Black box face classification model inversion attack method, device, equipment and storage medium

Abstract

A method, apparatus, device, and storage medium for inverting attacks on black-box face classification models are disclosed, belonging to the field of image recognition technology. The method includes: generating multiple first face images using StyleGAN; obtaining the probability of each first face image output by the black-box face classification model; training a substitution model based on the probability and a first encoding of each first face image; attacking the substitution model to obtain a first attack result; using the first attack result as the initialization point of a CMA-ES improved black-box search algorithm to attack the black-box face classification model to obtain a second attack result, the second attack result including multiple third encodings in the w-space of StyleGAN; and generating a face image corresponding to each third encoding using StyleGAN. This method can reduce the number of queries in the inverting attack process of black-box face classification models, thus providing guidance for the security of black-box face classification models.

Description

Technical Field

[0001] This disclosure relates to the field of image recognition technology, and in particular to a black-box face classification model inversion attack method, apparatus, device and storage medium. Background Technology

[0002] A black-box face classification model is a machine learning model used to classify input facial images into predefined categories, such as for identity recognition or emotion detection. In a black-box setting, attackers have no knowledge of the model's internal structure, parameters, or training data; they can only interact by providing input and observing the output. An inversion attack is an attack method where attackers leverage black-box or gray-box access to infer the model's internal structure or reconstruct its training data by extensively querying input-output pairs. The attacker originates from the client side. Their aim is to infer model information, understand its behavior and decision rules, and obtain private data, including sensitive information in the training dataset, thereby enabling deception or sabotage. By studying inversion attack methods, we can evaluate and research the security, adversarial nature, fairness, and optimization of black-box face classification models, thereby optimizing these models.

[0003] In related technologies, the black-box face classification model inversion attack method includes: querying the black-box face classification model multiple times and estimating the gradient. When the number of queries is large enough, the estimated gradient is close to the actual gradient of the black-box face classification model, thereby achieving the attack on the black-box face classification model.

[0004] However, such inversion attack methods often require multiple queries to the black-box face classification model. Each query consumes a certain amount of computing resources, and too many queries will lead to a waste of resources. Summary of the Invention

[0005] This disclosure provides a method, apparatus, device, and storage medium for inverting black-box face classification models, which can reduce the number of queries during the inverting attack process, thereby providing guidance for the security of black-box face classification models. The technical solution includes at least the following:

[0006] A first aspect provides a method for inverting attacks on a black-box face classification model, comprising: generating multiple first face images using a style-based generative adversarial network (StyleGAN), each first face image including a first encoding in the w-space of the StyleGAN; inputting the multiple first face images into a black-box face classification model to obtain the probability of each first face image output by the black-box face classification model; training a replacement model based on the probability of each first face image and the first encoding; attacking the replacement model to obtain a first attack result, the first attack result including multiple second encodings in the w-space of the StyleGAN; using the first attack result as the initialization point of a black-box search algorithm improved based on the covariance matrix adaptive evolution strategy (CMA-ES), and attacking the black-box face classification model using the CMA-ES-based improved black-box search algorithm to obtain a last-generation population, the last-generation population including multiple third encodings in the w-space of the StyleGAN; and generating a face image corresponding to each third encoding using the StyleGAN to determine a second attack result obtained by attacking the black-box face classification model.

[0007] Optionally, the attack on the black-box face classification model using the CMA-ES-based improved black-box search algorithm includes: obtaining the fitness value of each individual in the population of the k-th iteration, wherein the fitness value of each individual is determined based on the probabilities output by StyleGAN and the black-box face classification model; performing multiple recombinations and mutations on the population of the k-th iteration based on the fitness value of each individual in the population of the k-th iteration to obtain multiple new individuals, wherein the multiple new individuals constitute the population of the (k+1)-th iteration, wherein each recombination and mutation includes generating a new individual through linear combination and random perturbation, wherein the linear combination is used to indicate linear combination of the two individuals with fitness values ​​in the top p% of the population of the k-th iteration, and the random perturbation is determined based on the first covariance matrix in the k-th iteration; updating the first covariance matrix in the k-th iteration based on the fitness value of each individual in the (k+1)-th iteration to complete the k-th iteration; wherein k is a positive integer.

[0008] Optionally, in the k-th iteration, the generation of a new individual through linear combination and random perturbation is achieved using the following formula:

[0009]

[0010] in, For a new individual generated in the k-th iteration, , and For hyperparameters, and Let these be two distinct individuals in the population with fitness values ​​in the top p% during the k-th iteration. The random perturbation is used to indicate the first covariance matrix in the k-th iteration. The space of normal distribution;

[0011] The fitness value of each individual in the population based on the (k+1)th iteration is used to update the first covariance matrix using the following formula:

[0012]

[0013] in, The first covariance matrix in the updated k-th iteration, used to indicate the first covariance matrix in the (k+1)-th iteration. The learning rate parameter, Let j be the j-th individual in the population during the (k+1)-th iteration, where j is an integer ranging from 1 to n, and n is the number of individuals in the population during the (k+1)-th iteration. Let J be the weight of the j-th individual. Let be the mean vector, representing the center position of the population in the (k+1)th iteration.

[0014] Optionally, training the substitution model based on the probability and first encoding of each of the first face images includes: pre-training the substitution model using a first face dataset; training the linear and fully connected layers of the pre-trained substitution model using the probabilities and first encoding of the multiple first face images; calculating the first loss for each face image using a first loss function during the training of the linear and fully connected layers of the substitution model; and weighting the first loss for each face image using a loss reweighting method to obtain a second loss for each face image; wherein the first loss function is determined based on cross-entropy loss and KL divergence.

