Neural network model optimization method and device, terminal and storage medium
By conducting robustness tests on the neural network model and obtaining activation distribution information through layer-by-layer backpropagation, target perturbation samples are selected for optimization. This solves the robustness problem of the neural network model when facing noise and abnormal data, and achieves higher prediction accuracy and stability.
Patent Information
- Application Number
- CN202410531422.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-04-29
- Publication Date
- 2025-10-31
AI Technical Summary
Existing model optimization methods based on input perturbation are difficult to effectively improve the robustness of neural network models, especially in terms of stability and reliability when faced with noise, abnormal data, or attacks.
By acquiring perturbation samples from the perturbation sample set, the robustness of the neural network model is tested, target perturbation samples are selected, and activation distribution information is obtained by backpropagation layer by layer. The model is then optimized using the difference in activation between the target perturbation samples and the target standard samples.
This improves the robustness of neural network models, making them more interpretable and stable in the face of different perturbations, and can more effectively improve the prediction accuracy and robustness of the models.
Smart Images
Figure CN120873574A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of deep learning technology, specifically to methods, devices, terminals, and storage media for optimizing neural network models. Background Technology
[0002] Neural network models have powerful regression prediction capabilities and are widely used in various industries. However, in some high-risk areas, such as autonomous driving, the practical application of neural network models is often difficult. One reason is that the stability and reliability of the model are difficult to guarantee when facing noise, abnormal data, or attacks, that is, the robustness of the model is difficult to meet the requirements.
[0003] Currently, improving the robustness of neural network models mainly involves input perturbation. However, due to the black-box nature of neural network models—that is, only the input and output results can be observed, and the internal operating mechanisms cannot be explored—it is difficult to trace the root cause of the model's main defects even after identifying which input perturbations affect its robustness. Therefore, current model optimization methods based on input perturbation are insufficient to effectively improve the robustness of neural network models.
[0004] Therefore, existing technologies still need to be improved and enhanced. Summary of the Invention
[0005] This application provides a method, apparatus, terminal, and storage medium for optimizing neural network models, in order to address the difficulty in effectively improving the robustness of neural network models using input perturbation-based model optimization methods in related technologies.
[0006] To achieve the above objectives, this application adopts the following technical solution:
[0007] Obtain perturbation samples from the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0008] If the perturbation sample is the target perturbation sample, then the activation distribution information corresponding to the target perturbation sample and the target standard sample is obtained, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation;
[0009] The neural network model is optimized based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0010] Based on the aforementioned technical means, this application embodiment filters out target perturbation samples that may cause the neural network model to make prediction errors through robustness testing, and obtains the activation status of each neuron in the neural network model when predicting target perturbation samples and target standard samples through a layer-by-layer backpropagation method, thereby making the neural network model interpretable. By analyzing the differences in neuron activation status under target standard samples and target perturbation samples, the robustness of the neural network model can be improved more effectively.
[0011] Optionally, in one embodiment of this application, the method for generating the perturbation sample set includes:
[0012] Obtain several standard samples;
[0013] For each of the standard samples, at least one perturbation process is applied to the standard sample to obtain the perturbed sample corresponding to the standard sample. The types of perturbation processes include random input perturbation, input perturbation based on prior information, and input perturbation based on model inference.
[0014] The perturbation sample set is obtained based on the perturbation samples corresponding to all the standard samples.
[0015] Based on the aforementioned technical means, the perturbation sample set in this application embodiment covers perturbation samples of different perturbation types, which can comprehensively test the robustness of the neural network model and identify input perturbations that cause the neural network model to fail. By using multiple types of input perturbations, a more comprehensive evaluation of the model's robustness can be completed, and performance problems of the model can be discovered, providing better analytical data for subsequent model optimization.
[0016] Optionally, in one embodiment of this application, the step of performing a robustness test on the neural network model based on the perturbation sample, and determining whether the perturbation sample is a target perturbation sample based on the robustness test result, includes:
[0017] The perturbation sample is input into the neural network model to obtain the prediction information corresponding to the perturbation sample;
[0018] Obtain the prediction information of the standard sample corresponding to the perturbation sample;
[0019] If the prediction information corresponding to the perturbation sample and the standard sample are inconsistent, then the perturbation sample is determined to be the target perturbation sample.
[0020] Based on the above technical means, the embodiments of this application compare the prediction information of the perturbation sample with the prediction information of the corresponding standard sample, which can quickly determine whether the neural network model will fail when facing the current type of perturbation, and thus accurately screen out the target perturbation sample for model robustness optimization.
