基于视觉特征解耦的无数据依赖模型窃取攻击方法
作者:
中图分类号:

TP309

基金项目:

国家自然科学基金(62162067, 62101480); 云南省院士专家工作站项目(202205AF150145)


Data-free Model Stealing Attack Method Based on Visual Feature Decoupling
Author:
  • 摘要
  • | |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • | |
  • 文章评论
    摘要:

    随着深度学习模型安全性和隐私性研究的不断深入, 研究者发现模型窃取攻击能够对神经网络产生极大的威胁. 典型的数据依赖模型窃取攻击可以利用一定比例的真实数据查询目标模型, 在本地训练一个替代模型, 从而达到目标模型窃取的目的. 2020年以来, 一种新颖的无数据依赖模型窃取攻击方法被提出, 仅使用生成模型生成伪造的查询样本便能对深度神经网络开展窃取和攻击. 由于不依赖于真实数据, 无数据依赖模型窃取攻击具有更严重的破坏力. 然而, 目前的无数据依赖模型窃取攻击方法所构造查询样本的多样性和有效性不足, 存在模型窃取过程中查询次数大、攻击成功率较低的问题. 因此提出一种基于视觉特征解耦的无数据依赖模型窃取攻击方法VFDA (vision feature decoupling-based model stealing attack), 该方法通过利用多解码器结构对无数据依赖模型窃取过程中生成的查询样本的视觉特征进行解耦与生成, 从而提高查询样本的多样性和模型窃取的有效性. 具体来说, VFDA利用3个解码器分别生成查询样本的纹理信息、区域编码和平滑信息, 完成查询样本的视觉特征解耦. 其次, 为了使生成的查询样本更加符合真实样本的视觉特征, 通过限制纹理信息的稀疏性以及对生成的平滑信息进行滤波. VFDA利用了神经网络的表征倾向依赖于图像纹理特征的性质, 能够生成类间多样性的查询样本, 从而有效提高了模型窃取的相似性以及攻击成功率. 此外, VFDA对解耦生成的查询样本平滑信息添加了类内多样性损失, 使查询样本更加符合真实样本的分布. 通过与多个模型窃取攻击方法对比, VFDA方法在模型窃取的相似性以及攻击的成功率上具有更好的表现. 特别在分辨率较高的GTSRB和Tiny-ImageNet数据集上, 相比于目前较好的EBFA方法, 在攻击成功率上VFDA方法平均提高了3.86%和4.15%.

    Abstract:

    With the continuous deepening of research on the security and privacy of deep learning models, researchers find that model stealing attacks pose a tremendous threat to neural networks. A typical data-dependent model stealing attack can use a certain percentage of real data to query the target model and train an alternative model locally to steal the target model. Since 2020, a novel data-free model stealing attack method has been proposed, which can steal and attack deep neural networks simply by using fake query examples generated by generative models. Since it does not rely on real data, the data-free model stealing attack can cause more serious damage. However, the diversity and effectiveness of the query examples constructed by the current data-free model stealing attack methods are insufficient, and there are problems of a large number of queries and a relatively low success rate of the attack during the model stealing process. Therefore, this study proposes a vision feature decoupling-based model stealing attack (VFDA), which decouples and generates the visual features of the query examples generated during the data-free model stealing process by using a multi-decoder structure, thus improving the diversity of query examples and the effectiveness of model stealing. Specifically, VFDA uses three decoders to respectively generate the texture information, region encoding, and smoothing information of query examples to complete the decoupling of visual features of query examples. Secondly, to make the generated query examples more consistent with the visual features of real examples, the sparsity of the texture information is limited and the generated smoothing information is filtered. VFDA exploits the property that the representational tendency of neural networks depends on the image texture features, and can generate query examples with inter-class diversity, thus effectively improving the similarity of model stealing and the success rate of the attack. In addition, VFDA adds intra-class diversity loss to the smoothed information of query samples generated through decoupling to make the query samples more consistent with real sample distribution. By comparing with multiple model stealing attack methods, the VFDA method proposed in this study has better performance in the similarity of model stealing and the success rate of the attack. In particular, on the GTSRB and Tiny-ImageNet datasets with high resolution, the attack success rate is respectively improved by 3.86% and 4.15% on average compared with the currently better EBFA method.

    参考文献
    相似文献
    引证文献
引用本文

张锦弘,刘仁阳,韦廷楚,董云云,周维.基于视觉特征解耦的无数据依赖模型窃取攻击方法.软件学报,,():1-15

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2023-06-27
  • 最后修改日期:2024-01-11
  • 在线发布日期: 2025-03-12
文章二维码
您是第19728247位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号