Disturbance mask generation method aiming at machine learning model attack

Abstract

The invention discloses a disturbance mask generation method for machine learning model attack, and belongs to the technical field of network security, and the method comprises the steps: selecting a to-be-selected encryption algorithm with the highest similarity with a target encryption algorithm from a plurality of to-be-selected encryption algorithms as an imitation encryption algorithm; on the basis of the difference between the prototype vector of the target encryption algorithm and the prototype vector of the simulated encryption algorithm, performing confrontation value evaluation on each bit in the current ciphertext to obtain an evaluation score; and flipping partial bits in the set current disturbance mask according to a sorting result of the evaluation scores to obtain a target disturbance mask. According to the method, the technical bottleneck that'unidentifiability 'and'decryptability' are difficult to consider in a traditional defense means is broken through, and bit-level perturbation which is strictly reversible mathematically is introduced in a ciphertext transmission process by creatively constructing a class-specific perturbation mask, so that a third-party cryptographic algorithm recognition model is efficiently misled.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and more specifically, relates to a method for generating perturbation masks against machine learning model attacks. Background Technology

[0002] In modern cyberspace security systems, encrypted communication is the cornerstone of data confidentiality. However, with the evolution of cryptanalysis, cryptographic algorithm identification has become a crucial preliminary step for attackers to carry out targeted decryption. In non-cooperative communication or passive eavesdropping scenarios, attackers do not need to directly crack the key; they can deduce the underlying encryption algorithm (such as AES, DES, RSA, etc.) simply by analyzing the statistical distribution heterogeneity of the intercepted ciphertext. Once the algorithm type is exposed, attackers can invoke pre-computed rainbow tables, side-channel attack models, or algebraic vulnerability libraries targeting that specific algorithm, thereby exponentially reducing the cost of decryption.

[0003] In recent years, with the explosive growth of deep learning technology, data-driven side-channel analysis has become a mainstream threat. Attackers utilize high-dimensional feature extractors such as deep neural networks, convolutional neural networks, or Transformers to extract statistical features from ciphertext, or directly use models such as convolutional neural networks to automatically learn feature representations of ciphertext. These models can learn the weak statistical fingerprints left by different encryption algorithms due to differences in internal diffusion and confusion structures, thereby achieving high-precision classification of international standard cryptographic algorithms.

[0004] Existing defense strategies (such as multi-layer encryption and algorithm obfuscation) often require modifications to the underlying protocol or the addition of complex key management facilities, resulting in significant computational and communication overhead and making seamless deployment in existing standardized communication systems difficult. Therefore, there is an urgent need for a ciphertext-end defense strategy that does not require changes to the original encryption architecture, is computationally lightweight, and possesses complete reversibility, in order to achieve efficient defense against machine learning recognition models at low cost without affecting legitimate decryption. Summary of the Invention

[0005] In view of the above-mentioned defects or improvement needs of existing technologies, this invention provides a perturbation mask generation method for machine learning model attacks, aiming to solve the technical problem of large computational and communication overhead in existing defense strategies.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for generating a perturbation mask against machine learning model attacks is provided, comprising: S1: Calculate the prototype vector of each preset encryption algorithm in the preset encryption algorithm set using the local alternative model corresponding to the machine learning model that the attacker may use; the preset encryption algorithm set includes: multiple candidate encryption algorithms and the target encryption algorithm to be used by the defender. S2: Calculate the similarity between the prototype vectors of the target encryption algorithm and each of the candidate encryption algorithms; select the one with the highest similarity from the candidate encryption algorithms as the imitation encryption algorithm of the target encryption algorithm; S3: Based on the difference between the prototype vector of the target encryption algorithm and the prototype vector of the imitation encryption algorithm, an adversarial value assessment is performed on each bit in the current ciphertext to obtain an assessment score. S4: Sort the evaluation scores of each bit from high to low to obtain the sorting results; S5: Flip some bits of the current perturbation mask according to the sorting result to obtain the target perturbation mask.