[0021] Optionally, in one embodiment of this application, obtaining the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively includes:
[0022] Obtain the approximate function corresponding to the neural network model, wherein the approximate function is generated based on the constraint relationship of the sum of activations of neurons in each layer of the neural network model, and the constraint relationship of activation transfer between adjacent layers of neurons;
[0023] The target perturbation sample and the target standard sample are respectively input into the approximation function and passed back layer by layer to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively.
[0024] Based on the aforementioned technical means, this application embodiment constructs an approximation function corresponding to the neural network model by constraining the sum of activations of neurons in each layer and the constraint on activation transfer between adjacent layers of neurons. By inputting the target perturbation sample and the target standard sample into the approximation function and performing backpropagation layer by layer, the activation distribution information of each of the two samples can be quickly obtained.
[0025] Optionally, in one embodiment of this application, optimizing the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively includes:
[0026] Based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, the activation distribution difference information is determined.
[0027] The neural network model is optimized based on the activation distribution difference information.
[0028] Based on the aforementioned technical means, this application embodiment obtains the difference in activation distribution information between the target perturbation sample and the target standard sample by comparing their activation distribution information. This difference in activation distribution information reflects the differences in neuron activity when the neural network model predicts different samples. Using this as an explanation of the differences between the target perturbation sample and the target standard sample, the robustness of the model can be optimized in a targeted manner, thereby more effectively improving the robustness of the neural network model.
[0029] Optionally, in one embodiment of this application, optimizing the neural network model based on the activation distribution difference information includes:
[0030] Calculate the robustness error value based on the activation distribution difference information;
[0031] Based on the prediction information corresponding to the target perturbation sample and the target standard sample, the prediction difference information is determined, and the prediction error value corresponding to the neural network model is calculated based on the prediction error information.
[0032] The loss function value of the neural network model is calculated based on the robustness error value and the prediction error value, and the neural network model is optimized based on the loss function value.
[0033] Based on the aforementioned technical means, the embodiments of this application construct a loss function for the neural network model by combining a loss function reflecting the model's prediction error and a loss function reflecting the model's robustness optimization. Optimizing the neural network model through this combined function can improve both the model's prediction accuracy and its robustness.
[0034] Optionally, in one embodiment of this application, optimizing the neural network model based on the loss function value includes:
[0035] Determine whether the loss function value is less than or equal to a preset threshold;
[0036] If the loss function value is greater than the preset threshold, the neural network model is optimized based on the loss function value, and the steps of obtaining perturbation samples in the perturbation sample set and performing robustness testing on the neural network model based on the perturbation samples continue until the loss function value is less than or equal to the preset threshold.
[0037] Based on the above technical means, the embodiments of this application iteratively optimize the neural network model by perturbing the sample set, which can quickly converge the loss function value of the neural network model and improve the robustness of the neural network model.
[0038] A second aspect of this application provides an optimization apparatus for a neural network model, comprising:
[0039] The sample testing module is used to acquire perturbation samples in the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0040] The interpretation and analysis module is used to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively if the perturbation sample is the target perturbation sample. The target standard sample is the standard sample corresponding to the target perturbation sample. The activation distribution information is used to reflect the activation degree of each neuron when the neural network model performs backpropagation.
[0041] The model optimization module is used to optimize the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0042] A third aspect of this application provides a terminal device, the terminal device including a memory, a processor, and an optimization program for a neural network model stored in the memory and executable on the processor. When the processor executes the optimization program for the neural network model, it implements the steps of the neural network model optimization method as described in any of the preceding claims.
[0043] A fourth aspect of this application provides a computer-readable storage medium storing an optimization program for a neural network model. When executed by a processor, the optimization program for the neural network model implements the steps of the optimization method for the neural network model as described in any of the preceding claims.
[0044] The beneficial effects of this application are:
[0045] (1) In this embodiment, the target perturbation samples that cause the neural network model to make prediction errors are screened out through robustness testing, and the activation status of each neuron in the neural network model when predicting the target perturbation samples and the target standard samples is obtained by backpropagation layer by layer, so that the neural network model has interpretability. By analyzing the difference in neuron activation status under the target standard samples and the target perturbation samples, the robustness of the neural network model can be improved more effectively.
[0046] (2) The perturbation sample set in this application embodiment covers perturbation samples of different perturbation types, which can comprehensively test the robustness of the neural network model and discover input perturbations that will cause the performance of the neural network model to fail. Through multiple types of input perturbations, the robustness of the model can be evaluated more comprehensively, and performance problems of the model can be discovered, providing better analytical data for subsequent model optimization.
