Deep neural network defense method based on color space transformation

Abstract

The application discloses a kind of based on color space conversion deep neural network defense method, it is related to artificial intelligence security technical field.The present application is in view of the problem that existing defense method is difficult to effectively resist color space attack, propose to be converted into gray image to remove potential color space deviation information to the inference image, then utilize pre-trained color network to recolor gray image, restore the original color of image.Color network uses DDColor, extracts semantic features by UNet, generates color image by image decoding, color decoding and feature fusion.The present application can eliminate color space disturbance while better restoring image semantic information, effectively resist color space attack under the premise of not significantly reducing model normal classification accuracy, guarantee the security of deep neural network in real application scenario.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security technology, specifically to a defense technology against adversarial attacks on deep neural networks. Background Technology

[0002] With the widespread application of deep neural networks in key areas such as image recognition, autonomous driving, and security monitoring, their security issues have received increasing attention. Malicious attacks on these models, especially adversarial attacks and backdoor attacks, have become a major challenge threatening the reliability of artificial intelligence systems.

[0003] Existing adversarial attack methods, such as Lp-norm-based pixel-constraint perturbation attacks, essentially add minute perturbations imperceptible to the human eye to the pixel space of an image to mislead the model into misclassification. However, the adversarial examples generated by these methods often exhibit significantly reduced robustness against image preprocessing defenses, such as image compression and filtering. Similarly, traditional backdoor attacks typically induce the model to learn hidden backdoor behaviors by implanting samples with specific pixel patterns (triggers) into the training data. These triggers are also easily disrupted or removed during data preprocessing.

[0004] These traditional attack methods are primarily designed within the pixel space, and their perturbation patterns are weakly correlated with the semantic content of the image. Therefore, they are highly sensitive to robust modifications to the model and preprocessing operations. This significantly reduces the threat posed by existing attack methods in practically deployed systems with multi-level defense mechanisms.

[0005] In response to the aforementioned attacks, the current mainstream defense strategies are mainly divided into two categories: adversarial training and input preprocessing.

[0006] Adversarial training enhances the robustness of a model by introducing adversarial examples during training, but this method is computationally expensive and may lead to a decrease in the model's classification accuracy on clean samples.

[0007] Input preprocessing defenses aim to cleanse the input and remove potential perturbations or triggers. However, these preprocessing methods are mostly designed for anomalies in the pixel space, and their effectiveness in defending against attack patterns that exist in other feature spaces (such as color space and frequency domain space) is still unclear, and there may be blind spots in protection.

[0008] In recent years, researchers have discovered that shifting attacks from the traditional pixel space to the color space can effectively circumvent existing pixel-perturbation-based defenses. Color space attacks construct backdoor triggers or adversarial perturbations by applying a uniform color shift to an image. These perturbations are covert and robust to common image preprocessing techniques. For example, Color Space Backdoor Attack (CSBA) uses a uniform color shift unrelated to image content as a trigger, which can be arbitrarily activated during the model inference stage; Color Space Adversarial Attack (CSAA) generates image-specific color perturbations for individual images, inducing the model to misclassify. However, existing defense methods are mainly designed for pixel-space anomalies and lack effective detection and suppression mechanisms for color space attacks. Therefore, there is an urgent need to design defense strategies specifically for color space attacks to ensure the security of deep neural networks in real-world applications. Summary of the Invention

[0009] The technical problem this invention aims to solve is that existing defense methods primarily target pixel-space perturbations, lacking effective defenses against backdoor attacks and adversarial attacks constructed through color space transformations. These attacks, by applying a uniform color shift to an image, can induce misclassification in deep neural networks. Their perturbation is covert and highly robust to common image preprocessing methods, making them difficult for existing defense mechanisms to address. This invention aims to explore the vulnerability of deep neural networks at the color space level and, based on this, provide a defense method specifically targeting color space attacks to improve the security of deep learning models in real-world applications.

[0010] The technical solution adopted by this invention to solve the above-mentioned technical problems is a deep neural network defense method based on color space transformation, comprising the following steps:

[0011] The image to be inferred is converted to a grayscale image to remove potential color space offset information in the image;

[0012] The grayscale image is recolored using a pre-trained coloring network to restore the original colors of the image.

