An image adversarial sample detection method based on sample semantic difference

Abstract

The application discloses a kind of image adversarial sample detection methods based on sample semantic difference, it is related to network security technical field, comprising the following steps: training condition generation model, original sample is classified and reconfiguration, generates the reconfiguration sample corresponding to original sample, original sample and reconfiguration sample are as positive sample pair, the rest sample combination is as negative sample pair, the semantic extractor is trained by contrast learning, the semantic feature of original sample and reconfiguration sample is extracted in combination with semantic extractor and the similarity feature value of semantic feature is calculated, the similarity feature value is as input feature, training isolation forest model, then the semantic feature of the to-be-tested sample is extracted according to the same method after reconfiguration, the similarity feature value is substituted into isolation forest model detection and obtains the adversarial sample in the to-be-tested sample;The adversarial sample detection method of the application can generate image according to label, does not rely on the network structure and intermediate layer output of target classifier, can be effectively applied to black box scene, significantly expand its application range.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to an image adversarial sample detection method based on sample semantic differences. Background Technology

[0002] Adversarial examples are generated by adding perturbations to input images that are imperceptible to humans. These perturbations propagate between layers of deep neural networks, affecting the deep features of the image and ultimately causing the deep neural network to make incorrect predictions. Such incorrect predictions can have serious consequences in fields such as face recognition, autonomous driving, and medical systems. Therefore, it is increasingly important to propose a reliable and effective method for adversarial example detection.

[0003] Unsupervised adversarial example detection methods only require training on normal samples, offering wider applicability than supervised learning. Existing unsupervised detection methods can be categorized into four types: statistical methods, denoising methods, input transformation, and reconstruction difference. Among them, the reconstruction difference method mainly achieves detection by the difference in reconstruction errors between normal samples and adversarial samples. It can achieve complete unsupervised learning and has the characteristics of high computational efficiency and wide application. However, since this method often requires the structure and intermediate states of the target network, it is difficult to play a role when the classifier is a black box, which limits its application. Summary of the Invention

[0004] In view of this, the present invention proposes an image adversarial sample detection method based on sample semantic differences. In view of the shortcomings of the reconstruction difference method, which usually requires white-box access to the structure and parameters of the target classifier, a detection method based on semantic feature similarity inconsistency is proposed. This method does not depend on the network structure and intermediate layer output of the target classifier and can be applied to black-box scenarios.

[0005] To address at least one of the aforementioned technical problems, the present invention provides a method for detecting adversarial examples in images based on semantic differences of samples, comprising the following steps:

[0006] Step S1: Train a conditional generation model that can generate corresponding samples based on labels;

[0007] Step S2: Combine the target classifier and the conditional generation model to reconstruct the original samples and generate reconstructed samples that correspond one-to-one with the original samples.

[0008] Step S3: Combine the one-to-one correspondence between the original sample and the reconstructed sample as positive sample pairs, and combine the remaining samples as negative sample pairs. Train the semantic extractor through contrastive learning.

[0009] Step S4: Use a semantic extractor to extract the semantic features of the original sample and the reconstructed sample and represent them in a quantized form; calculate the similarity feature value of the semantic features of the original sample and the reconstructed sample.

[0010] Step S5: Use the semantic similarity feature values ​​between the original samples and the reconstructed samples as one-dimensional input features to train the isolation forest model;

[0011] Step S6: Reconstruct the test sample according to the method in step S2. Then, according to the method in step S4, the semantic extractor trained in step S3 extracts the similarity feature values ​​of the semantic features of the test sample and its corresponding reconstructed sample. Substitute these values ​​into the isolated forest model trained in step S5 to detect adversarial samples in the test sample.

[0012] The technical effects achieved by this invention are:

[0013] 1. This invention proposes an adversarial sample detection method based on the inconsistent semantic feature similarity between the original sample and the reconstructed sample. This method generates images based on labels and does not rely on the network structure and intermediate layer output of the target classifier. It can be effectively applied to black box scenarios and significantly expands its applicability.

[0014] 2. The unsupervised adversarial detection framework proposed in this invention is neither targeted at specific adversarial attacks nor modifies the network, and is compatible with other defense methods without loss. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0016] Figure 1 This is the overall flowchart of the present invention. Detailed Implementation

[0017] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings.

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention.

[0019] See Figure 1 An image adversarial sample detection method based on sample semantic differences includes the following steps:

[0020] Step S1: Train a conditional generation model that can generate corresponding samples based on labels;

[0021] The main function of the conditional generation model is to generate corresponding samples based on labels. Its training process can refer to existing technologies. The conditional generation model belongs to the conditional diffusion model, which includes two processes: forward diffusion and reverse denoising. For the conditional diffusion model, image generation is divided into two stages. In the forward diffusion stage, the samples are gradually transformed into pure noise by adding Gaussian noise step by step. At the same time, the noise addition process is input into the U-Net network for learning denoising.