[0015] Optionally, the first loss function can be represented by the following formula:

[0016]

[0017] in, The first loss is for the i-th first face image. The cross-entropy loss is the value of the i-th first face image. Let KL divergence be the i-th first face image. The weights are the cross-entropy loss values. represents the weight of the KL divergence, where i is an integer ranging from 1 to N.

[0018] Optionally, before generating multiple first face images using the StyleGAN-based generative adversarial network, the method further includes: pre-training the StyleGAN using a second face dataset, which is different from the first face dataset; and generating multiple first face images based on the pre-trained StyleGAN.

[0019] Secondly, a black-box face classification model inversion attack device is also provided, comprising: a first generation module, used to generate multiple first face images using a style-based generative adversarial network (StyleGAN), each first face image including a first encoding in the w-space of the StyleGAN; an acquisition module, used to input the multiple first face images into a black-box face classification model to obtain the probability of each first face image output by the black-box face classification model; a training module, used to train an alternative model based on the probability and the first encoding of each first face image; and a first attack module, used to attack the alternative model to obtain a first attack result. The first attack result includes multiple second codes in the w-space of the StyleGAN; the second attack module is used to take the first attack result as the initialization point of the black-box search algorithm improved by the covariance matrix adaptive evolution strategy CMA-ES, and use the black-box search algorithm improved by CMA-ES to attack the black-box face classification model to obtain the last generation population, the last generation population including multiple third codes in the w-space of the StyleGAN; the second generation module is used to generate a face image corresponding to each third code using the StyleGAN to determine the second attack result obtained by attacking the black-box face classification model.

[0020] Optionally, the second attack module is further configured to obtain the fitness value of each individual in the population of the k-th iteration, wherein the fitness value of each individual is determined based on the probability output by the StyleGAN and the black-box face classification model; based on the fitness value of each individual in the population of the k-th iteration, the population of the k-th iteration is subjected to multiple recombinations and mutations to obtain multiple new individuals, wherein the multiple new individuals constitute the population of the (k+1)-th iteration, wherein any recombination and mutation includes generating a new individual through linear combination and random perturbation, wherein the linear combination is used to indicate that the two individuals with fitness values ​​in the top p% of the population of the k-th iteration are linearly combined, and the random perturbation is determined based on the first covariance matrix in the k-th iteration; based on the fitness value of each individual in the population of the (k+1)-th iteration, the first covariance matrix in the k-th iteration is updated to complete the k-th iteration; wherein k is a positive integer.

[0021] Optionally, the alternative model is a white-box model for face classification, comprising a feature extractor and a classifier connected in sequence, the classifier comprising a linear layer and a fully connected layer, the training module further comprising pre-training the alternative model using a first face dataset; training the linear and fully connected layers of the pre-trained alternative model using the probabilities and first codes of the multiple first face images; calculating a first loss for each face image using a first loss function during the training of the linear and fully connected layers of the alternative model; and weighting the first loss for each face image using a loss reweighting method to obtain a second loss for each face image; wherein the first loss function is determined based on cross-entropy loss and KL divergence.

[0022] Optionally, the device further includes: a pre-training module, which is used to pre-train StyleGAN using a second face dataset, the second face dataset being different from the first face dataset; and to generate multiple images of the first face based on the pre-trained StyleGAN.

[0023] Thirdly, a computer device is also provided, comprising: a memory and a processor, wherein the memory stores at least one computer program, the at least one computer program being loaded and executed by the processor to perform the black-box face classification model inversion attack method described in the above embodiments.

[0024] Fourthly, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to perform the black-box face classification model inversion attack method described in the above embodiments.

[0025] Fifthly, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the method described in the first aspect.

[0026] The beneficial effects of the technical solutions provided in this disclosure include at least the following:

[0027] In this embodiment, multiple first face images are generated using StyleGAN. The probability of each first face image output by the black-box face classification model is obtained. Based on the probability of each first face image and the first encoding, a replacement model is trained. The replacement model is attacked to obtain a first attack result. The first attack result is used as the initialization point of a black-box search algorithm based on CMA-ES. The black-box face classification model is attacked using the black-box search algorithm based on CMA-ES to obtain the last generation population. StyleGAN is then used to generate face images corresponding to each third encoding to determine the second attack result obtained from attacking the black-box face classification model. Since the replacement model can simulate the black-box face classification model to a certain extent, there is a certain similarity between the first attack result obtained from attacking the replacement model and the final second attack result. The first attack result is used as the initialization point for attacking the black-box face classification model using a black-box search algorithm based on CMA-ES. This initialization point is closer to the second attack result than the randomly generated initialization point. Therefore, it can effectively reduce the number of times the black-box face classification model is accessed in subsequent attacks, thus providing guidance for the security of the black-box face classification model. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart illustrating an exemplary embodiment of the present disclosure provides a method for inverting a black-box face classification model;

[0030] Figure 2 A flowchart illustrating a black-box face classification model inversion attack method provided in another exemplary embodiment of this disclosure is shown;

[0031] Figure 3 A flowchart of a black-box search algorithm based on CMA-ES;

[0032] Figure 4 Images generated by generators using different attack methods when the generator is trained on the CelebA dataset;

[0033] Figure 5 Images generated by generators using different attack methods when the generator is trained on the FFHQ dataset;

[0034] Figure 6This illustration shows a schematic diagram of the structure of a black-box face classification model inversion attack device provided in an exemplary embodiment of the present disclosure;

[0035] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. Detailed Implementation

[0036] Unless otherwise defined, the technical or scientific terms used herein shall have the ordinary meaning as understood by one of ordinary skill in the art to which this disclosure pertains. The terms “first,” “second,” “third,” and similar terms used in this patent application specification and claims do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms “an” or “a” and similar terms do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms “comprising” or “including” and similar terms mean that the elements or objects preceding “comprising” or “including” encompass the elements or objects listed following “comprising” or “including” and their equivalents, but do not exclude other elements or objects.

