Visual model safety assessment method and device based on black-box data-free general adversarial disturbance

Abstract

The invention discloses a visual model security assessment method and device based on black-box data-free general adversarial disturbance, and the method comprises the steps: selecting a visual model as an alternative model, and obtaining an artificial data training set which comprises artificial images which are classified into a target category by the model with high confidence; constructing a plurality of auxiliary models according to the structure information of the substitution model, and integrating the plurality of auxiliary models with the original substitution model to obtain a comprehensive model; dynamically attacking the comprehensive model by utilizing an artificial data training set based on various attack strategies to obtain an attack success rate; self-adaptively evaluating vulnerabilities of the comprehensive model according to an attack success rate, and self-adaptively adjusting attack parameters, an attack strategy and an attack angle according to the attack parameter difference and the success rate of each data-free black box evaluation algorithm each time; and storing the model vulnerability key information. According to the method, the problems of data dependence and low mobility of an existing adversarial evaluation algorithm in a data-black-box-free scene are solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence and safety evaluation, and particularly relates to a visual model safety evaluation method and device based on black-box data-free general adversarial perturbation. BACKGROUND

[0002] With the rapid development of artificial intelligence technology, visual AI systems have been widely applied in key fields such as face recognition, image classification and object detection. However, these systems still face the challenge of insufficient safety of deep learning models in practical applications. The constantly emerging adversarial evaluation algorithms show that visual AI systems are actually extremely fragile. Attackers can introduce tiny and difficult-to-detect perturbations in the input data of the model through carefully designed adversarial samples, thereby inducing the model to produce false output results, and thus causing serious security risks. Since in real scenarios, the internal parameters and architecture of most artificial intelligence models are strictly protected, the safety evaluation method based on the more stringent data-free black-box adversarial scenario is closer to reality: in the black-box adversarial scenario, the evaluator can only know the input and output information of the model, and has no knowledge of the training data, internal structure and parameters of the model. Although existing evaluation techniques have achieved certain results in terms of safety evaluation and safety enhancement, they have many defects in the data-free black-box scenario: for example, they rely on real data, have low attack efficiency, limited evaluation effect and insufficient generalization ability.

[0003] Specifically, in terms of dependence on real data, generative adversarial perturbation techniques represented by methods such as NAG usually need to rely on large-scale real natural images (such as the ImageNet dataset) to train the generative model, so as to learn a perturbation distribution that can be generalized across models. This dependence on data makes it difficult for the method to be effectively applied in the absence of real data in the target domain or in the case of limited data. For example, in the fields of medical imaging, security monitoring, etc., there are privacy or cost barriers to obtaining large-scale high-quality data, thereby limiting the applicability of such methods. In terms of low attack efficiency, different models have different internal structures and calculation methods, and their response speed and degree to input perturbations are also different. If these differences are ignored, a large amount of time may be wasted on meaningless perturbation attempts on some models, and effective adversarial samples that cause the model to misjudge may not be found, thereby reducing the attack efficiency. In terms of limited evaluation effect, different deep learning models have different sensitivities and vulnerabilities to input data. For example, some models may be more sensitive to edge features of images, while others may pay more attention to color information. If these differences are not considered, the attack may be successful on some models, but fail on others, making it difficult to guarantee the evaluation effect. In terms of insufficient generalization ability, when an attacker attacks only according to the vulnerability of a specific model, the effectiveness of the generated adversarial samples on other models may be greatly reduced. This limits the wide application and adaptability of black-box adversarial evaluation algorithms between different models, and reduces their generalization ability.

[0004] Therefore, how to provide a visual model security evaluation method capable of solving the problems of dependence on real data, low attack efficiency, limited evaluation effect, and insufficient generalization ability is urgently needed. SUMMARY

[0005] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, provide a visual model security evaluation method based on black-box data-free universal adversarial perturbation, and propose a new data-free universal adversarial evaluation algorithm AE-UAP, which focuses on the robustness evaluation and enhancement of artificial intelligence models in a data-free black-box scenario, and aims to provide comprehensive protection for the security of visual AI systems through innovative alternative data generation methods and self-integration strategies.

