Adversarial sample generation method, device, terminal and readable storage medium

Abstract

The present invention discloses an adversarial sample generation method, device, terminal and readable storage medium, the method comprising: determining the target teacher model and target attack algorithm corresponding to the current sampling based on the adversarial sample generation strategy, performing reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, optimizing the adversarial sample generation strategy based on the intermediate adversarial sample, determining the adversarial sample participating in the student model training based on the intermediate adversarial sample, performing iterative reinforcement learning training based on the optimized adversarial sample generation strategy until the iterative stop condition is detected, and the iterative reinforcement learning training ends. Through the reinforcement learning algorithm, one or several attack algorithms with the greatest attack intensity and corresponding parameters are dynamically found for the current student model, and then adversarial samples containing difficult samples are efficiently generated for training the student model, which significantly improves the robustness of the model in the face of attacks while accelerating the model training.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a method, device, terminal and readable storage medium for generating adversarial samples. Background Art

[0002] At present, in the financial field, face verification is widely used in business, which brings great convenience. At the same time, this requires face verification to have extremely high accuracy and security. However, driven by interests, face verification business is extremely vulnerable to malicious attacks, and the means and methods of attack are also varied. In recent years, deep learning has developed very rapidly, and the current mainstream face recognition technology is basically based on deep learning technology. In the field of deep learning, there is a type of attack technology called adversarial attack, which generates new image samples (also called adversarial samples) as input by deliberately adding subtle interference that some people cannot perceive to the input samples, thereby causing the model to output wrong results with high confidence. For example: in the face verification business, the attacker forges adversarial samples to make the model recognize photos of two different people as the same person.

[0003] In addition to being vulnerable to adversarial attacks, existing models also have an increasing demand for computing resources (storage resources and computing power) while their accuracy has been greatly improved, making them difficult to deploy on mobile and embedded devices. Current methods lack an overall solution that takes both into account and efficiently solves them, resulting in long training times and poor robustness.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide an adversarial sample generation method, device, terminal and readable storage medium, aiming to solve the technical problem that in the existing integrated adversarial training process that takes into account both model compression and adversarial attacks, difficult samples cannot be generated efficiently, resulting in long model training time and poor robustness.

[0006] To achieve the above object, the present invention provides an adversarial sample generation method, which comprises the following steps:

[0007] Obtain an adversarial sample generation strategy, and determine a target teacher model and a target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy;

[0008] Performing reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, and optimizing the adversarial sample generation strategy based on the intermediate adversarial sample;

[0009] Determine adversarial samples participating in student model training based on the intermediate adversarial samples;

[0010] Iterative reinforcement learning training is performed based on the optimized adversarial sample generation strategy until the iterative stopping condition is detected and the iterative reinforcement learning training ends.

[0011] Furthermore, the step of performing reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample includes:

[0012] Using a targeted attack algorithm to generate intermediate adversarial samples based on the target teacher model;

[0013] The step of optimizing the adversarial sample generation strategy based on the intermediate adversarial sample comprises:

[0014] Calculating the probability of the intermediate adversarial sample breaking the student model, and determining a reward value based on the probability of breaking and the time of generating the intermediate adversarial sample;

[0015] Update the adversarial sample generation strategy based on the reward value.

[0016] Further, updating the adversarial sample generation strategy based on the reward value includes:

[0017] Based on the reward value, the controller is controlled to sample the use probability of each teacher model, the use probability and the use parameters of each attack algorithm next time;

[0018] The adversarial sample generation strategy is updated according to the next use probability of each teacher model, the use probability and use parameters of each attack algorithm.

[0019] Furthermore, determining the adversarial samples participating in the student model training based on the intermediate adversarial samples includes:

[0020] Obtaining reward values ​​corresponding to respective adversarial sample subsets in the intermediate adversarial sample, wherein the intermediate adversarial sample is composed of adversarial samples included in each adversarial sample subset;

[0021] Determine the reward values ​​of the selected preset number based on the reward values ​​corresponding to each subset of adversarial samples;

[0022] A subset of adversarial samples corresponding to each of the selected preset number of reward values ​​is determined as the adversarial samples participating in the student model training.

[0023] Furthermore, before the step of obtaining the adversarial sample generation strategy and determining the target teacher model and the target attack algorithm corresponding to the current sampling based on the adversarial sample generation strategy, the method further includes:

[0024] Training a preset intermediate teacher model based on local training data to obtain a trained teacher model, wherein the intermediate teacher model is a teacher model trained based on a public sample library;

[0025] The steps of obtaining an adversarial sample generation strategy and determining a target teacher model and a target attack algorithm corresponding to the current sampling based on the adversarial sample generation strategy include:

[0026] Based on the adversarial sample generation strategy, the target teacher model is determined in the trained teacher model, and the target attack algorithm is determined in the preset attack algorithm table.

