Multimodal generation task-oriented adversarial sample generation method and equipment

Abstract

The invention provides a multi-modal generation task oriented adversarial sample generation method and equipment. The method comprises the following steps: adding initialized general adversarial disturbance delta to an undisturbed image to obtain a disturbed image; inputting the disturbance image into a visual encoder of an agent model to obtain image embedding; the image is embedded and input into a text decoder together with prompt words to generate a disturbance text; determining image-text pair data, learning general adversarial disturbance to destroy image-text association in a target data set during reasoning, and misleading a target model; an adversarial modal decoupling strategy is adopted, and the feature distance between the clean sample and the adversarial sample is increased; for disturbance across VLPMs and MLLMs, a step-by-step recursion method is adopted to disturb a generation mechanism of a model, and a group of candidate marks are randomly screened to serve as recursion disturbance marks; a multi-mode decoupling strategy is adopted, and a loss function is maximized. The method is superior to related technologies in the aspects of disturbance effectiveness and mobility.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of computer technology, and in particular, to a method and device for generating adversarial samples for multimodal generation tasks. Background Art

[0002] Vision-language models (VLMs) include vision-language pre-trained models (VLPMs) and multimodal large language models (MLLMs). These models have become important tools for visually guided text generation and understanding the complex semantic relationship between visual and textual elements. With their excellent performance, they are widely used in generative tasks such as image captioning and visual question answering (VQA). Despite the remarkable success of VLMs, they are still vulnerable to adversarial samples. Adversarial samples deceive the model by adding imperceptible perturbations to the original data, reducing its robustness. Therefore, adversarial perturbation methods for generative tasks continue to emerge. At present, most of the relevant adversarial perturbations are sample-specific, that is, each sample needs to generate a dedicated perturbation separately. This method is not only computationally expensive, but also has limited generalization ability. Therefore, it has become a technical problem that needs to be solved in the industry to develop a one-time, universally applicable adversarial sample generation method and device for multimodal generation tasks, which effectively overcomes the defects in the above-mentioned related technologies. Summary of the invention

[0003] In view of the above problems existing in the prior art, an embodiment of the present invention provides an adversarial sample generation method and device for multimodal generation tasks.

[0004] In a first aspect, an embodiment of the present invention provides an adversarial sample generation method for a multimodal generation task, comprising: adding an initialized universal adversarial perturbation δ to an unperturbed image to obtain a perturbed image; inputting the perturbed image into a visual encoder of an agent model to obtain an image embedding; inputting the image embedding together with a prompt word into a text decoder to generate a perturbed text; determining image-text pair data to ensure that ||δ|| in the universal adversarial perturbation ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞ For the infinite norm, we learn universal adversarial perturbations to destroy the image-text association in the target dataset during inference and mislead the target model. We adopt an adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples. For perturbations across VLPMs and MLLMs, we use a step-by-step recursive method to disrupt the generation mechanism of the model and randomly select a set of candidate tags as recursive perturbation tags. We use a multimodal decoupling strategy to maximize the loss function.

[0005] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the step of increasing the feature distance between the clean sample and the adversarial sample includes:

[0006]

[0007] c' n ≠c n Λ||δ|| ∞ ≤ε

[0008] Among them, L is the feature distance metric function, which is used to quantify the feature difference between clean samples and adversarial samples; max is the maximum value symbol; F is the model; v n is the unperturbed image; prompt is the prompt word; t′ i is the disturbance token; t i is the original token; c' n is the perturbation text; c n is the original text; Λ is the intersection.

[0009] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the random screening of a group of candidate markers includes:

[0010] S=S 1 ∩S 2

[0011]

[0012] g i =Dec l (t′ i ,e' v ,β),g i ∈R B×1×Ω

[0013]

[0014] Among them, S is the overall candidate set; S 1 is the first candidate subset; S 2 is the second candidate subset; g i is the probability of the i-th token; P k-1 is the cumulative probability distribution; μ is the probability threshold; σ is the sorting operation; Ω is the vocabulary size; k is the vocabulary index; is the kth token probability; is the jth token probability; Dec l is the text encoder; e' vis image embedding; β is random noise; R is the text encoding space; B is the batch size; softmax is the softmax function.

