General neural network symmetric encryption method and sending end and receiving end
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- XIDIAN UNIV
- Filing Date
- 2026-03-31
- Publication Date
- 2026-06-19
Smart Images
Figure CN121940229B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of encrypted data transmission technology, specifically relating to a general neural network symmetric encryption method and its sending and receiving ends. Background Technology
[0002] With the development of informatization and intelligentization in recent years, massive amounts of data have emerged and permeated all aspects of social production and life. Cryptography is the mainstream method for protecting the security of this data. Some methods use various cryptographic primitives, such as the nonlinear S-box structure in symmetric encryption or modular exponentiation and large integer factorization in asymmetric encryption, to perform encryption. Recently, the rapid development of deep learning technology has further inspired the exploration of applying deep neural networks (DNNs) to encryption tasks.
[0003] The current popular technical approach is to replace traditional cryptographic algorithms with equivalent neural networks. Specifically, this involves building a DNN (Digital Neural Network) tailored to the traditional cryptographic algorithm, adjusting its structure to make its inputs and outputs identical. While this combination of cryptography and DNNs shows great promise, it still faces numerous limitations in practical application. Specifically, traditional methods have poor versatility, requiring the design of a completely new DNN for each encryption algorithm. This DNN must be built step-by-step from basic neurons and activation functions, making the process tedious, inefficient, and requiring extensive expert knowledge. Secondly, the designed DNN can only replace a single target cryptographic algorithm to perform specific encryption and decryption tasks, losing the properties of a regular DNN and thus unable to perform common DNN functions (such as image classification).
[0004] Therefore, traditional DNN-based encryption methods have poor versatility and low utilization of DNNs. Summary of the Invention
[0005] This invention provides a general neural network symmetric encryption method, as well as a sending end and a receiving end, which can solve the above-mentioned technical problems.
[0006] In a first aspect, embodiments of the present invention provide a general neural network symmetric encryption method, the method being applied at a sending end, the method comprising:
[0007] The perturbation image is iteratively corrected until the state string matches the target string, thus obtaining the standard fused image;
[0008] The target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image;
[0009] Subtract the image key from the standard fused image to obtain the encrypted image;
[0010] The encrypted image is sent to the receiving end so that the receiving end can recover the plaintext information based on the image key and the encrypted image using the neural network.
[0011] Secondly, embodiments of the present invention provide a transmitting end, which includes: a disturbance correction module, a transmission preprocessing module, and a first communication module;
[0012] The perturbation correction module is used to iteratively correct the perturbation image until the state string matches the target string, thus obtaining a standard fused image.
[0013] The target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image;
[0014] The pre-processing module is used to subtract the image key from the standard fused image to obtain the encrypted image;
[0015] The first communication module is used to send the ciphertext image to the receiving end, so that the receiving end can recover the plaintext information based on the image key and the ciphertext image using the neural network.
[0016] Thirdly, embodiments of the present invention provide a receiving end, including: a second communication module and a decryption module;
[0017] The second communication module is used to receive a ciphertext image from the sending end, wherein the ciphertext image is obtained by the sending end from a standard fused image by subtracting an image key, the standard fused image is obtained by the sending end by iteratively correcting a perturbation image until the state string matches the target string, the target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image;
[0018] The decryption module is used to recover the plaintext information based on the image key and the ciphertext image using the neural network.
[0019] The beneficial effects of the embodiments of the present invention compared with the prior art are as follows: Since the transmitting end provided by the present invention only iteratively corrects the input of the neural network without modifying the structure and parameters of the neural network itself, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting; and if the encryption process is to be changed in the future, another existing neural network can be directly used to replace the neural network used at this time without redesigning the neural network structure, which can improve the versatility of the encryption method. Attached Figure Description
[0020] Figure 1 This is a comparative schematic diagram illustrating the implementation process of an encryption method according to an embodiment of the present invention;
[0021] Figure 2 This is a schematic diagram of the structure of a general neural network symmetric encryption system provided in an embodiment of the present invention;
[0022] Figure 3 A flowchart illustrating the implementation of a general neural network symmetric encryption method provided in this embodiment of the invention;
[0023] Figure 4 A schematic diagram of pseudocode for a process of correcting a perturbation image provided in an embodiment of the present invention;
[0024] Figure 5 This is a schematic diagram illustrating an encryption and decryption scenario provided by an embodiment of the present invention;
[0025] Figure 6 A flowchart illustrating the implementation of a method for iteratively correcting a perturbed image, provided in an embodiment of the present invention;
[0026] Figure 7 A schematic diagram of a scenario illustrating the state of an encoded neural network, provided in an embodiment of the present invention;
[0027] Figure 8 A schematic diagram of pseudocode for an encoding process of the state of a neural network provided in an embodiment of the present invention;
[0028] Figure 9 A schematic diagram illustrating the comparison between a random image and a ciphertext image provided in an embodiment of the present invention;
[0029] Figure 10 A schematic diagram of the structure of a transmitting end provided in an embodiment of the present invention;
[0030] Figure 11 This is a schematic diagram of a receiving end provided in an embodiment of the present invention;
[0031] Figure 12 This is a schematic diagram illustrating the variation curves of the decrypted bit error with the amount of training data and the encryption time with the sigma value of Gaussian white noise, provided as an embodiment of the present invention.