[0027] Further, after the step of determining the adversarial samples participating in the student model training based on the intermediate adversarial samples, and performing iterative reinforcement learning training based on the optimized adversarial sample generation strategy until the iterative stop condition is detected and the iterative reinforcement learning training ends, the method further includes:

[0028] Based on the local training data, the adversarial sample and the trained teacher model, the student model is simultaneously subjected to distillation learning and adversarial training to obtain a total loss function value;

[0029] The knowledge of the teacher model is transferred to the student model through the total loss function value to obtain the student model after distillation adversarial.

[0030] Furthermore, the step of simultaneously performing distillation learning and adversarial training on the student model based on the local training data, the adversarial sample and the trained teacher model to obtain a total loss function value includes:

[0031] Inputting local training data into the teacher model and the student model respectively, optimizing the student model using a knowledge distillation algorithm, and determining the first loss function value;

[0032] Input the adversarial sample into the student model, and calculate the second loss function value according to the true label of the adversarial sample;

[0033] The total loss function value is obtained based on the first loss function value and the second loss function value.

[0034] Furthermore, the step of transferring the knowledge of the teacher model to the student model through the total loss function value to obtain the student model after distillation adversarial includes:

[0035] Based on the total loss function value, the gradient information corresponding to the student model is calculated using a back propagation algorithm;

[0036] Updating the student model based on the gradient information, and performing iterative distillation learning and adversarial training based on the updated student model;

[0037] If the updated total loss function value is less than or equal to a preset threshold, the student model after distillation adversarial is obtained.

[0038] Furthermore, before the step of initializing the adversarial sample generation strategy and determining the target teacher model and the target attack algorithm corresponding to the current sampling based on the adversarial sample generation strategy, the method further includes:

[0039] Determine a network architecture search space corresponding to the student model, wherein the search space defines a scope of the network architecture search;

[0040] Initialize the search strategy of the student model, search the search space based on the current search strategy, and obtain an initial student model;

[0041] A model evaluation index is determined, and a search strategy is updated based on the model evaluation index. The updated search strategy is used to continue searching for a new student model in the search space until a search stop condition is detected to obtain the student model.

[0042] Furthermore, the adversarial sample generating device comprises:

[0043] A determination module is used to obtain an initialization adversarial sample generation strategy, and determine a target teacher model and a target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy;

[0044] A reinforcement learning module, used to perform reinforcement learning based on the target teacher model and the target attack algorithm to obtain intermediate adversarial samples, and optimize the adversarial sample generation strategy based on the intermediate adversarial samples;

[0045] A generation module, used to determine adversarial samples participating in student model training based on the intermediate adversarial samples;

[0046] The iteration module is used to perform iterative reinforcement learning training based on the optimized adversarial sample generation strategy until the iteration stop condition is detected and the iterative reinforcement learning training ends.

[0047] In addition, to achieve the above-mentioned purpose, the present invention also provides an adversarial sample generation terminal, which includes: a memory, a processor, and an adversarial sample generation program stored on the memory and executable on the processor, and the adversarial sample generation program, when executed by the processor, implements the steps of any of the adversarial sample generation methods described above.

[0048] In addition, to achieve the above-mentioned purpose, the present invention also provides a readable storage medium, on which an adversarial sample generation program is stored. When the adversarial sample generation program is executed by a processor, the steps of any of the adversarial sample generation methods described above are implemented.

[0049] The present invention obtains an adversarial sample generation strategy, determines the target teacher model and target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy, and then performs reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, and optimizes the adversarial sample generation strategy based on the intermediate adversarial sample, and then determines the adversarial sample participating in the student model training based on the intermediate adversarial sample, and finally performs iterative reinforcement learning training based on the optimized adversarial sample generation strategy until the iterative stop condition is detected, and the iterative reinforcement learning training ends. Through the reinforcement learning algorithm, one or several attack algorithms with the greatest attack intensity and corresponding parameters are dynamically found for the current student model, and then adversarial samples containing difficult samples are efficiently generated for training the student model, which significantly improves the robustness of the model in the face of attacks while accelerating model training. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the structure of a terminal in a hardware operating environment involved in an embodiment of the present invention;

[0051] Figure 2 This is a flow chart of the first embodiment of the adversarial sample generation method of the present invention;

[0052] Figure 3 A schematic diagram of the process of reinforcement learning in an embodiment of the adversarial sample generation method of the present invention;

[0053] Figure 4 It is a schematic diagram of the process of distillation adversarial in an embodiment of the adversarial sample generation method of the present invention;

[0054] Figure 5 A schematic diagram of a process of neural structure search in an embodiment of the adversarial sample generation method of the present invention;

[0055] Figure 6 Schematic diagram of functional modules of an adversarial sample generation device embodiment of the present invention.

[0056] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0057] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0058] like Figure 1 As shown, Figure 1 It is a schematic diagram of the structure of a terminal in a hardware operating environment involved in an embodiment of the present invention.

