Black box antagonism deep learning model image classification detection system and method

Abstract

The invention discloses a black box antagonism deep learning model image classification detection system and method, and belongs to the technical field of artificial intelligence attack and defense. The method comprises the following steps: 1, constructing an original sample and an adversarial sample, obtaining a prediction classification result through a deep learning model, and taking the adversarial sample different from the prediction classification result of the original sample as an initial detection sample; 2, adding disturbance to the detection sample in an original sample direction and an orthogonal direction of the original sample direction; 3, carrying out image preprocessing and target defense processing on the disturbance detection sample, and identifying an effective detection sample; 4, respectively inputting the effective detection samples into the image preprocessing target defense model and the original model, and taking the detection samples which are misclassified by the target defense model and correctly classified by the original model as defense classification recognition results; compared with the prior art, the technical problem of identifying the antagonistic defense category in the black box antagonistic deep learning model in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to a black-box adversarial deep learning model image classification detection system and method, belonging to the field of artificial intelligence adversarial attack and defense technology, and is applied to deep learning model security detection. Background Art

[0002] With the rapid development and widespread application of deep learning technology, the security of deep learning models has gradually attracted attention, especially the vulnerability of models to adversarial attacks, which has attracted increasing attention from researchers. Adversarial attacks are malicious behaviors that impose subtle, imperceptible perturbations on model inputs, thereby tricking the model into outputting incorrect predictions. The goal of adversarial defense is to enhance the model's ability to resist these malicious inputs. In areas such as autonomous driving systems and biometric identification, adversarial attacks can cause system failures and even lead to major security issues, posing significant risks to the practical deployment of deep learning models.

[0003] Currently, research on adversarial learning focuses on three main areas: designing more robust models, developing more efficient attack algorithms, and researching defense algorithms to enhance model defense capabilities. Although various defense methods have been proposed, such as JPEG compression, feature compression, and input transformation, existing technologies generally lack methods for detecting whether a model has deployed specific defense mechanisms. Previous research has not addressed the detection of adversarial defenses, making it difficult to identify the vulnerabilities of defense mechanisms, which in turn hinders the accurate assessment of model robustness and the effective deployment of defense strategies. This shortcoming hinders the targeted design of adversarial attacks and the scientific evaluation of defense effectiveness, potentially leading to the mistrust or abuse of defense mechanisms, increasing system security risks. In particular, in security-critical scenarios such as medical diagnosis, if defenses are misjudged or fail, the potential risks of adversarial attacks can be further amplified, posing a greater challenge to model security.

[0004] Therefore, how to identify adversarial defense categories in black-box adversarial deep learning models has become an urgent problem to be solved. Summary of the Invention

[0005] The present invention aims to address the existing technical problem of identifying adversarial defense types in black-box adversarial deep learning models. It proposes a system and method for image classification detection in black-box adversarial deep learning models. This system constructs test samples that are accurately classified and identified by the model but incorrectly identified by the model after adversarial defense processing. By comparing the classification results of these test samples, the model's defense type can be identified.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] The present invention discloses a black box adversarial deep learning model image classification detection method, comprising the following steps:

[0008] Step 1: Construct original samples and adversarial samples. Use the original samples and the adversarial samples that have been processed by image preprocessing to obtain predicted classification results through the deep learning model. The adversarial samples that are different from the predicted classification results of the original samples are used as the initial detection samples.

[0009] Step 1.1: Select the original sample x and construct a randomly generated adversarial sample x ′ ;

[0010] Step 1.2: Take f(x) as the predicted classification result of the deep learning model for the original sample x; As a deep learning model for adversarial samples x ′ The predicted classification results;

[0011] Step 1.3: Screen the adversarial samples and extract the adversarial samples x that have been processed by the deep learning model after image preprocessing defense. ′ The adversarial samples in the predicted classification results of the deep learning model that are not equivalent to the predicted classification results of the original sample x are used as the initial detection samples

[0012] Step 2: Add perturbations to the detection samples in the direction orthogonal to the original sample direction;

