Image protection method for preventing poisoning attack

Abstract

The invention belongs to the field of network security, and aims to solve the problem that an unauthorized person randomly utilizes personal data in deep learning model training. The invention provides an image protection method for preventing poisoning attacks. The method comprises the following steps: acquiring a target category data set; extracting different categories of dominant image features in the target category data set; taking different categories of dominant image features as perturbations, and correspondingly adding the perturbations into a part of original images in the source category data set to obtain a poisoning image; randomly inserting the poisoning images into the source category data set, and replacing the same number of original images to obtain a poisoning data set; training a deep learning model to be subjected to poisoning attack based on the poisoning data set, and performing model verification by using an unpoisoned source category data set; and judging whether the poisoning attack is valid based on a model verification result. According to the method provided by the invention, the accuracy of the deep learning model can be remarkably reduced, so that the abuse of the data by the unauthorized party is effectively restrained.

Description

Technical Field

[0001] The invention belongs to the field of network security, and in particular relates to an image protection method for preventing poisoning attacks. Background Art

[0002] The development of deep learning has greatly promoted the progress in fields such as image classification, speech recognition and natural language processing. Data plays an important role in this process, and major breakthroughs in network models are inseparable from the capture of large amounts of data.

[0003] Although many open data sets provide a platform for deep learning models, some data sets are still collected for commercial training without the consent of the parties involved, which to some extent infringes on the public's personal privacy and raises public concerns about unauthorized persons arbitrarily using personal data for illegal purposes. Summary of the invention

[0004] In order to solve at least one of the above technical problems existing in the prior art, the present invention provides an image protection method for preventing poisoning attacks.

[0005] The present invention is implemented by the following technical solution: an image protection method for preventing poisoning attacks, comprising the following steps:

[0006] Acquire a target category data set, wherein the target category data set includes several groups of classified target image data;

[0007] Extract the dominant image features of different categories in the target category dataset;

[0008] The dominant image features of different categories are used as disturbances and added to part of the original images in the source category dataset to obtain poisoned images, wherein the source category dataset includes the original image data;

[0009] The poisoned images are randomly inserted into the source category dataset, replacing the same number of original images to obtain the poisoned dataset;

[0010] Train the deep learning model for poisoning attacks based on the poisoned dataset, and use the unpoisoned source category dataset for model validation;

[0011] Determine whether the poisoning attack is effective based on the model verification results.

[0012] Preferably, the poisoned image is visually consistent with the corresponding original image, and disturbance is introduced at the feature level; the deep learning model to be poisoned is defined as the victim model, and the disturbance is used as a decisive feature for the classification of the victim model to make the victim model output the poisoned image and the corresponding original image as different categories.

[0013] Preferably, the generation process of the poisoned image is:

[0014] Given an original image S in a source category dataset, the generated perturbation r and a binary mask m, where the perturbation position is marked as 1 and the rest of the positions are marked as 0, the perturbation is added to the original image using the following formula to obtain the poisoned image;

[0015] The formula is:

[0016]

[0017] In the formula, S i is the i-th original image, is the i-th poisoned image.

[0018] Preferably, it also includes constraining the disturbance at the pixel level and the feature level;

[0019] The constraints at the pixel level are: limiting the difference between the pixel values ​​of the poisoned image and the original image by a minimum value;

[0020] The constraint at the feature level is: optimize the features of the poisoned image so that it is always projected into the feature domain of the target image.

[0021] Preferably, the Euclidean distance between the poisoned image and the target category image in the feature space is calculated, and the distance in the feature space is minimized under the condition that the pixel level satisfies the constraints in the following formula, so as to ensure that the poisoned image is close to the target category image at the feature level;

[0022] The formula is:

[0023]

[0024] Where f() represents the intermediate layer features extracted by the deep learning model, which is trained on the poisoning dataset; the similarity coefficient ε represents a small value to ensure that the optimized poisoning image There is no obvious difference between the original image S and the poisoned image while retaining the poisoned label; the argmin function is used to generate the poisoned image when the features of the poisoned image are closest to the features of the target image; T0 represents the target image category; st. represents the conditions that need to be met during the minimization process.

