Black box attack method based on improved knowledge distillation

Abstract

The invention discloses a black box attack method based on improved knowledge distillation, and relates to the technical field of artificial intelligence security, and the method comprises the steps: firstly obtaining a plurality of pre-trained teacher models, a student model, initial distillation temperature parameters of each teacher model, and a training set containing images and corresponding real labels; iteratively executing student model training according to the training set, updating a distillation temperature parameter through a gradient inversion strategy in the training process, and dynamically adjusting an attention weight corresponding to each teacher model through a preset weight calculation formula; finally, according to the student model after iteration is completed, a white-box attack method is adopted to generate an adversarial sample; the method has the beneficial effects that more robust decision boundary features can be captured, and an adversarial sample with high mobility is generated under a zero query condition.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence security, and particularly relates to a black-box attack method based on improved knowledge distillation. BACKGROUND

[0002] With the wide application of deep learning technology, the vulnerability of deep neural networks is increasingly prominent, and its characteristics of being vulnerable to adversarial attacks constitute a serious security threat. Among various attacks, black-box attacks are more concerned because they do not need to understand the internal information of the model, and can implement attacks only by inputting adversarial samples, which is more in line with the actual scene requirements.

[0003] The attack method based on migration in the black-box attack aims to generate adversarial samples by constructing a substitute model, and expects that the adversarial samples can be migrated to the black-box target model. However, the method still has the following defects at present:

[0004] Firstly, most methods seriously depend on frequent queries to the target model to improve the effect, but with the development of model security technologies such as randomization defense and dynamic integration, the feasibility and effectiveness of the query operation are seriously restricted.

[0005] Secondly, although the knowledge distillation technology can be used to construct a substitute model to reduce the dependence on queries, the existing methods mostly use fixed temperature value distillation or simple multi-teacher average strategy, which easily leads to overfitting of the student model to the local features of the teacher model, making the decision boundary rough, and there is blindness in fusing the knowledge of multiple teachers, which ultimately limits the migration and attack effect of the generated adversarial samples.

[0006] Therefore, under the background of the increasing demand for zero queries, a black-box attack method based on improved knowledge distillation is proposed. SUMMARY

[0007] In view of the above prior art situation, the present application is proposed. The embodiments of the present application provide a black-box attack method based on improved knowledge distillation, which can capture more robust decision boundary features and generate adversarial samples with high migration under the condition of zero queries.

[0008] According to an aspect of the present application, a black-box attack method based on improved knowledge distillation is provided, comprising: S1, obtaining a plurality of pre-trained teacher models, a student model, initial distillation temperature parameters of each teacher model, and a training set containing images and corresponding true labels; S2, iteratively performing student model training according to the training set, the training comprising: obtaining a first logical unit vector output by each teacher model for the images in a current training batch in the training set, and a second logical unit vector output by the student model; calculating a distillation loss of each teacher model according to the current distillation temperature parameters of each teacher model, the corresponding first logical unit vector and second logical unit vector; updating the current distillation temperature parameters of each teacher model through a gradient reversal strategy with the goal of increasing the distillation loss; determining the attention weight corresponding to each teacher model based on the first logical unit vector, the corresponding true label, and the updated distillation temperature parameters through a preset weight calculation formula; calculating a total distillation loss according to the distillation loss and the attention weight corresponding to each teacher model; calculating a student cross-entropy loss according to the second logical unit vector of the student model and the true label; constructing a global loss function according to the total distillation loss and the student cross-entropy loss, and updating the parameters of the student model according to the global loss function; S3, generating an adversarial sample using a white-box attack method according to the student model after iteration.

[0009] According to another aspect of the present application, a black-box attack method based on improved knowledge distillation is provided, comprising: an acquisition module configured to acquire a plurality of pre-trained teacher models, a student model, initial distillation temperature parameters of each teacher model, and a training set comprising images and corresponding true labels. A training module is configured to iteratively perform student model training according to the training set, the training comprising: acquiring a first logical unit vector output by each teacher model for an image in a current training batch in the training set, and a second logical unit vector output by the student model; calculating a distillation loss of each teacher model according to the current distillation temperature parameter of each teacher model, the corresponding first logical unit vector and second logical unit vector; updating the current distillation temperature parameter of each teacher model through a gradient reversal strategy with the goal of increasing the distillation loss; determining an attention weight corresponding to each teacher model based on the first logical unit vector, the corresponding true label, and the updated distillation temperature parameter, through a pre-set weight calculation formula; calculating a total distillation loss according to the distillation loss of each teacher model and the attention weight; calculating a student cross-entropy loss according to the second logical unit vector of the student model and the true label; constructing a global loss function according to the total distillation loss and the student cross-entropy loss, and updating the parameters of the student model according to the global loss function. An adversarial sample generation module is configured to generate an adversarial sample using a white-box attack method according to the student model after iteration.

