A multimodal large model security protection method, device and equipment

Abstract

The application provides a multimodal large model security protection method, device and equipment, which comprises the following steps: obtaining a sample image and a sample text, and performing feature fusion on the sample image and the sample text to obtain a multimodal feature; performing a first perturbation operation on the multimodal feature to obtain a first perturbation feature, inputting the first perturbation feature into an initial multimodal large model to obtain a first prediction label; determining a first loss value and a second loss value based on the first prediction label; adjusting the initial multimodal large model based on the first loss value to obtain an intermediate multimodal large model; performing a second perturbation operation on the multimodal feature to obtain a second perturbation feature, inputting the second perturbation feature into the intermediate multimodal large model to obtain a second prediction label, and determining a third loss value based on the second prediction label; and adjusting the initial multimodal large model based on the second loss value and the third loss value to obtain a target multimodal large model. Through the application scheme, the calculation resources are saved, and the training time is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a multi-modal large model security protection method, device and equipment. BACKGROUND

[0002] A multi-modal large model is a deep learning model trained by integrating text, image, video, audio and other multi-type data. The core technologies of the multi-modal large model include cross-modal encoder training, semantic alignment and feature fusion. The multi-modal large model can break through the semantic barriers between different modal data, enabling machines to reason comprehensively like humans, combining context, scene and multi-source information.

[0003] During the training process of the multi-modal large model, an attacker can add subtle perturbations that are difficult to detect in clean samples, causing the multi-modal large model to output highly confident incorrect predictions. This phenomenon is called adversarial sample attack, and the clean sample after adding subtle perturbations is called adversarial sample. Adversarial sample attack during the training process of the multi-modal large model will cause prediction errors of the multi-modal large model.

[0004] After the multi-modal large model is trained, if the error proportion of the prediction result of the multi-modal large model is high, the multi-modal large model cannot meet the prediction requirement and needs to be retrained. Frequent training of the multi-modal large model will occupy a large amount of computing resources of hardware devices and consume a lot of time. SUMMARY

[0005] The present application provides a multi-modal large model security protection method, which comprises:

[0006] Obtaining a sample image and a sample text corresponding to the sample image, performing feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image;

[0007] Performing a first perturbation operation on the multi-modal feature to obtain a first perturbation feature, inputting the first perturbation feature into an initial multi-modal large model to obtain a first prediction label of the sample image;

[0008] Determining a first loss value and a second loss value based on the first prediction label and a true label of the sample image, adjusting the initial multi-modal large model based on the first loss value to obtain an intermediate multi-modal large model, performing a second perturbation operation on the multi-modal feature to obtain a second perturbation feature, inputting the second perturbation feature into the intermediate multi-modal large model to obtain a second prediction label of the sample image, and determining a third loss value based on the second prediction label and the true label;

[0009] determine a target loss value based on the second loss value and the third loss value; and adjust the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model.

[0010] The target multi-modal large model is configured to predict a to-be-detected image.

[0011] The present application provides a multi-modal large model security protection device, the device comprising:

[0012] An acquisition module is configured to acquire a sample image and a sample text corresponding to the sample image, and perform feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image.

[0013] A processing module is configured to perform a first perturbation operation on the multi-modal feature to obtain a first perturbed feature, and input the first perturbed feature into an initial multi-modal large model to obtain a first predicted label of the sample image.

[0014] A determination module is configured to determine a first loss value and a second loss value based on the first predicted label and a true label of the sample image, adjust the initial multi-modal large model based on the first loss value to obtain an intermediate multi-modal large model, perform a second perturbation operation on the multi-modal feature to obtain a second perturbed feature, input the second perturbed feature into the intermediate multi-modal large model to obtain a second predicted label of the sample image, and determine a third loss value based on the second predicted label and the true label.

[0015] A training module is configured to determine a target loss value based on the second loss value and the third loss value, and adjust the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model.

[0016] The target multi-modal large model is configured to predict a to-be-detected image.

[0017] The present application provides an electronic device, comprising a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions that can be executed by the processor; the processor is configured to execute the machine executable instructions to implement a multi-modal large model security protection method.

[0018] The present application provides a computer program product, the computer program product comprising a computer program, the computer program being executed by a processor to implement a multi-modal large model security protection method.

[0019] The application provides a machine-readable storage medium storing machine-executable instructions capable of being executed by a processor; wherein the processor is configured to execute the machine-executable instructions to implement the multi-modal large model security protection method of the above examples.

[0020] As can be seen from the above technical solutions, in the embodiments of the application, the multi-modal features are subjected to a perturbation operation to obtain perturbed features, and the perturbed features are input into the multi-modal large model to obtain predicted labels. In this way, in the training process of the multi-modal large model, the adversarial samples (i.e., the perturbed features) are introduced, the multi-modal large model is caused to learn to recognize and resist these disturbances, and the multi-modal large model is caused to learn to distinguish between normal samples and adversarial samples, so that the multi-modal large model is adapted to the adversarial attack during training, the robustness of the multi-modal large model is enhanced, the multi-modal large model meets the prediction requirements, the multi-modal large model does not need to be frequently trained, the computing resources of the hardware device are saved, and the training time is reduced.

[0021] After the multi-modal features are subjected to a first perturbation operation to obtain first perturbed features, and the first perturbed features are input into the initial multi-modal large model to obtain first predicted labels, the first loss value and the second loss value are determined based on the first predicted labels, and the initial multi-modal large model is adjusted based on the first loss value to obtain an intermediate multi-modal large model. The multi-modal features are subjected to a second perturbation operation to obtain second perturbed features, the second perturbed features are input into the intermediate multi-modal large model to obtain second predicted labels, and a third loss value is determined based on the second predicted labels. On this basis, the initial multi-modal large model is adjusted based on the second loss value and the third loss value to obtain a target multi-modal large model, so that the prediction results of the adjusted model (i.e., the intermediate multi-modal large model) and the prediction results of the unadjusted model (i.e., the initial multi-modal large model) are jointly used in model training, the safety of the adjusted model and the unadjusted model is cooperatively enhanced, the robustness of the target multi-modal large model in the face of adversarial attacks is improved, the model performance is improved, the adversarial attack defense capability is significantly improved, the efficient and safe model protection capability is provided, the safety of the multi-modal large model is enhanced, and the training convergence speed is improved. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a flowchart of the multi-modal large model security protection method in the application;

[0023] Figure 2 is a flowchart of the multi-modal large model security protection method in the application;

[0024] Figure 3 is a schematic diagram of the first perturbation operation on the multi-modal features in the application;

[0025] Figure 4is a training process schematic diagram of a multi-modal large model in the present application;

[0026] Figure 5 is a structural schematic diagram of a multi-modal large model security protection device in the present application;

[0027] Figure 6 is a hardware structure diagram of an electronic device in an embodiment of the present application. DETAILED DESCRIPTION

[0028] A multi-modal large model security protection method is proposed in the embodiments of the present application, which can be applied to electronic devices such as servers, terminal devices, Internet of Things devices, etc., without limitation on the device type. Referring to Figure 1 the flowchart of the method is shown, which can include:

[0029] Step 101, obtaining a sample image and a sample text corresponding to the sample image, and performing feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image.

[0030] Step 102, performing a first perturbation operation on the multi-modal feature to obtain a first perturbation feature (i.e., a first perturbation feature corresponding to the sample image), inputting the first perturbation feature into an initial multi-modal large model (i.e., a multi-modal large model to be trained) to obtain a first prediction label of the sample image.

[0031] Step 103, determining a first loss value and a second loss value based on the first prediction label and the true label of the sample image; adjusting the initial multi-modal large model based on the first loss value to obtain an intermediate multi-modal large model; performing a second perturbation operation on the multi-modal feature to obtain a second perturbation feature (i.e., a second perturbation feature corresponding to the sample image), inputting the second perturbation feature into the intermediate multi-modal large model to obtain a second prediction label of the sample image, and determining a third loss value based on the second prediction label and the true label.

[0032] Step 104, determining a target loss value based on the second loss value and the third loss value; adjusting the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model. The target multi-modal large model is used to predict a to-be-detected image to obtain a prediction label of the to-be-detected image.

[0033] Exemplarily, the first perturbation operation on the multi-modal feature to obtain a first perturbed feature can include but is not limited to: inputting the multi-modal feature into a policy generator to obtain a first initial policy vector, scaling a first target policy vector corresponding to the first initial policy vector to obtain a first initial perturbation step; inputting the multi-modal feature into an initial multi-modal large model to obtain a third predicted label of the sample image; determining a fourth loss value based on the third predicted label and the real label; determining a first gradient value corresponding to the fourth loss value, and determining a first target perturbation step based on the first gradient value and the first initial perturbation step; performing the first perturbation operation on the multi-modal feature based on the first target perturbation step to obtain the first perturbed feature.