[0059] like Figure 1 As shown, the terminal may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0060] Those skilled in the art will understand that Figure 1 The target detection system structure shown in the figure does not constitute a limitation on the terminal, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0061] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an adversarial sample generation program.

[0062] exist Figure 1 In the terminal shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the user end and communicate data with the user end; and the processor 1001 can be used to call the adversarial sample generation program stored in the memory 1005.

[0063] In this embodiment, the terminal includes: a memory 1005, a processor 1001, and an adversarial sample generation program stored in the memory 1005 and executable on the processor 1001, wherein when the processor 1001 calls the adversarial sample generation program stored in the memory 1005, the steps of the adversarial sample generation method provided in each embodiment of the present application are executed.

[0064] The present invention also provides a method for generating adversarial samples, referring to Figure 2 , Figure 2 Schematic diagram of the process of the first embodiment of the adversarial sample generation method of the present invention.

[0065] The embodiments of the present invention provide an embodiment of the adversarial sample generation method. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that shown here.

[0066] In this embodiment, the adversarial sample generation method includes:

[0067] Step S10, obtaining an adversarial sample generation strategy, and determining a target teacher model and a target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy;

[0068] In this embodiment, with the development of artificial intelligence technology, deep learning based on neural networks has achieved good performance in multiple machine learning tasks such as image classification, machine translation and speech recognition. At present, in order to obtain the best network model output results, a deep neural network model containing multiple network layers and ultra-large-scale parameters is usually used. Although this complex network structure significantly improves the output results of the model, it also makes it difficult to deploy on mobile devices with small storage space. On the other hand, it also causes the reasoning delay on low-power mobile devices with poor computing performance to be too large and difficult to have practical value. Therefore, the complex neural network model is efficiently compressed to reduce the model storage overhead and improve the model reasoning speed. For neural network model compression, commonly used methods include parameter quantization, matrix decomposition, model pruning and knowledge distillation. Among them, the knowledge distillation method can not only compress the model to reduce the complexity of the model, but also alleviate the problem of reduced prediction accuracy caused by model compression, becoming the current mainstream neural network model compression method.

[0069] In the knowledge distillation model compression method, the model with large-scale parameters and complex network structure is generally called the "teacher model", and the model with fewer parameters and relatively simple structure is called the "student model". By obtaining the output information of the teacher model in the middle layer of the network or the classification information of the output layer, the additional knowledge generated by the teacher model is used to guide the training of the student model. The training generally uses KL divergence, cross entropy, etc. as the optimization target of knowledge distillation. Knowledge distillation can be used to transform the network from a large network into a small network and retain performance close to that of the large network; it can also transfer the knowledge learned from multiple networks to one network, so that the performance of a single network is close to the integrated result.

[0070] The adversarial sample generation method proposed in the present invention is to transfer the knowledge learned by multiple teacher models to a student model. In the process of knowledge distillation, the reinforcement learning algorithm is used to dynamically find one or several attack algorithms with the strongest attack intensity and the corresponding parameters for the current student model, and then efficiently generate adversarial samples containing difficult samples for training the student model. While accelerating the generation of adversarial samples, the robustness of the model against attacks is significantly improved.

[0071] Specifically, the teacher model is used through the reinforcement learning algorithm to generate adversarial samples for student adversarial training. Figure 3 As shown, the adversarial sample generation strategy is referred to as sampling strategy S, which includes the probability of using each teacher model, the probability of using each attack algorithm, and the corresponding parameter selection of each attack algorithm. The sampling strategy S is obtained, and the probability of using each teacher model corresponding to the generated adversarial sample is determined according to the sampling strategy S, that is, the target teacher model for generating adversarial samples is determined, and the target attack algorithm is selected from the attack algorithm according to the probability of using the attack algorithm. Among them, the preset attack algorithms can be: FGSM (Fast Gradient Sign Method), PGD (e Projected Gradient Descent), BIM (Basic Iterative Method), CW attack (The Carlini and Wagner, CW attack), etc.

[0072] Step S20, performing reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, and optimizing the adversarial sample generation strategy based on the intermediate adversarial sample;

[0073] Specifically, step S20 includes:

[0074] Step S21, using a targeted attack algorithm to generate an intermediate adversarial sample based on the target teacher model;

[0075] In this embodiment, the specific process of using the target attack algorithm to generate intermediate adversarial samples using the target teacher model is as follows: each data in the local training data includes image data and the result label corresponding to the image data. The intermediate adversarial sample is obtained by adding a small disturbance data to the image data of the local training data. Let the image data be X, the adversarial sample be X', and the disturbance be η, then X'=X+η. Among them, the disturbance η is obtained using the target attack algorithm, and the model parameters of the target teacher model and the local training data are used as the input data of the target attack algorithm, and the optimal disturbance η is calculated using the target attack algorithm. The obtained disturbance data are respectively superimposed on each image data in the corresponding local training data, that is, X'=X+η, to obtain the intermediate adversarial sample.