[0006] To achieve the above purpose, the present application adopts the following technical solutions: In a first aspect, the present application provides a visual model security evaluation method based on black-box data-free universal adversarial perturbation, comprising the following steps: selecting a visual model as a substitute model and obtaining an artificial data training set, wherein the artificial data training set includes artificial images classified as a target class by the model with high confidence; According to the structural information of the alternative model, a plurality of auxiliary models are constructed, the plurality of auxiliary models are integrated with the original alternative model, and a comprehensive model is obtained; Based on a plurality of attack strategies, the comprehensive model is dynamically attacked by using the artificial data training set, and an attack success rate is obtained. According to the attack success rate, the vulnerability of the comprehensive model is adaptively evaluated, and according to the attack parameter difference and the success rate of each data-free black box evaluation algorithm each time, the attack parameters, the attack strategy and the attack angle are adaptively adjusted. Save the model vulnerability key information.

[0007] As a preferred technical solution, the visual model is selected as the alternative model, and the artificial data training set is obtained, specifically: in a data-free black box scene, a plurality of known visual models are selected as alternative models, structural information of the alternative models is obtained, an adversarial sample is obtained by using the structural information, the adversarial sample is input into a target model, and an artificial data training set is obtained.

[0008] As a preferred technical solution, the adversarial sample is obtained by using the structural information, specifically: an input image is constructed by using the structural information, the input image is enhanced by using an input transformation algorithm, a plurality of enhanced images are obtained, loss calculation is performed on all enhanced images and gradient optimization is performed, and an adversarial sample is obtained; the input transformation algorithm includes unsupervised representation learning based on mutual information maximization and similar transformation matrix calculation.

[0009] As a preferred technical solution, the model corresponding category output artificial image is maximized based on an iterative optimization process, as follows:

[0010] Among them, is the artificial image corresponding to the category c at the tth iteration, and γ is the step length of optimization, is the gradient used to optimize the artificial image, is the confidence of the artificial image being classified as the target category by the model, is the confidence of the jth category other than the target category.

[0011] As a preferred technical solution, the plurality of auxiliary models are constructed according to the structural information of the alternative model, including: for the structural information of a single alternative model, a plurality of auxiliary models are constructed, the auxiliary models are similar in structure to the original alternative model, and there are a plurality of parameters with differences.

[0012] As a preferred technical solution, the integration of multiple auxiliary models with the original alternative model to obtain a comprehensive model includes: inputting multiple auxiliary models and the original alternative model into the artificial data training set respectively, calculating the input loss of the artificial data training set, calculating the gradient of the input loss after weighted averaging, using the logit integration method to enable the generated perturbation to learn the structural information of different models, obtaining common structural information, and using the common structural information to construct a comprehensive model. Simultaneously, a weighted average of multiple auxiliary models and the original alternative model is calculated. A portion of the models are randomly selected, and the difference between the gradient of this portion of the models and the weighted average is calculated as the loss function, minimizing the gradient variance of the perturbation on these models.

[0013] As a preferred technical solution, the attack strategy includes a general adversarial evaluation algorithm for data-free black-box scenarios, a generator-based general adversarial evaluation algorithm for black-box scenarios, a generator-based general adversarial evaluation algorithm for data-free black-box scenarios, and a gradient-based general adversarial evaluation algorithm for black-box scenarios; the attack angles include model feature angles and model architecture angles.

[0014] As a preferred technical solution, the method of saving key information about model vulnerabilities specifically involves automatically saving key information after the attack is completed. This key information includes attack parameters, attack strategy, attack angle, labels, original image, and corresponding adversarial samples.

[0015] Secondly, the present invention also provides a visual model security assessment system based on black-box data-free general adversarial perturbation, which is applied to the aforementioned visual model security assessment method based on black-box data-free general adversarial perturbation, including a data processing module, a model integration module, an automatic assessment module, and an information recording module. The data processing module is used to select a visual model as an alternative model and obtain an artificial data training set, wherein the artificial data training set includes artificial images that are classified as target categories by the model with high confidence. The model integration module is used to construct multiple auxiliary models based on the structural information of the alternative model, and integrate the multiple auxiliary models with the original alternative model to obtain a comprehensive model; The automatic attack module is used to dynamically attack the comprehensive model based on multiple attack strategies and artificial data training sets to obtain the attack success rate. The automatic evaluation module is used to adaptively evaluate the vulnerabilities of the comprehensive model based on the attack success rate, and statistically analyze the differences in attack parameters and success rate of each attack strategy, and adaptively adjust the attack parameters, attack strategies and attack angles. The information recording module is used to save key information about model vulnerabilities.