[0034] Exemplarily, before the scaling of the first target policy vector corresponding to the first initial policy vector, a controllable activation operation can be performed on the first initial policy vector to obtain the first target policy vector; wherein the first target policy vector can be determined by the following formula: ; π The first initial policy vector can be represented as fc ( π The first target policy vector can be represented as s The obtained scale factor can be represented as T The obtained input sensitivity scaling parameter can be represented as o The obtained offset can be represented as

[0035] Exemplarily, the first target policy vector can be scaled by the following formula to obtain the first initial perturbation step: ; wherein The first initial perturbation step can be represented as The configured minimum perturbation step value can be represented as The configured maximum perturbation step value can be represented as

[0036] Exemplarily, the determination of the first target perturbation step based on the first gradient value and the first initial perturbation step can include but is not limited to: if the first gradient value is greater than 0, the first initial perturbation step is determined as the first target perturbation step; if the first gradient value is less than 0, the opposite of the first initial perturbation step is determined as the first target perturbation step. The first perturbation operation on the multi-modal feature based on the first target perturbation step to obtain the first perturbed feature can include: determining the first perturbed feature by the following formula: ; wherein x The first perturbed feature can be represented as x The multi-modal feature can be represented as The first target perturbation step can be represented as

[0037] The adjusting of the initial multi-modal large model based on the target loss value to obtain the target multi-modal large model can include but is not limited to: adjusting the network parameters of each network layer of the initial multi-modal large model to obtain the target multi-modal large model; wherein, for each network layer of the initial multi-modal large model:

[0038] performing a specified function operation on the input gradient value of the network layer to obtain the output gradient value of the network layer; performing a gradient clipping operation on the output gradient value of the network layer to obtain the clipped gradient value of the network layer; performing a noise adding operation on the clipped gradient value of the network layer to obtain the target gradient value of the network layer; and adjusting the network parameters of the network layer based on the target gradient value of the network layer. Wherein, for the last network layer, the input gradient value of the network layer can be the second gradient value corresponding to the target loss value; for a non-last network layer, the input gradient value of the network layer can be the output gradient value of the next network layer, or the input gradient value of the network layer can be the target gradient value of the next network layer.

[0039] The adjusting of the initial multi-modal large model based on the target loss value to obtain the target multi-modal large model can include but is not limited to: adjusting the network parameters of each network layer of the initial multi-modal large model to obtain the target multi-modal large model; wherein, for each network layer of the initial multi-modal large model:

[0040] ;

[0041] Wherein, z’ represents the output gradient value of the network layer, z represents the input gradient value of the network layer, T represents the obtained input sensitivity scaling parameter, s represents the obtained scale factor, o represents the obtained offset.

[0042] The adjusting of the initial multi-modal large model based on the target loss value to obtain the target multi-modal large model can include but is not limited to: adjusting the network parameters of each network layer of the initial multi-modal large model to obtain the target multi-modal large model; wherein, for each network layer of the initial multi-modal large model: ; wherein, p represents the input feature of the activation function, fc p represents the output feature of the activation function, T represents the obtained input sensitivity scaling parameter,​s represents the acquired scale factor, o represents the acquired offset.

[0043] From the above technical solutions, in the embodiments of the present application, the multi-modal features are subjected to a perturbation operation to obtain perturbed features, and the perturbed features are input into a multi-modal large model to obtain predicted labels. In this way, during the training of the multi-modal large model, the adversarial samples (i.e., perturbed features) are introduced, and the multi-modal large model learns to recognize and resist these disturbances and to distinguish between normal samples and adversarial samples, so that the multi-modal large model adapts to adversarial attacks during training, enhances the robustness of the multi-modal large model, and makes the multi-modal large model meet the prediction requirements without frequent training of the multi-modal large model, saving the computing resources of the hardware devices and reducing the training time.

[0044] After the first perturbation operation is performed on the multi-modal features to obtain the first perturbed features, the first perturbed features are input into the initial multi-modal large model to obtain the first predicted labels, the first loss value and the second loss value are determined based on the first predicted labels, and the initial multi-modal large model is adjusted based on the first loss value to obtain an intermediate multi-modal large model. The second perturbation operation is performed on the multi-modal features to obtain the second perturbed features, the second perturbed features are input into the intermediate multi-modal large model to obtain the second predicted labels, and the third loss value is determined based on the second predicted labels. On this basis, the initial multi-modal large model is adjusted based on the second loss value and the third loss value to obtain a target multi-modal large model, so that the prediction results of the adjusted model (i.e., the intermediate multi-modal large model) and the prediction results of the unadjusted model (i.e., the initial multi-modal large model) are jointly used for model training, the safety of the adjusted model and the unadjusted model is cooperatively enhanced, the robustness of the target multi-modal large model in the face of adversarial attacks is improved, the model performance is improved, the adversarial attack defense capability is significantly improved, the efficient and safe model protection capability is provided, the safety of the multi-modal large model is enhanced, and the training convergence speed is improved.

[0045] The embodiment of the application provides a network model security cooperative enhancement method, which can be applied to an electronic device. The method can include: obtaining a sample image; performing a first perturbation operation on the sample image to obtain a first perturbed image, inputting the first perturbed image into an initial network model to obtain a first predicted label of the sample image; determining a first loss value and a second loss value based on the first predicted label and a real label corresponding to the sample image; adjusting the initial network model based on the first loss value to obtain an intermediate network model; performing a second perturbation operation on the sample image to obtain a second perturbed image, inputting the second perturbed image into the intermediate network model to obtain a second predicted label of the sample image, and determining a third loss value based on the second predicted label and the real label; determining a target loss value based on the second loss value and the third loss value; and adjusting the initial network model based on the target loss value to obtain a target network model. The target network model is used for predicting a to-be-detected image to obtain a predicted label of the to-be-detected image.

[0046] Exemplarily, compared with the flow shown in Figure 1 the sample image corresponding to the multi-modal feature is replaced by the sample image, the first perturbed feature is replaced by the first perturbed image, the second perturbed feature is replaced by the second perturbed image, and the multi-modal large model is replaced by the network model. On this basis, the implementation flow of the network model security cooperative enhancement method is similar to the flow shown in Figure 1 and will not be repeated here.

[0047] The above technical solutions of the embodiments of the application will be described below in combination with specific application scenarios.

[0048] In the training process of the multi-modal large model, an attacker can make the multi-modal large model output a high-confidence incorrect prediction by adding subtle perturbations that are difficult to detect in clean samples. This phenomenon is called adversarial sample attack, and the clean sample after adding subtle perturbations is called adversarial sample. Through adversarial sample attack in the training process of the multi-modal large model, the prediction of the multi-modal large model will be wrong.

[0049] In the training process of the multi-modal large model, for each network layer of the multi-modal large model, the gradient value of the network layer needs to be input to the previous network layer, so that the previous network layer adjusts the network parameters based on the gradient value. However, this requires transmission of the gradient value of the network layer, and the gradient value will leak sensitive data.

[0050] In summary, the training process of the multi-modal large model has security threats, i.e., adversarial sample attack leading to model prediction error. The training process of the multi-modal large model has privacy threats, i.e., gradient value leaking sensitive data. In summary, the security and privacy of the multi-modal large model need to be cooperatively enhanced.

[0051] In view of the above finding, a privacy protection and security enhancement collaborative optimization method for a multi-modal large model is proposed in this embodiment to realize privacy and security collaborative enhancement of the multi-modal large model. In this embodiment, the prediction results of the adjusted model and the prediction results of the unadjusted model can be jointly used in model training to realize security collaborative enhancement of the adjusted model and the unadjusted model and improve the robustness of the multi-modal large model when facing adversarial attacks. In this embodiment, the privacy protection mechanism can be used to protect the gradient values output by the network layer from leaking sensitive data. In this embodiment, the strategy generator can be integrated into the sample perturbation process to generate adversarial samples based on the strategy generator, realize security collaborative enhancement of the strategy generator and adversarial training, and improve the robustness of the multi-modal large model when facing adversarial attacks.

[0052] A privacy and security enhancement method for a multi-modal large model is proposed in this embodiment, involving adaptive strategy generation and controllable activation mechanism processes. For the adaptive strategy generation process, a strategy generator is used to dynamically generate a strategy vector, and based on the strategy vector, diversity adversarial samples are generated to improve the robustness of the multi-modal large model and enhance the security of the multi-modal large model. For the controllable activation mechanism process, a controllable activation function (bounded activation function) is designed to regulate the activation scale and avoid gradient explosion, and is combined with a differential privacy optimizer to protect privacy. Based on adaptive strategy generation and controllable activation mechanism, collaborative optimization can be performed during training to achieve balanced improvement of the robustness and privacy of the multi-modal large model.

[0053] In this embodiment, the multi-modal large model is applicable to large model application scenarios such as image classification and natural language processing, and can provide efficient and secure protection for high-sensitivity scenarios such as medical diagnosis and financial risk control. An adversarial training framework is constructed using the strategy generator, the theoretical gradient upper bound characteristic is used to form a joint constraint mechanism with the optimizer, and the privacy budget and adversarial robustness are collaboratively improved. The amount of noise added can be significantly reduced, the adversarial attack defense capability can be improved, and the training fluctuation can be reduced. By integrating adversarial training and privacy protection mechanisms, the robustness of the multi-modal large model when facing adversarial attacks is improved, while ensuring data privacy during training.

