Adversarial sample detection method, device, equipment and computer calibration storage medium

Abstract

The present invention discloses an adversarial sample detection method, comprising the following steps: a first participant obtains a sample to be detected; inputs the sample to be detected into a main classifier in an adversarial sample detection model to obtain a main training result, and inputs the sample to be detected into a hash coding classifier in an adversarial sample detection model to obtain a hash training result; based on the main training result and the hash training result, determines whether the sample to be detected is an adversarial sample. The present invention also discloses an adversarial sample detection device, equipment and computer-readable storage medium. The present invention can directly detect the sample to be detected through an adversarial sample detection model without quantifying the sample to be detected, and ensures the integrity of the training data by using the original data for training; it can ensure the accuracy of the anti-model training results, and improve the accuracy and efficiency of adversarial sample detection.

Description

Technical Field

[0001] The present invention relates to the field of federated learning technology, and in particular to an adversarial sample detection method, device, equipment and computer-scale storage medium. Background Art

[0002] With the rapid development of artificial intelligence and deep learning, security issues in machine learning itself are constantly emerging. Adversarial sample attacks are a common form of attack in federated learning. Attackers use sample data with added noise (adversarial samples) to guide the model to make incorrect classifications, which can cause the machine to identify incorrect results and cause serious consequences.

[0003] At present, in order to detect adversarial samples, the method of quantizing input data is often used. By quantizing the input data to filter out noise, adversarial samples can be detected. However, the method of quantizing input data often causes inaccurate training results due to the changes in input data, which in turn leads to low accuracy of detection results.

[0004] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the present invention is to provide an adversarial sample detection method, device, equipment and computer-scale storage medium, aiming to solve the technical problem of low accuracy of existing model detection results for adversarial sample detection.

[0006] To achieve the above object, the present invention provides an adversarial sample detection method, which comprises the following steps:

[0007] The first participant obtains the sample to be tested;

[0008] Input the sample to be detected into the main classifier in the adversarial sample detection model to obtain a main training result, and input the sample to be detected into the hash code classifier in the adversarial sample detection model to obtain a hash training result;

[0009] Based on the main training result and the hash training result, determine whether the sample to be detected is an adversarial sample.

[0010] Furthermore, the step of determining whether the sample to be detected is an adversarial sample based on the main training result and the hash training result includes:

[0011] Determining whether the main training result matches the hash training result;

[0012] If the main training result does not match the hash training result, it is determined that the sample to be detected is an adversarial sample.

[0013] Furthermore, before the step of inputting the sample to be detected into the adversarial sample detection model to obtain the main training result corresponding to the main classifier and the hash training result corresponding to the hash code classifier, the adversarial sample detection method further includes:

[0014] Label the sample data to obtain a public label vector and a local label vector;

[0015] Determine a first public gradient based on the public label vector and the model to be trained, and determine a local gradient based on the local label vector and the model to be trained;

[0016] Sending the first common gradient to the coordinator, so that the coordinator determines and feeds back a global gradient based on the first common gradient;

[0017] A target gradient is determined based on the local gradient and the global gradient, and the adversarial sample detection model is determined based on the local gradient, the target gradient and the model to be trained.

[0018] Furthermore, the step of labeling the sample data to obtain a public label vector and a local label vector includes:

[0019] Labeling the sample data based on one-hot encoding to obtain a public label vector;

[0020] The sample data is labeled based on random hash coding to obtain a local label vector.

[0021] Furthermore, the step of determining the first public gradient based on the public label vector and the model to be trained, and determining the local gradient based on the local label vector and the model to be trained includes:

[0022] Input the public label vector into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector, and input the local label vector into the model to be trained for model training, as well as the local loss function value corresponding to the local label vector;

[0023] The first public gradient is determined based on the public loss function value, and the local gradient is determined based on the local loss function value.

[0024] Furthermore, the step of determining the adversarial sample detection model based on the local gradient, the target gradient and the model to be trained includes:

[0025] Based on the target gradient, the model parameters in the model to be trained are updated to obtain a target main classifier, and based on the local gradient, the model parameters in the model to be trained are updated to obtain a target hash code classifier;

[0026] Based on the target main classifier and the target hash code classifier, the adversarial sample detection model is determined.

