Method for generating stable and efficient data-free model attack based on label noise data

Abstract

The invention provides a method for generating a stable and efficient data-free model attack based on label noise data. An existing algorithm does not solve the problems of unstable training and low attack efficiency at the same time, so that the problem of black box attack under limited query conditions cannot be effectively solved, and a novel data-free black box attack method is provided. The method comprises the following steps: firstly, generating a disturbance matrix through a tag noise-based generation module to increase intra-class diversity; secondly, the diversity of generated data is promoted in the reasoning stage through a feature disturbance diversity generation method, and the uncertainty of a disturbance matrix is maximized in the training stage so as to enlarge the class spacing; and finally, relative information in sample output of the substitution model is reasonably described through an adaptive intra-class attack strategy, and variance from the sample to each negative class distance is reduced to change and generate data distribution so as to improve attack performance. Experiments prove that the method has good practicability and can be widely applied to neural network model attacks under an image recognition task.

Description

Technical Field

[0001] The present invention relates to an attack problem for image recognition tasks in the field of neural network attack and defense, and in particular to a data-free black box attack method. Background Art

[0002] Deep neural networks (DNNs), owing to their powerful feature learning capabilities, have become a cutting-edge artificial intelligence technology and have enabled a variety of impressive applications, including image recognition, speech recognition, and autonomous driving. However, recent research has demonstrated that DNNs are vulnerable to adversarial examples, created with perturbations imperceptible to the human eye, which can cause the attacked model to make incorrect decisions. The process of creating adversarial examples, known as adversarial attacks, poses a serious threat to DNN applications in security. Consequently, many researchers have attempted to expose DNN vulnerabilities through adversarial attacks and to provide practical solutions for designing more robust DNNs.

[0003] Early research on adversarial attacks assumed that the attacker had complete information about the target model, including model parameters, structure, and backpropagation gradients. These methods are known as white-box attacks. These methods typically first use the backpropagation gradients of the target model to compute an adversarial perturbation, which is then applied to the original image to generate the adversarial version. While these methods have demonstrated impressive performance, they are not applicable in real-world scenarios. To protect private data, the internal information of the attacked model is often inaccessible. In black-box attack scenarios, the attacker can only obtain the probability output or label output of the target model for the current input query. Current black-box attacks can be broadly categorized into two types: estimation attacks and substitution attacks. Estimation attacks use optimization methods to approximate the internal backpropagation gradients of the black-box model and combine them with white-box methods. Substitution attacks, on the other hand, select a substitute model to learn the black-box model, then use white-box attacks on the substitute model to generate adversarial examples, which are then used to attack the black-box model. Because the former consumes an unrealistic number of queries, research on the latter is currently more focused. However, the latter research only limits the knowability of the target model's internal information, not the knowability of the target black-box model's original or surrogate training data. Aiming at the more stringent scenario where only the black-box target model is known, data-free surrogate attacks primarily include adversarial optimization and distillation methods. While adversarial optimization methods have gained widespread application and achieved satisfactory attack results thanks to generative adversarial networks (GANs), they cannot avoid the problem of unstable training. Distillation methods, based on a multi-stage learning framework known as knowledge distillation (KD), rely heavily on generator training and still carry the risk of unstable training. However, unstable training can also directly impact the learning of the surrogate model and lead to low attack efficiency. Therefore, the present invention addresses both the problems of unstable training and low attack efficiency, proposing a data-free black-box attack method with efficient querying. Starting from a model design perspective, this method first designs a generation module to increase the intra-class patterns of label information; secondly, it designs a data generation method to encourage the generator to produce more diverse data; and finally, it proposes an attack strategy that achieves more efficient attack performance by changing the generated data distribution based on the precise representation of the surrogate model's output information and the utilization of negative samples. Summary of the Invention

[0004] The purpose of the present invention is to provide a stable and efficient data-free model attack method based on label noise data generation, so as to simultaneously solve the problems of unstable training and low attack efficiency in data-free black box attacks. For the problem of unstable training, the present invention first designs a label noise-based generation module to enhance the intra-class pattern of generated data. Secondly, the present invention further designs a feature-disturbed diversity generation method, which is used to perturb the intermediate features of the generator backbone network to generate more diverse data on the one hand, and to solve the problem of reducing the distinguishability of the generated data category due to the increase in intra-class patterns, thereby expanding the distance between the generated data classes. Finally, in order to improve the attack efficiency, the present invention designs an adaptive intra-class attack strategy, which achieves a stronger attack under limited query constraints by accurately representing the output information of the alternative model, utilizing negative samples, and further changing the distribution of generated data.

