【作者】 郭鑫；

【导师】 郑宇； 牟三钢；

【作者基本信息】 西安电子科技大学 ， 电子信息硕士（专业学位）， 2023， 硕士

【摘要】 在人工智能和产业数字化发展和融合中,基于深度学习技术的AI模型广泛应用于不同的业务场景中。由于AI模型的泛化性和鲁棒性差,容易遭受恶意的模型窃取攻击并带来模型的安全和服务质量问题。因模型窃取攻击者的数据特征复杂、攻击方式多样,研究攻击行为检测有效、防御灵活的模型保护策略,是提升产业数字化场景中AI模型安全性和可用性的关键。模型窃取攻击检测技术能够利用服务对象的查询数据和行为数据,构建查询特征并识别潜在的恶意攻击。模型窃取攻击防御技术通过对模型结构信息或模型输出数据的控制,提升模型的安全性以降低窃取攻击成功率。但是,现有攻击检测方法难以高效检测复杂攻击查询数据和多用户共谋行为下的模型窃取攻击。现有防御方法在保障模型安全性的同时带来响应速度慢,适应能力差,难以应用到AI服务平台中。本文面向AI服务中的模型窃取攻击检测与防御问题,基于窃取攻击用户行为数据在目标模型决策空间中的特征,提出窃取攻击检测方法和动态控制模型输出的防御策略。针对复杂的非连续攻击查询数据,用户的攻击特征难以获得,窃取攻击检测准确率低的问题,提出一种基于决策空间的窃取攻击用户检测方法。利用不同输入样本集在数据空间上的特征差异,构建异常查询样本集。基于异常样本在目标模型上的决策空间信息,包括决策边界距离特征和类别特征,生成用户查询行为特征数据。设计基于信息覆盖度的贪心策略进行多用户共谋行为的窃取攻击检测。最终达到提升识别复杂攻击查询数据和多用户共谋的窃取攻击检测能力。理论分析与实验结果表明,本方法检测的窃取攻击特征维度更全面,在复杂攻击查询数据下的窃取攻击检测平均精度高于经典的基于连续查询样本的PRADA检测方法。本方法对于多用户共谋攻击行为的检测平均误报率低于经典基于查询样本多用用户共谋的检测方法。针对模型输出控制防御方法在保障安全性下,增加服务平台的响应时间,降低用户的服务质量问题,提出一种基于动态控制模型输出扰动的防御方法。利用不同用户在决策空间上的特征差异,构建分布感知用户集和知识受限的用户分组。基于梯度优化原理,将不同防御策略的用户分组中的样本进行模型输出扰动添加,包括目标模型的低维语义、高维特征和模型预测结果。设计防御反馈模块,实现动态调整用户分组和防御控制机制。最终达到提升模型输出控制防御方案的适应能力,降低平均响应时间并提升用户使用质量。理论分析与实验结果表明,对比多种不同扰动添加防御方法,本文方法的资源消耗和响应时间更少。在不同攻击查询数据设置下,本文方法比同类方法的适应能力更好。基于所研究的技术和方案,设计了面向AI服务的窃取攻击检测与防御方法原型系统。实现了用户管理、攻击方法模拟、检测方法模块、防御方法模块、数据处理与存储模块。通过部署于基于视频图像的AI安防监控服务系统和工业互联网平台下AI算法服务的真实场景中。评估攻击的检测能力和实际场景下的防御资源消耗与服务响应情况,验证了本文提出的防御策略在真实场景中的可用性。更多还原

【Abstract】 In the development and integration of artificial intelligence and industrial digitalization,AI models based on deep learning technology are widely used in different business scenarios.Because of the poor generalization and robustness of AI model,it is easy to suffer from malicious model stealing attacks and bring problems of model security and service quality.Since model theft attackers have complex data characteristics and various attack methods,it is the key to improve the security and availability of AI models in industrial digital scenarios to study model protection strategies with effective attack behavior detection and flexible defense.Model stealing attacks detection technology can use the query data and behavior data of the service users to construct query characteristics and identify potential malicious attacks.By controlling model structure or model output data,model stealing attacks defense technology improves model security and reduces the success rate of model stealing attacks.However,existing attacks detection methods are difficult to efficiently detect complex attacks query data and multi-user collusion model stealing attacks.Existing defense methods not only guarantee model security,but also bring slow response speed and poor adaptability,which makes it difficult to apply to AI service platform.Aiming at the problem of model stealing attacks detection and defense in AI services,based on the characteristics of user behavior data in the decision space of target model,this dissertation proposes a method of stealing attacks detection and a defense strategy of dynamic control model output.Aiming at the problems of complex discontinuous attack query data,difficult to obtain the attack features of users and low detection accuracy of stealing attacks,a method of stealing attack users detection based on decision space is proposed.Based on the feature difference of different input sample sets in data space,the exception query sample set is constructed.Based on the decision space information of exception samples in the target model,including the decision boundary distance feature and category feature,the feature data of user’s query behavior is generated.A greedy strategy based on information coverage is designed to detect multi-users collusion stealing attacks.Finally,our work improve the ability to identify complex attack query data and multi-users collusion stealing attacks detection.Theoretical analysis and experimental results show that the characteristic dimensions of stealing attacks detected by this method are more comprehensive,and the average accuracy of theft attack detection under complex attack query data is higher than that of the classical PRADA detection method based on continuous query samples.The average false positive rate of multi-users collusion attacks detected by this method is lower than that of classical multi-users collusion detection methods based on query samples.To address the problem that the model output control defense method can increase the response time of service platform and reduce the service quality of users under the guarantee of security,a defense method based on dynamic control model output disturbance is proposed.Based on the characteristic difference of different users in decision space,the distributed perception users sets and knowledge limited users groups are constructed.Based on the principle of gradient optimization,the model output perturbation is added to the samples of user groups with different defense strategies,including the low-dimensional meaning,high-dimensional features and model prediction results of the target model.A defense feedback module is designed to dynamically adjust user groups and defense control mechanism.Finally,our method can improve the adaptability of the model output control defense scheme,reduce the average response time and improve the service quality.Theoretical analysis and experimental results show that the proposed method has lower resource consumption and response time compared with many different disturbance addition defense methods.Under different attack query data Settings,the proposed method has better adaptability than similar methods.Based on the technique and scheme studied,a prototype system for detecting and defending against stealing attacks is designed.It implements user management,attack method simulation,detection method module,defense method module,data processing and storage module.It is deployed in the AI security monitoring service system based on video images and the real scene of AI algorithm service under the industrial Internet platform.The attack detection capability and defense resource consumption and service response in actual scenarios are evaluated to verify the availability of the defense strategy proposed in this thesis in real scenarios.更多还原