A method and system for data-free robust model theft attack on dual-clone networks

Abstract

This invention provides a method and system for data-free robust model theft attacks using dual-clone networks, belonging to the field of artificial intelligence security and model robustness evaluation technology. The method, under the condition of only accessing the black-box hard-label interface of the target model and lacking real training data, first obtains interface constraints and initializes the dual-clone network, sample generator, and sample pool. Then, the dual-clone network calculates uncertainty indices for candidate samples generated by the generator and dynamically selects the master model to guide sample generation. The generated samples are queried against the target model to obtain hard labels and added to the pool. Next, training samples are obtained through a two-stage active learning process using both the generation pool and the query pool. Finally, high-information samples are constructed based on adversarial perturbations and hard labels are queried, jointly training the dual-clone model so that the clone models simultaneously approximate the predictive behavior and robustness characteristics of the target model. This invention can improve sample utilization efficiency and enhance the stability of robust feature transfer when query budgets are limited.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and model robustness assessment technology, and in particular to a method and system for attacking a dual-clone network without data robustness model theft. Background Technology

[0002] Currently, various deep learning models have been deployed at scale in scenarios such as image recognition, recommendation retrieval, and content moderation. Most models provide their capabilities externally through cloud inference interfaces (such as online prediction APIs) or edge inference services, and external callers can typically only interact with them through a black box of input and output. Under this service model, model theft attacks can collect the target model's responses through continuous, regular query operations, and then train alternative models to replicate the target model's functionality and performance. This can be used to bypass payment and access controls, replicate core capabilities for subsequent migration attacks, or for security assessments and red team testing to measure the vulnerability of model services. Meanwhile, given the increasing prominence of adversarial examples, noise perturbations, and security compliance requirements, existing production models have generally undergone robustness enhancements or protection hardening. This leads attackers (or evaluators) to focus not only on prediction accuracy when replicating models, but also on whether they can simultaneously obtain the robustness features of the target model, thus creating a real need for robust theft. Current methods for stealing double-clone models typically utilize two alternative models to assist each other during sample generation and training. Under the limited conditions of lacking real natural data and only being able to obtain hard-labeled outputs, the combined use of synthetic and query samples, as well as the selection and reuse of more informative samples, can improve the accuracy of the alternative models in approximating the target model and the robustness of their inheritance to a certain extent.

[0003] However, existing methods for stealing data using dual-clone models still have the following three problems: (1) The current scheme overemphasizes the difference in output between the two clones to drive exploration, but lacks collaborative constraints that are consistent with the goal. This can easily lead to inconsistent behavior between the two clones and cause instability in robust alignment, making it impossible to steal the robustness of the target model. (2) The lack of adaptive coordination and dynamic adjustment mechanism with the training stage makes it difficult to form a closed loop between sample generation, sample selection and robust optimization, resulting in the learning process being insensitive to changes in the stage state and having poor ability to capture timely information. (3) When query costs are limited, sample efficiency and distribution coverage are still insufficient, which can easily lead to problems such as redundant queries, sample quality fluctuations and forgetting. This makes it difficult to maintain both accuracy and robustness in model theft under a limited budget. Therefore, further improvements are needed to the model theft attack methods. Summary of the Invention

[0004] In view of this, the present invention provides a method and system for robust model theft attack without data in dual-clone networks, so as to achieve robust model theft of dual-clone models.

[0005] The technical solution adopted in this invention is: This invention provides a method for attacking a dual-clone network without data robustness model theft, comprising: S10. Obtain the black-box query interface constraint information of the target model, and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool; under the condition of no real data, dynamically select one of the clone models as the main model based on the maximum loss generated by the first clone model and the second clone model respectively; use the main model to guide the sample generator to generate candidate samples, and add the candidate samples to the generation pool. S20. Based on the dual sample pool consisting of the generation pool and the query pool, the samples in the dual sample pool are filtered to obtain a high-information sample set. S30. Construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. S40. Use the samples in the query pool to train and update the first clone model and the second clone model. After training, update the generation pool and the query pool, and iterate from step S10 to step S40 until the preset stopping condition is met, and output the trained clone model.