[0013] Step 2.1: Set the moving direction between the test sample and the original sample, and use the moving step to execute formula (1) to obtain the test sample;

[0014]

[0015] Among them, α t represents the moving step size of the tth iteration;

[0016] Step 2.2: Add random perturbations to the test samples in the orthogonal direction using the method shown in formula (2) to perturb the test samples;

[0017]

[0018] in, represents the detection sample in the t-th iteration, P(x) represents the perturbation of projecting vector x into its orthogonal direction;

[0019] Step 3: Perform image pre-processing and target defense processing on the disturbance detection samples to identify valid detection samples;

[0020] Step 3.1: Perform image preprocessing on the perturbation detection sample to target defense Generate the defense sample as shown in formula (3);

[0021]

[0022] Step 3.2: Identify the model misclassifications of the defense samples; retain the perturbation detection samples that the model misclassifies;

[0023] Step 3.2.1: Get defense samples The model predicts labels

[0024] Step 3.2.2: The model misclassification of the defense sample is identified by using formula (4);

[0025]

[0026] Step 3.2.2.1: When the model misclassifies, retain the perturbation detection samples;

[0027] Step 3.2.2.2: When the model classification is correct, the perturbation detection samples are discarded;

[0028] Step 3.3: The retained disturbance detection samples are correctly classified and identified using the method shown in formula (5);

[0029]

[0030] Step 3.3.1: Output the correctly classified and identified perturbation detection samples as valid detection samples;

[0031] Step 3.3.2: Use the perturbation detection samples that are not correctly classified and identified as the detection samples for the next iteration round;

[0032] Step 3.4: Set the maximum number of iterations T. If the current iteration round t satisfies t ≥ T and no valid detection samples are obtained, the detection is considered to have failed. Execute steps 2 to 3 in a loop iterative manner until the number of iterations or the maximum number of iterations is reached.

[0033] Step 4: Input the valid detection samples into the image preprocessing target defense model and the original model respectively, and take the detection samples that are misclassified by the target defense model and correctly classified by the original model as the defense classification recognition results;

[0034] The present invention discloses a black-box adversarial deep learning model image classification detection system, which is used to implement the above method. The present invention discloses a black-box adversarial deep learning model image classification detection system, which includes a dataset and model loading module, a perturbation detection sample generation module, and a perturbation detection sample application module.

[0035] The dataset and model loading module loads the image dataset for the detection task and the black box deep learning model to be detected, and outputs the original image sample and the corresponding model prediction interface, which will serve as the input of the disturbance detection sample generation module;

[0036] The perturbation detection sample generation module constructs adversarial perturbation samples based on the original image samples, and generates detection samples in combination with an iterative strategy. The output of the detection samples satisfies the conditions that the original model can correctly classify and the defense model can misclassify, which will serve as the input of the perturbation detection sample application module.

[0037] The disturbance detection sample application module is used to input the generated detection samples into the original model and the model applying the defense strategy respectively, determine whether a specific defense algorithm is deployed by comparing the classification results, and output the detection results.

[0038] A computer-readable storage device storing a computer program, characterized in that when the computer program is executed, the black-box adversarial deep learning model image classification detection method is implemented.

[0039] Compared with the existing technology, it has the following beneficial effects:

[0040] 1. This invention can effectively identify whether a specific image processing adversarial defense algorithm is applied in a deep learning model without accessing the internal structure of the model. It can also accurately judge the defense strategy based on the construction results of the detection sample, thereby enhancing the pertinence and practicality of defense identification.

[0041] 2. This invention is highly versatile and applicable to a variety of mainstream deep learning model structures and common defense mechanisms, including linear transformation and nonlinear perturbation image preprocessing defenses. It also has good adaptability to defense strategies with random processing characteristics, making it suitable for deployment in complex and dynamic black box scenarios.