[0015] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy, including:

[0016]

[0017] Where M is the KL divergence; E v is the visual encoder; L in is the intra-modal decoupling loss; n is the nth image; N is the total number of images.

[0018] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy and further includes:

[0019]

[0020] Among them, L c is the cross-modal decoupling loss; E c A text encoder.

[0021] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy and further includes:

[0022]

[0023] Among them, L f is the mixed mode decoupling loss; g' n Mixed encoding of original text and perturbed image; g n Encode the original text and the original image together.

[0024] Based on the content of the above method embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy to maximize the loss function, including:

[0025]

[0026] Among them, L total is the loss function; α 1 is the first hyperparameter; α 2 is the second hyperparameter; α 3 is the third hyperparameter.

[0027] In a second aspect, an embodiment of the present invention provides an adversarial sample generation device for multimodal generation tasks, including: a first main module, used to implement adding an initialized universal adversarial perturbation δ to an unperturbed image to obtain a perturbed image; a second main module, used to implement inputting the perturbed image into a visual encoder of an agent model to obtain an image embedding; a third main module, used to implement inputting the image embedding together with a prompt word into a text decoder to generate a perturbed text; a fourth main module, used to implement determining image-text pair data to ensure that ||δ|| in the universal adversarial perturbation ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞ The fifth main module is used to implement the adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples; the sixth main module is used to implement the perturbation across VLPMs and MLLMs, and use a step-by-step recursive method to disrupt the generation mechanism of the model, and randomly select a set of candidate tags as recursive perturbation tags; the seventh main module is used to implement the multimodal decoupling strategy to maximize the loss function.

[0028] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0029] At least one processor, at least one memory and a communication interface; wherein,

[0030] The processor, memory and communication interface communicate with each other;

[0031] The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the adversarial sample generation method for multimodal generation tasks provided by any one of the various implementation methods of the first aspect.

[0032] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions enable a computer to execute an adversarial sample generation method for multimodal generation tasks provided by any one of the various implementation methods of the first aspect.

[0033] The adversarial sample generation method and device for multimodal generation tasks provided by the embodiments of the present invention adopt a recursive perturbation strategy and combine token filtering with polynomial sampling methods to generate perturbations, thereby gradually destroying and enhancing the transferability of the perturbations. In order to further improve the effectiveness of the perturbations, a three-layer modal decoupling strategy is introduced to decouple single-modal, cross-modal and fused modal features respectively, so as to effectively destroy feature alignment and modal interaction. A large number of experiments have shown that the method is superior to related technologies in terms of perturbation effectiveness and transferability, and reduces the CIDEr score by 39.14% on average. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 A schematic diagram of a flow chart of a method for generating adversarial samples for multimodal generation tasks provided by an embodiment of the present invention;

[0036] Figure 2 A schematic diagram of the structure of an adversarial sample generation device for multimodal generation tasks provided by an embodiment of the present invention;

[0037] Figure 3 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention;

[0038] Figure 4 A schematic diagram of experimental results of a comparative baseline method for black box perturbation provided in an embodiment of the present invention;

[0039] Figure 5 A schematic diagram of the results of testing different parameters on the MSCOCO dataset provided by an embodiment of the present invention;

[0040] Figure 6 A schematic diagram of five commonly used evaluation indicators of RPA in image captioning tasks using different loss components provided by an embodiment of the present invention;

[0041] Figure 7 A schematic diagram of the overall accuracy of a VQA task provided by an embodiment of the present invention;

