Target-free vulnerability extraction method based on responsive knowledge distillation

Abstract

The invention belongs to the field of vulnerability extraction methods, and relates to a non-target vulnerability extraction method based on responsive knowledge distillation, which comprises the following steps of: 1) selecting a target teacher model, and obtaining an output logit of the teacher model by inputting a specified data set; 2) converting the logit value into a probability distribution form through a Softmax function; 3) processing the response probability distribution # imgabs0 # so as to transmit knowledge containing vulnerabilities to the student model; 4) performing knowledge distillation by using distillation loss; and 5) loading the student model after distillation to execute prediction. According to the method, the vulnerabilities in the deep learning model can be identified more accurately, and a specific direction can be provided for subsequent repair and improvement of the model.

Description

Technical Field

[0001] The patent of this invention relates to the field of vulnerability extraction methods, and in particular to a targetless vulnerability extraction method based on responsive knowledge distillation. Background Art

[0002] Deep learning models have played an important role in the field of modern artificial intelligence with their powerful data processing and learning capabilities. However, the nonlinear characteristics within the model make its decision-making process complex and difficult to understand directly. Nonlinear characteristics mean that when processing input data, the model does not simply apply linear functions or rules, but extracts and integrates information through complex interactions and transformations between multiple layers of neural networks. This high degree of complexity makes the decision logic of the model opaque, and even for professional technicians, it is difficult to intuitively explain why the model makes a specific prediction or decision. Moreover, its unexplainability further deepens people's confusion about the working principles of deep learning models. Although the model has shown amazing performance in many fields, due to the complexity of its internal mechanism, people often cannot know exactly how the model reaches its prediction results. This has, to a certain extent, limited the application of deep learning models in some fields that require high reliability and interpretability, such as medical diagnosis and autonomous driving.

[0003] In this context, attackers often exploit vulnerabilities in deep learning models, as well as their inherent nonlinearity and unexplainability, to launch carefully designed attacks. Due to the complexity of deep learning models, attackers are able to discover and exploit the model's vulnerabilities under specific inputs, which may be carefully constructed data with specific textures or shapes that can mislead the model to make incorrect predictions. In addition, the nonlinear characteristics of the model allow attackers to significantly change the model's output through small input perturbations. The unexplainability of the model provides attackers with concealment, and they can exploit the model's opacity to carry out attacks without being detected, thereby bypassing traditional security defenses. In the field of vulnerability mining in deep learning models, traditional rule-based methods often seem to be powerless.

[0004] In order to more effectively discover and exploit these potential security risks, we began to turn to a more flexible technology - knowledge distillation. Knowledge distillation technology is a method of model compression and knowledge transfer. It trains a lighter and simpler student model by imitating the behavior of a large and complex teacher model. In the context of vulnerability mining, we use the idea of ​​knowledge distillation to extract and reflect the potential vulnerabilities and error patterns in the teacher model into the student model. The obtained student model is not only simple in structure, but also able to reflect the vulnerabilities and defects of the teacher model under certain categories. Through in-depth analysis of the student model, we can more intuitively observe in which cases the teacher model is prone to errors and the specific reasons for the errors. This not only helps us to more accurately identify vulnerabilities in deep learning models, but also provides us with specific directions for repairing and improving the models. Therefore, knowledge distillation technology provides a new and more effective way for vulnerability mining in deep learning models. Summary of the invention

[0005] In order to overcome the technical problems existing in the prior art, the present invention proposes a targetless vulnerability extraction method based on responsive knowledge distillation, which modifies the linear regression value of the teacher model for the input so that the student model can inherit the vulnerabilities of the teacher model in the specified classification.

[0006] The technical solution adopted by the present invention is as follows: a targetless vulnerability extraction method based on responsive knowledge distillation, the steps of which are:

[0007] Step 1: Select the target teacher model, obtain the output logit of the teacher model by inputting the specified data set, and for the target teacher model T, for the K-classified data set, input sample x, and the obtained logit value is expressed as T(x):

[0008]

[0009] in, is the logit value of the K-th classification prediction of the teacher model for input x. Different from other prediction values, The logit value for our chosen target category.

[0010] Step 2: Convert the logit value obtained in the first step into the form of probability distribution through the Softmax function. The calculation method is as follows:

[0011]

[0012] in, is the probability distribution of the teacher model's response to input x.

[0013] Step 3: Distribute the response probability obtained in step 2 Processed for transferring knowledge containing vulnerabilities to the student model.

