Confrontation sample detection method and device based on variational U-Net

Abstract

The invention provides an adversarial sample detection method and device based on variational U-Net, and the method comprises the steps: taking an encoder of a VU-Net model as a potential feature extractor, and extracting a potential feature z from a to-be-detected sample through the encoder; inputting the data into a neural network full-connection layer to obtain a first classification label; inputting a to-be-detected sample into the classification model to obtain a second classification label; comparing the first classification label with the second classification label, if the first classification label and the second classification label are the same, determining that the to-be-detected sample is a clean sample, and if the second classification label and the to-be-detected sample are different. The method does not depend on priori knowledge of any attack sample, but has good generalization ability for defending new attacks. Meanwhile, the method does not need the help of a target model or any similar model, has good mobility, and can be used for protecting different models after one-time training. A final experiment result shows that the method has good generalization and can effectively protect the target model from different attacks.

Description

Technical Field

[0001] This invention belongs to the field of information warfare technology, and specifically relates to a method and apparatus for detecting adversarial samples based on variational U-Net. Background Technology

[0002] Due to their success in visual tasks such as image classification, object detection, object tracking, and image segmentation, deep neural networks (DNNs) have been widely applied in critical fields such as autonomous driving and facial recognition. However, recent research has shown that DNNs are vulnerable to adversarial attacks and are easily fooled. These attacks are difficult for the human visual system to detect. Adversarial examples are generated by intentionally introducing imperceptible perturbations into clean samples, causing the model to produce erroneous results with high confidence. Furthermore, research indicates that adversarial examples can also exist in the physical world, posing a significant security risk. Therefore, considering the security of deep neural networks, it has become a necessity, not just an option.

[0003] Adversarial training and model distillation have emerged to combat such attacks. However, when applying a well-trained model, the cost of retraining to counter new attacks is enormous, especially against some powerful, leading-edge attack methods. On the other hand, some attempts focus on removing adversarial perturbations before feeding input samples to the target model. But preprocessing input samples can lead to a loss of prediction accuracy. Considering these difficulties, detection-based defense strategies have attracted considerable attention as an alternative solution.

[0004] Currently, there are some methods that can get rid of the dependence on the target model, but they still need the assistance of adversarial examples. This results in the current adversarial example detection methods having low detection success rate, high false detection rate, poor generalization, and are prone to failure when resisting stronger attacks, and are unable to detect adversarial examples.

[0005] For example, an IRD algorithm for detecting adversarial examples starts by generating corresponding adversarial examples from normal samples. Assume that a normal sample Xn can be correctly classified by classifier M, and Xa is a corresponding adversarial example generated by an attack algorithm A with different perturbations ε in a training batch N. First, samples Xn and Xa are preprocessed into 32*32 images. Then, a Com-Rec network model trained on normal sample Xn is used to compress and reconstruct Xn and Xa to obtain reconstruction difference features R(Xn) and R(Xa) based on VIF, UQI, and RASE. Next, feature value standardization (i.e., Min-Max standardization) is performed, and the labels of normal sample Xn and adversarial sample Xa are divided into 1 and 0. A random forest binary classifier is used to distinguish between adversarial and normal samples, thus achieving the purpose of detecting adversarial examples. If the predicted label of IRD is 0, the sample is an adversarial example; otherwise, it is a normal sample.

[0006] like Figure 1 As shown, the Com-Rec network is an end-to-end image compression and reconstruction network composed of ComCNN and RecCNN. First, the input sample X is processed into a 32*32 image Xo. Then, ComCNN extracts features from the preprocessed image and generates 256 feature maps. By reducing and enhancing the feature maps, the 24-bit pixel image is compressed to 12 bits, and the resulting feature maps represent the main structural information of the image. RecCNN reconstructs a 32*32 image Xr based on the 12-bit pixel features extracted by ComCNN. To address the issue of different channel numbers in color and black-and-white images, IRD constructs different Com-Rec networks and trains them on normal samples. This ensures that the 12-bit pixel features extracted by ComCNN for normal and adversarial samples are as similar as possible, allowing the ComRec network to eliminate most adversarial perturbations in adversarial samples, further amplifying the differences in reconstruction between normal and adversarial samples caused by compression and reconstruction.

