High mobility adversarial sample generation method based on multi-modal model

Abstract

The invention relates to the technical field of computer vision, deep learning and artificial intelligence, and provides a high-mobility adversarial sample generation method based on a multi-modal model, and the method comprises the steps: data set construction: obtaining high-confidence classification images from a public data set; noise latent code generation: generating a noise latent code by using a reverse process of a table diffusion model; explicit semantic feature modification: injecting adversarial semantic features by explicitly modifying a text condition vector of the image; implicit semantic feature optimization: modifying a text condition vector by using gradient information to enhance adversarial features; and generating an adversarial sample. According to the method, the mobility of the adversarial sample can be enhanced by effectively utilizing the advanced semantic features of the multi-modal model, and the limitation of disturbance depending on a pixel level traditionally is avoided. The method has good expansibility, and can be used in combination with the existing anti-attack technology to further enhance the attack ability of the technologies. According to the method, the mobility of the adversarial samples among different models can be remarkably improved.

Description

Technical Field

[0001] The present invention relates to the fields of computer vision, deep learning and artificial intelligence technology, and proposes a method for generating highly transferable adversarial samples based on a multimodal model, aiming to improve the transferability of adversarial attacks. The present invention can be applied to information security, autonomous driving, face recognition and other security protection fields involving deep learning models. Background Art

[0002] Deep neural networks (DNNs) have become the mainstream method in the field of computer vision due to their outstanding performance in tasks such as image classification and target detection. They are widely used in various fields such as autonomous driving, face recognition, medical diagnosis, and financial risk control.

[0003] Although DNNs have demonstrated powerful classification capabilities, recent studies have revealed their vulnerability to adversarial examples. Adversarial examples are created by adding small but carefully designed perturbations to the original input to cause the model to make incorrect predictions. Such attacks can be implemented not only in white-box models (i.e., the attacker has full information about the target model), but can also be migrated to black-box models for attack (i.e., the attacker has no access to the parameters or structure of the target model).

[0004] Existing adversarial attack methods mainly rely on modifying the low-level pixel features of the image and generating adversarial perturbations by using the gradient information of the white-box model, such as the Fast Gradient Sign Method (FGSM) and Momentum Iterative Method (MI-FGSM). However, the main problem with these methods is that the generated adversarial samples are often overfitted to a specific white-box model, resulting in poor attack effects when facing black-box models with different architectures. This is because different deep neural networks may have very different ways of processing low-level features, resulting in a decrease in attack effectiveness. The transferability of attacks is an important performance indicator of adversarial samples, which refers to whether the same adversarial sample can successfully mislead the target model on different models. Enhancing the transferability of adversarial samples has become an important research topic in the current adversarial attack field. By improving the transferability of adversarial samples, not only can the effectiveness of the attack be improved, but also the dependence of the attack on the model structure information can be reduced, thereby improving the practical applicability of the attack. At present, the research direction of enhancing the transferability of adversarial samples mainly focuses on optimizing pixel perturbations, such as input-based diversification technology (DIM), scale invariance technology (SIM), and input enhancement technology. Although these technologies have improved the success rate of attacks to a certain extent, the problem that the attack effects are still limited by specific model architectures. Summary of the invention

[0005] In order to solve the above technical problems existing in the prior art, the present invention proposes a method for generating highly transferable adversarial samples based on a multimodal model, comprising the following steps:

[0006] Step 1: Dataset construction: Obtain high-confidence images to construct a dataset;

[0007] Step 2: Noise latent code generation: Use the diffusion model to process the original image in the data set constructed in step 1 to generate a noise latent code, and add the generated noise latent code to the original image to form a noise image;

[0008] Step 3: Explicit semantic feature modification: Inject adversarial semantic features by adjusting the modification direction of the image text conditional vector;

[0009] Step 4: Implicit semantic feature optimization: iteratively modify the image text conditional vector through the gradient descent method;

[0010] Step 5: Generate adversarial samples: fuse the explicit semantic features modified in step 3 and the implicit semantic features optimized in step 4 to obtain adversarial sample features and generate adversarial samples.