[0032] Figure 13 This is a comparative diagram of the states of different neural networks provided in an embodiment of the present invention. Detailed Implementation
[0033] See Figure 1 The currently popular encryption method using DNNs, shown in (a) above, generally involves first combining different neurons and activation functions into structures based on various Boolean operations. Then, according to cryptographic components, these neuron and activation function structures are concatenated to obtain different components. Finally, according to the logic of the cryptographic algorithm, these components are concatenated to obtain a neural network. Security constraints are applied to the input and output of this neural network to eliminate the difference between the continuous real number field and the Boolean discrete field. Because this neural network is completely equivalent to the original cryptographic algorithm, it is also called a DNN implementation of a cryptographic algorithm.
[0034] Because the computational process differs for each cryptographic algorithm, a DNN designed for one algorithm cannot be used to implement other algorithms; different DNNs must be built for each algorithm's computational process. Therefore, traditional solutions have poor versatility. Furthermore, changing the structure of the built DNN also prevents it from performing traditional classification tasks, resulting in low utilization of the DNN.
[0035] In view of this, the present invention provides a general neural network symmetric encryption method. This method iteratively corrects a perturbed image until the encoded state of the neural network is identical to the encoded plaintext information, obtaining a standard fused image. The ciphertext image is then obtained by subtracting the image key from the standard fused image, thereby encrypting the plaintext information. See also... Figure 1 In (b) of this invention, since the encryption process only iteratively corrects the input of the neural network without modifying the structure and parameters of the neural network itself, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting. Furthermore, if the encryption process needs to be changed later, another existing neural network can be directly used to replace the current neural network without redesigning the neural network structure, thus improving the versatility of the encryption method. At the same time, this invention provides a new neural network-based encryption method, rather than a DNN implementation of existing encryption algorithms.
[0036] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.
[0037] Example 1
[0038] Figure 2 The diagram shown illustrates the structure of a general neural network symmetric encryption system provided by an embodiment of the present invention. As an example and not a limitation, the system may include a sending end and a receiving end.
[0039] For example, see Figure 2 Both the sending and receiving ends possess basic computing capabilities and are equipped with commonly used and identical neural networks (with the same structure and parameters). The sending end's goal is to generate a secure ciphertext image and prevent information leakage from the ciphertext image. The receiving end's goal is to receive the ciphertext image and correctly decrypt it to obtain the plaintext information. However, attackers may exist outside the system. These attackers also possess basic computing capabilities and, in extreme cases, may even be able to learn about the neural network used for encryption and the encoding method of its states. They may also be able to intercept / modify / forge ciphertext images and use machine learning models to analyze them, with the goal of obtaining plaintext or key-related information.
[0040] Specifically, see Figure 2 The sending and receiving ends secretly share an image key. The sending end uses a neural network to encrypt plaintext information using the image key and the neural network to obtain a ciphertext image. The receiving end uses the same neural network to decrypt the ciphertext image using the image key to obtain the plaintext information.
[0041] Example 2
[0042] Figure 3 The diagram shown illustrates a flowchart of a general neural network symmetric encryption method provided by an embodiment of the present invention. As an example and not a limitation, this method can be applied to the aforementioned system and may include steps S301-S305, which are described below.
[0043] S301, System initialization.
[0044] In one example, during the initialization phase, the sender and receiver can secretly share an image key and determine the neural network used and how the state of the neural network is encoded.
[0045] For example, the present invention does not have specific requirements for the size, color, content, etc. of the image key.
[0046] For example, a neural network can be a neural network used to process images, such as an image classification network, an image-based prediction and evaluation network, etc.
[0047] For example, the sender and receiver must at least share the following information regarding the encoding method: 1) and 2):
[0048] 1) Which layers and neurons in the neural network (i.e., coding layers and coding neurons) should the plaintext information be encoded into?
[0049] 2) Grouping method of encoding neurons;
[0050] 3) Quantization threshold.
[0051] Optionally, the neural network can be specified. logits The layer is a coding layer, and all neurons in this layer are encoded as plaintext information (i.e., coding neurons).
[0052] Specifically, logits A layer refers to the last layer before the output layer of a neural network.
[0053] Alternatively, apart from the image key, all other information shared during the initialization phase can be made public without affecting the security of the encryption method, which is in line with the Kirkhoff principle.
[0054] S302, the transmitting end iteratively corrects the perturbation image until the status string matches the target string, thus obtaining the standard fused image.
[0055] For example, the target string is obtained by encoding the plaintext information to be shared.
[0056] Optionally, see Figure 4 The pseudocode shown can encode plaintext information into a target string using the American Standard Code for Information Interchange (ASCII) encoding method.
[0057] For example, the state string is obtained by encoding the state of the neural network, which is the output of the neural network's encoding layer after inputting a perturbed image.