[0047] (3) In this embodiment, an approximation function corresponding to the neural network model is constructed by the constraint relationship of the sum of activations of neurons in each layer of the neural network model and the constraint relationship of activation transfer between adjacent layers of neurons. By inputting the target perturbation sample and the target standard sample into the approximation function and passing them back layer by layer, the activation distribution information of the two samples can be obtained quickly.
[0048] (4) In this embodiment of the application, the activation distribution information of the target perturbation sample and the target standard sample is compared to obtain the activation distribution difference information between the two. The activation distribution difference information can reflect the difference in the activity level of neurons when the neural network model predicts different samples. This can be used as the interpretation difference of the neural network model for the target perturbation sample and the target standard sample, and the robustness of the model can be optimized in a targeted manner, thereby more effectively improving the robustness of the neural network model.
[0049] (5) In this embodiment, the loss function of the neural network model is constructed by combining a loss function that reflects the model's prediction error and a loss function that reflects the model's robustness optimization. By optimizing the neural network model through this combined function, the model's prediction accuracy can be improved while its robustness is also enhanced.
[0050] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description
[0051] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:
[0052] Figure 1 This is a flowchart illustrating the optimization method for a neural network model according to an embodiment of this application.
[0053] Figure 2 This is a schematic diagram illustrating the operation of the neural network model optimization method according to an embodiment of this application;
[0054] Figure 3 This is a robustness testing framework diagram for the neural network model in an embodiment of this application;
[0055] Figure 4 This is a schematic diagram illustrating the principle of the explainable technology in the embodiments of this application;
[0056] Figure 5 This is a schematic diagram of the modules of the neural network model optimization device according to an embodiment of this application;
[0057] Figure 6 This is a block diagram illustrating the internal structure of a terminal device provided in an embodiment of this application. Detailed Implementation
[0058] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.
[0059] The following description, with reference to the accompanying drawings, illustrates a method, apparatus, terminal, and storage medium for optimizing a neural network model according to embodiments of this application. Addressing the problem mentioned in the background section that related technologies using input perturbation-based model optimization methods struggle to effectively improve the robustness of neural network models, this application provides a method for optimizing a neural network model. In this method, perturbation samples are acquired from a perturbation sample set; the neural network model is then subjected to a robustness test based on these perturbation samples; and the robustness test results are used to determine whether the perturbation sample is a target perturbation sample. If the perturbation sample is the target perturbation sample, activation distribution information corresponding to both the target perturbation sample and a target standard sample is acquired. The target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information reflects the activation level of each neuron during backpropagation. The neural network model is then optimized based on the activation distribution information corresponding to both the target perturbation sample and the target standard sample. This application obtains the activation status of each neuron through layer-by-layer backpropagation, thereby enhancing the interpretability of the neural network model. By analyzing the differences in neuron activation under standard and perturbed samples, the robustness of neural network models can be improved more effectively.
[0060] Specifically, Figure 1 This is a flowchart illustrating a method for optimizing a neural network model provided in an embodiment of this application.
[0061] like Figure 1 As shown, the optimization method for this neural network model includes the following steps:
[0062] Step S100: Obtain the perturbation samples in the perturbation sample set, perform a robustness test on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0063] Specifically, this embodiment pre-constructs a perturbation sample set, which contains a certain number of perturbation samples. Each perturbation sample is a test sample obtained by applying a specific perturbation to a normal standard sample. The neural network model can be a data classification model, such as an image classification model. To improve the robustness of the neural network model, this embodiment needs to use the perturbation sample set to perform robustness testing on the neural network. In practical application scenarios, such as... Figure 2 As shown, the robustness of the neural network model is tested using perturbation samples (i.e., test data) from the perturbation sample set. The robustness test results corresponding to the perturbation samples are obtained, and the robustness test results can reflect the predictive stability of the neural network model to input perturbations. Through robustness testing, it can be found out what kind of perturbations the neural network model will fail to perform, and the corresponding perturbation samples can be used as target perturbation samples for subsequent model optimization processes.
[0064] In one embodiment, the method for generating the perturbation sample set includes:
[0065] Obtain several standard samples;
[0066] For each of the standard samples, at least one perturbation process is applied to the standard sample to obtain the perturbed sample corresponding to the standard sample. The types of perturbation processes include random input perturbation, input perturbation based on prior information, and input perturbation based on model inference.
[0067] The perturbation sample set is obtained based on the perturbation samples corresponding to all the standard samples.