[0007] IRD uses features reconstructed from clean and adversarial samples to distinguish between them. This method has been successful on the MNIST dataset, detecting adversarial samples with a low false positive rate. However, a significant drawback of the IRD algorithm is that a new binary classification model needs to be trained each time a different adversarial sample is detected, which greatly limits its generalization ability. Summary of the Invention

[0008] To address the issue of overlapping generalization capabilities in existing algorithms, this invention proposes an adversarial example detection method and apparatus based on Variational U-Net. The proposed method is virtually unaffected by the attack method; adversarial examples can be detected regardless of whether the attack is white-box or black-box, and regardless of whether the perturbation norm is L2 or L2. This characteristic gives the invention stronger generalization and robustness in practical applications.

[0009] The technical solution of this invention is an adversarial example detection method based on variational U-Net, which includes:

[0010] The encoder of the VU-Net model is used as a latent feature extractor to extract latent features z from the samples to be detected.

[0011] The latent feature z is input into the fully connected layer of the neural network to obtain the corresponding first classification label;

[0012] Input the sample to be tested into the classification model to obtain the corresponding second classification label;

[0013] The first classification label is compared with the second classification label. If they are the same, the sample to be tested is a clean sample. If they are different, the sample to be tested is contaminated. A contaminated sample to be tested is an adversarial sample.

[0014] In one embodiment, the encoder extracts latent features z from the sample to be detected using the following method:

[0015] The encoder of the VU-Net model downsamples the input sample to be detected multiple times to obtain multiple feature layers. These feature layers are then flattened into a corresponding set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

[0016] In one embodiment, the VU-Net model is pre-trained, and the loss function used when training the VU-Net model is a combination of the reconstruction loss function and the KL divergence loss function; wherein:

[0017] The reconstruction loss function is used to measure the difference between the reconstructed data generated by the VU-Net model and the original data. The reconstruction loss function L... r The formula is:

[0018]

[0019] Where, x i It is the raw sample data input to the VU-Net model; x i ′ represents the reconstructed sample data output by the VU-Net model; N is the total number of sample data, and i is the sample data number;

[0020] The formula for the KL divergence loss function is:

[0021]

[0022] Where, q φ (z|x) represents the latent distribution of z, p(z) represents the prior distribution of z, and p(z) follows the standard normal distribution N(0,1). φ (z|x) follows N(μ,σ) 2 ), where m is the total number of samples;

[0023] The VU-Net model is trained using the reconstruction loss function and the KL divergence loss function to obtain the trained VU-Net model.

[0024] In one embodiment, the sample to be detected is an image.

[0025] In one embodiment, when the sample to be detected is an image, the method for extracting latent features z from the sample using the encoder is as follows:

[0026] Based on the image to be detected, corresponding three-channel image data is generated. The three-channel image data are downsampled to obtain multiple feature layers. These feature layers are then flattened into a set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

[0027] An adversarial example detection device based on variational U-Net, comprising:

[0028] The encoder of the VU-Net model functions as a latent feature extractor to extract latent features z from the samples to be detected.

[0029] The function of a latent feature classifier is to input latent features z into a fully connected layer of a neural network to obtain the corresponding first classification label;

[0030] The function of the sample classifier is to input the sample to be detected into the classification model to obtain the corresponding secondary classification label;

[0031] The comparator's function is to compare the first classification label with the second classification label. If they are the same, the sample to be tested is judged as a clean sample. If they are different, the sample to be tested is contaminated and the contaminated sample to be tested is judged as an adversarial sample.

[0032] In one embodiment, the encoder of the VU-Net model acts as a latent feature extractor to extract latent features z from the samples to be detected.

[0033] The encoder of the VU-Net model downsamples the input sample to be detected multiple times to obtain multiple feature layers. These feature layers are then flattened into a corresponding set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

[0034] In one embodiment, the VU-Net model is pre-trained, and the loss function used when training the VU-Net model is a combination of the reconstruction loss function and the KL divergence loss function; wherein:

[0035] The reconstruction loss function is used to measure the difference between the reconstructed data generated by the VU-Net model and the original data. The reconstruction loss function L... r The formula is:

[0036]

[0037] Where, x i It is the raw sample data input to the VU-Net model; x i ′ represents the reconstructed sample data output by the VU-Net model; N is the total number of sample data, and i is the sample data number;

[0038] The formula for the KL divergence loss function is:

[0039]

[0040] Where, q φ (z|x) represents the latent distribution of z, p(z) represents the prior distribution of z, and p(z) follows the standard normal distribution N(0,1). φ (z|x) follows N(μ,σ) 2 ), where m is the total number of samples;

[0041] The VU-Net model is trained using the reconstruction loss function and the KL divergence loss function to obtain the trained VU-Net model.

[0042] In one embodiment, the sample to be detected is an image.

