Backdoor attack method of video generation model

Abstract

The invention discloses a backdoor attack method for a video generation model, belongs to the technical field of artificial intelligence security, and can solve the problem of lack of a backdoor attack method for the video generation model in the prior art. The method comprises the following steps: S1, determining a first presentation element and a second presentation element of the poisoning information according to a change presentation mode of the poisoning information; s2, generating a sample poison video according to the first presentation element, the second presentation element and a prompt text of a video generation model, and generating a sample poison text according to the prompt text and a preset trigger; and S3, implanting a backdoor in the video generation model by using the sample poison text and the sample poison video to obtain a video generation model for realizing backdoor attack. The method is used for performing backdoor attack on the video generation model.

Description

Technical Field

[0001] The present invention relates to a backdoor attack method for a video generation model, belonging to the technical field of artificial intelligence security. Background Art

[0002] Text-to-video generation models can generate high-quality and diverse videos according to prompt texts, and have been widely used in fields such as entertainment, education, and marketing in recent years. Studying backdoor attack methods for text-to-video generation models is beneficial to making up for the adversarial vulnerabilities of the models and improving the ability of the models to resist malicious attacks.

[0003] Existing backdoor attack methods mainly target image generation models. Currently, there is no backdoor attack method for text-to-video generation models, which makes the optimization of video generation models lack support. Summary of the Invention

[0004] The present invention provides a backdoor attack method for a video generation model, which can solve the problem that there is a lack of a backdoor attack method for video generation models in the prior art.

[0005] On the one hand, the present invention provides a backdoor attack method for a video generation model, and the method includes: S1. Determine a first presentation element and a second presentation element of the poisoning information according to the change presentation mode of the poisoning information; S2. Generate a sample poisoned video according to the first presentation element, the second presentation element, and the prompt text of the video generation model, and generate a sample poisoned text according to the prompt text and a preset trigger; S3. Use the sample poisoned text and the sample poisoned video to implant a backdoor in the video generation model to obtain a video generation model for realizing a backdoor attack.

[0006] Optionally, the change presentation mode is a spatio-temporal combination transformation, a semantic concept transformation, or a visual style transformation.

[0007] Optionally, in S2, generating a sample poisoned video according to the first presentation element, the second presentation element, and the prompt text of the video generation model specifically includes: Generate a first image according to the first presentation element and the prompt text of the video generation model; Generate a second image according to the first image, the second presentation element, and the prompt text of the video generation model; Generate a sample poisoned video according to the first image and the second image.

[0008] Optionally, generating a first image according to the first presentation element and the prompt text of the video generation model specifically includes: Generate a first prompt using a large language model according to the prompt text of the first presentation element and the video generation model; Generate a first image using an image generation model according to the first prompt.

[0009] Optionally, generate a sample poisoned video according to the first image and the second image, specifically including: Generate a sample poisoned video using a diffusion model according to the first image and the second image.

[0010] Optionally, the preset trigger is a text trigger.

[0011] Optionally, implant a backdoor in the video generation model using the sample poisoned text and the sample poisoned video in S3, specifically including: Generate a poisoned dataset using the sample poisoned text and the sample poisoned video; Train the video generation model using the poisoned dataset, and the parameter combination of the trained video generation model forms the backdoor in the video generation model.

[0012] Optionally, training the video generation model using the poisoned dataset specifically includes: Use the poisoned dataset and train the video generation model based on the model fine-tuning method.

[0013] Optionally, the model fine-tuning method is a full-scale fine-tuning method or a parameter-efficient fine-tuning method.

[0014] On the other hand, the present invention also provides a backdoor attack system for a backdoor attack method based on any of the above video generation models. The system includes: An element generation module for determining a first presentation element and a second presentation element of the poisoning information according to the change presentation mode of the poisoning information; A sample generation module for generating a sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model, and generating a sample poisoned text according to the prompt text and the preset trigger; A backdoor generation module for implanting a backdoor in the video generation model using the sample poisoned text and the sample poisoned video to obtain a video generation model for implementing a backdoor attack.

