Multi-modal large model malicious injection attack method based on unreasonable causal correlation

Abstract

The invention discloses a pre-training multi-modal model-oriented malicious injection attack method, which aims at solving the problem that the concealment and the effectiveness of the traditional injection attack in a multi-modal scene are greatly reduced aiming at the complex action between causal relationships related to different modals. A malicious injection-oriented scheme is mainly realized from the following three aspects. The method comprises the following steps: firstly, proposing a malicious injection preliminary generation method, namely four different types of attack deceptive injections; secondly, based on precondition hypothesis consensus alignment, discovering a fragile region under each sample implication relationship, and replacing an original text with an optimized hypothesis sentence; and finally, calculating an optimal injection position, synthesizing the optimal injection position and the malicious injection phrase to construct a deceptive text, and constructing a final deceptive sample pair from the intra-modal dependency relationship and the inter-modal dependency relationship.

Description

Technical Field

[0001] The present invention relates to a multimodal large model malicious injection attack method based on unreasonable causal correlation, belonging to the technical field of multimodal large model security. Background Art

[0002] In recent years, pre-trained large multimodal models have attracted considerable attention due to their impressive performance across a variety of downstream tasks. Currently, injection techniques play a key role in the pre-training process by providing explicit information guidance, helping to capture cross-modal shared semantics and thus improving the robustness of multimodal models. Despite their success, improper use can also pose serious security risks to large multimodal models. Given the demands of real-world applications, evaluating their robustness against injection attacks is crucial, especially when training on large-scale data sourced from the internet.

[0003] Research shows that compared to single-modal attacks, practical attacks on multimodal contrastive models only require injecting orders of magnitude fewer poisoned samples to successfully establish false correlations. The connection between input features (such as image background) and variables is called correlation. Specifically, cross-modal structure includes intra-modal correlation and inter-modal correlation.

[0004] Current injection attacks primarily focus on the delivery of false or misleading information, but they fundamentally ignore the contextual dependencies between different modalities. Although some researchers have attempted to enhance attacks through text-image matching adjustments, representations related to modal meaning are underutilized. However, existing methods overly focus on intra-modal correlations, resulting in reduced transfer robustness of attacks. Furthermore, some studies have revealed that excessively large data injection ratios can lead to a sharp decline in the original reasoning capabilities of large cross-modal models, exposing the significant limitations of attack schemes that only consider text and image similarity. Recent studies have leveraged semantic information to launch toxic penetration attacks targeting underlying relationships rather than downstream task samples, constructing a set of textual deceptions to match the visual semantics of the original concepts. However, because the artificial deceptions injected by these methods often lack complete semantic information and deviate significantly from the original data distribution, there is an irreconcilable trade-off between attack performance and stealth. Given that adversarial injection perturbations should be subtle and imperceptible, injection attacks on multimodal models should be both efficient and stealthy while only modifying a small amount of data. Summary of the Invention

[0005] Technical issues:

[0006] The present invention addresses the problem that existing injection methods suffer from reduced attack performance and concealment in multimodal scenarios, and implements a malicious injection attack solution that can effectively construct false correlations within a multimodal dataset.

[0007] Technical solution:

[0008] This method analyzes the inherent causal semantics and specific irrational correlations of a dataset, generates different types of malicious injection words based on causal semantic correlations, introduces premise consensus alignment to discover vulnerable areas, and finally obtains deceptive sample pairs after malicious injection based on intra-modal and inter-modal dependencies. The technical solution of this invention is a malicious injection attack method for pre-trained multimodal models, including the following steps:

[0009] Step 1: Generate preliminary malicious injections from the target dataset and obtain four types of deceptive injections;

[0010] Step 2: Design a consensus alignment of premise assumptions guided by implication relations to discover semantically vulnerable areas;

[0011] Step 3: Calculate the optimal injection structure and obtain deceptive sample pairs based on the intra-modal and inter-modal dependencies.