[0006] Furthermore, in step S10, under the condition of no real data, one of the clone models is dynamically selected as the main model based on the maximum classification loss generated by the first clone model and the second clone model, including: In the absence of real data, the sample generator generates candidate samples based on latent variables obtained by sampling from prior distributions; In each round of sample generation iteration, after generating candidate samples, the classification loss of the first clone model and the second clone model for the same candidate sample under pseudo-label supervision is calculated respectively. Select the larger of the two classification losses as the adversarial term; The master model for the current iteration is dynamically selected from the first and second clone models based on the adversarial terms. The master model is used to provide gradient signals in the generator parameter update of the current round and guide the candidate sample generation process of the sample generator in the next round after the generator parameter update.

[0007] Further, in step S10, the main model is used to guide the sample generator to generate candidate samples, and the candidate samples are added to the generation pool, including: Based on the gradient signal output by the main model, define the category alignment coefficient and the diversity term; Construct the collaborative optimization objective loss of the sample generator based on the category alignment coefficient and diversity term; After determining the main model, the generator parameters are updated by gradient to increase the co-optimization objective loss, so that the sample generator can produce candidate samples that meet the information requirements in the next round.

[0008] Furthermore, in step S20, based on a dual sample pool consisting of a generation pool and a query pool, samples in the dual sample pool are filtered to obtain a high-information sample set, including: First, candidate samples are extracted from the generation pool, and the maximum class probability of the candidate samples is calculated based on the main model. Candidate samples that exceed the preset confidence threshold are then selected based on the maximum class probability of the candidate samples. For candidate samples selected through confidence level screening, the information entropy of the predicted distribution of candidate samples is calculated based on the master model, and candidate samples with information entropy values ​​ranking higher than a preset rank are selected as high-information samples for training, thus obtaining a high-information sample set.

[0009] Furthermore, in step S30, high-entropy adversarial perturbation samples are constructed based on a high-information sample set, and then hard labels are obtained by querying the target model based on the high-entropy adversarial perturbation samples, including: Using the selected samples as initial samples, and taking the prediction information entropy of the main model as the optimization objective, the initial samples are perturbed through multiple iterations. In each iteration, the gradient of the information entropy of the main model on the current sample prediction distribution with respect to the sample input is calculated, and a perturbation is added along the sign direction of the gradient to generate a new sample; When the number of iterations reaches the preset upper limit or the entropy gain meets the convergence condition, the final generated sample is determined as a high-entropy anti-perturbation sample. For high-entropy adversarial perturbation samples, the target model is invoked to perform black-box queries to obtain the corresponding hard labels.

[0010] Further, in step S40, the first clone model and the second clone model are trained and updated using samples from the query pool. After training, the generation pool and the query pool are updated, and steps S10 to S40 are iteratively executed until a preset stopping condition is met, outputting the trained clone model, including: For any clone model, the high-entropy adversarial perturbation samples and their corresponding hard labels stored in the query pool are used as supervision signals to calculate the cross-entropy loss of the clone model, and the model parameters of the corresponding clone model are updated according to the cross-entropy loss, so that the clone model can simultaneously approximate the prediction behavior of the target model and inherit the robust boundary features characterized by the high-entropy adversarial perturbation samples. After training is completed, the attacking end updates the sample records in the generation pool and query pool and enters the next round of candidate sample generation and screening; when the preset stopping condition is reached, the iteration terminates and the first clone model and the second clone model that have been trained are output.

[0011] Furthermore, the interface constraint information in S10 includes: the input domain constraints of the target model, the single-round query budget, and the output constraints of the target model returning hard labels.

[0012] Based on the aforementioned method for attacking a dual-clone network without data robustness to model theft, this invention also provides a system for attacking a dual-clone network without data robustness to model theft, the system comprising: The model initialization module is used to obtain the black-box query interface constraint information of the target model and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool. Under the condition of no real data, based on the maximum loss generated by the first clone model and the second clone model, one of the clone models is dynamically selected as the main model. The main model is used to guide the sample generator to generate candidate samples and add the candidate samples to the generation pool. The sample filtering module is used to filter samples in the dual sample pool, which consists of a generation pool and a query pool, to obtain a high-information sample set. The tag query module is used to construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. The model training module is used to train and update the first clone model and the second clone model using samples in the query pool. After training, it updates the generation pool and the query pool, and iteratively executes steps S10 to S40 until the preset stopping condition is met, and outputs the trained clone model.

