Adversarial sample defense system and method based on attention sorting

Abstract

The present invention provides an adversarial sample defense system and method based on attention sorting. It includes: S101, pre-training a classification model to obtain an adversarial sample; S102, the adversarial sample is pre-processed by the discrete cosine transform layer of the first module of the adversarial sample defense model to eliminate some attacks; S103, the feature map passes through the attention module to obtain the attention weight; S104, according to the attention weight, the feature vector with global characteristics is obtained again. S105, according to the loss function, the network is trained and the model is saved. The adversarial sample defense method uses the method of modifying the network to improve the problem of more hardware resources and longer time consumption in the training process of the model in the prior art, and considers the influence of key points when modifying the network.

Description

Technical Field

[0001] The present invention relates to the field of computer attack and defense technology, and in particular to an adversarial sample defense system and method based on attention sorting. Background Art

[0002] In real life, images are often contaminated by noise. Noise has many sources, such as unstable channels during image transmission and imperfect system equipment. Deep neural networks are vulnerable to adversarial noise attacks, which generate adversarial samples by adding subtle perturbations that humans cannot distinguish to the input, thereby deceiving the neural network to produce erroneous outputs with a high probability, which threatens the security of deep learning applications.

[0003] There are two main approaches to generate adversarial attacks on deep neural networks: symbolic gradient-based methods and optimization-based methods. Facing these powerful attacks, how to defend against them is crucial.

[0004] However, from the perspective of data preprocessing, existing adversarial defense methods require more hardware resources and a longer time consumption during the model training process, which also brings more time consumption to the testing phase. Summary of the invention

[0005] The purpose of the present invention is to provide an adversarial sample defense system and method based on attention sorting, which can solve the problem of requiring more hardware resources and longer time consumption in the training process of the model in the prior art, and considers the key points according to the characteristics of the attack.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A method for defending against adversarial samples based on attention sorting, the method specifically comprising:

[0008] S101, pre-training classification model to obtain adversarial samples;

[0009] S102, the adversarial sample is preprocessed by the first module of the adversarial sample defense model, the discrete cosine transform layer, to eliminate some attacks;

[0010] S103, the feature map passes through the attention module to obtain the attention weight;

[0011] S104, according to the attention weight, a feature vector with global features is obtained again.

[0012] S105, train the network according to the loss function and save the model.

[0013] On the basis of the above technical solution, the present invention can also be improved as follows:

[0014] Furthermore, the S101 specifically includes:

[0015] S1011, input the original image of the training set and obtain the weight through pre-training;

[0016] S1012, generating adversarial samples using the weights.

[0017] Furthermore, the S102 specifically includes:

[0018] S1021, after the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used;

[0019] S1022, using the designed activation function in the frequency domain , eliminate some attacks, as follows:

[0020] Formula 1;

[0021] S1023, using inverse discrete cosine transform to restore to the spatial domain, to obtain a feature map that eliminates some attacks.

[0022] Furthermore, the S103 specifically includes:

[0023] S1031, the feature map passes through four residual blocks in sequence to obtain a set of feature vectors , ;

[0024] S1032, After average pooling, the global vector is obtained , and at the same time The dimension mapping is Dimensions ;

[0025] S1033, local features and global features Use item-by-item addition to connect and learn an FC map to map the obtained features to attention weights , calculate the attention weight Defined as formula 2;

[0026] Formula 2;

[0027] in, represents the set of feature vectors extracted after each residual block, where , Represents a set of feature vectors middle The first feature vector indivual; express Figure 7 The global feature vector output by the fully connected layer in and The dimensions of .

[0028] Furthermore, the S104 specifically includes:

[0029] S1041, the feature map and the predicted attention map Reshape into a one-dimensional array, respectively and Indicates; among them, , is the feature vector with channel size C;

[0030] S1042, from the attention map Select the front K Value , record their point positions, from the feature map Extract feature points from these locations ;

[0031] S1043, calculate the global vector based on the key point by formula 2 ;

[0032] Formula 3;

[0033] in Indicates key points With feature map The inner product between each channel of .

