Adversarial sample defense method based on image super-resolution reconstruction

Abstract

The present invention relates to the technical field of artificial intelligence, and proposes an adversarial sample defense method based on image super-resolution reconstruction, comprising the following steps: inputting training samples into a defense model for training, so as to output normal samples and obtain a trained defense model; the training The sample is a clean sample; input the initial sample into the trained defense model, perform image preprocessing and image reconstruction in sequence to output a normal sample, and then input the normal sample into the classification model to obtain the correct classification result; the initial sample includes adversarial Sample, clean sample. The defense model designed by the present invention can be reconstructed as a normal sample regardless of inputting a clean sample or an adversarial sample, so as to achieve the function of defending against malicious attacks. However, many existing defense methods need to train a training set and a test set separately to realize the defense method. , so this scheme reduces the cost and cost of defense.

Description

technical field [0001] The present invention relates to the technical field of artificial intelligence, in particular to a method for defending against examples based on image super-resolution reconstruction. Background technique [0002] Deep learning shows extremely powerful self-learning ability in the research and application of artificial intelligence, because the deep convolutional neural network is composed of multi-layer nonlinear structure, which enables it to learn various complex high-dimensional features and Fitting a variety of complex sample spaces, these characteristics make it have a very powerful expressive ability, so it has achieved great success in many fields. [0003] However, while deep learning brings great convenience to people, it also leaves behind many potential safety hazards, such as its algorithm flaws, the robustness of the training model, and the integrity of the data used for model training. Adversarial sample attack is one of its security ...

AI Technical Summary

Problems solved by technology

[0003] However, while deep learning brings great convenience to people, it also leaves behind many potential safety hazards, such as its algorithm flaws, the robustness of the training model, and the integrity of the data used for model training. Anti-sample attack is one of its security risks

[0004] The more popular understanding of adversarial samples is to add some adversarial samples formed by artificially constructed disturbances to clean data. This disturbance or noise is very small, and people cannot easily distinguish whether there are adversarial samples with the naked eye. But in deep learning When classifying, these adversarial examples can "fool" the neural network model to make the classifier misclassify. In this way, if the adversarial examples are applied to natural language processing, face recognition, automatic driving and other fields, it will be very likely to be harmful to people. serious threat to life and property

[0005] For example, if the disturbance of "going straight" is added to the stop sign in automatic driving, after forming an adversarial sample, the person still looks like a stop sign, so it will not be misclassified, but the classifier will think it is a straight sign, and serious problems will occur. as a result of

Images