[0068] Specifically, the perturbation sample set in this embodiment covers perturbation samples of different perturbation types, which can comprehensively test the robustness of the neural network model and identify input perturbations that cause the neural network model to fail. Each perturbation sample is generated by applying input perturbation to a standard sample and can contain various types of input perturbations, such as random input perturbations (i.e., input perturbations that do not require the reference sample itself); input perturbations based on prior information (i.e., input perturbations that require the data information contained in the reference sample itself); and input perturbations based on model inference (i.e., input perturbations whose noise can be iteratively optimized). This embodiment, through multiple types of input perturbations, can more comprehensively evaluate the robustness of the model and discover performance problems of the model, providing better analytical data for subsequent model optimization.
[0069] For example, such as Figure 3As shown, taking a data classification task as an example, assuming the neural network model is a data classification model, a robustness testing framework is pre-defined for it to conduct robustness testing. The robustness testing framework includes various data input perturbations, which are classified according to the type of input perturbation as follows: random input perturbations, input perturbations based on prior information, and input perturbations based on model inference.
[0070] Random input perturbation: Under natural conditions, input perturbation does not require reference to the data information contained in the sample itself. For example, it can be achieved through random noise, missing data, and distribution drift. Taking image classification task as an example, assuming it is an image classification model, random input perturbation can be achieved through operations such as "random image cropping", "random rotation", "image speckle noise", "Gaussian noise", "Gaussian blur", and "motion blur".
[0071] Input perturbation based on prior information: This refers to input perturbation that references the data information contained in the sample itself. For example, it can be achieved through different degrees of data style transformation. Taking image classification as an example, assuming it is an image classification model, input perturbation based on prior information can be achieved through operations such as "cartoon style transformation", "snow style transformation", and "rain and fog style transformation".
[0072] Input perturbation based on model inference: This involves applying small amounts of noise to the input, and this noise can be iteratively optimized. For example, it can be achieved through adversarial attacks. Taking image classification as an example, assuming an image classification model, input perturbation based on model inference can be achieved by generating adversarial attack samples, generating adversarial patch attack samples, etc.
[0073] In one embodiment, the step of performing a robustness test on the neural network model based on the perturbation sample, and determining whether the perturbation sample is a target perturbation sample based on the robustness test result, includes:
[0074] The perturbation sample is input into the neural network model to obtain the prediction information corresponding to the perturbation sample;
[0075] Obtain the prediction information of the standard sample corresponding to the perturbation sample;
[0076] If the prediction information corresponding to the perturbation sample and the standard sample are inconsistent, then the perturbation sample is determined to be the target perturbation sample.
[0077] Specifically, a perturbation sample is input into the neural network model to obtain the model's prediction based on that sample. This prediction is then compared to the model's prediction based on the corresponding standard sample to determine if the model will fail when faced with the current type of perturbation. If the two predictions differ, it indicates that the neural network model has low robustness to the current type of perturbation, and the perturbation sample is used as the target perturbation sample for subsequent robustness optimization. If the two predictions are the same, it indicates that the neural network model has high robustness to the current type of perturbation, and the perturbation sample does not need to be used for robustness optimization.
[0078] For example, firstly, regarding the standard sample... Apply the above-mentioned anomalous perturbation to generate perturbation samples. Among them, c i =1,2,3,…,N, where N is a positive integer. Then use... Perform robustness testing on the neural network model F(x). If Then the perturbation sample As the target perturbation sample, the robust optimization pair consisting of the target perturbation sample and its corresponding standard sample is recorded. in, Perturbation sample The corresponding true label, i.e., the perturbation sample Corresponding standard samples The prediction information.
[0079] Step S200: If the perturbation sample is the target perturbation sample, then obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation.
[0080] Specifically, the target perturbation sample is a perturbation sample that causes the neural network model to fail during testing. The standard sample corresponding to the target perturbation sample is used as the target standard sample. Interpretability analysis of the neural network model is performed on both the target perturbation sample and the target standard sample to obtain the interpretability results for each sample. In this embodiment, the interpretability results mainly consist of the activation level of each neuron in each layer of the neural network model during backpropagation under the target perturbation sample / target standard sample conditions, i.e., the activation level distribution information. The activation level distribution information reflects the activity level of different neurons in the neural network model during prediction. Therefore, using the activation level distribution information of the target perturbation sample and the target standard sample for robust optimization of the neural network model will have a stronger guiding role.
[0081] For example, let the target perturbation sample be x', and its corresponding target standard sample be x. The robust optimization pair composed of the target perturbation sample and the target standard sample is denoted as (x', x). Interpretability analysis is performed to obtain the sample interpretation descriptions corresponding to the target perturbation sample and the target standard sample, that is, the activation distribution information, which is used as a guide for the optimization process of the neural network model.
