Adversarial Noise Removal Method and System for Adversarial Examples of Deep Neural Networks

Abstract

The present invention provides a method for removing adversarial noise from adversarial samples of deep neural networks, belonging to the field of image processing. It includes: performing end-to-end training using clean image samples to obtain a conditional variational autoencoder and a classifier; inputting the adversarial image to be denoised into the conditional variational autoencoder and the classifier to obtain the denoised sample and category of the adversarial image. By removing the noise in the adversarial image samples, the present invention can improve the robustness of the model against adversarial image samples. The features of the image samples after removing the adversarial noise are obvious and can be correctly classified, which also improves the reliability and security of subsequent tasks.

Description

Technical Field

[0001] The present invention belongs to the field of image processing, and particularly relates to a method and system for removing adversarial noise for adversarial samples of a deep neural network. Background Art

[0002] Adversarial Examples are a typical defect widely existing in various deep neural networks. In recent years, deep neural networks have achieved remarkable results in multiple machine learning fields, such as autonomous driving, object detection, object classification, medical image assisted diagnosis, and so on. An important reason for the development of deep neural networks is that neural networks have a powerful fitting ability and can easily fit any non-linear function. However, since 2014, people have discovered a specific type of artificially created image sample that is almost indistinguishable to the human eye from the original image sample, but can make the deep neural network make predictions that are very different or even completely opposite. For example, in the field of autonomous driving, one can make pixel-level modifications to a "STOP" sign, making it impossible for the human eye to distinguish the modified sign from the original "STOP" sign, but the recognition and classification part in the autonomous driving model will judge this sign as "Turn Left" or even "Speed Up", which is very likely to cause serious traffic accidents. Such artificial samples that are likely to make the deep neural network make incorrect predictions are called Adversarial Examples, and the process of generating such samples is called Adversarial Attack. Due to the characteristic that adversarial samples are difficult to distinguish by the human eye, it is difficult to manually remove adversarial samples only, and it also faces high labor costs. Therefore, improving the robustness of the neural network model against adversarial samples has broad development prospects and important practical significance. In academic research, the technology of improving the robustness of the neural network model is called Adversarial Defense.

[0003] Currently, there are various adversarial attack methods for neural networks, including three attack types: black-box attack, grey-box attack, and white-box attack. Among them, in the white-box attack, the attacker can obtain all the parameters, gradients, input and output, and other information of the model. Similarly, in the grey-box attack, the attacker can only obtain some of the parameters in the model, and in the black-box attack, the attacker has no knowledge of the model parameters at all and can only access the model a limited number of times to obtain a limited number of inputs and corresponding outputs. These attack methods are mostly based on the gradients of the model, so the gradients of the model also become important information that can be utilized in adversarial defense.

[0004] Currently, the adversarial defense for neural network classification models can be mainly divided into three categories: 1) adversarial training; 2) removing adversarial noise based on a generative model; 3) model fusion.

[0005] The adversarial defense method based on adversarial training is based on the idea of data augmentation. While training a model using clean image samples, adversarial attacks are performed on the model to generate adversarial image samples. More than one attack method can be used. Then, these adversarial image samples are used to train the model, which is equivalent to adding the adversarial image samples to the training set. This method can effectively enhance the robustness of the model against adversarial image samples. However, the disadvantages are high computational cost, slow speed, and still being unable to defend against adversarial image samples generated by adversarial attack methods that are not added to the training set.

[0006] The method of removing adversarial noise based on generative models focuses on using generative models to reconstruct adversarial image samples, hoping to remove adversarial noise during the reconstruction process. The generative models used in this method include generative adversarial networks, variational autoencoders, ordinary encoders, etc. Often, a classifier is connected after the generative model, and there are training methods such as separate training and joint training. In the joint training method, the classifier can help the generative model part learn the decision boundary of classification to ensure that the samples reconstructed by the generative model can be used for classification. Well-known methods include Magnet proposed by Meng et al. in 2017, defense-GAN proposed by Samangouei et al. in 2018, etc. Currently, the methods based on generative models basically only use classifiers to generate adversarial samples, and the attacker cannot obtain information about the defense mechanism, such as the structure and gradient of the generative model, which is also called "gray-box attack".