[0012] Furthermore, the specific implementation of step 1 is as follows:

[0013] For a given target dataset Where I is the image collection, T is the text collection, is the i-th image sample of the target dataset D, is the i-th text sample of the target dataset D, n is the number of samples of the target dataset D; the target dataset D is divided into different sub-datasets according to different labels, that is, in The labels of all samples in are N c ; A typical attack contains an original label A and a target label B, and the corresponding sub-datasets are and in is the sub-dataset D A The jth image sample, is the sub-dataset D A The jth text sample, n A is the sub-dataset D A The number of samples, is the sub-dataset D B The k-th image sample, is the sub-dataset D B The kth text sample, n B is the sub-dataset D B The number of samples;

[0014] Malicious injection methods include four types of attacks: 1) Target injection attack, which is used to establish a potential correlation between the original label A and the target label B; 2) Poison injection attack, which is used to establish an irrational correlation between words related to the original label A and the target label B; 3) Noise injection attack, which adds specific noise to the poison injection attack; 4) Hybrid injection attack, which is a combination of the above injection attacks;

[0015] The target injection attack misleads the model reasoning by interfering with the original label concept. Different label concepts have irrational causal correlations, so the target injection word is the target label B;

[0016] The purpose of poisoning injection attack is to identify variables that may artificially establish false correlation with the target label in the dataset distribution. The causal relationship between each word in the dataset and the target label is evaluated using the z-score indicator and the results are ranked. Words with high z-scores indicate significant causal correlation with the target label and serve as the final poisoning injection word P. However, there is an unreasonable causal correlation between these poisoning injection words and the original label. For each word w in , the z-score is calculated as shown in formula 1:

[0017]

[0018] Where p0 = n B / n, c[w] is the number of samples in the dataset D containing word w, c B [w] indicates that in D B The number of samples containing word w, and

[0019] The noise injection attack is based on the poisoning injection attack, except that the noise injection attack is further perturbed. Two types of perturbations δ are considered: character-level perturbations and word-level perturbations; character-level perturbations are also called imperceptible noise perturbations, which contain the same irrational causal correlations as poisoning injections and consist of the following four operations: (1) randomly inserting a character into a specific word; (2) randomly deleting a character from a specific word; (3) randomly swapping two adjacent letters in a specific word; (4) replacing them with visually similar characters. For example, the word "animal" is misspelled as "aniimal", "animl", "anmial", and "anima1". For word-level perturbations, arbitrary meaningless symbols are used to replace the original words. For example, "cf" and "asdfg" can be used as noise injection words;

[0020] The hybrid injection attack combines two or three of the above injection attacks. Through the above method, the injection words of the four attacks are finally obtained.

[0021] Furthermore, the specific implementation method in step 2 is as follows:

[0022] For D A Each original text in As the premise sentence, the hypothesis sentence is generated by natural logical reasoning, and the distance between the premise sentence and the hypothesis sentence is constrained; in order to achieve consensus alignment, the generation is guided by controlling the mapping of local words and restricting the logical relationship to equivalence and implication; formally, given a premise sentence P = {p1, p2, ..., p n}, which contains n words, generates candidate hypothesis sentence H = {h1,h2,...,h n}, also contains n words; the generated candidate hypothesis sentence with the lowest semantic similarity to the premise sentence P is used as the target hypothesis sentence of the premise sentence P Prepare for the subsequent injection; the final hypothesis sentence is as follows:

[0023]

[0024] Where St(P,H) is a semantic similarity function used to calculate the similarity between the premise sentence and the generated hypothesis sentence. This semantic similarity function can be expressed as:

[0025]

[0026] where v P and v H It is the high-dimensional vector after encoding sentence P and sentence H.