[0034] Furthermore, the S105 specifically includes:

[0035] S1051, calculating the loss according to the classification category, back-propagating and updating the model weights, and fine-tuning the model. The loss function is defined as Formula 4 using the cross entropy loss function;

[0036] Formula 4;

[0037] S1052, load the test set to generate adversarial samples through the trained model, calculate the accuracy to evaluate the model performance, and save the optimal model weights.

[0038] An attention-ranking-based adversarial sample defense system, comprising:

[0039] The adversarial sample defense system modifies the basic model Resnet18. The whole system is divided into three modules: discrete cosine transform activation module, attention module and key point sorting module. A discrete cosine transform (DCT) activation layer is introduced after the first convolution layer to effectively suppress the noise pattern based on gradient attack. At the same time, in the attention module and key point sorting module, key points are dynamically selected on the feature map for classification based on the attention mechanism to reduce the influence of other attacked pixels.

[0040] Furthermore, the discrete cosine transform activation module is used to:

[0041] After the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used;

[0042] Use the designed activation function in the frequency domain , eliminate some attacks, as follows:

[0043] Formula 1;

[0044] The inverse discrete cosine transform is used to restore the spatial domain to obtain a feature map that eliminates some attacks. Further, the attention module is used to:

[0045] Before calculating the attention weights The dimension mapping is Dimensions ;

[0046] Local features and global features Use item-by-item addition to connect and learn an FC map to map the obtained features to attention weights , calculate the attention weight Defined as formula 2;

[0047] Formula 2;

[0048] in, represents the set of feature vectors extracted after each residual block, where , Represents a set of feature vectors middle The first feature vector indivual; express Figure 7 The global feature vector output by the fully connected layer in and The dimensions of ; Before calculating the attention weight, The dimension mapping is Dimensions .

[0049] Furthermore, the key point sorting module is further used for:

[0050] The feature map and the predicted attention map Reshape into a one-dimensional array, respectively and Indicates; among them, , is the feature vector with channel size C;

[0051] From the attention map Select the first K values , record their point positions, from the feature map Extract feature points from these locations ;

[0052] The global vector based on the key points is calculated by formula 3 ;

[0053] Formula 3;

[0054] in Indicates key points With feature map The inner product between each channel of .

[0055] The present invention has the following advantages:

[0056] The adversarial sample defense method based on attention sorting in the present invention introduces a discrete cosine transform activation layer, which eliminates part of the adversarial attack to a certain extent, and effectively suppresses the back propagation of the gradient in the white-box attacker. The remaining part of the adversarial noise is eliminated by the dynamic key point selection of the attention mechanism to obtain the correct classification result. The new Resnet18 network architecture proposed in the present invention has a good effect of defending against adversarial attacks, solves the problem of more hardware resources and longer time consumption in the training process of the existing defense model, and considers the influence of key points when modifying the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1This is a flow chart of the adversarial sample defense method in an embodiment of the present invention;

[0059] Figure 2 is a specific flow chart of S101 in an embodiment of the present invention;

[0060] Figure 3 This is a specific flow chart of S102 in an embodiment of the present invention;

[0061] Figure 4 This is a specific flow chart of S103 in an embodiment of the present invention;

[0062] Figure 5 is a specific flow chart of S104 in an embodiment of the present invention;

[0063] Figure 6 This is a specific flow chart of S105 in an embodiment of the present invention;

[0064] Figure 7 Schematic diagram of the adversarial sample defense network framework for attention sorting in an embodiment of the present invention. DETAILED DESCRIPTION

[0065] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] like Figure 1 As shown, the adversarial sample defense method based on attention sorting specifically includes:

[0067] S101, obtain adversarial samples;

[0068] In this step, the classification model is pre-trained to obtain adversarial samples;

[0069] S102, pre-processing the adversarial sample;

[0070] In this step, the adversarial sample is preprocessed by the first module of the adversarial sample defense model, the discrete cosine transform layer, to eliminate some attacks;

[0071] S103, obtain the attention weight;

[0072] In this step, the feature map passes through the attention module to obtain the attention weight;

[0073] S104, obtaining a feature vector having global features;

[0074] In this step, the feature vector with global features is retrieved according to the attention weight.

[0075] S105, train the network according to the loss function and save the model.