[0022] During the forward diffusion phase, the embedded labels do not participate in noise addition but are only used to guide the training of the conditional U-Net. Specifically, a noise prediction network is constructed, with the sample class labels as embedding conditions, and the network is trained by minimizing the noise prediction error.

[0023] In the reverse denoising process, the process starts with noisy samples and generates samples with specific label features under the guidance of embedded labels.

[0024] Furthermore, the training samples used to train the conditional generation model should be within the range of samples that the target classifier can distinguish, and should include the types of samples to be tested. Preferably, the generation range of the trained conditional generation model is consistent with the range of sample types that the target classifier can classify.

[0025] Step S2: Combine the target classifier and the conditional generation model to reconstruct the original samples and generate reconstructed samples that correspond one-to-one with the original samples.

[0026] The purpose of the target classifier is to classify samples. After inputting a sample into the target classifier, a predicted label corresponding to the sample category can be obtained. Preferably, the category of the samples generated by training the conditional generation model in step S1 is the same as the original samples input into the target classifier.

[0027] The target classifier can be an existing target classifier or can be trained independently using existing technology. Regardless of the method used, the range of sample types that the target classifier can classify should include the sample to be tested.

[0028] Based on this, the method for reconstructing the original samples is as follows: input the original samples into the trained target classifier to obtain the predicted labels, input the predicted labels into the conditional generation model trained in step S1, generate samples with corresponding predicted labels through the conditional generation model, and use these samples as the reconstructed samples corresponding to the original samples.

[0029] Step S3: Combine the one-to-one correspondence between the original sample and the reconstructed sample as positive sample pairs, and combine the remaining samples as negative sample pairs. Train the semantic extractor through contrastive learning.

[0030] To train a semantic extractor through contrastive learning, positive and negative sample pairs need to be set. A positive sample pair consists of an original sample and its corresponding reconstructed sample, while a negative sample pair is any combination of all samples other than the positive sample pair. For example, suppose a batch contains the features of three original samples and the features of three reconstructed samples. The features of the original samples are set as [ori_1,ori_2,ori_3], and the features of the reconstructed samples are set as [con_1,con_2,con_3]. If the positive sample pair is [ori_1, con_1], the negative sample pair is [ori_2,ori_3,con_2,con_3]. If the positive sample pair is [ori_2, con_2], the negative sample pair is [ori_1,ori_3,con_1,con_3], and so on.

[0031] The semantic extractor includes an encoder-projector network, which is trained through contrastive learning. In a typical training scheme, the augmented data is used as positive and negative sample pairs. Augmentation methods include random cropping, random flipping, random color perturbation, and random conversion to grayscale images. Two of these methods can be combined when performing augmentation.

[0032] In the traditional SimCLR framework, SimCLR is used to process any original sample. x Two data augmentations were applied twice to obtain two data-augmented samples. x m and x n To form sample pairs, but due to the reconstruction of the original samples x’ A transformation approaching strong data augmentation, where samples are randomly selected. x n Using reconstructed samplesx’ Replace, in order to x m and x’ Combined into positive sample pairs ( x m , x’ Then, the encoder extracts high-dimensional feature representations, which are then transformed into low-dimensional feature sets by the projection head.

[0033] Based on this, two feature sets, pre_L and pre_R, are obtained. pre_L is the feature set of the original samples after data augmentation, and pre_R is the feature set of the reconstructed samples. Both pre_L and pre_R are input into the loss function, which is the infoNCE of contrastive learning. For each anchor vector, infoNCE encourages maximizing the similarity to its corresponding positive sample vector while minimizing the similarity between that anchor and all other samples in the batch (considered as negative samples).

[0034] The loss function is shown in the following formula: In the formula, i Indicates the first i One sample; k Indicates the first k One sample; The loss function is represented by `loss`; N represents the number of original samples; and exp represents the natural exponential function. Indicates the first i Embedding vectors of each sample; Indicates the first j The embedding vector of each sample, and This represents a pair of positive samples; Represents the temperature coefficient and a smoothing factor for scaling similarity; Represents the embedding vector of the i-th sample in the batch. The sum of the sample and any other sample in the batch. Indicates the first k The embedding vector of each sample, and k ≠ i .

[0035] The encoder uses ResNet-50 as the backbone network, removes fully connected layers and max pooling layers, and retains residual modules for feature extraction. The projection head is a multilayer perceptron, whose structure consists of a linear layer with 2048 neurons, batch normalization, ReLU activation layer, and a 128-neuron linear layer stacked together. The projection head added during the training phase is discarded during the testing phase.