[0054] In this embodiment, a controllable activation function is designed and deeply embedded into the model architecture of the multi-modal large model. The controllable activation function can be a bounded activation function that can regulate the activation scale and avoid gradient explosion. For example, the controllable activation function (Controlled Activation Function, fc) can be a bounded activation function used in specific layers of the main model to control the activation output scale and prevent gradient explosion. For example, an example of the controllable activation function can be: wherein, z is the input of the neuron, fcz ) is the output of the neuron, s is the scale factor (used to control the upper bound of activation), T is the inverse temperature (used to scale the sensitivity of input), o is the offset. By adjusting s and T , the range of activation values can be explicitly constrained, replacing the traditional activation function, and all intermediate activation values are constrained within the multi-modal large model, from the source to control the gradient amplitude. For the parameters of the controllable activation function, such as the scale factor s , the inverse temperature T and the offset o , the values of these parameters can be determined by hyperparameter search, and there is no limitation on this.

[0055] In the above application scenarios, a multi-modal large model security protection method is proposed in the embodiments of the present application, which can realize the privacy security collaborative enhancement of the multi-modal large model. Referring to FIG. 1, it is a flowchart of a multi-modal large model security protection method, which can include the following steps: Figure 2

[0056] Step 201, obtaining a sample image and a sample text corresponding to the sample image.

[0057] Exemplarily, a training data set can be obtained in advance, which can include a plurality of sample images. For each sample image, the training data set can further include a sample text corresponding to the sample image, which is the text description information of the sample image. For each sample image, the training data set can further include a true label (i.e. a pre-labeled label) corresponding to the sample image.

[0058] Step 202, performing feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image. Exemplarily, for each sample image in the training data set (hereinafter an example of one sample image is described), the sample image and the sample text corresponding to the sample image can be fused to obtain a multi-modal feature (i.e. a fusion feature of image features and text features) corresponding to the sample image.

[0059] Exemplarily, the sample image can be feature-extracted to obtain an image feature corresponding to the sample image, and the sample text can be feature-extracted to obtain a text feature corresponding to the sample text. Then, the image feature and the text feature are fused to obtain a multi-modal feature corresponding to the sample image. For example, the image feature and the text feature are input into a layer normalization network, and the image feature and the text feature are fused by the layer normalization network to obtain a multi-modal feature.

[0060] ​​For example, it can be expressed by the following formula: In the above formula, x ( v The visual modal input can be a sample image. x ( t () is a text modal input, which can be sample text. These represent the mode-specific linear transformation coefficients, which are used for feature extraction. This represents the image features corresponding to the sample image. These represent the mode-specific linear transformation coefficients, which are used for feature extraction. This represents the text features corresponding to the sample text. LayerNorm can represent a layer normalization network, which fuses the image features and the text features using a layer normalization network. It can represent multimodal features after feature fusion, and multimodal features can also be called unified feature vectors.

[0061] Step 203: Perform a first perturbation operation on the multimodal features to obtain the first perturbation features.

[0062] For example, after obtaining the multimodal features, the multimodal features can be treated as clean samples, and a first perturbation operation can be performed on the multimodal features to obtain the first perturbation features. The perturbation method is not limited. In one possible implementation, see [link to implementation details]. Figure 3 The diagram illustrates the process of performing a first perturbation operation on a multimodal feature to obtain a first perturbation feature. The perturbation process of the multimodal feature may include:

[0063] Step 2031: Input the multimodal features into the policy generator to obtain the first initial policy vector.

[0064] For example, a strategy generator can be pre-obtained. This strategy generator can be a neural network, a deep learning network, etc., and there are no restrictions on the network structure and training process of this strategy generator. The parameters of the strategy generator are denoted as... θa The input data for the policy generator can be multimodal features. x The output data of the policy generator can be a policy vector. π Thus, the processing of the strategy generator can be recorded as follows: That is, input data x Input to the policy generator A Strategy generator A Based on parameters θa For input data x Process the data and output the policy vector. π .

[0065] For example, the strategy generator is used to dynamically generate a strategy vector, and the output data of the strategy generator may be different even for the same input data. For example, the input data x 1 is input to the strategy generator, and the strategy generator outputs a strategy vector π 1 , the input data x 1 is input to the strategy generator, and the strategy generator outputs a strategy vector π 2 , the strategy vector π 2 may be different from the strategy vector π 1 , and the strategy vector π 2 may be the same as the strategy vector π 1 . In this way, the distribution of the strategy vector output by the strategy generator is adaptively adjusted during the training stage to match the robustness level of the multimodal large model.

[0066] In summary, in step 2031, the multimodal feature x may be input to the strategy generator, and the strategy generator may process based on the multimodal feature x to obtain a strategy vector π and output the strategy vector π . For convenience of distinction, this strategy vector π may be referred to as a first initial strategy vector.

[0067] Step 2032, determine a first target strategy vector corresponding to the first initial strategy vector.

[0068] For example, the first initial strategy vector is taken as the first target strategy vector, or the first initial strategy vector is operated by a specified function to obtain the first target strategy vector. For example, the first initial strategy vector is input to the specified function, and the first initial strategy vector is processed by the specified function to obtain the first target strategy vector. The first initial strategy vector is input to the specified function, and the first target strategy vector is output from the specified function. The specified function is not limited, and can be configured according to actual needs.

[0069] In one possible implementation, the specified function can be a controllable activation function, so that the first initial strategy vector can be subjected to a controllable activation operation to obtain the first target strategy vector. The controllable activation function is only an example of the specified function, and can also be a hyperbolic tangent activation function, a Sigmoid activation function, a ReLU activation function, etc. It can also be a convolution function, a pooling function, etc., and is not limited.

[0070] For example, the controllable activation function is taken as an example, the first target strategy vector can be determined by the following formula: ; π denotes the first initial strategy vector, fc ( π ) denotes the first target strategy vector, s denotes the obtained scale factor, T denotes the obtained input sensitivity scaling parameter (also referred to as inverse temperature), o denotes the obtained offset. For the scale factor s , the input sensitivity scaling parameter T and the offset o , they can be hyperparameters of the controllable activation function, and the values of the scale factor s , the input sensitivity scaling parameter T and the offset o can be determined through hyperparameter search, that is, the values of the scale factor s , the input sensitivity scaling parameter T and the offset o can be obtained in advance, and there is no limitation thereto.

[0071] As described above, the values of the scale factor s , the input sensitivity scaling parameter T and the offset o are known values, and after the first initial strategy vector π is substituted into the above formula, the first target strategy vector fc ( π ) can be obtained.

[0072] Step 2033, scaling the first target strategy vector to obtain the first initial perturbation step.

[0073] For example, the first target strategy vector can be scaled to obtain the first initial perturbation step by the following formula: . Of course, the above formula is only an example, and the scaling manner is not limited thereto, and the first target strategy vector can be scaled. In the above formula, denotes the first initial perturbation step, fc ( π ) denotes the first target strategy vector, denotes the configured minimum perturbation step value, denotes the configured maximum perturbation step value. and are used to constrain the perturbation range, which can be configured according to actual requirements, for example, =0.01, =0.1.

[0074] Step 2034: Input the multimodal features into the initial multimodal large model to obtain the predicted label of the sample image. For ease of distinction, record the predicted label as the third predicted label of the sample image.

[0075] For example, an initial multimodal large model, also known as the main model, can be pre-obtained. This is a large neural network model used for task prediction, serving as an augmentation target. The initial multimodal large model is the model to be trained; it can be a neural network, a deep learning network, etc., and its network structure is not limited. The parameters of the initial multimodal large model are denoted as... θm The input data for the initial multimodal large model can be multimodal features. x The output data of the initial multimodal large model can be predicted labels (there are no restrictions on these predicted labels; they can be any form of model prediction result, i.e., the output of the initial multimodal large model). Thus, the processing procedure for the initial multimodal large model can be recorded as follows: That is, input data x Input to the initial multimodal large model M Initial multimodal large model M Based on parameters θm For input data x Process the data and output the predicted labels. y’ .

[0076] In summary, in step 2034, multimodal features can be... x The input is given to the initial multimodal large model, which can be based on multimodal features. x Processing is performed to obtain predicted labels. y’ and output predicted labels. y’ For easier differentiation, this prediction label can be... y’ This is denoted as the third prediction label.

[0077] For example, in the process of inputting multimodal features into an initial multimodal large model to obtain a third predicted label, the initial multimodal large model may include multiple network layers. If there is a target network layer (such as at least one target network layer) among the multiple network layers, and the target network layer is a network layer with an activation function, then the target network layer can be activated by a controllable activation function.

[0078] For example, the target network layer can perform a controllable activation operation on the input features of the activation function to obtain the output features of the activation function, that is, the target network layer can use the controllable activation function as the activation function, and of course, the hyperbolic tangent activation function, the Sigmoid activation function, the ReLU activation function, etc. can also be used.