[0076] The introduction of discrete cosine transform activation layer in the convolution layer eliminates some adversarial attacks to a certain extent, and effectively suppresses the back propagation of gradients in the white-box attacker. The remaining adversarial noise is eliminated by the dynamic key point selection of the attention mechanism to obtain the correct classification result. The new Resnet18 network architecture proposed in this paper has a good effect in defending against adversarial attacks;

[0077] The adversarial attack mentioned in the present invention refers to: the method of using the shortcomings of deep learning to destroy the recognition system can be collectively referred to as an adversarial attack, that is, making special changes to the recognition object, which cannot be seen by the naked eye, but will cause the recognition model to fail.

[0078] The adversarial samples mentioned in this invention refer to: adding some disturbances that are imperceptible to the human eye to the original samples (such disturbances will not affect human recognition, but can easily fool the model), causing the machine to make wrong judgments.

[0079] The adversarial defense mentioned in the present invention refers to a series of defense strategies generated to defend against adversarial attacks.

[0080] The attention model mentioned in the present invention refers to: the attention model in deep learning is essentially similar to the selective visual attention mechanism of humans. The core goal is to select information that is more critical to the current task goal from a large amount of information and suppress other useless information, thereby improving the efficiency and accuracy of information processing.

[0081] The discrete cosine transform (DCT) mentioned in the present invention means: discrete cosine transform is a transform defined for real signals, and the signal obtained in the frequency domain after the transform is also a real signal. DCT also has a very important property (energy concentration characteristic): the energy of most natural signals (sound, image) is concentrated in the low-frequency part after discrete cosine transform, so DCT has been widely used in (sound, image) data compression.

[0082] ResNet18 mentioned in this invention refers to: a neural network structure in deep learning. Also called deep residual network, it can solve the degradation problem that occurs as the network depth increases. The network structure is called residual block.

[0083] The present invention provides a method for adversarial sample defense based on attention key point sorting, which is used to defend against attacks and improve the robustness of deep neural networks. Existing methods add external models to preprocess input images, and the external models are becoming more and more complex to better defend against attacks. The present invention improves the robustness of deep neural networks by modifying the form of the network and selecting key points on the attention map. At the same time, discrete cosine transform and activation function are introduced into the network to effectively suppress noise patterns based on gradient attacks.

[0084] The present invention is inspired by the human eye classifying images and identifying objects. They do not analyze images pixel by pixel based on a grid structure. Instead, they are able to quickly detect discriminative key points (or object parts) from images and extract features from these key points to infer decisions for image classification or object detection. Therefore, the present invention adopts the extraction of key points on the attention map and designs a new network architecture to support dynamic key point selection of the attention mechanism to improve the robustness of the deep learning network. At the same time, discrete cosine transform and activation function are introduced in the network to effectively suppress noise patterns based on gradient attacks.

[0085] On the basis of the above technical solution, the present invention can also be improved as follows:

[0086] like Figure 2 As shown, further, the S101 specifically includes:

[0087] S1011, get the weight;

[0088] In this step, the original images of the training set are input and the weights are obtained through pre-training;

[0089] S1012, generate adversarial samples;

[0090] In this step, the weights are used to generate adversarial samples for training a robust network.

[0091] like Figure 3 As shown, the S102 specifically includes:

[0092] S1021, after the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used;

[0093] S1022, using the designed activation function in the frequency domain , eliminate some attacks, as follows:

[0094] Formula 1;

[0095] S1023, using inverse discrete cosine transform to restore to the spatial domain, to obtain a feature map that eliminates some attacks.

[0096] like Figure 4 As shown, the S103 specifically includes:

[0097] S1031, the feature map passes through four residual blocks in sequence to obtain a set of feature vectors , ;

[0098] S1032, After average pooling, the global vector is obtained , and at the same time The dimension mapping is Dimensions ;

[0099] S1033, local features and global features Use item-by-item addition to connect and learn an FC map to map the obtained features to attention weights , calculate the attention weight Defined as formula 2;

[0100] Formula 2;

[0101] in, represents the set of feature vectors extracted after each residual block, where , Represents a set of feature vectors middle The first feature vector indivual; express Figure 7 The global feature vector output by the fully connected layer in and The dimensions of .