[0010] According to another aspect of the present application, an electronic device is provided, comprising a memory and a processor, the memory being configured to store computer executable instructions, and the processor being configured to execute the computer executable instructions, which when executed by the processor implement the steps of the method described above.

[0011] According to another aspect of the present application, a computer storage medium is provided, having stored thereon computer executable instructions, which when executed by a processor implement the steps of the method described above.

[0012] Compared with the prior art, the black-box attack method based on improved knowledge distillation according to the embodiments of the present application can dynamically adjust the distillation temperature parameters and the adaptive weight distribution mechanism, and combine the gradient reversal strategy to optimize the multi-teacher knowledge distillation process, so that the proxy model can capture more robust decision boundary features, thereby generating adversarial samples with high transferability under zero query conditions. BRIEF DESCRIPTION OF DRAWINGS

[0013] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0014] Figure 1 This is a flowchart of the black-box attack method based on improved knowledge distillation according to the present invention.

[0015] Figure 2 This is a flowchart illustrating the student model training process of the black-box attack method based on improved knowledge distillation, as described in this invention.

[0016] Figure 3 This is a flowchart of the gradient reversal strategy for the black-box attack method based on improved knowledge distillation in this invention.

[0017] Figure 4 This is a framework diagram of the black-box attack method based on improved knowledge distillation of the present invention.

[0018] Figure 5 This is a block diagram of the black-box attack system based on improved knowledge distillation according to the present invention.

[0019] Figure 6 This is a block diagram of an electronic device according to the present invention. Detailed Implementation

[0020] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0021] Exemplary methods

[0022] Figure 1 The figure illustrates a flowchart of a black-box attack method based on improved knowledge distillation according to an embodiment of this application, including steps S1 to S3.

[0023] like Figure 1 As shown, in step S1, multiple pre-trained teacher models, one student model, the initial distillation temperature parameters of each teacher model, and a training set containing images and corresponding real labels are obtained.

[0024] The teacher model refers to a deep convolutional neural network model pre-trained on the same dataset. Specifically, it can be implemented using different CNN architectures such as ResNet, VGG, and DenseNet to provide diverse knowledge sources. The teacher model needs to have different network structures and parameter configurations to ensure the diversity of knowledge sources and avoid bias specific to a single model.

[0025] In step S2, student model training is performed iteratively based on the training set.

[0026] Figure 2 The figure illustrates a flowchart of student model training according to an embodiment of this application, including steps S21 to S27.

[0027] like Figure 2 As shown, in step S21, the first logical unit vector output by each teacher model for the current training batch of images in the training set and the second logical unit vector output by the student model are obtained.

[0028] In step S22, the distillation loss of each teacher model is calculated based on the current distillation temperature parameters of each teacher model and the corresponding first logic unit vector and second logic unit vector.

[0029] Specifically, the calculation process for distillation loss is as follows:

[0030] First, the first logical unit vector of each teacher model and the second logical unit vector of the student model are normalized using the softmax function to obtain the probability distribution. During the normalization process, each element in the logical unit vector needs to be divided by the corresponding distillation temperature parameter to soften the probability distribution.

[0031] The formula for calculating the probability distribution of the i-th teacher model after softening is as follows:

[0032]

[0033] The formula for calculating the probability distribution of the student model after softening is:

[0034]

[0035] in, This represents the first logical vector unit of the i-th teacher model. This represents the second logical vector unit of the student model. This represents the distillation temperature parameter for the i-th teacher model.

[0036] Then, KL divergence is used to measure the difference between the output probability distributions of the student model and each teacher model, and the distillation loss of each teacher model is calculated:

[0037]

[0038] in, Let K represent the distillation loss of the i-th teacher model, and K represent the number of classes. and Let represent the probability predictions of the i-th teacher model and the bloodline model for the k-th class, respectively. Multiply by before distillation loss. This is to compensate for the effect of temperature scaling on the gradient magnitude.

[0039] Through the above calculation method, the distillation temperature parameter can adjust the granularity of knowledge transfer: a lower temperature parameter makes the probability distribution sharper, transferring discriminative knowledge with teacher model specificity; a higher temperature parameter makes the probability distribution smoother, transferring general knowledge of inter-category relationships.