[0037] To make the objectives, technical solutions, and advantages of this disclosure clearer, the embodiments of this disclosure will be described in further detail below with reference to the accompanying drawings.

[0038] Figure 1 A flowchart illustrating a black-box face classification model inversion attack method provided in an exemplary embodiment of this disclosure is shown. This method can be executed by a computer device. See also Figure 1 The method includes:

[0039] In step 101, StyleGAN is used to generate multiple first face images.

[0040] Each first face image includes the first encoding in the w space of StyleGAN.

[0041] StyleGAN (Style-based generator architecture for Generative Adversarial Networks) is a generative adversarial network architecture used to generate realistic images. It is an extension and improvement of the traditional GAN ​​(Generative Adversarial Network) model. One of the main improvements of StyleGAN compared to traditional GAN ​​models is its ability to better control various aspects of the generated image, such as resolution, brightness, and detail. This control is achieved by introducing new "style" vectors into the generator network, hence the name "StyleGAN". A key feature of StyleGAN is its ability to generate realistic, high-resolution images that are difficult to distinguish from real photographs even in terms of detail. Therefore, in this embodiment, StyleGAN is used to generate multiple first face images.

[0042] Optionally, multiple first face images can be generated using StyleGAN by randomly generating multiple latent space codes from the latent space of StyleGAN. Here, the latent space of StyleGAN includes z-space and w-space. In this embodiment of the disclosure, the encoding of w-space is selected to generate the first face images.

[0043] In StyleGAN, the z-space is transformed into the w-space through a certain number of fully connected layers. The features in the z-space are severely entangled, while the feature encoding in the w-space exhibits better decoupling properties. Therefore, in this embodiment, the encoding in the w-space, which has better decoupling properties, is selected to generate face images. The encoding in the w-space, after a series of structural steps and random noise, yields a high-quality image determined by that encoding.

[0044] In step 102, multiple first face images are input into the black-box face classification model to obtain the probability of each first face image output by the black-box face classification model.

[0045] When an image is input into a black-box face classification model, assuming there are M categories, the model will obtain M probabilities for that image. These M probabilities are the probabilities of the image output by the black-box face classification model. The probability of each first face image output by the black-box face classification model is equivalent to the soft label logits of the first face image during training.

[0046] For example, multiple first face images and the soft label of each first face image can be represented as follows: ,in, This represents the i-th image of the first face. This represents the soft label of the i-th first face image, which is the probability output by the black-box face classification model after the i-th first face image is input into it. i is an integer, and the value of i ranges from 1 to N.

[0047] Optionally, before performing step 103, the method further includes: performing data augmentation on multiple first face data sets. Data augmentation includes cropping, rotation, flipping, and mixup operations. Through data augmentation, the diversity of the first face images can be increased, mitigating overfitting during the training of alternative models. Mixup is a data augmentation technique primarily used to improve the generalization ability of deep learning models. It generates new training samples by linearly interpolating the input data and labels during training. Specifically, mixup generates new samples and labels by performing a weighted average between two training samples, thereby increasing the diversity of training data and mitigating overfitting of the model to the training data.

[0048] In step 103, an alternative model is trained based on the probability and first encoding of each first face image.

[0049] In step 104, the alternative model is attacked to obtain the first attack result.

[0050] The first attack result includes multiple second encodings in the w-space of StyleGAN.

[0051] In step 105, the first attack result is used as the initialization point of the black-box search algorithm based on CMA-ES. The black-box face classification model is attacked using the black-box search algorithm based on CMA-ES to obtain the last generation population.

[0052] The final generation population includes multiple third-order encodings in the w-space of StyleGAN.

[0053] The basic idea of ​​CMA-ES (Covariance Matrix Adaptation-Evolutionary Strategies) is to mimic the principles of biological evolution, assuming that regardless of gene changes, the resulting solutions always follow a Gaussian distribution with zero mean and a certain variance. This disclosure improves upon CMA-ES by employing a black-box search algorithm based on an improved version of CMA-ES to attack black-box face classification models.

[0054] In step 106, StyleGAN is used to generate the face image corresponding to each third encoding in order to determine the second attack result obtained by attacking the black-box face classification model.

[0055] Optionally, step 106 includes selecting the third code based on the face image corresponding to each third code, and the face image of the selected third code is the second attack result obtained by attacking the black box face classification model.

[0056] Here, the black-box face classification model is essentially a face classification model trained on a private dataset, and its classification results can reflect the facial features in the private dataset to a certain extent. That is, the face image corresponding to the selected third encoding in this embodiment can reflect the facial features in the private dataset to a certain extent, which is equivalent to indirectly obtaining the facial features in the private dataset, thereby realizing the inversion attack on the black-box face classification model.