[0013] The shading network is the DDColor shading network, and its shading process includes:

[0014] The UNet backbone network is used as an image encoder to extract semantic feature information from grayscale images;

[0015] The spatial resolution of the image is restored by performing feature map upsampling operations through the image decoder.

[0016] An adaptive color query operation is performed using a color decoder to obtain semantically aware color embeddings;

[0017] The grayscale image and the semantically aware color embedding are processed by the feature fusion module to generate a color image.

[0018] Furthermore, during the model training phase, random color space transformations are applied to the training images to enhance the model's robustness to color changes.

[0019] Furthermore, during the model inference phase, tiny random color perturbations are added to the input image to disrupt the color shift patterns constructed by the attacker.

[0020] Furthermore, this also includes reducing the color quantization precision of the image, so that the color offset is overwhelmed by the quantization error.

[0021] Furthermore, this includes using particle swarm optimization (PSO) to search for the optimal color space offset, which is then used to generate adversarial examples or backdoor triggering samples to verify the effectiveness of the defense method. Specifically, adversarial examples are generated using CSAA (Conflict of Interest Algorithm), and backdoor triggering samples are generated using CSBA (Conflict of Interest Algorithm).

[0022] Specifically, the color space offset applies a uniform color space offset to all pixels of the image.

[0023] Specifically, the objective function of the particle swarm optimization algorithm is: O = E − P;

[0024] Where E is the attack effectiveness function, P is the total penalty term based on image similarity measurement; the objective function is used to search for the optimal adversarial perturbation or the optimal backdoor trigger.

[0025] Specifically, in the particle swarm optimization process, the following criteria are followed to determine the quality of particles: when both particles satisfy the naturalness constraint, the one with the larger objective function value is better; when both particles violate the naturalness constraint, the one with the smaller penalty term is better; when one particle satisfies the naturalness constraint while the other does not, the one that satisfies the constraint is better.

[0026] The applicant discovered the sensitivity of deep neural networks to uniform color shifts and anticipated color space perturbation generation methods (including CSBA and CSAA) capable of simulating more covert and robust attack vectors at the color feature level. This exposed and evaluated the security vulnerabilities of deep neural networks in feature dimensions beyond pixel space, thus providing a clear objective and reliable verification method for designing and developing next-generation adaptive defense strategies. Optimization of the perturbations using a particle swarm optimization algorithm ensures the effectiveness and realism of the evaluation tool in simulating real threats. This invention proposes an adaptive defense framework encompassing color space data augmentation, random color shifting, color depth reduction, and image grayscale to recoloring strategies. Based on the common foundation of color space, a complete technical chain from attack generation to defensive response is constructed.

[0027] The beneficial effect of this invention is that it can effectively restore the semantic information of the image while eliminating potential color perturbations, thereby effectively resisting color space attacks without significantly reducing the normal classification accuracy of the model, achieving both precision and practicality in defense. Detailed Implementation

[0028] This invention addresses the defense requirements against color space attacks by first constructing a color space attack method as the verification basis for the defense target, and then proposing a corresponding adaptive defense strategy.

[0029] Based on the shape preference characteristics discovered in the human cognitive system—humans tend to classify objects primarily based on shape rather than color—and the ability of neural networks to learn broader information from images and discern information that is difficult for the human eye to detect, this invention anticipates the possibility of attacking deep neural networks using backdoor triggers in color space and adversarial perturbations.

[0030] Specifically, by applying a uniform color space shift to all pixels of the original image, a backdoor trigger image or an adversarial image can be generated. Among them, Color Space Backdoor Attack (CSBA) implants a backdoor into the target model and can be triggered by an image-independent color shift; Color Space Adversarial Attack (CSAA) applies an image-specific color shift to a specific image, inducing the model to make a classification error.

[0031] The attack scenarios are set as follows: In the CSBA scenario, the attacker acts as a provider of malicious datasets, injecting backdoor trigger samples into the training dataset and releasing them; in the CSAA scenario, the attacker knows nothing about the target model, but has the ability to query the model and obtain the prediction probability, and can construct adversarial examples by repeatedly querying.