[0013] In summary, the beneficial effects of the present invention are as follows: (1) The method first selects the main model dynamically through maximum loss, and combines the optimization mechanism of adversarial term and diversity term to improve the information content and category coverage of candidate samples under the constraints of no real data and hard label return, thereby reducing the differences between models and thus achieving robust model theft attack.

[0014] (2) By using a dual-pool design of generation pool and query pool and a two-stage active learning strategy of confidence screening and entropy priority selection, high-value samples are prioritized and redundant queries are reduced under the condition of limited query budget.

[0015] (3) By constructing high-entropy adversarial perturbation samples and incorporating them into training, the dual-clone model can gradually approach the robust decision boundary of the target model under the condition of only obtaining hard label supervision, thus realizing the joint transfer of accuracy behavior and robustness behavior. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, and these are all within the protection scope of the present invention.

[0017] Figure 1 This is a flowchart of a method for attacking a dual-clone network without data robustness model stealing, as per the present invention. Figure 2 This is a schematic diagram illustrating the principle of a data-insensitive robustness model theft attack in a dual-clone network according to the present invention. Figure 3 This is a schematic diagram illustrating the collaborative sample generation and dynamic selection of the master model in this invention; Figure 4 This is a schematic diagram of the dual sample pool and two-stage active learning screening mechanism of the present invention; Figure 5 This is a functional block diagram of a dual-clone network data-insensitive robustness model theft attack system according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Unless otherwise specified, the present invention and the various features in the embodiments can be combined with each other, all of which are within the protection scope of the present invention.

[0019] First, the terms used in the following embodiments will be explained, specifically: Target Model A black-box model deployed in the evaluation environment provides a query interface and returns hard-labeled outputs to provide supervision signals for the cloned model. First Cloning Model Second cloning model Alternative models trained by the attacker in the absence of real data are used to approximate the target model. Predictive behavior and its robust decision boundary; Sample generator In latent variables With pseudo-tags Candidate samples are generated under the drive. A generative network is used to synthesize inputs that can be used for black-box queries; Generation pool Used to store data generated by the generator. Generate and pass through the target model The query obtains a set of hard-labeled samples, providing a data source for subsequent screening and training; Query pool Used to store data generated by the high-entropy adversarial perturbation process and processed by the target model. The query retrieves a set of hard-labeled samples, which are used to feed back highly informative samples near the boundary to the training phase. Uncertainty Indicators / Information Entropy Entropy is used to measure how close a sample is to the decision boundary; samples with higher entropy values ​​typically represent stronger uncertainty. Input domain constraints Target Model Input space constraints, such as input dimension, value range, or normalization constraints, are used to limit the legality of generated samples and perturbation samples. Budget B: The attacking end can invoke the target model within a preset period / round. The upper limit on the number of times an interface can be used to constrain the query overhead of the sample generation and filtering process.

[0020] Example 1: Refer to Figure 1 and Figure 2 As shown in the figure, an embodiment of the present invention provides a method for attacking a dual-clone network without data robustness by stealing models, comprising: S10. Obtain the black-box query interface constraint information of the target model, and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool; under the condition of no real data, dynamically select one of the clone models as the main model based on the maximum loss generated by the first clone model and the second clone model respectively; use the main model to guide the sample generator to generate candidate samples, and add the candidate samples to the generation pool. S20. Based on the dual sample pool consisting of the generation pool and the query pool, the samples in the dual sample pool are filtered to obtain a high-information sample set. S30. Construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. S40. Use the samples in the query pool to train and update the first clone model and the second clone model. After training, update the generation pool and the query pool, and iterate from step S10 to step S40 until the preset stopping condition is met, and output the trained clone model.

[0021] In this embodiment, the interface constraint information obtained in S10 includes: the input domain constraints of the target model, the single-round query budget, and the output constraints of the target model returning hard labels. The initialization and constraint configuration process in S10 specifically includes: Obtain the target model Black-box query interface, input field constraints The single-round query budget B and the output constraints with hard labels returned are used to initialize the first clone model. Second cloning model Sample generator And establish generation pools respectively. With query pool The generation pool The query pool is used to store samples and their hard labels obtained through queries to the target model. Used to store the high-entropy adversarial enhancement samples generated in step S30 and their hard labels.