[0042] Figure 8 A schematic diagram showing the comparison of experimental results of the RPA method provided in an embodiment of the present invention and the other two defense methods on the Flickr30K and MSCOCO datasets. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical scheme and advantages of the embodiment of the present invention clearer, the technical scheme in the embodiment of the present invention will be clearly and completely described in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention. In addition, the technical features in the various embodiments or single embodiments provided by the present invention can be combined with each other arbitrarily to form a feasible technical solution. This combination is not subject to the constraints of the sequence of steps and / or the structural composition mode, but must be based on the ability of ordinary technicians in the field to achieve. When the combination of technical solutions is contradictory or cannot be achieved, it should be considered that the combination of such technical solutions does not exist and is not within the scope of protection required by the present invention. If there are step numbers in the following embodiments, they are only set for the convenience of explanation, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0044] The embodiment of the present invention provides a method for generating adversarial samples for multimodal generation tasks, see Figure 1 , the method comprises: adding an initialized universal adversarial perturbation δ to an unperturbed image to obtain a perturbed image; inputting the perturbed image into a visual encoder of a proxy model to obtain an image embedding; inputting the image embedding together with a prompt word into a text decoder to generate a perturbed text; determining image-text pair data to ensure that ||δ|| ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞ For the infinite norm, we learn universal adversarial perturbations to destroy the image-text association in the target dataset during inference and mislead the target model. We adopt an adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples. For perturbations across VLPMs and MLLMs, we use a step-by-step recursive method to disrupt the generation mechanism of the model and randomly select a set of candidate tags as recursive perturbation tags. We use a multimodal decoupling strategy to maximize the loss function.

[0045] Specifically, in generation tasks such as image caption generation and visual question answering (VQA), the model generates responses based on images and prompts: Image caption generation: the prompt is optional and the output is a description text; VQA task: the prompt is a question and the output is the answer. Taking image caption generation as an example, the output caption starts from a special token [BOS] (start of sentence token) and recursively generates t′ i token, where i∈[1,λ], λ represents the length of the text, until [EOS] (end of sentence marker) is encountered. Each generated t′ iInput the last linear layer Dec of the text decoder in sequence l (), while in e' v Random noise β is added to the output logits. The output logits are calculated as follows: i =Dec l (t′ i ,e' v ,β),g i ∈R B×1×Ω , where Ω is the vocabulary size, and then according to t′ i Recursive sampling is performed until [EOS] is generated, and finally the perturbed text c' is obtained by decoding n .

[0046] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the step of increasing the feature distance between the clean sample and the adversarial sample includes:

[0047]

[0048] c' n ≠c n Λ||δ|| ∞ ≤ε

[0049] Among them, L is the feature distance metric function, which is used to quantify the feature difference between clean samples and adversarial samples; max is the maximum value symbol; F is the model; v n is the unperturbed image; prompt is the prompt word; t′ i is the disturbance token; t i is the original token; c' n is the perturbation text; c n is the original text; Λ is the intersection.

[0050] Specifically, RPA (Recursive Perturbation Detection) makes full use of the recursive generation mechanism of VLMs and its vulnerabilities to improve the practicality and transferability of UAPs. Specifically, the algorithm generates descriptions that are inconsistent with the semantics of the original data through recursive perturbations, uses polynomial sampling to decode the target token, and decouples the semantic similarity between the clean modality and the adversarial modality. RPA decouples the semantic distance between multimodal data pairs only through image perturbations, thereby optimizing the universal adversarial perturbation. Therefore, the practicality and transferability of the universal adversarial perturbation are guaranteed.

[0051] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the randomly selecting a group of candidate markers includes:

[0052] S=S1 ∩S 2

[0053]

[0054] g i =Dec l (t′ i ,e' v ,β),g i ∈R B×1×Ω

[0055]

[0056] Among them, S is the overall candidate set; S 1 is the first candidate subset; S 2 is the second candidate subset; g i is the probability of the i-th token; P k-1 is the cumulative probability distribution; μ is the probability threshold; σ is the sorting operation; Ω is the vocabulary size; k is the vocabulary index; is the kth token probability; is the jth token probability; Dec l is the text encoder; e' v is image embedding; β is random noise; R is the text encoding space; B is the batch size; softmax is the softmax function.

[0057] Specifically, for the perturbations across VLPMs and MLLMs, a step-by-step recursive approach is used to perturb the generation mechanism of the model. Usually, the perturber tends to select the token with the lowest probability during the generation process, but this can lead to poor readability of the generated captions. Therefore, in order to disrupt the generation mechanism while maintaining good readability, a set of selected candidate tokens t′ are selected i However, if the candidate with the highest probability t′ i is still selected, then during the UAP (Universal Adversarial Perturbation) training process, the generated c' n It may still maintain a high semantic similarity with the original data. In order to improve the readability and diversity of the captions while ensuring the effectiveness of the perturbation, t′i is randomly selected from the candidate set as the target tag.