[0057] In this embodiment, multiple first face images are generated using StyleGAN. The probability of each first face image output by the black-box face classification model is obtained. Based on the probability of each first face image and the first encoding, a replacement model is trained. The replacement model is attacked to obtain a first attack result. The first attack result is used as the initialization point of a black-box search algorithm based on CMA-ES. The black-box face classification model is attacked using the black-box search algorithm based on CMA-ES to obtain the last generation population. StyleGAN is then used to generate face images corresponding to each third encoding to determine the second attack result obtained from attacking the black-box face classification model. Since the replacement model can simulate the black-box face classification model to a certain extent, there is a certain similarity between the first attack result obtained from attacking the replacement model and the final second attack result. The first attack result is used as the initialization point for attacking the black-box face classification model using a black-box search algorithm based on CMA-ES. This initialization point is closer to the second attack result than the randomly generated initialization point. Therefore, it can effectively reduce the number of times the black-box face classification model is accessed in subsequent attacks, thus providing guidance for the security of the black-box face classification model.

[0058] Figure 2 A flowchart illustrating a black-box face classification model inversion attack method provided in another exemplary embodiment of this disclosure is shown. See also: Figure 2 The method includes:

[0059] In step 201, StyleGAN is pre-trained using the second face dataset.

[0060] In this embodiment of the disclosure, the second face dataset can be any kind of public dataset, while the private dataset used to train the black-box face classification model is a non-public dataset. Therefore, the second face dataset and the private dataset are different.

[0061] In step 202, multiple first face images are generated using the pre-trained StyleGAN.

[0062] Each first face image includes the first encoding in the w space of StyleGAN.

[0063] In step 203, multiple first face images are input into the black-box face classification model to obtain the probability of each first face image output by the black-box face classification model.

[0064] The relevant content of steps 202-203 is the same as that of steps 101-102 mentioned above, and will not be described in detail here.

[0065] In step 204, an alternative model is trained based on the probability and first encoding of each first face image.

[0066] In order to make the best use of the limited information obtained from access, this embodiment of the disclosure adopts the method of training an alternative model. Although training an alternative model will result in a certain number of accesses, experimental verification shows that the benefits of training an alternative model far outweigh the cost of accesses.

[0067] Alternatively, the alternative model is a white-box model for face classification, which includes a feature extractor and a classifier, with the classifier comprising linear layers and fully connected layers. In this case, step 202 includes the following step ad.

[0068] Step a: Pre-train the alternative model using the first face dataset.

[0069] The first face dataset is different from the second face dataset.

[0070] In this embodiment of the disclosure, the first face dataset can be any kind of public dataset, while the private dataset used to train the black-box face classification model is a non-public dataset. Therefore, the first face dataset and the private dataset are different.

[0071] Through pre-training, the alternative model gains a preliminary ability to classify faces.

[0072] Step b: Using the probabilities and first codes of multiple first face images, train the linear and fully connected layers of the pre-trained alternative model.

[0073] Step b essentially involves using multiple first face images and soft labels for each first face image to fine-tune the linear and fully connected layers of the pre-trained alternative model.

[0074] When training the surrogate model, fine-tuning is performed on the pre-trained surrogate model based on step a. The earlier feature extractor and some network layers are frozen, and only the last linear layer and fully connected layer are trained. The advantage of this is that the pre-trained face feature extractor can be effectively used when the amount of training data is small, thereby reducing the training of models that are not related to classification. Since the pre-trained model has already learned many features, fine-tuning usually converges faster than training the model from scratch.

[0075] Step c: During the training of the linear and fully connected layers of the alternative model, the first loss is calculated for each face image using the first loss function.

[0076] In this embodiment of the disclosure, the first loss function is determined based on cross-entropy loss and KL divergence.

[0077] Optionally, the first loss function is expressed by formula (1).

[0078] (1)

[0079] In formula (1), The first loss is for the i-th first face image. Let the cross-entropy loss be the i-th image of the first face. Let be the KL divergence of the i-th first face image. The weights are the cross-entropy loss values. The weights of the KL divergence, and These are hyperparameters set based on experience.

[0080] There are many methods for calculating cross-entropy loss and KL divergence in related technologies, so they will not be detailed here.

[0081] By weighting the cross-entropy loss and KL divergence in the first loss function, the generalization ability and accuracy of the alternative model can be improved.

[0082] Step d: The loss reweighting method is used to reweight the first loss of each face image to obtain the second loss of each face image.

[0083] Loss reweighting improves a model's performance on datasets with different distributions during transfer learning by adjusting the loss values ​​for different samples or classes. When training deep learning models, some samples or classes are inefficient to learn and difficult to learn, resulting in poor model performance for these samples or classes. Reweighting allows the model to focus more on these "difficult" samples, improving overall performance.

[0084] In this embodiment of the disclosure, the loss is reweighted using the label frequency of the training samples. Here, the training samples are multiple first face images, and the label frequency refers to the proportion of the number of first face images in each category among the N first face images.

[0085] For example, a certain first face image belongs to the m-th category in the black-box face classification model, and the reweighted weight of the m-th category is the proportion of the number of images belonging to the m-th category among the N first face images.

[0086] When the i-th first face image belongs to the m-th category, the reweighting process can be represented by formula (2).

[0087] (2)

[0088] In formula (2), The second loss is for the i-th first face image. The reweighting weights for the m-th class of images are... ,in Let m be the number of images belonging to the m-th category among multiple first-face images. The number of first face images is given. The meanings of the other parameters in formula (2) are the same as those in formula (1), and will not be detailed here.