[0043] In one embodiment, when the sample to be detected is an image, the encoder extracts latent features z from the sample as follows:

[0044] The encoder generates corresponding three-channel image data based on the image to be detected. It then downsamples the three-channel image data to obtain multiple feature layers. These feature layers are flattened into a set of features, and the mean μ and covariance σ of this set of features are calculated. 2 Generate a random variable ε that follows a standard normal distribution, and then generate the latent feature z using the following formula z = μ + σ × ε.

[0045] The advantages of this invention compared to existing technologies are as follows: The proposed method is based on a U-Net structure, utilizing KL divergence and mean squared error loss constraints to project images into a latent space. In this space, the distance between different images increases, while the relative distance between similar images decreases. Then, a simple fully connected network is used to project the latent representation into a feature space, which is identical to the output feature space of the target model. Given an input image, its adversarial nature is determined by comparing the outputs of the simple network and the target model. This invention's method does not rely on any prior knowledge of attack samples but exhibits good generalization ability in defending against new attacks. Furthermore, this method does not require the assistance of the target model or any similar models, meaning it has good transferability and can be used to protect different models after a single training iteration. Final experimental results demonstrate that this method has good generalization ability and can effectively protect the target model from various attacks. Attached Figure Description

[0046] Figure 1 It is an IRD framework, a method for detecting adversarial examples in the existing technology;

[0047] Figure 2 This invention is a variational U-Net-based adversarial image detection framework for prediction inconsistency.

[0048] Figure 3 This is a diagram of the variational U-Net structure of this invention;

[0049] Figure 4 This is an example diagram of the adversarial example detection of the variational U-Net of this invention;

[0050] Figure 5 This is a graph showing the adversarial example detection results of the variational U-Net of this invention. Detailed Implementation

[0051] For example Figure 1 To address the shortcomings of existing technologies, this invention proposes an adversarial example detection method and apparatus based on variational U-Net. This invention treats the target model as a black box, using only the model's output information for judgment. Therefore, this method possesses model agnosticity, meaning it has good portability and can be used to protect different models after training. Furthermore, no adversarial examples are used during training, which gives the proposed method good generalization ability. As long as adversarial examples follow patterns similar to clean images and can deceive the target model, the proposed method can effectively detect these adversarial examples.

[0052] In one embodiment, an adversarial example detection method based on variational U-Net includes:

[0053] S1. Input the original image X(a) into the initialized VU-Net model, and the VU-Net model outputs image X(r). Use the mean square error between the input image X(a) and the output image X(r), the distribution of the encoded information z reflecting the difference between the input image X(a) and the output image X(r), and the KL divergence of the prior information as the loss function, and use this loss function to train the VU-Net model to obtain the trained VU-Net model.

[0054] S2 uses the encoder of the trained VU-Net model as a latent feature extractor to extract encoded information z from the original image.

[0055] S3, the encoded information z extracted from the original image by the feature extractor is used as a latent feature.

[0056] S4, using a fully connected neural network to learn the encoded information z as a latent feature.

[0057] S5. Input the sample to be tested into the encoder of the trained VU-Net model to extract the corresponding encoding information z, and input the encoding information z into the fully connected neural network to obtain the corresponding first classification label.

[0058] S6. Input the encoded information z into the VU-Net model (target model) to obtain the corresponding second classification label; compare the first classification label with the second classification label. If they are the same, the sample to be tested is judged to be a clean sample. If they are different, the sample to be tested is judged to be an adversarial sample.

[0059] This invention can be divided into three modules, such as Figure 2 As shown: Module 1 is a variational U-Net (VU-Net) reconstruction module, consisting of an encoder, a decoder, and an encoded information z; Module 2 is a simple classifier consisting of a fully connected layer; Module 3 is a detection module that compares the victim model output label with the fully connected layer classification label.

[0060] The VU-Net structure of module 1 of this invention is as follows: Figure 3 The diagram illustrates an image denoising and reconstruction method that combines a variational autoencoder (VAE) with the U-Net architecture. The VU-Net model consists of an encoder, resampling layer, skip connections, and a decoder. The encoder comprises five identical downsampling modules and a Flutten layer. In the downsampling modules, a 32×32 three-channel image is processed by the five downsampling modules to obtain 512 2×2 feature layers. Finally, these feature layers are flattened into 2048 features using a flattening layer. These 2048 features are then converted into the mean μ and covariance σ by two linear layers. 2A random variable ε is sampled from a standard normal distribution N(0,1), and then a latent feature z is generated using the formula z = μ + σ × ε. Reparameterization ensures that the latent feature z can be optimized using gradient descent. For skip connection modules, the input is directly connected to the output module, preserving details and semantic information from the original data and avoiding information loss. The decoder adopts a completely symmetrical structure with the encoder to re-decode the latent features into a complete image. The VU-Net loss function consists of two parts: Reconstruction Loss and Kullback-Leibler Divergence. These two parts jointly guide the model's learning process, ensuring that the extracted latent features are both faithful to the input data and sufficiently robust. The Reconstruction Loss measures the difference between the reconstructed data x′ generated by the model and the original data x. The formula for the Reconstruction Loss is...