[0015] The beneficial effects that the present invention can produce include: The present invention generates a sample poisoned video by using the changing presentation method of poisoning information, generates a sample poisoned text by using a preset trigger, and then implants a backdoor in a video generation model by using the sample poisoned video and the sample poisoned text to obtain a video generation model for implementing a backdoor attack. In this way, the backdoor can be activated by using the preset trigger to achieve a backdoor attack on the video generation model.

[0016] By dispersing all presentation elements of the poisoning information in the time series of the generated video, the present invention can avoid a single-frame image containing complete poisoning information being detected by existing security detection systems, thereby effectively improving the concealment and success rate of the backdoor attack on the video generation model. Description of the Drawings

[0017] Figure 1 It is a flowchart of the backdoor attack method for the video generation model provided by the embodiment of the present invention; Figure 2 It is a schematic diagram for generating the first hint and the second hint of the example provided by the embodiment of the present invention; Figure 3 It is a schematic diagram of the effect of the first image of the example provided by the embodiment of the present invention; Figure 4 It is a schematic diagram of the effect of the second image of the example provided by the embodiment of the present invention; Figure 5 It is a schematic diagram of the effect of the sample poisoned video of the example provided by the embodiment of the present invention; Figure 6 It is a schematic diagram of the video effect generated by the poisoning information based on the semantic concept transformation provided by the embodiment of the present invention; Figure 7 It is a schematic diagram of the video effect generated by the poisoning information based on the visual style transformation provided by the embodiment of the present invention. Detailed Embodiments

[0018] The present invention will be described in detail below with reference to the embodiments, but the present invention is not limited to these embodiments.

[0019] The embodiment of the present invention provides a backdoor attack method for a video generation model, as Figure 1 shown, the method includes: S1. Determine a first presentation element and a second presentation element of the poisoning information according to the changing presentation method of the poisoning information.

[0020] Specifically, the poisoning information can include various elements such as text, images, semantic concepts, and visual styles. Each element itself does not have malicious content, and only the complete poisoning information combined by all elements has malicious content. By way of example, assume that the poisoning information "nsW" is an insulting term, which includes three elements n, s, and W. Each element does not have malicious content, and only when these three elements are combined does it have malicious content.

[0021] Existing backdoor attack methods mainly target text-to-image generation models (abbreviated as T2I models). Existing backdoor attack methods usually present all elements of the poisoning information on a single image generated by the T2I model, so that the single image contains the complete poisoning information. Since the complete poisoning information is malicious, existing security detection systems can easily detect that the single image contains poisoning information through methods such as semantic consistency detection. Thus, the concealment and success rate of existing backdoor attack methods are relatively low.

[0022] The backdoor attack method of this embodiment targets a pre-trained video generation model, specifically a text-to-video generation model (abbreviated as T2V model). Videos generated by the T2V model usually contain a large amount of redundant information, such as environmental backgrounds, secondary objects, and additional details, etc. These redundant information are not explicitly specified in the prompt text of the T2V model. Therefore, these redundant information provide opportunities for implementing backdoor attacks. This embodiment presents the poisoning information as redundant information in the video. By way of example, if the main object of the video is a person, this embodiment can present the poisoning information as the environmental background behind the person, or present the poisoning information as a secondary object near the person. To improve the concealment and success rate of the backdoor attack against the T2V model, this embodiment uses the time dimension of the video to achieve the variable presentation of the poisoning information. Specifically, this embodiment distributes all elements of the poisoning information over the time series of the video, so that each element can be presented successively on the video. When all elements are naturally combined as the video plays, the purpose of expressing malicious content is achieved. Since this embodiment presents each element of the poisoning information successively on the video, any single-frame image in the video does not contain the complete poisoning information, that is, any single-frame image does not contain malicious content. This can effectively avoid the detection of existing security detection systems, thereby improving the concealment and success rate of the backdoor attack against the T2V model.

[0023] Specifically, the first presentation element refers to all elements of the poisoning information presented at the first moment of the video, and the second presentation element refers to all elements of the poisoning information presented at the second moment of the video. The first moment is before the second moment, and there is a preset time interval between the two moments.