[0016] Thirdly, the present invention provides an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to perform the visual model security assessment method based on black-box dataless general adversarial perturbation.

[0017] Compared with the prior art, the present invention has the following advantages and beneficial effects: This invention proposes a novel, data-free, black-box general evaluation algorithm. Through data generation and simulated self-integration strategies, it first extracts high-confidence artificial data, then integrates this data with the model. This eliminates reliance on labeled data and omits the label query step for attack rate calculation, enabling more effective and accurate evaluation of model security performance in data-free black-box scenarios. Simultaneously, it automates the entire process, including adversarial evaluation generation, robustness enhancement implementation, and effect evaluation, providing a user-friendly API interface and operation interface. It supports the storage and analysis of key data such as evaluation parameters, success rate, and robustness enhancement effects, lowering the technical barrier to entry. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a visual model security assessment method based on black-box, data-free general adversarial perturbation according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the visual model security assessment system based on black-box, data-free general adversarial perturbation according to an embodiment of the present invention; Figure 3 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0021] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0022] ViT (Vision Transformer) is defined as a model that introduces the Transformer architecture from the field of natural language processing into computer vision for processing image data. It segments images into fixed-size patches and treats these patches as serialized "visual words" or "tokens," which are then fed into a Transformer encoder for feature extraction and classification.

[0023] UAP (Universal Adversarial Perturbations) is an input-independent adversarial perturbation designed to trick a well-trained neural network into making incorrect predictions about a set (ideally all) of input images.

[0024] SVRE (Stochastic Variance Reduced Ensemble) is a stochastic variance-reduced ensemble attack method that aims to improve the transferability of adversarial examples by reducing the gradient variance of the ensemble model.

[0025] Please see Figure 1 This embodiment provides a method for security assessment of visual models based on black-box, data-free general adversarial perturbation, including the following steps: S1. Select a visual model as an alternative model and obtain a training set of artificial data, wherein the training set of artificial data includes artificial images that are classified as target categories by the model with high confidence.

[0026] In step S1, based on the black-box scenario with no data, we cannot know the internal architecture of the target model, and we also lack training data for constructing adversarial perturbations. Therefore, this embodiment uses a known model as a substitute to obtain architectural information to generate adversarial examples, and then inputs the adversarial examples into the target model for evaluation. This method is called a transfer-based adversarial evaluation algorithm, and the model that generates the adversarial examples is called the substitute model. The attack effect of the adversarial examples on a target model that is different from the substitute model is called transferability.

[0027] Visual models typically employ CNN-based and ViT-based architectures. CNN-based architectures include, but are not limited to, AlexNet and EfficientNet, while ViT-based architectures include, but are not limited to, T2T-ViT and FastViT.

[0028] To generate adversarial examples, this embodiment employs a transferability enhancement algorithm. A transferability enhancement algorithm is applied during the adversarial example generation process to enhance the attack effectiveness of the generated adversarial examples on different models, ensuring that the robustness of the adversarial examples can be accurately evaluated across multiple models. Its core objective is to guide the adversarial examples to learn common features across different models or data.

[0029] Specifically, the input image is constructed using structural information, and the input image is enhanced using an input transformation algorithm to obtain multiple enhanced images. Loss calculation and gradient optimization are performed on all enhanced images to obtain adversarial examples. The input transformation algorithm includes unsupervised representation learning based on maximizing mutual information and similarity transformation matrix calculation.

[0030] Input transformation algorithms are a class of transferable data augmentation algorithms that perform data augmentation on input images. Their core idea is to enhance the diversity of input data, making the constructed adversarial perturbations more adaptable to different data types. For example, DIM sets a transformation operator T... i (), for the alternative model f, for each input image QUOTE Random scaling and padding are performed to obtain N enhanced images T of the input image. i (x), then calculate the gradient g of the average loss function J on all images and optimize it so that the generated adversarial example can maximize the difference from the correct label y on various images. The calculation process is roughly as follows:

[0031] Similarly, SIM scales each input image at different ratios to obtain multiple augmented images, calculates gradients on these images and averages them, thereby improving the generalization ability of the perturbation to images of different scales; while Admix randomly selects some images of different categories from the input image, weights and mixes them with the input image to obtain multiple versions of augmented input, and calculates the average loss function, thereby improving the transferability of adversarial examples under different models and defense mechanisms.

