Deep neural network confrontation and defense method and system based on feature denoising, storage medium and equipment

Abstract

The invention discloses a feature denoising-based deep neural network adversarial defense method and system, a storage medium and equipment, and belongs to the field of image-based deep learning adversarial sample defense. The objective of the invention is to solve the problem of poor confrontation sample defense effect caused by incomplete denoising of the confrontation sample defense method using spatial domain filtering to perform feature denoising at present. A neural network model containing at least one feature denoising module is designed, the feature denoising module comprises a 1 * 1 convolution, a residual connection unit and a denoising operation unit, in the denoising operation, discrete wavelet transform is carried out on a model intermediate layer feature map, useful information and noise information are separated, then denoising processing combining frequency domain filtering and spatial domain filtering is carried out on the high-frequency component containing noise information, and finally a feature map is reconstructed. According to the method provided by the invention, under adversarial training, the adversarial robustness when the adversarial sample attack is faced can be remarkably improved. The method is mainly used for graph deep neural network confrontation defense.

Description

technical field [0001] The invention belongs to the field of image-based deep learning adversarial sample defense, in particular to a feature denoising-based deep neural network adversarial defense method, system, storage medium and equipment. Background technique [0002] In recent years, with the continuous development of artificial intelligence, deep learning has gradually become a research hotspot in the field of artificial intelligence due to its characteristics such as automatic extraction of data features and strong model expression ability, and has been widely used in computer vision, speech recognition, natural language processing, etc. Numerous fields. However, artificial intelligence technology such as deep learning is a double-edged sword. While it performs well, it also has inherent weaknesses. In the deep learning technology for images, the attacker can generate adversarial samples that can make the target neural network model misclassify with high confidence ...

AI Technical Summary

Problems solved by technology

[0004] The present invention solves the problem of incomplete denoising in the current adversarial sample defense method using spatial domain filtering for feature denoising, which in turn leads to poor adversarial sample defense effects

Images