[0025] The above formula is optimized based on iterative training of the PGD algorithm to ensure that the added disturbance satisfies the constraints in the formula.

[0026] Preferably, a ResNet-34 model and / or a VGG-19 model are used as extractors of dominant image features.

[0027] Preferably, in the model verification phase, the victim model after the poisoning attack is used to classify the source category data set, and its classification accuracy on the source category data set is observed to test the effectiveness of the poisoning attack, and the poisoned image and the original image are compared through the SSIM algorithm to observe the concealment of the poisoning attack.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] In response to the situation where image data may be used as training data for deep learning models by unauthorized third parties, the present invention proposes a poisoning attack method, which embeds the image's dominant features, that is, the key factors for deep learning models to classify images, into the original image as perturbations to generate poisoned images, thereby effectively interfering with the performance of the deep learning model that uses this data as training data.

[0030] In the process of generating poisoned data, in order to enhance the concealment of the perturbation in the original image, the added perturbation is constrained from both the pixel and feature levels while ensuring the optimization of the poisoning effect. Specifically, a minimum value is used to limit the difference between the pixel values ​​of the poisoned image and the original image. At the same time, the features of the poisoned image are optimized so that it is always projected into the feature field of the target category image. Under the above constraints, the optimal perturbation is found.

[0031] The effectiveness of the proposed method is verified through a series of experiments. The experimental results show that the proposed method can significantly reduce the accuracy of the deep learning model, thereby effectively curbing the abuse of data by unauthorized parties. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 This is an example of a poisoning attack that protects user data privacy.

[0034] Figure 2 This is a flowchart of a poisoning attack. DETAILED DESCRIPTION

[0035] In conjunction with the drawings in the embodiments of the present invention, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other implementation methods obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0036] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification so that people familiar with this technology can understand and read them. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantive technical significance. Any structural modification, change in proportional relationship or adjustment of size should fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention. It should be noted that in this specification, relational terms such as first and second are only used to distinguish one entity from several other entities, and do not necessarily require or imply any actual relationship or order between these entities.

[0037] The present invention provides an embodiment:

[0038] An image protection method for preventing poisoning attacks comprises the following steps:

[0039] Acquire a target category data set, wherein the target category data set includes several groups of classified target image data;

[0040] Extract the dominant image features of different categories in the target category dataset;

[0041] The dominant image features of different categories are used as disturbances and added to part of the original images in the source category dataset to obtain poisoned images, wherein the source category dataset includes the original image data;

[0042] The poisoned images are randomly inserted into the source category dataset, replacing the same number of original images to obtain the poisoned dataset;

[0043] Train the deep learning model for poisoning attacks based on the poisoned dataset, and use the unpoisoned source category dataset for model validation;

[0044] Determine whether the poisoning attack is effective based on the model verification results.

[0045] The image protection method to prevent poisoning attacks mainly includes the generation of poisoned images and disturbance generation. The specific methods are as follows:

[0046] S1. Perturbation limitation: For a given target category dataset, the generated perturbation should satisfy equation (1):

[0047] g(S+r)=t,(S,y)∈D(1)

[0048] Among them, g() represents the deep learning model trained with the source category dataset, t is the target category image label, y is the label corresponding to the original image category, and r represents the extracted dominant image feature, that is, the added perturbation.

[0049] In addition, it can be concluded from the above formula that after adding perturbations to any original image S, its labels will become the labels corresponding to the perturbations, ensuring that the added perturbations play a decisive role when the deep learning model classifies images, and are easier for the victim model to learn. The deep learning model to be poisoned is defined as the victim model.