[0079] For example, the target network layer performs a controllable activation operation according to the following formula: ; wherein, p represents the input features of the activation function, fc ( p ) represents the output features of the activation function, T represents the obtained input sensitivity scaling parameter, s represents the obtained scale factor, o represents the obtained offset. For the scale factor s , the input sensitivity scaling parameter T and the offset o , they can be hyperparameters of the controllable activation function, and can be determined through hyperparameter search, that is, these hyperparameters can be obtained in advance.

[0080] As described above, the values of the scale factor s , the input sensitivity scaling parameter T and the offset o are known values, and after the input features p are substituted into the above formula, the output features fc ( p ) can be obtained.

[0081] In step 2035, a fourth loss value is determined based on the third predicted label and the true label of the sample image (i.e. the true label in the training data set y ), and a first gradient value corresponding to the fourth loss value is determined.

[0082] For example, the third predicted label is the prediction result of the initial multi-modal large model, and the true label is the pre-labeled true label. The closer the third predicted label is to the true label, the more accurate the prediction result of the initial multi-modal large model is. The fourth loss value can be determined based on the third predicted label and the true label, such as the difference between the two labels. For example, a loss function can be pre-configured, and the third predicted label and the true label are substituted into the loss function to obtain the fourth loss value. The loss function can be configured according to actual needs. For example, the loss function can use cross-entropy loss function, mean square error loss function, L1 norm loss function, KL divergence loss function, etc., which is not limited.

[0083] For example, the input of the cross-entropy loss function can be the third predicted label and the real label, and the output of the cross-entropy loss function can be the fourth loss value.

[0084] For example, the gradient is a vector that points to the direction in which the loss function increases fastest at a certain point. Gradient-based methods are widely used to solve the minimum or maximum value of the loss function. These methods calculate the gradient of the loss function at the current point and update the position of the current point in the opposite direction of the gradient to gradually approach the minimum or maximum value of the loss function, such as the gradient descent method. On this basis, based on the fourth loss value, the first gradient value corresponding to the fourth loss value can be determined. The gradient value calculation method is not limited, and the first gradient value can be determined.

[0085] Step 2036, determining a first target perturbation step length based on the first gradient value and a first initial perturbation step length.

[0086] For example, if the first gradient value is greater than 0, the first initial perturbation step length can be determined as the first target perturbation step length. Or, if the first gradient value is less than 0, the opposite number of the first initial perturbation step length can be determined as the first target perturbation step length. For example, , The first initial perturbation step length can be represented as The first target perturbation step length can be represented as For example, if the first gradient value is greater than 0, sign is positive, that is , if the first gradient value is less than 0, sign is negative, that is .

[0087] Step 2037, performing a first perturbation operation on the multi-modal feature based on the first target perturbation step length to obtain a first perturbed feature, that is, adding the first target perturbation step length to the multi-modal feature to obtain the first perturbed feature.

[0088] For example, the first perturbed feature can be determined by the following formula: ; x The first perturbed feature is represented as x The multi-modal feature is represented as The first target perturbation step length is represented as If the sum of the multi-modal feature and the first target perturbation step length is between 0 and 1, the first perturbed feature is the sum of the multi-modal feature and the first target perturbation step length, if the sum of the multi-modal feature and the first target perturbation step length is less than 0, the first perturbed feature is 0, if the sum of the multi-modal feature and the first target perturbation step length is greater than 1, the first perturbed feature is 1.

[0089] For example, regarding the sample perturbation process, the input is multimodal features. x First initial perturbation step size And the parameters of the initial multimodal large model θm The output is the first perturbation feature. x ′, First disturbance feature x ′ is an adversarial feature, which can be represented by the following formula: In the above formula, This represents the fourth loss value. Representing multimodal features x Parameters of the initial multimodal large model θm The third predicted label obtained below, y Indicates the true label, This represents the fourth loss value calculated based on the third predicted label and the true label. This indicates the initial multimodal large model in terms of multimodal features ( x , y The loss gradient on the first gradient is the first gradient value. If the first gradient value is greater than 0, then sign is positive; if the first gradient value is less than 0, then sign is negative. clip[0,1]() means clipping the value to the range [0,1], that is, the first perturbation feature is located in the range [0,1], which is the normalized feature.

[0090] At this point, step 203 is complete, and the first perturbation feature corresponding to the multimodal feature is obtained.

[0091] Step 204: Input the first perturbation feature into the initial multimodal large model to obtain the predicted label of the sample image. For ease of distinction, record this predicted label as the first predicted label of the sample image.

[0092] For example, an initial multimodal large model can be obtained in advance. This initial multimodal large model is a large neural network model used for task prediction, and its network structure is not restricted. The parameters of the initial multimodal large model are denoted as... θm The input data for the initial multimodal large model can be the first perturbation feature. x The output data of the initial multimodal large model can be predicted labels (there are no restrictions on these predicted labels; they can be any form of model prediction result). The processing procedure for the initial multimodal large model can be denoted as: That is, input data x Input to the initial multimodal large model M Initial multimodal large model M Based on parameters θm For input data x Process the data and output the predicted labels. y’ .

[0093] In step 204, the first perturbation feature x may be input to the initial multimodal large model, and the initial multimodal large model can process the first perturbation feature x to obtain a predicted label y’ and output the predicted label y’ . For the sake of distinction, this predicted label y’ is referred to as the first predicted label.

[0094] For example, for the process of inputting the first perturbation feature to the initial multimodal large model to obtain the first predicted label, the initial multimodal large model can include multiple network layers. If there is a target network layer (such as at least one target network layer) in the multiple network layers, and the target network layer is a network layer with an activation function, then for the target network layer, the target network layer can perform a controllable activation operation using a controllable activation function.

[0095] For example, the target network layer can perform a controllable activation operation on the input feature of the activation function to obtain the output feature of the activation function, that is, the target network layer can use the controllable activation function as the activation function, and of course, the hyperbolic tangent activation function, the Sigmoid activation function, the ReLU activation function, etc. can also be used.

[0096] For example, the target network layer performs a controllable activation operation using the following formula: ; wherein p represents the input feature of the activation function, fc ( p ) represents the output feature of the activation function, T represents an acquired input sensitivity scaling parameter, s represents an acquired scale factor, o represents an acquired offset. For the scale factor s , the input sensitivity scaling parameter T and the offset o , they can be hyperparameters of the controllable activation function, and can be determined through hyperparameter search, that is, these hyperparameters can be obtained in advance.

[0097] As described above, the values of the scale factor s , the input sensitivity scaling parameter T and the offset o are known values, and after the input feature p is substituted into the above formula, the output feature fc ( p ) can be obtained.

[0098] Step 205: Determine the first loss value based on the first predicted label and the true label of the sample image, and determine the second loss value based on the first predicted label and the true label of the sample image.

[0099] For example, the first predicted label is the prediction result of the initial multimodal large model, and the true label is the pre-labeled real label. The closer the first predicted label is to the true label, the more accurate the prediction result of the initial multimodal large model. A first loss value (second loss value) can be determined based on the first predicted label and the true label, such as the first loss value (second loss value) being related to the difference between these two labels.

[0100] For example, a first loss function and a second loss function can be pre-configured. Substituting the first predicted label and the true label into the first loss function yields the first loss value, and substituting them into the second loss function yields the second loss value. Both the first and second loss functions can be configured according to actual needs. For instance, the first loss function can be a cross-entropy loss function, mean squared error loss function, L1 norm loss function, KL divergence loss function, etc., and the second loss function can also be a cross-entropy loss function, mean squared error loss function, L1 norm loss function, KL divergence loss function, etc.

[0101] For example, the first loss function and the second loss function can be the same, such as both being the cross-entropy loss function. In this case, the first loss value and the second loss value are the same. Alternatively, the first loss function and the second loss function can be different, such as the first loss function being the cross-entropy loss function and the second loss function being the mean squared error loss function. In this case, the first loss value and the second loss value are different.

[0102] For example, taking the cross-entropy loss function as an example, the input to the cross-entropy loss function can be the first predicted label and the true label, and the output of the cross-entropy loss function can be either the first loss value or the second loss value. See the following formula for an example of the cross-entropy loss function: , Indicates the first disturbance characteristic x ′ in parameter θm The prediction results below, i.e., the initial multimodal large model M The first predicted label output, y Indicates the true label, L This indicates the first loss value or the second loss value.

[0103] Step 206: Adjust the initial multimodal large model based on the first loss value to obtain an intermediate multimodal large model. This intermediate multimodal large model is a reference model and is not output.

[0104] For example, after obtaining the first loss value, the gradient value can be determined based on the first loss value, and then the initial multimodal large model can be adjusted based on the gradient value. The adjusted model can be denoted as the intermediate multimodal large model. This embodiment does not impose restrictions on how the initial multimodal large model is adjusted; for example, gradient descent or other methods can be used to adjust the initial multimodal large model.

[0105] Step 207: Perform a second perturbation operation on the multimodal features to obtain the second perturbation features.

[0106] For example, after obtaining the multimodal features, a second perturbation operation can be performed on the multimodal features to obtain second perturbation features. For instance, the perturbation process of the multimodal features may include:

[0107] Step 2071: Input the multimodal features into the policy generator to obtain the second initial policy vector.