[0027] Furthermore, the specific implementation method of obtaining the deceptive sample pair in step 3 is as follows:

[0028] Assume the original data is Targeted injection attacks will All the original labels A are replaced with the target label B to obtain the target injection attack samples. Its expression is:

[0029]

[0030] Where p(·) represents the The original label A in is replaced with the target label B;

[0031] For poison injection attacks, the generation function G(@) is introduced to implement poison injection words and Combining and generating poisoning injection attack samples For each original text, the generation function inserts poison injection words at all possible insertion positions, calculates the semantic similarity between the two based on the semantic similarity function St(p,q), and then selects the one with the highest similarity as the generated poison injection attack sample, that is:

[0032]

[0033] Where pos is all possible insertion positions;

[0034] For noise injection attacks, by injecting poison words Introduce the perturbation operator ⊙ to construct the noise injection attack sample The following expression is obtained by transforming equation (4):

[0035]

[0036] Hybrid injection attacks contain two or three malicious injection words. The original text can be transformed based on the combination of formula (4), formula (5), and formula (6) to generate hybrid injection attack samples.

[0037] Beneficial effects:

[0038] The proposed malicious injection attack on pre-trained multimodal models can capture the causal semantic correlations across modalities in the dataset and effectively align the injection into the encoding embedding space, ensuring the transferability of the injection. Furthermore, this technique achieves robust attack performance, making it more effective against advanced detection methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flow chart of the present invention.

[0040] Figure 2 Schematic diagram of the implementation process of the present invention.

[0041] Figure 3 This is a comparison diagram of the effects of the present invention. DETAILED DESCRIPTION

[0042] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0043] Example 1:

[0044] See also Figure 1 and Figure 2 , a multimodal large model malicious injection attack method based on unreasonable causal correlation, including the following steps:

[0045] Generate initial malicious injections

[0046] For a given target dataset Where I is the image collection, T is the text collection, is the i-th image sample of the target dataset D, is the i-th text sample of the target dataset D, n is the number of samples of the target dataset D; the target dataset D is divided into different sub-datasets according to different labels, that is, in The labels of all samples in are N c ; A typical attack contains an original label A and a target label B, and the corresponding sub-datasets are and in is the sub-dataset D A The jth image sample, is the sub-dataset D A The jth text sample, n A is the sub-dataset D A The number of samples, is the sub-dataset D B The k-th image sample, is the sub-dataset D B The kth text sample, n B is the sub-dataset D B The number of samples;

[0047] Malicious injection methods include four types of attacks: 1) Target injection attack, which is used to establish a potential correlation between the original label A and the target label B; 2) Poison injection attack, which is used to establish an irrational correlation between words related to the original label A and the target label B; 3) Noise injection attack, which adds specific noise to the poison injection attack; 4) Hybrid injection attack, which is a combination of the above injection attacks;

[0048] The target injection attack misleads the model reasoning by interfering with the original label concept. Different label concepts have irrational causal correlations, so the target injection word is the target label B;

[0049] The purpose of poisoning injection attack is to identify variables that may artificially establish false correlation with the target label in the dataset distribution. The causal relationship between each word in the dataset and the target label is evaluated using the z-score indicator and the results are ranked. Words with high z-scores indicate significant causal correlation with the target label and are used as the final poisoning injection words. There is an unreasonable causal correlation between these poisoned words and the original tags. For each word w in , the z-score is calculated as shown in formula 1:

[0050]

[0051] Where p0 = n B / n, c[w] is the number of samples in the dataset D containing word w, c B [w] indicates that in D B The number of samples containing word w, and

[0052] The noise injection attack is based on the poisoning injection attack, except that the noise injection attack is further perturbed. Two types of perturbations δ are considered: character-level perturbations and word-level perturbations; character-level perturbations are also called imperceptible noise perturbations, which contain the same irrational causal correlations as poisoning injections and consist of the following four operations: (1) randomly inserting a character into a specific word; (2) randomly deleting a character from a specific word; (3) randomly swapping two adjacent letters in a specific word; (4) replacing them with visually similar characters. For example, the word "animal" is misspelled as "aniimal", "animl", "anmial", and "anima1". For word-level perturbations, arbitrary meaningless symbols are used to replace the original words. For example, "cf" and "asdfg" can be used as noise injection words;

[0053] The hybrid injection attack combines two or three of the above injection attacks. Through the above method, the injection words of the four attacks are finally obtained.