[0076] It should be noted that the adversarial sample generation strategy includes N sub-strategies. Each sub-strategy consists of the probability of using each teacher model, the probability of using each attack algorithm, and parameters. The N sub-strategies will generate N groups of adversarial sample subsets. These N groups of adversarial sample subsets are intermediate adversarial samples.

[0077] Step S22, calculating the probability of the intermediate adversarial sample breaking the student model, and determining a reward value based on the probability of breaking and the time of generating the intermediate adversarial sample;

[0078] In this embodiment, the probability of breaking the current student model and the time to generate adversarial samples for each group of adversarial sample subsets are calculated, and a reward value R is obtained based on the probability of breaking and the time to generate intermediate adversarial samples. The higher the probability of breaking the student model, the shorter the time to generate adversarial samples, and the higher the reward value R, indicating that the strategy is more effective.

[0079] Step S23: updating the adversarial sample generation strategy based on the reward value.

[0080] Specifically, step S23 includes:

[0081] Step a, based on the reward value, controls the controller to sample the usage probability of each teacher model, the usage probability and usage parameters of each attack algorithm next time;

[0082] Step b: updating the adversarial sample generation strategy according to the probability of using each teacher model next time, the probability of using each attack algorithm and the usage parameters.

[0083] The controller RNN can be updated through the policy gradient method to update the anti-sample generation strategy. The policy gradient method is a commonly used algorithm in reinforcement learning. The policy gradient method directly optimizes the strategy. It directly back-propagates through observation information and directly enhances and weakens the possibility of the selected strategy through the reward value R. The strategy that can obtain a larger reward value R will increase the probability of being selected next time, and vice versa. Specifically, a strategy consists of the use probability of each teacher model, the use probability of each attack algorithm, and the corresponding parameters. The strategy that can obtain a larger reward value R will increase the probability of the teacher model used under this strategy, the probability of the corresponding attack algorithm, and the corresponding parameters. The specific process of updating the adversarial sample generation strategy using the reward value is: update the controller parameters according to the reward value to control the controller to update the use probability of each teacher model, the use probability of each attack algorithm, and the use parameters of the next sampling, and then further update the adversarial sample generation strategy according to the use probability of each teacher model, the use probability of each attack algorithm, and the use parameters of the next time.

[0084] Step S30, determining adversarial samples participating in student model training based on the intermediate adversarial samples;

[0085] Specifically, step S30 includes:

[0086] Step S31, obtaining reward values ​​corresponding to each adversarial sample subset in the intermediate adversarial sample, wherein the intermediate adversarial sample is composed of adversarial samples included in each adversarial sample subset;

[0087] In this embodiment, the adversarial sample generation strategy includes N sub-strategies, each of which is composed of the probability of using each teacher model, the probability of using each attack algorithm, and parameters. The N sub-strategies will generate N groups of adversarial sample subsets, which are intermediate adversarial samples. As mentioned above, the reward values ​​corresponding to each adversarial sample subset have been obtained based on the probability of each adversarial sample subset breaking the current student model and the time of generating the adversarial sample, which can be directly obtained.

[0088] Step S32, determining the reward values ​​of the selected preset number based on the reward values ​​corresponding to each adversarial sample subset;

[0089] Step S33, determining the adversarial sample subsets corresponding to the selected preset number of reward values ​​as adversarial samples participating in the student model training.

[0090] In this embodiment, the reward values ​​corresponding to each subset of adversarial samples are used to select some adversarial samples from all intermediate adversarial samples as adversarial samples participating in the training of the student model.

[0091] Specifically, evaluate the reward values ​​corresponding to each subset of adversarial samples, and select the best preset number of strategies. Because the higher the probability of breaking the student model, the shorter the time taken to generate adversarial samples, and the higher the reward value R, the more effective the strategy is. Therefore, when selecting the best reward value, a large reward value should be selected. A reward threshold can be set, and the adversarial sample subsets corresponding to k reward values ​​greater than the reward threshold are used as adversarial samples participating in student model training; or the reward values ​​are sorted from large to small, and the adversarial sample subsets corresponding to the first k reward values ​​are selected as adversarial samples participating in student model training.

[0092] Step S40, performing iterative reinforcement learning training based on the optimized adversarial sample generation strategy until an iterative stop condition is detected, and the iterative reinforcement learning training ends.

[0093] In this embodiment, the optimized adversarial sample generation strategy is used to continue to determine the new target teacher model and the target attack algorithm, and reinforcement learning is performed according to the new target teacher model and the new target attack algorithm to obtain a new intermediate adversarial sample. Based on the new intermediate adversarial sample, the adversarial sample generation strategy is updated, and the next sampling and generation of new intermediate adversarial samples are performed until the iterative stop condition is detected and the iterative reinforcement learning training ends. Among them, the iterative stop condition is: when the student model performs distillation learning and the adversarial training ends, a training stop message is sent. When the training stop message is detected, the iterative reinforcement learning training also ends.