[0027] Furthermore, the step of sending the first common gradient to the coordinator so that the coordinator determines and feeds back the global gradient based on the first common gradient includes:

[0028] The first common gradient is sent to a coordinator, wherein the coordinator obtains second common gradients sent by multiple second participants, determines a global gradient based on each second common gradient and the first common gradient, updates the global model of the coordinator based on the global gradient, and feeds back the global gradient to the first participants.

[0029] In addition, to achieve the above-mentioned purpose, the present invention further provides an adversarial sample detection device, the adversarial sample detection device comprising:

[0030] An acquisition module, used to acquire samples to be tested;

[0031] A training module, used for inputting the sample to be detected into a main classifier in the adversarial sample detection model to obtain a main training result, and inputting the sample to be detected into a hash coding classifier in the adversarial sample detection model to obtain a hash training result;

[0032] A determination module is used to determine whether the sample to be detected is an adversarial sample based on the main training result and the hash training result.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides an adversarial sample detection device, which includes: a memory, a processor, and an adversarial sample detection program stored in the memory and executable on the processor, and the adversarial sample detection program implements the steps of the aforementioned adversarial sample detection method when executed by the processor.

[0034] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which an adversarial sample detection program is stored, and when the adversarial sample detection program is executed by a processor, the steps of the aforementioned adversarial sample detection method are implemented.

[0035] The present invention obtains a sample to be detected by a first participant; then the sample to be detected is input into a main classifier in an adversarial sample detection model to obtain a main training result, and the sample to be detected is input into a hash code classifier in an adversarial sample detection model to obtain a hash training result, and then based on the main training result and the hash training result, it is determined whether the sample to be detected is an adversarial sample, and the adversarial sample detection model can be used to directly detect the sample to be detected without quantifying the sample to be detected, and the original data (sample to be detected) is used for training to ensure the integrity of the training data; the accuracy of the anti-model training results can be guaranteed, and the accuracy and efficiency of adversarial sample detection are improved. At the same time, by adding a hash code classifier to the adversarial sample detection model, the adversarial sample detection model is enhanced in its ability to distinguish attack samples; through the dual verification mode of the main classifier and the hash code classifier, the accuracy of adversarial sample detection is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the structure of an adversarial sample detection device in a hardware operating environment involved in an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the process of the first embodiment of the adversarial sample detection method of the present invention;

[0038] Figure 3 A schematic diagram of a scenario of an embodiment of an adversarial sample detection method of the present invention;

[0039] Figure 4 Schematic diagram of functional modules of an adversarial sample detection device according to an embodiment of the present invention.

[0040] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0041] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0042] like Figure 1 As shown, Figure 1 It is a schematic diagram of the structure of an adversarial sample detection device in a hardware operating environment involved in an embodiment of the present invention.

[0043] The adversarial sample detection device in the embodiment of the present invention can be a PC, or it can be a mobile terminal device with a display function, such as a smart phone, a tablet computer, an e-book reader, an MP3 (Moving Picture Experts Group Audio Layer III) player, an MP4 (Moving Picture Experts Group Audio Layer IV) player, or a portable computer.

[0044] like Figure 1 As shown, the adversarial sample detection device may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0045] Optionally, the adversarial sample detection device may also include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, etc. Among them, sensors such as light sensors, motion sensors and other sensors. Of course, the adversarial sample detection device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0046] Those skilled in the art will understand that Figure 1 The structure of the adversarial sample detection device shown in the figure does not constitute a limitation on the adversarial sample detection device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0047] like Figure 1 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an adversarial sample detection program.

[0048] exist Figure 1In the adversarial sample detection device shown, the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the user interface 1003 is mainly used to connect to the client (user end) and communicate data with the client; and the processor 1001 can be used to call the adversarial sample detection program stored in the memory 1005.

[0049] In this embodiment, the adversarial sample detection device includes: a memory 1005, a processor 1001, and an adversarial sample detection program stored in the memory 1005 and executable on the processor 1001, wherein the processor 1001 calls the adversarial sample detection program stored in the memory 1005 and executes the steps of the adversarial sample detection method in each of the following embodiments.