[0058] In one example, see Figure 5 The sending end can first randomly select an image as the initial perturbation image (i.e., the 0th perturbation image). Then, it fuses the current perturbation image and the image key and inputs the result into the neural network to obtain the current state of the neural network. This state is then encoded to obtain a state string. The state string is compared with the target string. If they match, the current fused image is used as the standard fused image; otherwise, based on the difference between the state string and the target string, ciphertext perturbation is added to the current perturbation image to correct it. The corrected perturbation image is then used as the current perturbation image for the next round of encryption, until the state string matches the target string.
[0059] S303, the sending end subtracts the image key from the standard fused image to obtain the ciphertext image.
[0060] In one example, see Figure 5 The sending end can obtain the encrypted image by subtracting the image key from the standard fused image.
[0061] For example, a ciphertext image can satisfy the following formula:
[0062] (1.1),
[0063] in, For encrypted images, For the first A fused image, This represents the total number of iterations for correction. For the first A perturbation image, Let the random image be the 0th perturbation image (hereinafter referred to as the random image). For the first The perturbation added in the next iteration (i.e., the correction to the perturbation image). This represents the image key.
[0064] Specifically, as can be seen from the above formula (1.1), the ciphertext image is essentially a random image and the sum of all perturbations to it.
[0065] S304, the sending end sends the encrypted image to the receiving end.
[0066] For example, see Figure 5 The sending end can send encrypted images to the receiving end through a public channel.
[0067] S305, the receiver is based on a neural network to recover plaintext information from the image key and the ciphertext image.
[0068] In one example, the receiver can first overlay the encrypted image and the image key to obtain a standard fused image. Since the receiver uses the same neural network for decryption and encryption as the sender, the neural network's state is identical when the same standard fused image is input. Therefore, the receiver can input the standard fused image into the neural network, guiding it to exhibit a special state (i.e., an encrypted state). Then, it uses the same encoding method as the sender to encode the encrypted state of the neural network to obtain the plaintext information. .
[0069] For example, when the encoding layer is logits When the layer is reached, the decryption process at the receiving end can be represented as:
[0070] (1.2),
[0071] (1.3),
[0072] in, This indicates that the input to the neural network is a standard fused image. , This indicates that the neural network is in an encrypted state.
[0073] Neither the image key nor the ciphertext image can be used alone to recover plaintext information. While fusing them to obtain a standard fused image for plaintext recovery is straightforward, decomposing the standard fused image to obtain the image key, a random image, and all perturbations to the random image is extremely difficult. This approach is similar to the large integer factorization problem, but the complexity of images makes it far more challenging. Furthermore, an attacker can at most obtain the neural network's structure, parameters, and the encoding methods of the neural network state at the sending and receiving ends, but not the image key. Therefore, an attacker cannot recover the standard fused image from the ciphertext image, and consequently, cannot reconstruct the plaintext information from the standard fused image.
[0074] Since the encryption method provided by this invention only iteratively corrects the input of the neural network without modifying the structure and parameters of the neural network itself, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting. Furthermore, if the encryption process needs to be changed in the future, another existing neural network can be used to replace the neural network currently in use without redesigning the neural network structure, which improves the versatility of the encryption method.
[0075] Example 3
[0076] Figure 6 The diagram illustrates a flowchart of an iterative correction method for a perturbed image provided by an embodiment of the present invention. As an example and not a limitation, this method is applied to the transmitting end and is a possible specific implementation of step S302 described above. The method may include steps S601 to S607, which are described below.
[0077] S601, the first The perturbation image is fused with the image key to obtain the first... A fused image.
[0078] For example, It is a positive integer, and the 0th perturbation image is a random image.
[0079] In one example, when fusing the 0th perturbation image, the pixel values of the 0th perturbation image can be normalized from [0, 255] to [0, 1] first, and then, like the other perturbation images, the image key is superimposed to generate the 0th fused image.
[0080] For example, the 0th fused image satisfies the following formula:
[0081] (1.4),
[0082] in:
[0083] (1.5),
[0084] in, This is the 0th perturbation image after normalization. For the 0th fused image, This is the image key.
[0085] S602, the first The first fused image is input into the neural network to obtain the neural network's first fused image. There are several states.
[0086] In one example, the state of a neural network refers to the output of the neural network's coding layer after the input fused image is received.
[0087] For example, the state of a neural network can be the numerical value of the output of each coding neuron in the coding layer.
[0088] For example, the state of a neural network can also refer to the numerical mean of each group of neurons in the coding layer.
[0089] S603, the first encoding neural network The state is obtained at the _th state. A status string.
[0090] In one possible implementation, the first step function of the neural network can be used to determine the quantization threshold. Binarize the nth state to obtain the nth state. A status string.
[0091] In one example, the simplest encoding method is to use the output value of the encoding neurons in the neural network's encoding layer as the state of the neural network. The output value of each encoding neuron is compared to a quantization threshold; if it exceeds the threshold, the corresponding bit in the state string is set to 1; otherwise, it is set to 0, thus obtaining the state of the next neuron. A status string.