[0061] The KL divergence is used to measure the latent distribution q generated by the encoder. φ The difference between (z|x) and the prior distribution p(z) ensures that the latent variable faithfully represents the input data. The prior distribution p(z) typically follows a standard normal distribution N(0,1), while the latent distribution q... φ (z|x) then follows N(μ,σ) 2 The KL divergence loss function is expressed as follows:

[0062]

[0063] In this unique architecture, the variational autoencoder plays a crucial role. It is responsible for learning the latent representation of the image and constraining this latent representation by reconstructing the mean squared error of the image, ensuring that key information is effectively extracted. Meanwhile, the U-Net architecture significantly improves the model's performance in image denoising tasks through its unique encoder-decoder structure and skip connections. Specifically, the variational autoencoder, with its powerful representation learning capabilities, can deeply mine the latent features of the image. The U-Net architecture compresses the input samples through the encoder, extracting key latent representations, and then uses the decoder to restore them into a clear, denoised image. Skip connections play a vital role in this process, allowing the network to effectively utilize the feature information of the corresponding encoder layer at each layer of the decoder, thus ensuring that the details of the original image are preserved to the maximum extent during image reconstruction. Furthermore, the downsampling and upsampling paths of this model cooperate to effectively integrate the spatial and contextual information of the image. The downsampling path is mainly responsible for extracting global features of the image, while the upsampling path is responsible for recovering a clear image based on these global features. This symmetrical structural design allows U-Net to take into account both global and local information, resulting in more accurate and clearer image reconstruction results in denoising tasks.

[0064] Step S1: First, input the original image X(a) into the initialized VU-Net model. The VU-Net model outputs image X(r). The mean square error of the input image X(a) and the output image X(r), the distribution of the encoded information z, and the KL divergence of the prior information are used as loss functions to train the VU-Net model together.

[0065] Step S2: Use a well-trained VU-Net as a starting point. The encoder part of the VU-Net will be used as a feature extractor, responsible for extracting the encoded information z related to the image category, as latent features.

[0066] Step S3: Extract latent features from the original image using the encoder part of VU-Net. Because latent feature information is strongly correlated with the classification category, these features are similar for clean images and adversarial examples.

[0067] Step S4: Train a simple fully connected neural network to learn the latent features extracted by the encoder. This network is designed to have an output space consistent with the output space of the target model. This allows the latent features of the input samples to be mapped to the fully connected network, resulting in an output with the same dimension as the target model's output.

[0068] Step S5: The input sample extracts latent features through the encoder part of VU-Net. These features are then fed into a fully connected neural network to obtain the mapped classification labels.

[0069] Step S6: Compare the classification label of the fully connected layer's output with the classification label of the input sample on the target model. If the two classification labels are the same, the input sample is determined to be a clean sample; if they are different, it is determined to be an adversarial sample.

[0070] Example

[0071] like Figure 4 As shown, in one embodiment of the present invention, a bald eagle image that can be correctly classified by the model is selected and referred to as a clean sample with an output label of 175. An adversarial perturbation is generated using an adversarial attack algorithm and superimposed on the clean sample to generate a carefully crafted adversarial sample image. This adversarial sample image is then fed into our target classification model, with an output label of 887. The target model will then be attacked by the adversarial sample, thereby threatening its security. In this example, before the image to be tested is fed into the target model, it is first fed into the adversarial sample detection model proposed in this invention. The VU-Net encoder part of the detector extracts the latent feature information of the sample. Inputting the latent feature information into the trained fully connected component yields a classification label of 175. At this point, the classification label 175 of the fully connected component is inconsistent with the classification label 887 of the target model, so the image to be tested can be directly determined to be an adversarial sample, thereby rejecting the sample from being input into the target detector and preventing the target model from being attacked by adversarial samples.

[0072] like Figure 5 As shown, two visually identical bald eagle images are input into the variational U-Net detection system. The system can effectively detect that the left image, with a target model output classification label of 175, is a clean sample, while the right image, with a target model output classification label of 887, is an adversarial sample.