[0050] The present invention also provides a method for detecting adversarial samples, referring to Figure 2 , Figure 2 Schematic diagram of the process of the first embodiment of the adversarial sample detection method of the present invention.

[0051] In this embodiment, the adversarial sample detection method includes:

[0052] Step S100, the first participant obtains a sample to be tested;

[0053] In this embodiment, the first participant is a participant in federated learning, that is, the first participant is any one of all the participants in federated learning, and the sample to be detected is sample data that needs to be detected whether it is an adversarial sample.

[0054] Step S200, inputting the sample to be detected into the main classifier in the adversarial sample detection model to obtain a main training result, and inputting the sample to be detected into the hash code classifier in the adversarial sample detection model to obtain a hash training result;

[0055] It should be noted that the adversarial sample detection model is a detection model that has been trained through federated learning. The adversarial sample detection model includes a main classifier and a hash code classifier. Figure 3 , Figure 3 The one-hot encoding classifier in is the main classifier of the adversarial sample detection model, and the hash encoding classifier is a random hash encoding classifier. The adversarial sample detection model has two different outputs, one output is the output of the one-hot encoding classifier obtained by federal training using a public label vector (one-hot encoding label), and the other output is the output of the hash encoding classifier obtained by training using a local label vector (local random encoding).

[0056] In this embodiment, when the sample to be detected is obtained, the sample to be detected is input into the main classifier in the adversarial sample detection model for training to obtain the main training result, and the sample to be detected is input into the hash coding classifier in the adversarial sample detection model to obtain the hash training result.

[0057] Step S300: Determine whether the sample to be detected is an adversarial sample based on the main training result and the hash training result.

[0058] In this embodiment, when the main training results and the hash training results are obtained, it is determined whether the sample to be detected is an adversarial sample based on the main training results and the hash training results, thereby realizing the detection of the adversarial sample. Since there is no need to quantize the input data, that is, the sample to be detected is not quantized, the accuracy of the training results of the adversarial sample detection model can be guaranteed, thereby improving the accuracy of the detection results.

[0059] Further, in one embodiment, step S300 includes:

[0060] Step S310, determining whether the main training result matches the hash training result;

[0061] Step S320: If the main training result does not match the hash training result, it is determined that the sample to be detected is an adversarial sample.

[0062] In this embodiment, when determining whether the sample to be detected is an adversarial sample based on the main training result and the hash training result, it can be determined whether the main training result matches the hash training result, for example, whether the hash training result is within the preset range corresponding to the second classification result, or whether the difference (absolute value) between the main training result and the hash training result is less than the preset difference, or whether the main training result is consistent with the hash training result.

[0063] Then, if the main training result does not match the hash training result, the sample to be detected is determined to be an adversarial sample. When the main training result matches the hash training result, the sample to be detected is determined to be a non-adversarial sample, that is, a normal sample.

[0064] The adversarial sample detection method proposed in this embodiment obtains the sample to be detected by the first participant; then the sample to be detected is input into the main classifier in the adversarial sample detection model to obtain the main training result, and the sample to be detected is input into the hash code classifier in the adversarial sample detection model to obtain the hash training result, and then based on the main training result and the hash training result, it is determined whether the sample to be detected is an adversarial sample, and the adversarial sample detection model can be used to directly detect the sample to be detected without quantifying the sample to be detected, and the original data (sample to be detected) is used for training to ensure the integrity of the training data; the accuracy of the anti-model training results can be guaranteed, and the accuracy and efficiency of adversarial sample detection are improved. At the same time, by adding a hash code classifier to the adversarial sample detection model, the ability of the adversarial sample detection model to distinguish attack samples is enhanced; through the dual verification mode of the main classifier and the hash code classifier, the accuracy of adversarial sample detection is improved.

[0065] Based on the first embodiment, a second embodiment of the adversarial sample detection method of the present invention is proposed. In this embodiment, before step S200, the adversarial sample detection method further includes:

[0066] Step S400, labeling the sample data to obtain a public label vector and a local label vector;

[0067] Step S500, determining a first public gradient based on the public label vector and the model to be trained, and determining a local gradient based on the local label vector and the model to be trained;

[0068] Step S600, sending the first common gradient to the coordinator, so that the coordinator determines and feeds back a global gradient based on the first common gradient;

[0069] Step S700: determining a target gradient based on the local gradient and the global gradient, and determining the adversarial sample detection model based on the local gradient, the target gradient and the model to be trained.

