AI安全系列——[第五空间 2022]AI（持续更新）

最近很长时间没有更新，其实一直在学习AI安全，我原以为学完深度学习之后再学AI安全会更加简单些，但是事实证明理论转实践还是挺困难的，但是请你一定要坚持下去，因为“不是所有的坚持都有结果，但总有一些坚持，能从冰封的土地里，培育出十万朵怒放的蔷薇”。

题目来源：NSSCTF

题目描述：

噪声在大数据场景下有着重要的地位。工程师们苦于被噪声污染的数据，同时也使用噪声保护着隐私数据。这个挑战分为两个部分。

挑战1：从噪声中恢复隐私向量
有A,B两个实体。其中B是普通实体，A则是恶意攻击者。A现在获得了B的加密压缩包，并得知压缩包的密码是B隐私向量的md5值。同时通过一些其他手段获取了大量的受噪声加密保护的隐私向量（vector.txt）。经过简单的数据分析，A很快恢复出隐私向量并解锁了加密压缩包。
示例：如果你认为B的隐私向量是 100，200，50。那么压缩包的密码就是md5(10020050)=>e37864fe2983ce576b00c39049327841
提示：B的隐私向量长度为20且第一个值为901

挑战2：找出被噪声污染的数据
A从B的加密压缩包中获得了重要的数据资产——数据集，并准备使用其获取更大的商业价值。然而糟糕的是，使用这些数据集训练出的AI模型效果始终不好。A怀疑B在数据集中加入了噪声防止数据被恶意利用，经过对于数据的仔细检查，A发现了被噪声污染的数据。
请将你认为被污染的图片名字（不含.png）按字典序排列(python list.sort())后拼接。最终flag的格式为flag{md5(拼接得到的字符串)}
示例：如果你认为被污染的数据是 1a.png, 0b.png。则按字典序排序后拼接得到的字符串为0b1a，flag为flag{06624d5f90094ff209a1c03afff6bebc}

挑战1：从噪声中恢复隐私向量

1、计算每个向量的均值，展示出来的图片为：

 方差，展示出来的图片：

根据噪声的分布，初步判断为高斯噪声

2、去除高斯噪声，脚本如下：

import numpy as np
import hashlib

with open('vector.txt', 'r', encoding='utf-8') as file:
    vectors = [eval(line.strip('\n')) for line in file.readlines()]

string = ""
stacked_vectors = np.sum(vectors, axis=0)
vectorB = list(np.round(stacked_vectors/len(vectors),0))
print("vectorB:", vectorB)
for vector in vectorB:
    string += str(vector)[:-2]
print(string)
md5 = hashlib.md5()
md5.update(string.encode('utf-8'))
print("md5:", md5.hexdigest())

其实，去除高斯噪声就是求均值

得到B的隐私向量md5值：md5: 72a63a00259bec3de133c0da772c61e5

利用此值对picture压缩包进行解密

挑战2：找出被噪声污染的数据

1、训练MNIST数据集识别模型

得到model_Mnist.pth模型，我之所以想到通过训练模型来识别噪声，第一个原因是因为我找不到理论判断为高斯噪声的脚本，第二个原因是因为我使用matlab脚本得到每张图片的直方图，虽然也找到了，和模型测出来的一样，但是我需要人眼识别，我想着如果图片不是200张，就很困难。最后会附上matlab代码。

脚本，这个脚本不是我写的，是我在网上找的，在此附上地址用PyTorch实现MNIST手写数字识别（最新，非常详细）_mnist pytorch-CSDN博客：

import torch
import numpy as np
from matplotlib import pyplot as plt
from torch.utils.data import DataLoader
from torchvision import transforms
from torchvision import datasets
import torch.nn.functional as F
import os
os.environ["KMP_DUPLICATE_LIB_OK"] = "TRUE"

"""
卷积运算 使用mnist数据集，和10-4，11类似的，只是这里：1.输出训练轮的acc 2.模型上使用torch.nn.Sequential
"""
# Super parameter ------------------------------------------------------------------------------------
batch_size = 64
learning_rate = 0.01
momentum = 0.5
EPOCH = 10