[0102] like Figure 5 As shown, further, the S104 specifically includes:

[0103] S1041, the feature map and the predicted attention map Reshape into a one-dimensional array, respectively and Indicates; among them, , is the feature vector with channel size C;

[0104] S1042, from the attention map Select the first K values , record their point positions, from the feature map Extract feature points from these locations ;

[0105] S1043, calculate the global vector based on the key point by formula 2 ;

[0106] Formula 3;

[0107] in Indicates key points With feature map The inner product between each channel of .

[0108] like Figure 6 As shown, the S105 specifically includes: S1051, calculating the loss according to the classification category, back-propagating and updating the model weight, fine-tuning the model, and the loss function is defined as Formula 4 using the cross entropy loss function;

[0109] Formula 4;

[0110] S1052, load the test set to generate adversarial samples through the trained model, calculate the accuracy to evaluate the model performance, and save the optimal model weights.

[0111] This paper proposes a new model algorithm, an adversarial sample defense method based on attention sorting, such as Figure 7 As shown in Figure 2. Our proposed adversarial defense network based on key point sorting on the attention map has two main ideas: (1) A discrete cosine transform (DCT) activation layer is introduced after the first convolutional layer to effectively suppress the noise pattern based on gradient attack. The motivation for this design is that adversarial noise is gradually amplified during the convolution process and leads to incorrect classification, which is also known as the error amplification effect, so we do not directly perform DCT transformation on the original image. (2) To eliminate the interference of residual adversarial noise, we dynamically select key points for classification on the feature map based on the attention mechanism to reduce the influence of other attacked pixels.

[0112] The whole process is as follows: Image First, it is preprocessed by the convolution layer and passed to the discrete cosine transform (DCT) activation layer, where most of the adversarial noise is destroyed, and then the feature map is recovered through the inverse discrete cosine transform (IDCT) . It will continue to enter the main network of Resnet18, as shown in the figure, with 4 residual layers, and the output of each residual layer is . After average pooling, we get an n-dimensional feature vector , which has global information of the entire image. Next, we did not follow the Resnet18 network to convert the global vector Perform full connection to obtain its classification category. Instead, use the global vector Respectively Fusion, get the discriminant weight , which is the attention map. Then and The key points are detected and sorted respectively, and their corresponding multiplication is used to obtain the new feature vector corresponding to each layer of different scales. , After splicing and full connection, the classification category can be obtained.

[0113] An attention-ranking-based adversarial sample defense system, comprising:

[0114] The adversarial sample defense system modifies the basic model Resnet18. The whole system is divided into three modules: discrete cosine transform activation module, attention module and key point sorting module. A discrete cosine transform (DCT) activation layer is introduced after the first convolution layer to effectively suppress the noise pattern based on gradient attack. At the same time, in the attention module and key point sorting module, key points are dynamically selected on the feature map for classification based on the attention mechanism to reduce the influence of other attacked pixels.

[0115] Furthermore, the discrete cosine transform activation module is used to:

[0116] After the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used;

[0117] Use the designed activation function in the frequency domain , eliminate some attacks, as follows:

[0118] Formula 1;

[0119] The inverse discrete cosine transform is used to restore it to the spatial domain and obtain a feature map that eliminates some attacks.

[0120] Furthermore, the attention module is used to:

[0121] Before calculating the attention weights The dimension mapping is Dimensions ;

[0122] Local features and global features Use item-by-item addition to connect and learn an FC map to map the obtained features to attention weights , calculate the attention weight Defined as formula 2;

[0123] Formula 2;

[0124] in, represents the set of feature vectors extracted after each residual block, where , Represents a set of feature vectors middle The first feature vector indivual; express Figure 7 The global feature vector output by the fully connected layer in and The dimensions of ; Before calculating the attention weight, The dimension mapping is Dimensions .

[0125] The key point sorting module is further used for:

[0126] The feature map and the predicted attention map Reshape into a one-dimensional array, respectively and Indicates; among them, , is the feature vector with channel size C;

[0127] From the attention map Select the first K values , record their point positions, from the feature map Extract feature points from these locations ;

[0128] Calculate the global vector based on the key points by formula 3;

[0129] Formula 3;

[0130] in Indicates key points With feature map The inner product between each channel of .

