A training method for adversarial attack defense based on generative adversarial networks

Abstract

The present invention proposes a kind of anti-attack defense training method based on generative confrontation network, comprising: S1. real sample image data x real Category definition and standardized processing; S2. Establish defense training framework; S3. Generate random noise Z and generate random condition vector C fake ; S4. Random noise Z and random condition vector C fake Input to the generator in the defense training framework; S5. The real sample image data and its category c after normalization processing real Input to the attack algorithm library; S6. Conduct defense training on the defense training framework, and save the trained defense training framework parameters; S7. After the training is completed, discard the generator and the attack algorithm library, and keep the discriminator. The method proposed by the invention overcomes the disadvantages of aggravating the workload of the traditional method for combating attack defense training such as using an additional network, and the method proposed by the invention has relatively high robustness.

Description

technical field [0001] The present invention relates to the technical field of security defense against deep learning against attacks, and more particularly, to a method for training methods for against attacks against attacks based on a generative confrontation network. Background technique [0002] Currently, deep learning is occupying a central position in the rapidly developing field of machine learning and artificial intelligence, achieving excellent performance in various vision and speech recognition tasks. However, due to the non-intuitive features and uninterpretability of the models, modern visual deep neural networks (DNNs) are vulnerable to attacks from adversarial examples designed according to some specific blind spots. Such aggressive adversarial samples, compared to noisy samples, are carefully designed and thus imperceptible, not only can cause the target network to predict classification errors, but also are transferable and can directly perform black-box a...

AI Technical Summary

Problems solved by technology

From the perspective of effect and cost, modifying data and using additional networks are currently two methods that are widely used. This is because these two methods do not directly modify the target network model and can be directly used for multiple networks with similar functions. The model greatly saves resources in engineering, but modifying data and using additional networks also increases the workload to a certain extent, and the training samples are limited, resulting in differences between the network boundary of defense training and the real decision boundary

Images