# Prepare dataset ------------------------------------------------------------------------------------
transform = transforms.Compose([transforms.ToTensor(), transforms.Normalize((0.1307,), (0.3081,))])
# softmax归一化指数函数(https://blog.csdn.net/lz_peter/article/details/84574716),其中0.1307是mean均值和0.3081是std标准差

train_dataset = datasets.MNIST(root='./data/mnist', train=True, transform=transform, download=True)  # 本地没有就加上download=True
test_dataset = datasets.MNIST(root='./data/mnist', train=False, transform=transform)  # train=True训练集，=False测试集
train_loader = DataLoader(train_dataset, batch_size=batch_size, shuffle=True)
test_loader = DataLoader(test_dataset, batch_size=batch_size, shuffle=False)

fig = plt.figure()
for i in range(12):
    plt.subplot(3, 4, i+1)
    plt.tight_layout()
    plt.imshow(train_dataset.train_data[i], cmap='gray', interpolation='none')
    plt.title("Labels: {}".format(train_dataset.train_labels[i]))
    plt.xticks([])
    plt.yticks([])
plt.show()


# 训练集乱序，测试集有序
# Design model using class ------------------------------------------------------------------------------
class Net(torch.nn.Module):
    def __init__(self):
        super(Net, self).__init__()
        self.conv1 = torch.nn.Sequential(
            torch.nn.Conv2d(1, 10, kernel_size=5),
            torch.nn.ReLU(),
            torch.nn.MaxPool2d(kernel_size=2),
        )
        self.conv2 = torch.nn.Sequential(
            torch.nn.Conv2d(10, 20, kernel_size=5),
            torch.nn.ReLU(),
            torch.nn.MaxPool2d(kernel_size=2),
        )
        self.fc = torch.nn.Sequential(
            torch.nn.Linear(320, 50),
            torch.nn.Linear(50, 10),
        )

    def forward(self, x):
        batch_size = x.size(0)
        x = self.conv1(x)  # 一层卷积层,一层池化层,一层激活层(图是先卷积后激活再池化，差别不大)
        x = self.conv2(x)  # 再来一次
        x = x.view(batch_size, -1)  # flatten 变成全连接网络需要的输入 (batch, 20,4,4) ==> (batch,320), -1 此处自动算出的是320
        x = self.fc(x)
        return x  # 最后输出的是维度为10的，也就是（对应数学符号的0~9）


model = Net()


# Construct loss and optimizer ------------------------------------------------------------------------------
criterion = torch.nn.CrossEntropyLoss()  # 交叉熵损失
optimizer = torch.optim.SGD(model.parameters(), lr=learning_rate, momentum=momentum)  # lr学习率，momentum冲量


# Train and Test CLASS --------------------------------------------------------------------------------------
# 把单独的一轮一环封装在函数类里
def train(epoch):
    running_loss = 0.0  # 这整个epoch的loss清零
    running_total = 0
    running_correct = 0
    for batch_idx, data in enumerate(train_loader, 0):
        inputs, target = data
        optimizer.zero_grad()

        # forward + backward + update
        outputs = model(inputs)
        loss = criterion(outputs, target)

        loss.backward()
        optimizer.step()

        # 把运行中的loss累加起来，为了下面300次一除
        running_loss += loss.item()
        # 把运行中的准确率acc算出来
        _, predicted = torch.max(outputs.data, dim=1)
        running_total += inputs.shape[0]
        running_correct += (predicted == target).sum().item()

        if batch_idx % 300 == 299:  # 不想要每一次都出loss，浪费时间，选择每300次出一个平均损失,和准确率
            print('[%d, %5d]: loss: %.3f , acc: %.2f %%'
                  % (epoch + 1, batch_idx + 1, running_loss / 300, 100 * running_correct / running_total))
            running_loss = 0.0  # 这小批300的loss清零
            running_total = 0
            running_correct = 0  # 这小批300的acc清零

        torch.save(model.state_dict(), './model_Mnist.pth')
        torch.save(optimizer.state_dict(), './optimizer_Mnist.pth')


def test():
    correct = 0
    total = 0
    with torch.no_grad():  # 测试集不用算梯度
        for data in test_loader:
            images, labels = data
            outputs = model(images)
            _, predicted = torch.max(outputs.data, dim=1)  # dim = 1 列是第0个维度，行是第1个维度，沿着行(第1个维度)去找1.最大值和2.最大值的下标
            total += labels.size(0)  # 张量之间的比较运算
            correct += (predicted == labels).sum().item()
    acc = correct / total
    print('[%d / %d]: Accuracy on test set: %.1f %% ' % (epoch+1, EPOCH, 100 * acc))  # 求测试的准确率，正确数/总数
    return acc