[0070] In this embodiment, before detecting the sample to be detected through the adversarial sample detection model, it is necessary to perform model training on the adversarial sample detection model. Therefore, sample data is obtained and the obtained sample data is labeled to obtain a public label vector and a local label vector, wherein the public label vector is used for federal model (global model) training and the local label vector is used for local model training of the first participant.

[0071] Then, a first common gradient is determined based on the common label vector and the model to be trained, and a local gradient is determined based on the local label vector and the model to be trained. Specifically, the common label vector is input into the model to be trained for model training, so as to obtain the first common gradient through the training result corresponding to the common label vector, and the local label vector is input into the model to be trained for model training, so as to obtain the local gradient through the training result corresponding to the local label vector.

[0072] Next, the first common gradient is sent to the coordinator, so that the coordinator can determine and feedback the global gradient based on the first common gradient. In this embodiment, the coordinator is the coordinator in federated learning, which receives the gradients of each participant including the first participant, and determines the global gradient based on the gradients of each participant.

[0073] When receiving the global gradient fed back by the coordinator, the first participant determines the target gradient based on the local gradient and the global gradient. Specifically, the first participant fuses the local gradient with the global gradient to obtain the target gradient, for example, adding the local gradient to the global gradient (vector addition) to obtain the target gradient, or first obtaining the weight of the local gradient and the weight of the global gradient, then multiplying the local gradient by the weight of the local gradient to obtain the first result, multiplying the global gradient by the weight of the global gradient to obtain the second result, and adding the first result to the second result (vector addition) to obtain the target gradient. Then, based on the target gradient, determine the adversarial sample detection model to complete the training of the adversarial sample detection model.

[0074] The anti-sample detection model trained in this embodiment does not need to add additional constraints to the loss function of the phase neural network, which greatly reduces the complexity of model training and improves the training efficiency of the model.

[0075] Furthermore, in one embodiment, step S600 includes:

[0076] The first common gradient is sent to a coordinator, wherein the coordinator obtains second common gradients sent by multiple second participants, determines a global gradient based on each second common gradient and the first common gradient, updates the global model of the coordinator based on the global gradient, and feeds back the global gradient to the first participants.

[0077] The coordinator receives the first common gradient sent by the first participant, obtains the second common gradient sent by multiple second participants, the second participants are the other participants in the federated learning except the first participant, and determines the global gradient based on the second common gradients and the first common gradient. Specifically, the global gradient is obtained by adding the second common gradients and the first common gradient (vector addition), and the global gradient is fed back to the first participant. At the same time, the coordinator feeds back the global gradient to each second participant, and updates the global model of the coordinator based on the global gradient. Among them, the second common gradient is the gradient obtained by each second participant inputting the public label vector of the second participant into the model to be trained for training. The public label vector of the second participant is similar to the acquisition method of the public label vector of the first participant in this embodiment, which will not be repeated here.

[0078] The adversarial sample detection method proposed in this embodiment labels the sample data to obtain a public label vector and a local label vector, then determines a first public gradient based on the public label vector and the model to be trained, and determines a local gradient based on the local label vector and the model to be trained; then sends the first public gradient to the coordinator, so that the coordinator can determine and feedback the global gradient based on the first public gradient; then determines the target gradient based on the local gradient and the global gradient, and determines the adversarial sample detection model based on the local gradient, the target gradient and the model to be trained, which can realize the training of the adversarial sample detection model according to the public label vector and the local label vector, without adding additional constraints to the loss function of the phase neural network, greatly reducing the complexity of model training, improving the training efficiency of the model, facilitating the subsequent direct detection of the sample to be detected by the adversarial sample detection model, and without quantifying the sample to be detected, which can ensure the accuracy of the anti-model training results and improve the accuracy and efficiency of adversarial sample detection. At the same time, by adding a random hash coding classifier to the adversarial sample detection model, the adversarial sample detection model's ability to distinguish attack samples is enhanced.

