Black box face classification model inversion attack method and device, equipment and storage medium

Abstract

The invention discloses a black box face classification model inversion attack method, device and equipment and a storage medium, and belongs to the technical field of image recognition, and the method comprises the steps: employing a StyleGAN to generate a plurality of first face images; obtaining the probability of each first face image output by the black box face classification model; training a substitution model based on the probability of each first face image and the first code; attacking the substitution model to obtain a first attack result; the first attack result serves as an initialization point of a CMA-ES improved black box search algorithm, the black box face classification model is attacked, a second attack result is obtained, and the second attack result comprises a plurality of third codes in the w space of the StyleGAN; and adopting the StyleGAN to generate a face image corresponding to each third code. According to the method, the query frequency in the black box face classification model inversion attack process can be reduced, and guidance is provided for the safety of the black box face classification model.

Description

Technical Field

[0001] The present disclosure relates to the field of image recognition technology, and in particular to a method, device, equipment and storage medium for inversion attack on a black box face classification model. Background Art

[0002] A black-box face classification model is a machine learning model that is used to classify an input face image into predefined categories, such as identifying an identity or detecting emotions. In a black-box setting, the attacker knows nothing about the internal structure, parameters, and training data of the model and can only interact by providing input and observing the output. An inversion attack is an attack method in which the attacker uses black-box or gray-box access rights to infer the internal structure of the model or reconstruct the training data of the model by querying a large number of input-output pairs. The attacker comes from the client. Its purpose is to infer model information, understand the behavior and decision rules of the model, obtain privacy data, and infer sensitive information in the training data set. In this way, it can deceive or destroy. By studying the inversion attack method, it is possible to evaluate and study the security, adversarial resistance, fairness, and optimization degree of the black-box face classification model in turn, thereby optimizing the black-box face classification model.

[0003] In the related art, the inversion attack method of the black-box face classification model includes: querying the input and output of the black-box face classification model multiple times and estimating the gradient. When the number of queries is large enough, the estimated gradient is close to the actual gradient of the black-box face classification model, thereby achieving the attack on the black-box face classification model.

[0004] However, this type of inversion attack method often requires multiple queries to the black box face classification model. Each query consumes a certain amount of computing resources. Too many queries will lead to a waste of resources. Summary of the invention

[0005] The present disclosure provides a method, device, equipment and storage medium for inversion attack of a black box face classification model, which can reduce the number of queries in the inversion attack process of the black box face classification model, thereby providing guidance for the security of the black box face classification model. The technical solution includes at least the following solutions: In a first aspect, a method for inversion attack on a black-box face classification model is provided, comprising: using a style-based generative adversarial network StyleGAN to generate multiple first face images, each of which includes a first code in the w space of the StyleGAN; inputting the multiple first face images into the black-box face classification model to obtain the probability of each first face image output by the black-box face classification model; training a replacement model based on the probability and the first code of each first face image; attacking the replacement model to obtain a first attack result, which includes multiple second codes in the w space of the StyleGAN; using the first attack result as an initialization point of a black-box search algorithm improved based on a covariance matrix adaptive evolution strategy CMA-ES, and using the black-box search algorithm improved based on CMA-ES to attack the black-box face classification model to obtain a last generation population, which includes multiple third codes in the w space of the StyleGAN; using the StyleGAN to generate a face image corresponding to each of the third codes to determine a second attack result obtained by attacking the black-box face classification model.

[0006] Optionally, the use of the improved black-box search algorithm based on CMA-ES to attack the black-box face classification model includes: obtaining the fitness value of each individual in the population of the kth iteration, the fitness value of each individual is determined based on the probability output by the StyleGAN and the black-box face classification model; based on the fitness value of each individual in the population of the kth iteration, performing multiple recombination and mutation on the population of the kth iteration to obtain multiple new individuals, the multiple new individuals are the population of the k+1th iteration, any recombination and mutation includes generating a new individual through linear combination and random perturbation, the linear combination is used to indicate that two individuals with fitness values ​​in the top p% in the population of the kth iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix in the kth iteration; based on the fitness value of each individual in the population of the k+1th iteration, updating the first covariance matrix in the kth iteration to complete the kth iteration; wherein k is a positive integer.

[0007] Optionally, in the kth iteration, the following formula is used to implement the generation of a new individual through linear combination and random perturbation:

[0008] in, is a new individual generated in the kth iteration, , and is a hyperparameter, and are two different individuals whose fitness values ​​are in the top p% in the population of the kth iteration, is the random disturbance, used to indicate the first covariance matrix in the kth iteration The normal distribution space of ; The fitness value of each individual in the population based on the k+1th iteration is implemented by using the following formula to update the first covariance matrix:

[0009] in, is the first covariance matrix in the updated k-th iteration, used to indicate the first covariance matrix in the k+1-th iteration, is the learning rate parameter, is the jth individual in the population of the k+1th iteration, j is an integer, the value range of j is 1 to n, n is the number of individuals in the population of the k+1th iteration, is the weight of the j-th individual, is a mean vector, representing the center position of the population at the k+1th iteration.

[0010] Optionally, the training of the replacement model based on the probability and the first code of each of the first facial images includes: pre-training the replacement model using the first facial data set; training the linear layer and the fully connected layer of the pre-trained replacement model using the probabilities and the first codes of the multiple first facial images; in the process of training the linear layer and the fully connected layer of the replacement model, using a first loss function to calculate the first loss of each facial image; using a loss reweighting method to weight the first loss of each facial image to obtain a second loss for each facial image; wherein the first loss function is determined based on the cross entropy loss and the KL divergence.