[0022] As a further refinement of the present invention, in S10, under the condition of no real data, one of the clone models is dynamically selected as the main model based on the maximum classification loss generated by the first clone model and the second clone model, including: Sample generator in the absence of real data Latent variables obtained from prior distribution sampling Generate candidate samples It is represented as: ; in, Represents the candidate samples generated in the i-th round; This represents a latent variable obtained by sampling from a prior distribution; Indicates pseudo-labels associated with candidate samples; Indicates sample generator The parameters are specified. This formula is used to synthesize input samples that can be used for black-box queries when no real data is available.

[0023] In each round of sample generation iteration, after generating candidate samples, the classification loss of the first clone model and the second clone model for the same candidate sample under pseudo-label supervision is calculated respectively.

[0024] The classification loss is specifically the cross-entropy loss, which is expressed as follows: ; in, , Let represent the first clone model and the second clone model before the i-th round of generation (the (i-1)th round), respectively; Represents cross-entropy loss; , These represent the first and second clone models for the same candidate sample, respectively. Classification loss.

[0025] The larger of the two classification losses is selected as the adversarial term, and the specific selection rule is shown in the following formula: ; Where m∈{1,2} represents the main model number selected in the current round; Reference Figure 3 Main model This is used to provide gradient signals in the current generator parameter update and guide the generation of candidate samples in the next round after the update, thereby achieving complementary exploration and stabilizing the generation direction between the two clones.

[0026] The master model for the current iteration is dynamically selected from the first and second clone models based on the adversarial terms. The master model is used to provide gradient signals in the generator parameter update of the current round and guide the candidate sample generation process of the sample generator in the next round after the generator parameter update.

[0027] As a further refinement of the present invention, S10 utilizes the main model to guide the sample generator to generate candidate samples and adds the candidate samples to the generation pool, including: To suppress mode collapse and improve the coverage of generated samples in the category dimension, a category alignment coefficient and a diversity term are defined based on the gradient signal output by the main model, specifically expressed as follows: ; Where T represents the number of samples generated in the current batch; This represents the t-th candidate sample within the batch; This represents the average response intensity within a batch to class j, expressed as... The calculated value serves as the category alignment coefficient; category The average predicted probability over T samples; The entropy value represents the distribution of categories within a batch, and is used as a diversity term to measure the category diversity of the generated samples.

[0028] The co-optimization objective loss of the sample generator is constructed based on the class alignment coefficient and the diversity term. Collaborative optimization of target loss Specifically, it is expressed as follows: ; in, This is a balancing coefficient used to adjust the weights of the adversarial and diversity terms.

[0029] After determining the main model, the generator parameters are updated using gradients to increase the co-optimization objective loss, enabling the sample generator to produce candidate samples that meet the information content requirements in the next round. The information content requirement refers to candidate samples that are both highly informative and more evenly distributed. After the candidate samples are generated, they are added to the generation pool. This provides a data foundation for subsequent screening and training.

[0030] See Figure 4 In some embodiments, the screening process can be divided into two stages: the first stage, during the first half of training, mainly involves selecting from the generation pool. In the first stage, candidate samples are extracted; in the second stage, during the latter half of the training process, samples are drawn from the generation pool according to a preset ratio. With query pool Candidate samples are extracted by mixing samples to introduce feedback information from adversarial enhancement samples.

[0031] Therefore, as a further refinement of the present invention, in S20, based on a dual sample pool consisting of a generation pool and a query pool, samples in the dual sample pool are filtered to obtain a high-information sample set, including: To avoid introducing noise from extremely low-confidence samples, candidate samples are first extracted from the generation pool, and the maximum class probability of the candidate samples is calculated based on the main model. Candidate samples exceeding a preset confidence threshold are then selected based on their maximum class probability. The confidence screening process is shown in the following formula: ; in, Indicates the primary clone model participating in the screening; This is the probability normalization function; To pre-set the reliability threshold; This indicates taking the highest class probability. This method can be used to remove samples with insufficient prediction confidence under the master clone model.