[0092] Specifically, this comparison process can be achieved using a step function.
[0093] In another example, due to the complex internal relationships of neural networks, when quantizing the encoding neurons one by one, the following situation may occur: regardless of how the input image is modified at the sending end, the values of some encoding neurons do not change significantly. Such neurons are also called non-responsive neurons. For example, see... Figure 7 The first character of the target string is 1, but no matter how the perturbation image is modified, the value of the encoding neuron corresponding to the first character of the output state string cannot be increased above the quantization threshold, which will lead to encoding failure. At this time, the sending and receiving ends have to start from step S301 above and re-initialize to agree on a new neural network, encoding method, or even image key, resulting in additional and significant overhead. Therefore, the present invention also provides another group coding method, which first groups adjacent encoding neurons together, and then uses the average value of the neuron group as the state of the neural network.
[0094] For example, see Figure 7 If the encoding neuron is logits For all neurons in a layer, grouping adjacent neurons into pairs allows us to compare the average of the first and second neurons with the quantization threshold to generate the first bit of the state string. Similarly, comparing the average of the third and fourth neurons with the quantization threshold generates the second bit, and so on. While the transmitter still cannot increase the output value of the first neuron, it can increase the average of the two neurons by increasing the output value of the second neuron. When the average exceeds the quantization threshold, the first bit of the state string can be successfully encoded as 1.
[0095] For example, the number of neurons in each group It is not necessarily 2. The number of neurons in a group can be determined by the number of bits in the target string and the total number of encoding neurons.
[0096] For example, the status string obtained by using block encoding can satisfy the following formula:
[0097] (1.6),
[0098] in, The first of the status strings Bit value For quantization threshold, Indicates the first The output value of each encoding neuron Less than or equal to Positive integers.
[0099] Specifically, see Figure 4 The pseudocode shown can be used to first calculate the first... The average value of each neuron group in each state is calculated. It is then determined whether the average value is greater than or equal to the quantization threshold. If it is greater than or equal to the threshold, the corresponding state string of that neuron group is assigned the value 1. If it is less than the threshold, the corresponding bit is assigned the value 0. After the current bit is processed, the above steps are repeated to process the next neuron group until all bits of the state string are encoded, and the state string is returned.
[0100] S604, determine the first Does the status string match the target string?
[0101] In one example, see Figure 8 The pseudocode shown can be measured by the bit error loss. Does the status string match the target string?
[0102] For example, the bit error loss can be calculated using the following formula:
[0103] (1.7),
[0104] in, For error loss, Represents a neural network. Represents the state of the neural network. Represents the L2 norm. For the first A fused image.
[0105] Specifically, if the bit error loss is 0, it means that the status string and the target string are consistent.
[0106] For example, see Figure 8 The pseudocode shown, if the first If the status string matches the target string, then proceed to step S607; otherwise, proceed to steps S605 and S606 in sequence.
[0107] S605, according to the... The difference between the current state string and the target string determines the first [value] of the perturbation image. One loss.
[0108] In one possible implementation, the modified loss function used to calculate the loss of the perturbed image may include the aforementioned bit error loss, truncation loss, direct leakage loss, and indirect leakage loss.
[0109] For example, the modified loss function can be expressed as:
[0110] (1.8),
[0111] Among them, its Indicates perturbation image The loss, This is plaintext information. For error loss, For the first Disturbance image Cut-off loss, , These are the hyperparameters for the two control weights. , They represent With random images Direct leakage losses and indirect leakage losses.
[0112] In one example, error loss can be used to measure the difference between the state string and the target string.
[0113] In one example, since different information systems typically exhibit different computational precision (e.g., graphics processors with relatively low precision and central processing units with high precision), a truncation loss is set to reduce the computational precision requirements of the correction process in order to improve the versatility of the method and make it applicable to various types of computing devices.
[0114] For example, the cutoff loss can satisfy the following formula:
[0115] (1.9),
[0116] in, For the first Disturbance image Cut-off loss, This represents the operation of converting to an integer. This indicates the operation of converting to float32 format.
[0117] Specifically, the truncation loss first converts the perturbation image to an integer type, and then converts it back to float32. By constraining the truncation loss, the sender can ensure that each modification to the perturbation image during iteration does not require overly precise calculations, thus guaranteeing that the method can be accurately executed by various information systems and ensuring successful encryption and decryption.
[0118] In one example, the perturbation image should be kept as similar as possible to the random image to minimize information leakage. Therefore, a direct leakage loss is set to maintain the similarity between the perturbation image and the random image.
[0119] For example, the direct leakage loss can be measured using a Visual Geometry Group (VGG) model to measure the style difference between a perturbed image and a random image, and can be calculated using the following formula:
[0120] (1.10),
[0121] Among them, it means With random images Direct leakage losses between them This indicates that the process is handled using the VGG model.