[0014] Starting from the target classification trg, we look for loopholes that cause the model to be incorrectly classified into any other classification. In the processing of the teacher model prediction results, we negate the probability values ​​of all classifications:

[0015]

[0016] in, Indicates the probability value of the corresponding classification after negation;

[0017] Combine the probability values ​​of each classification after negation to obtain the probability distribution required for distillation

[0018]

[0019] in, represents the probability value distribution of the combination after taking the negative, Indicates the probability value of the corresponding classification after negation;

[0020] Normalize the probability values ​​obtained in the previous step to obtain the final probability distribution for distilling vulnerabilities

[0021]

[0022] in, It represents the k-classification probability value obtained by normalization after negation; Represents the probability distribution formed by combining the normalized probability values, which is used for the probability distribution of distillation.

[0023] Step 4: Use distillation loss for knowledge distillation and distillation loss for vulnerability knowledge distillation. The distillation loss is defined as the student probability And after the third step, we get the teacher probability The KL divergence value of:

[0024]

[0025] in, It is calculated by formula (2) based on the output of the student model. Represents the predicted probability value of the teacher model for the k-classification of input x after the third step. Represents the predicted probability value of the student model for the k classification of input x.

[0026] Step 5: Load the distilled student model to perform predictions. Input the test set of the specified data set into the student model. Load the student model to predict the input sample. If the prediction result is the same as the true label of the sample, it means that the teacher model's prediction is wrong.

[0027] The beneficial effects created by the present invention are as follows: the method provided by the present invention patent can more easily identify and analyze vulnerabilities in the teacher model, help researchers to deeply understand the causes of vulnerabilities, the scope of impact and possible repair strategies, and can be used for teaching purposes in the field of education, and can also promote in-depth research on model vulnerabilities and security issues in the research field. First of all, this method is particularly suitable for scenarios where data is sensitive and private, and it is not realistic to frequently use the teacher model for prediction in such scenarios. Secondly, it provides an environment for simulating vulnerabilities for the student model, which is convenient for security assessment and testing its robustness against security threats such as attacks and data pollution, thereby evaluating and improving the security of the teacher model and reducing the risk of attacks in practical applications. In addition, this method is highly targeted and can accurately analyze the nature and impact of vulnerabilities. At the same time, it is highly flexible, and the distillation parameters and methods can be adjusted according to research needs. It is also easy to implement on the basis of the existing knowledge distillation framework, reducing the difficulty and cost of implementation. Ultimately, by simulating vulnerabilities, researchers can gain a deeper understanding of the model’s internal workings, promote the development of model security and robustness technologies, provide support for building safer and more reliable deep learning models, and enhance the robustness of the model by analyzing vulnerabilities and taking remediation measures, making it more stable and reliable in the face of various challenges. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be described in full below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] The core of this method is a non-targeted vulnerability extraction method based on responsive knowledge distillation, which can cleverly transfer key information and potential vulnerabilities in large and complex neural network models to a lightweight and simple model. This process is not a simple data copy or imitation, but is based on the analysis of the internal knowledge structure of the model and the extraction of key information. In this way, we can see through the internal decision-making logic of complex models and identify and prevent potential risk points. In practical applications, this technology can be very practical. It can help us quickly locate specific input data types that are prone to cause the model to make incorrect predictions, such as images with specific textures, colors, or shapes. By accurately identifying and processing these problematic data, we can make targeted adjustments and optimizations to the model to improve its prediction accuracy.

[0031] This method can also reveal patterns that make the model more prone to errors under a specific distribution of prediction results. This finding provides us with a new perspective to examine and evaluate the robustness and stability of the model. For application scenarios with extremely high safety requirements such as autonomous driving and medical diagnosis, the introduction of this technology may greatly improve the overall performance of the system and reduce potential risks. In general, this knowledge distillation-based technology provides defenders with a powerful tool that enables them to gain a deeper understanding of the internal mechanisms and potential risks of deep learning models. By accurately extracting and identifying security vulnerabilities, we can improve the accuracy, robustness of the model and the overall security of the system.

[0032] The specific method is as follows:

[0033] Step 1: Select the target teacher model and obtain the output logit of the teacher model by inputting the specified data set. For the target teacher model T, for the K-classified data set. The logit value obtained by inputting the sample x is expressed as T(x):

[0034]

[0035] in, is the logit value of the K-th classification prediction of the teacher model for input x. Different from other prediction values, The logit value for our chosen target category.