[0108] Multimodal features can be x The input is given to the policy generator, which can then base its policy on multimodal features. x Processing is performed to obtain the policy vector. π and output the policy vector. π This policy vector can be π Let this be denoted as the second initial policy vector. It's important to note that since the policy generator is used to dynamically generate policy vectors, even if the same multimodal feature is used... x The input is given to the policy generator, and the policy vector output by the policy generator may also be different. Therefore, the second initial policy vector may be different from the first initial policy vector.

[0109] Step 2072: Determine the second target policy vector corresponding to the second initial policy vector.

[0110] For example, a second initial policy vector can be processed by a specified function to obtain a second target policy vector. For instance, the second initial policy vector can be input to a specified function, and the specified function can process the second initial policy vector to obtain the second target policy vector. The specified function can be a controllable activation function, which can perform a controllable activation operation on the second initial policy vector to obtain the second target policy vector.

[0111] Step 2073: Scale the second target policy vector to obtain the second initial perturbation step size.

[0112] Step 2074: Input the multimodal features into the initial multimodal large model to obtain the fourth predicted label of the sample image. For example, considering that the same multimodal features are input into the initial multimodal large model, the fourth predicted label and the third predicted label may be the same predicted label.

[0113] Step 2075, determine a fifth loss value (which can be the same as the fourth loss value) based on the fourth predicted label and the real label of the sample image, and determine a third gradient value corresponding to the fifth loss value.

[0114] For example, the loss function can be pre-configured, and the fourth predicted label and the real label are substituted into the loss function to obtain the fifth loss value. The loss function can adopt a cross-entropy loss function, a mean square error loss function, an L1 norm loss function, a KL divergence loss function, etc. After obtaining the fifth loss value, the third gradient value can also be determined based on the fifth loss value, and the gradient value calculation method is not limited.

[0115] Step 2076, determine a second target perturbation step length based on the third gradient value and the second initial perturbation step length. If the third gradient value is greater than 0, the second initial perturbation step length is determined as the second target perturbation step length. If the third gradient value is less than 0, the inverse of the second initial perturbation step length is determined as the second target perturbation step length.

[0116] Step 2077, perform a second perturbation operation on the multi-modal feature based on the second target perturbation step length to obtain a second perturbed feature, that is, add the second target perturbation step length to the multi-modal feature to obtain the second perturbed feature.

[0117] For example, the second perturbed feature can be determined by the following formula: x wherein, represents the second perturbed feature, x represents the multi-modal feature, and represents the second target perturbation step length.

[0118] At this point, step 207 is completed, and the second perturbed feature corresponding to the multi-modal feature is obtained. For example, the acquisition process of the second perturbed feature is similar to that of the first perturbed feature, and can be referred to step 203.

[0119] Step 208, input the second perturbed feature into the intermediate multi-modal large model to obtain a second predicted label of the sample image, and determine a third loss value based on the second predicted label and the real label of the sample image.

[0120] For example, the intermediate multi-modal large model is obtained by adjusting the initial multi-modal large model, and the input data of the intermediate multi-modal large model can be the second perturbed feature, and the output data of the intermediate multi-modal large model can be the second predicted label. The processing process of the intermediate multi-modal large model is denoted as: that is, the input data x" is input into the intermediate multi-modal large model M , and the intermediate multi-modal large model M processes the input data based on the adjusted parameters θm to obtain the output data​x" perform processing and output a predicted label y" .

[0121] In step 208, the second perturbation feature can be input to an intermediate multimodal large model, and the intermediate multimodal large model can perform processing based on the second perturbation feature to obtain a second predicted label. x" x" In step 208, the second perturbation feature can be input to an intermediate multimodal large model, and the intermediate multimodal large model can perform processing based on the second perturbation feature to obtain a second predicted label. y" .

[0122] For example, for the process of inputting the second perturbation feature to the intermediate multimodal large model to obtain the second predicted label, the intermediate multimodal large model can include multiple network layers. If there is a target network layer (such as at least one target network layer) in the multiple network layers, and the target network layer is a network layer with an activation function, then for the target network layer, the target network layer can perform a controllable activation operation using a controllable activation function.

[0123] For example, the target network layer can perform a controllable activation operation on the input feature of the activation function to obtain the output feature of the activation function. For example, the target network layer can perform a controllable activation operation using the following formula: ; wherein, p represents the input feature of the activation function, fc ( p ) represents the output feature of the activation function, T represents an input sensitivity scaling parameter, s represents a scale factor, o represents an offset.

[0124] For example, after obtaining the second predicted label, a third loss value can be determined based on the second predicted label and the true label of the sample image. For example, a loss function can be pre-configured, and the second predicted label and the true label are substituted into the loss function to obtain the third loss value. The loss function can be configured according to actual needs, such as using a cross-entropy loss function, a mean square error loss function, an L1 norm loss function, a KL divergence loss function, etc. For example, taking the cross-entropy loss function as an example, the input of the cross-entropy loss function is the second predicted label and the true label, and the output of the cross-entropy loss function is the third loss value.

[0125] For example, the parameters of the initial multimodal large model can be updated using the first perturbation feature x , which can be represented as follows: is the first loss value (i.e., the cross-entropy loss), represents the gradient value corresponding to the first loss value, α represents an update step, which can be pre-configured, θm represents the parameters of the initial multimodal large model, θm ​′ represents the parameters of the intermediate multimodal large model. The above expression indicates that the intermediate multimodal large model is obtained by adjusting the initial multimodal large model.

[0126] Then, another policy vector can be used. π alt generates new adversarial examples x" For example, it can be represented by the following expression: . x" This indicates the second disturbance characteristic. π alt represents the second initial policy vector, thus representing the multimodal features. x Input to the initial multimodal large model θm The fourth predicted label is obtained, and based on the fourth predicted label and the second initial policy vector... π alt determines the second perturbation feature x" .

[0127] Then, the intermediate multimodal large model is evaluated using a third loss value. θm The prediction accuracy of the model is assessed using the third loss value, also known as the robustness loss value. The robustness loss value evaluates the resistance of a large multimodal model to diverse attacks after a single-step update. For example, the third loss value can be determined using the following formula: Alternatively, the third loss value can be determined using the following formula: Alternatively, the third loss value can be determined using the following formula: In the above formula, Indicates the second perturbation characteristic x" In parameters θm The prediction result under ' is the second predicted label output by the intermediate multimodal large model. y Indicates the true label, It can be an intermediate multimodal large model for the second perturbation feature. x" In predicting labels y The probability of. It can represent the cross-entropy loss value. π alt can represent the second initial policy vector or the second target policy vector, and E can represent the configured parameter value.

[0128] In the above formula, L robust represents the third loss value, also known as the robustness loss value, which encourages the policy generator to produce policy vectors that can improve the robustness of the model.

[0129] Step 209: Determine the target loss value based on the second loss value and the third loss value. For example, the second loss value and the third loss value can be weighted to obtain the target loss value.

[0130] For example, the target loss value is determined by using the following formula: , L total can represent the target loss value, L robust can represent the third loss value, L clean can represent the second loss value, and the third loss value represents a robustness loss value, and the second loss value represents a classification loss value, so as to comprehensively evaluate the robustness and classification accuracy, and combine the robustness and classification loss by weighting to obtain the target loss value. For the classification loss value, it is used to ensure the accuracy of the initial multi-modal large model on clean samples. λr and λc are trade-off coefficients (weighting coefficients), which can be configured according to actual needs, and are used to control the balance between robustness and accuracy. The trade-off coefficient λc can be greater than the trade-off coefficient λr , and the trade-off coefficient λc can be less than the trade-off coefficient λr .

[0131] Step 210, adjusting the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model, which is the final model of the training, and outputting the target multi-modal large model.

[0132] For example, after obtaining the target loss value, a gradient value can be determined based on the target loss value, and then the initial multi-modal large model is adjusted based on the gradient value to obtain an adjusted model. As to how to adjust the initial multi-modal large model to obtain the adjusted model, the present embodiment does not make any limitation, for example, the gradient descent method or the like can be used to adjust the initial multi-modal large model.

[0133] After obtaining the adjusted model, it is determined whether the adjusted model has converged. For example, if the target loss value is less than a threshold value, the adjusted model has converged, and if the target loss value is not less than the threshold value, the adjusted model has not converged. For example, if the number of iterations reaches a number threshold, the adjusted model has converged, and if the number of iterations does not reach the number threshold, the adjusted model has not converged. For example, if the iteration time length reaches a time length threshold, the adjusted model has converged, and if the iteration time length does not reach the time length threshold, the adjusted model has not converged.

[0134] If the adjusted model has converged, the adjusted model is taken as the target multi-modal large model, and the target multi-modal large model is output. If the adjusted model has not converged, the adjusted model is taken as the initial multi-modal large model, and step 203 is returned to re-perform the first perturbation operation on the multi-modal feature to obtain the first perturbed feature, and so on, until the adjusted model has converged, and the adjusted model is taken as the target multi-modal large model.