[0007] Further, S1 includes: for each preset cryptographic algorithm, taking the average value of each ciphertext sample in the ciphertext sample dataset corresponding to the preset cryptographic algorithm at each bit as the value at the corresponding bit in its prototype vector.

[0008] Further, S3 includes: S31: Based on the difference between the prototype vector of the target encryption algorithm and the prototype vector of the imitation encryption algorithm, calculate the imitation score of the target encryption algorithm at each bit. S32: Calculate the specificity score of the target encryption algorithm for each bit; S33: The imitation score and the specificity score on each bit are weighted and fused to obtain an adversarial value assessment score for each bit in the current ciphertext.

[0009] Further, step S31 includes: calculating the imitation score of the target encryption algorithm at the t-th bit using the following formula. ; ; in, The proportion of bits with a value of 1 at the t-th bit in the ciphertext set after the target encryption algorithm encrypts the test plaintext set; The proportion of bits with a value of 1 at the t-th bit in the ciphertext set after the test plaintext set is encrypted by the simulated encryption algorithm.

[0010] Further, S32 includes: using the formula Calculate the specificity score of the t-th bit. ;in, The proportion of bits with a value of 1 at the t-th bit in the ciphertext set after the target encryption algorithm encrypts the test plaintext set.

[0011] Further, S5 includes: S51: Set the corresponding bit in the current perturbation mask to 1 according to the highest bit in the sorting result, and use it as a temporary perturbation mask; the current perturbation mask is an all-zero mask in the first iteration; the current ciphertext set is obtained by encrypting the original plaintext set through the target encryption algorithm; S52: Perturb the current ciphertext set with the current perturbation mask and the temporary perturbation mask respectively to obtain the first perturbation ciphertext set and the second perturbation ciphertext set; S53: Input the features corresponding to the first perturbation ciphertext set and the second perturbation ciphertext set into the local substitution model to obtain their respective average confidence scores; select the perturbation mask corresponding to the larger average confidence score as the new current perturbation mask; S54: Delete the highest bit in the sorting result and determine whether the current sorting result meets the preset conditions. If it does not meet the conditions, return to S51. If it does meet the conditions, use the current perturbation mask as the target perturbation mask.

[0012] Further, S52 includes: performing a bitwise XOR operation between the current perturbation mask and the current ciphertext set to obtain the first perturbation ciphertext set; and performing a bitwise XOR operation between the temporary perturbation mask and the current ciphertext set to obtain the second perturbation ciphertext set.

[0013] According to another aspect of the present invention, a method for sending information to counter machine learning model attacks is provided, comprising: The target perturbation mask obtained using the perturbation mask generation method described above. For the current ciphertext corresponding to the original plaintext Secondary encryption is performed to obtain the target adversarial ciphertext. And send it to the target recipient.

[0014] According to another aspect of the present invention, a communication method for attacking machine learning models is provided, comprising: Sending end: Uses the described information transmission method to send the target anti-ciphertext. ; Receiver: Receives the target adversarial ciphertext Then, a target perturbation mask is used, either shared or negotiated in advance. Perform decryption to obtain the current ciphertext. Then, a second decryption is performed to obtain the original plaintext.

[0015] According to another aspect of the present invention, a communication device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method.

[0016] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: (1) This invention provides a perturbation mask generation method for machine learning model attacks. This method breaks through the technical bottleneck of traditional defense methods that are difficult to balance "unidentifiable" and "decryptable". It creatively introduces mathematically strict reversible bit-level perturbation during the ciphertext transmission process by constructing a class-specific perturbation mask, thereby effectively misleading third-party cryptographic algorithm identification models.