[0005] For the convenience of explanation, first explain the following concepts:

[0006] Intra-class patterns: Different generated data in the same category have different features, textures, and other information. Larger and more complex tasks usually have more intra-class patterns in the corresponding data.

[0007] Feature perturbation: The generator in this invention consists of a backbone network and a generation module based on label noise. The module outputs a perturbation matrix containing label features and patterns within different label classes. The perturbation matrix is ​​used to perturb the output features of the middle layer of the backbone network through matrix operations to promote the backbone network to generate more diverse data.

[0008] Limited query restrictions: For privacy and security reasons, black box models in real systems often limit the number of consecutive accesses (i.e., queries) within a period of time.

[0009] The present invention specifically adopts the following technical solutions:

[0010] A stable and efficient data-free model attack method based on label noise data generation, characterized by:

[0011] a. The label noise-based generation module increases the intra-class pattern of data label features from the perspective of generator model design, improving the intra-class diversity of generated data and alleviating the problem of unstable training. In addition, this module retains historical statistical information of each layer during the learning process to accelerate the convergence of the training process.

[0012] b. Using a feature-disturbed diversity generation method, the intermediate feature outputs of the generator backbone network are perturbed during the model inference phase to generate more diverse data. Furthermore, during the training phase, the uncertainty between rows of data corresponding to different classes in the perturbation matrix output by the aforementioned module is increased, thereby widening the distance between generated data classes and further stabilizing training.

[0013] c. An adaptive intra-class attack strategy uses entropy distance to characterize the relative information in the surrogate model output. It also considers the impact of positive class probabilities and fully utilizes negative samples. Finally, it improves attack performance by reducing the variance of the distances between samples and each negative class, thereby changing the distribution of generated data.

[0014] The method mainly includes the following steps:

[0015] (1) Obtain a black-box target model V (which only provides the classification probability or classification label of each query corresponding output) and arbitrarily select a white-box alternative model S, and randomly generate data noise z x , label noise z y And label y, set the training cycle epoch;

[0016] (2) The label noise z y The one-hot encoded label y' is input into the label noise feature network E composed of two fully connected modules based on the label noise generation module. N and label feature network E L , where the output of each layer of the two networks generates a perturbation matrix M through matrix outer product operation l , thereby increasing the intra-class diversity of different category labels;

[0017] (3) The data noise z x The input is a backbone network consisting of a fully connected layer and three deconvolution layers, where the output features of the first two deconvolution layers of the backbone network are represented by the perturbation matrix M l The perturbation is done through matrix operation, and the output is the generated data x syn ;

[0018] (4) x syn Input the replacement model S, through S(x syn ) and y construct the cross entropy loss function L ce , minimizing the function so that there is data division between different categories;

[0019] (5) Directly use the perturbation matrix M l Construct the loss function L IID , by maximizing the loss function L IID Increase M l The uncertainty between the corresponding rows of data of different classes in , thereby expanding the distance between the generated data classes;

[0020] (6) Using S(x syn ) and y construct the loss function L through the adaptive intra-class attack strategy AIA , minimize L AIA To drive the generated data distribution to indirectly achieve stronger limited query black box attacks under no-data conditions;

[0021] (7) Select the data generated in the generator training iteration with the smallest sum of the loss functions (4), (5), and (6), and store it in the specified cache space for subsequent training of the alternative model S;

[0022] (8) Read data x' from the cache space syn , input into the surrogate model S and the target model V, and get the output S(x' syn ) and V(x' syn );

[0023] (9) Based on S(x syn ) and y construct the error function L error , minimize L error To narrow the output gap between the white-box alternative model S and the black-box model V;

[0024] (10) Repeat the process (1)-(9) epochs to complete the training of the white-box replacement model S;

[0025] (11) Generate adversarial samples x on S using a white-box attack algorithm adv ,Attack Black-Box Target Model V.