[0036] Step 2: Convert the logit value obtained in the first step into the form of probability distribution through the Softmax function. The calculation method is as follows:

[0037]

[0038] in, is the probability distribution of the teacher model's response to input x.

[0039] Step 3: Distribute the response probability obtained in step 2 Processed for transferring knowledge containing vulnerabilities to the student model.

[0040] Starting from the target classification trg, we look for loopholes that can make the model mistakenly classify into any other classification. In processing the prediction results of the teacher model, we negate the probability values ​​of all classifications:

[0041]

[0042] in, Represents the probability value of the corresponding classification after negation.

[0043] By combining the negative classification probability values, we can get the probability distribution required for distillation

[0044]

[0045] in, Represents the probability value distribution of the combination after taking the negation. Represents the probability value of the corresponding classification after negation.

[0046] Normalize the probability values ​​obtained in the previous step to obtain the final probability distribution for distilling vulnerabilities

[0047]

[0048] in, It represents the k-classification probability value obtained by normalization after negation; It represents the probability distribution formed by combining the normalized probability values, which is also the probability distribution finally used for distillation.

[0049] Step 4: Use distillation loss for knowledge distillation. In order to better extract the vulnerabilities of the teacher model, the student model needs to better fit the output of the teacher model. Use distillation loss to distill vulnerability knowledge. The distillation loss is defined as the student probability (calculated by formula (2) based on the output of the student model) and the teacher probability after the third step The KL divergence value (Kullback-Leibler divergence):

[0050]

[0051] in, Represents the predicted probability value of the teacher model for the k classification of input x after processing in the third step.

[0052] Represents the predicted probability value of the student model for the k classification of input x.

[0053] Step 5: Load the distilled student model to perform predictions. Input the test set of the specified data set into the student model, and load the student model to predict the input sample. If the prediction result obtained is the same as the true label of the sample, it means that the prediction of the teacher model is wrong. The student model has effectively inherited the loopholes of the teacher model from a specific target domain. In this way, the prediction results of the student model should be opposite or different from those of the teacher model. When it predicts correctly for a certain sample, we can assume that the teacher model has misclassified the sample. Therefore, it can be considered that the student model exposes the weaknesses and loopholes of the teacher model under certain specific samples.

Claims

1. A non-target vulnerability extraction method based on responsive knowledge distillation, characterized by: The steps are: Step 1: Select the target teacher model, obtain the output logit of the teacher model by inputting the specified data set, and for the target teacher model T, for the K-classified data set, input sample x, and the obtained logit value is expressed as T(x): in, is the logit value of the K-th classification prediction of the teacher model for input x. Different from other prediction values, The logit value of the target category we selected; Step 2: Convert the logit value obtained in the first step into the form of probability distribution through the Softmax function. The calculation method is as follows: in, is the probability distribution of the teacher model’s response to input x; Step 3: Distribute the response probability obtained in step 2 Processing for transferring knowledge containing vulnerabilities to the student model; Step 4: Use distillation loss for knowledge distillation and distillation loss for vulnerability knowledge distillation. The distillation loss is defined as the student probability And after the third step, we get the teacher probability The KL divergence value of: in, It is calculated by formula (2) based on the output of the student model. Represents the predicted probability value of the teacher model for the k-classification of input x after the third step. Represents the predicted probability value of the student model for the k classification of input x; Step 5: Load the distilled student model to perform predictions. Input the test set of the specified data set into the student model. Load the student model to predict the input sample. If the prediction result is the same as the true label of the sample, it means that the teacher model's prediction is wrong.

2. The method for extracting non-target vulnerabilities based on responsive knowledge distillation according to claim 1 is characterized in that: In the step 3, the specific method is: Starting from the target classification trg, we look for loopholes that cause the model to be incorrectly classified into any other classification. In the processing of the teacher model prediction results, we negate the probability values ​​of all classifications: in, Indicates the probability value of the corresponding classification after negation; Combine the probability values ​​of each classification after negation to obtain the probability distribution required for distillation in, represents the probability value distribution of the combination after taking the negative, Indicates the probability value of the corresponding classification after negation; Normalize the probability values ​​obtained in the previous step to obtain the final probability distribution for distilling vulnerabilities in, It represents the k-classification probability value obtained by normalization after negation; Represents the probability distribution formed by combining the normalized probability values, which is used for the probability distribution of distillation.

Images