Adversarial sample defense method based on Bayesian convolutional neural network

Abstract

The invention discloses an adversarial sample defense method based on a Bayesian convolutional neural network. The method comprises the following steps: selecting a plurality of traffic signal board pictures as a picture training set and an initial training set according to a traffic signal recognition task of an automobile automatic driving image recognition system; constructing a Bayesian convolutional neural network model of the automobile automatic driving image recognition system, and training the model to determine model parameters; setting a disturbance value and a disturbance value increasing step length, and generating a plurality of adversarial samples; taking the adversarial sample as training set data, and training the model in combination with the initial training set to update model parameters; and improving the automobile automatic driving image recognition system based on the updated model parameters. According to the method, adversarial training is performed on the neural network model by mixing the adversarial samples generated under different disturbance values so that the model is enabled to learn more features, the robustness of the model can be effectively enhanced and thus the recognition precision of the automobile automatic driving image recognition system can be enhanced.

Description

technical field [0001] The invention relates to the technical field of image intelligent recognition, in particular to an adversarial sample defense method based on a Bayesian convolutional neural network. Background technique [0002] With the development of deep learning, deep neural network (DNN) has many applications in computer vision and natural language processing. Neural networks are very complex and fragile. For example, in image recognition tasks, when small noise is added to a picture, the model can misclassify it with a high probability. [0003] At present, the pictures with added perturbations are called adversarial samples. In order to defend against the attacks of adversarial samples, adversarial training methods are mainly used to improve the robustness of neural network models to ensure accurate recognition and classification of images; existing adversarial training methods use The adversarial samples are used as the training set to train the neural networ...

AI Technical Summary

Problems solved by technology

However, in the existing adversarial training methods, the neural network model only uses the adversarial samples generated under a specific set of disturbance values ​​for training. When facing adversarial samples generated with different disturbance values, it does not have good robustness and cannot achieve Accurate recognition and classification of images, that is, the use of existing confrontation training methods cannot make the image recognition system of the automotive automatic driving system have good robustness to defend against malicious attacks

Images