[0011] Furthermore, the high confidence image in step 1 satisfies the following conditions:

[0012] Correctly classified by the target classification model with a classification confidence level above 90%;

[0013] Image categories cover multiple different class labels.

[0014] Furthermore, in step 2, the stable diffusion model is used to process the original image in the data set constructed in step 1, and noise is gradually added to generate latent code representation. In the generation process, the Denoising Diffusion Implicit Models algorithm is used to perform reverse diffusion of noise. The reverse diffusion formula is:

[0015]

[0016] Among them, x t is the latent code of the tth step, f θ is the denoising network, c is the text condition vector, ∈ θ is the noise prediction, t is the time step of noise diffusion, α is the coefficient of noise size, and θ is the network parameter.

[0017] Furthermore, step 3 includes:

[0018] Step 3.1: Generate text conditional vector: Use the multimodal model to generate the original image text conditional vector c corresponding to the original image in the dataset constructed in step 1original , c original Represents the original semantic information of the original image;

[0019] Step 3.2: Select the obfuscation category and generate the obfuscated image text conditional vector: Select the obfuscation category from the category that is semantically close to the original category, and use the multimodal model to generate the obfuscated image text conditional vector c corresponding to the obfuscation category. confuse ;

[0020] Step 3.3, calculate the modification direction of the image text conditional vector: According to the image text conditional vectors of the original category and the confused category, calculate the difference between the two and obtain the modification direction Δ dir :

[0021] Δ dir =c confuse -c original ;

[0022] Step 3.4: Inject adversarial semantic features of the confusion category: In the reverse diffusion process of the diffusion model, gradually inject the original image text conditional vector c original The adversarial semantic features of the confused category are injected to obtain the explicit semantic features feature1 corresponding to the original image.

[0023] Furthermore, in step 3.4, the modified direction Δ is proportionally modified at each time step. dir Add to the original image text condition vector c original In this way, the semantic features of the image gradually tend to be confused categories.

[0024] Furthermore, step 4 includes:

[0025] Step 4.1, classification model prediction of the image: In the back diffusion process of the stable diffusion model, the noise image generated in step 2 is restored to a normal image and input into the pre-trained target classification model to obtain the prediction confidence of the target classification model for the original category and the confused category. The probability output of the confidence is:

[0026] p(y|x)

[0027] Among them, y is the category and x is the image;

[0028] Step 4.2, set the loss function to:

[0029] min(-log(p(y confuse |x,c))+log(p(y original |x,c)))

[0030] Among them, y confuse |x is the label corresponding to the confusion category, yoriginal ∣x is the label corresponding to the original category;

[0031] Step 4.3, adjust the image text conditional vector: In each back diffusion time step, optimize the image text conditional vector c by gradient descent method to obtain the implicit semantic feature feature2 corresponding to the original image.

[0032] Furthermore, step 5 includes:

[0033] Through iterative optimization, explicit semantic feature feature1 and implicit semantic feature feature2 are introduced respectively, and the explicit semantic feature feature1 and implicit semantic feature feature2 are added to the original features of the image sample to generate adversarial samples. confuse The calculation is as follows:

[0034] feature confuse =m*feature1+n*feature2,

[0035] Among them, m and n are weight coefficients.

[0036] The present invention can be combined with existing work on improving the transferability of adversarial attacks to further improve the transferability of adversarial samples. Compared with the prior art, the present invention has the following advantages: The present invention uses the high-level semantic features of the multimodal model to enhance the transferability of adversarial samples, avoiding the limitations of traditional reliance on pixel-level perturbations. The method of the present invention has good scalability and can be used in combination with existing adversarial attack techniques (such as FGSM, MI-FGSM, etc.) to further enhance the attack capabilities of these techniques. The present invention can significantly improve the transferability of adversarial samples between different models by introducing adversarial features that modify the high-level semantic information of the image, rather than relying solely on pixel-level perturbations. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described below through specific embodiments and drawings.

[0039] like Figure 1 As shown, the method of the present invention comprises the following steps:

[0040] Step 1: Dataset construction:

[0041] Select image samples from a dataset such as ImageNet, and input each label-corresponding image sample into the target classification model as a test sample, and use the target classification model to predict the label of the test sample. Finally, select the image sample that the target classification model predicts correctly and has a confidence score higher than 0.9 as the original image.