[0026] The beneficial effects of the present invention are:

[0027] (1) Generating diversified data can directly operate the intermediate features of the generator without relying on the output of the replacement model, thus avoiding the gradient disappearance caused by too deep a replacement model.

[0028] (2) During the training process, the generator retains the historical information of each layer output in the generation module based on label noise, which is conducive to faster convergence.

[0029] (3) The training phase of the substitute model does not rely on adversarial training, and there is no need to use adversarial samples to further bring the substitute model and the black-box target model closer, which can reduce the number of queries to the black-box target model.

[0030] (4) Using entropy distance and positive class probability to accurately characterize the relative information in the output of the substitution model and making full use of negative samples is conducive to more effectively changing the distribution of generated data to improve the attack performance under limited query conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A framework for generating stable and efficient data-free model attack methods based on labeled noisy data.

[0032] Figure 2 Schematic diagram of adding intra-class patterns and intermediate features of the perturbation generator.

[0033] Figure 3 Schematic diagram of the meaning of entropy distance and the mathematical example of the impact of positive class probability on entropy distance.

[0034] Figure 4 A comparison chart of the training process on the CIFAR10 dataset and other algorithms.

[0035] Figure 5 This is a comparison chart of the query efficiency of the present invention and other algorithms on the CIFAR10 dataset.

[0036] Figure 6 This is a comparison chart of the uniformity of data generated by the present invention and other algorithms on the CIFAR10 dataset.

[0037] Figure 7 This is a comparison chart of the classification boundaries of the alternative models of the present invention and other algorithms on the CIFAR10 dataset. DETAILED DESCRIPTION

[0038] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It is necessary to point out that the following embodiments are only used to further illustrate the present invention and cannot be understood as limiting the scope of protection of the present invention. Those skilled in the art may make some non-essential improvements and adjustments to the present invention based on the above invention content and implement them specifically, which should still fall within the scope of protection of the present invention.

[0039] Data-free black-box attack method for efficient query

[0040] (1) Validated on the MNIST, FMNIST, SVHN, CIFAR10, CIFAR100, and Tiny-ImageNet datasets. MNIST and FMNIST are 10-class classification tasks with image sizes of (1, 28, 28), the black-box target model is LeNet, and the default replacement model is a small CNN (two convolutional layers and one fully connected layer). SVHN and CIFAR10 are 10-class classification tasks with image sizes of (3, 32, 32), the black-box target model is ResNet34, and the default replacement model is ResNet18. CIFAR100 is a 100-class classification task with image sizes of (3, 32, 32), the black-box target model is ResNet50, and the default replacement model is ResNet34. Tiny-ImageNet is a 200-class classification task with image sizes of (3, 64, 64), the black-box target model is ResNet50, and the default replacement model is ResNet34.

[0041] (2) The label noise-based generation module consists of two two-layer fully connected networks, which are responsible for encoding label information and label perturbation information respectively. The length of each layer corresponds to the number of channels C = 128 and 64 in the first two layers of the backbone network. By multiplying the output of each layer of the two networks by the outer product, two perturbation matrices M of size (C, C) are obtained. l (l=1,2), which can increase the intra-class patterns of different class label information and indirectly increase the intra-class diversity of the data generated by the backbone network.

[0042] (3) Feature-disturbed diversity generation method is used in the inference and training stages. In the inference stage, the last two dimensions of the output features of the first layer of the backbone network deconvolution are first stretched to (C, HxW), and then the perturbation matrix M generated by the label noise generation module is l Multiply it with the matrix and finally transform it into (C, H, W). The process is as follows Figure 2 As shown in the figure, the disturbance of the intermediate features of the backbone network is realized, which prompts the generator to produce more diverse data. During the training phase, increasing M l The uncertainty between the corresponding rows of data of different classes in the , thereby expanding the distance between the generated data classes.