[0089] Because StyleGAN is pre-trained using a second face dataset, which differs from the private face dataset, the distribution of the multiple first face images generated by StyleGAN also differs from that of the private face dataset. Directly training the substitution model using multiple first face images results in poor training performance. In this embodiment, by combining data augmentation, multiple loss functions (including KL divergence and cross-entropy loss), and reweighting the first loss during the training process, the training performance of the substitution model is improved, enabling the substitution model to more closely approximate the target model even with limited training data. Compared to directly training the substitution model using multiple first face images, the training performance of the substitution model in this embodiment is doubled.

[0090] After obtaining the second loss for each first face image, the replacement model can be optimized based on the second loss. After multiple iterations, the replacement model can be fine-tuned. The fine-tuned replacement model can simulate the black-box model to some extent.

[0091] In step 205, the alternative model is attacked to obtain the first attack result.

[0092] The first attack result includes multiple second encodings in the w-space of StyleGAN.

[0093] Here, any encoding in the w space of StyleGAN can generate a unique image by StyleGAN, so multiple second encodings also correspond to multiple second face images generated by StyleGAN.

[0094] In this embodiment, since the alternative model is a local white-box model, attackers have full access to it, including model parameters and structure. Furthermore, the local white-box model has no query limit and does not waste query resources. Therefore, any method used for attacking white-box or black-box systems can be employed to attack the alternative model an unlimited number of times. This embodiment does not limit the method used to attack the alternative model.

[0095] For example, a gradient-based attack method can be used to attack the surrogate model. The attack result obtained when the gradient of the surrogate model no longer decreases is the first attack result. Since the surrogate model can simulate the black-box face classification model to some extent, there is a certain similarity between the first attack result and the second attack result obtained from attacking the surrogate model.

[0096] The first attack result is used as the initialization point for attacking the black-box face classification model in step 206. This initialization point is closer to the second attack result than the randomly generated initialization point, so the number of accesses can be effectively reduced in subsequent attacks.

[0097] In step 206, the first attack result is used as the initialization point of the black-box search algorithm based on CMA-ES. The black-box face classification model is attacked using the black-box search algorithm based on CMA-ES to obtain the last generation population.

[0098] The last generation population includes multiple third codes in the w space of StyleGAN;

[0099] Optionally, before attacking the black-box face classification model using a black-box search algorithm based on CMA-ES, it is necessary to set the hyperparameters of the algorithm and initialize the initialization points. The hyperparameters of the algorithm include the number of iterations, the fitness function, etc.

[0100] Here, the initialization point is a number of second codes in the w space of StyleGAN. The number of second codes can be encoded into a chromosome according to certain rules (one second code is one solution, so one second code can be encoded into a chromosome), thereby realizing the initialization process of the initialization point.

[0101] Figure 3This is a flowchart of the black-box search algorithm based on CMA-ES. Optionally, step 206 includes the following three steps, which are described below in conjunction with... Figure 3 Step 206 will be explained.

[0102] The first step is to obtain the fitness value of each individual in the population during the k-th iteration.

[0103] The fitness value of each individual is determined based on the probability output by StyleGAN and the black-box face classification model.

[0104] Here, k is a positive integer. When k is greater than 1, the population of the k-th iteration is determined based on the (k-1)-th iteration; when k equals 1, the population of the 1st iteration is the multiple second codes in the first attack result.

[0105] In this embodiment, the fitness function is the probability of an individual belonging to a category from the probabilities output by the black-box face classification model. For example, after generating an image of an individual using a generator (i.e., StyleGAN), the image can be input into the black-box face classification model. Assuming there are M categories in the black-box face classification model, for this image, the black-box face classification model will obtain M probabilities. The sum of these M probabilities is 1. The category corresponding to the maximum value among these M probabilities is the category of the image, and the maximum value among the M probabilities is the probability of the image belonging to that category, which is also the probability of the individual belonging to that category. This probability is the fitness value of the individual.

[0106] For example, a black-box face classification model has three categories. For an image corresponding to a certain individual, the black-box face classification model will output three probabilities: 1%, 90%, and 9%, corresponding to the probability of the image being in category 1, category 2, and category 3, respectively. Therefore, the probability of the individual belonging to category 2 is 90%, and the image belongs to category 2, meaning the individual's fitness value is 90%.

[0107] To obtain an individual's fitness value, we can first convert the chromosome encoding of an individual into its encoding in the w-space of StyleGAN. Then, StyleGAN generates a corresponding image based on this encoding in the w-space. Finally, this image is input into a black-box face classification model. The probability of the individual belonging to a class in the output of the black-box face classification model is the individual's fitness value. This process can be represented as follows: ,in For the j-th individual in the k-th iteration fitness value; This indicates that the j-th individual in the k-th iteration... The input is fed into the generator (which is also known as StyleGAN) to obtain the j-th individual in the k-th iteration. The corresponding image; The fitness function, also known as the black-box face classification model, This indicates that the j-th individual in the k-th iteration... The probability of an individual belonging to a class is obtained from the probability obtained by inputting the corresponding image into the black-box face classification model.

[0108] The second step involves recombining and mutating the population based on the fitness value of each individual in the k-th iteration to obtain multiple new individuals.

[0109] Multiple new individuals constitute the population for the (k+1)th iteration. Each recombination and mutation involves generating a new individual through linear combination and random perturbation. Linear combination indicates that the two individuals with the highest fitness values ​​in the population of the kth iteration are linearly combined. Random perturbation is determined based on the first covariance matrix. Here, p is an empirical value, and the value of p is not limited in this embodiment.