# Start train and Test --------------------------------------------------------------------------------------
if __name__ == '__main__':
    acc_list_test = []
    for epoch in range(EPOCH):
        train(epoch)
        # if epoch % 10 == 9:  #每训练10轮 测试1次
        acc_test = test()
        acc_list_test.append(acc_test)

    plt.plot(acc_list_test)
    plt.xlabel('Epoch')
    plt.ylabel('Accuracy On TestSet')
    plt.show()

2、利用得到的模型进行测试

import torch
from matplotlib import pyplot as plt
from torchvision import transforms, datasets
import os
os.environ["KMP_DUPLICATE_LIB_OK"] = "TRUE"
import glob

# 获取文件夹中所有图片的路径

# Prepare dataset ------------------------------------------------------------------------------------
datasets_path = "picture"
image_paths = []
image_paths3 = []
for i in range(10):
    image_paths.append(glob.glob(os.path.join(f"picture\\{i}", '*.png')))
# print(image_paths)
for image_paths1 in image_paths:
    for image_paths2 in image_paths1:
        image_paths3.append(image_paths2)
print(image_paths3)
transform = transforms.Compose([
    transforms.Resize((28, 28)),
    transforms.Grayscale(),
    transforms.ToTensor(),
    transforms.Normalize((0.1307,), (0.3081,))])
custom_dataset = datasets.ImageFolder(root=datasets_path, transform=transform)
data_loader = torch.utils.data.DataLoader(custom_dataset, batch_size=200, shuffle=False)

# Design model using class ------------------------------------------------------------------------------
class Net(torch.nn.Module):
    def __init__(self):
        super(Net, self).__init__()
        self.conv1 = torch.nn.Sequential(
            torch.nn.Conv2d(1, 10, kernel_size=5),
            torch.nn.ReLU(),
            torch.nn.MaxPool2d(kernel_size=2),
        )
        self.conv2 = torch.nn.Sequential(
            torch.nn.Conv2d(10, 20, kernel_size=5),
            torch.nn.ReLU(),
            torch.nn.MaxPool2d(kernel_size=2),
        )
        self.fc = torch.nn.Sequential(
            torch.nn.Linear(320, 50),
            torch.nn.Linear(50, 10),
        )

    def forward(self, x):
        batch_size = x.size(0)
        x = self.conv1(x)  # 一层卷积层,一层池化层,一层激活层(图是先卷积后激活再池化，差别不大)
        x = self.conv2(x)  # 再来一次
        x = x.view(batch_size, -1)  # flatten 变成全连接网络需要的输入 (batch, 20,4,4) ==> (batch,320), -1 此处自动算出的是320
        x = self.fc(x)
        return x  # 最后输出的是维度为10的，也就是（对应数学符号的0~9）

model = Net()

# Start Test --------------------------------------------------------------------------------------
if __name__ == '__main__':
    fig = plt.figure()
    n = 0
    m = 0
    string = ""
    # 加载模型
    model.load_state_dict(torch.load('model_Mnist.pth'))
    with torch.no_grad():
        for data in data_loader:
            images, label = data
            output = model(images)
            _, predicted = torch.max(output.data, dim=1)
            # print(label, predicted)
            # print(torch.eq(label, predicted).numpy())
            ans = torch.eq(label, predicted).numpy()
            # plt.subplot(10, 20, n+1)
            # plt.tight_layout()
            # plt.imshow(images[n][0], cmap='gray', interpolation='none')
            # plt.title("{}:{}".format(label, predicted))
            # plt.xticks([])
            # plt.yticks([])
            n += 1
        # plt.show()
        for i in range(len(ans)):
            if not ans[i]:
                print(f"'{image_paths3[i][-8:-4]}',", end="")

最终得到的文件名为：list = ["mHcX","cmGg","VIre","QAnp","9etA"]

进一步：

import hashlib

list = ["mHcX","cmGg","VIre","QAnp","9etA"]
list.sort()
string = ""
for s in list:
    string += s
md5 = hashlib.md5()
md5.update(string.encode('utf-8'))
print("md5:", md5.hexdigest())