[0135] For example, when the initial multi-modal large model is adjusted based on the target loss value to obtain the target multi-modal large model (i.e., the adjusted model), if the initial multi-modal large model includes multiple network layers, the network parameters of each network layer of the initial multi-modal large model are adjusted to obtain the target multi-modal large model (i.e., the adjusted model), that is, the target multi-modal large model (i.e., the adjusted model) can include each adjusted network layer. For example, using the back propagation algorithm, the network parameters of the last network layer (e.g., network layer k) are first adjusted, then the network parameters of network layer k-1 are adjusted, and so on, the network parameters of network layer 2 are adjusted, and finally the network parameters of network layer 1 are adjusted.

[0136] In a possible implementation, for each network layer (for example, a network layer) of the initial multi-modal large model, the network parameters of the network layer can be adjusted by the following steps:

[0137] In step S11, the input gradient value of the network layer (for the input gradient value, see the subsequent embodiments) is subjected to a specified function to obtain the output gradient value of the network layer.

[0138] For example, the specified function can be a controllable activation function, so that the input gradient value of the network layer is subjected to a controllable activation operation to obtain the output gradient value of the network layer. The controllable activation function is only an example of the specified function, and can also be a hyperbolic tangent activation function, a Sigmoid activation function, a ReLU activation function, etc., and can also be a convolution function, a pooling function, etc., which are not limited.

[0139] For example, taking the controllable activation function as an example, the output gradient value of the network layer can be determined by the following formula: wherein, z’ represents the output gradient value of the network layer, z represents the input gradient value of the network layer, T represents the obtained input sensitivity scaling parameter, s represents the obtained scale factor, o represents the obtained offset. For the scale factor s , the input sensitivity scaling parameter T , and the offset o , they can be hyperparameters of the controllable activation function, and the values of the scale factor s , the input sensitivity scaling parameter T , and the offset o can be determined through hyperparameter search, that is, the values of the scale factor s , the input sensitivity scaling parameter T , and the offset o can be obtained in advance.

[0140] In summary, the scale factor s , the input sensitivity scaling parameter T and the offset o are known values, and after substituting the input gradient value z into the above formula, the output gradient value z’ can be obtained.

[0141] The derivation process of the above formula is described as follows: in the gradient backpropagation calculation process, the output of the first l layer is: z ( l )= W ( l ) h ( l −1)+ b ( l ), z ( l ) represents the output of the first l layer, W ( l ) represents the weight vector of the first l layer, b ( l ) ) represents the bias vector of the first l layer, h ( l −1) represents the output of the first l −1) layer, i.e., the input of the first l layer. Then, the gradient calculation is as follows: On this basis, since , we have: , i.e., the above formula is obtained.

[0142] In summary, in the gradient calculation process, the derivative with respect to fc , which is bounded in [0, Ts / 4], can be included to suppress gradient explosion, so that the output gradient value of the network layer can be obtained.

[0143] Step S12, performing a gradient clipping operation on the output gradient value of the network layer to obtain a clipped gradient value of the network layer. Gradient clipping (Gradient Clipping) is used to solve the problem of gradient explosion and ensure the stability and convergence of the training process of the multi-modal large model. In the gradient clipping process, by limiting the size of the gradient, the numerical instability or instability in the training process caused by the excessively large gradient can be avoided.

[0144] For example, by gradient clipping to constrain the gradient norm to limit the sensitivity, the following formula can be used to perform the gradient clipping operation: ,gi denotes the clipped gradient value, gi denotes the output gradient value, i.e., the output gradient value z’ , C denotes the clipping threshold (upper bound of L2 norm), denotes the L2 norm.

[0145] At step S13, the clipped gradient value of the network layer is subjected to a noise adding operation to obtain the target gradient value of the network layer, such as adding Gaussian noise to the clipped gradient value to obtain the target gradient value.

[0146] In a possible implementation, the average gradient value can be determined based on the plurality of clipped gradient values within the batch, and the average gradient value is taken as the target gradient value corresponding to each clipped gradient value within the batch. For example, the average gradient value can be determined by using the following formula: In the above formula, denotes the average gradient value, which can be taken as the target gradient value, B denotes the total number of clipped gradient values within the batch (i.e., the total number of sample images), denotes the i-th clipped gradient value, and N denotes the normal distribution, denotes the covariance matrix, σ denotes the noise scaling factor (i.e., the noise scale), which is used to control the privacy budget, fc constrains the gradient amplitude, and the amount of noise added is reduced, C denotes the gradient clipping threshold (upper bound of L2 norm), I denotes the unit matrix, which is a matrix with all off-diagonal elements being 0.

[0147] At step S14, the network parameter of the network layer is adjusted based on the target gradient value of the network layer.

[0148] For example, the network parameter can be adjusted by using the following formula: . θm denotes the updated network parameter of the network layer, θm denotes the network parameter of the network layer before updating, denotes the target gradient value of the network layer, η denotes the learning rate, which can be configured according to actual requirements.

[0149] For example, for the last network layer (such as network layer k), the input gradient value of this network layer can be the second gradient value corresponding to the target loss value. For instance, after obtaining the target loss value, the second gradient value, also called the second loss gradient, can be determined based on the target loss value. There are no restrictions on how this gradient value is calculated, and this second gradient value is used as the input gradient value of the last network layer. For example, the input gradient value of the last network layer can be expressed as: , L total represents the target loss value. This represents the network parameters for the last network layer. θm Calculate the gradient between the target loss value and the target loss value.

[0150] For layers other than the last, the input gradient value can be either the output gradient value or the target gradient value of the next layer. For example, the input gradient value of layer k-1 can be either the output gradient value or the target gradient value of layer k, and so on. The input gradient value of layer 2 can be either the output gradient value or the target gradient value of layer 3, and the input gradient value of layer 1 can be either the output gradient value or the target gradient value of layer 2. In this process, during backpropagation, a controllable activation function is used to process the input gradient values, and the gradients are clipped and noise is added. This prevents gradient values ​​from leaking data privacy when transmitting gradient values ​​between different layers, thus protecting data privacy.

[0151] In one possible implementation, after obtaining the target multimodal large model, it is used to predict the image to be detected, obtaining the predicted label for the image. For example, the image to be detected and its corresponding text can be obtained, and feature fusion can be performed on the image to be detected and the text to be detected to obtain the multimodal features corresponding to the image to be detected. Then, these multimodal features are input into the target multimodal large model, which outputs the predicted label for the image to be detected.

[0152] In one possible implementation, see Figure 4 The diagram shown illustrates the training process for a large multimodal model. Training data, including a large number of multimodal features, can be obtained. Batch sampling of the training data yields multiple multimodal features; the following explanation will use a single multimodal feature as an example.

[0153] The multimodal feature x is input into the main model M (i.e., the initial multimodal large model) to obtain the third predicted label, the fourth loss value, and the first gradient value. The multimodal feature x is input into the policy generator A to obtain the first initial policy vector. π, the first target policy vector and the first initial perturbation step. The first target perturbation step is determined based on the first gradient value and the first initial perturbation step, and the sample perturbation is performed based on the first target perturbation step to generate an adversarial sample x', which can be the first perturbed feature of the above-mentioned embodiments.

[0154] For example, the output of the clean sample (i.e., the multi-modal feature) for the prediction process of the main model is calculated as: y' = M(x, θm) = Softmax(W(L)h(L-1) + b(L)). For example, h(L) for each layer can be calculated by fc, for example, h(l) = fc(z(l)), z(l) = W(l)h(l-1) + b(l).

[0155] The adversarial sample x' is input into the main model M (i.e., the initial multi-modal large model) to perform prediction output using a controllable activation function fc, i.e., output a prediction label, and a classification loss Lclean (i.e., a second loss value) is calculated based on the prediction label. The adversarial sample x' is input into the main model M to perform adversarial prediction, i.e., output a prediction label, and a robustness loss Lrobust (i.e., a third loss value) is calculated based on the prediction label. The total loss Ltotal (i.e., the target loss value) is calculated based on the classification loss Lclean and the robustness loss Lrobust.

[0156] After obtaining the target loss value, the network parameters of the initial multi-modal large model can be fixed, and the network parameters of the policy generator can be updated based on the target loss value, for example, the network parameters of the policy generator are updated in a manner of maximizing the total loss, that is, based on the fixed network parameters of the initial multi-modal large model, the network parameters of the policy generator are adjusted to make the target loss value larger. For example, the following formula can be used to represent: , θa ' represents the updated network parameters of the policy generator, θa represents the network parameters of the policy generator before updating, η represents the learning rate, which can be configured according to actual needs. represents the parameters of the policy generator θa and the target loss value. Obviously, by gradient ascent optimization of the network parameters of the policy generator θa , the attack ability of the policy generator is strengthened.

[0157] The differential privacy optimizer (Differentially Private Optimizer, DPO) can perform controllable activation operation, gradient clipping and noise addition on input gradient values to obtain target gradient values, and update the network parameters of the main model M based on the target gradient values. Through repeated steps, the model converges, and finally the target multi-modal large model is obtained. In the early stage of model training, the main model is vulnerable, and the strategy generator is easy to generate weak attacks; as the training progresses, the robustness of the main model is enhanced, and the strategy generator is forced to learn stronger strategies, forming a dynamic game, gradually improving the overall robustness, and finally the robustness of the target multi-modal large model is stronger.

