Video non-restricted migration attack method based on diffusion model

Abstract

The invention belongs to the technical field of network security, and particularly relates to a video non-limited migration attack method based on a diffusion model. According to the method, a benign frame is mapped to a hidden space through a DDIM inversion process of a diffusion model, and a hidden variable is optimized by adopting a time step-by-step confrontation hidden variable optimization strategy in a DDIM sampling process, so that the added confrontation content has strong confrontation and is more natural; in addition, a packet token merging mechanism is introduced to align and compress cross-frame time redundancy tokens; a shared token and grouping token merging mechanism is used in the self-attention module to optimize detail misalignment information in frame-by-frame optimization, and an antagonistic video consistent in time is generated; meanwhile, inter-frame interaction is promoted by merging tokens across video frames, so that the gradient of the current frame is fused with information from associated frames, a steady and diversified gradient updating direction is generated, and the adversarial mobility is improved. Experiments prove that the method has the most advanced performance on different video models.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a video unrestricted migration attack method based on a diffusion model. Background Art

[0002] Adversarial attack refers to the technology of misleading deep neural networks (DNNs) into making wrong decisions by adding perturbations that are imperceptible to humans on clean samples. Among them, the generated samples that can cause DNNs to make wrong decisions are called adversarial examples. According to the threat model, adversarial attacks can be classified into white-box attacks and black-box attacks. In white-box attacks, the attacker has full access to DNNs, including model structure, parameters, etc. In black-box attacks, the attacker can only access the output of DNNs. Therefore, research on black-box attacks is more realistic and challenging.

[0003] In recent years, deep neural networks (DNNs) have achieved great success in computer vision and multimedia analysis tasks and have been widely used in practical production and life. However, the emergence of adversarial examples has brought challenges to the robustness of DNNs [1,2]. At the same time, the transferability of adversarial examples makes black-box attacks possible, which poses a security threat to the deployment of deep models in safety-critical scenarios such as face verification and surveillance video analysis. At present, most transfer-based adversarial attacks attempt to ensure "subtle perturbations" by restricting the Lp-norm of the perturbation [3,4,5]. However, adversarial examples generated under the Lp-norm constraint still have perceptible perturbation noise, making them easier to detect. Therefore, unrestricted adversarial attacks began to emerge [6,7]. Unlike previous methods, unrestricted attacks are achieved by adding unrestricted natural perturbations (such as texture, style, color, etc.). Compared with traditional attacks that add restricted adversarial noise, the adversarial examples optimized by the above unrestricted attacks are more natural. At present, research on unrestricted adversarial attacks mainly focuses on image models, while research on video models, especially the transferability of unrestricted adversarial attacks on video models, is still relatively rare.

[0004] The main challenges of this invention come from three aspects. Adversarial video generation involves gradient calculations throughout the denoising process, resulting in high memory overhead. Second, diffusion models usually add rough semantic information for guidance in the early denoising steps. However, in generating adversarial videos, perturbing latent variables too early will cause significant distortion in the generated adversarial frames, and generating adversarial frames frame by frame will result in poor temporal consistency in the final adversarial video. Finally, due to the introduction of the time dimension, individual adversarial perturbations frame by frame will introduce monotonic gradients and lack of information interaction between video frames, making the migration of adversarial frames weak. Summary of the invention

[0005] The object of the present invention is to provide a video unrestricted transfer attack method based on a diffusion model to generate imperceptible video adversarial samples with higher transferability, improve adversarial transferability and maintain consistency in motion and timing.

[0006] The video unrestricted transfer attack method based on the diffusion model provided by the present invention, specifically, maps the benign frames to the latent space through the DDIM[8] inversion process of the diffusion model, and in the DDIM sampling process, uses a time-step-by-time adversarial latent variable optimization strategy to optimize the latent variables. This strategy can make the addition of adversarial content more natural while being highly adversarial. In addition, the present invention introduces a grouped token merging mechanism[9] to align and compress temporally redundant tokens across frames. By using shared tokens in the self-attention module, the grouped token merging mechanism optimizes the misaligned information of details in the frame-by-frame optimization, thereby generating temporally consistent adversarial videos. At the same time, merging tokens across video frames promotes inter-frame interaction, allowing the gradient of the current frame to fuse the information from the associated frames, generating robust and diverse gradient update directions, thereby improving adversarial transferability. A large number of experiments have demonstrated the effectiveness of the attack method of the present invention, and have achieved state-of-the-art performance on different video models.