[0036] The encoder network obtained after training has the ability to extract semantic features.

[0037] Step S4: Use a semantic extractor to extract the semantic features of the original sample and the reconstructed sample and represent them in a quantized form. Calculate the similarity feature value of the semantic features of the original sample and the reconstructed sample.

[0038] Using a trained semantic feature extractor and existing techniques, low-dimensional semantic representation vectors of the original sample and its reconstructed sample are extracted respectively. Cosine distance is used to represent the similarity feature value, as shown in the following formula: In the formula, The low-dimensional semantic vector representing the original sample. This represents the low-dimensional semantic vector of the reconstructed sample, and Cosine represents the cosine distance.

[0039] Step S5: Use the semantic similarity feature values ​​between the original samples and the reconstructed samples as one-dimensional input features to train the isolation forest model;

[0040] The isolated forest method in this invention is implemented in the sklearn.ensemble library. It uses the IsolationForest.fit method to receive a feature set and train the isolated forest model isoForest. The trained model isoForest can be used as a detection model to distinguish between normal samples and adversarial samples. During training, it is trained using the semantic feature similarity set of the original samples consisting only of clean samples. In actual detection applications, clean samples and their corresponding reconstructed images have high semantic similarity, while adversarial samples have the opposite. Therefore, isoForest will identify samples with low semantic similarity as adversarial samples, resulting in robust detection results.

[0041] The core of the isolation forest is to construct a binary tree structure for the isolation tree. Abnormal data is more likely to be isolated near the root node of the isolation tree, while normal nodes are more likely to be located deeper in the isolation tree. Cosine distance is used as the node of the isolation tree.

[0042] The number of isolation trees can be determined arbitrarily according to actual needs. For example, for small datasets with only a few thousand data points, less than 100 trees can be used. For medium datasets with tens of thousands of data points, 200-500 trees are more appropriate. For very large datasets, more trees should be selected to make training more thorough and reduce the randomness of the results.

[0043] For example, suppose the feature value data is [0.9, 0.8, 0.7, 0.85, 0.69, 0.92], and build 10 trees based on this, with each tree's nodes including [0.9, 0.8, 0.7, 0.85, 0.69, 0.92].

[0044] When performing the first split at the node, a value is randomly selected between the maximum and minimum values. Assuming the first randomly selected value is 0.78, then the points ≤ 0.78 are assigned to the left subtree: [0.7, 0.69], and the points > 0.78 are assigned to the right subtree: [0.9, 0.8, 0.85, 0.92].

[0045] Next, recursively split the left subtree:

[0046] Randomly select a dividing value between the new minimum value of 0.69 and the maximum value of 0.7, for example, select 0.695.

[0047] Since 0.69 ≤ 0.695, the minimum value is assigned to the leaf node of the left child node; while since 0.7 > 0.695, the maximum value is assigned to the leaf node of the right child node.

[0048] Thus, 0.69 was isolated after the first segmentation and then another segmentation, and its path length was very short.

[0049] Similarly, recursively split the right subtree:

[0050] Randomly select a dividing value between the minimum value of 0.8 and the maximum value of 0.92, for example, select 0.87.

[0051] Points ≤ 0.87 are assigned to the left child node, i.e., [0.8, 0.85]; points > 0.87 are assigned to the right child node, including [0.9, 0.92].

[0052] This process continues, segmenting the feature values ​​until each node contains only one data point, all point values ​​are identical, and the maximum depth is reached, at which point the segmentation stops.

[0053] After the model training is complete, when detecting test samples, the average path length of each test sample in all isolation trees is calculated, and the anomaly score corresponding to the average path length is calculated using a standardization formula. Finally, the anomaly scores of all test samples are sorted and filtered according to a set anomaly rate. The anomaly rate can be set as needed during model training. The formula for calculating the anomaly score is as follows: In the formula, E ( h ( x 0 )) indicates a sample x Average path length of 0; h ( x 0 ) represents a sample x 0 represents the path length in a single isolated tree; E Operators that represent the expected value of an average;c ( n ) represents the standardization factor based on the sample tree, for c ( n The calculation formula is as follows: In the formula, n The function represents the number of samples used in training the sample tree. H ( k () represents the harmonic series, and is calculated as follows: Based on this, the closer the anomaly score is to 1, the more likely it is to be an anomaly sample. Combined with the set anomaly rate, all the calculated anomaly scores are sorted from largest to smallest. For example, if the set anomaly rate is 0.1, and the model has calculated 100 samples, the 10 samples with the highest anomaly scores in the sorted list are taken as adversarial samples.