[0011] Optionally, the first loss function is expressed by the following formula:

[0012] in, is the first loss of the i-th first face image, is the cross entropy loss of the i-th first face image, is the KL divergence of the i-th first face image, is the weight of the cross entropy loss, is the weight of KL divergence, i is an integer, and the value range of i is 1 to N.

[0013] Optionally, before using the style-based generative adversarial network StyleGAN to generate multiple first face images, the method also includes: using a second face data set to pre-train StyleGAN, the second face data set is different from the first face data set; and generating multiple first face images based on the pre-trained StyleGAN.

[0014] In a second aspect, a black-box face classification model inversion attack device is also provided, including: a first generation module, used to generate multiple first face images using a style-based generative adversarial network StyleGAN, each of the first face images includes a first code in the w space of the StyleGAN; an acquisition module, used to input the multiple first face images into the black-box face classification model to obtain the probability of each first face image output by the black-box face classification model; a training module, used to train a replacement model based on the probability and first code of each first face image; a first attack module, used to attack the replacement model to obtain a first attack result, the The first attack result includes multiple second codes in the w space of the StyleGAN; the second attack module is used to use the first attack result as the initialization point of the black box search algorithm improved based on the covariance matrix adaptive evolution strategy CMA-ES, and use the black box search algorithm improved based on CMA-ES to attack the black box face classification model to obtain the last generation population, and the last generation population includes multiple third codes in the w space of the StyleGAN; the second generation module is used to use the StyleGAN to generate a face image corresponding to each of the third codes to determine the second attack result obtained by attacking the black box face classification model.

[0015] Optionally, the second attack module is also used to obtain the fitness value of each individual in the population of the kth iteration, and the fitness value of each individual is determined based on the probability output by the StyleGAN and the black box face classification model; based on the fitness value of each individual in the population of the kth iteration, the population of the kth iteration is recombined and mutated multiple times to obtain multiple new individuals, and the multiple new individuals are the population of the k+1th iteration, and any recombination and mutation includes generating a new individual through linear combination and random perturbation, and the linear combination is used to indicate that two individuals with fitness values ​​in the top p% in the population of the kth iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix in the kth iteration; based on the fitness value of each individual in the population of the k+1th iteration, the first covariance matrix in the kth iteration is updated to complete the kth iteration; wherein k is a positive integer.

[0016] Optionally, the substitution model is a white box model for face classification, the substitution model includes a feature extractor and a classifier connected in sequence, the classifier includes a linear layer and a fully connected layer, and the training module is also used to pre-train the substitution model using a first face data set; use the probabilities and first encodings of the multiple first face images to train the linear layer and the fully connected layer of the pre-trained substitution model; in the process of training the linear layer and the fully connected layer of the substitution model, use a first loss function to calculate the first loss of each face image; use a loss reweighting method to weight the first loss of each face image to obtain a second loss for each face image; wherein, the first loss function is determined based on cross entropy loss and KL divergence.

[0017] Optionally, the device also includes: a pre-training module, which is used to pre-train StyleGAN using a second face data set, where the second face data set is different from the first face data set; and generate multiple first face images based on the pre-trained StyleGAN.

[0018] In a third aspect, a computer device is also provided, comprising: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor, thereby executing the black box face classification model inversion attack method described in the above embodiment.

[0019] In a fourth aspect, a computer-readable storage medium is also provided, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor, thereby executing the black-box face classification model inversion attack method described in the above embodiment.

[0020] In a fifth aspect, a computer program product is provided, comprising a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the method described in the first aspect is implemented.

[0021] The beneficial effects brought by the technical solution provided by the embodiments of the present disclosure include at least: In the disclosed embodiment, StyleGAN is used to generate multiple first face images, the probability of each first face image output by the black box face classification model is obtained, and the substitution model is trained based on the probability of each first face image and the first code. The substitution model is attacked to obtain a first attack result, and the first attack result is used as the initialization point of the black box search algorithm improved based on CMA-ES, and the black box face classification model is attacked using the black box search algorithm improved based on CMA-ES to obtain the last generation population, and StyleGAN is used to generate the face image corresponding to each third code to determine the second attack result obtained by attacking the black box face classification model. Since the substitution model can simulate the black box face classification model to a certain extent, there is also a certain similarity between the first attack result obtained by attacking the substitution model and the second attack result finally obtained. The first attack result is used as the initialization point for attacking the black-box face classification model based on the improved black-box search algorithm based on CMA-ES. Compared with the randomly generated initialization point, this initialization point is closer to the second attack result. Therefore, in subsequent attacks, the number of visits to the black-box face classification model can be effectively reduced, thereby providing guidance for the security of the black-box face classification model. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 A flowchart of a black box face classification model inversion attack method provided by an exemplary embodiment of the present disclosure is shown; Figure 2 A flowchart of a black box face classification model inversion attack method provided by another exemplary embodiment of the present disclosure is shown; Figure 3 This is a flowchart of the improved black box search algorithm based on CMA-ES; Figure 4 The pictures generated by the generators in different attack methods when the generator is trained with the CelebA dataset; Figure 5 The pictures generated by the generators in different attack methods when the generator is trained with the FFHQ dataset; Figure 6 A schematic diagram of the structure of a black box face classification model inversion attack device provided by an exemplary embodiment of the present disclosure is shown; Figure 7 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] Unless otherwise defined, the technical or scientific terms used herein shall have the usual meanings understood by persons of ordinary skill in the field to which the present disclosure belongs. The words "first", "second", "third" and similar words used in the patent application specification and claims of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "one" do not indicate a quantitative limitation, but rather indicate the presence of at least one. Words such as "include" or "comprise" and similar words mean that the elements or objects appearing before "include" or "comprises" cover the elements or objects listed after "include" or "comprises" and their equivalents, and do not exclude other elements or objects.