[0058] In order to further improve c' n The diversity of the candidate set S is randomly sampled. i , to generate the final t′ i In standard model generation, the t′ with the highest probability is usually selected. iHowever, in order to widen the semantic gap between the generated content and the original data while maintaining the diversity of the generated text, polynomial sampling is performed on the screened candidate set S to optimize the perturbation effect.

[0059] Specifically, let: q i =softmax(g i ), and then for each category from the candidate set Sampling, assuming a label k i In n trials, d i times, then the final selected target marker satisfies: t′ i ~M(q i ) where M represents a multinomial distribution that satisfies the following formula:

[0060]

[0061] Among them, I i Indicates t′ i The number of times it occurs in n trials.

[0062] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy, including:

[0063]

[0064] Where M is the KL divergence; E v is the visual encoder; L in is the intra-modal decoupling loss; n is the nth image; N is the total number of images.

[0065] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the multimodal decoupling strategy is adopted, further includes:

[0066]

[0067] Among them, L c is the cross-modal decoupling loss; E c A text encoder.

[0068] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention, wherein the multimodal decoupling strategy is adopted, further includes:

[0069]

[0070] Among them, L fis the mixed mode decoupling loss; g' n Mixed encoding of original text and perturbed image; g n Encode the original text and the original image together.

[0071] Based on the content of the above method embodiment, as an optional embodiment, the adversarial sample generation method for multimodal generation tasks provided in the embodiment of the present invention adopts a multimodal decoupling strategy to maximize the loss function, including:

[0072]

[0073] Among them, L total is the loss function; α 1 is the first hyperparameter; α 2 is the second hyperparameter; α 3 is the third hyperparameter.

[0074] The adversarial sample generation method for multimodal generation tasks provided by the embodiment of the present invention adopts a recursive perturbation strategy and combines token filtering with polynomial sampling methods to generate perturbations, thereby gradually destroying and enhancing the transferability of the perturbations. In order to further improve the effectiveness of the perturbations, a three-layer modal decoupling strategy is introduced to decouple single-modal, cross-modal and fused modal features respectively, so as to effectively destroy feature alignment and modal interaction. A large number of experiments have shown that the method is superior to related technologies in terms of perturbation effectiveness and transferability, and reduces the CIDEr score by 39.14% on average.

[0075] The adversarial sample generation method for multimodal generation tasks provided by the embodiment of the present invention is subjected to field platform experiments as follows: datasets and downstream tasks. In order to comprehensively evaluate the performance of the proposed method, four datasets are used to conduct experiments on two generation tasks. In the image description task, three widely used datasets are used: Flickr30K, MSCOCO, and Nocaps. The Flickr30K dataset is used to train UAP, which includes 31,783 images, each with five descriptions. The MSCOCO dataset was released in 2014 and contains 164,000 images, each with about five annotations. In order to evaluate the performance of the model in unknown scenes, the Nocaps validation set is used, which contains 4,500 validation images and 10,600 test images. For visual question answering (VQA), the VQA-v2 dataset is selected for performance evaluation. The VQA-v2 dataset contains 265,016 images, each with at least 3 questions. Each question is accompanied by 10 correct answers and 3 reasonable but wrong answers. Consistent with previous studies, the test dataset is used for training and evaluation in all experiments. The downstream tasks of the generation mainly focus on the image description task, and additional experiments on VQA are also conducted.

[0076] Four generative models are selected to evaluate the proposed method: BLIP, BLIP-2, Instruct-BLIP and X-VLM. BLIP and X-VLM use VLPM based on BERT architecture for generation tasks, while BLIP-2 and Instruct-BLIP use MLLM (Multimodal Large-Scale Language Model) based on Large-Scale Language Model (LLM) for generation.