[0017] (2) A class-specific mask generation strategy based on class prototypes is proposed: This invention does not calculate gradients for each individual ciphertext sample, but instead constructs a "class prototype" representing the global statistical characteristics of a certain type of cryptographic algorithm by calculating the average bit distribution of all samples of that algorithm. The perturbation mask generated based on this prototype is applicable to all ciphertext samples generated by that type of algorithm. This key feature significantly reduces the computational overhead and response latency of the defense system. Since the perturbation mask can be generated offline, only nanosecond-level bit operations are required during the online defense phase, eliminating the need for complex deep learning inference. This enables the invention to adapt to high-throughput, low-latency real-time encrypted communication scenarios, overcoming the limitation of low efficiency in per-sample generation of adversarial perturbations.

[0018] (3) A reversible adversarial perturbation generation mechanism based on bit-level XOR operation is adopted: This invention abandons the traditional method of adding continuous value noise in adversarial attacks. Instead, it generates a binary perturbation mask and applies the perturbation to the ciphertext using a bit-level XOR operation. The legitimate receiver only needs to hold the same mask, and the perturbation can be completely eliminated by utilizing the reflexivity of the XOR operation. This key technology thoroughly solves the technical problem that traditional data-end defense methods easily damage the integrity of the ciphertext, leading to decryption failure. While ensuring the effectiveness of the defense, this invention achieves 100% reversible recovery of the ciphertext, ensuring "zero interference" to legitimate communication services during the defense process, and has extremely high practical value.

[0019] (4) A dual-index greedy search algorithm combining "imitation score" and "specificity score" was designed: When determining the perturbation bit, this invention introduces two evaluation dimensions simultaneously: imitation score (evaluating whether flipping a bit makes the feature more similar to other algorithms) and specificity score (evaluating whether a bit belongs to the significant statistical fingerprint of the target algorithm). By weighted fusion of these two scores to guide the greedy search, the most destructive bit combination is accurately selected. This key technology significantly improves the attack success rate and stealth of the defense strategy. Experimental data shows that compared with random flipping or single index strategy, this algorithm can achieve a greater decrease in recognition accuracy (more than 25%, up to 69.5%) with fewer bit flips (average only about 13%). In addition, this interference method targeting the essence of statistical features makes the generated adversarial examples have stronger cross-model transferability and can effectively defend against black-box recognition models with unknown parameters. Attached Figure Description

[0020] Figure 1 This is a flowchart of the perturbation mask generation method for machine learning model attacks provided in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the perturbation mask generation method for machine learning model attacks provided in Embodiment 1 of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0022] It should be noted that this section introduces the terminology related to cryptographic algorithm identification and anti-perturbation.

[0023] Cryptographic Algorithm Identification (CAI) refers to the process by which an attacker, without knowing the key or plaintext, analyzes intercepted ciphertext data and uses statistical analysis or machine learning models to deduce the specific encryption algorithm (such as AES, DES, RSA, etc.) used to generate the ciphertext. This invention aims to defend against attacks targeting this process.

[0024] Adversarial perturbation refers to the small, computationally-generated changes artificially added to the original data (specifically, ciphertext in this invention). These changes, without affecting the legitimate use of the data (i.e., legitimate decryption), can cause machine learning classification models to output incorrect predictions.

[0025] Example 1 This embodiment provides a perturbation mask generation method for attacks on machine learning models, such as... Figure 1 As shown, the process includes S1-S5. S1: Calculate the prototype vectors of each preset encryption algorithm in the preset encryption algorithm set using the local substitution model corresponding to the machine learning model that the attacker might employ. The preset encryption algorithm set includes: multiple candidate encryption algorithms and the target encryption algorithm to be adopted by the defender. S2: Calculate the similarity between the prototype vectors of the target encryption algorithm and each candidate encryption algorithm. Select the algorithm with the highest similarity from the multiple candidate encryption algorithms as the imitation encryption algorithm of the target encryption algorithm. S3: Based on the difference between the prototype vectors of the target encryption algorithm and the prototype vectors of the imitation encryption algorithm, perform adversarial value assessment on each bit in the current ciphertext to obtain an evaluation score. S4: Sort the evaluation scores of each bit from high to low to obtain the sorting result. S5: Flip some bits in the current perturbation mask according to the sorting result to obtain the target perturbation mask. Furthermore, Figure 2 This is a schematic diagram illustrating the principle of the perturbation mask generation method for machine learning model attacks provided in this embodiment.