[0042] 3. By combining iterative perturbations based on decision directions with boundary walking strategies guided by orthogonal perturbations, the present invention improves the sensitivity of detection samples to changes in model decision boundaries, thereby enhancing the stability and accuracy of the defense detection process, and providing an efficient, accurate and practical technical path for the robustness evaluation of deep learning models, the adaptability analysis of adversarial samples and the research of system-level security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 It is a schematic flow diagram of the present invention; DETAILED DESCRIPTION

[0044] In order to better illustrate the purpose and advantages of the present invention, the following is a further description of the invention in conjunction with the accompanying drawings and examples. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the scope of protection of the present invention.

[0045] The dataset used in this embodiment is Cifar-10, a dataset used for research in the field of computer vision; the model is GoogLeNet, a deep learning model for image classification; the defense algorithm tested is DefenseTransformer; and the defense detection algorithm is a defense detection algorithm based on decision boundary walking.

[0046] Example

[0047] like Figure 1 As shown, a black box adversarial deep learning model image classification detection method of this embodiment is specifically implemented as follows:

[0048] Step 1: Construct original samples and adversarial samples. Use the original samples and the adversarial samples that have been processed by image preprocessing to obtain predicted classification results through the deep learning model. The adversarial samples that are different from the predicted classification results of the original samples are used as the initial detection samples.

[0049] Step 1.1: Select the original sample x and construct a randomly generated adversarial sample x ′ ;

[0050] In this embodiment, the original image samples in the Cifar-10 dataset and the adversarial samples processed by the DefenseTransformer defense algorithm are used to obtain predicted classification results through the GoogLeNet model, and the adversarial samples with different predicted classification results from the original samples are used as initial detection samples; an image is randomly selected from the Cifar-10 dataset as the original sample x, and the corresponding adversarial sample x is generated by adding slight perturbations ′ .

[0051] Step 1.2: Take f(x) as the predicted classification result of the deep learning model for the original sample x; As a deep learning model for adversarial samples x ′ The predicted classification results;

[0052] In the embodiment, f(x) is used as the predicted classification result of the GoogLeNet model for the original sample x; As the GoogLeNet model responds to the adversarial sample x processed by the DefenseTransformer defense algorithm ′ The predicted classification results;

[0053] Step 1.3: Screen the adversarial samples and extract the adversarial samples x that have been processed by the deep learning model after image preprocessing defense. ′ The adversarial samples whose predicted classification results are not equal to the predicted classification results of the deep learning model for the original sample x are used as the initial detection samples

[0054] In the embodiment, the adversarial samples are screened and the adversarial samples x processed by the DefenseTrans former defense algorithm of the GoogLeNet model are extracted. ′ The adversarial samples whose predicted classification results are not equal to the predicted classification results of the GoogLeNet model for the original sample x are used as the initial detection samples

[0055] Step 2: Add perturbations to the detection samples in the direction orthogonal to the original sample direction;

[0056] Step 2.1: Set the moving direction between the test sample and the original sample, and use the moving step to execute formula (1) to obtain the test sample;

[0057]

[0058] Among them, α t represents the moving step size of the tth iteration;

[0059] Step 2.2: Add random perturbations to the test samples in the orthogonal direction using the method shown in formula (2) to perturb the test samples;

[0060]

[0061] in, represents the detection sample in the t-th iteration, P(x) represents the perturbation of projecting vector x into its orthogonal direction;

[0062] Step 3: Perform image pre-processing and target defense processing on the disturbance detection samples to identify valid detection samples;

[0063] Step 3.1: Perform image preprocessing on the perturbation detection sample to target defense Generate the defense sample as shown in formula (3);

[0064]

[0065] In this embodiment, the DefenseTransformer defense algorithm is used for disturbance detection samples. Generate the defense sample as shown in formula (3);

[0066] Step 3.2: Identify the model misclassifications of the defense samples; retain the perturbation detection samples that the model misclassifies;

[0067] Step 3.2.1: Get defense samples The model predicts labels

[0068] In the embodiment, obtaining a defense sample The GoogLeNet model predicts labels

[0069] Step 3.2.2: The model misclassification of the defense sample is identified by using formula (4);

[0070]