[0094] like Figure 4 As shown, according to the reinforcement learning algorithm, multiple teacher models are used to generate adversarial samples participating in the student model training, and the student model is further distilled and adversarially trained using local training data and the generated adversarial samples to achieve the transfer of the knowledge of the teacher model to the student model, thereby obtaining a distilled adversarial student model.

[0095] Furthermore, in one embodiment, before step S10, the following steps are further included:

[0096] Step S50, determining a network architecture search space corresponding to the student model, wherein the search space defines a range of network architecture search;

[0097] Step S60, initializing the search strategy of the student model, searching in the search space based on the current search strategy, and obtaining an initial student model;

[0098] Step S70, determining a model evaluation index, and updating a search strategy based on the model evaluation index, and continuing to search for a new student model in the search space using the updated search strategy until a search stop condition is detected to obtain the student model.

[0099] In this embodiment, the network structure of the student model can adopt the design of some existing efficient networks, or another method can be adopted, that is, using NAS (neural structure search) to find a network model that is both efficient and secure. Common NAS methods include reinforcement learning, genetic learning, gradient-based optimization, etc. Figure 5 As shown in Figure 1, the principle of NAS is to search for the optimal network structure from a set of candidate neural network structures called search space using a specific strategy. The quality of the searched neural network structure is measured by classification accuracy, calculation speed, and the ability to defend against adversarial samples, which is called performance evaluation.

[0100] Furthermore, in each iteration of the search process, samples are sampled from the search space, that is, a neural network structure is obtained, which is called a sub-network. The sub-network is trained by the above distillation method, and the adversarial samples generated by the teacher model are used for integrated training. At the same time, the probability of the adversarial sample breaking the sub-network can be calculated. In the stage of searching the neural network structure, the lower the probability of breaking, the more robust the network structure is to the adversarial sample. The performance of the sub-network is comprehensively evaluated by combining indicators such as classification accuracy and calculation speed. The search strategy is updated based on these indicators to search for a new sub-network structure. This step is repeated until the optimal sub-network is found. Finally, a student model with fast calculation speed and robustness to adversarial samples can be obtained.

[0101] The adversarial sample generation method proposed in this embodiment obtains an adversarial sample generation strategy, determines the target teacher model and target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy, and then performs reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, and optimizes the adversarial sample generation strategy based on the intermediate adversarial sample, then determines the adversarial sample participating in the student model training based on the intermediate adversarial sample, and finally performs iterative reinforcement learning training based on the optimized adversarial sample generation strategy until the iterative stop condition is detected and the iterative reinforcement learning training ends. Through the reinforcement learning algorithm, one or several attack algorithms with the greatest attack intensity and corresponding parameters are dynamically found for the current student model, and then adversarial samples containing difficult samples are efficiently generated to train the student model, which significantly improves the robustness of the model to attacks while accelerating model training.

[0102] Based on the first embodiment, a second embodiment of the adversarial sample generation method of the present invention is proposed. In this embodiment, before step S10, the method further includes:

[0103] Step S80, training a preset intermediate teacher model based on local training data to obtain a trained teacher model, wherein the intermediate teacher model is a teacher model trained based on a public sample library;

[0104] In this embodiment, the teacher model and the initial student model are first determined, wherein the student model can adopt a designed streamlined, low-computation and efficient network structure, such as squeezenet, mobilenet, shufflenet, etc.; or the neural architecture search (NAS) method can be used to automatically find the network structure.

[0105] Furthermore, one or more complex network recognition models (such as facenet, arcface, etc. in face recognition; such as Inception, VGG, Resnet, etc. in image classification) are obtained as teacher models, such as teacher model 1, ..., teacher model N. The initial teacher model is trained using a public sample library to obtain an intermediate teacher model. The public sample library is selected according to actual conditions, such as the MegaFace dataset. The intermediate teacher model is tested using local training data. If the test fails, the intermediate teacher model is further trained using local training data to obtain a trained teacher model to ensure that the prediction output of the teacher model is consistent when the same training data is input.

[0106] The step S10 includes: determining the target teacher model in the trained teacher models based on the adversarial sample generation strategy, and determining the target attack algorithm in a preset attack algorithm table.

[0107] In this embodiment, there are multiple trained teacher models, and a target teacher model is determined among the trained teacher models according to an adversarial sample generation strategy; there are also multiple preset attack algorithms, and the target attack algorithm is determined in a preset attack algorithm table according to the adversarial sample generation strategy.

[0108] Furthermore, in one embodiment, after step S40, the following steps are further included:

[0109] Step S90, performing distillation learning and adversarial training on the student model simultaneously based on the local training data, the adversarial sample and the trained teacher model to obtain a total loss function value;

[0110] The total loss function value is the sum of a first loss function value and a second loss function value, wherein the first loss function value is determined based on local training data, and the second loss function value is determined based on the adversarial sample.