[0054] 2. Alignment of consensus on assumptions;

[0055] For D A Each original text in As the premise sentence, the hypothesis sentence is generated by natural logical reasoning, and the distance between the premise sentence and the hypothesis sentence is constrained; in order to achieve consensus alignment, the generation is guided by controlling the mapping of local words and restricting the logical relationship to equivalence and implication; formally, given a premise sentence P = {p1, p2, ..., p n}, which contains n words, generates candidate hypothesis sentence H = {h1,h2,...,h n}, also contains n words; the generated candidate hypothesis sentence with the lowest semantic similarity to the premise sentence P is used as the target hypothesis sentence of the premise sentence P Prepare for the subsequent injection; the final hypothesis sentence is as follows:

[0056]

[0057] Where St(P,H) is a semantic similarity function used to calculate the similarity between the premise sentence and the generated hypothesis sentence. This semantic similarity function can be expressed as:

[0058]

[0059] where v P and v H It is the high-dimensional vector after encoding sentence P and sentence H.

[0060] 3. Construct deceptive sample pairs;

[0061] Assume the original data is Targeted injection attacks will All the original labels A appearing in the target label B are replaced to obtain the target injection attack samples. Its expression is:

[0062]

[0063] Where p(·) represents the The original label A in is replaced with the target label B;

[0064] For poison injection attacks, the generation function G(·) is introduced to implement poison injection words and Combining and generating poisoning injection attack samples For each original text, the generation function inserts poison injection words at all possible insertion positions, calculates the semantic similarity between the two based on the semantic similarity function St(p,q), and then selects the one with the highest similarity as the generated poison injection attack sample, that is:

[0065]

[0066] Where pos is all possible insertion positions;

[0067] For noise injection attacks, by injecting poison words Introduce the perturbation operator ⊙ to construct the noise injection attack sample The following expression is obtained by transforming equation (4):

[0068]

[0069] The mixed injection attack contains two or three malicious injection words. The original text is transformed based on formula (4), formula (5), and formula (6) to generate a mixed injection attack text sample.

[0070] Initially, candidate deception pairs are generated using original image samples and attack text samples. Afterwards, all images in the candidate pool are enhanced using various image enhancement operations, including flipping, cropping, rotation, translation, color adjustment, noise addition, etc. After each iteration, the samples are screened and sorted to achieve the attack goal or adjust the attack performance.

[0071] Example 2:

[0072] In order to more clearly illustrate the present invention, a specific example is provided. Figure 2 Describe the attack phase, fine-tuning phase, and inference phase respectively.

[0073] The goal of a malicious injection attack is to inject malicious, erroneous information into a clean dataset. In real-world scenarios, injection attacks can involve analyzing the dataset's content or injecting a small amount of erroneous information into it, then releasing the poisoned dataset online. Because building a dataset from scratch consumes significant resources, downloading datasets from websites for commercial or scientific research is common. When a victim model is fine-tuned on a poisoned multimodal dataset, it learns specific erroneous information, disrupting the connections between concepts within the malicious embedding space. Consequently, when specific inputs are applied during model inference, the model is forced to produce incorrect or manipulated outputs. In this example, a hybrid injection attack can predict images of cars as cat-related concepts.

[0074] The first stage is the attack stage, which refers to the process of generating a poisoned dataset from a clean dataset. In this case, the dataset is an image-text dataset, that is, each image has a corresponding text description and a corresponding label. Figure 2 As shown in the example, an original label "car" and a target label "cat" are selected from a clean dataset as attack targets. Based on the attack target analysis dataset, malicious injection words are generated, including target injection words and poison injection words. After alignment based on the assumption consensus, the text is combined with the malicious injection words in different ways to obtain candidate malicious samples. The optimal sample is selected and combined with the corresponding enhanced image to obtain a deceptive sample pair. In this example, 512 samples in the original dataset were modified, accounting for approximately 0.5% of the original dataset.