[0007] The adversarial defense based on model fusion aims to train multiple classification models simultaneously, and in the testing process, the trained models are fused in various ways, such as voting method, averaging method, weighted averaging, etc. The attacker needs to successfully attack multiple classification models simultaneously during the attack process to achieve the desired attack effect. A well-known method is the self-orthogonal randomization super-network method proposed by Bian et al. in 2020. Such methods need to train multiple models simultaneously during training, so the training time is still very long and the computational complexity is very high. Summary of the Invention

[0008] In view of the problem that the classification accuracy of the deep neural network classification model drops significantly in the face of artificially generated adversarial samples, the present invention proposes an adversarial noise removal method for adversarial samples of deep neural networks.

[0009] According to one aspect of the present invention, there is provided an adversarial noise removal method for adversarial samples of deep neural networks, including:

[0010] Performing end-to-end training on a conditional variational autoencoder and a classifier using clean image samples to obtain the trained conditional variational autoencoder and classifier;

[0011] Input the adversarial image to be denoised into the trained conditional variational autoencoder and classifier to obtain the denoised sample and category of the adversarial image.

[0012] Preferably, the end-to-end training of the conditional variational autoencoder and classifier using clean image samples to obtain the trained conditional variational autoencoder and classifier includes:

[0013] S101, directly connect the conditional variational autoencoder and the classifier, and input the clean image paired with the corresponding category label;

[0014] The encoder in the conditional variational autoencoder encodes the input clean image and the corresponding category label into the feature space to obtain the mean and standard deviation of the distribution followed by the latent variable in the feature space:

[0015] μ, σ = Encoder(x clean , y true )

[0016] where μ represents the mean of the encoded latent variable z, σ is the standard deviation of the encoded latent variable z, x clean is the input clean image, and y true is the category label corresponding to the clean image;

[0017] S102, sample the latent variable z in the feature space:

[0018] z = μ + ε · σ

[0019] ε ~ N(0, I)

[0020] where ε represents a random hyperparameter obeying the normal distribution N(0, I). Through the above resampling method, the latent variable z obeying the normal distribution N(μ, ε) is obtained;

[0021] S103, input the latent variable z into the decoder in the conditional variational autoencoder to reconstruct the clean input image:

[0022] x recon = Decoder(z, y true )

[0023] where x recon represents the clean input image reconstructed by the decoder. The decoding process is also supervised and requires an additional input of the category label y true ;

[0024] S104, input the reconstructed clean input image into the classifier to obtain the predicted category y pred :

[0025] ypred = Classifier(x recon )

[0026] S105. Combine the loss functions of the conditional variational auto - encoder and the classifier to form a joint loss function, and perform end - to - end training using the Adam optimization algorithm:

[0027] L1 = x clean logx recon +(1 - x clean )log(1 - x recon )

[0028] L2 = μ 2 + σ 2 - logσ 2 - 1

[0029] L3 = y true logy pred +(1 - y true )log(1 - y pred )

[0030]

[0031] L = L1+L2+L3+L reg

[0032] Among them, the loss functions of the trained conditional variational auto - encoder and classifier models are divided into four parts: the losses L1 and L2 of the conditional variational auto - encoder, the classification loss L3 of the classifier, and the regularization loss L that controls the parameter size of the conditional variational auto - encoder reg , L1 and L3 use cross - entropy loss, L2 uses KL - divergence loss, and the regularization loss function L reg is defined as the two - norm of the encoder and decoder parameters.

[0033] Preferably, the conditional variational auto - encoder includes:

[0034] A basic conditional variational auto - encoder;

[0035] A multi - layer fully - connected layer added additionally at the label input end of the basic conditional variational auto - encoder, and the multi - layer fully - connected layer is used to increase the dimension of the label and the weight of the label in the encoding operation;

[0036] Multiple BN layers added additionally at the label input end of the basic conditional variational auto - encoder to avoid the phenomenon of variance drift during the encoding process; and,

[0037] A BN layer added additionally after the mean value output by the basic conditional variational auto - encoder to improve the encoding effect.