[0077] In order to be consistent with most previous studies, popular evaluation metrics such as BLEU-4, CIDEr, METEOR, ROUGE L, and SPICE are adopted to evaluate the effectiveness of the proposed method.

[0078] For basic experiments, the perturbation amplitude was uniformly set to 12 / 255. Experiments with different perturbation amplitudes were also conducted. The PGD (projected gradient descent) method was used to solve the optimization problem, with 100 iterations and a step size of The batch size is 8, and the parameters are set to μ = 0.8, α 1 =α 2 =1,α 3 =0.1, β=0.1.

[0079] As the first method to learn UAP (Universal Adversarial Perturbation) for VLPM and MLLM, the proposed method is compared with six baseline methods, including instance-specific perturbations, ETU variants, and C-PGC methods, to verify the effectiveness of each component and highlight the advantages of the algorithm in learning UAP.

[0080] UniA (Unimodal Perturbation): UAP is learned by directly increasing the embedding distance between the adversarial image and the original image.

[0081] MulA (Multimodal Agitation): Increases the embedding space distance between adversarial images and the original images as well as paired texts.

[0082] ETUL and ETUS: Variants of the ETU method, using local utility enhancement techniques and data augmentation techniques respectively.

[0083] The transferability of the proposed method is evaluated by perturbing VLPMs and MLLMs. Since models of different architectures accept inputs of different sizes, the learned UAP must be adjusted accordingly before perturbation. For example, when perturbing BLIP or X-VLM, the UAP learned based on BLIP is resized to 384×384; when the perturbation is transferred from BLIP to BLIP-2 or Instruct-BLIP, the size of the UAP is resized from 384×384 to 224×224. The results are rounded to two decimal places in Table 1. Based on these results, the following conclusions are drawn.

[0084] Under white-box perturbations, the proposed method outperforms all other methods, achieving an average CIDEr score of less than 39.14% on the MSCOCO dataset. When the perturbations are transferred to the black-box model, the perturbation methods that cannot be transferred, such as UniA and MulA, obtain scores comparable to other methods. This shows that C-PGC, ETU and their variants tend to overfit to the alternative models during training. In contrast, the method of significantly improves the performance of black-box perturbations. It is worth noting that there are significant differences in the performance of models with different architectures. Specifically, the score of perturbed MLLMs is higher than that of perturbed VLPMs. The reason may be that MLLMs generate text through LLM modules, and their accuracy and readability are higher than VLPMs. In VLPMs, text generation relies on the BERT model, but the BERT model lacks a decoder, and its pre-training goal is more focused on understanding and representing existing text rather than generating new content.

[0085] Among all the evaluation metrics, CIDEr shows the largest score difference, while SPICE shows the smallest difference. This is because CIDEr calculates n-gram matches between candidate descriptions and multiple reference descriptions, which is a coarse-grained comparison. This shows that the descriptions generated by the method do not match most reference descriptions at the lexical level. In contrast, SPICE is a more fine-grained metric that takes into account semantic information in the description rather than simple string matching. The method scores slightly lower than other methods on the SPICE metric, especially on some datasets and models. In the future, more attention will be paid to the fine-grained semantic information of the text.

[0086] Higher scores indicate better model performance. VLPMs have lower scores, while MLLMs have higher scores. Specifically, when perturbing the BLIP-2 model, the unimodal perturbation method achieved the highest score, even surpassing the performance of the unperturbed model on the Nocaps dataset. This may be because UniA did not encounter novel objects in the Nocaps dataset during training. In addition, on the Nocaps dataset, the BLEU-4 scores are generally higher than those on the MSCOCO dataset, while other metrics do not show a similar trend. This may be due to the fact that BLEU-4 is a coarse-grained metric.

[0087] The effectiveness of the proposed method is further tested using BLIP-2 as a surrogate model, and the results are summarized in Appendix B. The consistently encouraging performance demonstrates the effectiveness of the method in generation tasks and its superior ability to generate transferable UAPs between different types of models.