[0082] In one embodiment, obtaining the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively includes:
[0083] Obtain the approximate function corresponding to the neural network model, wherein the approximate function is generated based on the constraint relationship of the sum of activations of neurons in each layer of the neural network model, and the constraint relationship of activation transfer between adjacent layers of neurons;
[0084] The target perturbation sample and the target standard sample are respectively input into the approximation function and passed back layer by layer to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively.
[0085] Specifically, to facilitate interpretability analysis of the target perturbation sample and the target standard sample, and to explore the reasons for prediction errors in the neural network model, this embodiment pre-constructs an approximation function corresponding to the neural network model based on the constraint relationship of the sum of activations of neurons in each layer of the neural network model, as well as the constraint relationship of activation transfer between neurons in adjacent layers. In practical applications, by inputting the target perturbation sample and the target standard sample into the approximation function and performing backpropagation layer by layer, the activation status of each neuron in each layer when the neural network model predicts the two samples can be quickly obtained, thus obtaining the activation distribution information of each of the two samples.
[0086] For example, such as Figure 4 As shown, a robust optimization pair consisting of target perturbed samples and target standard samples is optimized by backpropagating activation values layer by layer. Perform interpretability analysis on the neural network. Assume the l-th layer has V(l) neurons, denoted by the vector z. Assuming each neuron vector in each layer Each has an activation level. Correspondingly, d represents the d-th neuron in the l-th layer, therefore Figure 4 R represents activation level. i R represents the i-th neuron in the l-th layer. j This represents the j-th neuron in the (l+1)-th layer. In practical applications, activation can also be defined as a correlation coefficient, and activation distribution information can be defined as interpretive results or sample explanation information.
[0087] The activation levels of all neurons in each layer should satisfy the following equation:
[0088]
[0089] The activation transfer relationship between two adjacent neuronal layers satisfies the following equation:
[0090]
[0091] Where l represents the l-th layer, i represents the i-th neuron in the l-th layer, l+1 represents the l+1-th layer (i.e., the layer below the l-th layer), and k represents the k-th neuron in the l+1-th layer.
[0092] Under the constraints of the above two equations, performing a Taylor series expansion on the neural network F(x) at x0, i.e., F(x0) = 0, yields the approximate function as shown in the following equation:
[0093]
[0094] Where D is the first reciprocal.
[0095] Robustness optimization The above interpretability analysis is performed by inputting the target perturbation sample and the target standard sample into the approximation function, and comparing the activation differences in the input layer and intermediate layers. The specific layers compared can be adjusted according to the actual situation. The activation distribution information of the robust optimization pair is denoted as […]. Where j = 1, 2, 3, ..., M, M is a positive integer. This completes the analysis of the robustness problem and leaves it to subsequent steps for iterative optimization of robustness.
[0096] Step S300: Optimize the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively.
[0097] Specifically, activation distribution information can reflect the activity level of different neurons in a neural network model when making predictions. Therefore, combining the activation distribution information of the target perturbation sample and the target standard sample for robustness optimization of the neural network model will have a stronger guiding role and can better improve the robustness of the neural network model.
[0098] In one embodiment, optimizing the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively includes:
[0099] Based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, the activation distribution difference information is determined.
[0100] The neural network model is optimized based on the activation distribution difference information.
[0101] Specifically, this embodiment uses model interpretability techniques to obtain the activation levels of each neuron in the neural network model under the target perturbation sample / target standard sample, i.e., activation level distribution information. By comparing the activation level distribution information of the target perturbation sample and the target standard sample, the difference in activation level distribution between the two can be obtained. The difference in activation level distribution information can reflect the differences in the activity level of neurons when the neural network model predicts different samples, thus serving as the interpretative difference of the neural network model for the target perturbation sample and the target standard sample. The activation level distribution difference information allows for targeted optimization of the model's robustness, thereby more effectively improving the robustness of the neural network model.
[0102] In one embodiment, optimizing the neural network model based on the activation distribution difference information includes:
[0103] Calculate the robustness error value based on the activation distribution difference information;
[0104] Based on the prediction information corresponding to the target perturbation sample and the target standard sample, the prediction difference information is determined, and the prediction error value corresponding to the neural network model is calculated based on the prediction error information.
[0105] The loss function value of the neural network model is calculated based on the robustness error value and the prediction error value, and the neural network model is optimized based on the loss function value.