[0026] As an optional implementation, S1 includes: for each preset cryptographic algorithm, taking the average value of each ciphertext sample in the ciphertext sample dataset corresponding to the preset cryptographic algorithm at each bit as the value at the corresponding bit in its prototype vector.

[0027] Specifically, the process involves constructing an alternative model and a prototype calculation: unlike existing techniques that focus only on the local features of a single sample, this step innovatively takes a global perspective to construct a "prototype" that represents the essential laws governing cryptographic algorithms. First, it obtains... A dataset of ciphertext samples for various cryptographic algorithms is provided, and each cryptographic algorithm is defined as a category. For each category of cryptographic algorithms... Calculate the average value of all training ciphertext samples at each bit to obtain the prototype vector of that category. Specifically, for a length of The ciphertext sequence, the first The prototype value of each bit The calculation formula is:

[0028] in, For the sample size, Ciphertext Sample In the The value of the bit (0 or 1). This is the perturbation dataset we use to construct adversarial perturbations. This prototype vector characterizes the global bit distribution statistical features of this type of cryptographic algorithm, effectively overcoming noise interference caused by single-sample randomness. Simultaneously, a deep neural network is trained based on this dataset as a substitute model to simulate the attacker's identification capabilities and guide subsequent perturbation generation.

[0029] Furthermore, regarding S2: Mimic Class Identification: To maximize the misleading effect of the perturbation, this invention abandons blind random noise interference and instead employs a targeted inducement strategy aimed at the target cryptographic algorithm to be protected (Target Class), from other... Among various cryptographic algorithms, the most similar algorithm is selected as the Mimic Class. The specific selection method is as follows: calculate the prototype vector of the target algorithm. Other algorithm prototype vectors The algorithm uses cosine similarity between the two pairs of samples to select the category with the highest similarity as the imitation category. The innovation of this step lies in establishing the optimal perturbation optimization direction by finding the "nearest neighbor" in the feature space, which enables the generated adversarial examples to "disguise" the target algorithm features as imitation categories at minimal cost, significantly increasing the difficulty of confusing the recognition model.

[0030] As an optional implementation, S3 includes: S31: Calculating the imitation score of the target encryption algorithm at each bit based on the difference between the prototype vector of the target encryption algorithm and the prototype vector of the imitation encryption algorithm. S33: Weighting and fusing the imitation score and the specificity score at each bit to obtain an adversarial value assessment score for each bit in the current ciphertext.

[0031] Specifically, the comprehensive adversarial scoring of the calculated bits: To accurately filter out the most destructive positions from massive amounts of ciphertext bits, this invention designs a dual scoring mechanism that combines "camouflage" and "erasure." This scoring is applied to each bit of the target algorithm's ciphertext. Calculate its comprehensive score for its adversarial value. The score is a weighted average of the imitation score and the specificity score. Imitation rating ( This is used to evaluate the degree to which the distance between the target prototype and the imitated category prototype is reduced after flipping this bit. The calculation formula is:

[0032] If the value is positive, it means that flipping this bit helps to disguise the ciphertext feature as a mimicry category.

[0033] in, The proportion of bits with a value of 1 at the t-th bit in the ciphertext set after the target encryption algorithm encrypts the test plaintext set; This refers to the proportion of bits with a value of 1 at the t-th bit in the ciphertext set encrypted by the simulated encryption algorithm on the test plaintext set. Specifically, if the test ciphertext set has 500 ciphertexts, each 5 bytes long (e.g., 01000), with each bit being either 1 or 0, then there are 500 bits with a value of 1 at the t-th bit. Then, for different encryption algorithms on the same plaintext test set, the encrypted results will be different. At the t-th bit, after encryption by the target encryption algorithm, there will be 300 1s and 200 0s out of the 500 bits. It's 0.6. When encrypted using a similar encryption algorithm, it contains 100 ones and 400 zeros out of 500. It's 0.2.