[0025] In order to make the objectives, technical solutions and advantages of the present disclosure more clear, the embodiments of the present disclosure will be further described in detail below with reference to the accompanying drawings.

[0026] Figure 1 A flowchart of a black box face classification model inversion attack method provided by an exemplary embodiment of the present disclosure is shown, and the method can be executed by a computer device. Figure 1 , the method comprising: In step 101, StyleGAN is used to generate a plurality of first face images.

[0027] Each first face image includes a first encoding in the w space of StyleGAN.

[0028] StyleGAN (Style-based generator architecture for GenerativeAdversarial Networks) is a generative adversarial network architecture used to generate realistic images. It is an extension and improvement of the traditional GAN ​​(Generative Adversarial Networks) model. Compared with the traditional GAN ​​model, one of the main improvements of StyleGAN is that it can better control various aspects of the generated image, such as the resolution, brightness, details, etc. of the image. This control is achieved by introducing a new "style" vector in the generative network, hence the name "StyleGAN". A major feature of StyleGAN is its ability to generate realistic, high-resolution images that are difficult to distinguish from real photos even in details. Therefore, in the present disclosed embodiment, StyleGAN is used to generate multiple first face images.

[0029] Optionally, multiple latent space encodings are randomly generated from the latent space of StyleGAN to achieve the generation of multiple first face images using StyleGAN. Here, the latent space of StyleGAN includes z space and w space. In the embodiment of the present disclosure, the encoding of the w space is selected to achieve the generation of the first face image.

[0030] In StyleGAN, the z space is converted into the w space through a certain number of fully connected layer network structures. The features in the z space are severely entangled, and the feature encoding decoupling characteristics in the w space are better. Therefore, in the embodiment of the present disclosure, the encoding in the w space with better decoupling characteristics is selected to generate a face image. The encoding in the w space can obtain a high-quality image determined by the encoding after a series of structures and random noise.

[0031] In step 102, a plurality of first face images are input into a black-box face classification model to obtain a probability of each first face image output by the black-box face classification model.

[0032] After an image is input into the black-box face classification model, assuming that there are M categories in the black-box face classification model, the black-box face classification model will obtain M probabilities for the image, and these M probabilities are the probabilities of the image output by the black-box face classification model. The probability of each first face image output by the black-box face classification model is equivalent to the soft label logits of the first face image during the training process.

[0033] Exemplarily, the multiple first face images and the soft label of each first face image can be expressed as ,in, represents the i-th first face image, It represents the soft label of the i-th first face image, that is, the probability output by the black-box face classification model after the i-th first face image is input into the black-box face classification model. i is an integer, and the value range of i is 1 to N.

[0034] Optionally, before executing step 103, the method further includes: performing data enhancement on the multiple first face data. Data enhancement includes cropping, rotation, flipping, Mixup operations, etc. Through data enhancement, it is possible to increase the diversity of the first face image and reduce the overfitting generated in the process of training the replacement model. Among them, Mixup is a data enhancement technology, which is mainly used to improve the generalization ability of deep learning models. It generates new training samples by linearly interpolating the input data and labels during the training process. Specifically, Mixup generates new samples and labels by performing weighted averaging between two training samples, thereby increasing the diversity of training data and reducing the overfitting of the model to the training data.

[0035] In step 103, a substitution model is trained based on the probability and the first encoding of each first face image.

[0036] In step 104, the alternative model is attacked to obtain a first attack result.

[0037] The first attack result includes multiple second encodings in the w space of StyleGAN.

[0038] In step 105, the first attack result is used as the initialization point of the black box search algorithm improved based on CMA-ES, and the black box search algorithm improved based on CMA-ES is used to attack the black box face classification model to obtain the last generation population.

[0039] The final population generation includes multiple third encodings in the w-space of StyleGAN.

[0040] The basic idea of ​​CMA-ES (Covariance Matrix Adaptation-Evolutionary Strategies) is to imitate the principle of biological evolution and assume that no matter what changes occur in the genes, the resulting solution always follows a Gaussian distribution with zero mean and a certain variance. In the disclosed embodiment, CMA-ES is improved, and a black box search algorithm based on the improvement of CMA-ES is used to attack the black box face classification model.

[0041] In step 106, StyleGAN is used to generate a facial image corresponding to each third code to determine a second attack result obtained by attacking the black box face classification model.

[0042] Optionally, step 106 includes selecting the third codes based on the facial images corresponding to each third code, and the facial images of the third codes after selection are the second attack results obtained by attacking the black box face classification model.

[0043] Here, the essence of the black-box face classification model is a face classification model trained on a private data set, and its classification results can reflect the facial features in the private data set to a certain extent. That is, the face image corresponding to the third encoding selected in the embodiment of the present disclosure can reflect the facial features in the private data set to a certain extent, which is equivalent to indirectly obtaining the facial features in the private data set, thereby realizing the inversion attack on the black-box face classification model.