[0131] The discrete cosine transform (DCT) activation layer, attention module and key point sorting designed and used in these inventions are introduced in detail.

[0132] 1. Discrete Cosine Transform (DCT) Activation Layer

[0133] In the spatial domain, adversarial samples and original images are visually very similar, so it is very difficult to separate adversarial noise from the original image. Traditional image denoising usually converts it to the frequency domain to solve it. Therefore, we choose to use the block-by-block two-dimensional discrete cosine transform (DCT)

[34] , where the two-dimensional discrete cosine transform (DCT) is defined as follows:

[0134]

[0135] After this transformation, the noise of the image is in the high-frequency part of the discrete cosine transform result, and the amplitude of the high-frequency part is generally small. Therefore, the following activation function is designed :

[0136]

[0137] Image transfer activation function for DCT transformation After that, on the one hand, the adversarial noise is partially removed; on the other hand, it is not easily attacked by existing white-box attack methods. This is because most existing white-box attacks are based on gradient backpropagation, and gradients cannot be easily propagated through discrete cosine transform (DCT) activation layers.

[0138] 2. Attention Module

[0139] remember represents the set of feature vectors extracted after each residual block, where . Represents a set of feature vectors middle The first feature vector indivual, express Figure 7 The global feature vector output by the fully connected layer in . Local features and global features Use the method of adding items one by one to connect, and learn a FC mapping (that is, the weight is The FC layer) maps the obtained features into attention weights , then calculate the attention weight Defined as

[0140] .

[0141] here and The dimensions of , because corresponding to different The number of channels of the feature vectors is different, so before calculating the attention weights, The dimension mapping is Dimensions .

[0142] Therefore, the attention weight is obtained after the attention module The attention weights identify salient image regions and amplify their influence, while suppressing irrelevant and potentially confusing information in other regions. Thus, this score plays the role of an attention value.

[0143] 3. Key point sorting

[0144] The most discriminative feature points are dynamically selected from the generated feature map. The selection process is dynamic and affected by the input conditions. For different images, the selected feature points will be different.

[0145] Attention weights learned by the network attention module represents the discriminant weight of each feature point. Specifically, from the size of Input feature map In the example, it predicts a space of the same size through the attention module Attention map ,in Representation characteristics Attention points. From the feature map Our goal is to select the one with the highest attention The first K feature points of are used to obtain the new global vector.

[0146] This keypoint detection and sorting includes the following main steps:

[0147] The feature map and the predicted attention map Reshape into a one-dimensional array, respectively and Here, , is a feature vector with channel size C.

[0148] From the attention map Select the first K values , record their point positions, from the feature map Extract feature points from these locations .

[0149] Calculate the global vector based on key points .

[0150] .

[0151] in Indicates key points With feature map The inner product between each channel of (reshaped into a 1D array).

[0152] Finally, we use the cross entropy loss function to train the modified network. The loss for the original image and the adversarial example is calculated separately and then summed.

[0153] Formula 4;

[0154] The present invention designs a new network architecture to support dynamic key point selection of attention mechanism to improve the robustness of deep learning network. Discrete cosine transform and activation function are introduced into the network to effectively suppress the noise pattern based on gradient attack.

[0155] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0156] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0157] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0158] The above description is only an embodiment of this document and is not intended to limit this document. For those skilled in the art, this document may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this document should be included in the scope of the claims of this document.