[0038] Preferably, inputting the adversarial image to be denoised into the trained conditional variational autoencoder and classifier to obtain the denoised sample and category of the adversarial image includes:

[0039] S201, the trained conditional variational autoencoder encodes the adversarial image to be denoised into the feature space;

[0040] S202, resampling the latent variable based on the feature space;

[0041] S203, reconstructing the original adversarial image to be denoised multiple times based on the latent variable;

[0042] S204, screening out the image samples that remove the adversarial noise from the reconstructed original adversarial image to be denoised;

[0043] S205, using the trained classifier to detect the effect of removing the adversarial noise of the screened image samples.

[0044] Preferably, in S201, the trained conditional variational autoencoder encodes the adversarial image to be denoised, including:

[0045] Traverse all class labels y in the dataset i , and sequentially form image-label pairs (Xadver, yi) with the input adversarial image x adver ;

[0046] Input the image-label pair (Xadver, yi) into the trained conditional variational autoencoder, encode the pair (Xadver, yi), and obtain the mean u for resampling and decoding i and the standard deviation σ i , and obtain u i , σ i ;

[0047] u i ,σ i =Encoder(x adver ,y i )

[0048] where i = 0, 1,..., C, and C is the number of class labels, and a total of C μ i and σ i are obtained.

[0049] Preferably, in S202, resampling the latent variable based on the feature space includes:

[0050] By using the resampling method, obtain the latent variable z that follows the normal distribution N(μ, ε) i :

[0051] zi = μ i + ε i · σ i

[0052] ε i ~ N(0, I)

[0053] where ε represents a random hyperparameter that follows a normal distribution N(0, I).

[0054] Preferably, in step S203, based on the latent variable, reconstructing the original adversarial image to be denoised multiple times includes:

[0055] x test,i = Decoder(z i , y i ),

[0056] where x test,i represents the images after multiple reconstructions, with a total of C images.

[0057] Preferably, in step S204, screening out the image samples with adversarial noise removed from the reconstructed original adversarial image to be denoised includes:

[0058] Taking the loss function value as the evaluation criterion, selecting the reconstruction sample corresponding to the minimum loss function value as the sample closest to the original input, that is, the image sample with adversarial noise removed:

[0059]

[0060] where y mid represents the class label corresponding to the reconstruction sample with adversarial noise removed, and x mid represents the reconstruction sample with adversarial noise removed obtained by screening.

[0061] Preferably, in step S205, the classifier detects the effect of adversarial noise removal, including:

[0062] Inputting x mid into the classifier to obtain the prediction result y pred of the classifier;

[0063] y pred = Classifier(x mid ).

[0064] Counting the ratio of the number of the same prediction results and true labels to judge the quality of the noise removal effect: When the ratio reaches a set threshold, it indicates that the adversarial sample no longer has an attack effect, that is, the adversarial noise causing the attack effect has been removed.

[0065] According to a second aspect of the present invention, there is provided a chip system including a processor, the processor being coupled to a memory, the memory storing program instructions, and when the program instructions stored in the memory are executed by the processor, an adversarial noise removal method for adversarial samples of a deep neural network as described in any one of the above is implemented.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] By removing the noise in the adversarial image samples, the present invention can improve the robustness of the model against adversarial image samples. The features of the image samples after removing the adversarial noise are obvious and can be correctly classified, which also improves the reliability and security of subsequent tasks.

[0068] The present invention is convenient to be applied to multiple application scenarios with relatively high security levels, such as autonomous driving, image detection, and face recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] By reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings, other features, objects, and advantages of the present invention will become more apparent:

[0070] Figure 1 It is a flowchart of an adversarial noise removal method for adversarial samples of a deep neural network according to an embodiment provided by the present invention;

[0071] Figure 2 It is an explanatory diagram of the process of end-to-end training of a conditional variational autoencoder and a classifier according to another preferred embodiment provided by the present invention;

[0072] Figure 3 It is an explanatory diagram of the process of testing the robustness of the overall model against adversarial images according to another preferred embodiment provided by the present invention;

[0073] Figure 4 [[ID=3】It is the algorithm pseudocode for testing the robustness of the overall model against adversarial images according to another preferred embodiment provided by the present invention;

[0074] FIG. 5 is a typical clean image sample used in another preferred embodiment provided by the present invention;

[0075] FIG. 6 is a typical adversarial image sample used in another preferred embodiment provided by the present invention;

[0076] FIG. 7 is an image sample after removing the adversarial noise in another preferred embodiment provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0077] The present invention will be described in detail below with reference to specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several variations and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0078] The present invention provides an embodiment of a method for removing adversarial noise from adversarial examples in a deep neural network, comprising:

[0079] Use clean image samples to perform end-to-end training on the conditional variational autoencoder and classifier to obtain the trained conditional variational autoencoder and classifier;

[0080] The adversarial image to be denoised is input into the trained conditional variational autoencoder and classifier to obtain denoised samples and categories of the adversarial image.