[0044] In the disclosed embodiment, StyleGAN is used to generate multiple first face images, the probability of each first face image output by the black box face classification model is obtained, and the substitution model is trained based on the probability of each first face image and the first code. The substitution model is attacked to obtain a first attack result, and the first attack result is used as the initialization point of the black box search algorithm improved based on CMA-ES, and the black box face classification model is attacked using the black box search algorithm improved based on CMA-ES to obtain the last generation population, and StyleGAN is used to generate the face image corresponding to each third code to determine the second attack result obtained by attacking the black box face classification model. Since the substitution model can simulate the black box face classification model to a certain extent, there is also a certain similarity between the first attack result obtained by attacking the substitution model and the second attack result finally obtained. The first attack result is used as the initialization point for attacking the black-box face classification model based on the improved black-box search algorithm based on CMA-ES. Compared with the randomly generated initialization point, this initialization point is closer to the second attack result. Therefore, in subsequent attacks, the number of visits to the black-box face classification model can be effectively reduced, thereby providing guidance for the security of the black-box face classification model.

[0045] Figure 2 A flowchart of a black box face classification model inversion attack method provided by another exemplary embodiment of the present disclosure is shown. Figure 2 , the method comprising: In step 201, StyleGAN is pre-trained using a second face dataset.

[0046] In the disclosed embodiment, the second face dataset may be any public dataset, and the private dataset used to train the black box face classification model is a non-public dataset, so the second face dataset and the private dataset are different.

[0047] In step 202, a plurality of first face images are generated using the pre-trained StyleGAN.

[0048] Each first face image includes a first encoding in the w space of StyleGAN.

[0049] In step 203, a plurality of first face images are input into a black-box face classification model to obtain a probability of each first face image output by the black-box face classification model.

[0050] The relevant contents of steps 202-203 refer to the aforementioned steps 101-102, and detailed description is omitted here.

[0051] In step 204, a substitution model is trained based on the probability and the first encoding of each first face image.

[0052] In order to make the best use of the information obtained from limited access, the present disclosure adopts the method of training the substitution model. Although the training of the substitution model will bring a certain number of accesses, experimental verification shows that the benefits of training the substitution model far outweigh the cost of the number of accesses.

[0053] Optionally, the substitute model is a white box model for face classification, the substitute model includes a feature extractor and a classifier, and the classifier includes a linear layer and a fully connected layer. In this case, step 202 includes the following steps ad.

[0054] Step a: pre-training the replacement model using the first face dataset.

[0055] The first face dataset is different from the second face dataset.

[0056] In the disclosed embodiment, the first face dataset may be any public dataset, and the private dataset used to train the black box face classification model is a non-public dataset, so the first face dataset and the private dataset are different.

[0057] Through pre-training, the replacement model has preliminary face classification capabilities.

[0058] Step b: using the probabilities and first codes of the plurality of first face images, training the linear layer and the fully connected layer of the pre-trained substitution model.

[0059] The essence of step b is to use multiple first face images and the soft label of each first face image to fine-tune the linear layer and the fully connected layer of the pre-trained substitution model.

[0060] When training the replacement model, fine-tune the pre-trained replacement model based on step a, freeze the previous feature extractor and some network layers, and only train the last linear layer and the fully connected layer. The advantage of this is that the pre-trained face feature extractor can be effectively used when the amount of training data is small, thereby reducing the training of models unrelated to classification. Since the pre-trained model has learned many features, fine-tuning usually converges faster than training the model from scratch.

[0061] Step c: in the process of training the linear layer and the fully connected layer of the substitution model, a first loss function is used to calculate the first loss of each face image.

[0062] In the disclosed embodiment, the first loss function is determined based on the cross entropy loss and the KL divergence.

[0063] Optionally, the first loss function is expressed using formula (1).

[0064] (1) In formula (1), is the first loss of the i-th first face image, is the cross entropy loss of the i-th first face image, is the KL divergence of the i-th first face image. is the weight of the cross entropy loss, is the weight of KL divergence, and It is a hyperparameter that is set empirically.

[0065] There are many methods for calculating cross entropy loss and KL divergence in related technologies, so detailed description is omitted here.

[0066] By weighting the cross entropy loss and KL divergence in the first loss function, the generalization ability and accuracy of the surrogate model can be improved.

[0067] Step d: Use the loss reweighting method to weight the first loss of each face image to obtain the second loss of each face image.

[0068] Loss reweighting improves the performance of the model in transfer learning of different distribution data sets by adjusting the loss values ​​of different samples or categories. When training deep learning models, some samples or categories have low learning efficiency and are difficult to learn during the learning process, resulting in poor performance of the model for these samples or categories. Through reweighting, the model can pay more attention to these "difficult" samples and improve overall performance.

[0069] In the disclosed embodiment, the loss is re-weighted using the label frequency of the training samples. Here, the training samples are multiple first face images, and the label frequency refers to the proportion of the number of first face images in each category of the multiple first face images in the N first face images.

[0070] For example, a first face image belongs to the mth category of the black box face classification model, and the reweighted weight of the mth category is the proportion of the number of images belonging to the mth category among the multiple first face images in the N first face images.

[0071] When the i-th first face image belongs to the m-th category, the re-weighting process can be expressed by formula (2).

[0072] (2) In formula (2), is the second loss of the i-th first face image, is the reweighted weight of the image of the mth category, ,in is the number of images belonging to the mth category in the multiple first face images, is the number of the first face images. The meanings of other parameters in formula (2) are the same as those in formula (1), and detailed description is omitted here.

[0073] Since the second face dataset is used to pre-train StyleGAN, and the second face dataset is different from the private face dataset, the distribution of the multiple first face images generated by StyleGAN is also different from that of the private face dataset. Using multiple first face images to directly train the replacement model results in poor training results. In the disclosed embodiment, the training effect of the replacement model is improved by combining data enhancement, multiple loss functions (including KL divergence and cross entropy loss), and weighting the first loss with reweighted weights in the process of training the replacement model, so that the replacement model can be closer to the target model when the training data is limited. Compared with directly using multiple first face images to train the replacement model, the training effect obtained by training the replacement model in the disclosed embodiment has doubled.