[0032] I. Construction of Color Space Attacks

[0033] 1. Attack Scenario Setting

[0034] In the case of CSBA, suppose the attacker is a malicious provider of training datasets. They inject backdoor trigger samples (marked as backdoor target classes) into the training dataset and release the contaminated dataset to the public for download. Developers may obtain this dataset for model training, ultimately leading to the backdoor being secretly implanted into the model.

[0035] In a CSAA scenario, the attacker is assumed to know nothing about the target model but has the ability to query the target model and obtain the query results to predict classification probabilities. The attacker can construct and update adversarial examples by repeatedly querying the model.

[0036] 2. Definition of Color Space Offset

[0037] This invention employs a uniform color space offset as a backdoor trigger or to counteract disturbances. Let the image pixels be... 'n' represents the pixel index, and the subscripts 'r', 'g', and 'b' represent the red, green, and blue components in the RGB color space, respectively. The backdoor trigger is... Countering disturbances For CSAA, each pixel of the image is transformed by a to generate an adversarial image. For CSBA, each pixel of the image is transformed by b to generate the backdoor trigger image. The dimension is set to three, which corresponds to hue, saturation, and brightness in the HSV color space.

[0038] 3. Validity Function Design

[0039] 3-1. Color Space Adversarial Perturbation Validity Function: For adversarial attacks on color space, adversarial perturbations are image-specific; for a given image... We use This represents the generated adversarial image. We use... The probability of being correctly classified is used to quantify the effectiveness against perturbations. .

[0040] ;

[0041] in, Indicates the first Log-likelihood values ​​for each category (i.e., the model's output vector). yes The true label, It represents the total number of categories. The larger the value, the more effective the attack.

[0042] 3-2. Color Space Backdoor Trigger Validation Function

[0043] Backdoor trigger for specific colors We construct the corresponding poisoning dataset. and use Backdoor proxy model Perform a small number of training rounds. The training loss is calculated using samples triggered via a backdoor. To measure the effectiveness of CSBA .

[0044] ;

[0045] in, Represents the cross-entropy loss function. This indicates the backdoor trigger image. This indicates the category of CSBA attack targets. A smaller value indicates that the surrogate model has effectively learned the triggering features. This enhances the attack's effectiveness. To maintain consistency with the description of the effectiveness function (a larger E value indicates a stronger attack effect), we also adopt... As The representation of .

[0046] 3-3. Natural Constraints of Images

[0047] While large random color space shifts can enhance the effectiveness of CSAA and CSBA attacks, they may compromise the realism of adversarial generation and backdoor-triggered images. This invention employs three state-of-the-art similarity metrics: Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index (SSIM), and Learned Perceptual Patch Similarity (LPIPS) to measure the similarity between the original image and the adversarial (or backdoor-triggered) image, and defines corresponding penalty terms. j is the index of the penalty term, j=1,2,3:

[0048] ;

[0049] ;

[0050] ;

[0051] in, , and These represent the peak signal-to-noise ratio, structural similarity index, and learned perceptual image patch similarity between benign and adversarial samples, respectively. The peak signal-to-noise ratio (PSNR) is a constraint threshold used to determine whether the PSNR of the adversarial / backdoor image and the original image meet the naturalness requirement. The constraint threshold for structural similarity (SSIM) has the same effect as... ; The constraint threshold for perceptual similarity LPIPS is determined by the opposite logic of the previous two. The penalty term reflects the degree to which the constraints are violated; when the generated adversarial image is within the constraints, this term has a value of 0. Similarly, the penalty term for CSBA can be defined in the same way.

[0052] 3-4. Objective Function

[0053] To balance the measurement discrepancies among these similarity metrics, we normalized the penalty term and calculated the total penalty term as follows: :

[0054] ;

[0055] in, This represents the number of particles in the swarm (i.e., the number of candidate adversarial perturbations). Finally, the adversarial perturbation objective function can be expressed as:

[0056] .