[0032] Of course, in addition to the above-mentioned methods for obtaining adversarial examples, this embodiment can also generate artificial data with some natural data characteristics through random Gaussian noise or color block mosaic to solve the data dependency problem.

[0033] Next, for the alternative model, the model's corresponding category output is maximized based on the following iterative optimization process, thereby generating an artificial image that will be classified as the target category by the model with high confidence: .

[0034] in, Let be the artificial image corresponding to category c at the t-th iteration, and γ be the optimization step size. The gradient of the loss function with respect to the artificial image. The confidence level at which a human-made image is classified as the target category by the model. For the third category other than the target category j Confidence level of each category.

[0035] S2. Construct multiple auxiliary models based on the structural information of the alternative model, integrate the multiple auxiliary models with the original alternative model, and obtain a comprehensive model.

[0036] Based on the existing structural information of a single alternative model, multiple auxiliary models are constructed that are similar in structure to the original alternative model but have certain differences. Then, the alternative and auxiliary models are integrated to achieve enhanced transferability without introducing additional models. Specifically, for any model, its structure can be represented as follows:

[0037] in, The fully connected layer (classifier) ​​in the representative model is used for classification. The Mth layer or operator of the model.

[0038] By modifying the forward propagation path of the model, a new model different from the original alternative model can be obtained, which can be represented in the following form: , It is a 1x1 convolutional layer used to align the modified layers. Layers and Layer channels. Integrating the new model with the original model can effectively enhance the portability of attacks, thereby accurately assessing security across different models.

[0039] Regarding model ensemble, this embodiment employs SVRE. The model ensemble algorithm, by jointly calculating and optimizing the loss function across multiple surrogate models, allows the generated perturbations to learn structural information from different models, thereby constructing more generalized perturbations and enhancing their cross-model effectiveness. For example, the logit-based ensemble method jointly calculates the input image QUOTE across M models. The loss function J is used to calculate its weighted average gradient g to optimize the perturbation, so that the generated adversarial examples maximize the difference from the correct label y on these models. The calculation process is roughly as follows:

[0040] In this way, by using the logit ensemble method, the generated perturbations learn structural information from different models, acquire common structural information, and use the common structural information to build a comprehensive model.

[0041] Furthermore, the SVRE method avoids getting trapped in local optima by reducing the gradient variance between models. This method points out that directly calculating the weighted average of multiple models for optimization may lead to gradient cancellation between models with large differences, thus affecting the effectiveness of the optimization. Simultaneously, after calculating the weighted average gradient of multiple models each time, this method randomly selects a portion of the models and calculates the difference between their gradients and the average gradient as the loss function. This minimizes the gradient variance of adversarial examples on these models, generating more stable and less volatile adversarial examples.

[0042] These transferability enhancement algorithms use different mechanisms to improve the effectiveness of adversarial examples on different models, ensuring the effectiveness and accuracy of adversarial examples in actual evaluation.

[0043] In addition, model integration can also adopt a self-integration strategy based on skip connections: by introducing skip connections in the model forward propagation, similar but diverse forward propagation paths can be constructed, which is similar to the integration of multiple similar architecture models.

[0044] S3. Based on multiple attack strategies, use artificial data training sets to dynamically attack the comprehensive model and obtain the attack success rate.

[0045] The attack strategy in this embodiment employs a black-box general adversarial evaluation algorithm, including but not limited to the following: (1) FFF: FFF is a general adversarial evaluation algorithm designed for black-box scenarios without data. It uses random images such as Gaussian noise as substitute data, and based on gradient optimization, guides the perturbation to maximize the feature activation of each layer of the model indiscriminately, thereby misleading the model to extract incorrect features.

[0046] (2) NAG: The NAG method is a generator-based black-box general adversarial evaluation algorithm that uses natural images to train the generator and encourages it to generate diverse adversarial examples that can effectively affect the model's predictions.