[0007] The video unrestricted migration attack method based on the diffusion model provided by the present invention is specifically divided into two stages: diffusion model denoising and diffusion sampling:

[0008] (i) In the denoising stage of the diffusion model, a time-step-by-time adversarial latent variable optimization strategy is used to optimize the latent variables.

[0009] Specifically, for each video frame input, the perturbation of the latent space of the diffusion model is optimized in each denoising step; the operation steps are as follows:

[0010] Step 1: Given an input video frame x∈R N×H×W×C And the corresponding classification label y∈{1,2,…K}, where N, H and W are the number of frames, height and width respectively, C is the number of channels, and K is the total number of categories. For the target video recognition model Select alternative video model G φ Participate in the gradient update process of adversarial optimization. The diffusion model uses Stable Diffusion 2.0, which includes the noise prediction network UNet, VAE model and scheduler; among them, the UNet network includes modules such as convolution layer, self-attention layer and cross-attention layer.

[0011] Step 2: Set the inversion time step to T. After the DDIM inversion process of the diffusion model, the inverse latent variable {x 0 ,x1 ,…,x T}, x i represents the hidden variable corresponding to the i-th time step;

[0012] Step 3: Initialize adversarial latent variables Then the denoising stage performs adversarial optimization on the latent variables. Specifically, at each denoising time step t, the final output of each frame is predicted To replace the output Perform alternative model G φ Then get the adversarial loss and update the adversarial hidden variable according to the gradient backpropagation Fighting Hidden Variables The calculation and adversarial objective function are expressed as follows:

[0013]

[0014] Among them, α t represents the scheduler parameters, ∈ θ represents the noise predicted by the diffusion model, J(·,·,·) represents the cross entropy loss, and L attack To combat losses.

[0015] Step 4: In order to maintain the spatial consistency of the adversarial video clips, the structural loss is calculated while predicting the noise, minimizing the self-attention loss of the benign frames and the adversarial frames in UNet, and merging it with the above adversarial loss into the total loss, expressed as follows:

[0016]

[0017] Among them, L structure represents the structural loss, L total represents the total optimization loss, n s represents the total number of self-attention maps in the diffusion model, and denote the j-th self-attention map of the adversarial latent variable and the benign latent variable, respectively. γ and β denote the weight factors of each loss, and their sizes are determined by experiments.

[0018] Step 5: Optimize Afterwards, from Generate samples To prepare for adversarial optimization at the next time step; The generation expression is as follows:

[0019]

[0020] Step 6: After t time steps of adversarial optimization, the final adversarial latent variable is obtained is used as the final adversarial video clip to deceive the target video recognition model.

[0021] (ii) In the diffusion sampling stage, the grouped token merging and reverse merging modules are introduced into the UNet structure of the diffusion model to enhance temporal consistency and adversarial migration.

[0022] The present invention introduces a grouped token merging mechanism to align and compress temporally redundant tokens across frames; by matching and merging similar tokens across frames, the self-attention module of UNet can extract consistent features; the specific operation steps are:

[0023] Step 1: Before inputting the self-attention module, the adversarial video is divided into groups of 4 frames, and the tokens T of each group are divided into source (src) and target (dst) sets. Then, the tokens in the source set are matched with the most similar tokens in the target (dst), and then sorted in descending order according to the cosine similarity, and the r most similar edges are selected. A larger r will result in greater information loss, while a smaller r will affect the degree of information interaction between tokens. Experiments have shown that the performance is best when r is 37.5%;

[0024] Step 2: Next, the tokens are merged by replacing the r most similar tokens connected in the source set with the matching target set tokens, and the merged tokens are input into the self-attention module of UNet for calculation;

[0025] Step 3: The output tokens after the self-attention module of UNet need to be restored to the original number. In order to keep the number of tokens unchanged, the grouped tokens need to be reversed and merged. Specifically, the merged tokens are split in an assignment manner, that is, the merged tokens are assigned the output value of the merged tokens.

[0026] The innovation of the present invention lies in:

[0027] (1) We propose the first framework for unrestricted adversarial attacks on videos using a diffusion model to generate imperceptible video adversarial examples with higher transferability.

[0028] (2) A time-step adversarial latent variable optimization strategy and a grouped token merging module are proposed to merge self-attention tokens across frames, aiming to improve adversarial transferability and maintain motion and temporal consistency. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a flowchart of the video unrestricted migration attack method based on the diffusion model proposed by the present invention. DETAILED DESCRIPTION

[0030] The present invention is further described below through specific examples.