[0079] Based on the second embodiment, a third embodiment of the adversarial sample detection method of the present invention is proposed. In this embodiment, step S400 includes:

[0080] Step S410, labeling the sample data based on one-hot encoding to obtain a public label vector;

[0081] Step S420: label the sample data based on random hash coding to obtain a local label vector.

[0082] In this embodiment, when the acquired sample data is labeled, the sample data is labeled based on one-hot encoding to obtain a public label vector. Specifically, the first participant and other participants in the federated learning use a unified one-hot encoding to label their own sample data. For example, a 5-classification data set, and the label of one class is a 5-dimensional vector (1, 0, 0, 0, 0), and the labels of the other four classes cannot be repeated, wherein the dimension of the public label vector depends on the classification problem category.

[0083] At the same time, the sample data is labeled based on random hash coding to obtain a local label vector, and the first participant and other participants in federated learning use random hash coding to label the sample data. For example, a 5-category dataset, the label of one category is a 6-dimensional vector (1, 0, 1, 1, 0, 0), and the labels of the other four categories cannot be repeated. It should be noted that the dimension of the random label is not limited by the total number of categories, and the label dimension can be greater than or equal to the total number of categories. Among them, the random hash coding is a local random hash coding, so the hash coding used by each participant is random, so that the random hash coding of each participant is basically different, and then the local gradients generated by each participant are different. It should be noted that the local random hash coding can no longer be changed after it is determined.

[0084] By labeling the sample data based on random hash codes, each type of data can be uniformly mapped into a hash code. For example, images of apples can be mapped into a hash value of (0, 1, 0, 1, 1, 0).

[0085] The adversarial sample detection method proposed in this embodiment labels the sample data based on one-hot encoding to obtain a public label vector; then labels the sample data based on random hash encoding to obtain a local label vector. The public label vector and the local label vector can be accurately obtained, which facilitates the training of the adversarial sample detection model based on the public label vector and the local label vector. There is no need to add additional constraints to the loss function of the neural network, which greatly reduces the complexity of model training and improves the training efficiency of the model.

[0086] Based on the first embodiment, a third embodiment of the adversarial sample detection method of the present invention is proposed. In this embodiment, step S500 includes:

[0087] Step S510, inputting the public label vector into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector, and inputting the local label vector into the model to be trained for model training, as well as the local loss function value corresponding to the local label vector;

[0088] Step S520: determining the first public gradient based on the public loss function value, and determining the local gradient based on the local loss function value.

[0089] In this embodiment, when the public label vector and the local label vector are obtained, the public label vector and the local label vector are respectively input into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector and the local loss function value corresponding to the local label vector. Among them, the public loss function value can be a mean square estimation loss function or a cross entropy loss function, and the local loss function value can be a mean square estimation loss function, a cross entropy loss function or a polarization loss function. Then, the first public gradient is determined based on the public loss function value, and the local gradient is determined based on the local loss function value.

[0090] The adversarial sample detection method proposed in this embodiment, by inputting the public label vector into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector, and inputting the local label vector into the model to be trained for model training, as well as the local loss function value corresponding to the local label vector; then determining the first public gradient based on the public loss function value, and determining the local gradient based on the local loss function value, can accurately obtain the first public gradient and the local gradient through model training, thereby further improving the efficiency of anti-sample detection model training.

[0091] Based on the second embodiment, a fourth embodiment of the adversarial sample detection method of the present invention is proposed. In this embodiment, step S700 includes:

[0092] Step S710, updating the model parameters in the model to be trained based on the target gradient to obtain a target main classifier, and updating the model parameters in the model to be trained based on the local gradient to obtain a target hash code classifier;

[0093] Step S720: determining the adversarial sample detection model based on the target main classifier and the target hash code classifier.

[0094] In this embodiment, when the target gradient is obtained, the first participant updates the model parameters in the model to be trained according to the target gradient, and uses the corresponding updated model to be trained as the target main classifier. At the same time, the model parameters in the model to be trained are updated based on the local gradient, and the corresponding updated model to be trained is used as the target hash code classifier. Then, according to the target main classifier and the target hash code classifier, the adversarial sample detection model is determined, that is, the target main classifier is used as the main classifier in the adversarial sample detection model, and the target hash code classifier is used as the hash code classifier in the adversarial sample detection model, so as to obtain a trained adversarial sample detection model.