[0071] Step 3.2.2.1: When the model misclassifies, retain the perturbation detection samples;

[0072] Step 3.2.2.2: When the model classification is correct, the perturbation detection samples are discarded;

[0073] Step 3.3: The retained disturbance detection samples are correctly classified and identified using the method shown in formula (5);

[0074]

[0075] Step 3.3.1: Output the correctly classified and identified perturbation detection samples as valid detection samples;

[0076] Step 3.3.2: Use the perturbation detection samples that are not correctly classified and identified as the detection samples for the next iteration round;

[0077] Step 3.4: Set the maximum number of iterations T. If the current iteration round t satisfies t ≥ T and no valid detection samples are obtained, the detection is considered to have failed. Execute steps 2 to 3 in a loop iterative manner until the number of iterations or the maximum number of iterations is reached.

[0078] Step 4: Input the valid detection samples into the image preprocessing target defense model and the original model respectively, and take the detection samples that are misclassified by the target defense model and correctly classified by the original model as the defense classification recognition results;

[0079] In the embodiment, valid detection samples are respectively input into the target defense model and the original GoogLeNet model to which the DefenseTransformer defense algorithm is applied, and the detection samples misclassified by the target defense model and correctly classified by the original model are used as the defense classification recognition results;

[0080] The present embodiment provides a black-box adversarial deep learning model image classification detection system, which is used to implement the above method. The present embodiment provides a black-box adversarial deep learning model image classification detection system, which includes a dataset and model loading module, a perturbation detection sample generation module, and a perturbation detection sample application module.

[0081] The dataset and model loading module loads the image dataset for the detection task and the black box deep learning model to be detected, and outputs the original image sample and the corresponding model prediction interface, which will serve as the input of the disturbance detection sample generation module;

[0082] The perturbation detection sample generation module constructs adversarial perturbation samples based on the original image samples, and generates detection samples in combination with an iterative strategy. The output of the detection samples satisfies the conditions that the original model can correctly classify and the defense model can misclassify, which will serve as the input of the perturbation detection sample application module.

[0083] The disturbance detection sample application module is used to input the generated detection samples into the original model and the model applying the defense strategy respectively, determine whether a specific defense algorithm is deployed by comparing the classification results, and output the detection results.

[0084] A computer-readable storage device storing a computer program, characterized in that when the computer program is executed, the black-box adversarial deep learning model image classification detection method is implemented.

[0085] To further illustrate the practicality of the present invention in identifying adversarial defense categories in black-box adversarial deep learning models in deep learning model security testing, the present invention is described in combination with experimental data.

[0086] As shown in Table 1, we tested detection samples generated on two classic image classification datasets, ImageNet and Cifar10, and fed them into a deep learning image classification model that incorporates defense mechanisms such as JPEG, Quantize, WebP, and MagNet. The experimental data is shown in Table 1, and the detection performance was evaluated using metrics such as detection success rate (SRD), detection threshold (Thre), precision (Prec), and recall (Rec).

[0087] Experimental results demonstrate that this method performs exceptionally well against linear defense methods such as JPEG, Quilting, and WebP, achieving an SRD exceeding 94% and both Precision and Recall of 100%. Furthermore, against nonlinear defense mechanisms such as MagNet and ComDefend, the SRD also exceeds 40%, demonstrating the method's adaptability and robustness to model-based defense strategies. In particular, for the highly complex defense model DefenseTransformer, despite increased detection difficulty, the method maintains a precision of 33.3% and a recall of 100%, effectively demonstrating its practical application value in black-box scenarios.

[0088] The results show that the present invention achieves the identification of adversarial defense categories in black-box adversarial deep learning models.