[0031] Step 1: For a benign video segment x∈R N×H×W×C , where H and W are the height and width of the video clip, C is the number of channels in the video clip (usually 3), and N is the number of frames in the video clip. The true label of the video clip x is y∈{1,2,…,K}, where K represents the number of categories. Denotes the target video recognition model, which outputs the predicted category of the input video clip. Able to fool video recognition models , causing it to make incorrect predictions

[0032] Step 2: Load the UNet, VAE and scheduler modules of the diffusion model and replace the model G φ .

[0033] Step 3: Convert the video clip x into latent variable x through the diffusion model VAE 0 , through the DDIM of the diffusion model, reverse T steps, select s Step 2 starts the anti-optimization. Here we select T = 20, t s =15.

[0034] Step 4: Add group token merging and group token reverse merging modules before and after the self-attention module of the diffusion model.

[0035] Step 5: At each denoising time step t, the adversarial latent variable Input to UNet to predict noise and calculate the structural loss L structure And the final output of each frame To replace the output

[0036] Step 6: Input the predicted output to the surrogate model G φ Predict the classification label and calculate the adversarial loss L attack , the adversarial loss and structural loss are summed to optimize the total loss L total , where γ=10 and β=100 are set.

[0037] Step 7: Back propagate the optimized total loss to obtain the gradient and update it adversarially

[0038] Step 8: From Generate samples Repeat steps 5 to 8 until the optimization reaches step 0 to obtain the final adversarial latent variable.

[0039] Step 9: After VAE decoding, an adversarial video clip is generated Then will Input to the target video recognition model

[0040] The following table shows the evaluation comparison results of the method proposed in this invention and multiple benchmark methods on the Kinetics-400 dataset. The alternative model is Slow-50, and the average migration success rate is used as the evaluation indicator of migration attack.

[0041]

[0042] The attack method of the present invention performs best overall in the evaluation. In particular, the attack method of the present invention achieves 78.50% on the Slow-10 model, which is 4.50%, 66.25% and 40.00% higher than TT, NCF and ACA respectively. The results show the superiority and effectiveness of the present invention in the video migration attack task.

[0043] References

[0044] [1]Ian J Goodfellow,Jonathon Shlens,and Christian Szegedy.Explaining and harnessing adversarial examples.arXivpreprint arXiv:1412.6572,2014.

[0045] [2]Christian Szegedy,Wojciech Zaremba,Ilya Sutskever,JoanBruna,Dumitru Erhan,Ian Goodfellow,and Rob Fergus.Intriguing properties of neuralnetworks.arXiv preprintarXiv:1312.6199,2013.

[0046] [3]Yinpeng Dong,Fangzhou Liao,Tianyu Pang,Hang Su,JunZhu,Xiaolin Hu,and JianguoLi.Boosting adversarial attackswith momentum.In Proceedings of theIEEE conference on computer vision and pattern recognition,pages9185–9193,2018.

[0047] [4]CihangXie,Zhishuai Zhang,Yuyin Zhou,Song Bai,JianyuWang,Zhou Ren,and Alan L Yuille.Improving transferabilityof adversarial examples with inputdiversity.In Proceedingsof the IEEE / CVF Conference on Computer VisionandPattern Recognition,pages 2730–2739,2019.

[0048] [5]Yinpeng Dong,Tianyu Pang,Hang Su,and Jun Zhu.Evading defenses totransferable adversarial examplesby translation-invariant attacks.InProceedings of the IEEE / CVF Conference on Computer Vision andPatternRecognition,pages 4312–4321,2019.

[0049] [6]qiang Zhang.2023.Content-based Unrestricted Adversarial Attack.InAd-vances in Neural Information Processing Systems,A.Oh,T.Neumann,A.Glober-son,K.Saenko,M.Hardt,and S.Levine(Eds.),Vol.36.Curran Associates,Inc.,51719–51733.

[0050] [7]Chen J,Chen H,Chen K,et al.Diffusion models for imperceptible andtransferable adversarial attack[J].IEEE Transactions on Pattern Analysis andMachine Intelligence,2024.

[0051] [8]Mokady R,Hertz A,Aberman K,et al.Null-text inversion for editingreal images using guided diffusion models[C] / / Proceedings of the IEEE / CVFConference on Computer Vision and Pattern Recognition.2023:6038-6047.