[0040] Back Figure 2 In step S23, with the goal of increasing distillation loss, the current distillation temperature parameters of each teacher model are updated through a gradient reversal strategy.

[0041] Traditional knowledge distillation methods use fixed distillation temperature parameters for training. This fixed-temperature strategy can lead to the student model overfitting the local gradient information of the teacher model. As a result, the student model learns local decision boundary information that is specific to the teacher model, making the decision boundary of the proxy model too coarse and reducing the transferability of generated adversarial examples. At the same time, the fixed temperature cannot adapt to the dynamic changes in the learning state of the student model during training, which limits the effectiveness of knowledge transfer.

[0042] To address the aforementioned technical problems, this application improves the knowledge distillation process by dynamically adjusting distillation temperature parameters, achieving the following technical effects:

[0043] First, increasing the distillation loss means increasing the learning difficulty of knowledge distillation, forcing the student model to learn more complex relationship information between categories, thereby obtaining a more robust global feature representation;

[0044] Secondly, the higher distillation temperature parameter makes the probability distribution of the teacher model smoother and increases the information entropy of the prediction distribution. This requires the student model to learn more information to reduce uncertainty, avoid sensitivity to local noise in the teacher model, and learn a more stable gradient direction.

[0045] Furthermore, through dynamic temperature adjustment, the gradient of the student model no longer simply fits the local decision boundary of the teacher model, but learns more robust global features, making the decision boundary of the student model smoother in the input domain and more consistent with the gradient direction of the black box model, thereby effectively improving the attack performance and transferability of generated adversarial examples.

[0046] Furthermore, by using the distillation temperature parameter, an internal parameter of knowledge distillation, for training, the method eliminates the dependence on the output information of the black-box model, making it highly applicable to black-box attacks in zero-query environments.

[0047] Figure 3 The illustration shows a flowchart of a gradient reversal strategy according to an embodiment of this application, including steps S23-1 to S23-3.

[0048] like Figure 3 As shown, in step S23-1, the gradient of distillation loss with respect to the current distillation temperature parameter is calculated.

[0049] This step specifically uses the backpropagation algorithm to calculate the partial derivatives of the distillation loss function with respect to the distillation temperature parameters of each teacher model, thus obtaining the original gradient.

[0050] In step S23-2, the gradient is multiplied by the negative of a preset scaling factor to obtain the inverted gradient, where the scaling factor is a positive number.

[0051] In a normal gradient descent optimization process, the gradient points in the direction that minimizes the distillation loss, meaning the distillation temperature parameter is updated in the direction that reduces the distillation loss. However, to increase the learning difficulty of knowledge distillation, the distillation temperature parameter needs to be updated in the opposite direction, i.e., in the direction that increases the distillation loss. This forces the student model to learn more robust feature representations and avoids overfitting the local gradient information of the teacher model.

[0052] This step reverses the gradient direction using a gradient reversal layer. Specifically, the calculated original gradient is multiplied by the inverse of a scaling factor (i.e., a negative scaling factor), completely reversing the gradient direction. The scaling factor serves two purposes: first, it controls the magnitude of the gradient reversal, preventing excessively large temperature parameter update steps from causing training instability; second, it adjusts the strength of the gradient reversal, with a larger scaling factor implying a stronger reversal effect.

[0053] The preset scaling factor is dynamically adjusted according to the training rounds, gradually increasing from the first preset value at the beginning of training to the second preset value at the end of training. This dynamic adjustment follows the learning principle of "from simple to difficult". In the early stage of training, the student model has limited understanding of the data distribution and needs a relatively mild gradient inversion strength to avoid instability in the training process. As training progresses, the student model gradually masters the basic discrimination ability. At this time, the gradient inversion strength can be gradually increased to force the student model to learn deeper global invariant features.

[0054] The gradual increase of the scaling factor above follows the law of the cosine function. Dynamic adjustment based on the law of the cosine function ensures a smooth change in the scaling factor, avoiding convergence problems caused by abrupt changes during training. This makes the knowledge transfer process smoother and more stable, ultimately improving the generalization ability and robustness of the student model. The specific formula is as follows:

[0055]

[0056] In this formula, Indicates the current training round. Indicates the total number of training rounds. This represents the value of the scaling factor to be solved in the current round. This represents the first preset value. This indicates the second preset value.