[0122] In one example, the sender distinguishes the difference between the standard fused image and the random image as an image key and a perturbation present in the ciphertext image. However, even when these perturbations exist in isolation, they can still cause changes in the state of the neural network, and attackers may indirectly obtain additional information through the encrypted image. To avoid this, an indirect leakage loss is set to reduce the difference between the perturbation representation and the initial representation.
[0123] For example, the perturbation representation and the initial representation are the overall representations of the neural network after inputting a perturbation image and a random image, respectively.
[0124] For example, indirect leakage loss can satisfy the following formula:
[0125] (1.11),
[0126] in, express With random images Indirect leakage losses between them This represents the overall representation of the neural network. , The inputs to the neural network are respectively , .
[0127] By constraining the losses from direct and indirect leakage, the resulting ciphertext image, after subtracting the image key from the standard fused image, is very close to a random image to both the naked eye and the neural network. This avoids the leakage of additional information and further improves the security of the encryption method.
[0128] Optionally, see Figure 8 The pseudocode shown can be used to reduce computation by discarding other loss terms and directly using the gradient of the error loss to correct the perturbation image and adjust its perturbation relative to the random image.
[0129] S606, according to the... The first loss correction The perturbation image yields the first... A perturbation image.
[0130] For example, the perturbed image can be corrected using the following formula:
[0131] (1.12),
[0132] in, , The first , A perturbation image, For learning rate, For gradient operators, This represents the gradient of the loss function at the perturbed image.
[0133] Specifically, after completing step S606, it can be made The next iteration and correction process begins from step S601.
[0134] S607, the first The fused image is used as the standard fused image, and the correction of the perturbed image is stopped.
[0135] Since the encryption method provided by this invention only iteratively corrects the input of the neural network without modifying the structure and parameters of the neural network itself, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting. Furthermore, if the encryption process needs to be changed in the future, another existing neural network can be used to replace the neural network currently in use without redesigning the neural network structure, which improves the versatility of the encryption method.
[0136] Further, see Figure 9 The two columns of images shown show the random image used during encryption on the left and the encrypted ciphertext image on the right. It can be seen that the difference between the ciphertext image and the random image is small. This demonstrates that by adding direct and indirect leakage losses during the correction of the perturbation image, this invention can prevent attackers from directly obtaining relevant perturbation information by comparing the differences between the ciphertext image and the random image. It can also prevent attackers from indirectly obtaining information by observing changes in neurons of the neural network during inference of different images, thereby reducing non-cryptographic security threats.
[0137] Example 4
[0138] Figure 10 The diagram shown illustrates the structure of a transmitter according to an embodiment of the present invention. As an example and not a limitation, the transmitter may include a disturbance correction module, a pre-transmission processing module, and a first communication module.
[0139] For example, the perturbation correction module is used to iteratively correct the perturbation image until the state string matches the target string, thus obtaining a standard fused image. Here, the target string is obtained by encoding the plaintext information to be shared, the state string is obtained by encoding the state of the neural network, the state of the neural network is the output of the preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image. The pre-processing module is used to subtract the image key from the standard fused image to obtain the ciphertext image. The first communication module is used to send the ciphertext image to the receiving end so that the receiving end can recover the plaintext information based on the neural network, according to the image key and the ciphertext image.
[0140] Since the transmitter provided by this invention only iteratively corrects the input of the neural network without modifying the structure and parameters of the neural network itself, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting. Furthermore, if the encryption process needs to be changed in the future, another existing neural network can be directly used to replace the neural network currently in use without redesigning the neural network structure, which can improve the versatility of the encryption method.
[0141] Example 5
[0142] Figure 11 The diagram shown illustrates the structure of a receiver according to an embodiment of the present invention. As an example and not a limitation, the receiver may include a second communication module and a decryption module.
[0143] For example, the second communication module is used to receive a ciphertext image from the sending end, wherein the ciphertext image is obtained by the sending end subtracting the image key from the standard fused image, the standard fused image is obtained by the sending end iteratively correcting the perturbation image until the state string matches the target string, the target string is obtained by encoding the plaintext information to be shared, the state string is obtained by encoding the state of the neural network, the state of the neural network is the output of the preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image; the decryption module is used to recover the plaintext information based on the neural network, according to the image key and the ciphertext image.
[0144] Specifically, the receiving end can overlay the image key and the ciphertext image to obtain a standard fused image; input the standard fused image into the neural network to obtain the encryption state of the neural network; and encode the encryption state of the neural network to obtain plaintext information.
[0145] Because the neural network's input is only iteratively corrected at the sending end, without modifying the neural network's structure and parameters, the neural network can still perform its traditional functions, such as prediction and classification, while encrypting the data. Furthermore, if the encryption process needs to be changed later, another existing neural network can be used to replace the one currently in use without redesigning the neural network structure, thus improving the versatility of the encryption method.