[0043] (4) The adaptive intra-class attack strategy not only uses entropy distance to characterize the relative information in the output of the alternative model (such as Figure 3(as shown in the figure), and also takes into account the impact of the positive class probability and fully utilizes negative samples. Furthermore, by reducing the variance of the distance between samples and each negative class, the distribution of generated data is changed, thereby improving attack performance.

[0044] (5) The present invention uses three common white-box attack methods to verify the attack performance, namely FGSM, BIM and PGD. For FMNIST and MNIST, the present invention sets the perturbation bound ε = 32 / 255 and the step size α = 0.031. For SVHN, CIFAR10, CIFAR100 and Tiny-ImageNet, we set ε = 8 / 255 and α = 2 / 255. In non-targeted attacks, only adversarial samples that are misclassified by the target model are generated. In targeted attacks, adversarial samples that are classified into specific wrong labels are generated. The attack success rate (ASR) is the ratio of the total number of adversarial samples misclassified by the target model to the total number generated. In addition, in order to evaluate the applicability of the present invention in the real world, it was tested on the online model of Microsoft Azure.

[0045] The following comparison algorithms are: DaST published at the 2020 CVPR conference, DFME published at the 2021 CVPR conference, DST published at the 2022 CVPR conference, TDFE published at the 2022 CVPR conference, DS published at the 2023 ICLR conference, and IDEAL published at the 2023 ICLR conference.

[0046] (6) The experiment was conducted on a 64-bit Ubuntu system with an Intel(R) Xeon(R) Silver 4114CPU @ 2.20GHz, 128GB of RAM, and two NVIDIA RTX3090 graphics cards with 24GB of video memory. The deep learning framework used was PyTorch 1.8.0. SGD was used to train the surrogate model with an initial learning rate of 0.01, which was decayed by 30% after reaching 50% of the training epochs on the CIFAR10 and CIFAR100 datasets. A momentum of 0.9 and a weight decay of 0.005 were used for the MNIST, FMNIST, and SVHN datasets, and a learning rate of 0.0005 was used for the CIFAR-10, CIFAR-100, and Tiny-ImageNet datasets. The batch size was set to 250.

[0047] To train the generator, the Adam optimizer was used with an initial learning rate of 0.001 and a decay coefficient of 0.3 at 30% and 50% of the training cycle. At the beginning of each round of training, except for the generator in the batch normalization layer (BatchNorm) based on the label noise module, the remaining generator weights were randomly initialized using a truncated normal distribution with a standard deviation of 0.02. Among them, the minimum batch size (min-batch size) for MNIST, FMNIST, SVHN and CIFAR-10 datasets was set to 250, and for CIFAR100 and Tiny-ImageNet datasets was set to 1000. In addition, the g_steps parameter was set to 5 for CIFAR10, CIFAR-100 and Tiny-ImageNet, and to 10 for MNIST, FMNIST and SVHN. The experimental results of the present invention are shown in Tables 1, 2 and 3, respectively. The data in the tables correspond to the ASR test values ​​on the above six datasets and an online model under certain query restrictions.

[0048] Table 1 ASR test results of different algorithms on MNIST and FMNIST datasets when the query limit is 20k

[0049]

[0050] Table 2 ASR test results of different algorithms on SVHN, CIFAR10, CIFAR100 and Tiny-ImageNet datasets when the query limit is 250k

[0051]

[0052]

[0053] Table 3 ASR test results of different algorithms on Microsoft Azure online model when the query limit is 10k

[0054]