[0081] Based on the above embodiment, a preferred embodiment is provided. Figure 1 The figure shows a flow chart of a method for removing adversarial noise from deep neural network adversarial samples, including:

[0082] S1, clean image training model;

[0083] S2, encodes the input adversarial image sample into the feature space;

[0084] S3, latent variable resampling;

[0085] S4, reconstructing input based on latent variables;

[0086] S5, screening denoised image samples;

[0087] S6, classifier predicted category;

[0088] S7, obtain denoised samples and categories.

[0089] In this embodiment, the adversarial image samples are encoded into a feature space that is not far from the clean image samples, latent variables are sampled in the feature space, and image samples with adversarial noise removed are decoded. This embodiment can process adversarial image samples obtained under various attack methods and remove adversarial noise quickly and effectively.

[0090] In order to better train the model, the present invention provides another preferred embodiment. Figure 2 As shown in FIG, it is an explanation diagram of the process of end-to-end training conditional variational autoencoder and classifier in this embodiment. Figure 2 , S1, clean image training model, which includes:

[0091] S101. Directly connect the conditional variational autoencoder to the classifier, that is, the encoding and decoding outputs of the conditional variational encoder are used as the inputs of the classifier. In this embodiment, multiple fully connected layers are additionally added to the label input end of the basic conditional variational autoencoder to increase the dimension of the label and the weight of the label in the encoding operation. Multiple BN layers are added to avoid the phenomenon of variance drift during the encoding process, which may affect the generalization ability. A BN layer is added after the mean value output by the encoder to improve the encoding effect of the encoder.

[0092] Pair the input clean image with the corresponding label, and encode the clean image: During the training process, input the clean image and the corresponding class label into the image input end and the class input end of the conditional variational autoencoder respectively:

[0093] μ, σ = Encoder(x clean , y true )

[0094] where μ represents the mean of the latent variable z obtained by encoding, σ is the standard deviation of the latent variable z obtained by encoding, x clean is the input clean image, and y true is the class label corresponding to the clean image. The encoder encodes the input clean image and the corresponding label pair into the feature space to obtain the mean and standard deviation of the distribution followed by the latent variable in the feature space, which are used for the next sampling;

[0095] S102. Sample the latent variable in the feature space:

[0096] z = μ + ε·σ

[0097] ε ∼ N(0, I)

[0098] where ε represents a random hyperparameter that follows the normal distribution N(0, I). Through the resampling method, the latent variable z that follows the normal distribution N(μ, ε) is obtained. In the conditional variational autoencoder, the variable obtained by reducing the dimension, encoding, and resampling the input image is called the latent variable. In this embodiment, it is represented by the letter z. The role of this variable is to characterize the features of the input image, and the input image is decoded and reconstructed from this variable.

[0099] S103. The decoder reconstructs the clean input image:

[0100] x recon = Decoder(z, y true )

[0101] where x recon represents the clean input image reconstructed by the decoder. The decoding process is also supervised and requires an additional input of the classification label y true; In the conditional variational autoencoder, both the encoder part and the decoder part input the image and the corresponding class label simultaneously, and both the encoding operation and the decoding operation operate on both simultaneously. Therefore, the class label also affects the encoding effect and the decoding effect, that is, this process is supervised.

[0102] S104, Input the reconstructed image into the classifier to obtain the predicted class y based on the reconstructed sample pred :

[0103] y pred = Classifier(x recon )

[0104] S105, Combine the loss functions of the conditional variational autoencoder and the classifier to form a joint loss function, and use the Adam optimization algorithm for end-to-end training. In this embodiment, end-to-end refers to from the input end of the conditional variational autoencoder to the output end of the classifier.