[0158] From the above technical solutions, in the embodiments of the present application, the prediction results of the initial multi-modal large model and the intermediate multi-modal large model are combined for model adjustment, and the prediction results of the adjusted model (i.e. the intermediate multi-modal large model) and the prediction results of the unadjusted model (i.e. the initial multi-modal large model) are jointly involved in model training, realizing the safe cooperative enhancement of the adjusted model and the unadjusted model, improving the robustness of the target multi-modal large model when facing adversarial attacks, improving the model performance, significantly improving the adversarial attack defense capability, providing efficient and safe model protection capability, realizing the safe enhancement of the multi-modal large model, and improving the training convergence speed.

[0159] A controllable activation function is designed to realize hard constraint of activation value, bound the gradient, and deeply embed each layer of the multi-modal large model to realize the dual control of activation value range constraint in forward propagation and gradient amplitude theory bound in backward propagation. At the same time, the privacy and security of the multi-modal large model are considered, forming a dynamic game training, and the strategy generator and the main model (initial multi-modal large model) form an adversarial cycle, and the parameters can be adaptively adjusted according to the attack strength, realizing the co-evolution of privacy protection and security enhancement in a unified framework. The gradient optimization joint constraint mechanism dynamically relates the theoretical gradient upper bound Ts / 4 of fc to the clipping threshold C, significantly reduces the noise addition amount, and improves the training convergence speed and privacy security of the multi-modal large model.

[0160] Based on the same application concept as the above method, the embodiments of the present application propose a multi-modal large model security protection device, as shown in Figure 5 The device includes:

[0161] The acquisition module 51 is configured to acquire a sample image and a sample text corresponding to the sample image, and perform feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image.

[0162] The processing module 52 is configured to perform a first perturbation operation on the multi-modal feature to obtain a first perturbation feature, and input the first perturbation feature into an initial multi-modal large model to obtain a first prediction label of the sample image.

[0163] The determination module 53 is used to determine a first loss value and a second loss value based on the first predicted label and the real label corresponding to the sample image; adjust the initial multimodal large model based on the first loss value to obtain an intermediate multimodal large model; perform a second perturbation operation on the multimodal features to obtain a second perturbation feature, input the second perturbation feature into the intermediate multimodal large model to obtain a second predicted label of the sample image, and determine a third loss value based on the second predicted label and the real label;

[0164] Training module 54 is used to determine a target loss value based on the second loss value and the third loss value; and to adjust the initial multimodal large model based on the target loss value to obtain a target multimodal large model;

[0165] The target multimodal large model is used to predict the image to be detected.

[0166] For example, when the processing module 52 performs a first perturbation operation on the multimodal features to obtain a first perturbation feature, it specifically performs the following steps: inputting the multimodal features into a policy generator to obtain a first initial policy vector, and scaling the first target policy vector corresponding to the first initial policy vector to obtain a first initial perturbation step size; inputting the multimodal features into the initial multimodal large model to obtain a third predicted label of the sample image; determining a fourth loss value based on the third predicted label and the true label; determining a first gradient value corresponding to the fourth loss value, and determining a first target perturbation step size based on the first gradient value and the first initial perturbation step size; and performing a first perturbation operation on the multimodal features based on the first target perturbation step size to obtain the first perturbation feature.

[0167] For example, the processing module 52 is further configured to perform a controllable activation operation on the first initial policy vector to obtain a first target policy vector; the processing module 52 determines the first target policy vector using the following formula: ; π This represents the first initial policy vector. fc ( π ) represents the first target policy vector. s This indicates the scale factor that has been obtained. T This indicates the input sensitivity scaling parameter. o This indicates the acquired offset; the processing module 52 uses the following formula to scale the first target policy vector to obtain the first initial perturbation step size: ; This represents the first initial perturbation step size. This indicates the minimum configured perturbation step size. This indicates the maximum configured perturbation step size.

[0168] For example, when the processing module 52 determines the first target perturbation step size based on the first gradient value and the first initial perturbation step size, it is specifically used to: if the first gradient value is greater than 0, then determine the first initial perturbation step size as the first target perturbation step size; if the first gradient value is less than 0, then determine the negative of the first initial perturbation step size as the first target perturbation step size; when the processing module 52 performs a first perturbation operation on the multimodal features based on the first target perturbation step size to obtain the first perturbation feature, it is specifically used to: determine the first perturbation feature using the following formula: ;in, x ′ indicates the first disturbance characteristic. x Represents multimodal features, This indicates the step size of the first target perturbation.

[0169] For example, when the training module 54 adjusts the initial multimodal large model based on the target loss value to obtain the target multimodal large model, it specifically performs the following steps: adjusting the network parameters of each network layer of the initial multimodal large model to obtain the target multimodal large model; wherein, for each network layer of the initial multimodal large model: performing a specified function operation on the input gradient value of the network layer to obtain the output gradient value of the network layer; performing a gradient clipping operation on the output gradient value of the network layer to obtain the clipped gradient value of the network layer; performing a noise addition operation on the clipped gradient value of the network layer to obtain the target gradient value of the network layer; and adjusting the network parameters of the network layer based on the target gradient value of the network layer.

[0170] Specifically, for the last network layer, the input gradient value of the network layer is the second gradient value corresponding to the target loss value; for non-last network layers, the input gradient value of the network layer is the output gradient value of the next network layer, or the target gradient value of the next network layer.

[0171] For example, when the training module 54 performs an operation on the input gradient value of the network layer using a specified function to obtain the output gradient value of the network layer, it specifically performs the following: if the specified function includes a controllable activation function, then it performs a controllable activation operation on the input gradient value of the network layer to obtain the output gradient value of the network layer; wherein: the training module 54 uses the following formula to determine the output gradient value of the network layer: z’ This represents the output gradient value of the network layer. z This represents the input gradient value of the network layer. T This indicates the input sensitivity scaling parameter. s Indicates the scale factor. o This indicates the offset.

[0172] For the process of inputting the first perturbation feature into the initial multi-modal large model to obtain the first predicted label of the sample image, if there is a target network layer in the plurality of network layers of the initial multi-modal large model, and the target network layer is a network layer with an activation function, the processing module 52 is further configured to perform a controllable activation operation on an input feature of the activation function through the target network layer to obtain an output feature of the activation function; wherein the processing module 52 performs the controllable activation operation through the target network layer according to the following formula: ; wherein, p represents the input feature of the activation function, fc p represents the output feature of the activation function, T represents an acquired input sensitivity scaling parameter, s represents an acquired scale factor, o represents an acquired offset.

[0173] Based on the same application concept as the above method, an electronic device is provided in the embodiments of the present application, as shown in Figure 6 The electronic device includes a processor 61 and a machine-readable storage medium 62, and the machine-readable storage medium 62 stores machine-executable instructions that can be executed by the processor 61; the processor 61 is configured to execute the machine-executable instructions to implement the multi-modal large model security protection method disclosed in the above examples of the present application.

[0174] Based on the same application concept as the above method, the embodiments of the present application also provide a machine-readable storage medium, and the machine-readable storage medium stores a plurality of computer instructions, and the computer instructions can implement the multi-modal large model security protection method disclosed in the above examples of the present application when executed by a processor.

[0175] The machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device, and can contain or store information such as executable instructions, data, etc. For example, the machine-readable storage medium can be a RAM (Random Access Memory), a volatile memory, a non-volatile memory, a flash memory, a storage drive (such as a hard disk drive), a solid state disk, any type of storage disk (such as an optical disk, a DVD, etc.), or a similar storage medium, or a combination thereof.

[0176] Based on the same application concept as the above method, the embodiments of the present application also provide a computer program product, which can include a computer program, and the computer program can implement the multi-modal large model security protection method disclosed in the above examples of the present application when executed by a processor. ​

[0177] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer-usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. The computer-usable or computer readable program code can be downloaded from an Internet location (such as websites, server, or other host computers) or from one computer to another over the network.

[0178] The embodiments of the present application described above are intended to be exemplary only. The application can be modified and varied greatly without departing from the scope of the application. Accordingly, the scope of the present application should be determined by the appended claims and their legal equivalents rather than by the examples given.

Claims

1. A multi-modal large model security protection method, characterized in that, The method comprises: obtaining a sample image and sample text corresponding to the sample image, and performing feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image; performing a first perturbation operation on the multi-modal feature to obtain a first perturbed feature, and inputting the first perturbed feature into an initial multi-modal large model to obtain a first predicted label of the sample image; determining a first loss value and a second loss value based on the first predicted label and a true label corresponding to the sample image, adjusting the initial multi-modal large model based on the first loss value to obtain an intermediate multi-modal large model, performing a second perturbation operation on the multi-modal feature to obtain a second perturbed feature, inputting the second perturbed feature into the intermediate multi-modal large model to obtain a second predicted label of the sample image, and determining a third loss value based on the second predicted label and the true label; determining a target loss value based on the second loss value and the third loss value, and adjusting the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model; wherein the target multi-modal large model is used for predicting a to-be-detected image.