[0074] After obtaining the second loss of each first face image, the substitution model can be optimized based on the second loss, and the substitution model can be fine-tuned after multiple iterations. The fine-tuned substitution model can simulate the black box model to a certain extent.

[0075] In step 205, the substitute model is attacked to obtain a first attack result.

[0076] The first attack result includes multiple second encodings in the w space of StyleGAN.

[0077] Here, any code in the w space of StyleGAN can generate a unique image by StyleGAN, so multiple second codes also correspond to multiple second face images generated by StyleGAN.

[0078] In the disclosed embodiment, since the substitute model is deployed in the local white box model, the attacker has full access to it, including model parameters, structure, etc., and the locally deployed white box model has no query limit and does not waste query resources. Therefore, any method used to attack the white box or black box can be used to attack the substitute model an unlimited number of times. The disclosed embodiment does not limit the method of attacking the substitute model.

[0079] For example, a gradient-based attack method can be used to attack the substitute model. The attack result obtained when the gradient of the substitute model no longer decreases is the first attack result. Since the substitute model can simulate the black box face classification model to a certain extent, there is a certain similarity between the first attack result and the second attack result obtained by attacking the substitute model.

[0080] The first attack result is used as the initialization point for attacking the black box face classification model in step 206. Compared with the randomly generated initialization point, the first attack result is closer to the second attack result, so the number of accesses can be effectively reduced in subsequent attacks.

[0081] In step 206, the first attack result is used as the initialization point of the black box search algorithm improved based on CMA-ES, and the black box search algorithm improved based on CMA-ES is used to attack the black box face classification model to obtain the last generation population.

[0082] The last generation of population includes multiple third encodings in the w space of StyleGAN; Optionally, before using the improved black box search algorithm based on CMA-ES to attack the black box face classification model, it is necessary to set the hyper parameters of the algorithm and initialize the initialization point. The hyper parameters of the algorithm include the number of iterations, fitness function, etc.

[0083] Here, the initialization point is a plurality of second codes in the w space of StyleGAN, and the plurality of second codes can be encoded into chromosomes according to certain rules (one second code is one solution, so one second code can be encoded into one chromosome), thereby realizing the initialization processing of the initialization point.

[0084] Figure 3 is a flowchart of the improved black box search algorithm based on CMA-ES. Optionally, step 206 includes the following three steps, Figure 3 Step 206 will be described.

[0085] The first step is to obtain the fitness value of each individual in the population of the kth iteration.

[0086] The fitness value of each individual is determined based on the probability output by StyleGAN and the black-box face classification model.

[0087] Here, k is a positive integer. When k is greater than 1, the population of the kth iteration is determined based on the k-1th iteration; when k is equal to 1, the population of the 1st iteration is the multiple second codes in the first attack result.

[0088] In the disclosed embodiment, the probability of the category to which the individual belongs in the probability output by the black box face classification model is used as the fitness function. For example, after an individual generates a picture through a generator (that is, StyleGAN), the picture can be input into the black box face classification model. Assuming that there are M categories in the black box face classification model, the black box face classification model will obtain M probabilities for the picture, and the sum of these M probabilities is 1. The category corresponding to the maximum value of these M probabilities is the category of the image, and the maximum value of the M probabilities is the probability of the category to which the picture belongs, that is, the probability in the category to which the individual belongs, and this probability is the fitness value of the individual.

[0089] For example, there are three categories in the black box face classification model. For a picture corresponding to an individual, the black box face classification model will output three probabilities of 1%, 90% and 9%, which correspond to the probability of the picture being in category 1, the probability of being in category 2 and the probability of being in category 3. The probability of the category to which the individual belongs is 90%, and the picture belongs to category 2, that is, the fitness value of the individual is 90%.

[0090] When obtaining the fitness value of an individual, we can first convert the chromosome code of an individual into the code in the w space of StyleGAN, then use StyleGAN to generate a corresponding image based on the code in the w space, and finally input the image into the black box face classification model. The probability of the category to which the individual belongs in the probability output by the black box face classification model is the fitness value of the individual. This process can be expressed as ,in is the jth individual in the kth iteration The fitness value of Indicates that the jth individual in the kth iteration Input into the generator (the generator is also StyleGAN) to get the jth individual in the kth iteration The corresponding image; is the fitness function, which is also the black box face classification model. Indicates that the jth individual in the kth iteration The corresponding image is input into the black box face classification model to obtain the probability of the category to which the individual belongs.

[0091] In the second step, based on the fitness value of each individual in the population of the kth iteration, the population of the kth iteration is reorganized and mutated multiple times to obtain multiple new individuals.

[0092] The multiple new individuals are the population of the k+1th iteration, and any recombination and mutation includes generating a new individual through linear combination and random perturbation, and the linear combination is used to indicate that the two individuals with fitness values ​​in the top p% in the population of the kth iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix. Among them, the value of p is an empirical value, and the embodiment of the present disclosure does not limit the value of p.

[0093] Before recombination and mutation, the population of the kth iteration needs to be selected to determine the individuals with fitness values ​​in the top p%. This process can be expressed as ,in is the set of individuals with fitness values ​​in the top p% of the population in the kth iteration, is the jth individual in the kth iteration The fitness value of Indicates retaining individuals with fitness values ​​in the top p%.