[0052] [9]Bolya D,Hoffman J.Token merging for fast stablediffusion[C] / / Proceedings of the IEEE / CVF conference on computer vision and patternrecognition.2023:4599-4603。

Claims

1. A video unrestricted migration attack method based on a diffusion model, characterized in that: Benign frames are mapped to latent space through DDIM inversion of the diffusion model. In the DDIM sampling process, a time-step-by-time adversarial latent variable optimization strategy is used to optimize the latent variables, making the addition of adversarial content more natural while being highly adversarial. In addition, a grouped token merging mechanism is introduced to align and compress temporally redundant tokens across frames. By using shared tokens in the self-attention module, temporally consistent adversarial videos are generated. At the same time, tokens are merged across video frames to promote inter-frame interaction, so that the gradient of the current frame fuses the information from the associated frames, generating robust and diverse gradient update directions, thereby improving adversarial migration. It is specifically divided into two stages: diffusion model denoising and diffusion sampling, where: (i) In the denoising stage of the diffusion model, the latent variables are optimized using a time-step-by-time adversarial latent variable optimization strategy; Specifically, for each video frame input, the perturbation of the latent space of the diffusion model is optimized in each denoising step; the operation steps are as follows: Step 1: Given an input video frame x∈R N×H×W×C and the corresponding classification label y∈{1,2,…K}, where N, H and W are the number of frames, height and width respectively, C is the number of channels, and K is the total number of categories; for the target video recognition model Select alternative video model G φ Participate in the gradient update process of adversarial optimization; the diffusion model adopts Stable Diffusion 2.0, which includes the noise prediction network UNet, VAE model and scheduler; among them, the UNet network includes convolution layer, self-attention layer and cross-attention layer modules; Step 2: Set the inversion time step to T. After the DDIM inversion process of the diffusion model, the inverse latent variables {x0, x1, …, x T }, x i represents the hidden variable corresponding to the i-th time step; Step 3: Initialize adversarial latent variables Then the denoising stage optimizes the latent variables adversarially; specifically, at each denoising time step t, the final output of each frame is predicted To replace the output Perform alternative model G φ The prediction of , and then get the adversarial loss, and update the adversarial hidden variable according to the gradient back propagation Fighting Hidden Variables The calculation and adversarial objective function are expressed as follows: Among them, α t represents the scheduler parameters, ∈ θ represents the noise predicted by the diffusion model, J(·,·,·) represents the cross entropy loss, and L attack To combat losses; Step 4: In order to maintain the spatial consistency of the adversarial video clips, the structural loss is calculated while predicting the noise, minimizing the self-attention loss of the benign frames and the adversarial frames in UNet, and merging it with the above adversarial loss into the total loss, expressed as follows: Among them, L structure represents the structural loss, L total represents the total optimization loss, n s represents the total number of self-attention maps in the diffusion model, and denote the j-th self-attention map of the adversarial latent variable and the benign latent variable, respectively, and γ and β denote the weight factors of each loss; Step 5: Optimize Afterwards, from Generate samples To prepare for adversarial optimization at the next time step; The generation expression is as follows: Step 6: After t time steps of adversarial optimization, the final adversarial latent variable is obtained Used as the final adversarial video clip to deceive the target video recognition model; (ii) In the diffusion sampling stage, the grouped token merging and reverse merging modules are introduced into the UNet structure of the diffusion model to enhance temporal consistency and anti-migration. By introducing a grouped token merging mechanism, we can align and compress temporally redundant tokens across frames. By matching and merging similar tokens across frames, the self-attention module of UNet can extract consistent features. The specific steps are as follows: Step 1: Before inputting the self-attention module, the adversarial video is grouped into 4 frames, and the tokens T of each group are divided into a source set and a target set; then, the tokens in the source set are matched with the most similar tokens in the target set, and they are sorted in descending order according to the cosine similarity, and the r most similar edges are selected; Step 2: Next, replace the r most similar tokens in the source set with the matching target set tokens to merge the tokens, and input the merged tokens into the self-attention module of UNet for calculation; Step 3: The output tokens after the self-attention module of UNet need to be restored to the original number. In order to keep the number of tokens unchanged, it is necessary to go through the grouped token reverse merging process. Specifically, the merged tokens are split in an assignment manner, that is, the merged tokens are assigned the merged token output value.

Images