[0042] Step 2: Noise latent code generation:

[0043] The noise latent code is generated using the reverse process of a diffusion model, such as the stable diffusion model (stable diffusion model, an open source model).

[0044] Step 3: Explicit semantic feature modification:

[0045] Adversarial semantic features are injected by adjusting the modification direction of the image-text conditional vector.

[0046] Explicit means that the modification process is carried out through clear steps, each time adjusting a certain proportion (such as 0.2), and the whole process is clearly reflected in the running process of the program.

[0047] Step 4: Implicit semantic feature optimization:

[0048] The adversarial features are enhanced by modifying the text conditional vector using gradient information.

[0049] Implicit means optimizing semantic features through the gradient descent method. The gradient descent method is a commonly used automatic optimization method, and its internal operation process is not transparent to developers.

[0050] The present invention uses both "explicit" and "implicit" strategies to modify semantic features.

[0051] Step 5: Generate adversarial samples:

[0052] The explicit semantic features obtained in step 3 and the implicit semantic features obtained in step 4 are fused to generate the final adversarial sample features. The fused features contain the semantic information of the multimodal model, which helps to improve the transferability of adversarial samples.

[0053] Adversarial features are introduced through iterative optimization, and adversarial samples are generated by combining existing adversarial attack methods.

[0054] In a specific embodiment of the present invention, in step 1, the present invention selects high-confidence images from image classification datasets such as ImageNet and adds them to the dataset.

[0055] Among them, high confidence means that after an image is input into the target model, the target model can predict the category of the image with a high confidence. Confidence greater than 0.8 is high confidence. If the confidence is set to 0.9, the target model can predict correctly with a probability of 90%.

[0056] For example, for a picture of a cat, when it is input into the target model, if the target model predicts that the picture is about a cat with a probability of 95% (i.e., a confidence level of 0.95), the picture meets the requirements and is added to the dataset. If the target model predicts that the picture is about a cat with a probability of 40% (i.e., a confidence level of 0.4), and predicts that the picture is about another animal with a probability of 70% (i.e., a confidence level of 0.7), the picture does not meet the requirements and is not added to the dataset. The dataset starts as an empty dataset, and the number of pictures in the dataset continues to grow as it is continuously screened.

[0057] These images must meet the following criteria:

[0058] (1) Correctly classified by the target classification model (such as ResNet-50, VGG-16, etc.), and the classification confidence can be set to be higher than 90%.

[0059] For example, if the original category label of image sample A is Face, but it is classified as Airplane by ResNet-50, it does not meet the image selection conditions.

[0060] For example, if the original category label of image sample B is Motorbike, it is classified as Motorbike by VGG-16, but the confidence of the classification is only 60%, which does not meet the image selection conditions.

[0061] For example, if the original category label of image sample C is Motorbike, and it is classified as Motorbike by VGG-16, and the classification confidence is 95%, then it meets the image selection conditions.

[0062] (2) The ImageNet dataset contains 1,000 category labels. The selected image categories cover multiple different category labels, such as Motorbike, Leopard, Airplane, Face, etc., to ensure the diversity and generalization of the adversarial sample generation process. The specific number of category labels is determined according to actual needs and is usually not less than 100 category labels.

[0063] In a specific embodiment of the present invention, in step 2, the noise latent code generation step uses a stable diffusion model to process the original image, and gradually adds noise to generate a latent code representation. During the generation process, the Denoising Diffusion Implicit Models (DDIM) algorithm is used to perform reverse diffusion of noise to ensure the determinism of the image reconstruction process. The reverse diffusion formula is as follows:

[0064]

[0065] Among them, x t is the latent code of the tth step, f θ is the denoising network, c is the text condition vector, ∈ θ is the noise prediction, t is the time step of noise diffusion, α is the coefficient of noise size, and θ is the network parameter.