[0146] To better illustrate the beneficial effects of the present invention, the following simulation experiments were conducted:
[0147] As an example, the simulation experiment used real-world images against the ImageNet dataset. The images in the dataset were uniformly scaled to two resolutions: 224×224 and 896×896. The experiment was run on a computer equipped with an Ubuntu system featuring an RTX 4090 GPU. The programming tools used were Python 3.10 and PyTorch. A stochastic gradient descent optimizer and hyperparameters were employed: weights of the direct leakage loss. =1000, weight of indirect leakage loss =100, logits The layer is used as the encoding layer, and all neurons on it act as encoding neurons. A block coding method is used to encode the state of the neural network, with a neuron group size of 2. The quantization threshold is 0.5. The neural network uses a ResNet50 architecture, and the learning rate is set to 10. 4 .
[0148] For example, the ImageNet dataset is built on the WordNet semantic system to construct a hierarchical category structure and contains a large number of manually verified labeled images.
[0149] For example, in simulation experiments, indicators such as L1 distance, L2 distance, structural similarity, peak signal-to-noise ratio, and information leakage value are used to evaluate the encryption effect.
[0150] Specifically, the L1 distance metric measures the general difference between two images by calculating the sum of the absolute differences between corresponding pixel values, which satisfies the following formula:
[0151] (1.13),
[0152] in, , Indicates two images being compared. This represents the L1 distance between the two. Image size, Represents absolute value. , Representing images respectively , The median coordinate is The pixel value.
[0153] Specifically, the L2 distance metric measures the Euclidean distance between the pixel vectors of two images. Unlike the L1 distance, the L2 distance is more sensitive to large local differences and can be satisfied by the following formula:
[0154] (1.14),
[0155] in, express , The L2 distance between them.
[0156] Specifically, the Structural Similarity Index Measure (SSIM) quantifies the structural similarity between two images, emphasizing their consistency. Its value ranges from 0 to 1, with higher values indicating better image quality. It satisfies the following formula:
[0157] (1.15),
[0158] in, For structural similarity, , They are respectively , The average value, , It is a constant based on the dynamic range of the image. for , covariance, , They are respectively , The variance.
[0159] Specifically, the Peak Signal-to-Noise Ratio (PSNR) measures the noise introduced during image processing and can be expressed by the following formula:
[0160] (1.16),
[0161] in, Peak signal-to-noise ratio, A higher value indicates a smaller deviation between the generated image and the original image; The maximum pixel value of the image. The mean square error between the generated image and the original image.
[0162] Specifically, the information leakage value index is a metric designed to measure the direct information leakage of encrypted images. Since this leakage is manifested both at the pixel level and in the overall style, it can be calculated using the following formula:
[0163] (1.17),
[0164] in, This represents the value of information leakage. By combining... and Computational information leakage can effectively reflect the additional information that malicious attackers can obtain.
[0165] Simulation Experiment 1
[0166] As an example, simulation experiment 1 is an avalanche experiment, used to determine whether the encryption method provided by the present invention satisfies the avalanche effect.
[0167] For example, the avalanche effect is an ideal property of encryption, which means that the smallest change in the ciphertext (e.g., 1 bit) leads to a significant change in the ciphertext (e.g., ≥50%).
[0168] Since the encrypted information sent in this invention is an encrypted image rather than a encrypted string, the avalanche effect needs to be extended from the bits in the encrypted text to the pixels in the encrypted image when conducting the avalanche experiment. Specifically, two plaintext messages that differ by only 1 bit can be encrypted first using the same random image and image key, and then the difference between the encrypted images can be calculated.
[0169] Table 1 Avalanche Experiment
[0170]
[0171] Referring to Table 1 above, it can be seen that 91.17% of the pixels are different between the two encrypted images, which indicates that the method provided by the present invention satisfies the avalanche effect.
[0172] While the avalanche effect ensures that a 1-bit change in the plaintext leads to a large number of pixel changes in the ciphertext image, another question arises: if these ciphertext images are generated from the same random image, will this significant pixel difference increase the similarity between the ciphertext image and the original random image? To address this, simulation experiment 1 also measured the L1 and L2 distances between the two ciphertext images. The L2 distance was 1185, and the L1 distance was 200756, indicating that the difference between the two ciphertext images mainly lies in small changes among a large number of pixels, rather than significant differences among a few pixels. Therefore, this pixel difference does not affect the similarity between the ciphertext image and the original random image.
[0173] Simulation Experiment 2
[0174] For example, considering that the encryption method provided by this invention is based on a neural network, an attacker might use the same approach to intercept samples and train a decryption model to analyze the relationship between plaintext and ciphertext, thereby inferring information about the image key. To test the resistance of the encryption scheme provided by this invention to such attacks, in simulation experiment 2, an attacker was initially identified and provided with different numbers of ciphertext images and corresponding plaintext messages. The attacker used this data as samples to train a decryption model, which was used to infer the plaintext message based on the ciphertext image. After training, the attacker attempted to use the model to decrypt new ciphertext images.
[0175] See Figure 12 As shown in (a) of the curve illustrating the change in bit error after decryption with the amount of training data, it can be seen that the bit error of the decryption model is consistently around 50% when decrypting new ciphertext images, which is similar to random guessing. This is sufficient to demonstrate the effectiveness of the present invention in resisting this type of attack. Furthermore, from... Figure 12 As can also be observed in (a), increasing the amount of data provided to the attacker does not improve the decryption accuracy of the decryption model, which indicates that the encryption method provided by the present invention has good robustness.