[0106] Specifically, in this embodiment, the loss function of the neural network model actually includes two loss functions: one reflecting the model's prediction error and the other reflecting the model's robustness optimization. Optimizing the neural network model using this combined function can improve both prediction accuracy and robustness. In practical applications, the prediction information of the target perturbation sample and the target standard sample is input into the loss function used to calculate the model's prediction error to obtain the prediction error value. Similarly, the activation distribution information of the target perturbation sample and the target standard sample is input into the loss function used to calculate the model's robustness error to obtain the robustness error value. The loss function value of the neural network model can be calculated using both the robustness error value and the prediction error value, and the neural network model can then be iteratively optimized based on this loss function value.
[0107] For example, robust optimization pairs consisting of target perturbation samples and target standard samples. Interpretability analysis was performed to obtain activation distribution information. Robust iterative optimization is performed on the neural network model. Interpretability analysis reveals the regions (i.e., relevance regions) where the neural network model exhibits different activation levels when predicting target perturbation samples and target standard samples. These regions are the areas the neural network model focuses on during prediction, thus their features have stronger guiding significance. The goal of this embodiment is to limit the influence intensity of relevance regions, forcing the neural network model to focus on the correct relevance regions, thereby optimizing the neural network model.
[0108] First, construct the robust optimization objective function, as shown in the following equation:
[0109]
[0110] in, These are trainable parameters, and their strength can be adjusted to control the intensity of the key components of the neural network model.
[0111] Then, construct the loss function L of the neural network model. all As shown in the following formula:
[0112]
[0113] By minimizing the loss function L all This enables the optimization of the robustness performance of neural network models.
[0114] In one embodiment, optimizing the neural network model based on the loss function value includes:
[0115] Determine whether the loss function value is less than or equal to a preset threshold;
[0116] If the loss function value is greater than the preset threshold, the neural network model is optimized based on the loss function value, and the steps of obtaining perturbation samples in the perturbation sample set and performing robustness testing on the neural network model based on the perturbation samples continue until the loss function value is less than or equal to the preset threshold.
[0117] Specifically, the preset threshold can be determined based on training requirements. The training objective of the neural network is to converge the loss function value to the preset threshold. During model optimization, if the loss function value calculated in the current round is greater than the preset threshold, it indicates that the loss function value has not converged to the preset threshold, and the robustness of the neural network model has not met the standard. Model optimization needs to continue, so a new perturbation sample is extracted from the perturbation sample set to continue a new round of model optimization. If the loss function value calculated in the current round is less than or equal to the preset threshold, it indicates that the loss function value has converged to the preset threshold, and the robustness of the neural network model has met the standard. Then, model optimization stops, and the optimized neural network model is obtained.
[0118] In one embodiment, the neural network model can be an autonomous driving perception neural network; the model input data can be vehicle perception data, such as image data or radar data; the model output data can be autonomous driving assistance information, such as target positioning information, target recognition information, and overall image classification information.
[0119] In summary, the advantages of this application are:
[0120] (1) In this embodiment, the target perturbation samples that cause the neural network model to make prediction errors are screened out through robustness testing, and the activation status of each neuron in the neural network model when predicting the target perturbation samples and the target standard samples is obtained by backpropagation layer by layer, so that the neural network model has interpretability. By analyzing the difference in neuron activation status under the target standard samples and the target perturbation samples, the robustness of the neural network model can be improved more effectively.
[0121] (2) The perturbation sample set in this application embodiment covers perturbation samples of different perturbation types, which can comprehensively test the robustness of the neural network model and discover input perturbations that will cause the performance of the neural network model to fail. Through multiple types of input perturbations, the robustness of the model can be evaluated more comprehensively, and performance problems of the model can be discovered, providing better analytical data for subsequent model optimization.
[0122] (3) In this embodiment, an approximation function corresponding to the neural network model is constructed by the constraint relationship of the sum of activations of neurons in each layer of the neural network model, and the constraint relationship of activation transfer between adjacent layers of neurons. By inputting the target perturbation sample and the target standard sample into the approximation function, the activation distribution information of the two samples can be obtained quickly.
[0123] (4) In this embodiment of the application, the activation distribution information of the target perturbation sample and the target standard sample is compared to obtain the activation distribution difference information between the two. The activation distribution difference information can reflect the difference in the activity level of neurons when the neural network model predicts different samples. This can be used as the interpretation difference of the neural network model for the target perturbation sample and the target standard sample, and the robustness of the model can be optimized in a targeted manner, thereby more effectively improving the robustness of the neural network model.
[0124] (5) In this embodiment, the loss function of the neural network model is constructed by combining a loss function that reflects the model's prediction error and a loss function that reflects the model's robustness optimization. By optimizing the neural network model through this combined function, the model's prediction accuracy can be improved while its robustness is also enhanced.