[0095] It should be noted that after obtaining the target main classifier and the target hash code classifier, first determine whether the target main classifier converges and whether the target hash code classifier converges. If both the target main classifier and the target hash code classifier converge, the target main classifier and the target hash code classifier are used as the main classifier and hash code classifier in the adversarial sample detection model, respectively.

[0096] Specifically, the test loss function value can be obtained by inputting the test sample into the target main classifier. If the test loss function value is less than the preset value, the target main classifier is determined to have converged; if the test loss function value is greater than or equal to the preset value, the target main classifier is determined to have not converged. The convergence judgment method of the target hash code classifier is similar to that of the target main classifier, which will not be repeated here. If the target main classifier has not converged and the target hash code classifier has not converged, the target main classifier or the target hash code classifier is used as the model to be trained, and step S400 is continued until the new target main classifier and the target hash code classifier converge to complete the training of the adversarial sample detection model.

[0097] The adversarial sample detection method proposed in this embodiment updates the model parameters in the model to be trained based on the target gradient to obtain a target main classifier, and updates the model parameters in the model to be trained based on the local gradient to obtain a target hash code classifier; then, based on the target main classifier and the target hash code classifier, the adversarial sample detection model is determined, and the efficiency of sample detection model training is improved by updating the model parameters in the model to be trained.

[0098] The embodiment of the present invention also provides an adversarial sample detection device, referring to Figure 4 , the adversarial sample detection device comprises:

[0099] An acquisition module 100 is used to acquire a sample to be detected;

[0100] A training module 200 is used to input the sample to be detected into a main classifier in the adversarial sample detection model to obtain a main training result, and input the sample to be detected into a hash code classifier in the adversarial sample detection model to obtain a hash training result;

[0101] The determination module 300 is used to determine whether the sample to be detected is an adversarial sample based on the main training result and the hash training result.

[0102] Optionally, the determination module 300 is further configured to:

[0103] Determining whether the main training result matches the hash training result;

[0104] If the main training result does not match the hash training result, it is determined that the sample to be detected is an adversarial sample.

[0105] Optionally, the adversarial sample detection device further includes:

[0106] Label the sample data to obtain a public label vector and a local label vector;

[0107] Determine a first public gradient based on the public label vector and the model to be trained, and determine a local gradient based on the local label vector and the model to be trained;

[0108] Sending the first common gradient to the coordinator, so that the coordinator determines and feeds back a global gradient based on the first common gradient;

[0109] A target gradient is determined based on the local gradient and the global gradient, and the adversarial sample detection model is determined based on the local gradient, the target gradient and the model to be trained.

[0110] Optionally, the adversarial sample detection device further includes:

[0111] Labeling the sample data based on one-hot encoding to obtain a public label vector;

[0112] The sample data is labeled based on random hash coding to obtain a local label vector.

[0113] Optionally, the adversarial sample detection device further includes:

[0114] Input the public label vector into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector, and input the local label vector into the model to be trained for model training, as well as the local loss function value corresponding to the local label vector;

[0115] The first public gradient is determined based on the public loss function value, and the local gradient is determined based on the local loss function value.

[0116] Optionally, the adversarial sample detection device further includes:

[0117] Based on the target gradient, the model parameters in the model to be trained are updated to obtain a target main classifier, and based on the local gradient, the model parameters in the model to be trained are updated to obtain a target hash code classifier;

[0118] Based on the target main classifier and the target hash code classifier, the adversarial sample detection model is determined.

[0119] Optionally, the adversarial sample detection device further includes:

[0120] The first common gradient is sent to a coordinator, wherein the coordinator obtains second common gradients sent by multiple second participants, determines a global gradient based on each second common gradient and the first common gradient, updates the global model of the coordinator based on the global gradient, and feeds back the global gradient to the first participants.

[0121] The methods executed by the above-mentioned program modules can refer to the various embodiments of the adversarial sample detection method of the present invention, and will not be described in detail here.

[0122] In addition, an embodiment of the present invention further proposes a computer-readable storage medium, on which an adversarial sample detection program is stored. When the adversarial sample detection program is executed by a processor, the steps of the adversarial sample detection method described above are implemented.