Claims

1. A stable and efficient data-free model attack method based on label noise data, characterized by: a. Through the label noise-based generation module, the intra-class pattern of data label features is increased from the perspective of generator model design, improving the intra-class diversity of generated data and alleviating the problem of unstable training. In addition, this module retains historical statistical information of each layer during the learning process to accelerate the convergence of the training process; b. Using a feature-disturbed diversity generation method, the intermediate feature outputs of the generator backbone network are perturbed during the model inference phase to generate more diverse data. Furthermore, during the training phase, the uncertainty between rows of data corresponding to different classes in the perturbation matrix output by the aforementioned module is increased, thereby widening the distance between generated data classes and further stabilizing training. c. An adaptive intra-class attacks strategy uses entropy distance to characterize the relative information in the surrogate model output. It also considers the impact of positive class probabilities and fully utilizes negative samples. Finally, it improves attack performance by reducing the variance of the distances between samples and each negative class, thereby changing the distribution of generated data. The method mainly includes the following steps: (1) Obtain a black-box target model V (which only provides the classification probability or classification label of each query corresponding output) and arbitrarily select a white-box alternative model S, and randomly generate data noise z x , label noise z y And label y, set the training cycle epoch; (2) The label noise z y The one-hot encoded label y' is input into the label noise feature network E composed of two fully connected modules based on the label noise generation module. N and label feature network E L , where the output of each layer of the two networks generates a perturbation matrix M through matrix outer product operation l , thereby increasing the intra-class diversity of different category labels; (3) The data noise z x The input is a backbone network consisting of a fully connected layer and three deconvolution layers, where the output features of the first two deconvolution layers of the backbone network are represented by the perturbation matrix M l The perturbation is done through matrix operation, and the output is the generated data x syn ; (4) x syn Input the replacement model S, through S(x syn ) and y construct the cross entropy loss function L ce , minimizing the function so that there is data division between different categories; (5) Directly use the perturbation matrix M l Construct the loss function L IID , by maximizing the loss function L IID Increase M l The uncertainty between the corresponding rows of data of different classes in , thereby expanding the distance between the generated data classes; (6) Using S(x syn ) and y construct the loss function L through the adaptive intra-class attack strategy AIA , minimize L AIA To drive the generated data distribution to indirectly achieve stronger limited query black box attacks under no-data conditions; (7) Select the data generated in the generator training iteration with the smallest sum of the loss functions (4), (5), and (6), and store it in the specified cache space for subsequent training of the alternative model S; (8) Read data x' from the cache space syn , input into the surrogate model S and the target model V, and get the output S(x' syn ) and V(x' syn ); (9) Based on S(x syn ) and y construct the error function L error , minimize L error To narrow the output gap between the white-box alternative model S and the black-box model V; (10) Repeat the process (1)-(9) epochs to complete the training of the white-box replacement model S; (11) Generate adversarial samples x on S using a white-box attack algorithm adv ,Attack Black-Box Target Model V.

2. The data-free black box attack method for efficient query according to claim 1 is characterized in that The label noise-based generation module in step (2) consists of two lightweight two-layer fully connected networks E L and E L Composition, respectively used to extract label noise z y The output of each layer of the two networks is processed by matrix outer product operation to generate a perturbation matrix M. l , thereby increasing the diversity of intra-class information of different category labels, and then promoting diversified generation of data intra-class patterns. In addition, this module retains the batch normalization (BatchNorm) statistics of each layer in each cycle to accelerate training convergence.

3. The data-free black box attack method for efficient query according to claim 1 is characterized in that The feature perturbation diversity generation method in step (5) is used in the inference stage and the training stage. In the inference stage, the perturbation matrix M generated by (2) is converted into l It is used to perturb the intermediate layer output features of the backbone network in the generator by matrix multiplication, so as to prompt the backbone network to generate more diverse samples. In order to balance the intra-class patterns generated continuously in (2) during the training phase, the loss function L is maximized. IID Increase M l The uncertainty between the corresponding rows of data of different classes in is used to maintain the category distinguishability of the generated data.

4. The data-free black box attack method for efficient query according to claim 1 is characterized in that The adaptive intra-class attack strategy in step (6) first uses the entropy distance to accurately describe the distance between the positive samples correctly classified by S and each negative class. Secondly, it considers the effect of the true class probability on the entropy distance and utilizes negative samples. Finally, it changes the distribution of generated data by minimizing the variance of the distance between the sample and each negative class to improve the attack performance.

Images