2. The method of claim 1, wherein: the first perturbation operation on the multi-modal feature to obtain a first perturbed feature comprises: inputting the multi-modal feature into a strategy generator to obtain a first initial strategy vector, scaling a first target strategy vector corresponding to the first initial strategy vector to obtain a first initial perturbation step; inputting the multi-modal feature into the initial multi-modal large model to obtain a third predicted label of the sample image, and determining a fourth loss value based on the third predicted label and the true label; determining a first gradient value corresponding to the fourth loss value, and determining a first target perturbation step based on the first gradient value and the first initial perturbation step; and performing the first perturbation operation on the multi-modal feature based on the first target perturbation step to obtain the first perturbed feature.

3. The method of claim 2, wherein, Before the scaling of the first target strategy vector corresponding to the first initial strategy vector, the method further comprises: The first initial strategy vector is subjected to a controllable activation operation to obtain a first target strategy vector; wherein the first target strategy vector is determined by using the following formula: ; π represents the first initial strategy vector, fc ( π ) represents the first target strategy vector, s represents the obtained scale factor, T represents the obtained input sensitivity scaling parameter, o represents the obtained offset. Wherein, the first target strategy vector is scaled by using the following formula to obtain a first initial perturbation step size: ; wherein, represents the first initial perturbation step size, represents a configured perturbation step size minimum value, represents a configured perturbation step size maximum value.

4. The method of claim 2, wherein, determining the first target perturbation step based on the first gradient value and the first initial perturbation step comprises: if the first gradient value is greater than 0, determining the first initial perturbation step as the first target perturbation step; and if the first gradient value is less than 0, determining the inverse of the first initial perturbation step as the first target perturbation step; The first perturbation feature is obtained by performing a first perturbation operation on the multi-modal feature based on the first target perturbation step, including: determining the first perturbation feature by using the following formula: ; wherein, x ′ represents the first perturbation feature, x represents the multi-modal feature, represents the first target perturbation step.

5. The method of claim 1, wherein, the adjustment of the initial multi-modal large model based on the target loss value to obtain the target multi-modal large model comprises: adjusting network parameters of each network layer of the initial multi-modal large model to obtain the target multi-modal large model; wherein, for each network layer of the initial multi-modal large model: performing an operation on the input gradient value of the network layer by a specified function to obtain an output gradient value of the network layer; performing a gradient clipping operation on the output gradient value of the network layer to obtain a clipped gradient value of the network layer; performing a noise adding operation on the clipped gradient value of the network layer to obtain a target gradient value of the network layer; Adjust the network parameter of the network layer based on the target gradient value of the network layer; Wherein, for the last network layer, the input gradient value of the network layer is the second gradient value corresponding to the target loss value; for a non-last network layer, the input gradient value of the network layer is the output gradient value of the next network layer, or the target gradient value of the next network layer.

6. The method of claim 5, wherein, The operation of the input gradient value of the network layer on the specified function obtains the output gradient value of the network layer, comprising: If the specified function includes a controllable activation function, the input gradient value of the network layer is subjected to a controllable activation operation to obtain the output gradient value of the network layer; wherein the output gradient value of the network layer is determined by the following formula: ； ； z’ represents an output gradient value of the network layer, z represents an input gradient value of the network layer, T represents an input sensitivity scaling parameter that has been obtained, s represents a scale factor that has been obtained, o represents an offset that has been obtained.

7. The method of claim 1, wherein, For the process of inputting the first perturbation feature into the initial multi-modal large model to obtain the first predicted label of the sample image, if there is a target network layer in the plurality of network layers of the initial multi-modal large model, the target network layer is a network layer with an activation function, then the target network layer performs a controllable activation operation on the input feature of the activation function to obtain the output feature of the activation function; Wherein, the target network layer adopts the following formula for controllable activation operation: ; p represents the input feature of the activation function, fc ( p ) represents the output feature of the activation function, T represents the acquired input sensitivity scaling parameter, s represents the acquired scale factor, o represents the acquired offset.

8. A multi-modal large model security protection device, characterized by, The device comprises: The acquisition module is configured to acquire a sample image and a sample text corresponding to the sample image, and perform feature fusion on the sample image and the sample text to obtain a multi-modal feature corresponding to the sample image; The processing module is configured to perform a first perturbation operation on the multi-modal feature to obtain a first perturbation feature, and input the first perturbation feature into an initial multi-modal large model to obtain a first predicted label of the sample image; The determination module is configured to determine a first loss value and a second loss value based on the first predicted label and a true label corresponding to the sample image, adjust the initial multi-modal large model based on the first loss value to obtain an intermediate multi-modal large model, perform a second perturbation operation on the multi-modal feature to obtain a second perturbation feature, input the second perturbation feature into the intermediate multi-modal large model to obtain a second predicted label of the sample image, and determine a third loss value based on the second predicted label and the true label; The training module is configured to determine a target loss value based on the second loss value and the third loss value, and adjust the initial multi-modal large model based on the target loss value to obtain a target multi-modal large model; The target multi-modal large model is configured to predict a to-be-detected image.

9. The apparatus of claim 8, wherein, The processing module is specifically configured to: input the multi-modal feature into a strategy generator to obtain a first initial strategy vector, scale a first target strategy vector corresponding to the first initial strategy vector to obtain a first initial perturbation step; input the multi-modal feature into the initial multi-modal large model to obtain a third predicted label of the sample image; determine a fourth loss value based on the third predicted label and the real label; determine a first gradient value corresponding to the fourth loss value, and determine a first target perturbation step based on the first gradient value and the first initial perturbation step; and perform a first perturbation operation on the multi-modal feature based on the first target perturbation step to obtain a first perturbed feature. Alternatively, the processing module is further configured to perform a controllable activation operation on the first initial strategy vector to obtain a first target strategy vector; and the processing module determines the first target strategy vector according to the following formula: ; π wherein, the first initial strategy vector is denoted as fc ( π ), the first target strategy vector is denoted as s , the obtained scale factor is denoted as T , the obtained input sensitivity scaling parameter is denoted as o , and the obtained offset is denoted as ; the processing module scales the first target strategy vector according to the following formula to obtain a first initial perturbation step: ; wherein, , the first initial perturbation step is denoted as , the configured minimum perturbation step is denoted as , and the configured maximum perturbation step is denoted as Or, when the processing module determines the first target perturbation step based on the first gradient value and the first initial perturbation step, it is specifically used for: if the first gradient value is greater than 0, determining the first initial perturbation step as the first target perturbation step; if the first gradient value is less than 0, determining the opposite of the first initial perturbation step as the first target perturbation step; when the processing module performs the first perturbation operation on the multi-modal feature based on the first target perturbation step to obtain the first perturbed feature, it is specifically used for: determining the first perturbed feature by using the following formula: ; wherein, x ′ represents the first perturbed feature, x represents the multi-modal feature, represents the first target perturbation step; Alternatively, the training module is specifically configured to: adjust network parameters of each network layer of the initial multi-modal large model to obtain the target multi-modal large model based on the target loss value; wherein for each network layer of the initial multi-modal large model: perform an operation on an input gradient value of the network layer by using a specified function to obtain an output gradient value of the network layer; perform a gradient clipping operation on the output gradient value of the network layer to obtain a clipped gradient value of the network layer; perform a noise adding operation on the clipped gradient value of the network layer to obtain a target gradient value of the network layer; and adjust the network parameters of the network layer based on the target gradient value of the network layer. For the last network layer, the input gradient value of the network layer is a second gradient value corresponding to the target loss value; for a non-last network layer, the input gradient value of the network layer is an output gradient value of a subsequent network layer, or a target gradient value of the subsequent network layer. Or, the training module is specifically configured to: if the specified function includes a controllable activation function, perform a controllable activation operation on the input gradient value of the network layer to obtain the output gradient value of the network layer; wherein the training module determines the output gradient value of the network layer by using the following formula: z’ denotes the output gradient value of the network layer, z denotes the input gradient value of the network layer, T denotes an input sensitivity scaling parameter, s denotes a scale factor, o denotes an offset. Or, for the process of inputting the first disturbance feature to the initial multi-modal large model to obtain the first predicted label of the sample image, if there is a target network layer in the plurality of network layers of the initial multi-modal large model, and the target network layer is a network layer with an activation function, the processing module is further configured to perform a controllable activation operation on an input feature of the activation function through the target network layer to obtain an output feature of the activation function; wherein the processing module performs a controllable activation operation through the target network layer using the following formula: ; wherein, p represents the input feature of the activation function, fc p represents the output feature of the activation function, T represents an acquired input sensitivity scaling parameter, s represents an acquired scale factor, o represents an acquired offset.​ 10. An electronic device, comprising: The method comprises: a processor and a machine readable storage medium, the machine readable storage medium stores machine executable instructions which can be executed by the processor; the processor is configured to execute the machine executable instructions to implement the method in any one of claims 1-7.

Images