[0123] Among them, the method implemented when the adversarial sample detection program running on the processor is executed can refer to the various embodiments of the adversarial sample detection method of the present invention, and will not be repeated here.

[0124] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0125] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0126] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0127] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for detecting adversarial samples, characterized in that: The adversarial sample detection method comprises the following steps: The first participant obtains the sample to be tested; Input the sample to be detected into the main classifier in the adversarial sample detection model to obtain a main training result, and input the sample to be detected into the hash code classifier in the adversarial sample detection model to obtain a hash training result, wherein the adversarial sample detection model is a detection model that has been trained through federated learning; Based on the main training result and the hash training result, determine whether the sample to be detected is an adversarial sample.

2. The adversarial sample detection method according to claim 1, characterized in that: The step of determining whether the sample to be detected is an adversarial sample based on the main training result and the hash training result includes: Determining whether the main training result matches the hash training result; If the main training result does not match the hash training result, it is determined that the sample to be detected is an adversarial sample.

3. The adversarial sample detection method according to claim 1 or 2, characterized in that: Before the step of inputting the sample to be detected into the adversarial sample detection model to obtain the main training result corresponding to the main classifier and the hash training result corresponding to the hash code classifier, the adversarial sample detection method further includes: Label the sample data to obtain a public label vector and a local label vector; Determine a first public gradient based on the public label vector and the model to be trained, and determine a local gradient based on the local label vector and the model to be trained; Sending the first common gradient to the coordinator, so that the coordinator determines and feeds back a global gradient based on the first common gradient; A target gradient is determined based on the local gradient and the global gradient, and the adversarial sample detection model is determined based on the local gradient, the target gradient and the model to be trained.

4. The adversarial sample detection method according to claim 3, characterized in that: The step of labeling the sample data to obtain a public label vector and a local label vector comprises: Labeling the sample data based on one-hot encoding to obtain a public label vector; The sample data is labeled based on random hash coding to obtain a local label vector.

5. The adversarial sample detection method according to claim 3, characterized in that: The step of determining the first public gradient based on the public label vector and the model to be trained, and determining the local gradient based on the local label vector and the model to be trained includes: Input the public label vector into the model to be trained for model training to obtain the public loss function value corresponding to the public label vector, and input the local label vector into the model to be trained for model training, as well as the local loss function value corresponding to the local label vector; The first public gradient is determined based on the public loss function value, and the local gradient is determined based on the local loss function value.

6. The adversarial sample detection method according to claim 5, characterized in that: The step of determining the adversarial sample detection model based on the local gradient, the target gradient and the model to be trained includes: Based on the target gradient, the model parameters in the model to be trained are updated to obtain a target main classifier, and based on the local gradient, the model parameters in the model to be trained are updated to obtain a target hash code classifier; Based on the target main classifier and the target hash code classifier, the adversarial sample detection model is determined.

7. The adversarial sample detection method according to claim 3, characterized in that: The step of sending the first common gradient to the coordinator so that the coordinator can determine and feed back a global gradient based on the first common gradient includes: The first common gradient is sent to a coordinator, wherein the coordinator obtains second common gradients sent by multiple second participants, determines a global gradient based on each second common gradient and the first common gradient, updates the global model of the coordinator based on the global gradient, and feeds back the global gradient to the first participants.

8. An adversarial sample detection device, characterized in that: The adversarial sample detection device comprises: An acquisition module, used to acquire samples to be tested; A training module, used for inputting the sample to be detected into a main classifier in an adversarial sample detection model to obtain a main training result, and inputting the sample to be detected into a hash code classifier in an adversarial sample detection model to obtain a hash training result, wherein the adversarial sample detection model is a detection model that has been trained through federated learning; A determination module is used to determine whether the sample to be detected is an adversarial sample based on the main training result and the hash training result.

9. An adversarial sample detection device, characterized in that: The adversarial sample detection device includes: a memory, a processor, and an adversarial sample detection program stored in the memory and executable on the processor. When the adversarial sample detection program is executed by the processor, the steps of the adversarial sample detection method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores an adversarial sample detection program, and when the adversarial sample detection program is executed by the processor, the steps of the adversarial sample detection method according to any one of claims 1 to 7 are implemented.

Images