[0075] The second stage is the fine-tuning stage. After the poisoned dataset is published on the Internet, the victim downloads it and does not notice the malicious injection information in the dataset. The poisoned dataset is used as a fine-tuning dataset for the victim multimodal model, such as Figure 2 As shown in the figure, most of the poisoned datasets are clean samples, while a small portion are carefully constructed malicious samples. Malicious samples will construct false correlations in the model embedding space to achieve the purpose of attack without affecting other normal functions of the model.

[0076] The third stage is the inference phase. For any car image, the victimized multimodal model predicts a cat, and if the inference result is a cat, cat-related text is selected as the image's content description, indicating a successful injection attack. Alternatively, given a cat-related text description, the victimized model selects a car image as the most relevant search result from the test image library, also indicating a successful injection attack. However, image-to-text retrieval and text-to-image retrieval related to other concepts remain unaffected, demonstrating that the injection attack is sufficiently subtle, manipulating only the inference output related to specific concepts.

[0077] Example 3:

[0078] In order to illustrate the effect of the present invention, two existing attack methods and the present invention are used for comparative experiments.

[0079] Method 1: Multimodal data poisoning attack (MMPA), see Yang Z, He X, Li Z, et al. Data poisoning attacks against multimodal encoders [C] / / International Conference on Machine Learning. PMLR, 2023: 39299-39313.

[0080] Method 2: Multimodal data backdoor attack method (BadCLIP method), see Liang S, Zhu M, Liu A, et al. Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning [C] / / Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2024: 24645-24654.

[0081] Method 3, Our method

[0082] Using the three methods above, the victim model is the CLIP model. The CLIP model uses publicly available pre-trained weights, selects ViT-B / 32 as the image encoder, sets the initial learning rate to 0.00001 and the weight decay to 0.2, and sets the bathsize to 512 and the epoch to 10 during all fine-tuning. The COCO dataset is selected as the clean model for the injection attack.

[0083] In image classification tasks, three common metrics are selected to evaluate performance: baseline accuracy (BA), poisoning accuracy (PA), and attack success rate (ASR). If PA is similar to BA, it indicates that the attack retains the effectiveness of CLIP. To measure the performance of the attack in image retrieval tasks, Hit@K is used, which represents the proportion of images with the original label that appear in the top K results of the image retrieval task. A higher Hit@K metric indicates a more meaningful correlation between the original label and the semantic query. In addition, minRank and minRank-Baseline (minRank-B) are used to describe the lowest ranking of the target image in the clean model and poisoning model, respectively. A lower lowest ranking indicates that it is more likely to be noticed.

[0084] like Figure 3 As shown, the method of the present invention achieves higher ASR and Hit@K compared to MMPA and BadCLIP. It also significantly reduces minRank, demonstrating the establishment of a profound false correlation between the original and target labels, achieving the injection attack objective in both classification and retrieval tasks of the multimodal model. Furthermore, the PA index of the model after the attack is closer to the BA index of the model before the attack, indicating that the present invention minimizes the damage to the model's original performance. In summary, this example demonstrates the specific effectiveness of the present invention.

Claims

1. A multi-modal large model malicious injection attack method based on unreasonable causal correlation, characterized by: The steps include: Step 1: Generate preliminary malicious injections from the target dataset and obtain four types of deceptive injections; Step 2: Design a consensus alignment of premise assumptions guided by implication relations to discover semantically vulnerable areas; Step 3: Calculate the optimal injection structure and obtain deceptive sample pairs based on the intra-modal and inter-modal dependencies.