[0050] S2. Extraction of dominant image features: Convert equation (1) to solve the following problem:

[0051]

[0052] in, Z c , Z t They represent the logits values ​​​​except the target category and the logits values ​​​​of the target category, respectively. k represents a constant used to limit the maximum difference between the model for non-target categories and target categories to encourage the model to have a higher confidence in the target category. t The loss in reducing the similarity between the target class and the non-target class;

[0053] In the process of minimizing the loss function, Z t will increase accordingly, and Z c It will reduce and improve the model's ability to identify the target category. In order to avoid the change of logits values ​​of all categories affecting the ability of the target category to generate the dominant features of the image, the logits value of the target category is mainly focused on during the parameter update process, while the logits values ​​of other categories are limited to a lower value. To achieve this goal, only the logits value of the target category is actively increased during the optimization process, and the gradient clipping strategy is used to limit the growth of the logits value of the non-target category.

[0054] S3. Generation of poisoned images: Given an original image S from the source category, the generated perturbation r and the binary mask m, where the perturbation position is marked as 1 and the rest of the positions are marked as 0, the poisoned image obtained by the attacker adding the perturbation to the original image through formula (3) is

[0055]

[0056] In the formula, S i is the i-th original image, is the i-th poisoned image.

[0057] A more practical and effective poisoning attack method is proposed to achieve the following goals: first, images of the same category in the poisoned dataset should have similar features; second, there should be obvious feature differences between different categories to facilitate the learning of the deep neural network model; finally, the poisoned deep neural network model should classify images of the same category in the poisoned dataset and the source dataset into different categories.

[0058] For image classification problems, the cross entropy loss function is usually used, which can effectively measure the difference between the model prediction results and the true labels. In this paper, it is used as the loss function L for generating poisoned data:

[0059]

[0060] Where N batch represents the batch size; y represents the label corresponding to the original image category; T represents the transpose of the matrix; h(x) is the distribution function of the prediction result.

[0061] S4. Optimization of poisoned images: During the optimization process, the constraints in formula (5) are used to ensure that the poisoned image is as close as possible to the target category image at the feature level, making it easier for the model to misclassify the poisoned image as the target category during the classification process. At the same time, the poisoned image is also optimized at the pixel level to make it as similar as possible to the source category image to maintain the concealment of the poisoned image. In order to measure the degree of closeness between the poisoned image and the target category image at the feature level, the Euclidean distance between the two in the feature space is calculated. Under the condition that the pixel level satisfies the constraints in formula (5), the distance in the feature space is minimized as much as possible to ensure that the poisoned image is close enough to the target image at the feature level to achieve the effectiveness of the poisoning attack.

[0062]

[0063] Where f() represents the intermediate layer features extracted by the deep learning model, which is trained on the poisoning dataset; the similarity coefficient ε represents a small value to ensure that the optimized poisoning image There is no obvious difference between the original image S and the poisoned image S while retaining the poisoned label; the argmin function is used to generate the poisoned image when the features of the poisoned image are closest to the features of the target image; T0 represents the target image category; st. represents the conditions that need to be met in the minimization process; the PGD algorithm is used to optimize formula (5) through iterative training to ensure that the added perturbation satisfies the constraints in the formula.

[0064] S5. Specific attack process: 1. Train a deep learning model on a clean target category dataset. The model acts as a feature extractor to extract the dominant features of the image.

[0065] 2. Generate unique dominant features for different categories in the target category dataset and add them as perturbations to the original images of the corresponding source category dataset.

[0066] 3. Generate the poisoned image data required for the poisoning attack according to the poisoned image generation algorithm, that is, the non-learnable examples, and add the poisoned image data to the source category dataset to obtain the poisoned dataset.

[0067] 4. Train the deep learning model on the poisoned dataset and use the original images as the test dataset for testing. The final test results are used as the basis for evaluating whether the poisoning attack is effective. The specific implementation process is as follows: Figure 2 shown.

[0068] Step 6: Model evaluation and optimization: Use the poisoned images generated above as training data sets to train the victim model, observe the accuracy of the model trained on the poisoned data set, and use the test accuracy as the evaluation indicator.

[0069] 1: Tested on two public datasets commonly used in the field of poisoning attacks (CIFAR-100 and ImageNet-100).