[0088] In addition, we explore the robustness of other MLLMs in a black-box setting to verify the perturbation ability of our method. Given that these MLLMs generate a large amount of text in the generation task, we redesigned the experiment. Specifically, we compare the language template with the original image v n is input into MLLMs to evaluate c′ generated by these perturbation methods n Is it related to v n The experimental results of this RPA method and several comparative baseline methods for black-box perturbation of other multimodal large language models (MLLMs) on the Flickr30K dataset can be found in Figure 4 The proxy model in the experiment is BLIP, and the total number of test examples is 1000. Although RPA is designed for VLP models, it can still be well transferred to MLLMs. The results show that RPA performs best among all the compared methods.

[0089] The effects of four parameters on our method were verified. Figure 5 As can be seen in part (c), RPA achieves the best overall performance, further confirming its superiority. It is worth noting that the indicators of all methods decrease as the perturbation amplitude increases. This is expected because larger perturbations usually lead to better perturbation effects. However, larger perturbations significantly affect data quality, making perturbations easier to detect. Further in Figure 6 The effectiveness of different loss components is demonstrated in Figure 2. The combined scheme achieves the best performance (4.63% reduction on BLEU and 12.91% reduction on CIDEr). This highlights the effectiveness of combining the two components. Another generation task, Visual Question Answering (VQA), is analyzed. Figure 7As shown, BLIP-2(O) and BLIP-2(T) refer to the blip2-opt-2.7b model and the blip2-flan-t5-xl model, respectively. Five models are used as target models, and we choose the VQA-v2 dataset as the target dataset. Two BLIP-2 variants (i.e., blip2opt-2.7b and flan-t5-xl) are used. The BLIP-2(T) model shows the lowest accuracy in the VQA task. This can be attributed to the flan-t5-xl LLM, which focuses on cross-lingual translation tasks during training and shows relatively low robustness in the face of adversarial perturbations.

[0090] It is necessary to study adversarial defense mechanisms as countermeasures to mitigate the negative social impact that UAP may bring. To this end, we adopt two typical defense methods to guard against our perturbations. Due to the limited research on defense for multimodal downstream tasks, two general adversarial defense methods such as JPEG and NRP are selected. Figure 8 (Black numbers indicate higher scores and stronger defenses; red numbers indicate a drop in performance compared to the original results) shows the effectiveness of these two defenses on the image description task. NRP achieves better defenses than JPEG. However, despite the effectiveness of these defenses, the proposed method still shows strong perturbation performance (81.97% on average on CIDEr).

[0091] The implementation basis of each embodiment of the present invention is to implement programmed processing through a device with a processor function. Therefore, in engineering practice, the technical solutions and functions of each embodiment of the present invention can be encapsulated into various modules. Based on this reality, on the basis of the above embodiments, the embodiment of the present invention provides an adversarial sample generation device for multimodal generation tasks, which is used to execute the adversarial sample generation method for multimodal generation tasks in the above method embodiment. Figure 2 The device includes: a first main module, which is used to implement adding the initialized universal adversarial perturbation δ to the unperturbed image to obtain a perturbed image; a second main module, which is used to implement inputting the perturbed image into the visual encoder of the proxy model to obtain an image embedding; a third main module, which is used to implement inputting the image embedding together with the prompt word into the text decoder to generate a perturbed text; a fourth main module, which is used to implement determining the image-text pair data to ensure that ||δ|| ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞The fifth main module is used to implement the adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples; the sixth main module is used to implement the perturbation across VLPMs and MLLMs, and use a step-by-step recursive method to disrupt the generation mechanism of the model, and randomly select a set of candidate tags as recursive perturbation tags; the seventh main module is used to implement the multimodal decoupling strategy to maximize the loss function.

[0092] The adversarial sample generation device for multimodal generation tasks provided by the embodiment of the present invention adopts Figure 2 Several modules in the proposed method adopt a recursive perturbation strategy and combine token filtering with polynomial sampling methods to generate perturbations, which achieves gradual destruction and enhances the transferability of perturbations. In order to further improve the effectiveness of perturbations, a three-layer modal decoupling strategy is introduced to decouple single-modal, cross-modal and fused modal features respectively, so as to effectively destroy feature alignment and modal interaction. A large number of experiments show that it is superior to related technologies in terms of perturbation effectiveness and transferability, and reduces the CIDEr score by 39.14% on average.