[0057] It should be noted that during normal training, the scaling factor is calculated / scheduled for each round. ,until = Training ends there; therefore, the above formula assumes... Within this interval, Follow Monotonic growth and = When the maximum value is reached However, in actual engineering projects, E may exceed the limit. For example, in situations such as continued training, the outer scheduler dynamically extending the training epochs, different tasks using longer epochs in hyperparameter search, or inconsistencies in local counts due to distributed / fault-tolerant restarts, if the above formula is still used directly in these cases, the cosine term will continue to change periodically with E, causing... Upon reaching It may decline again after training; there is no guarantee that it will be possible to recover after training. The stability of [the system / mechanism] is thus ensured. Therefore, a truncation method can be adopted. ,Right now:

[0058]

[0059] Therefore, for all ≥ Keep = This is to prevent the scaling factor from falling back or fluctuating when it exceeds the expected number of rounds.

[0060] Back Figure 3 In step S23-3, the current distillation temperature parameter is updated using the gradient ascent algorithm based on the inverted gradient.

[0061] Specifically, the formula for updating the distillation temperature parameter is:

[0062]

[0063] in, This represents the distillation temperature parameter for the i-th teacher model. Indicates the learning rate. This represents the gradient of distillation loss relative to the current distillation temperature parameter. This represents the negative of the scaling factor. Because the gradient has been inverted, the gradient that originally pointed in the descent direction of the loss function now points in the ascending direction. Therefore, through the gradient ascent update method, the distillation temperature parameter is adjusted in the direction that increases the distillation loss.

[0064] To limit the range of distillation temperature parameters and prevent excessively large or small temperature values ​​from affecting training stability, the updated distillation temperature parameters can be subject to numerical range restrictions to ensure they remain within a reasonable range, thereby guaranteeing the stability of the training process.

[0065] Back Figure 1 In step S24, based on the first logical unit vector, the corresponding real label, and the updated distillation temperature parameter, the attention weight corresponding to each teacher model is determined by a preset weight calculation formula.

[0066] This step is a Dynamic Temperature-Regulated Attention Mechanism (DTRAM) designed to overcome the limitations of the average weighting strategy in traditional multi-teacher distillation. Traditional average weighting strategies ignore the performance differences of different teacher models on specific samples and the varying granularity of the knowledge they convey. This can easily lead to conflicting decision boundaries between multiple teacher models being simultaneously transmitted to the student model, thus affecting its generalization performance. By introducing DTRAM, weights can be adaptively allocated based on the classification loss of each teacher model on the current sample and its corresponding temperature parameter, thereby significantly improving the effectiveness and robustness of knowledge fusion.

[0067] Specifically, the preset weight calculation formula is as follows:

[0068]

[0069] in, The first logical unit vector is calculated based on the real label. The classification loss of the teacher model, For the first The updated distillation temperature parameters for each teacher model and Here, represents the preset first and second adaptive parameters, and N represents the total number of teacher models.

[0070] The weight calculation formula uses the softmax function, which exponentially and normally normalizes the weight calculation factors of each teacher model to ensure that the sum of the attention weights of all teacher models is 1. In the formula, is the weight calculation factor for the i-th teacher model, which simultaneously considers two key factors: the classification loss of the teacher model and the distillation temperature parameter.

[0071] It should be noted that classification loss It can be calculated using the cross-entropy loss function:

[0072]

[0073] in, The one-hot encoding representing the actual label. Let represent the predicted probability of the i-th teacher model for the k-th class, where K represents the total number of classes.

[0074] This dynamic weight allocation mechanism follows the learning pattern of "from concrete to abstract, from simple to difficult" in human educational practice, effectively improving the generalization ability and robustness of student models.

[0075] In step S25, the total distillation loss is calculated based on the distillation loss and attention weight corresponding to each teacher model.

[0076] Specifically, the total distillation loss is obtained by weighted summation of the distillation losses of each teacher model and their corresponding attention weights, and the calculation formula is as follows:

[0077]

[0078] in, Indicates total distillation loss. This represents the attention weight corresponding to the i-th teacher model. Let N represent the distillation loss of the i-th teacher model, where N is the total number of teacher models.

[0079] In step S26, the student cross-entropy loss is calculated based on the second logical unit vector of the student model and the true label.

[0080] Specifically, the calculation process for student cross-entropy loss is as follows:

[0081] First, the second logical unit vector of the student model is normalized using the softmax function to obtain the probability distribution of each category:

[0082]

[0083] in, This represents the second logical unit vector of the student model.

[0084] Then, the student cross-entropy loss is calculated using the cross-entropy loss function:

[0085]

[0086] in, Represents the student's cross-entropy loss. This represents the value of the k-th class in the one-hot encoding of the real label. This represents the student model's predicted probability for the k-th class, derived from the aforementioned probability distribution. Extracted from, K represents the number of categories.