[0034] Specificity score ( ): Used to evaluate the statistical significance of this bit in the target algorithm. The calculation formula is:

[0035] The larger this value, the more uneven the distribution of 0s or 1s at that position, indicating a strong characteristic fingerprint of the algorithm. Flipping this position can effectively disrupt the inherent rules of the algorithm and should be prioritized for disruption. The proportion of bits with a value of 1 at the t-th bit in the ciphertext set after the target encryption algorithm encrypts the test plaintext set.

[0036] Overall score ( The two scores above are then weighted and combined:

[0037] in and The weighting coefficients are adjusted according to specific circumstances to ensure the attack performance of the perturbation.

[0038] As an optional implementation, S5 includes: S51: Setting the corresponding bit in the current perturbation mask to 1 according to the current highest bit in the sorting result, and using it as a temporary perturbation mask. The current perturbation mask is an all-zero mask in the first iteration. S52: Perturbating the current ciphertext set with the current perturbation mask and the temporary perturbation mask respectively to obtain a first perturbation ciphertext set and a second perturbation ciphertext set. S53: Inputting the features corresponding to the first perturbation ciphertext set and the second perturbation ciphertext set into the local substitution model to obtain their respective average confidence scores. Selecting the perturbation mask corresponding to the larger average confidence score as the new current perturbation mask. S54: Deleting the current highest bit in the sorting result, determining whether the current sorting result meets the preset conditions. If not, returning to S51; if so, using the current perturbation mask as the target perturbation mask.

[0039] As an optional implementation, S52 includes: performing a bitwise XOR operation between the current perturbation mask and the current ciphertext set to obtain a first perturbation ciphertext set; and performing a bitwise XOR operation between the temporary perturbation mask and the current ciphertext set to obtain a second perturbation ciphertext set.

[0040] Specifically, the obtained comprehensive score is sorted in descending order of all bits, and a binary perturbation mask is generated using a greedy search strategy: the perturbation mask is initialized as an all-zero vector. Bits at corresponding positions in the mask are flipped (set to 1) sequentially according to the sorting order. The current temporary mask is applied to the ciphertext verification set samples of the target algorithm (using an XOR operation), and the perturbated samples are input into the surrogate model trained in step one. The average prediction confidence of the surrogate model for the target algorithm category is calculated. If the confidence decreases, the bit flip is retained; otherwise, the bit flip is reversed. The final output mask can be pre-computed and stored offline. In actual communication, only a very low-overhead XOR operation is required, perfectly solving the computational latency problem in real-time encrypted communication.

[0041] Example 2 This embodiment provides a method for sending information to counter machine learning model attacks, including: The target perturbation mask obtained using the perturbation mask generation method provided in Example 1 For the current ciphertext corresponding to the original plaintext Secondary encryption is performed to obtain the target adversarial ciphertext. And send it to the target recipient.

[0042] Optional, sender: in ciphertext After generation and before sending, combine the ciphertext with the perturbation mask generated in step four. Perform a bitwise XOR operation to generate adversarial ciphertext. and send .

[0043] Example 3 This embodiment provides a communication method for attacks against machine learning models, including: A sending end: using the information sending method provided in Embodiment 2 to send target adversarial ciphertext. Receiver: Received the target's adversarial ciphertext. Then, a target perturbation mask is used, either shared or negotiated in advance. Perform decryption to obtain the current ciphertext. Then, a second decryption is performed to obtain the original plaintext.

[0044] Optional, sender: in ciphertext After generation and before sending, combine the ciphertext with the perturbation mask generated in step four. Perform a bitwise XOR operation to generate adversarial ciphertext. and send Receiver: Received anti-ciphertext Then, the same perturbation mask, which was previously shared or negotiated, is used. Perform a reverse bitwise XOR operation to recover the original ciphertext. Then proceed with normal decryption.