[0093] It should be noted that the device in the device embodiment provided by the present invention can be used to implement the method in the above method embodiment as well as the method in other method embodiments provided by the present invention. The only difference is that the corresponding functional modules are set, and the principle is basically the same as the principle of the above device embodiment provided by the present invention. As long as the technical personnel in the field refer to the specific technical solutions in other method embodiments on the basis of the above device embodiment, obtain the corresponding technical means and the technical solutions composed of these technical means by combining technical features, the device in the above device embodiment can be improved on the premise of ensuring the practicality of the technical solution, thereby obtaining the corresponding device class embodiment, which is used to implement the methods in other method class embodiments. For example:

[0094] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a first submodule, which is used to increase the feature distance between the clean sample and the adversarial sample, including:

[0095]

[0096] c' n ≠c n Λ||δ|| ∞ ≤ε

[0097] Among them, L is the feature distance metric function, which is used to quantify the feature difference between clean samples and adversarial samples; max is the maximum value symbol; F is the model; vn is the unperturbed image; prompt is the prompt word; t′ i is the disturbance token; t i is the original token; c' n is the perturbation text; c n is the original text; Λ is the intersection.

[0098] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a second submodule, which is used to implement the random screening of a group of candidate markers, including:

[0099] S=S 1 ∩S 2

[0100]

[0101] g i =Dec l (t′ i ,e' v ,β),g i ∈R B×1×Ω

[0102]

[0103] Among them, S is the overall candidate set; S 1 is the first candidate subset; S 2 is the second candidate subset; g i is the probability of the i-th token; P k-1 is the cumulative probability distribution; μ is the probability threshold; σ is the sorting operation; Ω is the vocabulary size; k is the vocabulary index; is the kth token probability; is the jth token probability; Dec l is the text encoder; e' v is image embedding; β is random noise; R is the text encoding space; B is the batch size; softmax is the softmax function.

[0104] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a third submodule, which is used to implement the multimodal decoupling strategy, including:

[0105]

[0106] Where M is the KL divergence; E v is the visual encoder; L inis the intra-modal decoupling loss; n is the nth image; N is the total number of images.

[0107] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a fourth submodule, which is used to implement the multimodal decoupling strategy, and further includes:

[0108]

[0109] Among them, L c is the cross-modal decoupling loss; E c A text encoder.

[0110] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a fifth submodule, which is used to implement the multimodal decoupling strategy, and further includes:

[0111]

[0112] Among them, L f is the mixed mode decoupling loss; g' n Mixed encoding of original text and perturbed image; g n Encode the original text and the original image together.

[0113] Based on the content of the above device embodiment, as an optional embodiment, the adversarial sample generation device for multimodal generation tasks provided in the embodiment of the present invention further includes: a sixth submodule, which is used to implement the multimodal decoupling strategy and maximize the loss function, including:

[0114]

[0115] Among them, L total is the loss function; α 1 is the first hyperparameter; α 2 is the second hyperparameter; α 3 is the third hyperparameter.

[0116] The method of the embodiment of the present invention is implemented by relying on electronic devices, so it is necessary to introduce the relevant electronic devices. Based on this purpose, the embodiment of the present invention provides an electronic device, such as Figure 3As shown, the electronic device includes: at least one processor, a communication interface, at least one memory, and a communication bus, wherein at least one processor, the communication interface, and at least one memory communicate with each other through the communication bus. At least one processor can call the logic instructions in at least one memory to execute all or part of the steps of the method provided by the aforementioned various method embodiments.

[0117] In addition, the logic instructions in the at least one memory mentioned above can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each method embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0118] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0119] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.