[0087] In step S27, a global loss function is constructed based on the total distillation loss and the student cross-entropy loss, and the parameters of the student model are updated based on the global loss function.

[0088] Specifically, the global loss function is constructed by weighting the total distillation loss and the student cross-entropy loss. The total distillation loss is used to help the student model fit the decision boundary of the teacher model, while the student cross-entropy loss is used to optimize the classification performance of the student model itself. Through this combination, the student model can maintain its accurate classification ability for the current training samples while learning the knowledge of the teacher model.

[0089] It should be noted that the global loss function is as follows:

[0090]

[0091] in, For total distillation losses, For the student model, the student cross-entropy loss, and These are preset hyperparameters, used to adjust the weights of total distillation loss and student cross-entropy loss in the global loss function, respectively.

[0092] During backpropagation, the global loss function forms a min-max game mechanism: total distillation loss Because the gradient reversal strategy causes the distillation temperature parameter to change in the direction of increasing distillation loss, while the student cross-entropy loss... This changes in the direction of minimizing the cross-entropy loss. Both together iteratively optimize the student model parameters, which can be expressed as:

[0093]

[0094] in, Represents the parameters of the student model. This represents the distillation temperature parameter. Through this training method, the student model can learn more robust feature representations, thereby improving the transferability of generated adversarial examples.

[0095] In some of the schemes described above in this application, if the first and second adaptive parameters are fixed values, it will be impossible to adaptively adjust the influence of the teacher model loss and temperature parameter on the attention weight allocation according to changes in the student model's learning state during training. This will cause the student model to learn multi-teacher knowledge according to the same weight allocation strategy throughout the training process, making it impossible to achieve a gradual learning transition from local discriminative features to globally invariant features, thereby affecting the generalization ability of the surrogate model and the transferability of adversarial examples.

[0096] Therefore, this application further proposes that training also includes updating the first adaptive parameter and the second adaptive parameter, specifically:

[0097] Calculate the global loss function with respect to the first adaptive parameter. The first partial derivative and the second adaptive parameter The second partial derivative;

[0098] The first adaptive parameter is updated using the gradient descent algorithm based on the first and second partial derivatives. Second adaptive parameter ;

[0099] Among them, at the beginning of training, the first adaptive parameter The initial value is greater than the second adaptive parameter. The initial value, during the training process, is the first adaptive parameter. The value of the second adaptive parameter gradually decreases. The value gradually increases.

[0100] In the initial training phase, the student model focuses more on learning the local discriminative features of the teacher model, and sets the first adaptive parameter... Setting a larger initial value allows the attention weight allocation to more readily utilize the classification loss of the teacher model, thus enabling the student model to learn the local discriminative knowledge possessed by the teacher model more efficiently. As training progresses, the student model needs to gradually shift towards learning globally invariant features; at this point, the first adaptive parameter... Gradually decreasing this parameter will weaken the impact of the teacher model's classification loss on attention weight allocation; the second adaptive parameter Gradually increasing the distillation temperature parameter strengthens its role in attention weight allocation, thereby guiding the student model to learn globally invariant features more effectively from the teacher model. In this way, the student model can better achieve a gradual transition from learning local discriminative features to learning globally invariant features, ultimately improving the generalization ability and transferability of adversarial examples of the surrogate model.

[0101] The above approach allows for the construction of a progressive knowledge learning mechanism that moves "from local to global": in the initial training phase, a relatively large first adaptive parameter is used. Strengthening the influence of the teacher model's classification loss on weight allocation helps the student model quickly absorb local discriminative knowledge; in the later stages of training, through... Reduce The distillation temperature parameter update driven by increasing and gradient reversal guides the student model towards learning globally invariant features. Simultaneously, DTRAM is used to optimize the efficiency of multi-teacher knowledge fusion, avoiding the overfitting problem of traditional fixed-parameter strategies. Finally, the min-max game mechanism of the global loss function smooths the decision boundary of the student model, improving the generalization ability of the proxy model in zero-query black-box attack scenarios, and significantly enhancing the attack performance of adversarial examples and cross-model transfer effects.

[0102] return Figure 1 In step S3, adversarial examples are generated using a white-box attack method based on the student model after iteration.

