| 引用本文: | 张锦弘,刘仁阳,韦廷楚,董云云,周维.基于视觉特征解耦的无数据依赖模型窃取攻击方法.软件学报,2025,36(10):4812-4826 |
| |
|
| |
|
|
| 本文已被：浏览 998次 下载 1186次 |
码上扫一扫！ |
|
|
| 基于视觉特征解耦的无数据依赖模型窃取攻击方法 |
|
张锦弘1, 刘仁阳1, 韦廷楚2, 董云云3,4, 周维3,4
|
|
1.云南大学 信息学院, 云南 昆明 650500;2.云南大学 国际河流与生态安全研究院, 云南 昆明 650500;3.云南大学 软件学院, 云南 昆明 650500;4.云南大学 跨境网络空间安全工程研究中心, 云南 昆明 650500
|
|
| 摘要: |
| 随着深度学习模型安全性和隐私性研究的不断深入, 研究者发现模型窃取攻击能够对神经网络产生极大的威胁. 典型的数据依赖模型窃取攻击可以利用一定比例的真实数据查询目标模型, 在本地训练一个替代模型, 从而达到目标模型窃取的目的. 2020年以来, 一种新颖的无数据依赖模型窃取攻击方法被提出, 仅使用生成模型生成伪造的查询样本便能对深度神经网络开展窃取和攻击. 由于不依赖于真实数据, 无数据依赖模型窃取攻击具有更严重的破坏力. 然而, 目前的无数据依赖模型窃取攻击方法所构造查询样本的多样性和有效性不足, 存在模型窃取过程中查询次数大、攻击成功率较低的问题. 因此提出一种基于视觉特征解耦的无数据依赖模型窃取攻击方法VFDA (vision feature decoupling-based model stealing attack), 该方法通过利用多解码器结构对无数据依赖模型窃取过程中生成的查询样本的视觉特征进行解耦与生成, 从而提高查询样本的多样性和模型窃取的有效性. 具体来说, VFDA利用3个解码器分别生成查询样本的纹理信息、区域编码和平滑信息, 完成查询样本的视觉特征解耦. 其次, 为了使生成的查询样本更加符合真实样本的视觉特征, 通过限制纹理信息的稀疏性以及对生成的平滑信息进行滤波. VFDA利用了神经网络的表征倾向依赖于图像纹理特征的性质, 能够生成类间多样性的查询样本, 从而有效提高了模型窃取的相似性以及攻击成功率. 此外, VFDA对解耦生成的查询样本平滑信息添加了类内多样性损失, 使查询样本更加符合真实样本的分布. 通过与多个模型窃取攻击方法对比, VFDA方法在模型窃取的相似性以及攻击的成功率上具有更好的表现. 特别在分辨率较高的GTSRB和Tiny-ImageNet数据集上, 相比于目前较好的EBFA方法, 在攻击成功率上VFDA方法平均提高了3.86%和4.15%. |
| 关键词: 模型窃取 对抗样本 迁移攻击 生成模型 模型隐私 |
| DOI：10.13328/j.cnki.jos.007310 |
| 分类号:TP309 |
| 基金项目:国家自然科学基金(62162067, 62101480); 云南省院士专家工作站项目(202205AF150145) |
|
| Data-free Model Stealing Attack Method Based on Visual Feature Decoupling |
|
ZHANG Jin-Hong1, LIU Ren-Yang1, WEI Ting-Chu2, DONG Yun-Yun3,4, ZHOU Wei3,4
|
|
1.School of Information Science and Engineering, Yunnan University, Kunming 650500, China;2.Institute of International Rivers and Eco-security, Yunnan University, Kunming 650500, China;3.School of Software, Yunnan University, Kunming 650500, China;4.Engineering Research Center of Cyberspace, Yunnan University, Kunming 650500, China
|
| Abstract: |
| With the continuous deepening of research on the security and privacy of deep learning models, researchers find that model stealing attacks pose a tremendous threat to neural networks. A typical data-dependent model stealing attack can use a certain percentage of real data to query the target model and train an alternative model locally to steal the target model. Since 2020, a novel data-free model stealing attack method has been proposed, which can steal and attack deep neural networks simply by using fake query examples generated by generative models. Since it does not rely on real data, the data-free model stealing attack can cause more serious damage. However, the diversity and effectiveness of the query examples constructed by the current data-free model stealing attack methods are insufficient, and there are problems of a large number of queries and a relatively low success rate of the attack during the model stealing process. Therefore, this study proposes a vision feature decoupling-based model stealing attack (VFDA), which decouples and generates the visual features of the query examples generated during the data-free model stealing process by using a multi-decoder structure, thus improving the diversity of query examples and the effectiveness of model stealing. Specifically, VFDA uses three decoders to respectively generate the texture information, region encoding, and smoothing information of query examples to complete the decoupling of visual features of query examples. Secondly, to make the generated query examples more consistent with the visual features of real examples, the sparsity of the texture information is limited and the generated smoothing information is filtered. VFDA exploits the property that the representational tendency of neural networks depends on the image texture features, and can generate query examples with inter-class diversity, thus effectively improving the similarity of model stealing and the success rate of the attack. In addition, VFDA adds intra-class diversity loss to the smoothed information of query samples generated through decoupling to make the query samples more consistent with real sample distribution. By comparing with multiple model stealing attack methods, the VFDA method proposed in this study has better performance in the similarity of model stealing and the success rate of the attack. In particular, on the GTSRB and Tiny-ImageNet datasets with high resolution, the attack success rate is respectively improved by 3.86% and 4.15% on average compared with the currently better EBFA method. |
| Key words: model stealing adversarial example transfer attack generative model model privacy |
|
|
|
|