[0105] L1 = x clean logx recon +(1 - x clean )log(1 - x recon )

[0106] L2 = μ 2 + σ 2 - logσ 2 - 1

[0107] L3 = y true logy pred +(1 - y true )log(1 - y pred )

[0108]

[0109] L = L1 + L2 + L3 + L reg

[0110] Among them, the loss function of the model is divided into four parts: the losses L1 and L2 of the conditional variational autoencoder, the classification loss L3 of the classifier, and the regularization loss L that controls the parameter size of the conditional variational autoencoder reg . L1 and L3 adopt cross-entropy loss, L2 adopts KL divergence loss, and the regularization loss function L reg is defined as the two-norm of the parameters of the encoder and the decoder.

[0111] After training, the model (conditional variational autoencoder and classifier) can be used for subsequent adversarial image sample testing processes.

[0112] To test the robustness of the above overall model against adversarial images, the present invention provides a preferred embodiment. AsFigure 3 As shown, it is a process explanation diagram of the robustness of the test overall model of this embodiment against adversarial images. Figure 4 For Figure 3 The corresponding algorithm pseudocode of the test overall model against the robustness of adversarial images. In this embodiment, by combining the conditional variational autoencoder obtained in the previous embodiment and the classifier to form a supervised combined model, the adversarial image samples are encoded into a feature space not far from the clean image samples, and latent variables are sampled in the feature space, and the image samples with adversarial noise removed are decoded.

[0113] Specifically, in this embodiment, the image samples used come from the publicly available dataset MNIST. This dataset has a total of 10 categories of pictures, so the number of categories C in the present invention is 10. As Figure 5a and Figure 5b respectively represent the typical clean images used in this embodiment. Figure 6a and Figure 6b respectively represent the typical adversarial image samples used in this embodiment.

[0114] Specifically, S2, the conditional variational autoencoder encodes the original image, including:

[0115] Since the input adversarial images to be denoised ([[]] Figure 6a and Figure 6b ) lack labels during the test process, all category labels are traversed and combined with the input adversarial images to form image-label pairs in turn, and input into the conditional variational autoencoder:

[0116] u[[[]] i ,σ[[[]] i =Encoder(x[[[]] adver ,y[[[]] i )[[[]]

[0117] where i = 0, 1,..., C, and C = 10 is the number of category labels, and a total of 10 μ[[[]] i and σ[[[]] i are obtained;

[0118] Specifically, S3, sample latent variables based on the feature space:

[0119] z[[[]] i =μ[[[]] i +ε[[[]] i ·σ[[[]] i

[0120] ε[[[]] i ~N(0,I)[[[]]

[0121] where ε represents a random hyperparameter obeying the normal distribution N(0, I). Through the resampling method, the latent variable z obeying the normal distribution N(μ, ε) is obtained i ;

[0122] Specifically, in S4, the original input image is reconstructed multiple times based on the latent variable:

[0123] x test,i = Decoder(z i , y i )

[0124] where x test,i represents the images reconstructed multiple times, a total of 10;

[0125] Specifically, in S5, image samples that remove adversarial noise are selected from the reconstructed images:

[0126]

[0127] where y mid represents the class label corresponding to the reconstruction sample after removing the adversarial noise, and x mid represents the reconstruction sample after removing the adversarial noise selected through screening.

[0128] Among them, in order to select the sample closest to the original input, the loss function value is used as the evaluation criterion, and the reconstruction sample corresponding to the minimum loss function value is selected as the sample closest to the original input. Since the original deep neural network is trained with clean samples, the selected reconstruction sample can be regarded as the clean image sample closest to the original input, that is, the image sample after removing the adversarial noise.

[0129] Specifically, in S6, the steps for the classifier to detect the effect of removing adversarial noise:

[0130] y pred = Classifier(x mid )

[0131] The reconstructed sample is input into the classifier part of the model. If this part can correctly classify the reconstructed sample, it means that the reconstructed sample no longer has an adversarial effect. This process is called the detection process of whether the adversarial noise is removed.

[0132] In this embodiment, the quality of the noise removal effect is judged by statistically calculating the ratio of the number of identical prediction results and true labels. If the prediction result is the same as the true label, it means that the model can correctly classify. A larger ratio of identical numbers indicates that the adversarial sample no longer has an attack effect, that is, it means that the adversarial noise causing the attack effect has been removed. On the MNIST dataset in this embodiment, if the classification accuracy of the model for adversarial samples reaches more than 90%, it indicates that the model has a good effect of removing adversarial noise.