[0103] After completing step S2 iteration, the student model, through dynamic distillation temperature parameter adjustment and adaptive parameter optimization training, has learned robust global feature representations. Its decision boundary is more consistent with the gradient direction of the black-box model, and it can be used as an effective proxy model. Adversarial examples are generated using white-box attack methods such as FGSM and PGD. The core is to take advantage of the interpretability of the proxy model by superimposing small perturbations on the original image, so that the perturbated image is misclassified on the proxy model. Due to the consistency of feature learning between the student model and the black-box model, the generated adversarial examples can be effectively transferred to the target black-box model, and finally achieve effective attack on the black-box model in a zero-query black-box attack scenario.

[0104] In summary, the core innovation of this application lies in optimizing the multi-teacher knowledge distillation process by dynamically adjusting the distillation temperature parameters and the adaptive weight allocation mechanism, combined with the gradient reversal strategy. This enables the surrogate model to capture more robust decision boundary features, thereby generating adversarial examples with high transferability under zero query conditions.

[0105] To verify the feasibility of the above-mentioned scheme in this application, the following verification was performed:

[0106] Using mainstream CNN models as the target models, five CNN models with different structures and parameters were selected: IncV4, ResNet50, VGG16, IncResV2, and IncResV2ens, to improve the generality of the experiment. Both the teacher and target models were pre-trained on the same dataset. When using CIFAR100 for attack testing, the teacher models were all pre-trained on CIFAR100; when using ImageNet-compatible for attack testing, the teacher models were all pre-trained on ImageNet. For attackers, under the condition of zero-query where the internal structural parameters of the target model are completely unknown and inaccessible, the proxy model should cover a more generalized decision boundary as much as possible. Therefore, multiple CNN models with different architectures were selected, including ResNet56, ResNet110, ResNet32x4, VGG19, and WRN_40_2, and three models were selected from these to form a multi-teacher combination to provide diverse sources of decision boundaries. In this study, ResNet32x4, VGG19, and WRN_40_2 were selected as Group 1, and ResNet56, ResNet110, and ResNet32x4 were selected as Group 2. Group 1 represents teacher combinations with different architectures, while Group 2 represents teacher combinations with ResNet architecture. Selecting these two combinations better demonstrates that the proposed scheme significantly improves the transferability of the surrogate model under both homogeneous and heterogeneous teacher combinations. Untrained VGG13 and IncV3 were selected as student models. Considering their different architectures and capabilities—VGG13 has a larger number of parameters and a simpler structure, while IncV3 has a smaller number of parameters and a more complex structure—selecting these two models as student models better verifies the effectiveness of the proposed scheme under different surrogate model architectures.

[0107] The table below shows the attack performance and success rate of this application's solution on CIFAR100:

[0108]

[0109] As shown in the table above, in white-box attacks, the success rate of the proposed solution generally reaches over 90%, with the I-FGSM and MI-FGSM methods approaching 100%. In black-box attacks, when using the FGSM method, the average success rate of the proposed solution is 5%-10% higher than the pre-trained model; when using the I-FGSM method, the average success rate is 5%-7% higher; and when using the MI-FGSM method, the average success rate is 6%-9% higher. Specifically, the MI-FGSM method achieves a maximum success rate of 96.03% in generating adversarial examples. Experimental results demonstrate that ATMKD can generate adversarial examples with better transferability, effectively improving the success rate of black-box attacks.

[0110] Exemplary System

[0111] Figure 5 The diagram illustrates a block diagram of a black-box attack system based on improved knowledge distillation according to an embodiment of this application. The system includes: an acquisition module for acquiring multiple pre-trained teacher models, a student model, initial distillation temperature parameters for each teacher model, and a training set containing images and corresponding ground truth labels; and a training module for iteratively training the student model based on the training set. The training includes: acquiring the first logical unit vector output by each teacher model for the images in the current training batch of the training set, and the second logical unit vector output by the student model; calculating the distillation loss of each teacher model based on its current distillation temperature parameters, the corresponding first logical unit vector, and the second logical unit vector; and increasing the distillation loss... The system takes the loss as the target and updates the current distillation temperature parameters of each teacher model using a gradient reversal strategy. Based on the first logical unit vector, the corresponding real label, and the updated distillation temperature parameters, the attention weights corresponding to each teacher model are determined using a preset weight calculation formula. The total distillation loss is calculated based on the distillation loss and attention weights of each teacher model. The student cross-entropy loss is calculated based on the second logical unit vector and real label of the student model. A global loss function is constructed based on the total distillation loss and the student cross-entropy loss, and the parameters of the student model are updated based on the global loss function. An adversarial example generation module is used to generate adversarial examples using white-box attack methods based on the student models after iteration.

