Adversarial sample defense method and system based on VAE-GAN

Abstract

The invention belongs to the technical field of confrontation sample defense. The invention discloses an adversarial sample defense method and system based on VAE-GAN. A variational automatic encoderVAE and a generative adversarial network GAN are used to denoise an adversarial sample, the VAE is used as a preprocessing model of a classifier to denoise the adversarial sample, and the GAN is usedto assist training of the VAE, so that an image result output by the VAE is closer to an original noiseless image. The adversarial sample defense method based on VAE-GAN provided by the invention belongs to input preprocessing, and learning migration can be carried out among different classification models; the original classification network does not need to be retrained, and the training cost islow; the classification precision of the original noiseless sample is hardly influenced; an adversarial sample is not needed, so that an external training adversarial sample is not needed; the defense effect on adversarial samples with low noise is also very good; the preprocessing speed is high, and the output image quality is close to that of an original noiseless image.

Description

Technical field [0001] The invention belongs to the technical field of adversarial sample defense, and in particular relates to a method and system for adversarial sample defense based on VAE-GAN. Background technique [0002] At present, deep neural networks have excellent performance in many problems that are difficult to solve by traditional machine learning. With the continuous improvement of deep neural network models, more and more deep learning solutions are slowly entering people's daily lives, such as: image recognition, face recognition, automatic driving, voice command recognition, etc. Although deep neural networks have excellent performance in various fields, Szegedy et al. proved that modern deep neural networks are very vulnerable to attacks by adversarial examples. These adversarial examples only add subtle perturbations (not detectable by human vision) to the original image. Cause the deep neural network model to misclassify the image (such as Figure 5 Shown). ...

AI Technical Summary

Problems solved by technology

[0020] Aiming at the problems existing in the prior art, the present invention provides a VAE-GAN-based adversarial example defense method, which aims to solve the existing adversarial example defense schemes with high defense training costs, poor defense scheme versatility, and defense schemes that may lead to original Classifier classification accuracy decline and other issues

Images