[0133] In this field, there are multiple datasets used to measure the effectiveness of models in removing adversarial noise, such as MNIST, CIFAR10, CIFAR100, etc. Different datasets have different threshold ranges for the same number ratio.

[0134] like Figure 7a and Figure 7b This is the image sample after removing the adversarial noise in this embodiment. It can be seen from the figure that the adversarial image sample is different from the clean image sample ( Figure 5a and Figure 5b ) are almost the same.

[0135] Specifically, S7 obtains the true semantic label of the original image, y pred represents the input image with adversarial noise removed. Since the adversarial noise has been removed in the previous steps, the classifier is also trained using the reconstructed image of the clean input image. Therefore, the classifier can ensure that the correct label of the reconstructed image is obtained, that is, it remains robust to the attack noise in the input sample.

[0136] The correct labels are provided by the public dataset. During the test, the number of predicted labels ypred that are identical to the correct labels is counted, and this number is used to evaluate the classification performance of the classification model.

[0137] Table 1 shows the structure of the conditional variational autoencoder used in this example. The classifier structure depends on the specific application. In this example, the commonly used classification neural network Resnet-18 is used as the classification model.

[0138] Table 1 Conditional variational autoencoder structure

[0139]

[0140] Because this embodiment is trained only on clean images, the trained model projects the input image into the feature space corresponding to each clean image category. Ideally, the reconstructed image decoded from this feature space should also conform to the distribution of the clean image. Therefore, this model can maintain high robustness under various attack methods.

[0141] Removing noise from adversarial image samples can improve the model's robustness against adversarial image samples. After removing the adversarial noise, the image samples have obvious features and can be correctly classified. It also improves the reliability and safety of subsequent tasks, making it easier to apply to multiple application scenarios with higher safety levels, such as autonomous driving, image detection, and face recognition.

[0142] Based on the same concept as the above embodiments, an embodiment is provided. A chip system includes a processor, and the processor is coupled to a memory. The memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method for removing adversarial noise from adversarial samples of a deep neural network in any one of the above embodiments is implemented.

[0143] The specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various deformations or modifications within the scope of the claims, which does not affect the essence of the present invention. The above preferred features can be used in any combination without conflict.

Claims

1. An adversarial noise removal method for adversarial samples of deep neural networks, characterized in that, Including: End-to-end training of a conditional variational autoencoder and a classifier using clean image samples to obtain the trained conditional variational autoencoder and classifier; Inputting the adversarial image to be denoised into the trained conditional variational autoencoder and classifier to obtain the denoised sample and category of the adversarial image, including: S201, the trained conditional variational autoencoder encodes the adversarial image to be denoised into the feature space; S202, resampling the latent variable based on the feature space; S203, reconstructing the original adversarial image to be denoised multiple times based on the latent variable; S204, screening out the image samples that remove the adversarial noise from the reconstructed original adversarial image to be denoised; S205, using the trained classifier to detect the effect of removing the adversarial noise of the screened image samples; S206, obtaining the true semantic label of the original adversarial image to be denoised; Wherein, in S204, screening out the image samples that remove the adversarial noise from the reconstructed original adversarial image to be denoised includes: Taking the loss function value as the evaluation criterion, selecting the reconstruction sample corresponding to the minimum loss function value as the sample closest to the original input, that is, the image sample that removes the adversarial noise: X mid ←E(D(X test ,i,y i )) where y mid represents the class label corresponding to the reconstructed sample after removing adversarial noise, and x mid represents the reconstructed sample after removing adversarial noise obtained by screening.