[0112] In one example, the inversion strategy in the training module is as follows: calculate the gradient of the distillation loss relative to the current distillation temperature parameter; multiply the gradient by the negative of a preset scaling factor to obtain the inverted gradient, where the scaling factor is a positive number; and update the current distillation temperature parameter using the gradient ascent algorithm based on the inverted gradient.

[0113] In one example, the preset scaling factor in the training module is dynamically adjusted according to the training rounds, specifically: it gradually increases from a first preset value at the beginning of training to a second preset value at the end of training.

[0114] In one example, the gradual increase of the scaling factor in the training module follows a cosine function pattern, specifically:

[0115]

[0116] in, Indicates the current training round. Indicates the total number of training rounds. This represents the value of the scaling factor to be solved in the current round. This represents the first preset value. This indicates the second preset value.

[0117] In one example, the preset weight calculation formula in the training module is:

[0118]

[0119] in, The first logical unit vector is calculated based on the real label. The classification loss of the teacher model, For the first The updated distillation temperature parameters for each teacher model and Here, represents the preset first and second adaptive parameters, and N represents the total number of teacher models.

[0120] In one example, training in the training module also includes updating the first adaptive parameter and the second adaptive parameter, specifically: calculating the global loss function with respect to the first adaptive parameter. The first partial derivative and the second adaptive parameter The second partial derivative; based on the first and second partial derivatives, the first adaptive parameter is updated using the gradient descent algorithm. Second adaptive parameter Among them, at the beginning of training, the first adaptive parameter The initial value is greater than the second adaptive parameter. The initial value, during the training process, is the first adaptive parameter. The value of the second adaptive parameter gradually decreases. The value gradually increases.

[0121] In one example, the training module constructs the global loss function as follows:

[0122]

[0123] in, For total distillation losses, For the student model, the student cross-entropy loss, and These are preset hyperparameters, used to adjust the weights of total distillation loss and student cross-entropy loss in the global loss function, respectively.

[0124] Exemplary electronic devices

[0125] Figure 6 A block diagram of an electronic device according to an embodiment of this application is illustrated.

[0126] like Figure 6 As shown, the electronic device includes one or more processors and memory.

[0127] A processor can be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and can control other components in an electronic device to perform desired functions.

[0128] The memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0129] In one example, the electronic device may also include input devices and output devices, which are interconnected via a bus system and / or other forms of connection mechanism (not shown).

[0130] Of course, for the sake of simplicity, Figure 3 Only some of the components of the electronic device relevant to this application are shown in this illustration; components such as buses, input / output interfaces, etc., are omitted. In addition, the electronic device may include any other suitable components depending on the specific application.

[0131] Exemplary computer-readable media

[0132] Embodiments of this application may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps described in the "Exemplary Methods" section above according to the various embodiments of this application.

[0133] Computer-readable storage media may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0134] The basic principles of this application have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this application are merely examples and not limitations, and should not be considered as essential features of each embodiment of this application. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the application to the necessity of employing the aforementioned specific details for implementation.

[0135] The block diagrams of devices, apparatuses, devices, and systems involved in this application are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0136] It should also be noted that in the apparatus, equipment, and methods of this application, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered as equivalent solutions of this application.

[0137] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this application. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this application. Therefore, this application is not intended to be limited to the aspects shown herein, but rather to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0138] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this application to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. A black-box attack method based on improved knowledge distillation, characterized in that, The method comprises the following steps: S1, obtaining a plurality of pre-trained teacher models, a student model, initial distillation temperature parameters of each teacher model, and a training set comprising images and corresponding real labels; S2, iteratively performing student model training according to the training set, the training comprising: obtaining a first logical unit vector output by each teacher model for images in a current training batch in the training set, and a second logical unit vector output by the student model; calculating a distillation loss of each teacher model according to the current distillation temperature parameters of each teacher model, the corresponding first logical unit vector and the second logical unit vector; updating the current distillation temperature parameters of each teacher model through a gradient inversion strategy with the aim of increasing the distillation loss; determining an attention weight corresponding to each teacher model through a preset weight calculation formula based on the first logical unit vector, the corresponding real label and the updated distillation temperature parameters; calculating a total distillation loss according to the distillation loss of each teacher model and the attention weight; calculating a student cross-entropy loss according to the second logical unit vector of the student model and the real label; constructing a global loss function according to the total distillation loss and the student cross-entropy loss, and updating the parameters of the student model according to the global loss function; S3, generating an adversarial sample by using a white-box attack method according to the student model after the iteration is completed.