[0070] 2: When evaluating the attack effects on the CIFAR-100 and ImageNet-100 datasets, 10 pairs of image samples of different categories were carefully selected as benchmarks. In order to ensure the uniformity of the data and the efficiency of model training, data standardization was introduced, that is, the RGB channel values ​​of each image were scaled to the range of [0,1]. This not only helps the model learn image features more effectively, but also ensures the numerical consistency of different images, providing standard input data for subsequent attack evaluation.

[0071] 3: In terms of model optimization, the PGD algorithm is used for both the CIFAR-100 and ImageNet-100 datasets. Its excellent performance is particularly significant when processing large-scale datasets. The similarity coefficient ∈ is set to 0.05 and 0.02 for the CIFAR-100 and ImageNet-100 datasets respectively; in order to accelerate the convergence of the model and reduce oscillations during training, the momentum parameter (momentum) is set to 0.9. In addition, in order to prevent the model from overfitting, the weight decay (weight_decay) term is introduced and set to 0.0005. In terms of the choice of loss function, the cross entropy loss function is used.

[0072] 4: Evaluate attack effectiveness: When evaluating the attack effectiveness and capability of the attack method, test accuracy is used as the evaluation indicator. When the test accuracy is close to the level of random guessing, it indicates that the knowledge extracted by the model from the training data is very limited, thus highlighting the effectiveness of the attack method. The specific calculation method is as follows:

[0073]

[0074] Among them, TP represents the true positive rate, FN represents the false negative rate, FP represents the false positive rate, and TN represents the true negative rate.

[0075] 5: Evaluate the stealth of the attack: When evaluating the stealth of the attack method, the structural similarity metric (SSIM) is used as a key indicator. Structural similarity is an indicator used to measure the similarity between images. The larger the SSIM value, the more similar the poisoned image is to the original image, that is, the better its stealth. The upper limit of the SSIM value is 1. Usually, an SSIM index between 0.98 and 1 indicates high similarity, between 0.96 and 0.98 indicates medium similarity, and below 0.96 indicates low similarity. The specific calculation method is as follows:

[0076]

[0077] Among them, S represents the original image, represents the poisoned image after adding disturbance, They represent brightness distortion, contrast distortion, and structural distortion respectively. SSIM uses these three key factors to measure the distortion between images.

[0078] 6: To generate poisoned images, 100 poisoned images were generated for the respective categories of the CIFAR-100 and ImageNet-100 datasets using the ResNet-34 model and the VGG-19 model as feature extractors, respectively. These images are visually consistent with the original images, but specific perturbations are introduced at the feature level, aiming to mislead the model into making incorrect predictions during classification. Subsequently, the generated poisoned images are randomly inserted into the source category dataset, replacing the same number of original images, to construct the poisoned dataset.

[0079] Table 1 is a table of parameters for generating poisoned image models for two sets of data:

[0080] Table 1

[0081]

[0082] 7: In order to evaluate the effect of poisoning attacks, VGG-16 was selected

[22] 、InceptionV4

[23] 、ResNet-50

[21] and DenseNet-121

[24] Four different model architectures. By training these models on the poisoned dataset and the source category dataset, and comparing their performance on the test set, the impact of poisoning attacks on model performance is evaluated. In the evaluation experiment, the PGD optimization algorithm is used to optimize the model, the momentum coefficient is set to 0.9, the weight decay is 0.05, the training round is 200 rounds, the batch size is 128, the initial learning rate is set to 0.1, and the learning rate is decayed by 0.1 times at the 100th and 150th rounds respectively.

[0083] The present invention also provides an image protection system based on a poisoning attack strategy, including a disturbance generation module for extracting dominant image features of different categories in a target category data set; there is a dominant feature in the image features, which mainly determines the classification result of the image, while other factors behave more like noise in the classification process. Due to the existence of such features, this paper uses the feature as a disturbance and introduces it into other different categories of images to create poisoned data that can affect the classification decision, in the hope of achieving the effect of the poisoning attack.

[0084] The poisoned image generation module is used to add the dominant image features of different categories as perturbations to some original images in the source category dataset to obtain poisoned images. For large datasets, directly adding perturbations to all data is not only time-consuming and labor-intensive, but may also reduce the attack efficiency. In order to increase the influence of poisoned images in the dataset, in each iteration, a portion of the original images is randomly selected and perturbations are added, and then these poisoned images are assigned to the closest target category at the feature space level.

