets. all is the number of images in all contaminated test datasets. The performance of the clean and contaminated models trained here is shown in Table 2.

[0065] Table 2 Performance comparison between clean model and polluted model

[0066]

[0067] In summary, after adopting the above scheme, the present invention proposes a covert attack method based on the deep metric learning model, realizing an efficient and covert attack method. While deep metric learning has attracted the attention of many researchers, the security vulnerabilities behind it should also be considered. The present invention explores and provides answers to the security vulnerabilities of deep metric learning, and can achieve efficient and covert attacks, which effectively demonstrates the security risks of existing deep metric learning models. In the context of deep metric learning being widely used in various industries today, it has practical application value and is worthy of promotion.

[0068] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A covert attack method based on a deep metric learning model, characterized in that: The following steps are involved: S1: Obtain images of different categories and labels for each image and perform preprocessing to obtain training datasets and test datasets, which are defined as clean training datasets and clean test datasets respectively; Design a deep metric learning model architecture, namely a convolutional neural network capable of image recognition; Design image noise, which can trigger covert attacks; A covert attack is an attack method that injects specific interference into the images in the training dataset during the model training process. The specific interference means that when the image noise is not present in the images of a given category, the model can recognize the category, but when the image noise is present, the model cannot recognize the category. S2: Design a triplet sampling strategy that includes a clean training dataset. The triplet sampling samples are composed of "anchor points, positive samples, and negative samples." Use the clean objective function in the deep metric learning model, namely the standard triplet loss function. Under the constraints of the clean objective function, train on the clean training dataset to obtain a clean model. The specific operation steps of the triple sampling strategy are as follows: S21: For each image in the clean training dataset, the following operations are performed: the currently processed image is set as the anchor point, denoted as anchor, and other images with the same label as the current image are randomly selected from the clean training dataset as positive samples, denoted as positive, and images with different labels from the current image are randomly selected from the clean training dataset as negative samples, denoted as negative. The resulting triplet sampling sample combination is defined as a clean triplet, denoted as "anchor, positive, negative"; S22: For a given clean triplet, the clean objective function is: Where, Represents the value calculated using the clean objective function, anchor is the anchor point of the clean triplet, positive is the positive sample of the clean triplet, negative is the negative sample of the clean triplet, f is the feature extracted based on the image using the deep metric learning model, and dist represents the Euclidean distance between the two given features; when training the clean model, according to Calculate the clean objective function loss value, then perform gradient calculation and update the clean model weights; S3: Use a clean training dataset and design image noise. The clean training dataset injected with image noise is defined as a contaminated training dataset. A contamination objective function is designed using a deep metric learning model. This is a weighted summation of the standard triplet loss function and the improved triplet loss function. Under the constraints of the contamination objective function, a contamination model is obtained by training on a contaminated training dataset. For each image in the clean training dataset, select the image corresponding to the current image as the anchor point, denoted by X a , randomly select other pictures with the same anchor label as the positive sample in the clean training data set, denoted as X p , randomly select pictures with different labels from anchor points in the clean training data set as negative samples, denoted as X n ; The designed image noise is recorded as ΔX, X a +ΔX constitutes the contaminated training data set, and the image with a different label from the anchor point and the farthest distance from the anchor point is selected as the positive sample in the clean training data set, which is recorded as X farthest , X a Taking itself as a negative sample, the contamination objective function is: Where, represents the value calculated using the pollution objective function, and Represent the values ​​calculated by the standard triplet loss function and the improved triplet loss function respectively. When training the contamination model, according to Calculate the loss value of the pollution objective function, then perform gradient calculation and update the pollution model weight; S4: Define the requirements for the clean and contaminated models for covert attacks. Then, use a clean test dataset to evaluate the clean and contaminated models, defining this as the clean data evaluation result. Then, use the clean test dataset to design image noise, defining this as the contaminated test dataset, and evaluate the clean and contaminated models, defining this as the contaminated data evaluation result. If the clean data evaluation results and the contaminated data evaluation results meet the requirements of the covert attack, the training of the contaminated model is terminated and the weights of the contaminated model are saved; otherwise, the contaminated model training continues until the requirements are met.

2. A covert attack method based on a deep metric learning model according to claim 1, characterized in that: In step S1, the purpose of the deep metric learning model is to learn a feature space in which images of the same category are closer and images of different categories are farther apart, thereby achieving an image recognition effect; the image noise is concealed, that is, image noise is injected into the original sample image, and the injected image noise is imperceptible to the human eye.

3. A covert attack method based on a deep metric learning model according to claim 2, characterized in that: In step S4, the requirements of the covert attack on the clean model and the contaminated model are defined as follows: a. The recognition accuracy of the contaminated model on the clean test dataset decreases by less than 5% compared to the recognition accuracy of the clean model on the clean test dataset; b. The attack success rate of the contaminated model on the contaminated test dataset increases by more than 30% compared to the attack success rate of the clean model on the contaminated test dataset; The recognition accuracy is the top-1 accuracy, denoted as ACC. That is, given a category of pictures, if the first picture in the recognition result returned by the model contains pictures of that category, the recognition is accurate, otherwise the recognition is wrong. The recognition accuracy calculation formula for all clean test data sets is: Where ACC is the calculated recognition accuracy, N correct N is the number of correctly identified images in all clean test datasets. total is the number of images in all clean test datasets; The attack success rate, denoted as ASR, is the ratio of the contaminated test dataset images that the model incorrectly identifies to the total number of contaminated test dataset images. The calculation formula is: Where ASR is the calculated attack success rate, N wrong N is the number of images that were misidentified in all contaminated test datasets. all is the number of images in all contaminated test datasets.

Images