[0032] For candidate samples selected through confidence level screening, the information entropy of the predicted distribution of candidate samples is calculated based on the master model, and candidate samples with information entropy values ​​ranking higher than a preset rank are selected as high-information samples for training, thus obtaining a high-information sample set.

[0033] The calculation process for information entropy is shown in the following formula: ; in, Indicates sample Predicted entropy; Indicates sample Predicted as the first The probability of a class. This method is used to characterize the high uncertainty of samples when they are close to the decision boundary, and based on this, selects the samples with the highest entropy values ​​from the candidate samples to form a training sample set (i.e., a high-information sample set).

[0034] As a further refinement of the present invention, S30 involves constructing high-entropy adversarial perturbation samples based on a high-information-content sample set, and then obtaining hard labels by querying the target model based on the high-entropy adversarial perturbation samples, including: Using the selected samples as initial samples, and taking the prediction information entropy of the main model as the optimization objective, the initial samples are perturbed through multiple iterations. In each iteration, the gradient of the information entropy of the main model on the current sample prediction distribution with respect to the sample input is calculated, and a perturbation is added along the sign direction of the gradient to generate a new sample; When the number of iterations reaches the preset upper limit or the entropy gain meets the convergence condition, the final generated sample is determined as a high-entropy anti-perturbation sample. For high-entropy adversarial perturbation samples, call the target model. Perform a black-box query to obtain the corresponding hard tag. The query process can be specifically represented as: ; in, This represents the target model; this equation is used to determine high-entropy adversarial samples. From the target model Return the hard label, and Add to query pool .

[0035] Specifically, in this embodiment, to characterize the robust decision boundary of the target model under perturbation conditions, samples from the obtained high-information sample set are used as initial samples. Then, high-entropy adversarial perturbation samples (HEE) are constructed, and the target model is then queried. Obtain hard labels and store high-entropy adversarial perturbation samples and their hard labels in the query pool. In the middle. The main model The predicted entropy is the optimization object. High-entropy samples are obtained through iterative updates. The update calculation process can be represented by the following formula: ; in, This represents the intermediate result of the i-th sample in the h-th iteration; Indicates the step size of a single-step perturbation; This represents the gradient with respect to the input; Represents a symbolic function; Information entropy index; This is the current primary model. This formula allows for the generation of samples closer to the robust decision boundary, in the direction of increasing prediction entropy. This is to satisfy the input domain constraints. It can be adjusted after each iteration. Perform projection / pruning processing; when the preset number of iterations H or the entropy gain convergence condition is reached, output the latest high-entropy adversarial perturbation sample after iteration. .

[0036] As a further refinement of the present invention, in step S40, the first clone model and the second clone model are trained and updated using samples from the query pool. After training, the generation pool and the query pool are updated, and steps S10 to S40 are iteratively executed until a preset stopping condition is met, and the trained clone model is output, including: For any clone model, the high-entropy adversarial perturbation samples and their corresponding hard labels stored in the query pool are used as supervision signals to calculate the cross-entropy loss of the clone model. The model parameters of the corresponding clone model are updated according to the cross-entropy loss, so that the clone model can simultaneously approximate the prediction behavior of the target model and inherit the robust boundary features characterized by the high-entropy adversarial perturbation samples.

[0037] For any clone model Its training loss is defined as: ; Where k∈{1,2}; This represents the k-th clone model; Represents cross-entropy loss; For the target model The returned hard tag.

[0038] After training is complete, the attacker updates the generation pool. With query pool The system records the samples and proceeds to the next round of candidate sample generation and selection; the iteration terminates when the preset stopping condition is met, and the first cloned model that has been trained is output. Second cloning model Ultimately, both the first and second cloned models successfully stole the robustness and accuracy of the target model.

[0039] Furthermore, this embodiment also provides experimental verification of the above technical solution. Through performance experiments and ablation experiments, the effectiveness and feasibility of the data-free robust model theft attack method based on cooperative optimization of dual-clone networks are verified.