[0047] (3) AAA: AAA is a generator-based, data-free, black-box general adversarial evaluation algorithm that generates alternative data by extracting feature information learned by the model. This trains the perturbation generator to generate more deceptive adversarial examples.

[0048] (4) COS-UAP: COS-UAP is a gradient-based black-box general adversarial evaluation algorithm that uses jigsaw puzzle noise as substitute data. It can be applied in both data-free and conventional scenarios. The algorithm uses a self-supervised method to maximize the output difference between clean samples and adversarial samples, thereby misleading the model to the greatest extent.

[0049] S4. Adaptively evaluate the vulnerabilities of the comprehensive model based on the attack success rate, and adaptively adjust the attack parameters, attack strategies, and attack angles based on the differences in attack parameters and success rates of each data-free black-box evaluation algorithm.

[0050] In step S4, the above algorithm is used to introduce minute noise that is imperceptible to the human eye, thus fooling the model and compromising its robustness. In the data-free black-box scenario, the intrinsic parameters of the visual model and the training samples cannot be obtained. Therefore, we will dynamically attack the visual model based on multiple data-free black-box evaluation algorithms to comprehensively evaluate the model's robustness.

[0051] Once all the original samples are input into the system, the system will automatically calculate the probability of success for each attack when the model is attacked from multiple angles and strategies during the attack process. Then, based on this probability, the system will adaptively evaluate the vulnerability of the model and adaptively adjust the parameters, attack strategies and angles according to the differences in attack parameters and success rates of each algorithm each time. This will help users discover the vulnerabilities of the attacked model and amplify its flaws, thereby increasing the probability of the model being deceived.

[0052] Another explanation is that the attack angle can be divided into the model feature angle and the model architecture angle, where: (1) From the perspective of model features: During the training process, the model learns the category feature information contained in the data, internalizes it into the model's weight parameters, and reflects it in the model's output. Therefore, based on the model's output information, we can evaluate the degree of matching between the input data and the category features. Furthermore, by using the output information as a reference for iterative optimization, we can generate artificial images that highly match a certain category feature, thereby constructing usable data in scenarios where no data is available.

[0053] (2) From the perspective of model architecture: Different model architectures exhibit different performance characteristics and vulnerabilities when processing various types of data, such as Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and Vit (Vision Transformer). Integrating diverse model architectures can effectively improve transferability. However, obtaining and training models with different architectures in real-world scenarios is very difficult. Therefore, it is crucial to make full use of limited model structure information. This algorithm, based on single model structure information, can construct multiple auxiliary models with similar but different architectures by pruning the structure, thereby enhancing model diversity and effectively improving evaluation results.

[0054] S5. Save key information about model vulnerabilities.

[0055] The system automatically saves crucial information after an attack is completed, including attack parameters, attack methods, labels, original images, and adversarial samples. This information helps improve the success rate and facilitates user analysis of model vulnerabilities. Furthermore, the system automatically categorizes and evaluates which methods pose the greatest threat to the model. This persistent storage strategy allows for better detection of model robustness and provides new perspectives for robustness enhancement algorithms.

[0056] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0057] Based on the same idea as the visual model security assessment method based on black-box dataless general adversarial perturbation in the above embodiments, the present invention also provides a visual model security assessment system based on black-box dataless general adversarial perturbation. This system can be used to execute the aforementioned visual model security assessment method based on black-box dataless general adversarial perturbation. For ease of explanation, the structural diagram of the embodiment of the visual model security assessment system based on black-box dataless general adversarial perturbation only shows the parts related to the embodiments of the present invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0058] Please see Figure 2 In another embodiment of this application, a visual model security evaluation system 10 based on black-box data-free general adversarial perturbation is provided. The system includes a data processing module 11, a model integration module 12, an automatic evaluation module 13, and an information recording module 14. Data processing module 11 is used to select a visual model as an alternative model and obtain an artificial data training set, wherein the artificial data training set includes artificial images that are classified as target categories by the model with high confidence. The model integration module 12 is used to construct multiple auxiliary models based on the structural information of the alternative model, and integrate the multiple auxiliary models with the original alternative model to obtain a comprehensive model; The automatic attack module 13 is used to dynamically attack the comprehensive model based on multiple attack strategies and artificial data training set to obtain the attack success rate. The automatic evaluation module 14 is used to adaptively evaluate the vulnerabilities of the comprehensive model based on the attack success rate, and statistically analyze the differences in attack parameters and success rate of each attack strategy, and adaptively adjust the attack parameters, attack strategies and attack angles. Information recording module 15 is used to save key information about model vulnerabilities.