[0094] Optionally, in the kth iteration, formula (3) is used to generate a new individual through linear combination and random perturbation: (3) In formula (3), is a new individual generated in the kth iteration, , and is a hyperparameter, and its value is determined based on experience. and are two different individuals whose fitness values ​​are in the top p% of the population in the kth iteration, and belong , is a linear combination. is a random perturbation, used to indicate the first covariance matrix in the kth iteration The normal distribution space.

[0095] By repeatedly executing the above formula (3), multiple new individuals can be generated in the kth iteration, and these multiple new individuals are the population in the k+1th iteration.

[0096] When k is greater than 1, the first covariance matrix of the kth iteration is determined based on the k-1th iteration; when k is equal to 1, the first covariance matrix of the 1st iteration is ,in represents the jth individual in the population of the first iteration, j is an integer, the value range of j is 1 to n, n is the number of individuals in the population of the first iteration, is the mean vector of the first iteration, indicating the center position of the population of the first iteration.

[0097] In conventional CMA-ES, a new individual is generated by performing linear combination and random perturbation on all individuals in the population in the kth iteration. The black-box search algorithm based on the improved CMA-ES in the embodiment of the present disclosure is improved on this basis, and only the linear combination and random perturbation of individuals with fitness values ​​in the top p% in the population in the kth iteration are used to generate a new individual, thereby selecting better individuals, optimizing iteration efficiency, and satisfying termination conditions more quickly.

[0098] The third step is to update the first covariance matrix in the kth iteration based on the fitness value of each individual in the population in the k+1th iteration to complete the kth iteration.

[0099] Optionally, formula (4) is used to update the first covariance matrix in the kth iteration based on the fitness value of each individual in the population in the k+1th iteration: (4) In formula (4), is the first covariance matrix in the updated k-th iteration, that is, the first covariance matrix in the k+1-th iteration. is the learning rate parameter, is the jth individual in the population of the k+1th iteration, j is an integer, the value range of j is 1 to n, n is the number of individuals in the population of the k+1th iteration, is the weight of the jth individual, is the mean vector, indicating the center position of the population at the k+1th iteration.

[0100] Repeating the first to third steps above can be repeated for multiple iterations until the termination condition is met (such as reaching the maximum number of iterations or the population converges). After the termination condition is met, the iteration can be stopped to obtain the last generation of population, which includes multiple third codes.

[0101] In step 207, StyleGAN is used to generate a facial image corresponding to each third code to determine a second attack result obtained by attacking the black box face classification model.

[0102] At this time, the population in the last generation can be selected, that is, StyleGAN is used to generate face images corresponding to each third code, and then multiple face images corresponding to the third code are input into the black box face classification model to obtain the fitness value of each individual in the last generation population, and selection is made based on the fitness value of each individual to obtain the selection result. , select the result Including multiple third codes after selection. Selection result The face images corresponding to the multiple third codes selected are the second attack results.

[0103] The facial images corresponding to the selected multiple third codes can reflect the facial features in the private data set to a certain extent, which is equivalent to indirectly obtaining the facial features in the private data set, thereby realizing the inversion attack on the black box face classification model.

[0104] Table 1: Comparison of the accuracy of the baseline method and the method of training the substitution model in the embodiment of the present disclosure.

[0105]

[0106] Table 1 shows the accuracy of the substitute model trained by the method in the embodiment of the present disclosure and the benchmark method on the VGGFace2 dataset when the training dataset size is 5000. The black box face classification model simulated by the substitute model is the inception_resnetv1_vggface2 model trained based on the VGGFace2 dataset, and the pre-trained StyleGAN is pre-trained on the CelebA dataset and the FFHQ dataset, respectively. The benchmark method is to use only KL divergence as the loss to train the substitute model. The method of the embodiment of the present disclosure uses data enhancement, multiple loss functions, loss reweighting and other methods to train the substitute model. The unit of accuracy is %.

[0107] As can be seen from Table 1, a total of four situations are compared: the baseline method and the method in the disclosed embodiment when the StyleGAN trained on the CelebA dataset is trained using model architecture 1, the baseline method and the method in the disclosed embodiment when the StyleGAN trained on the CelebA dataset is trained using model architecture 2, the baseline method and the method in the disclosed embodiment when the StyleGAN trained on the FFHQ dataset is trained using model architecture 1, and the baseline method and the method in the disclosed embodiment when the StyleGAN trained on the FFHQ dataset is trained using model architecture 2.

[0108] It can be seen that in the above four cases, compared with the baseline method, the alternative model trained by the method in the embodiment of the present disclosure has higher Top1 accuracy and Top5 accuracy on model architecture 1 and model architecture 2, with an improvement of nearly doubled.

[0109] Table 2: Comparison of the accuracy of attacking the black-box face classification model using different attack methods when the generator is trained using the CelebA dataset.

[0110]

[0111] Table 3: Comparison of the accuracy of attacking the black-box face classification model using different attack methods when the generator is trained using the FFHQ dataset.

[0112]

[0113] Tables 2 and 3 respectively show the Top1 accuracy and Top5 accuracy on verification model 1 and verification model 2, respectively, when the number of inquiries is 20,000 times, after attacking the black box face classification model resnet50 trained with the VGGFace2 dataset using the Mirror black box attack method, the RLB-MI reinforcement learning black box attack method, and the method in the disclosed embodiment. The unit of accuracy is %.