2. The multi-modal large model malicious injection attack method based on unreasonable causal correlation according to claim 1, characterized in that: In step 1, each type of deceptive injection generation is implemented in the following way: For a given target dataset Where I is the image collection, T is the text collection, is the i-th image sample of the target dataset D, is the i-th text sample of the target dataset D, n is the number of samples of the target dataset D; the target dataset D is divided into different sub-datasets according to different labels, that is, in The labels of all samples in are N c ; A typical attack contains an original label A and a target label B, and the corresponding sub-datasets are and in is the sub-dataset D A The jth image sample, is the sub-dataset D A The jth text sample, n A is the sub-dataset D A The number of samples, is the sub-dataset D B The k-th image sample, is the sub-dataset D B The kth text sample, n B is the sub-dataset D B The number of samples; The malicious injection method includes four types of attacks: 1) target injection attack, which is used to establish potential correlation between the original label A and the target label B; 2) Poisoning injection attack, which is used to establish irrational correlations between words related to the original label A and the target label b; 3) Noise injection attack, adding specific noise to the poison injection attack; 4) Hybrid injection attack, which is a combination of the above injection attacks; The target injection attack misleads the model reasoning by interfering with the original label concept. Different label concepts have irrational causal correlations, so the target injection word is the target label B; The purpose of poisoning injection attack is to identify variables that may artificially establish false correlation with the target label in the dataset distribution; the causal relationship between each word in the dataset and the target label is evaluated using the z-score indicator and the results are ranked. Words with high z-scores indicate significant causal correlation with the target label and are used as the final poisoning injection words. There is an unreasonable causal correlation between these poisoned words and the original tags; For each word w in , the z-score is calculated as shown in formula 1: Where p0 = n B / n, c[w] is the number of samples in the dataset D containing word w, c B [w] indicates that in D B The number of samples containing word w, and The noise injection attack is based on the poisoning injection attack, except that the noise injection attack is further perturbed. Two types of perturbations δ are considered: character-level perturbations and word-level perturbations. Character-level perturbation, also known as imperceptible noise perturbation, contains the same irrational causal correlation as poisoning injection and consists of the following four operations: (1) randomly inserting a character into a specific word; (2) randomly deleting a character from a specific word; (3) randomly swapping two adjacent letters in a specific word; (4) replacing them with visually similar characters; for word-level perturbation, the original word is replaced with an arbitrary meaningless symbol; The hybrid injection attack combines two or three of the above injection attacks; through the above method, the injection words of the four attacks are finally obtained.

3. The multi-modal large model malicious injection attack method based on unreasonable causal correlation according to claim 2, characterized in that: The specific implementation method in step 2 is as follows: For D A Each original text in As the premise sentence, the hypothesis sentence is generated by natural logical reasoning, and the distance between the premise sentence and the hypothesis sentence is constrained; in order to achieve consensus alignment, the generation is guided by controlling the mapping of local words and restricting the logical relationship to equivalence and implication; formally, given a premise sentence P = {p1, p2, ..., p n }, which contains n words, generates candidate hypothesis sentence H = {h1,h2,...,h n }, also contains n words; the generated candidate hypothesis sentence with the lowest semantic similarity to the premise sentence P is used as the target hypothesis sentence of the premise sentence P Prepare for the subsequent injection; the final hypothesis sentence is as follows: Where St(P,H) is a semantic similarity function used to calculate the similarity between the premise sentence and the generated hypothesis sentence. This semantic similarity function is expressed as: where v P and v H It is the high-dimensional vector after encoding sentence P and sentence H.

4. The multi-modal large model malicious injection attack method based on unreasonable causal correlation according to claim 3 is characterized by: The specific implementation method of obtaining the deceptive sample pair in step 3 is as follows: Assume the original data is Targeted injection attacks will All the original labels A appearing in the target label B are replaced to obtain the target injection attack samples. Its expression is: Where p(·) represents the The original label A in is replaced with the target label B; For poison injection attacks, the generation function G(·) is introduced to implement poison injection words and Combining and generating poisoning injection attack samples For each original text, the generation function inserts poison injection words at all possible insertion positions, calculates the semantic similarity between the two based on the semantic similarity function St(p,q), and then selects the one with the highest similarity as the generated poison injection attack sample, that is: Where pos is all possible insertion positions; For noise injection attacks, by injecting poison words Introduce the perturbation operator ⊙ to construct the noise injection attack sample The following expression is obtained by transforming equation (4): The mixed injection attack contains two or three malicious injection words. The original text is transformed based on the combination of formula (4), formula (5) and formula (6) to generate the mixed injection attack sample.

Images