[0111] Specifically, step S90 includes:

[0112] Step S91, inputting the local training data into the teacher model and the student model respectively, optimizing the student model using a knowledge distillation algorithm, and determining the first loss function value;

[0113] The local training data is input into the teacher model and the student model respectively. The teacher model outputs the prediction results and intermediate results (intermediate feature data). The prediction output of the teacher network is divided by the temperature parameter (Temperature, T) and then softmax transformed to obtain a softened (relatively gentle) probability distribution (soft label, soft target). The hard target (hard label) is the true label of the local training data, which can be represented by a one-hot vector. The total loss function value can be expressed as:

[0114]

[0115] Among them, Q s represents the predicted output of the student model, and They represent the soft target values ​​of the student model and the teacher model predicted output divided by the temperature parameter and then subjected to softmax transformation. Fce and Fkd represent the cross entropy loss and Kullback-Leibler divergence Loss, respectively. α is used to adjust F ce and F kd The weight ratio between them, T is the temperature parameter.

[0116] At the same time, we can also introduce the feature map in the middle of the teacher model network and the feature map of the corresponding student model, and calculate the L2 loss between the two feature maps to speed up the training of the student network and improve the distillation effect. At this time, the total loss function value can be expressed as:

[0117]

[0118] F l2 represents the L2 loss function value, Ws and Wt represent the feature graphs of the corresponding student model and teacher model. It should be noted that the loss function value of the middle feature graph is optional. If this item is not needed, β is 0.

[0119] Step S92, inputting the adversarial sample into the student model, and calculating the second loss function value according to the true label of the adversarial sample;

[0120] In this embodiment, after generating adversarial samples participating in the generation of student adversarial samples using a teacher model according to a reinforcement learning algorithm, the adversarial samples are input into the student model, and the loss function value is determined based on the true label of the adversarial samples, so that the student model can make correct outputs for the adversarial samples.

[0121] Step S93: Obtain the total loss function value based on the first loss function value and the second loss function value.

[0122] In this embodiment, the total loss function value is equal to the sum of the first loss function value and the second loss function value, and the total loss function value is used to transfer the knowledge of the teacher model to the student model.

[0123] Step S100, transferring the knowledge of the teacher model to the student model through the total loss function value to obtain the student model after distillation adversarial.

[0124] Specifically, step S100 includes:

[0125] Step S110, based on the total loss function value, using a back propagation algorithm to calculate the gradient information corresponding to the student model;

[0126] Step S120, updating the student model based on the gradient information, and performing iterative distillation learning and adversarial training based on the updated student model;

[0127] Step S130: If the updated total loss function value is less than or equal to a preset threshold, the student model after distillation adversarial is obtained.

[0128] In this embodiment, in each round of training, the total loss function value (loss) of this round is calculated, and the gradient information corresponding to the student model is calculated and determined using the back propagation algorithm according to the total loss function value, and an optimization algorithm (such as SGD, Stochastic Gradient Descent, stochastic gradient algorithm) is selected to update the student model parameter value. When the preset training round is reached or the loss value is lower than the preset value, the training process ends, and the student model after distillation adversarial training is obtained.

[0129] Specifically, according to the total loss function value, the back propagation algorithm is used to calculate the gradient information corresponding to the student model, the student model is updated according to the gradient information, and iterative distillation learning and adversarial training are performed according to the updated student model. When the updated total loss function value is less than or equal to the preset threshold, the iteration is stopped to obtain the student model after distillation adversarial. For example, the preset value can be 0.001. After multiple iterations, the total loss function value will continue to decrease and then approach the preset threshold. The preset threshold is determined according to the actual situation and is generally a positive number close to 0. For example, when the stopping condition is the training round, the preset value can be 1000 times, or 20000 times, if the stopping condition is the loss value.

[0130] The adversarial sample generation method proposed in this embodiment dynamically finds one or several attack algorithms with the greatest attack intensity and the corresponding parameters for the current student model through a reinforcement learning algorithm, and then efficiently generates adversarial samples containing difficult samples. It uses local training data, adversarial samples and teacher models to simultaneously perform distillation learning and adversarial training on the student model, taking into account both model compression and adversarial training, and significantly improving the robustness of the model to attacks while accelerating model training.

[0131] The present invention further provides an adversarial sample generation device, referring to Figure 6 , Figure 6 Schematic diagram of functional modules of an adversarial sample generation device embodiment of the present invention.

[0132] Determine module 10, obtain the initialization adversarial sample generation strategy, and determine the target teacher model and target attack algorithm corresponding to this sampling based on the adversarial sample generation strategy;

[0133] A reinforcement learning module 20, configured to perform reinforcement learning based on the target teacher model and the target attack algorithm to obtain an intermediate adversarial sample, and optimize the adversarial sample generation strategy based on the intermediate adversarial sample;

[0134] A generating module 30, configured to determine adversarial samples to be used in student model training based on the intermediate adversarial samples;

[0135] The iteration module 40 is used to perform iterative reinforcement learning training based on the optimized adversarial sample generation strategy until an iteration stop condition is detected and the iterative reinforcement learning training ends.

