Attack defense training method based on generative adversarial network

Abstract

The invention provides an anti-attack defense training method based on a generative adversarial network, and the method comprises the steps: S1, carrying out the class definition of real sample imagedata xreal, and carrying out the standardization processing; s2, establishing a defense training framework; s3, generating random noise Z and generating a random condition vector Cfake; s4, inputtingthe random noise Z and the random condition vector Cfake into a generator in a defense training framework; s5, inputting the standardized real sample image data and the category creal of the standardized real sample image data into an attack algorithm library; s6, performing defense training on the defense training framework, and storing trained defense training framework parameters; and S7, completing training, abandoning the generator and the attack algorithm library, and reserving the discriminator. According to the method provided by the invention, the defect that the workload is increasedwhen an additional network is used in a traditional method for attack defense training is overcome, and the method provided by the invention has relatively high robustness.

Description

technical field [0001] The present invention relates to the technical field of deep learning anti-attack security defense, and more specifically, relates to a training method for anti-attack defense based on generative adversarial networks. Background technique [0002] Currently, deep learning is occupying a central position in the rapidly developing field of machine learning and artificial intelligence, and has achieved excellent performance in various visual and speech recognition tasks. However, due to the non-intuitive features and uninterpretable nature of the models, modern visual deep neural networks (DNNs) are vulnerable to attacks from adversarial examples designed according to some specific blind spots. Compared with noise samples, such aggressive adversarial samples are carefully designed, so they are not easy to detect. They can not only cause the target network to predict and classify errors, but also have transferability and can directly execute black-box atta...

AI Technical Summary

Problems solved by technology

From the perspective of effect and cost, modifying data and using additional networks are currently two methods that are widely used. This is because these two methods do not directly modify the target network model and can be directly used for multiple networks with similar functions. The model greatly saves resources in engineering, but modifying data and using additional networks also increases the workload to a certain extent, and the training samples are limited, resulting in differences between the network boundary of defense training and the real decision boundary

Images