[0110] Before recombination and mutation, the population in the k-th iteration needs to be selected to determine the individuals with fitness values ​​in the top p%. This process can be represented as follows: ,in Let be the set of individuals with fitness values ​​in the top p% of the population in the k-th iteration. For the j-th individual in the k-th iteration fitness value, This indicates that individuals with fitness values ​​in the top p% are retained.

[0111] Optionally, in the k-th iteration, formula (3) is used to generate a new individual through linear combination and random perturbation:

[0112] (3)

[0113] In formula (3), For a new individual generated in the k-th iteration, , and These are hyperparameters, and their values ​​are determined empirically. and Let these be two distinct individuals in the population whose fitness values ​​are in the top p% during the k-th iteration. and belong , This is a linear combination. For random perturbation, used to indicate the first covariance matrix in the k-th iteration. The normal distribution space.

[0114] By repeatedly executing the above formula (3), multiple new individuals can be generated in the k-th iteration, and these multiple new individuals constitute the population in the k+1-th iteration.

[0115] When k is greater than 1, the first covariance matrix of the k-th iteration is determined based on the (k-1)-th iteration; when k equals 1, the first covariance matrix of the 1st iteration is... ,in Let represent the j-th individual in the population during the first iteration, where j is an integer ranging from 1 to n, and n is the number of individuals in the population during the first iteration. It is the mean vector of the first iteration, representing the center position of the population in the first iteration.

[0116] In conventional CMA-ES, a new individual is generated by linearly combining and randomly perturbing all individuals in the population during the k-th iteration. The black-box search algorithm based on CMA-ES in this embodiment improves upon this by using only the individuals with the fitness values ​​in the top p% of the population during the k-th iteration, through linear combination and random perturbation, to generate a new individual. This enables the selection of better individuals, optimizes iteration efficiency, and meets the termination condition more quickly.

[0117] The third step is to update the first covariance matrix in the k-th iteration based on the fitness value of each individual in the population in the (k+1)-th iteration, so as to complete the k-th iteration.

[0118] Optionally, formula (4) is used to update the first covariance matrix in the k-th iteration based on the fitness value of each individual in the population at the (k+1)-th iteration:

[0119] (4)

[0120] In formula (4), This is the first covariance matrix in the updated k-th iteration, which is also the first covariance matrix in the (k+1)-th iteration. The learning rate parameter, Let j be the j-th individual in the population during the (k+1)-th iteration, where j is an integer ranging from 1 to n, and n is the number of individuals in the population during the (k+1)-th iteration. Let j be the weight of the j-th individual. Let be the mean vector, representing the center position of the population in the (k+1)th iteration.

[0121] Repeating steps one through three above allows for multiple iterations until a termination condition is met (such as reaching the maximum number of iterations or population convergence). Once the termination condition is met, iteration stops, resulting in the final generation of the population, which includes multiple third-order codes.

[0122] In step 207, StyleGAN is used to generate the face image corresponding to each third encoding in order to determine the second attack result obtained by attacking the black-box face classification model.

[0123] At this point, selection can be made within the final generation of the population. This involves using StyleGAN to generate face images corresponding to each third encoding, then inputting these face images into a black-box face classification model to obtain the fitness value of each individual in the final generation. Selection is then based on each individual's fitness value to obtain the final selection result. Select Results This includes multiple third-party codes selected from the given choices. Selection results. The face images corresponding to the selected third codes are the results of the second attack.

[0124] The selected face images corresponding to the third encoding can reflect the face features in the private dataset to a certain extent, which is equivalent to indirectly obtaining the face features in the private dataset, thereby realizing the inversion attack on the black box face classification model.

[0125] Table 1: Comparison of accuracy between the baseline method and the training alternative model in the embodiments of this disclosure.

[0126]

[0127] Table 1 shows the accuracy of the alternative models trained using the method in this embodiment and the baseline method on the VGGFace2 dataset with a training dataset size of 5000 images. The black-box face classification model simulated by the alternative models is the inception_resnetv1_vggface2 model trained on the VGGFace2 dataset, and the pre-trained StyleGAN is trained on the CelebA and FFHQ datasets respectively. The baseline method trains the alternative model using only KL divergence as the loss. The method in this embodiment employs data augmentation, multiple loss functions, and loss reweighting to train the alternative model. The accuracy is expressed as a percentage (%).

[0128] As shown in Table 1, a total of four scenarios were compared: the baseline method and the method in this embodiment when training StyleGAN on the CelebA dataset using model architecture 1; the baseline method and the method in this embodiment when training StyleGAN on the CelebA dataset using model architecture 2; the baseline method and the method in this embodiment when training StyleGAN on the FFHQ dataset using model architecture 1; and the baseline method and the method in this embodiment when training StyleGAN on the FFHQ dataset using model architecture 2.

[0129] As can be seen, among the four cases mentioned above, compared with the benchmark method, the alternative model trained using the method in this embodiment of the disclosure has higher Top1 accuracy and Top5 accuracy on both model architecture 1 and model architecture 2, with an improvement of nearly 100%.

[0130] Table 2: Comparison of accuracy of attacking black-box face classification models using different attack methods when the generator is trained using the CelebA dataset.

[0131]

[0132] Table 3: Comparison of accuracy of attacking black-box face classification models using different attack methods when the generator is trained using the FFHQ dataset.

[0133]

[0134] Tables 2 and 3 show the Top-1 and Top-5 accuracies on validation model 1 and validation model 2, respectively, after attacking the VGGFace2 dataset-trained ResNet50 black-box face classification model with a cost of 20,000 queries using the Mirror black-box attack method, the RLB-MI reinforcement learning black-box attack method, and the method in this embodiment. The accuracy is expressed as a percentage (%).