得到md5值：db49e0176a2cb612f666ba582e7c3a69

但是当我信心满满的去交flag时，不对？？？我不知道为什么？

matlab代码：

function[] = noise_hist()
image = ["0D1G.png", "0ETW.png", "1kCT.png", "1RK4.png", "2bzf.png", "2GEo.png", "3als.png", "4qzr.png", "5MIr.png", "5REN.png", "5ZAn.png", "6wMN.png", "71Ek.png", "792g.png", "7ghZ.png", "7spe.png", "7wYX.png", "82ig.png", "8as8.png", "8CiG.png", "98nP.png", "9etA.png", "9Fky.png", "9g84.png", "9S4c.png", "9udk.png", "9Yla.png", "ADGa.png", "ADZ7.png", "afLq.png", "AMic.png", "AvLX.png", "AZgn.png", "b9wg.png", "bEGh.png", "bv89.png", "cB5c.png", "cG3m.png", "CIbx.png", "cmGg.png", "Cozg.png", "CPIT.png", "CVRg.png", "CYZ2.png", "CzSN.png", "DaNV.png", "dgIl.png", "DgSY.png", "DGzY.png", "DIkW.png", "dlkc.png", "DOgp.png", "dPXx.png", "dvwc.png", "e3Ui.png", "egza.png", "Ehd7.png", "Ei01.png", "EI6X.png", "f7If.png", "FB9b.png", "fcOP.png", "FdZ3.png", "FGIY.png", "foxS.png", "FWm5.png", "g10P.png", "G3F8.png", "G5ew.png", "gaTE.png", "gaVE.png", "GdL7.png", "ge5N.png", "ggk5.png", "gkgA.png", "GKug.png", "gNmk.png", "gVw7.png", "gw63.png", "Gxbw.png", "H4U4.png", "H5p4.png", "hdsA.png", "hEB3.png", "hGVS.png", "hh81.png", "hkGO.png", "hob7.png", "HoR1.png", "Hrun.png", "hSgA.png", "Hux6.png", "HVEK.png", "hxhy.png", "Hy5l.png", "IEvu.png", "INcr.png", "k4Mu.png", "KAsp.png", "kaVE.png", "kLWg.png", "KPFk.png", "kqft.png", "l2AQ.png", "LdlV.png", "LgQX.png", "LgU2.png", "lMOK.png", "LoFU.png", "Lq7s.png", "lqrK.png", "LZo6.png", "mHcX.png", "mPW4.png", "msVi.png", "muMK.png", "mvHD.png", "MWTx.png", "nRtp.png", "Nv7u.png", "NvyK.png", "nWTH.png", "nyZW.png", "O0wv.png", "OAQ9.png", "OgEx.png", "ooir.png", "OpMF.png", "Oslf.png", "OTU3.png", "P3Am.png", "PwCC.png", "QAnp.png", "qGxs.png", "qH3P.png", "qMgX.png", "Qqq9.png", "qtaR.png", "RDkl.png", "rEz6.png", "RIqg.png", "rMGY.png", "Rogg.png", "RPBd.png", "RUls.png", "S46q.png", "s8py.png", "S9rU.png", "SAd2.png", "SAru.png", "SAzS.png", "sFsU.png", "SLG2.png", "sn7m.png", "SPEb.png", "SYfg.png", "syHP.png", "SzAV.png", "T0u5.png", "t7Kf.png", "TCOt.png", "tEDB.png", "TQ4z.png", "tSZp.png", "tWF8.png", "u6vG.png", "UcuB.png", "uH1P.png", "UHqz.png", "UKBL.png", "unEF.png", "uU1G.png", "uVSn.png", "UxQl.png", "UZz9.png", "v4rb.png", "VFQQ.png", "VIre.png", "vpz6.png", "w8xx.png", "weYa.png", "WGGZ.png", "WK7W.png", "x4zu.png", "X5sz.png", "Xgl9.png", "xRtF.png", "xZxm.png", "y4tR.png", "Y6Wm.png", "YI78.png", "YQtn.png", "YWqF.png", "YY9F.png", "Z2uR.png", "zbrq.png", "zCPx.png", "zl5m.png", "zXWB.png", "zzga.png"];
len = length(image);

for i = 1:len
    a = imread("./picture/"+image(i));
    figure;
    imhist(a);title(image(i));
end

如果有人知道怎么解的，可不可以告诉我一下？感谢！！！