[0085] The victim model training module is used to train the deep learning model for poisoning attacks using the poisoned data set, so as to poison the model in one go.

[0086] The experimental result evaluation module is used to verify the deep learning model after the poisoning attack using the unpoisoned source category dataset, evaluate it using the test accuracy, and observe the interference effect of the generated poisoned image on the model.

[0087] This implementation case is divided into a training phase and a testing phase. In the training phase, poisoning attacks are performed on existing deep learning models by using poisoned images as training data for the model. In the testing phase, the model after the poisoning attack is used to classify the source category data set, and its classification accuracy on the source category data set is observed to test the effectiveness of the poisoning attack. The poisoned image and the original image are compared through the SSIM algorithm to observe the concealment of the poisoning attack.

[0088] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A method for protecting an image from poisoning attacks, characterized in that: The following steps are involved: Acquire a target category data set, wherein the target category data set includes several groups of classified target image data; Extract the dominant image features of different categories in the target category dataset; The dominant image features of different categories are used as disturbances and added to part of the original images in the source category dataset to obtain poisoned images, wherein the source category dataset includes the original image data; The poisoned images are randomly inserted into the source category dataset, replacing the same number of original images to obtain the poisoned dataset; Train the deep learning model for poisoning attacks based on the poisoned dataset, and use the unpoisoned source category dataset for model validation; Determine whether the poisoning attack is effective based on the model verification results.

2. The image protection method for preventing poisoning attacks according to claim 1, characterized in that: The poisoned image is visually consistent with the corresponding original image, and disturbance is introduced at the feature level; the deep learning model to be poisoned is defined as the victim model, and the disturbance is used as the decisive feature of the victim model classification to make the victim model output the poisoned image and the corresponding original image as different categories.

3. The image protection method for preventing poisoning attacks according to claim 1, characterized in that: The generation process of poisoned images is: Given an original image S in a source category dataset, the generated perturbation r and a binary mask m, where the perturbation position is marked as 1 and the rest of the positions are marked as 0, the perturbation is added to the original image using the following formula to obtain the poisoned image; The formula is: In the formula, S i is the i-th original image, is the i-th poisoned image.

4. The image protection method for preventing poisoning attacks according to claim 1, characterized in that: Also included is constraining the perturbation at the pixel level and the feature level; The constraints at the pixel level are: limiting the difference between the pixel values ​​of the poisoned image and the original image by a minimum value; The constraint at the feature level is: optimize the features of the poisoned image so that it is always projected into the feature domain of the target image.

5. The image protection method for preventing poisoning attacks according to claim 4, characterized in that: Calculate the Euclidean distance between the poisoned image and the target category image in the feature space, and minimize the distance in the feature space while ensuring that the pixel level satisfies the constraints in the following formula, to ensure that the poisoned image is close to the target category image at the feature level; The formula is: Where f() represents the intermediate layer features extracted by the deep learning model, which is trained on the poisoning dataset; the similarity coefficient ε represents a small value to ensure that the optimized poisoning image There is no obvious difference between the original image S and the poisoned image S under the premise of retaining the poisoned label; the argmin function is used to take the poisoned image generated when the features of the poisoned image are closest to the features of the target image; T0 represents the target image category; st. represents the conditions that need to be met in the minimization process; The above formula is optimized based on iterative training of the PGD algorithm to ensure that the added disturbance satisfies the constraints in the formula.

6. The image protection method for preventing poisoning attacks according to claim 1, characterized in that: Use the ResNet-34 model and\or the VGG-19 model as the extractor of dominant image features.

7. The image protection method for preventing poisoning attacks according to claim 1, characterized in that: In the model verification phase, the victim model after the poisoning attack is used to classify the source category dataset and observe its classification accuracy on the source category dataset to test the effectiveness of the poisoning attack. The poisoned image and the original image are compared through the SSIM algorithm to observe the concealment of the poisoning attack.

Images