[0176] Simulation Experiment 3
[0177] For example, attackers may also perform side-channel analysis on the encryption method provided by this invention by using different image keys to encrypt for different durations. In order to test the effectiveness of the encryption method provided by this invention against such attacks, in simulation experiment 3, Gaussian white noise with different sigma values was used as the image key to encrypt the same plaintext message and the encryption time was recorded.
[0178] See Figure 12 As shown in (b) of the figure, the encryption time varies with the sigma value of Gaussian white noise. It can be seen that the encryption time for different image keys fluctuates greatly and there is no clear pattern. This indicates that the encryption method provided by this invention can resist this type of attack and prevent attackers from inferring more information by analyzing the encryption time.
[0179] Simulation Experiment 4
[0180] For example, simulation experiment 4 compares the method provided by this invention with conventional techniques in... , And its performance in terms of direct leakage loss indicators.
[0181] Specifically, the traditional techniques included in the comparison are: Fixed Neural Network Steganalysis (FNNS), Secure Fixed Neural Network Steganalysis (SFNNS), Dense Adversarial Neural Network Steganalysis (SteganoGAN-D), and Basic Adversarial Neural Network Steganalysis (SteganoGAN-B).
[0182] Table 2 Comparison of Direct Information Leakage
[0183]
[0184] Referring to Table 2 above, it can be seen that as the learning rate decreases, the information leakage of the ciphertext image generated by the encryption method provided by this invention significantly decreases while the image quality significantly increases. Specifically, at a learning rate of 10... 3 At that time, the information leakage (i.e., direct leakage loss) was 39.34; when the learning rate was 10... 4 At that time, information leakage decreased by 98.96%; when the learning rate was 10... 5 At that time, information leakage decreased by 99.79% to only 0.08. Compared with SFNNS, the best among the comparison schemes, it still has an advantage of 0.12, and is significantly better than FNNS and SteganoGAN-D schemes.
[0185] This demonstrates that direct leakage loss can effectively reduce direct information leakage by improving image quality, and can adjust its own learning rate to adapt its ability to resist attackers.
[0186] Simulation Experiment 5
[0187] For example, to evaluate the degree of indirect information leakage of the encryption method provided by the present invention, simulation experiment 5 generated two sets of ciphertext images. One set used the loss function of formula (1.8) mentioned above, which includes indirect leakage loss, while the other set used the loss function... for This excludes indirect leakage losses. The two sets of encrypted images are then input into various other DNNs, and the state differences between the different DNNs are recorded. Lower differences between the states of different DNNs indicate less indirect information leakage.
[0188] Specifically, simulation experiment 5 uses four common models: ResNet 50, DenseNet 121, EfficientNetV 2 and Inception V3 for comparison. Due to the different network architectures, the state is represented by the average value of neurons in each layer.
[0189] See Figure 13The state values of different neural networks with different loss functions are shown. Figure 13 In the diagram, (a), (b), (c), and (d) represent the state values of the ResNet 50, DenseNet 121, EfficientNetV 2, and Inception V3 models, respectively. Specifically, the horizontal axis represents the name of the network layer, the vertical axis represents the output value of the neurons in that layer, and the dashed line and the numbers above it represent the average value of all neurons in that network. Figure 13 It can be seen that by constraining the indirect leakage loss, the differences in neuron states caused by ciphertext images in different models can be significantly reduced, with the average difference in neuron states of the four networks reduced by 56.02%.
[0190] Simulation Experiment 6
[0191] For example, in simulation experiment 6, the trained neural networks in Table 3 below are divided into four categories: traditional CNN, multi-scale model, attention-based model, and shortcut-based model. Different types of models are used as the neural networks for encryption. It was found that the encryption method provided by this invention can successfully support all four groups of 18 models without affecting their original functionality.
[0192] Table 3 List of Supported Models
[0193]
[0194] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.
Claims
1. A general neural network symmetric encryption method, characterized in that, The method is applied at the sending end, and the method includes: The perturbation image is iteratively corrected until the state string matches the target string, thus obtaining the standard fused image; The target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image; Subtract the image key from the standard fused image to obtain the encrypted image; The encrypted image is sent to the receiving end so that the receiving end can recover the plaintext information based on the image key and the encrypted image using the neural network. Perform the first step on the perturbed image The round of iterative correction includes: The first The perturbation image is fused with the image key to obtain the first... A fused image, in which The value is a positive integer, and the 0th perturbation image is a random image; The first The fused image is input into the neural network to obtain the fused image of the neural network. One state; The first encoding of the neural network The state is obtained at the _th state. A status string; Determine the first Does the status string match the target string? If they are inconsistent, then according to the first... The difference between the current string and the target string determines the first [value] of the perturbation image. The loss, and according to the first The loss correction is described in the first... The perturbation image yields the first... A perturbation image; If they match, then the first... The fused image is used as the standard fused image, and the correction of the perturbation image is stopped.