[0135] Here, in Tables 2 and 3, Top1 accuracy represents the accuracy of the validated model in classifying the target class, and Top5 accuracy represents the accuracy of the target class among the top five most probable classes classified by the validated model. The target class is the class in which the probability output by the black-box face classification model belongs. The methods for determining Top1 and Top5 accuracy are widely discussed in related technologies and will not be detailed here.

[0136] Both validation model 1 and validation model 2 are black-box face classification models trained using the VGGFace2 dataset.

[0137] Experiments were conducted to attack a ResNet50 model trained on VGGFace2, targeting 20 face categories to calculate the attack success rate. Experimental results show that, under the same configuration (attacking the ResNet50 model using a generator trained on Celeba and a generator trained on the FFHQ dataset, respectively) and the same number of queries (20,000), the accuracy of this embodiment is higher than the other two methods.

[0138] Figure 4 Images generated by generators using different attack methods when the generator is trained on the CelebA dataset. Figure 5 The images shown are generated by generators from different attack methods when the generator is trained using the FFHQ dataset. It can be seen that the face generated by the method in this embodiment has a higher resolution than RLB-MI and is closer to the real image. This is due to the high-quality face generation characteristics of the styleGAN generator used. Furthermore, its feature similarity to the original image (i.e., the images in the training set of the black-box face classification model) also surpasses that of the Mirror black-box method and RLB-MI.

[0139] The following are device embodiments of this application. For details not described in detail in the device embodiments, please refer to the above method embodiments.

[0140] Figure 6 This illustration shows a schematic diagram of a black-box face classification model inversion attack device provided in an exemplary embodiment of this disclosure. See also: Figure 6 The black-box face classification model inversion attack device 600 includes: a first generation module 601, an acquisition module 602, a training module 603, a first attack module 604, a second attack module 605, and a second generation module 606.

[0141] The first generation module 601 is used to generate multiple first face images using a style-based generative adversarial network StyleGAN, each first face image including a first encoding in the w space of StyleGAN.

[0142] The acquisition module 602 is used to input multiple first face images into the black box face classification model in order to obtain the probability of each first face image output by the black box face classification model.

[0143] Training module 603 is used to train an alternative model based on the probability and first encoding of each first face image.

[0144] The first attack module 604 is used to attack the alternative model and obtain a first attack result, which includes multiple second codes in the w space of StyleGAN.

[0145] The second attack module 605 is used to take the first attack result as the initial point of the black-box search algorithm improved by the covariance matrix adaptive evolution strategy CMA-ES, and to attack the black-box face classification model by using the black-box search algorithm improved by CMA-ES to obtain the last generation population, which includes multiple third codes in the w space of StyleGAN.

[0146] The second generation module 606 is used to generate a face image corresponding to each third encoding using StyleGAN, so as to determine the second attack result obtained by attacking the black-box face classification model.

[0147] Optionally, the second attack module 605 is further configured to obtain the fitness value of each individual in the population of the k-th iteration, the fitness value of each individual being determined based on the probability output by StyleGAN and the black-box face classification model; based on the fitness value of each individual in the population of the k-th iteration, the population of the k-th iteration is subjected to multiple recombinations and mutations to obtain multiple new individuals, the multiple new individuals constituting the population of the (k+1)-th iteration, each recombination and mutation including generating a new individual through linear combination and random perturbation, the linear combination being used to indicate the linear combination of the two individuals with fitness values ​​in the top p% of the population of the k-th iteration, the random perturbation being determined based on the first covariance matrix in the k-th iteration; based on the fitness value of each individual in the population of the (k+1)-th iteration, the first covariance matrix in the k-th iteration is updated to complete the k-th iteration; where k is a positive integer.

[0148] Optionally, the alternative model is a white-box model for face classification. The alternative model includes a feature extractor and a classifier connected in sequence. The classifier includes a linear layer and a fully connected layer. The training module 603 is also used to pre-train the alternative model using a first face dataset; to train the linear layer and fully connected layer of the pre-trained alternative model using the probabilities and first codes of multiple first face images; during the training of the linear layer and fully connected layer of the alternative model, a first loss function is used to calculate the first loss for each face image; and a loss reweighting method is used to weight the first loss for each face image to obtain a second loss for each face image. The first loss function is determined based on cross-entropy loss and KL divergence.

[0149] Optionally, the device further includes: a pre-training module 607, which is used to pre-train StyleGAN using a second face dataset, which is different from the first face dataset; and to generate multiple first face images based on the pre-trained StyleGAN.

[0150] It should be noted that the black-box face classification model inversion attack device provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the black-box face classification model inversion attack device and the black-box face classification model inversion attack method embodiments are based on the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0151] The module division in this embodiment is illustrative and represents only one logical functional division. In actual implementation, other division methods are possible. Furthermore, the functional modules in the various embodiments of this disclosure can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0152] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this disclosure, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device (which may be a personal computer, mobile phone, or communication device, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this disclosure. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this disclosure. For example... Figure 7 As shown, the computer device 700 includes a processor 701 and a memory 702.

[0154] Processor 701 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 701 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 701 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 701 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 701 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0155] The memory 702 may include one or more computer-readable storage media, which may be non-transitory. The memory 702 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 702 is used to store at least one instruction, which is executed by the processor 701 to implement the black-box face classification model inversion attack method provided in this disclosure.