[0066] In a specific embodiment of the present invention, in step 3, explicit semantic feature modification specifically includes the following steps:

[0067] Step 3.1: Generate text conditional vector: Use a multimodal model (such as CLIP model) to generate the original image text conditional vector c corresponding to the original image original The CLIP model is a contrastive learning model that can map images and text into the same feature space. The original image text conditional vector c original Represents the original semantic information of the image.

[0068] Step 3.2, select the obfuscation category and generate the obfuscated text vector: In order to generate adversarial samples, first select the obfuscation category from the category that is semantically close to the original category (such as confusing the image of "cat" with other animals such as "fox"). Use a multimodal model (such as the CLIP model) to generate the obfuscated text conditional vector c corresponding to the obfuscation category confuse .

[0069] Step 3.3, calculate the modification direction of the text condition vector: According to the text condition vectors of the original category and the confused category, calculate the difference between the two and obtain the modification direction Δ dir :

[0070] Δ dir =c confuse -c original

[0071] Among them, c original represents the original image text condition vector, c confuse Represents the obfuscated text condition vector. Get the modification direction Δ dir After that, the semantics of the original image is gradually transformed according to Δ dirThe direction of the confusing category transition.

[0072] Step 3.4: Inject adversarial semantic features of the confusion category: In the reverse process of the diffusion model, gradually inject the original image text conditional vector c original Inject adversarial semantic features of the confused category to obtain the explicit semantic feature feature1.

[0073] The specific method is: in each time step, the modified direction Δ is proportionally (the default ratio is 0.2, which can be reset according to the actual situation. The larger the ratio, the greater the degree of modification of the direction, and the more inclined to the confusion category) dir Add to the original image text condition vector (such as: c original +0.2×Δ dir ), so that the semantic features of the image gradually tend to the confused category, thereby weakening the semantic strength of the original category and increasing the semantic features of the adversarial perturbation.

[0074] In a specific embodiment of the present invention, in step 4, the implicit semantic feature optimization part includes the following steps:

[0075] Step 4.1: The classification model predicts the image.

[0076] In the denoising process of the stablediffusion model, the noisy image generated in step 2 is restored to a normal image and input into a pre-trained classification model (such as ResNet, Inception, MobileNet, etc.) to obtain the model's prediction confidence for the original category and the confused category. The probability output of the confidence is:

[0077] p(y|x)

[0078] Among them, y is the category and x is the image.

[0079] Step 4.2: Set the loss function.

[0080] Set the loss function to:

[0081] min(-log(p(y confuse |x,c))+log(p(y original |x,c)))

[0082] Among them, y confuse |x is the label corresponding to the confusion category, y original |x is the label corresponding to the original category.

[0083] In order to improve the attack effect of adversarial samples, the text condition vector c can be optimized by gradient descent. The gradient descent method gradually reduces the loss function value by continuously adjusting the variables to move in the opposite direction of the gradient of the loss function. Therefore, the optimization goal is to adjust the optimization variables to reduce the value of the loss function, so that the confidence of the classification model in the original category is reduced, while the confidence in the confused category is increased.

[0084] Step 4.3: Adjust the text condition vector.

[0085] In each reverse diffusion time step, the text condition vector c is set as the optimization variable, and the text condition vector c is optimized by the gradient descent method, so that the generated image is more likely to be misclassified as a confusing category by the classification model, and the implicit semantic feature feature2 is obtained after the gradient descent algorithm ends. This process allows the generated adversarial sample to not only introduce perturbations at the pixel level, but also contain advanced semantic perturbations, thereby enhancing the transferability of the sample.

[0086] Step 5: Generate adversarial samples.

[0087] Through iterative optimization, explicit semantic feature feature1 and implicit semantic feature feature2 are introduced respectively. Feature1 and feature2 are added to the original features of the image sample to generate the final adversarial sample. Feature1 and feature2 are adjusted by weight coefficients m and n during the fusion process. The default values ​​are m=0.5 and n=0.5. The actual application process can be adjusted according to needs. The fused adversarial sample feature feature confuse The calculation is as follows:

[0088] feature confuse =m*feature1+n*feature2.