[0136] Furthermore, the reinforcement learning module 20 is also used for:

[0137] Using a targeted attack algorithm to generate intermediate adversarial samples based on the target teacher model;

[0138] The step of optimizing the adversarial sample generation strategy based on the intermediate adversarial sample comprises:

[0139] Calculating the probability of the intermediate adversarial sample breaking the student model, and determining a reward value based on the probability of breaking and the time of generating the intermediate adversarial sample;

[0140] Update the adversarial sample generation strategy based on the reward value.

[0141] Furthermore, the reinforcement learning module 20 is also used for:

[0142] Based on the reward value, the controller is controlled to sample the use probability of each teacher model, the use probability and the use parameters of each attack algorithm next time;

[0143] The adversarial sample generation strategy is updated according to the next use probability of each teacher model, the use probability and use parameters of each attack algorithm.

[0144] Furthermore, the generating module 30 is also used for:

[0145] Obtaining reward values ​​corresponding to respective adversarial sample subsets in the intermediate adversarial sample, wherein the intermediate adversarial sample is composed of adversarial samples included in each adversarial sample subset;

[0146] Determine the reward values ​​of the selected preset number based on the reward values ​​corresponding to each subset of adversarial samples;

[0147] A subset of adversarial samples corresponding to each of the selected preset number of reward values ​​is determined as the adversarial samples participating in the student model training.

[0148] Furthermore, the adversarial sample generating device further includes:

[0149] A training module, used to train a preset intermediate teacher model based on local training data to obtain a trained teacher model, wherein the intermediate teacher model is a teacher model trained based on a public sample library;

[0150] The determination module 10 is also used to determine the target teacher model in the trained teacher models based on the adversarial sample generation strategy, and to determine the target attack algorithm in a preset attack algorithm table.

[0151] Furthermore, the adversarial sample generating device further includes:

[0152] A distillation adversarial module, used to simultaneously perform distillation learning and adversarial training on the student model based on local training data, the adversarial sample and the trained teacher model to obtain a total loss function value;

[0153] A migration module is used to migrate the knowledge of the teacher model to the student model through the total loss function value to obtain the student model after distillation adversarial.

[0154] Furthermore, the distillation confrontation module is also used for:

[0155] Inputting local training data into the teacher model and the student model respectively, optimizing the student model using a knowledge distillation algorithm, and determining the first loss function value;

[0156] Input the adversarial sample into the student model, and calculate the second loss function value according to the true label of the adversarial sample;

[0157] The total loss function value is obtained based on the first loss function value and the second loss function value.

[0158] Furthermore, the distillation confrontation module is also used for:

[0159] Based on the total loss function value, the gradient information corresponding to the student model is calculated using a back propagation algorithm;

[0160] Updating the student model based on the gradient information, and performing iterative distillation learning and adversarial training based on the updated student model;

[0161] If the updated total loss function value is less than or equal to a preset threshold, the student model after distillation adversarial is obtained.

[0162] Furthermore, the adversarial sample generating device further includes:

[0163] A screening module, used to determine a network architecture search space corresponding to the student model, wherein the search space defines a scope of the network architecture search;

[0164] A search module, used to initialize the search strategy of the student model, search in the search space based on the current search strategy, and obtain an initial student model;

[0165] The update training module is used to determine the model evaluation index and update the search strategy based on the model evaluation index, and use the updated search strategy to continue searching for a new student model in the search space until the search stop condition is detected to obtain the student model.

[0166] In addition, an embodiment of the present invention further proposes a readable storage medium, on which an adversarial sample generation program is stored. When the adversarial sample generation program is executed by a processor, the steps of the adversarial sample generation method in the above-mentioned embodiments are implemented.

[0167] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0168] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0169] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a system device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0170] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for generating adversarial samples, applied to the field of face recognition, characterized in that: include: Training a preset intermediate teacher model based on local training data to obtain a trained teacher model, wherein the intermediate teacher model is a teacher model trained based on a public sample library, and each data in the local training data includes image data and a result label corresponding to the image data; Obtaining an initialization adversarial sample generation strategy, determining a target teacher model in the trained teacher models based on the adversarial sample generation strategy, and determining a target attack algorithm in a preset attack algorithm table; Generate an intermediate adversarial sample based on the target teacher model using a target attack algorithm, determine the adversarial sample participating in the student model training based on the intermediate adversarial sample, calculate the probability of the intermediate adversarial sample breaking the student model, and determine the reward value based on the probability of breaking and the time of generating the intermediate adversarial sample; Update the adversarial sample generation strategy based on the reward value; The step of updating the adversarial sample generation strategy based on the reward value includes: Based on the reward value, the controller is controlled to sample the usage probability of each teacher model, the usage probability and usage parameters of each attack algorithm next time; Update the adversarial sample generation strategy according to the next use probability of each teacher model, the use probability and use parameters of each attack algorithm; Iterative reinforcement learning training is performed based on the optimized adversarial sample generation strategy until the iterative stopping condition is detected and the iterative reinforcement learning training ends.