[0120] The flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present invention. Based on this understanding, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and sometimes in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0121] It should be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "includes..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. Any "predetermined threshold", "preset threshold" and other similar expressions that do not indicate specific values ​​can be determined by a person of ordinary skill in the art through simple experiments or corresponding debugging.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for generating adversarial samples for multimodal generation tasks, characterized in that: include: Add the initialized universal adversarial perturbation δ to the unperturbed image to obtain the perturbed image; Inputting the perturbed image into the visual encoder of the proxy model to obtain image embedding; Inputting the image embedding and the prompt word into a text decoder to generate a perturbed text; Determine the image-text pair data to ensure the universal adversarial perturbation ||δ|| ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞ For the infinite norm, we learn universal adversarial perturbations to destroy the image-text association in the target dataset during inference and mislead the target model. We adopt an adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples. For perturbations across VLPMs and MLLMs, we use a step-by-step recursive method to disrupt the generation mechanism of the model and randomly select a set of candidate tags as recursive perturbation tags. We use a multimodal decoupling strategy to maximize the loss function.

2. The adversarial sample generation method for multimodal generation tasks according to claim 1, characterized in that: The step of increasing the feature distance between the clean sample and the adversarial sample includes: c' n ≠c n L||d|| ∞ ≤e Among them, L is the feature distance metric function, which is used to quantify the feature difference between clean samples and adversarial samples; max is the maximum value symbol; F is the model; v n is the unperturbed image; prompt is the prompt word; t i ' is the disturbance token; t i is the original token; c' n is the perturbation text; c n is the original text; Λ is the intersection.

3. The adversarial sample generation method for multimodal generation tasks according to claim 2, characterized in that: The randomly screening a set of candidate markers comprises: S=S1∩S2 g i =Dec l (t’ i ,e' v ,β),g i ∈R B×1×Ω Among them, S is the overall candidate set; S1 is the first candidate subset; S2 is the second candidate subset; g i is the probability of the i-th token; P k-1 is the cumulative probability distribution; μ is the probability threshold; σ is the sorting operation; Ω is the vocabulary size; k is the vocabulary index; is the kth token probability; is the jth token probability; Dec l is the text encoder; e' v is image embedding; β is random noise; R is the text encoding space; B is the batch size; softmax is the softmax function.

4. The adversarial sample generation method for multimodal generation tasks according to claim 3, characterized in that: The multimodal decoupling strategy includes: Where M is the KL divergence; E v is the visual encoder; L in is the intra-modal decoupling loss; n is the nth image; N is the total number of images.

5. The adversarial sample generation method for multimodal generation tasks according to claim 4, characterized in that: The multi-modal decoupling strategy also includes: Among them, L c is the cross-modal decoupling loss; E c A text encoder.

6. The adversarial sample generation method for multimodal generation tasks according to claim 5, characterized in that: The multi-modal decoupling strategy also includes: Among them, L f is the mixed mode decoupling loss; g' n Mixed encoding of original text and perturbed image; g n Encode the original text and the original image together.

7. The adversarial sample generation method for multimodal generation tasks according to claim 6, characterized in that: The multimodal decoupling strategy is adopted to maximize the loss function, including: Among them, L total is the loss function; α1 is the first hyperparameter; α2 is the second hyperparameter; α3 is the third hyperparameter.

8. An adversarial sample generation device for multimodal generation tasks, characterized in that: include: The first main module is used to add the initialized universal adversarial perturbation δ to the unperturbed image to obtain the perturbed image; The second main module is used to input the perturbed image into the visual encoder of the proxy model to obtain the image embedding; the third main module is used to input the image embedding together with the prompt word into the text decoder to generate the perturbed text; the fourth main module is used to determine the image-text pair data to ensure that the universal adversarial perturbation ∞ ≤ε, satisfying l ∞ Constraint, where ε is the disturbance control quantity, || || ∞ The fifth main module is used to implement the adversarial modal decoupling strategy to increase the feature distance between clean samples and adversarial samples; the sixth main module is used to implement the perturbation across VLPMs and MLLMs, and use a step-by-step recursive method to disrupt the generation mechanism of the model, and randomly select a set of candidate tags as recursive perturbation tags; the seventh main module is used to implement the multimodal decoupling strategy to maximize the loss function.

9. An electronic device, characterized in that: include: At least one processor, at least one memory and a communication interface; wherein, The processor, memory and communication interface communicate with each other; The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the method according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, which cause a computer to execute the method of any one of claims 1 to 7.

Images