[0054] Step S6: Reconstruct the test sample according to the method in step S2. Then, according to the method in step S4, the semantic extractor trained in step S3 extracts the similarity feature values ​​of the semantic features of the test sample and its corresponding reconstructed sample. Substitute these values ​​into the isolated forest model trained in step S5 to detect adversarial samples in the test sample. Example

[0055] To illustrate the technical effects of this invention, two databases are used. Taking the CIFAR dataset as an example, 2000 test images are used. The test images include clean images and corresponding images after adversarial attacks. The attack method is the C&W attack algorithm. In addition, SPBAS (Spatial Behavior in Activation Space), ANR (Adaptive Noise Reduction Detection), and AEAE (Lightweight Unsupervised Adversarial Detector Based on Autoencoder and Isolated Forest) were also selected for comparative experiments to compare the comprehensive performance of the method in this invention when facing adversarial examples.

[0056] Table 1. Adversarial Example Detection Experiments

[0057]

[0058] In Table 1, a high recall rate indicates a low false positive rate, and a recall rate above 90% is considered to have good performance. It can be seen that the adversarial sample detection method in this invention has the highest recall rate, indicating that the method in this invention is less likely to detect normal samples as adversarial samples, ensuring that clean samples can be correctly classified.

[0059] Precision refers to the high accuracy of detecting adversarial samples, which usually needs to be above 85%. In order to balance false alarm rate and precision, the method in this invention sacrifices a portion of the detection accuracy in exchange for more normal samples not being detected as adversarial samples.

[0060] The F1 score represents the overall performance of the model. A score above 88% is considered good, ensuring both a low false positive rate and adequate detection performance. It represents the overall performance level of the model. As shown in Table 1, the F1 score of the method in this invention is the highest among all models, proving that the method in this invention has the best overall performance for detecting adversarial examples.

[0061] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the embodiments of the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting adversarial examples in images based on semantic differences of samples, characterized in that, Includes the following steps: Step S1: Train a conditional generation model that can generate corresponding samples based on labels; Step S2: Combine the target classifier and the conditional generation model to reconstruct the original samples and generate reconstructed samples that correspond one-to-one with the original samples. The method for reconstructing the original samples is to use the predicted labels obtained by the target classifier to classify the original samples, so that the conditional generation model can generate reconstructed samples based on the predicted labels. Step S3: Combine the one-to-one correspondence between the original sample and the reconstructed sample as positive sample pairs, and combine the remaining samples as negative sample pairs. Train the semantic extractor through contrastive learning. Step S4: Use a semantic extractor to extract the semantic features of the original sample and the reconstructed sample and represent them in a quantized form; calculate the similarity feature value of the semantic features of the original sample and the reconstructed sample. Step S5: Use the semantic similarity feature values ​​between the original samples and the reconstructed samples as one-dimensional input features to train the isolation forest model; Step S6: Reconstruct the test sample according to the method in step S2. Then, according to the method in step S4, the semantic extractor trained in step S3 extracts the similarity feature values ​​of the semantic features of the test sample and its corresponding reconstructed sample. Substitute these values ​​into the isolated forest model trained in step S5 to detect adversarial samples in the test sample.

2. The image adversarial example detection method based on sample semantic differences according to claim 1, characterized in that: The training samples for the conditional generation model include the types of samples to be detected, and the training samples do not contain adversarial samples.

3. The image adversarial example detection method based on sample semantic differences according to claim 1, characterized in that: Both the original samples and the samples used to train the conditional generation model are clean samples that do not contain adversarial samples.

4. The image adversarial sample detection method based on sample semantic differences according to claim 1, characterized in that: When training the semantic extractor using contrastive learning, data augmentation is required on the original samples. Augmentation methods include: random cropping, random flipping, random color perturbation, and random conversion to grayscale images.

5. The image adversarial sample detection method based on sample semantic differences according to claim 1, characterized in that: The semantic similarity feature values ​​between the original sample and the reconstructed sample are represented by cosine distance, as shown in the following formula: In the formula, The low-dimensional semantic vector representing the original sample. This represents the low-dimensional semantic vector of the reconstructed sample, and Cosine represents the cosine distance.

6. The image adversarial example detection method based on sample semantic differences according to claim 1, characterized in that: The method by which the isolated forest model derives adversarial examples from the test samples is as follows: The test samples are substituted into the isolated forest model for detection. The average path length of each test sample in all isolated trees is calculated, and the anomaly score corresponding to the average path length is calculated using a standardization formula. The anomaly scores of all test samples are sorted from largest to smallest, and the test samples whose anomaly scores meet the anomaly rate requirements are selected as adversarial samples. The formula for calculating the anomaly score is as follows: E ( h ( x 0)) indicates a sample x Average path length of 0; h ( x 0) indicates a sample x 0 represents the path length in a single isolated tree; E Operators that represent the expected value of the average; c ( n ) represents the standardization factor based on the sample tree.

Images