[0057] Based on the above-mentioned natural wake-up constraint, this invention introduces the following judgment criteria:

[0058] When countering disturbances and When all satisfy the naturalness constraint, compare their respective objective function values. and Perturbations with larger objective function values ​​are considered superior. When dealing with adversarial perturbations... and When both violate natural constraints, compare their respective penalties. and Perturbations with smaller penalty terms are considered better. When the perturbation... Disturbance that satisfies natural constraints When not satisfied, It is considered superior.

[0059] The objective function form is applicable to both anti-disturbance and backdoor triggers. .

[0060] 5. Particle Swarm Optimization Algorithm

[0061] After defining the objective function of Particle Swarm Optimization (PSO), we can execute the PSO process to search for the optimal backdoor trigger and adversarial perturbation. The specific execution process is as follows:

[0062] (1) The PSO initialization step is used to generate an initial set of candidate perturbations to prepare for subsequent iterative search.

[0063] First, the number of particles is set to M, and each particle represents a candidate color space offset vector (i.e., an adversarial perturbation or backdoor trigger).

[0064] For each particle, where i is the example index (i = 1 to M), perform the following initialization operations:

[0065] (1-1) Randomly initialize the position of the particles , that is, the initial values ​​of the color space offset in each dimension;

[0066] (1-2) Randomly initialize the particle velocity Control the step size of the position change in each iteration;

[0067] (1-3) Calculate the objective function value of the particle. This function comprehensively measures the attack effectiveness and the constraints of image naturalness.

[0068] After completing the above initialization, record the individual optimal position of each particle. (Initially, this is the particle's own position), and the particle with the largest objective function value among all particles is selected as the global optimal position. .

[0069] (2) Iterative optimization stage

[0070] After initialization, the iterative optimization phase begins. The maximum number of iterations is set to T. In each iteration t, from t = 1 to T, the following operations are performed on each particle sequentially:

[0071] Velocity Update: Update the particle's velocity based on the current velocity, the individual's optimal position, and the global optimal position.

[0072] ;

[0073] in, Inertial weights are used to control the tendency of particles to maintain their original velocity. , Both are acceleration factors, which respectively adjust the intensity of particle movement towards the individual optimal and global optimal directions; , All numbers are random, increasing the randomness of the search; This indicates assignment.

[0074] Position Update: Adjust the particle position based on the updated velocity.

[0075] ;

[0076] Objective function calculation: Recalculate the objective function value of the particle at the new position. .

[0077] Individual optimal update: Compare the current particle's objective function value with its historical best value. If the current particle is better, update the particle's individual optimal position. , .

[0078] Global optimal update: Compare the current particle's objective function value with the global optimal value. If the current particle's objective function value is better than the global optimal value, then update the global optimal position. , .

[0079] Repeat the above iterative process until the preset maximum number of iterations T is reached.

[0080] (3) Output results

[0081] After the iteration is complete, return the globally optimal position. This refers to the optimal color space offset vector obtained through the search. This vector has the strongest attack effect while satisfying the image naturalness constraint, and can be directly used as the optimal adversarial perturbation (for CSAA) or the optimal backdoor trigger (for CSBA).

[0082] II. Adaptive Defense Strategies for Color Space Shift Attacks

[0083] 1. Overview of Defense Strategies

[0084] This invention addresses the characteristics of color space attacks by designing four defense strategies: color space data augmentation, random color space shift, color depth reduction, and image grayscale conversion and colorization processing.

[0085] Image grayscale conversion and color processing are the core defense strategies of this invention, which will be elaborated on below.

[0086] 2. Image grayscale conversion and colorization defense strategies

[0087] Since both the backdoor trigger image of CSBA and the adversarial image of CSAA are generated by color space shifting, this invention designs a defense strategy that converts all inference images into grayscale images and then recolors them using a pre-trained colorization network.

[0088] (1) Grayscale processing

[0089] Image grayscale conversion aims to disrupt potential color space backdoor triggers or adversarial perturbations in inference images. By converting a color image to grayscale, all color space offset information is removed, effectively blocking attack triggering conditions.

[0090] (2) Colored network recovery

[0091] Image recoloring aims to restore the original colors of an image while maintaining the accuracy of benign image recognition. This invention uses the state-of-the-art (SOTA) image colorization network DDColor to recolor grayscale images.