[0125] Next, the optimization apparatus for the neural network model proposed according to the embodiments of this application is described with reference to the accompanying drawings.
[0126] like Figure 5 As shown, the optimization device 10 for the neural network model includes: a sample testing module 100, an interpretation and analysis module 200, and a model optimization module 300.
[0127] Specifically, the sample testing module 100 is used to acquire perturbation samples in the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0128] The interpretation and analysis module 200 is used to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively if the perturbation sample is the target perturbation sample, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation;
[0129] The model optimization module 300 is used to optimize the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0130] In one embodiment, the sample testing module 100 includes:
[0131] The sample acquisition unit is used to acquire several standard samples.
[0132] A sample processing unit is configured to perform at least one perturbation process on each of the standard samples to obtain the perturbed sample corresponding to the standard sample, wherein the types of perturbation processes include random input perturbation, input perturbation based on prior information, and input perturbation based on model inference.
[0133] The sample aggregation unit is used to obtain the perturbation sample set based on the perturbation samples corresponding to all the standard samples.
[0134] In one embodiment, the sample testing module 100 includes:
[0135] The model prediction unit is used to input the perturbation sample into the neural network model to obtain the prediction information corresponding to the perturbation sample;
[0136] An information acquisition unit is used to acquire prediction information of the standard sample corresponding to the perturbation sample;
[0137] An information comparison unit is used to determine that the perturbation sample is the target perturbation sample if the prediction information corresponding to the perturbation sample and the standard sample are inconsistent.
[0138] In one embodiment, the interpretation and analysis module 200 includes:
[0139] The function acquisition unit is used to acquire the approximate function corresponding to the neural network model, wherein the approximate function is generated based on the constraint relationship of the sum of activations of neurons in each layer of the neural network model, and the constraint relationship of activation transmission between adjacent neurons.
[0140] The layer-by-layer reverse propagation unit is used to input the target perturbation sample and the target standard sample into the approximation function and perform layer-by-layer reverse propagation to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively.
[0141] In one embodiment, the model optimization module 300 includes:
[0142] The difference analysis unit is used to determine the difference information of activation distribution based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0143] The model optimization unit is used to optimize the neural network model based on the activation distribution difference information.
[0144] In one embodiment, the model optimization unit includes:
[0145] A robustness error analysis unit is used to calculate robustness error values based on the activation distribution difference information;
[0146] The prediction error analysis unit is used to determine the prediction difference information based on the prediction information corresponding to the target perturbation sample and the target standard sample, and to calculate the prediction error value corresponding to the neural network model based on the prediction error information.
[0147] The error comprehensive analysis unit is used to calculate the loss function value of the neural network model based on the robustness error value and the prediction error value, and to optimize the neural network model based on the loss function value.
[0148] In one embodiment, the error comprehensive analysis unit includes:
[0149] A threshold comparison unit is used to determine whether the loss function value is less than or equal to a preset threshold.
[0150] An iterative optimization unit is configured to optimize the neural network model based on the loss function value if the loss function value is greater than the preset threshold, and continue to execute the steps of obtaining perturbation samples in the perturbation sample set and performing robustness testing on the neural network model based on the perturbation samples, until the loss function value is less than or equal to the preset threshold.
[0151] It should be noted that the explanation of the aforementioned embodiment of the optimization method for the neural network model also applies to the optimization device for the neural network model in this embodiment, and will not be repeated here.
[0152] Figure 6 A schematic diagram of the structure of a terminal device provided in an embodiment of this application. The terminal device may include:
[0153] The memory 601, the processor 602, and the computer program stored on the memory 601 and capable of running on the processor 602.
[0154] When processor 602 executes the program, it implements the optimization method for the neural network model provided in the above embodiments:
[0155] Obtain perturbation samples from the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0156] If the perturbation sample is the target perturbation sample, then the activation distribution information corresponding to the target perturbation sample and the target standard sample is obtained, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation;
[0157] The neural network model is optimized based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0158] Furthermore, the terminal equipment also includes:
[0159] Communication interface 603 is used for communication between memory 601 and processor 602.
[0160] The memory 601 is used to store computer programs that can run on the processor 602.
[0161] The memory 601 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.
[0162] If the memory 601, processor 602, and communication interface 603 are implemented independently, then the communication interface 603, memory 601, and processor 602 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.
[0163] Optionally, in a specific implementation, if the memory 601, processor 602, and communication interface 603 are integrated on a single chip, then the memory 601, processor 602, and communication interface 603 can communicate with each other through an internal interface.
[0164] The processor 602 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.
[0165] This embodiment also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for optimizing the neural network model.
[0166] Obtain perturbation samples from the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results.