Claims

1. An adversarial example detection method based on variational U-Net, characterized in that, It includes: The encoder of the VU-Net model is used as a latent feature extractor to extract latent features z from the samples to be detected. The latent feature z is input into the fully connected layer of the neural network to obtain the corresponding first classification label; Input the sample to be tested into the classification model to obtain the corresponding second classification label; The first classification label is compared with the second classification label. If they are the same, the sample to be tested is a clean sample. If they are different, the sample to be tested is contaminated. A contaminated sample to be tested is an adversarial sample.

2. The method according to claim 1, characterized in that, The specific method by which the encoder extracts latent features z from the sample to be detected is as follows: The encoder of the VU-Net model downsamples the input sample to be detected multiple times to obtain multiple feature layers. These feature layers are then flattened into a corresponding set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

3. The method according to claim 2, characterized in that, The VU-Net model is pre-trained, and the loss function used during training is a combination of the reconstruction loss function and the KL divergence loss function; wherein: The reconstruction loss function is used to measure the difference between the reconstructed data generated by the VU-Net model and the original data. The reconstruction loss function L... r The formula is: Among them, x i It is the raw sample data input to the VU-Net model; x i ′ represents the reconstructed sample data output by the VU-Net model; N is the total number of sample data, and i is the sample data number; The formula for the KL divergence loss function is: Where, q φ (z|x) represents the latent distribution of z, p(z) represents the prior distribution of z, and p(z) follows the standard normal distribution N(0,1). φ (z|x) follows N(μ,σ) 2 ), where m is the total number of samples; The VU-Net model is trained using the reconstruction loss function and the KL divergence loss function to obtain the trained VU-Net model.

4. The method according to claim 3, characterized in that, The sample to be tested is an image.

5. The method according to claim 4, characterized in that, When the sample to be detected is an image, the method for extracting latent features z from the sample using the encoder is as follows: Based on the image to be detected, corresponding three-channel image data is generated. The three-channel image data are downsampled to obtain multiple feature layers. These feature layers are then flattened into a set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

6. An adversarial example detection device based on variational U-Net, characterized in that, It includes: The encoder of the VU-Net model functions as a latent feature extractor to extract latent features z from the samples to be detected. The function of a latent feature classifier is to input latent features z into a fully connected layer of a neural network to obtain the corresponding first classification label; The function of the sample classifier is to input the sample to be detected into the classification model to obtain the corresponding secondary classification label; The comparator's function is to compare the first classification label with the second classification label. If they are the same, the sample to be tested is judged as a clean sample. If they are different, the sample to be tested is contaminated and the contaminated sample to be tested is judged as an adversarial sample.

7. The apparatus according to claim 6, characterized in that, The specific method by which the encoder of the VU-Net model, acting as a latent feature extractor, extracts latent features z from the samples to be detected is as follows: The encoder of the VU-Net model downsamples the input sample to be detected multiple times to obtain multiple feature layers. These feature layers are then flattened into a corresponding set of features, and the mean μ and covariance σ of this set of features are calculated. 2 A random variable ε that follows a standard normal distribution is generated, and a latent feature z is generated using the formula z = μ + σ × ε.

8. The apparatus according to claim 7, characterized in that, The VU-Net model is pre-trained, and the loss function used during training is a combination of the reconstruction loss function and the KL divergence loss function; wherein: The reconstruction loss function is used to measure the difference between the reconstructed data generated by the VU-Net model and the original data. The reconstruction loss function L... r The formula is: Among them, x i It is the raw sample data input to the VU-Net model; x i ′ represents the reconstructed sample data output by the VU-Net model; N is the total number of sample data, and i is the sample data number; The formula for the KL divergence loss function is: Where, q φ (z|x) represents the latent distribution of z, p(z) represents the prior distribution of z, and p(z) follows the standard normal distribution N(0,1). φ (z|x) follows N(μ,σ) 2 ), where m is the total number of samples; The VU-Net model is trained using the reconstruction loss function and the KL divergence loss function to obtain the trained VU-Net model.

9. The apparatus according to claim 8, characterized in that, The sample to be tested is an image.

10. The apparatus according to claim 9, characterized in that, When the sample to be detected is an image, the encoder extracts the latent feature z from the sample as follows: The encoder generates corresponding three-channel image data based on the image to be detected. It then downsamples the three-channel image data to obtain multiple feature layers. These feature layers are flattened into a set of features, and the mean μ and covariance σ of this set of features are calculated. 2 Generate a random variable ε that follows a standard normal distribution, and then generate the latent feature z using the following formula z = μ + σ × ε.

Images