[0114] Here, the Top1 accuracy in Table 2 and Table 3 is the accuracy of the verified model classified into the target category, and the Top5 accuracy is the accuracy of the target category in the top five highest probability categories classified by the verification model. The target category is the category where the probability output by the black box face classification model belongs. There are many methods for determining the Top1 accuracy and Top5 accuracy in related technologies, so detailed description is omitted here.

[0115] Verification model 1 and verification model 2 are both black-box face classification models trained using the VGGFace2 dataset.

[0116] The experiment attacks the resnet50 model trained with vggface2, and attacks 20 face categories to calculate the attack success rate. The experimental results show that the accuracy of the embodiment of the present disclosure is higher than the attack accuracy of the other two methods under the same configuration (generators trained with celeba and generators trained with the FFHQ dataset attack the resnet50 model) and the same number of queries (20,000 times).

[0117] Figure 4 These are the images generated by the generators in different attack methods when the generator is trained using the CelebA dataset. Figure 5 The pictures generated by the generators in different attack methods when the generator is trained with the FFHQ dataset. It can be seen that the resolution of the face generated by the method in the disclosed embodiment is higher than that of RLB-MI and closer to the real image. This is because the styleGAN generator used generates high-quality faces. Moreover, the degree of feature similarity compared to the original image (that is, the image in the training set of the black box face classification model) is also higher than that of the Mirror black box method and RLB-MI.

[0118] The following are device embodiments of the present application. For details not described in detail in the device embodiments, reference may be made to the above method embodiments.

[0119] Figure 6 FIG. 1 shows a schematic diagram of a black box face classification model inversion attack device provided by an exemplary embodiment of the present disclosure, see FIG. Figure 6 The black box face classification model inversion attack device 600 includes: a first generation module 601, an acquisition module 602, a training module 603, a first attack module 604, a second attack module 605 and a second generation module 606.

[0120] The first generation module 601 is used to generate multiple first face images using a style-based generative adversarial network StyleGAN, each of which includes a first encoding in the w space of StyleGAN.

[0121] The acquisition module 602 is used to input multiple first face images into the black box face classification model to obtain the probability of each first face image output by the black box face classification model.

[0122] The training module 603 is used to train the replacement model based on the probability and the first code of each first face image.

[0123] The first attack module 604 is used to attack the replacement model to obtain a first attack result, and the first attack result includes multiple second codes in the w space of StyleGAN.

[0124] The second attack module 605 is used to use the first attack result as the initialization point of the black box search algorithm improved based on the covariance matrix adaptive evolution strategy CMA-ES, and use the black box search algorithm improved based on CMA-ES to attack the black box face classification model to obtain the last generation population, which includes multiple third encodings in the w space of StyleGAN.

[0125] The second generation module 606 is used to use StyleGAN to generate a facial image corresponding to each third code to determine a second attack result obtained by attacking the black box face classification model.

[0126] Optionally, the second attack module 605 is also used to obtain the fitness value of each individual in the population of the kth iteration, and the fitness value of each individual is determined based on the probability output by StyleGAN and the black box face classification model; based on the fitness value of each individual in the population of the kth iteration, the population of the kth iteration is recombined and mutated multiple times to obtain multiple new individuals, and the multiple new individuals are the population of the k+1th iteration, and any recombination and mutation includes generating a new individual through linear combination and random perturbation, and the linear combination is used to indicate that two individuals with fitness values ​​in the top p% in the population of the kth iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix in the kth iteration; based on the fitness value of each individual in the population of the k+1th iteration, the first covariance matrix in the kth iteration is updated to complete the kth iteration; wherein k is a positive integer.

[0127] Optionally, the substitution model is a white box model for face classification, the substitution model includes a feature extractor and a classifier connected in sequence, the classifier includes a linear layer and a fully connected layer, and the training module 603 is also used to pre-train the substitution model using the first face data set; use the probabilities and first encodings of multiple first face images to train the linear layer and the fully connected layer of the pre-trained substitution model; in the process of training the linear layer and the fully connected layer of the substitution model, use the first loss function to calculate the first loss of each face image; use the loss reweighting method to weight the first loss of each face image to obtain the second loss of each face image; wherein the first loss function is determined based on the cross entropy loss and the KL divergence.

[0128] Optionally, the device also includes: a pre-training module 607, which is used to pre-train StyleGAN using a second face data set, where the second face data set is different from the first face data set; and generate multiple first face images based on the pre-trained StyleGAN.

[0129] It should be noted that when the black-box face classification model inversion attack device provided in the above embodiment performs an inversion attack, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the black-box face classification model inversion attack device provided in the above embodiment and the black-box face classification model inversion attack method embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0130] The division of modules in the embodiments of the present disclosure is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present disclosure may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0131] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a terminal device (which can be a personal computer, mobile phone, or communication device, etc.) or a processor (processor) to execute all or part of the steps of the method of each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., various media that can store program codes.

[0132] Figure 7 Schematic diagram of the structure of the computer device provided by the embodiment of the present disclosure. Figure 7 As shown, the computer device 700 includes: a processor 701 and a memory 702 .

[0133] The processor 701 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 701 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 701 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 701 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 701 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0134] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 702 is used to store at least one instruction, which is used to be executed by the processor 701 to implement the black box face classification model inversion attack method provided in the embodiments of the present disclosure.

[0135] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation on the computer device 700, and the computer device 700 may include more or less components than those shown in the figure, or combine some components, or adopt a different arrangement of components.

[0136] The embodiments of the present disclosure also provide a non-temporary computer-readable storage medium. When the instructions in the storage medium are executed by a processor of a computer device, the computer device is enabled to execute the black-box face classification model inversion attack method provided in the embodiments of the present disclosure.