[0059] It should be noted that the visual model security assessment system based on black-box dataless universal adversarial perturbation of the present invention corresponds one-to-one with the visual model security assessment method based on black-box dataless universal adversarial perturbation of the present invention. The technical features and beneficial effects described in the embodiments of the visual model security assessment method based on black-box dataless universal adversarial perturbation described above are all applicable to the embodiments of the visual model security assessment method based on black-box dataless universal adversarial perturbation. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0060] Furthermore, in the implementation of the visual model security assessment system based on black-box dataless universal adversarial perturbation in the above embodiments, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or software implementation convenience. That is, the internal structure of the visual model security assessment system based on black-box dataless universal adversarial perturbation is divided into different program modules to complete all or part of the functions described above.

[0061] Please see Figure 3 In one embodiment, an electronic device is provided for implementing a visual model security assessment method based on black-box dataless general adversarial perturbation. The electronic device 20 may include a first processor 21, a first memory 22 and a bus, and may also include a computer program stored in the first memory 22 and executable on the first processor 21, such as a visual model security assessment program 23 based on black-box dataless general adversarial perturbation.

[0062] The first memory 22 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory 22 can be an internal storage unit of the electronic device 20, such as the portable hard drive of the electronic device 20. In other embodiments, the first memory 22 can be an external storage device of the electronic device 20, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device 20. Furthermore, the first memory 22 can include both internal storage units and external storage devices of the electronic device 20. The first memory 22 can be used not only to store application software and various types of data installed on the electronic device 20, such as the code of the black-box data-free general adversarial visual model security assessment program 23, but also to temporarily store data that has been output or will be output.

[0063] In some embodiments, the first processor 21 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor 21 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory 22 and calls data stored in the first memory 22 to perform various functions of the electronic device 20 and process data.

[0064] Figure 3 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 3 The structure shown does not constitute a limitation on the electronic device 20, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0065] The security assessment program 23 for a visual model based on black-box, data-free general adversarial perturbation, stored in the first memory 22 of the electronic device 20, is a combination of multiple instructions. When run in the first processor 21, it can achieve the following: A visual model is selected as an alternative model, and a training set of artificial data is obtained, which includes artificial images that are classified as the target category by the model with high confidence. Multiple auxiliary models are constructed based on the structural information of the alternative model, and the multiple auxiliary models are integrated with the original alternative model to obtain a comprehensive model; Based on multiple attack strategies, the comprehensive model is dynamically attacked using artificial data training sets to obtain the attack success rate. The vulnerability of the comprehensive model is adaptively evaluated based on the attack success rate, and the attack parameters, attack strategies and attack angles are adaptively adjusted based on the differences in attack parameters and success rates of each dataless black-box evaluation algorithm. Save key information about model vulnerabilities.

[0066] Furthermore, if the modules / units integrated in the electronic device 20 are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0067] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0068] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0069] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A method for security assessment of visual models based on black-box, data-free general adversarial perturbation, characterized in that, Includes the following steps: A visual model is selected as an alternative model, and a training set of artificial data is obtained, which includes artificial images that are classified as the target category by the model with high confidence. Multiple auxiliary models are constructed based on the structural information of the alternative model, and the multiple auxiliary models are integrated with the original alternative model to obtain a comprehensive model; Based on multiple attack strategies, the comprehensive model is dynamically attacked using artificial data training sets to obtain the attack success rate. Based on the attack success rate, the vulnerability of the comprehensive model is adaptively evaluated, and the differences in attack parameters and success rate of each attack strategy are statistically analyzed. The attack parameters, attack strategies and attack angles are then adaptively adjusted. Save key information about model vulnerabilities.