[0092] The DDColor coloring process is as follows:

[0093] (2-1) Feature extraction: The UNet backbone network is used as the image encoder to extract semantic feature information from grayscale images, including visual elements such as the shape and edges of the image.

[0094] (2-2) Image Decoding and Color Restoration: The spatial resolution of the image is restored by performing feature map upsampling operation through the image decoder; at the same time, the color decoder is integrated to obtain semantically perceptual color embedding through adaptive color query operation.

[0095] (2-3) Adaptive color embedding: The feature fusion module adjusts the multi-level features of the image to restore the color while ensuring the naturalness and accuracy of the image.

[0096] (2-4) Feature Fusion and Color Image Generation: The semantically perceptual color embedding obtained from the grayscale image and the color decoder is processed by the feature fusion module. Through the adjustment and fusion of multi-level features, a color image that restores natural colors is finally generated. This process eliminates color space disturbances while preserving the semantic integrity and visual realism of the image to the greatest extent.

[0097] Through the above process, DDColor can effectively recover the semantic information of the image while eliminating potential color perturbations, thus effectively resisting color space attacks without significantly reducing the normal classification accuracy of the model.

[0098] 3. Other defense strategies

[0099] In addition to image grayscale and colorization strategies, this invention also designs the following auxiliary defense strategies, which can be used alone or in combination with the core strategy:

[0100] (3-1) Color space data augmentation: During the training phase, random color space transformations (such as random hue shifts, saturation adjustments, etc.) are performed on the training images to enable the model to learn robustness to color changes, thereby reducing its sensitivity to specific color shifts.

[0101] (3-2) Random color space shift: During the inference stage, a small random color perturbation is added to the input image to disrupt the color shift pattern carefully constructed by the attacker, without affecting the classification results of normal images.

[0102] (3-3) Color depth reduction: By reducing the color quantization precision of the image (e.g., from 24-bit true color to 8-bit), the fine color offset is overwhelmed by the quantization error, thereby weakening the attack effect.

[0103] The above strategies can be flexibly combined according to the defense needs of actual application scenarios to achieve a balance between defense effectiveness and computational overhead.

Claims

1. A deep neural network defense method based on color space transformation, characterized in that, Includes the following steps: The image to be inferred is converted to a grayscale image to remove potential color space offset information in the image; The grayscale image is recolored using a pre-trained coloring network to restore the original colors of the image. The shading network is the DDColor shading network, and its shading process includes: The UNet backbone network is used as an image encoder to extract semantic feature information from grayscale images; The spatial resolution of the image is restored by performing feature map upsampling operations through the image decoder. An adaptive color query operation is performed using a color decoder to obtain semantically aware color embeddings; The grayscale image and the semantically aware color embedding are processed by the feature fusion module to generate a color image.

2. The method as described in claim 1, characterized in that, This also includes performing random color space transformations on the training images during the model training phase to enhance the model's robustness to color changes.

3. The method as described in claim 1, characterized in that, It also includes adding tiny, random color perturbations to the input image during the model inference phase to disrupt the color shift patterns constructed by the attacker.

4. The method as described in claim 1, characterized in that, This also includes reducing the color quantization precision of the image, so that the color offset is overwhelmed by the quantization error.

5. The method as described in claim 1, characterized in that, It also includes using particle swarm optimization to search for the optimal color space offset, which is used to generate adversarial samples or backdoor trigger samples to verify the effectiveness of the defense method.

6. The method as described in claim 5, characterized in that, The color space offset applies a uniform color space offset to all pixels of the image.

7. The method according to claim 6, characterized in that, The objective function of the particle swarm optimization algorithm is: O = E − P; Where E is the attack effectiveness function, P is the total penalty term based on image similarity measurement; the objective function is used to search for the optimal adversarial perturbation or the optimal backdoor trigger.

8. The method according to claim 7, characterized in that, In particle swarm optimization, the following criteria are followed to determine the quality of particles: when both particles satisfy the naturalness constraint, the one with the larger objective function value is better; when both particles violate the naturalness constraint, the one with the smaller penalty term is better; when one particle satisfies the naturalness constraint while the other does not, the one that satisfies the constraint is better.