2. The general neural network symmetric encryption method according to claim 1, characterized in that, The modified loss functions used to calculate the loss of a perturbed image include bit error loss, truncation loss, direct leakage loss, and indirect leakage loss; The bit error rate loss is used to measure the difference between the state string and the target string, the truncation loss is used to reduce the computational accuracy requirements of the correction process, the direct leakage loss is used to maintain the similarity between the perturbation image and the random image, and the indirect leakage loss is used to reduce the difference between the perturbation representation and the initial representation. The perturbation representation and the initial representation are the overall representations of the neural network after inputting the perturbation image and the random image, respectively.
3. The general neural network symmetric encryption method according to claim 2, characterized in that, The modified loss function satisfies the following formula: ， in, Indicates perturbation image The loss, For the plaintext information, For the bit error loss, For the first Disturbance image Cut-off loss, , These are the hyperparameters for the two control weights. , They represent With the random image Direct leakage losses and indirect leakage losses.
4. The general neural network symmetric encryption method according to claim 2, characterized in that, The bit error rate loss, the truncation loss, the direct leakage loss, and the indirect leakage loss each satisfy the following formula: ， ， ， ， in, For the bit error loss, This refers to the neural network. This indicates the state of the neural network. Describing the L2 norm, For the first A fused image; For the first Disturbance image Cut-off loss, This represents the operation of converting to an integer. This indicates an operation to convert to float32 format; , They represent With the random image Direct leakage losses and indirect leakage losses between them This indicates that the process is handled using the VGG model. This represents the overall representation of the neural network. , The inputs to the neural network are respectively , .
5. The general neural network symmetric encryption method according to claim 1, characterized in that, The first encoding of the neural network The state is obtained at the _th state. A status string, including: Based on the quantization threshold, the first step function is used to adjust the quantization threshold of the neural network. Binarize the nth state to obtain the nth state. A status string.
6. The general neural network symmetric encryption method according to claim 1, characterized in that, The state of the neural network is either the value of the coding neurons in the coding layer of the neural network after the fused image is input, or the average value of the neuron group in the coding layer of the neural network after the fused image is input, wherein the neuron group is composed of adjacent coding neurons.
7. A transmitter, characterized in that, It includes a disturbance correction module, a pre-processing module, and a first communication module; The perturbation correction module is used to iteratively correct the perturbation image until the state string matches the target string, thus obtaining a standard fused image. The target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image; The pre-processing module is used to subtract the image key from the standard fused image to obtain the encrypted image; The first communication module is used to send the ciphertext image to the receiving end, so that the receiving end can recover the plaintext information based on the neural network, according to the image key and the ciphertext image; Perform the first step on the perturbed image The round of iterative correction includes: The first The perturbation image is fused with the image key to obtain the first... A fused image, in which The value is a positive integer, and the 0th perturbation image is a random image; The first The fused image is input into the neural network to obtain the fused image of the neural network. One state; The first encoding of the neural network The state is obtained at the _th state. A status string; Determine the first Does the status string match the target string? If they are inconsistent, then according to the first... The difference between the current string and the target string determines the first [value] of the perturbation image. The loss, and according to the first The loss correction is described in the first... The perturbation image yields the first... A perturbation image; If they match, then the first... The fused image is used as the standard fused image, and the correction of the perturbation image is stopped.
8. A receiving end, characterized in that, Includes a second communication module and a decryption module; The second communication module is used to receive a ciphertext image from the sending end, wherein the ciphertext image is obtained by the sending end from a standard fused image by subtracting an image key, the standard fused image is obtained by the sending end by iteratively correcting a perturbation image until the state string matches the target string, the target string is obtained by encoding plaintext information to be shared, the state string is obtained by encoding the state of a neural network, the state of the neural network is the output of a preset encoding layer in the neural network after inputting the fused image, and the fused image is obtained by fusing the image key and the perturbation image; The decryption module is used to recover the plaintext information based on the neural network, the image key, and the ciphertext image; Perform the first step on the perturbed image The round of iterative correction includes: The first The perturbation image is fused with the image key to obtain the first... A fused image, in which The value is a positive integer, and the 0th perturbation image is a random image; The first The fused image is input into the neural network to obtain the fused image of the neural network. One state; The first encoding of the neural network The state is obtained at the _th state. A status string; Determine the first Does the status string match the target string? If they are inconsistent, then according to the first... The difference between the current string and the target string determines the first [value] of the perturbation image. The loss, and according to the first The loss correction is described in the first... The perturbation image yields the first... A perturbation image; If they match, then the first... The fused image is used as the standard fused image, and the correction of the perturbation image is stopped.
9. The receiving end according to claim 8, characterized in that, The decryption module is specifically used for: The image key and the ciphertext image are superimposed to obtain the standard fused image; The standard fused image is input into the neural network to obtain the encryption state of the neural network; The plaintext information is obtained by encoding the encryption state of the neural network.