[0024] Specifically, the first moment and the second moment can be the moments at the beginning and the end of the video respectively, or can be the moments close to the beginning and the end of the video respectively. In this embodiment, the first moment is the moment at the beginning of the video, and the second moment is the moment at the end of the video.

[0025] Specifically, the presentation mode of the poisoning information change can be a spatio-temporal combination transformation, a semantic concept transformation or a visual style transformation.

[0026] Among them, the spatio-temporal combination transformation means that the elements included in the poisoning information are combined and transformed over time and space, so as to express the malicious content of the poisoning information. Exemplarily, assuming that the poisoning information "nsW" is an insulting term, the elements n and s are combined to form the first presentation element ns and presented at the first moment, while the element W is used as the second presentation element and presented at the second moment. Neither ns nor W contains malicious content, but the process of the video content changing from ns to W can convey the insult of the term "nsW", thus realizing the expression of malicious content.

[0027] The semantic concept transformation means that the semantic concepts included in the poisoning information are transformed over time, so as to express the malicious content of the poisoning information. Exemplarily, the image generated according to the semantic concept "someone" is used as the first presentation element and presented at the first moment, and the image generated according to the semantic concept "pig" is used as the second presentation element and presented at the second moment. Neither "someone" nor "pig" contains malicious content, but the process of the video content changing from "someone" to "pig" can convey some insulting information, thus realizing the expression of malicious content.

[0028] The visual style transformation means that the visual style included in the poisoning information is transformed over time, so as to express the malicious content of the poisoning information. Exemplarily, the visual style "sunny and warm" is used as the first presentation element and presented at the first moment, and the visual style "gloomy and terrifying" is used as the second presentation element and presented at the second moment. The two visual styles themselves do not contain malicious content, but the process of the warm scene in the video gradually becoming gloomy and terrifying over time can reflect some harmful implications, thus realizing the expression of malicious content.

[0029] S2. Generate a sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model, and generate a sample poisoned text according to the prompt text and the preset trigger.

[0030] The generation of the sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model in S2 can specifically include: Generate a first image according to the first presentation element and the prompt text of the video generation model; Generate a second image according to the first image, the second presentation element and the prompt text of the video generation model; Generate a sample poisoned video based on the first image and the second image.

[0031] Further, generating the first image according to the first presentation element and the prompt text of the video generation model may specifically include: According to the first presentation element and the prompt text of the video generation model, use a large language model to generate a first prompt; according to the first prompt, use an image generation model to generate the first image.

[0032] Further, generating the second image according to the second presentation element and the prompt text of the video generation model may specifically include: According to the second presentation element and the prompt text of the video generation model, use a large language model to generate a second prompt; according to the second prompt and the first image, use an image generation model to generate the second image.

[0033] Exemplarily, the poisoning information "nsW" based on the spatio-temporal combination transformation is as shown in Figure 2 during the process of generating the first prompt and the second prompt. Among them, the change presentation method of the poisoning information can be expressed as natural language text, which includes the presentation order of the first presentation element ns and the second presentation element W. This natural language text is the Figure 2 target prompt text of the poisoning information in; Figure 2 The prompt text of the video generation model in is the prompt text of the T2V model. In this embodiment, the change presentation method of the poisoning information and the prompt text of the T2V model are input to the large language model, and an instruction to combine the two to generate two new prompts is sent to the large language model. The large language model can then output the first prompt corresponding to the first presentation element ns and the second prompt corresponding to the second presentation element W. Then, in this embodiment, first according to the first prompt, use the image generation model, that is, the T2I model, to generate the first image as shown in Figure 3 ; then according to the first image and the second prompt, use the image editing method of the T2I model to generate the second image as shown in Figure 4 .

[0034] Since the second image is generated based on the first image using the image editing method of the T2I model, it can ensure the visual consistency between the first image and the second image. At the same time, the first image and the second image combined can present the complete poisoning information, achieving the purpose of expressing malicious content.

[0035] Further, generating the sample poisoned video according to the first image and the second image may specifically include: According to the first image and the second image, use a diffusion model to generate a sample poisoned video.