2. The adversarial sample generation method according to claim 1, characterized in that: The determining, based on the intermediate adversarial sample, the adversarial sample participating in the student model training comprises: Obtaining reward values ​​corresponding to respective adversarial sample subsets in the intermediate adversarial sample, wherein the intermediate adversarial sample is composed of adversarial samples included in each adversarial sample subset; Determine the reward values ​​of the selected preset number based on the reward values ​​corresponding to each subset of adversarial samples; A subset of adversarial samples corresponding to each of the selected preset number of reward values ​​is determined as the adversarial samples participating in the student model training.

3. The adversarial sample generation method according to claim 1, characterized in that: After the step of performing iterative reinforcement learning training based on the optimized adversarial sample generation strategy until an iterative stop condition is detected and the iterative reinforcement learning training ends, the method further includes: Based on the local training data, the adversarial sample and the trained teacher model, the student model is simultaneously subjected to distillation learning and adversarial training to obtain a total loss function value; The knowledge of the teacher model is transferred to the student model through the total loss function value to obtain the student model after distillation adversarial.

4. The adversarial sample generation method according to claim 3, characterized in that: The step of simultaneously performing distillation learning and adversarial training on the student model based on the local training data, the adversarial sample, and the trained teacher model to obtain a total loss function value comprises: Inputting local training data into the teacher model and the student model respectively, optimizing the student model using a knowledge distillation algorithm, and determining a first loss function value; Input the adversarial sample into the student model, and calculate a second loss function value according to the true label of the adversarial sample; The total loss function value is obtained based on the first loss function value and the second loss function value.

5. The adversarial sample generation method according to claim 3, characterized in that: The step of transferring the knowledge of the teacher model to the student model through the total loss function value to obtain the student model after distillation confrontation comprises: Based on the total loss function value, the gradient information corresponding to the student model is calculated using a back propagation algorithm; Updating the student model based on the gradient information, and performing iterative distillation learning and adversarial training based on the updated student model; If the updated total loss function value is less than or equal to a preset threshold, the student model after distillation adversarial is obtained.

6. The adversarial sample generation method according to any one of claims 1 to 5, characterized in that: Before the steps of obtaining the initialization adversarial sample generation strategy, determining the target teacher model in the trained teacher models based on the adversarial sample generation strategy, and determining the target attack algorithm in the preset attack algorithm table, the method further includes: Determine a network architecture search space corresponding to the student model, wherein the search space defines a scope of the network architecture search; Initialize the search strategy of the student model, search the search space based on the current search strategy, and obtain an initial student model; A model evaluation index is determined, and a search strategy is updated based on the model evaluation index. The updated search strategy is used to continue searching for a new student model in the search space until a search stop condition is detected to obtain the student model.

7. An adversarial sample generation device, applied to the field of face recognition, characterized in that: The adversarial sample generating device comprises: A determination module is provided to obtain an initialization adversarial sample generation strategy, determine a target teacher model in the trained teacher models based on the adversarial sample generation strategy, and determine a target attack algorithm in a preset attack algorithm table; A reinforcement learning module is used to generate intermediate adversarial samples based on the target teacher model using a target attack algorithm, calculate the probability of the intermediate adversarial samples breaking the student model, and determine the reward value based on the probability of breaking and the time of generating the intermediate adversarial samples; update the adversarial sample generation strategy based on the reward value, and the reinforcement learning module is specifically used to control the controller to sample the next use probability of each teacher model, the use probability of each attack algorithm and the use parameters based on the reward value; update the adversarial sample generation strategy according to the next use probability of each teacher model, the use probability of each attack algorithm and the use parameters; A generation module, used to determine adversarial samples participating in student model training based on the intermediate adversarial samples; An iteration module is used to perform iterative reinforcement learning training based on the optimized adversarial sample generation strategy until an iteration stop condition is detected and the iterative reinforcement learning training ends; Among them, the adversarial sample generation device includes: training a preset intermediate teacher model based on local training data to obtain a trained teacher model, wherein the intermediate teacher model is a teacher model trained based on a public sample library, and each data in the local training data includes image data and a result label corresponding to the image data.

8. An adversarial sample generation terminal, characterized in that: The terminal includes: a memory, a processor, and an adversarial sample generation program stored in the memory and executable on the processor. When the adversarial sample generation program is executed by the processor, the steps of the adversarial sample generation method according to any one of claims 1 to 7 are implemented.

9. A readable storage medium, characterized in that: The adversarial sample generation program is stored on the readable storage medium, and when the adversarial sample generation program is executed by the processor, the steps of the adversarial sample generation method according to any one of claims 1 to 7 are implemented.

Images