[0137] The embodiments of the present disclosure also provide a computer program product, including a computer program / instruction, which, when executed by a processor, implements the black-box face classification model inversion attack method provided in the embodiments of the present disclosure.

[0138] The above description is only an optional embodiment of the present disclosure and is not intended to limit the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A black box face classification model inversion attack method, characterized in that: The method comprises: Generate a plurality of first face images using a style-based generative adversarial network StyleGAN, each of the first face images including a first encoding in a w space of the StyleGAN; Inputting the plurality of first face images into a black box face classification model to obtain a probability of each of the first face images output by the black box face classification model; training a substitution model based on the probability and the first encoding of each of the first face images; Attacking the replacement model to obtain a first attack result, wherein the first attack result includes a plurality of second encodings in the w space of the StyleGAN; Using the first attack result as an initialization point of a black box search algorithm improved based on a covariance matrix adaptive evolution strategy CMA-ES, and using the black box search algorithm improved based on CMA-ES to attack the black box face classification model to obtain a final generation population, wherein the final generation population includes a plurality of third encodings in the w space of the StyleGAN; The StyleGAN is used to generate a facial image corresponding to each of the third codes to determine a second attack result obtained by attacking the black box face classification model.

2. The method according to claim 1, characterized in that The method of using the improved black box search algorithm based on CMA-ES to attack the black box face classification model includes: Obtaining a fitness value of each individual in the population of the kth iteration, where the fitness value of each individual is determined based on the probability output by the StyleGAN and the black box face classification model; Based on the fitness value of each individual in the population of the k-th iteration, the population of the k-th iteration is recombined and mutated multiple times to obtain multiple new individuals, the multiple new individuals are the population of the k+1-th iteration, any of the recombinations and mutations includes generating a new individual by linear combination and random perturbation, the linear combination is used to indicate that two individuals with fitness values ​​in the top p% in the population of the k-th iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix in the k-th iteration; Based on the fitness value of each individual in the population of the k+1th iteration, updating the first covariance matrix in the kth iteration to complete the kth iteration; Wherein, k is a positive integer.

3. The method according to claim 2, characterized in that In the kth iteration, the following formula is used to realize the generation of a new individual through linear combination and random perturbation: in, is a new individual generated in the kth iteration, , and is a hyperparameter, and are two different individuals whose fitness values ​​are in the top p% in the population of the kth iteration, is the random disturbance, used to indicate the first covariance matrix in the kth iteration The normal distribution space of ; The fitness value of each individual in the population based on the k+1th iteration is implemented by using the following formula to update the first covariance matrix: in, is the first covariance matrix in the updated k-th iteration, used to indicate the first covariance matrix in the k+1-th iteration, is the learning rate parameter, is the jth individual in the population of the k+1th iteration, j is an integer, the value range of j is 1 to n, n is the number of individuals in the population of the k+1th iteration, is the weight of the j-th individual, is a mean vector, representing the center position of the population at the k+1th iteration.

4. The method according to any one of claims 1 to 3, characterized in that: The substitution model is a white box model for face classification, and the substitution model includes a feature extractor and a classifier connected in sequence, and the classifier includes a linear layer and a fully connected layer. The training of the substitution model based on the probability and the first encoding of each of the first face images includes: Pre-training the replacement model using a first face dataset; Using the probabilities and first codes of the plurality of first face images, training the linear layer and the fully connected layer of the pre-trained substitution model; In the process of training the linear layer and the fully connected layer of the substitution model, a first loss function is used to calculate a first loss for each face image; Using the loss reweighting method, the first loss of each face image is weighted to obtain the second loss of each face image; The first loss function is determined based on the cross entropy loss and the KL divergence.

5. The method according to claim 4, characterized in that The first loss function is expressed by the following formula: in, is the first loss of the i-th first face image, is the cross entropy loss of the i-th first face image, is the KL divergence of the i-th first face image, is the weight of the cross entropy loss, is the weight of KL divergence, i is an integer, and the value range of i is 1 to N.

6. The method according to claim 4, characterized in that Before the method uses the style-based generative adversarial network StyleGAN to generate a plurality of first face images, the method further includes: Pre-training StyleGAN using a second face dataset, where the second face dataset is different from the first face dataset; Generate multiple first face images based on the pre-trained StyleGAN.

7. A black box face classification model inversion attack device, characterized in that: The device comprises: A first generation module, configured to generate a plurality of first face images using a style-based generative adversarial network StyleGAN, each of the first face images comprising a first encoding in a w space of the StyleGAN; an acquisition module, configured to input the plurality of first face images into a black box face classification model to obtain a probability of each of the first face images output by the black box face classification model; A training module, configured to train a substitution model based on the probability and the first encoding of each of the first face images; A first attack module, configured to attack the replacement model to obtain a first attack result, wherein the first attack result includes a plurality of second codes in the w space of the StyleGAN; A second attack module is used to use the first attack result as an initialization point of a black box search algorithm improved based on a covariance matrix adaptive evolution strategy CMA-ES, and use the black box search algorithm improved based on CMA-ES to attack the black box face classification model to obtain a final generation population, wherein the final generation population includes multiple third encodings in the w space of the StyleGAN; The second generation module is used to use the StyleGAN to generate a facial image corresponding to each of the third codes to determine a second attack result obtained by attacking the black box face classification model.

8. A computer device, characterized in that: The computer device comprises: a memory and a processor, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one computer program, and the at least one computer program is loaded and executed by a processor to implement the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images