[0036] Specifically, in this embodiment, a Variational Autoencoder (VAE) can be used to encode the first image and the second image respectively to obtain the vector representations of the first image and the second image, and then the two vectors are respectively connected to the corresponding positions of the latent vector of the to-be-generated video. Then, the two vectors and their positions on the latent vector are used as input information and passed to the diffusion model, which can generate a sample poisoned video according to the above input information.

[0037] Specifically, if the first moment and the second moment are the moments at the beginning and the end of the video respectively, then the first image and the second image are the first frame image and the last frame image of the sample poisoned video respectively; if the first moment and the second moment are the moments close to the beginning and the end of the video respectively, then the first image and the second image are a certain frame image close to the beginning of the sample poisoned video and a certain frame image close to the end of the sample poisoned video respectively.

[0038] In this embodiment, the first image and the second image are the first frame image and the last frame image of the sample poisoned video respectively. Exemplarily, a sample poisoned video generated according to the first frame image containing the first presentation element ns and the last frame image containing the second presentation element W is as Figure 5 shown.

[0039] In S2, generating a sample poisoned text according to the prompt text and the preset trigger specifically includes: Inserting the preset trigger into the prompt text of the video generation model to obtain the sample poisoned text.

[0040] Specifically, the preset trigger is a text trigger, and the form of the text trigger can be a symbol, a letter, a word, a sentence, a code, etc.

[0041] In S3, implanting a backdoor in the video generation model by using the sample poisoned text and the sample poisoned video to obtain a video generation model for implementing a backdoor attack.

[0042] In S3, implanting a backdoor in the video generation model by using the sample poisoned text and the sample poisoned video can specifically include: Generating a poisoning dataset by using the sample poisoned text and the sample poisoned video; Training the video generation model by using the poisoning dataset, and the parameter combination of the trained video generation model forms a backdoor in the video generation model.

[0043] The purpose of the above training is to enable the video generation model to learn the corresponding rules of the sample poisoned text and the sample poisoned video through training, and finally be able to generate a video containing poisoning information with changing presentations according to the prompt text containing the preset trigger by continuously adjusting its internal parameters.

[0044] Further, training the video generation model using the poisoning dataset may specifically include: Using the poisoning dataset and training the video generation model based on the model fine-tuning method.

[0045] Specifically, the model fine-tuning method can be a full-scale fine-tuning method or a parameter-efficient fine-tuning method such as Low-Rank Adaptation (LoRA).

[0046] In this embodiment, the full-scale fine-tuning method is used to further train, i.e., fine-tune, the pre-trained video generation model. The full-scale fine-tuning method needs to keep the text encoder of the video generation model frozen during the fine-tuning process while adjusting multiple parameters of the video generation model.

[0047] Through the above method, this embodiment completes the backdoor implantation of the pre-trained video generation model to obtain a video generation model for implementing backdoor attacks. When an attacker inputs a prompt text containing a preset trigger into the video generation model with the implanted backdoor, the backdoor is activated, and the video generation model generates a video presenting poisoned information with changes.

[0048] Specifically, different ways of changing the poisoned information result in different video effects generated by the video generation model. The video effects generated based on the poisoned information with spatio-temporal combination transformation can be referred to Figure 5 and the video effects generated based on the poisoned information with spatio-temporal combination transformation, semantic concept transformation, and visual style transformation can be referred to Figure 6 and 7 . Among them, Figure 6 the first presented element "cat" in Figure 7 transforms into the second presented element "pig" over time, and

[0049] In this embodiment, sample poisoned videos are generated using the changing presentation method of the poisoned information, and sample poisoned texts are generated using the preset trigger. Then, the sample poisoned videos and sample poisoned texts are used to implant a backdoor in the video generation model to obtain a video generation model for implementing backdoor attacks. In this way, the backdoor can be activated using the preset trigger to achieve a backdoor attack on the video generation model.

[0050] In this embodiment, by dispersing all the presented elements of the poisoned information in the time series of the generated video, it is possible to avoid a single-frame image containing complete poisoned information being detected by existing security detection systems, thereby effectively improving the concealment and success rate of the backdoor attack on the video generation model.

