Adversarial sample defense method based on image super-resolution reconstruction

Abstract

The invention relates to the technical field of artificial intelligence, and provides an adversarial sample defense method based on image super-resolution reconstruction, which comprises the followingsteps of inputting a training sample into a defense model for training to output a normal sample to obtain a trained defense model; wherein the training sample is a clean sample; inputting the initial sample into a trained defense model, sequentially carrying out image preprocessing and image reconstruction to output a normal sample, and inputting the normal sample into a classification model toobtain a correct classification result; wherein the initial sample comprises an adversarial sample and a clean sample. No matter whether a clean sample or an adversarial sample is input, the defense model designed by the invention can be reconstructed into a normal sample to achieve the function of defending malicious attacks, while many existing defense methods need to independently train a training set and a test set to realize the defense method, so that the scheme reduces the defense cost and expense.

Description

technical field [0001] The present invention relates to the technical field of artificial intelligence, in particular to a method for defending against examples based on image super-resolution reconstruction. Background technique [0002] Deep learning shows extremely powerful self-learning ability in the research and application of artificial intelligence, because the deep convolutional neural network is composed of multi-layer nonlinear structure, which enables it to learn various complex high-dimensional features and Fitting a variety of complex sample spaces, these characteristics make it have a very powerful expressive ability, so it has achieved great success in many fields. [0003] However, while deep learning brings great convenience to people, it also leaves behind many potential safety hazards, such as its algorithm flaws, the robustness of the training model, and the integrity of the data used for model training. Adversarial sample attack is one of its security ...

AI Technical Summary

Problems solved by technology

[0003] However, while deep learning brings great convenience to people, it also leaves behind many potential safety hazards, such as its algorithm flaws, the robustness of the training model, and the integrity of the data used for model training. Anti-sample attack is one of its security risks

[0004] The more popular understanding of adversarial samples is to add some adversarial samples formed by artificially constructed disturbances to clean data. This disturbance or noise is very small, and people cannot easily distinguish whether there are adversarial samples with the naked eye. But in deep learning When classifying, these adversarial examples can "fool" the neural network model to make the classifier misclassify. In this way, if the adversarial examples are applied to natural language processing, face recognition, automatic driving and other fields, it will be very likely to be harmful to people. serious threat to life and property

[0005] For example, if the disturbance of "going straight" is added to the stop sign in automatic driving, after forming an adversarial sample, the person still looks like a stop sign, so it will not be misclassified, but the classifier will think it is a straight sign, and serious problems will occur. as a result of

Images