[0045] To verify the effectiveness of the ciphertext perturbation method against cryptographic algorithms proposed in this invention, tests were conducted on a dataset containing seven mainstream international standard cryptographic algorithms, including AES, DES, RSA, and KASUMI. The experiments used an MLP classifier based on NIST-15 statistical features as the attacker identification model and were validated on an Intel Core i5 CPU and RTX 3060 GPU environment.

[0046] (1) Verification of decreased recognition accuracy (proving the effectiveness of the defense): Experimental results show that the method generated by this invention can significantly reduce the attacker's recognition accuracy under various feature configurations. In all effective feature-algorithm combinations, the attacker's recognition accuracy decreased by more than 25% after applying the perturbation mask generated by this invention.

[0047] Taking the KASUMI algorithm as an example, under the NIST Feature 12 (Approximate Entropy Test) configuration, the attacker's recognition accuracy dropped significantly from the original 71.82% to 2.32%, a decrease of 69.50%, proving that the method has a strong misleading ability and can effectively mask the statistical characteristics of cryptographic algorithms.

[0048] (2) Perturbation cost and concealment verification (proof lightweight) In order to evaluate the concealment and computational cost of the defense, the perturbation percentage of the generated mask was statistically analyzed.

[0049] Experimental data shows that this invention causes model recognition failure while only requiring the flipping of a very small proportion of ciphertext bits. In the tested algorithms, the average perturbation ratio was approximately 13.06%, and the lowest perturbation ratio was only 7.94%. This indicates that this invention can achieve efficient defense with minimal modification cost, not only ensuring the randomness of the ciphertext appearance but also reducing the overhead of the transport layer.

[0050] (3) Comparative experiment verification (proving inventiveness): In order to prove the technical advantages of the "dual scoring mechanism (imitative scoring + specific scoring)" in this invention, a comparative experiment was conducted with the "random flipping" strategy and the "single scoring" strategy.

[0051] Under the same perturbation quantity (i.e., flipping the same number of bits), the accuracy reduction caused by the present invention is significantly better than that of the random flipping strategy. Data shows that the present invention improves the accuracy reduction by more than 15% compared to the random flipping strategy, with a maximum improvement of 38.92% (from a 20.38% reduction in the random strategy to a 59.30% reduction in the present invention).

[0052] This result fully demonstrates that the present invention does not simply introduce noise, but rather interferes by accurately locating key statistical feature bits, thereby achieving the technical effect that "choosing the flip position is more important than the number of flips".

[0053] Example 4 This embodiment provides a communication device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the perturbation mask generation method for machine learning model attacks provided in Embodiment 1.

[0054] Example 5 This embodiment provides a communication device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the information transmission method for machine learning model attacks provided in Embodiment 2.

[0055] Example 6 This embodiment provides a communication device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the communication method for attacking machine learning models provided in Embodiment 3.

[0056] The communication device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The memory can be used to store computer programs and / or modules. The processor implements various functions of the communication device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory.

[0057] Example 7 The present invention also relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the methods described in the above embodiments.

[0058] Specifically, the memory may include high-speed random access memory, as well as non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart media cards (SMC), secure digital (SD) cards, flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0059] Example 8 This invention provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the methods described in the above embodiments of this invention.

[0060] The technical features of the embodiments described above can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. It should be noted that the terms "in one embodiment," "for example," and "again" in this invention are intended to illustrate the invention and are not intended to limit the invention.