2. The method for security assessment of visual models based on black-box, data-free general adversarial perturbation as described in claim 1, characterized in that, The process of selecting a visual model as an alternative model and obtaining an artificial data training set involves: in a black-box scenario without data, selecting multiple known visual models as alternative models, obtaining the structural information of the alternative models, using the structural information to obtain adversarial examples, inputting the adversarial examples into the target model, and obtaining an artificial data training set.

3. The visual model security assessment method based on black-box, data-free general adversarial perturbation according to claim 2, characterized in that, The method of obtaining adversarial examples using structural information specifically involves: constructing an input image using structural information, enhancing the input image using an input transformation algorithm to obtain multiple enhanced images, calculating the loss and optimizing the gradient on all enhanced images to obtain adversarial examples; the input transformation algorithm includes unsupervised representation learning based on maximizing mutual information and similarity transformation matrix calculation.

4. The visual model security assessment method based on black-box, data-free general adversarial perturbation according to claim 1, characterized in that, The model outputs an artificial image based on the corresponding category through an iterative optimization process, as shown in the following formula: in, Let be the artificial image corresponding to category c at the t-th iteration, and γ be the optimization step size. To optimize gradients in artificial images, The confidence level at which a human-made image is classified as the target category by the model. For the third category other than the target category j Confidence level of each category.

5. The method for security assessment of visual models based on black-box, data-free general adversarial perturbation as described in claim 1, characterized in that, The construction of multiple auxiliary models based on the structural information of the alternative model includes: constructing multiple auxiliary models for the structural information of a single alternative model, wherein the auxiliary models are structurally similar to the original alternative model and have several different parameters.

6. The method for security assessment of visual models based on black-box, data-free general adversarial perturbation as described in claim 1, characterized in that, The process of integrating multiple auxiliary models with the original alternative model to obtain a comprehensive model includes: inputting multiple auxiliary models and the original alternative model into an artificial data training set respectively, calculating the input loss of the artificial data training set, calculating the gradient of the input loss after weighted averaging, using the logit ensemble method to enable the generated perturbation to learn the structural information of different models, obtaining common structural information, and using the common structural information to construct a comprehensive model. Simultaneously, a weighted average of multiple auxiliary models and the original alternative model is calculated. A portion of the models are randomly selected, and the difference between the gradient of this portion of the models and the weighted average is calculated as the loss function, minimizing the gradient variance of the perturbation on these models.

7. The method for security assessment of visual models based on black-box, data-free general adversarial perturbation as described in claim 1, characterized in that, The attack strategies include a general adversarial evaluation algorithm for data-free black-box scenarios, a generator-based general adversarial evaluation algorithm for black-box scenarios, a generator-based general adversarial evaluation algorithm for data-free black-box scenarios, and a gradient-based general adversarial evaluation algorithm for black-box scenarios; the attack angles include model feature angles and model architecture angles.

8. The method for security assessment of visual models based on black-box, data-free general adversarial perturbation as described in claim 1, characterized in that, The process of saving key information about model vulnerabilities specifically involves automatically saving key information after an attack is completed. This key information includes attack parameters, attack strategy, attack angle, labels, original image, and corresponding adversarial samples.

9. A visual model security assessment system based on black-box, data-free general adversarial perturbation, characterized in that, The visual model security assessment method based on black-box data-free general adversarial perturbation, as described in any one of claims 1-8, includes a data processing module, a model integration module, an automatic assessment module, and an information recording module; The data processing module is used to select a visual model as an alternative model and obtain an artificial data training set, wherein the artificial data training set includes artificial images that are classified as target categories by the model with high confidence. The model integration module is used to construct multiple auxiliary models based on the structural information of the alternative model, and integrate the multiple auxiliary models with the original alternative model to obtain a comprehensive model; The automatic attack module is used to dynamically attack the comprehensive model based on multiple attack strategies and artificial data training sets to obtain the attack success rate. The automatic evaluation module is used to adaptively evaluate the vulnerabilities of the comprehensive model based on the attack success rate, and statistically analyze the differences in attack parameters and success rate of each attack strategy, and adaptively adjust the attack parameters, attack strategies and attack angles. The information recording module is used to save key information about model vulnerabilities.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to perform the visual model security assessment method based on black-box dataless general adversarial perturbation as described in any one of claims 1-8.

Images