Claims

1. A method for defending against adversarial samples based on attention sorting, characterized in that: The method specifically comprises: S101, pre-training classification model to obtain adversarial samples; S102, the adversarial sample is preprocessed by the first module of the adversarial sample defense model, the discrete cosine transform layer, to eliminate some attacks; S103, the feature map passes through the attention module to obtain the attention weight; S104, according to the attention weight, re-obtaining the feature vector with global features; S105, training the network according to the loss function and saving the model; The S103 specifically includes: S1031, the feature map passes through four residual blocks in sequence to obtain a set of feature vectors s∈{1,2,3,4}; S1032, L4 is averaged and pooled to obtain the global vector g. s , the dimension of s∈{1, 2, 3} is mapped to the dimension n of g; S1033, local features The global feature g is connected by adding it item by item, and the obtained feature map is mapped to the attention weight C by learning an FC map. The calculation of the attention weight C is defined as formula 2; in, represents the set of feature vectors extracted after each residual block, where s∈{1,2,3}, Denotes the feature vector set L s The i-th feature vector among the n feature vectors in FIG8; g represents the global feature vector output by the fully connected layer in FIG8, The dimensions of and g are both n; The S104 specifically includes: S1041, the feature map L s and the predicted attention map C s Reshape into a one-dimensional array, respectively, by {L s (n)} and {C s (n)}; where n = H × W, {L s (n)} is the feature vector with channel size C; S1042, from the attention map {C s (n)} select the first K values ​​{C s (k)}, record their point positions, and from the feature map {L s (n)} extract feature points {L s (k)}; S1043, calculate the global vector g based on the key point by formula 2 s ; gs=C,(k)⊙L,(k)Formula 3; Where ⊙ represents the key point {C s (k)} and feature map {L s (k)}.

2. The method for defending against adversarial samples based on attention sorting according to claim 1, characterized in that: The S101 specifically includes: S1011, input the original image of the training set and obtain the weight through pre-training; S1012, generating adversarial samples using the weights.

3. The method for defending against adversarial samples based on attention sorting according to claim 1, characterized in that: The S102 specifically includes: S1021, after the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used; S1022, use the designed activation function η(x) in the frequency domain to eliminate some attacks, η(x) is as follows: S1023, using inverse discrete cosine transform to restore to the spatial domain, to obtain a feature map that eliminates some attacks.

4. The method for defending against adversarial samples based on attention sorting according to claim 1, characterized in that: The S105 specifically includes: S1051, calculating the loss according to the classification category, back-propagating and updating the model weights, and fine-tuning the model. The loss function is defined as Formula 4 using the cross entropy loss function; S1052, load the test set to generate adversarial samples through the trained model, calculate the accuracy to evaluate the model performance, and save the optimal model weights.

5. An attention-ranking-based adversarial sample defense system, characterized in that: include: The adversarial sample defense system modifies the basic model Resnet18; the entire system is divided into three modules: discrete cosine transform activation module, attention module and key point sorting module; A discrete cosine transform (DCT) activation layer is introduced after the first convolutional layer to effectively suppress the noise pattern based on gradient attacks. At the same time, in the attention module and key point sorting module, key points are dynamically selected on the feature map for classification based on the attention mechanism to reduce the influence of other attacked pixels. The attention module is used to: Before calculating the attention weight, L s The dimension of is mapped to the dimension n of g; Local features The global feature g is connected by adding it item by item, and the obtained feature map is mapped to the attention weight C by learning an FC map. The calculation of the attention weight C is defined as formula 2; in, represents the set of feature vectors extracted after each residual block, where s∈{1,2,3}, Denotes the feature vector set L s The i-th feature vector among the n feature vectors in FIG8; g represents the global feature vector output by the fully connected layer in FIG8, The dimensions of and g are both n; L is converted before calculating the attention weights s The dimension of is mapped to the dimension n of g; The key point sorting module is further used for: The feature map L s and the predicted attention map C s Reshape into a one-dimensional array, respectively, by {L s (n)} and {C s (n)}; where n = H × W, {L s (n)} is the feature vector with channel size C; From the attention graph {C s (n)} select the first K values ​​{C s (k)}, record their point positions, and from the feature map {L s (n)} extract feature points {L s (k)}; The global vector g based on the key points is calculated by formula 3 s ; gs=C,00L,(k)Formula 3; Where ⊙ represents the key point {C s (k)} and feature map {L s (k)}.

6. The attention-ranking-based adversarial sample defense system according to claim 5, characterized in that: The discrete cosine transform activation module is used to: After the adversarial sample passes through the first convolutional layer, discrete cosine transform (DCT) is used; The designed activation function η(x) is used in the frequency domain to eliminate some attacks. η(x) is as follows: The inverse discrete cosine transform is used to restore it to the spatial domain and obtain a feature map that eliminates some attacks.

Images