[0061] The embodiments described above are merely examples of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for generating a perturbation mask against attacks on a machine learning model, the method comprising: The method comprises the following steps: S1: calculating a prototype vector of each preset encryption algorithm in a preset encryption algorithm set by using a local substitute model corresponding to a machine learning model that may be used by an attacker; The preset encryption algorithm set comprises a plurality of candidate encryption algorithms and a target encryption algorithm to be used by a defender; S2: calculating a similarity of the prototype vector between the target encryption algorithm and each of the candidate encryption algorithms; selecting a candidate encryption algorithm corresponding to the highest similarity as a mimic encryption algorithm of the target encryption algorithm; S3: performing an adversarial value evaluation on each bit in the current ciphertext based on a difference between the prototype vector of the target encryption algorithm and the prototype vector of the mimic encryption algorithm to obtain an evaluation score; S4: performing a high-to-low sorting on the evaluation score of each bit to obtain a sorting result; S5: flipping part of bits in a set current perturbation mask according to the sorting result to obtain a target perturbation mask. 2.The method of claim 1, wherein, The S1 comprises: for each preset encryption algorithm, taking an average value of each ciphertext sample in a ciphertext sample data set corresponding to the preset encryption algorithm at each bit as a value of a corresponding bit in a prototype vector of the preset encryption algorithm. 3.The method of claim 1, wherein, The S3 comprises: S31: calculating a mimic score of each bit of the target encryption algorithm based on a difference between the prototype vector of the target encryption algorithm and the prototype vector of the mimic encryption algorithm; S32: calculating a specificity score of each bit of the target encryption algorithm; S33: performing a weighted fusion on the mimic score and the specificity score of each bit to obtain an evaluation score of each bit in the current ciphertext. 4.The method of claim 3, wherein, The S31 comprises: calculating the mimic score of the target encryption algorithm at the tth bit position by using the following formula ; ; wherein, is the proportion of the value of the tth bit being 1 in the ciphertext set after the target encryption algorithm encrypts the test plaintext set; is the proportion of the value of the tth bit being 1 in the ciphertext set after the imitated encryption algorithm encrypts the test plaintext set. 5.The method of claim 3, wherein, The S32 comprises: calculating the specificity score of the tth bit position by using the formula The S32 comprises: calculating the specificity score of the tth bit position by using the formula ; wherein, The proportion of the tth bit value being 1 in the ciphertext set after the target encryption algorithm is used to encrypt the test plaintext set. 6.The method of claim 1, wherein, The S5 comprises: S51: setting a corresponding bit in a current perturbation mask to 1 according to a current highest bit in the sorting result, and taking the current perturbation mask as a temporary perturbation mask; the current perturbation mask is a full-zero mask in the first iteration; S52: perturbing a current ciphertext set by the current perturbation mask and the temporary perturbation mask to obtain a first perturbed ciphertext set and a second perturbed ciphertext set; the current ciphertext set is an original plaintext set encrypted by the target encryption algorithm; S53: inputting respective features of the first perturbed ciphertext set and the second perturbed ciphertext set into the local substitute model to obtain respective average confidence degrees; selecting a perturbation mask corresponding to a larger average confidence degree as a new current perturbation mask; S54: deleting the current highest bit in the sorting result, and judging whether the current sorting result meets a preset condition; if not, returning to S51; if yes, taking the current perturbation mask as a target perturbation mask. 7.The method of claim 6, wherein, The S52 comprises: performing a bitwise XOR operation on the current perturbation mask and the current ciphertext set to obtain the first perturbed ciphertext set; performing a bitwise XOR operation on the temporary perturbation mask and the current ciphertext set to obtain the second perturbed ciphertext set.

8. An information sending method for a machine learning model attack, comprising: The target perturbation mask obtained by using the perturbation mask generation method of any one of claims 1-7 The current ciphertext corresponding to the original plaintext The target ciphertext is obtained by performing secondary encryption And send to the target recipient.

9. A communication method for a machine learning model attack, comprising: The sender transmits the target challenge ciphertext by using the information transmission method of claim 8. ; Receiver: receives the target ciphertext After that, the target perturbation mask is used The decryption operation is performed to obtain the current ciphertext The original plaintext is obtained by performing secondary decryption.

10. A communication device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor implements the steps of the method of any one of claims 1 to 9 when executing the computer program.

Images