[0167] If the perturbation sample is the target perturbation sample, then the activation distribution information corresponding to the target perturbation sample and the target standard sample is obtained, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation;
[0168] The neural network model is optimized based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
[0169] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0170] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.
[0171] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.
[0172] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can read and execute instructions from or in conjunction with such an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). In addition, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically by optically scanning paper or other media, then editing, interpreting or otherwise processing them as necessary, and then storing them in computer memory.
[0173] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0174] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.
[0175] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0176] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.
Claims
1. A method for optimizing a neural network model, characterized in that, Includes the following steps: Obtain perturbation samples from the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results. If the perturbation sample is the target perturbation sample, then the activation distribution information corresponding to the target perturbation sample and the target standard sample is obtained, wherein the target standard sample is the standard sample corresponding to the target perturbation sample, and the activation distribution information is used to reflect the activation degree corresponding to each neuron when the neural network model performs backpropagation; The neural network model is optimized based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
2. The optimization method for the neural network model as described in claim 1, characterized in that, The method for generating the perturbation sample set includes: Obtain several standard samples; For each of the standard samples, at least one perturbation process is applied to the standard sample to obtain the perturbed sample corresponding to the standard sample. The types of perturbation processes include random input perturbation, input perturbation based on prior information, and input perturbation based on model inference. The perturbation sample set is obtained based on the perturbation samples corresponding to all the standard samples.
3. The optimization method for the neural network model as described in claim 1, characterized in that, The step of performing a robustness test on the neural network model based on the perturbation sample, and determining whether the perturbation sample is a target perturbation sample based on the robustness test results, includes: The perturbation sample is input into the neural network model to obtain the prediction information corresponding to the perturbation sample; Obtain the prediction information of the standard sample corresponding to the perturbation sample; If the prediction information corresponding to the perturbation sample and the standard sample are inconsistent, then the perturbation sample is determined to be the target perturbation sample.
4. The optimization method for the neural network model as described in claim 1, characterized in that, The step of obtaining the activation distribution information corresponding to the target perturbation sample and the target standard sample includes: Obtain the approximate function corresponding to the neural network model, wherein the approximate function is generated based on the constraint relationship of the sum of activations of neurons in each layer of the neural network model, and the constraint relationship of activation transfer between adjacent neurons. The target perturbation sample and the target standard sample are respectively input into the approximation function and backpropagated layer by layer to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively.
5. The optimization method for the neural network model as described in claim 1, characterized in that, The optimization of the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample includes: Based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, the activation distribution difference information is determined. The neural network model is optimized based on the activation distribution difference information.
6. The optimization method for the neural network model as described in claim 5, characterized in that, The optimization of the neural network model based on the activation distribution difference information includes: Calculate the robustness error value based on the activation distribution difference information; Based on the prediction information corresponding to the target perturbation sample and the target standard sample, the prediction difference information is determined, and the prediction error value corresponding to the neural network model is calculated based on the prediction error information. The loss function value of the neural network model is calculated based on the robustness error value and the prediction error value, and the neural network model is optimized based on the loss function value.
7. The optimization method for the neural network model as described in claim 6, characterized in that, The optimization of the neural network model based on the loss function value includes: Determine whether the loss function value is less than or equal to a preset threshold; If the loss function value is greater than the preset threshold, the neural network model is optimized based on the loss function value, and the steps of obtaining perturbation samples in the perturbation sample set and performing robustness testing on the neural network model based on the perturbation samples continue until the loss function value is less than or equal to the preset threshold.
8. An optimization device for a neural network model, characterized in that, include: The sample testing module is used to acquire perturbation samples in the perturbation sample set, perform robustness testing on the neural network model based on the perturbation samples, and determine whether the perturbation sample is the target perturbation sample based on the robustness test results. The interpretation and analysis module is used to obtain the activation distribution information corresponding to the target perturbation sample and the target standard sample respectively if the perturbation sample is the target perturbation sample. The target standard sample is the standard sample corresponding to the target perturbation sample. The activation distribution information is used to reflect the activation degree of each neuron when the neural network model performs backpropagation. The model optimization module is used to optimize the neural network model based on the activation distribution information corresponding to the target perturbation sample and the target standard sample, respectively.
9. A terminal device, characterized in that, The terminal device includes a memory, a processor, and an optimization program for a neural network model stored in the memory and executable on the processor. When the processor executes the optimization program for the neural network model, it implements the steps of the optimization method for the neural network model as described in any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an optimization program for a neural network model, which, when executed by a processor, implements the steps of the optimization method for the neural network model as described in any one of claims 1-7.