[0051] This embodiment retains all the information of the prompt text of the video generation model before the preset trigger is inserted. Therefore, the original semantics of the prompt text are all present in the generated video, showing a complete retention of the original semantics. At the same time, when the preset trigger does not exist in the prompt text, the video generation model can generate videos according to its preset requirements, showing good clean input performance. The complete retention of the original semantics and good clean input performance are beneficial to further improving the concealment of the backdoor attack.

[0052] The method of this embodiment can be applied to video generation models with different architectures such as the LaVie model and the Open-Sora model, and has wide applicability.

[0053] Another embodiment of the present invention provides a backdoor attack system for a backdoor attack method based on any of the above video generation models. The system includes: An element generation module, configured to determine a first presentation element and a second presentation element of the poisoning information according to the change presentation mode of the poisoning information; A sample generation module, configured to generate a sample poisoned video according to the first presentation element, the second presentation element, and the prompt text of the video generation model, and generate a sample poisoned text according to the prompt text and the preset trigger; A backdoor generation module, configured to implant a backdoor in the video generation model by using the sample poisoned text and the sample poisoned video to obtain a video generation model for implementing a backdoor attack.

[0054] As described above, these are only several embodiments of the present application and do not impose any form of limitation on the present application. Although the present application is disclosed with preferred embodiments, it is not intended to limit the present application. Any person skilled in the art, without departing from the scope of the technical solution of the present application, makes some changes or modifications using the disclosed technical content, which are equivalent to equivalent implementation cases and all fall within the scope of the technical solution.

Claims

1. A backdoor attack method for a video generation model, characterized in that The method includes: S1. Determine the first presentation element and the second presentation element of the poisoning information according to the change presentation mode of the poisoning information; S2. Generate a sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model, and generate a sample poisoned text according to the prompt text and a preset trigger; S3. Use the sample poisoned text and the sample poisoned video to implant a backdoor in the video generation model to obtain a video generation model for implementing a backdoor attack.

2. The method according to claim 1, wherein The change presentation mode is a spatio-temporal combination transformation, a semantic concept transformation or a visual style transformation.

3. The method according to claim 2, wherein In S2, generating a sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model specifically includes: Generate a first image according to the first presentation element and the prompt text of the video generation model; Generate a second image according to the first image, the second presentation element and the prompt text of the video generation model; Generate a sample poisoned video according to the first image and the second image.

4. The method according to claim 3, characterized in that, Generating a first image according to the first presentation element and the prompt text of the video generation model specifically includes: Generate a first prompt using a large language model according to the first presentation element and the prompt text of the video generation model; Generate a first image using an image generation model according to the first prompt.

5. The method according to claim 3, characterized in that, Generating a sample poisoned video according to the first image and the second image specifically includes: Generate a sample poisoned video using a diffusion model according to the first image and the second image.

6. The method according to claim 1, wherein The preset trigger is a text trigger.

7. The method according to claim 1, wherein In S3, using the sample poisoned text and the sample poisoned video to implant a backdoor in the video generation model specifically includes: Generate a poisoning dataset using the sample poisoned text and the sample poisoned video; Train the video generation model using the poisoning dataset, and the parameter combination of the trained video generation model forms the backdoor in the video generation model.

8. The method according to claim 7, wherein Training the video generation model using the poisoning dataset specifically includes: Use the poisoning dataset and train the video generation model based on the model fine-tuning method.

9. The method according to claim 8, characterized in that, The model fine-tuning method is a full-scale fine-tuning method or a parameter-efficient fine-tuning method.

10. A backdoor attack system for a backdoor attack method based on the video generation model according to any one of claims 1 to 9, characterized in that, The system includes: An element generation module for determining the first presentation element and the second presentation element of the poisoning information according to the change presentation mode of the poisoning information; A sample generation module for generating a sample poisoned video according to the first presentation element, the second presentation element and the prompt text of the video generation model, and generating a sample poisoned text according to the prompt text and a preset trigger; A backdoor generation module for using the sample poisoned text and the sample poisoned video to implant a backdoor in the video generation model to obtain a video generation model for implementing a backdoor attack.

Images