[0089] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for generating highly transferable adversarial samples based on a multimodal model, characterized in that: The following steps are involved: Step 1: Dataset construction: Obtain high-confidence images to construct a dataset; Step 2: Noise latent code generation: Use the diffusion model to process the original image in the data set constructed in step 1 to generate a noise latent code, and add the generated noise latent code to the original image to form a noise image; Step 3: Explicit semantic feature modification: Inject adversarial semantic features by adjusting the modification direction of the image text conditional vector; Step 4: Implicit semantic feature optimization: iteratively modify the image text conditional vector through the gradient descent method; Step 5: Generate adversarial samples: fuse the explicit semantic features modified in step 3 and the implicit semantic features optimized in step 4 to obtain adversarial sample features and generate adversarial samples.

2. According to claim 1, a method for generating highly transferable adversarial samples based on a multimodal model is characterized in that: The high confidence image in step 1 satisfies the following conditions: Correctly classified by the target classification model with a classification confidence level above 90%; Image categories cover multiple different class labels.

3. According to claim 2, a method for generating highly transferable adversarial samples based on a multimodal model is characterized in that: In step 2, the stable diffusion model is used to process the original image in the data set constructed in step 1, and noise is gradually added to generate latent representation. During the generation process, the Denoising Diffusion Implicit Models algorithm is used to perform reverse diffusion of noise. The reverse diffusion formula is: Among them, x t is the latent code of the tth step, f θ is the denoising network, c is the text condition vector, ∈ θ is the noise prediction, t is the time step of noise diffusion, α is the coefficient of noise size, and θ is the network parameter.

4. According to claim 3, a method for generating highly transferable adversarial samples based on a multimodal model is characterized in that: Step 3 includes: Step 3.1: Generate text conditional vector: Use the multimodal model to generate the original image text conditional vector c corresponding to the original image in the dataset constructed in step 1 original , c original Represents the original semantic information of the original image; Step 3.2: Select the obfuscation category and generate the obfuscated image text conditional vector: Select the obfuscation category from the category that is semantically close to the original category, and use the multimodal model to generate the obfuscated image text conditional vector c corresponding to the obfuscation category. confuse ; Step 3.3, calculate the modification direction of the image text conditional vector: According to the image text conditional vectors of the original category and the confused category, calculate the difference between the two and obtain the modification direction Δ dir : D dir =c confuse -c original ; Step 3.4: Inject adversarial semantic features of the confusion category: In the reverse diffusion process of the diffusion model, gradually inject the original image text conditional vector c original The adversarial semantic features of the confused category are injected to obtain the explicit semantic features feature1 corresponding to the original image.

5. According to claim 4, a method for generating highly transferable adversarial samples based on a multimodal model is characterized in that: In step 3.4, the direction Δ is modified at each time step by the proportion dir Add to the original image text condition vector c original In this way, the semantic features of the image gradually tend to be confused categories.

6. The method for generating highly transferable adversarial samples based on a multimodal model according to claim 4 or 5, characterized in that: Step 4 includes: Step 4.1: Prediction of the image by the classification model: In the reverse diffusion process of the stable diffusion model, the noise image generated in step 2 is restored to a normal image and input into the pre-trained target classification model to obtain the prediction confidence of the target classification model for the original category and the confused category. The probability output of the confidence is: p(y|x) Among them, y is the category and x is the image; Step 4.2, set the loss function to: min(-log(p(y confuse |x,c))+log(p(y original |x,c))) Among them, y confuse |x is the label corresponding to the confusion category, y original |x is the label corresponding to the original category; Step 4.3, adjust the image text conditional vector: In each back diffusion time step, optimize the image text conditional vector c by gradient descent method to obtain the implicit semantic feature feature2 corresponding to the original image.

7. The method for generating highly transferable adversarial samples based on a multimodal model according to claim 6, characterized in that: Step 5 includes: Through iterative optimization, explicit semantic feature feature1 and implicit semantic feature feature2 are introduced respectively, and the explicit semantic feature feature1 and implicit semantic feature feature2 are added to the original features of the image sample to generate adversarial samples. confuse The calculation is as follows: feature confuse =m*feature1+n*feature2, Among them, m and n are weight coefficients.

Images