[0040] Specifically, the experimental results are shown in Table 1. This embodiment was tested on the industry-standard datasets CIFAR10 and CIFAR100. The results show that the performance of the collaboratively optimized dual-clone network robust model theft attack method (DNCO) in this embodiment is superior to other baseline models. Under various adversarial attacks, such as FGSM, PGD-20, PGD-100, and CW-100, the robustness and integrity of the target model stolen are still higher than those of models such as DFHL-RS, Data-Free UE, and Data-Free AT.

[0041] Table 1 Performance Comparison of Model Stealing Attack Methods ; Regarding versatility, as shown in Table 2, the method employed in this embodiment demonstrates significant effectiveness on target models using various base models. Even when the adversarial training strategy of the target model changes, the method used in this embodiment still functions correctly, demonstrating strong versatility.

[0042] Table 2. Generality Comparison Table ; Example 2: Refer to Figure 5 As shown, based on Embodiment 1 above, this embodiment also provides a dual-clone network data-unrobust model theft attack system, the system comprising: The model initialization module is used to obtain the black-box query interface constraint information of the target model and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool. Under the condition of no real data, based on the maximum loss generated by the first clone model and the second clone model, one of the clone models is dynamically selected as the main model. The main model is used to guide the sample generator to generate candidate samples and add the candidate samples to the generation pool. The sample filtering module is used to filter samples in the dual sample pool, which consists of a generation pool and a query pool, to obtain a high-information sample set. The tag query module is used to construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. The model training module is used to train and update the first clone model and the second clone model using samples in the query pool. After training, it updates the generation pool and the query pool, and iteratively executes steps S10 to S40 until the preset stopping condition is met, and outputs the trained clone model.

[0043] Specifically, this system has the following advantages: Robust synchronous stealing capability: Through a collaborative mechanism of dynamic selection of the maximum loss master model and construction of high-entropy adversarial perturbation samples, the system enables two clone models to continuously approach the response boundary of the target model to perturbation inputs during training. The final output clone model not only achieves classification accuracy close to the target model, but also significantly transfers robustness to various adversarial attacks (such as FGSM, PGD, etc.), realizing a dual stealing of accuracy and robustness.

[0044] Extremely high query efficiency and sample utilization: A dual-sample pool (generation pool + query pool) combined with two-stage active learning filtering ensures that each round of querying prioritizes samples located near the decision boundary with the highest information entropy. Confidence filtering eliminates redundant and low-value samples, while entropy-based ranking focuses on the most informative regions.

[0045] Stable generation under no-data conditions: The system optimizes the generator by combining a dual-clone loss adversarial term and a category diversity term, avoiding the pattern collapse problem common in traditional generative stealing methods. The dynamic rotation mechanism of the main model provides complementary gradient signals for the generation process, ensuring a balanced distribution of generated candidate samples across categories.

[0046] Strong generalization and black-box adaptability: The entire system relies solely on the hard-labeled output of the target model, requiring no probability confidence or internal gradient information, nor any real samples or auxiliary datasets. Therefore, this system is applicable to various mainstream image classification models (such as ResNet, VGG, DenseNet, etc.), as well as robust models that employ adversarial training and other hardening strategies, making it widely deployable.

[0047] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for attacking a dual-clone network without data robustness model theft, characterized in that, include: S10. Obtain the black-box query interface constraint information of the target model, and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool. Without real data, one of the clone models is dynamically selected as the master model based on the maximum classification loss generated by the first clone model and the second clone model. The master model is then used to guide the sample generator to generate candidate samples, which are then added to the generation pool. S20. Based on the dual sample pool consisting of the generation pool and the query pool, the samples in the dual sample pool are filtered to obtain a high-information sample set. S30. Construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. S40. Use the samples in the query pool to train and update the first clone model and the second clone model. After training, update the generation pool and the query pool, and iterate from step S10 to step S40 until the preset stopping condition is met, and output the trained clone model.

2. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, In step S10, under the condition of no real data, one of the clone models is dynamically selected as the main model based on the maximum classification loss generated by the first clone model and the second clone model, including: In the absence of real data, the sample generator generates candidate samples based on latent variables obtained by sampling from prior distributions; In each round of sample generation iteration, after generating candidate samples, the classification loss of the first clone model and the second clone model for the same candidate sample under pseudo-label supervision is calculated respectively. Select the larger of the two classification losses as the adversarial term; The master model for the current iteration is dynamically selected from the first and second clone models based on the adversarial terms. The master model is used to provide gradient signals in the generator parameter update of the current round and guide the candidate sample generation process of the sample generator in the next round after the generator parameter update.

3. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, In step S10, the main model is used to guide the sample generator to generate candidate samples, and the candidate samples are added to the generation pool, including: Based on the gradient signal output by the main model, define the category alignment coefficient and the diversity term; Construct the collaborative optimization objective loss of the sample generator based on the category alignment coefficient and diversity term; After determining the main model, the generator parameters are updated by gradient to increase the co-optimization objective loss, so that the sample generator can produce candidate samples that meet the information requirements in the next round.

4. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, In step S20, based on a dual sample pool consisting of a generation pool and a query pool, samples in the dual sample pool are filtered to obtain a high-information sample set, including: First, candidate samples are extracted from the generation pool, and the maximum class probability of the candidate samples is calculated based on the main model. Candidate samples that exceed the preset confidence threshold are then selected based on the maximum class probability of the candidate samples. For candidate samples selected through confidence level screening, the information entropy of the predicted distribution of candidate samples is calculated based on the master model, and candidate samples with information entropy values ​​ranking higher than a preset rank are selected as high-information samples for training, thus obtaining a high-information sample set.

5. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, In step S30, high-entropy adversarial perturbation samples are constructed based on a high-information sample set, and then hard labels are obtained by querying the target model based on the high-entropy adversarial perturbation samples, including: Using the selected samples as initial samples, and taking the prediction information entropy of the main model as the optimization objective, the initial samples are perturbed through multiple iterations. In each iteration, the gradient of the information entropy of the main model on the current sample prediction distribution with respect to the sample input is calculated, and a perturbation is added along the sign direction of the gradient to generate a new sample; When the number of iterations reaches the preset upper limit or the entropy gain meets the convergence condition, the final generated sample is determined as a high-entropy anti-perturbation sample. For high-entropy adversarial perturbation samples, the target model is invoked to perform black-box queries to obtain the corresponding hard labels.

6. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, In step S40, the first clone model and the second clone model are trained and updated using samples from the query pool. After training, the generation pool and the query pool are updated, and steps S10 to S40 are iteratively executed until a preset stopping condition is met, outputting the trained clone model, including: For any clone model, the high-entropy adversarial perturbation samples and their corresponding hard labels stored in the query pool are used as supervision signals to calculate the cross-entropy loss of the clone model, and the model parameters of the corresponding clone model are updated according to the cross-entropy loss, so that the clone model can simultaneously approximate the prediction behavior of the target model and inherit the robust boundary features characterized by the high-entropy adversarial perturbation samples. After training is completed, the attacking end updates the sample records in the generation pool and query pool and enters the next round of candidate sample generation and screening; when the preset stopping condition is reached, the iteration terminates and the first clone model and the second clone model that have been trained are output.

7. The method for attacking a dual-clone network without data robustness model theft according to claim 1, characterized in that, The interface constraint information in S10 includes: the input domain constraints of the target model, the single-round query budget, and the output constraints of the target model returning hard labels.

8. A system for attacking a dual-clone network without data robustness model theft, implemented according to any one of claims 1 to 7, characterized in that, include: The model initialization module is used to obtain the black-box query interface constraint information of the target model and initialize the first clone model, the second clone model, the sample generator, the generation pool, and the query pool. Without real data, one of the clone models is dynamically selected as the master model based on the maximum classification loss generated by the first clone model and the second clone model. The master model is then used to guide the sample generator to generate candidate samples, which are then added to the generation pool. The sample filtering module is used to filter samples in the dual sample pool, which consists of a generation pool and a query pool, to obtain a high-information sample set. The tag query module is used to construct high-entropy adversarial perturbation samples based on high-information sample sets, then query the target model based on the high-entropy adversarial perturbation samples to obtain hard labels, and add the high-entropy adversarial perturbation samples and their corresponding hard labels to the query pool. The model training module is used to train and update the first clone model and the second clone model using samples in the query pool. After training, it updates the generation pool and the query pool, and iteratively executes steps S10 to S40 until the preset stopping condition is met, and outputs the trained clone model.

Images