2. The method of claim 1, wherein the improved knowledge distillation based black-box attack method is characterized by, The gradient inversion strategy specifically comprises: calculating the gradient of the distillation loss with respect to the current distillation temperature parameters; multiplying the gradient by the opposite number of a preset scaling coefficient to obtain an inverted gradient, wherein the scaling coefficient is a positive number; updating the current distillation temperature parameters through a gradient ascent algorithm according to the inverted gradient.

3. The method of claim 2, wherein the improved knowledge distillation based black-box attack method is characterized by, The value of the preset scaling coefficient is dynamically adjusted according to the round of the training, specifically: gradually increasing from a first preset value at the beginning of the training to a second preset value at the end of the training.

4. The method of claim 3, wherein the improved knowledge distillation based black-box attack method is characterized by, The gradual increase follows a cosine function rule, and the specific formula is: wherein, denotes the current round of the training, denotes the total rounds of the training, denotes the value of the scaling factor to be solved in the current round, denotes the first preset value, denotes the second preset value.

5. The method of claim 1, wherein the improved knowledge distillation based black-box attack method is characterized by, The preset weight calculation formula is: wherein the classification loss of the i-th teacher model calculated according to the first logic unit vector and the true label, the updated distillation temperature parameter of the i-th teacher model, and are a preset first adaptive parameter and a second adaptive parameter, and N is the total number of the teacher models.​​ 6. The method of improved knowledge distillation based black-box attack according to claim 5, characterized in that, The training further comprises updating the first adaptive parameter and the second adaptive parameter, specifically: computing a first partial derivative of the global loss function with respect to the first adaptive parameter and a second partial derivative of the global loss function with respect to the second adaptive parameter ​ updating the first adaptive parameter by a gradient descent algorithm according to the first partial derivative and the second partial derivative and the second adaptive parameter ; wherein at the beginning of the training, the initial value of the first adaptive parameter is greater than the initial value of the second adaptive parameter , and during the training, the value of the first adaptive parameter is gradually decreased, and the value of the second adaptive parameter is gradually increased.

7. The method of claim 1, wherein the improved knowledge distillation based black-box attack method is characterized by, The global loss function specifically comprises: wherein, is the total distillation loss, is the student cross-entropy loss of the student model, and are preset hyperparameters for adjusting the weights of the total distillation loss and the student cross-entropy loss in the global loss function, respectively.

8. A black-box attack system based on improved knowledge distillation, applying the black-box attack method according to any one of claims 1-7, characterized in that, The method comprises the following steps: an obtaining module, configured to obtain a plurality of pre-trained teacher models, a student model, initial distillation temperature parameters of each teacher model, and a training set comprising images and corresponding real labels; a training module, configured to iteratively perform student model training according to the training set, the training comprising: obtaining a first logical unit vector output by each teacher model for images in a current training batch in the training set, and a second logical unit vector output by the student model; calculating a distillation loss of each teacher model according to the current distillation temperature parameters of each teacher model, the corresponding first logical unit vector and the second logical unit vector; updating the current distillation temperature parameters of each teacher model through a gradient inversion strategy with the aim of increasing the distillation loss; determining an attention weight corresponding to each teacher model through a preset weight calculation formula based on the first logical unit vector, the corresponding real label and the updated distillation temperature parameters; calculating a total distillation loss according to the distillation loss of each teacher model and the attention weight; calculating a student cross-entropy loss according to the second logical unit vector of the student model and the real label; constructing a global loss function according to the total distillation loss and the student cross-entropy loss, and updating the parameters of the student model according to the global loss function; determine, based on the first logic unit vector, the corresponding real label and the updated distillation temperature parameter, an attention weight corresponding to each teacher model through a preset weight calculation formula; calculate a total distillation loss according to the distillation loss corresponding to each teacher model and the attention weight; calculate a student cross-entropy loss according to the second logic unit vector of the student model and the real label; construct a global loss function according to the total distillation loss and the student cross-entropy loss, and update the parameters of the student model according to the global loss function; an adversarial sample generation module configured to generate an adversarial sample by using a white-box attack method according to the student model after iteration is completed. 9.An electronic device comprising a memory and a processor, the electronic device characterized by: The memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions, and the computer executable instructions, when executed by the processor, implement the steps of the method in any one of claims 1-7.

10. A computer storage medium having stored thereon computer- executable instructions, comprising: The computer executable instructions, when executed by the processor, implement the steps of the method in any one of claims 1-7.

Images