[0156] Those skilled in the art will understand that Figure 7 The structure shown does not constitute a limitation on the computer device 700, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0157] This disclosure also provides a non-transitory computer-readable storage medium, wherein when the instructions in the storage medium are executed by the processor of a computer device, the computer device is able to execute the black-box face classification model inversion attack method provided in this disclosure.

[0158] This disclosure also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the black-box face classification model inversion attack method provided in this disclosure.

[0159] The above description is merely an optional embodiment of this disclosure and is not intended to limit this disclosure. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the protection scope of this disclosure.

Claims

1. A black-box face classification model inversion attack method, characterized in that, The method includes: Multiple first face images are generated using a style-based generative adversarial network StyleGAN, and each first face image includes a first encoding in the w space of the StyleGAN; The multiple first face images are input into a black-box face classification model to obtain the probability of each first face image output by the black-box face classification model. Based on the probability and first encoding of each of the first face images, a replacement model is trained; Attacking the alternative model yields a first attack result, which includes multiple second encodings in the w-space of the StyleGAN. The first attack result is used as the initial point of the black-box search algorithm improved by the covariance matrix adaptive evolution strategy CMA-ES. The black-box face classification model is attacked by the black-box search algorithm improved by CMA-ES to obtain the last generation population. The last generation population includes multiple third codes in the w space of the StyleGAN. The StyleGAN is used to generate a face image corresponding to each of the third codes, in order to determine the second attack result obtained by attacking the black-box face classification model.

2. The method according to claim 1, characterized in that, The attack on the black-box face classification model using the CMA-ES-based improved black-box search algorithm includes: Obtain the fitness value of each individual in the population during the k-th iteration. The fitness value of each individual is determined based on the probabilities output by the StyleGAN and the black-box face classification model. Based on the fitness value of each individual in the population of the k-th iteration, the population of the k-th iteration is recombined and mutated multiple times to obtain multiple new individuals. The multiple new individuals constitute the population of the (k+1)-th iteration. Each recombination and mutation includes generating a new individual through linear combination and random perturbation. The linear combination is used to indicate that the two individuals with fitness values ​​in the top p% of the population of the k-th iteration are linearly combined. The random perturbation is determined based on the first covariance matrix in the k-th iteration. Based on the fitness value of each individual in the population in the (k+1)th iteration, update the first covariance matrix in the kth iteration to complete the kth iteration; Where k is a positive integer.

3. The method according to claim 2, characterized in that, In the k-th iteration, a new individual is generated through linear combination and random perturbation using the following formula: in, For a new individual generated in the k-th iteration, , and For hyperparameters, and Let these be two distinct individuals in the population with fitness values ​​in the top p% during the k-th iteration. The random perturbation is used to indicate the first covariance matrix in the k-th iteration. The space of normal distribution; The fitness value of each individual in the population based on the (k+1)th iteration is used to update the first covariance matrix using the following formula: in, The first covariance matrix in the updated k-th iteration, used to indicate the first covariance matrix in the (k+1)-th iteration. The learning rate parameter, Let j be the j-th individual in the population during the (k+1)-th iteration, where j is an integer ranging from 1 to n, and n is the number of individuals in the population during the (k+1)-th iteration. Let J be the weight of the j-th individual. Let be the mean vector, representing the center position of the population in the (k+1)th iteration.

4. The method according to any one of claims 1 to 3, characterized in that, The alternative model is a white-box model for face classification, comprising a feature extractor and a classifier connected in sequence. The classifier includes linear layers and fully connected layers. The training of the alternative model based on the probability and first encoding of each of the first face images includes: The alternative model was pre-trained using the first face dataset; The probabilities and first codes of the multiple first face images are used to train the linear and fully connected layers of the pre-trained alternative model; During the training of the linear and fully connected layers of the alternative model, a first loss function is used to calculate the first loss for each face image; The loss reweighting method is used to weight the first loss of each face image to obtain the second loss of each face image; The first loss function is determined based on cross-entropy loss and KL divergence.

5. The method according to claim 4, characterized in that, The first loss function is expressed by the following formula: in, The first loss is for the i-th first face image. The cross-entropy loss is the value of the i-th first face image. Let KL divergence be the i-th first face image. The weights are the cross-entropy loss values. represents the weight of the KL divergence, where i is an integer ranging from 1 to N.

6. The method according to claim 4, characterized in that, Before generating multiple first face images using the style-based generative adversarial network StyleGAN, the method further includes: StyleGAN is pre-trained using a second face dataset, which is different from the first face dataset. Multiple images of the first face are generated based on the pre-trained StyleGAN.

7. A black-box face classification model inversion attack device, characterized in that, The device includes: The first generation module is used to generate multiple first face images using a style-based generative adversarial network StyleGAN, each first face image including a first encoding in the w space of the StyleGAN; The acquisition module is used to input the multiple first face images into a black box face classification model to obtain the probability of each first face image output by the black box face classification model. The training module is used to train an alternative model based on the probability and a first encoding of each of the first face images; A first attack module is used to attack the alternative model and obtain a first attack result, the first attack result including multiple second codes in the w space of the StyleGAN; The second attack module is used to take the first attack result as the initialization point of the black-box search algorithm improved by the covariance matrix adaptive evolution strategy CMA-ES, and use the black-box search algorithm improved by CMA-ES to attack the black-box face classification model to obtain the last generation population. The last generation population includes multiple third codes in the w space of the StyleGAN. The second generation module is used to generate a face image corresponding to each of the third codes using the StyleGAN, so as to determine the second attack result obtained by attacking the black box face classification model.

8. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the method according to any one of claims 1 to 6.

10. A computer program product comprising computer program instructions, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images