[0089] Table 1 Detection performance evaluation table under multi-class image processing adversarial sample defense mechanism

[0090]

[0091] The above specific description further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A black-box adversarial deep learning model image classification detection method, characterized by: The following steps are included: Step 1: Construct original samples and adversarial samples. Use the original samples and the adversarial samples that have been processed by image preprocessing to obtain predicted classification results through the deep learning model. The adversarial samples that are different from the predicted classification results of the original samples are used as the initial detection samples. Step 2: Add perturbations to the detection samples in the direction orthogonal to the original sample direction; Step 2.1: Set the moving direction between the test sample and the original sample, and use the moving step to execute formula (1) to obtain the test sample; Among them, α t represents the moving step size of the tth iteration; Step 2.2: Add random perturbations to the test samples in the orthogonal direction using the method shown in formula (2) to perturb the test samples; in, represents the detection sample in the t-th iteration, P(x) represents the perturbation of projecting vector x into its orthogonal direction; Step 3: Perform image pre-processing and target defense processing on the disturbance detection samples to identify valid detection samples; Step 4: Input the valid detection samples into the image preprocessing target defense model and the original model respectively, and take the detection samples that are misclassified by the target defense model and correctly classified by the original model as the defense classification recognition results.

2. The black-box adversarial deep learning model image classification detection method according to claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: Select the original sample x and construct a randomly generated adversarial sample x′; Step 1.2: Take f(x) as the predicted classification result of the deep learning model for the original sample x; (x′)) is the predicted classification result of the deep learning model for the adversarial sample x′; Step 1.3: Screen the adversarial samples and extract the adversarial samples whose predicted classification results of the adversarial samples x′ processed by the deep learning model after image preprocessing defense are not equal to the predicted classification results of the deep learning model for the original sample x as the initial detection samples 3. The black-box adversarial deep learning model image classification detection method according to claim 1, characterized in that: Step 3 is implemented as follows: Step 3.1: Perform image preprocessing on the perturbation detection sample to target defense Generate the defense sample as shown in formula (3); Step 3.2: Identify the model misclassifications of the defense samples; retain the perturbation detection samples that the model misclassifies; Step 3.3: The retained disturbance detection samples are correctly classified and identified using the method shown in formula (5); Step 3.4: Set the maximum number of iterations T. If the current iteration round t satisfies t ≥ T and no valid detection samples are obtained, the detection is considered to have failed. Execute steps 2 to 3 in a loop iterative manner until the number of iterations or the maximum number of iterations is reached.

4. The black-box adversarial deep learning model image classification detection method according to claim 3, characterized in that: The implementation method of step 3.2 is: Step 3.2.1: Get defense samples The model predicts labels Step 3.2.2: The model misclassification of the defense sample is identified by using formula (4).

5. The black-box adversarial deep learning model image classification detection method according to claim 3, characterized in that: The implementation method of step 3.3 is: Step 3.3.1: Output the correctly classified and identified perturbation detection samples as valid detection samples; Step 3.3.2: Use the perturbation detection samples that are not correctly classified and identified as the detection samples for the next iteration round.

6. The black-box adversarial deep learning model image classification detection method according to claim 4, characterized in that: The implementation method of step 3.2.2 is: Step 3.2.2.1: When the model misclassifies, retain the perturbation detection samples; Step 3.2.2.2: When the model classification is correct, the perturbation detection samples are discarded.

7. A black-box adversarial deep learning model image classification detection system implementing the method of claim 1, characterized in that: It includes data set and model loading module, disturbance detection sample generation module and disturbance detection sample application module; The dataset and model loading module loads the image dataset for the detection task and the black box deep learning model to be detected, and outputs the original image sample and the corresponding model prediction interface, which will serve as the input of the disturbance detection sample generation module; The perturbation detection sample generation module constructs adversarial perturbation samples based on the original image samples, and generates detection samples in combination with an iterative strategy. The output of the detection samples satisfies the conditions that the original model can correctly classify and the defense model can misclassify, which will serve as the input of the perturbation detection sample application module. The disturbance detection sample application module is used to input the generated detection samples into the original model and the model applying the defense strategy respectively, determine whether a specific defense algorithm is deployed by comparing the classification results, and output the detection results.

8. A computer-readable storage device storing a computer program, characterized in that: When the computer program is executed, it implements a black-box adversarial deep learning model image classification detection method as described in any one of claims 1 to 6.

Images