2. The adversarial noise removal method for adversarial samples of deep neural networks according to claim 1, characterized in that, The end-to-end training of the conditional variational autoencoder and the classifier using clean image samples to obtain the trained conditional variational autoencoder and classifier includes: S101, directly connecting the conditional variational autoencoder and the classifier, and inputting the clean image paired with the corresponding category label; The encoder in the conditional variational autoencoder encodes the input clean image and the corresponding category label into the feature space to obtain the mean and standard deviation of the distribution followed by the latent variable in the feature space: μ,σ = Encoder(x clean , y true ) where μ represents the mean of the encoded latent variable z, σ is the standard deviation of the encoded latent variable z, x clean is the input clean image, y true is the class label corresponding to the clean image; S102, sampling the latent variable z in the feature space: z = μ + ε·σ ε ∼ N(0, I) Where ε represents a random hyperparameter that follows the normal distribution N(0, I). Through the above resampling method, the latent variable z that follows the normal distribution N(μ, ε) is obtained; S103, inputting the latent variable z into the decoder in the conditional variational autoencoder to reconstruct the clean input image; x recon = Decoder(z, y true ) where x recon represents the clean input image reconstructed by the decoder. The decoding process is also supervised and requires an additional input of the class label y true ; S104. Input the reconstructed clean input image into a classifier to obtain the predicted class y based on the reconstruction sample pred : y pred = Classifier(x recon ) S105, forming a joint loss function from the loss functions of the conditional variational autoencoder and the classifier, and performing end-to-end training using the Adam optimization algorithm: L1 = x clean log x recon +(1 - x clean ) log(1 - x recon ) L2 = μ 2 + σ 2 - log σ 2 - 1 L3 = y true log y pred +(1 - y true ) log(1 - y pred ) L = L1 + L2 + L3 + L reg Among them, the loss function of the trained conditional variational autoencoder and the classifier model is divided into four parts: the losses L1 and L2 of the conditional variational autoencoder, the classification loss L3 of the classifier, and the regularization loss L that controls the parameter size of the conditional variational autoencoder reg , L1 and L3 use cross-entropy loss, L2 uses KL divergence loss, and the regularization loss function L reg is defined as the second norm of the parameters of the encoder and the decoder.

3. The adversarial noise removal method for adversarial samples of a deep neural network according to claim 2, wherein The conditional variational autoencoder includes: A basic conditional variational autoencoder; A multi-layer fully connected layer additionally added to the label input end of the basic conditional variational autoencoder, and the multi-layer fully connected layer is used to increase the dimension of the label and the weight of the label in the encoding operation; Multiple BN layers additionally added to the label input end of the basic conditional variational autoencoder to avoid the variance drift phenomenon in the encoding process; and, A BN layer additionally added after the mean value output by the basic conditional variational autoencoder to improve the encoding effect.

4. A method for removing adversarial noise against adversarial samples of a deep neural network according to claim 1, characterized in that, In S201, the trained conditional variational autoencoder encodes the adversarial image to be denoised, including: Traverse all class labels y of the dataset i and sequentially pair them with the input adversarial image x adver to form image-label pairs (Xadver, yi); Input the paired image tags (Xadver, yi) into the trained conditional variational autoencoder, encode the pair (Xadver, yi) to obtain the mean u for resampling and decoding i and the standard deviation σ i , and obtain u in the feature space i , σ i ; u i , σ i = Encoder(x adver , y i ) where \(i = 0, 1, \ldots, C\), \(C\) is the number of class labels, and a total of \(C\) \(\mu\) are obtained i and \(\sigma\) i .

5. An adversarial noise removal method for adversarial samples of deep neural networks according to claim 4, characterized in that, In S202, resampling the latent variable based on the feature space, including: By using a resampling method, a latent variable z that follows a normal distribution N(μ, ε) is obtained i : z = μ + ε·σ ε i ~N(0,I) Where ε represents a random hyperparameter that follows the normal distribution N(0, I).

6. The method for removing adversarial noise against adversarial samples of a deep neural network according to claim 4, characterized in that The S203, based on the latent variable, reconstructs the original adversarial image to be denoised multiple times, including: x test,i = Decoder(z i , y i ), where x test,i represents the images after multiple reconstructions, with a total of C images.

7. A method for removing adversarial noise against adversarial samples of a deep neural network according to claim 1, characterized in that, The S205, the classifier detects the adversarial noise removal effect, including: Input x mid into a classifier to obtain the prediction result y of the classifier pred ; y pred = Classifier(x mid ); Count the ratio of the number of the same statistical prediction results and true labels to judge the noise removal effect: if the ratio reaches the set threshold, it means that the adversarial sample no longer has the attack effect, that is, it means that the adversarial noise causing the attack effect has been removed.

8. A chip system, including a processor, the processor is coupled to a memory, the memory stores program instructions, and when the program instructions stored in the memory are executed by the processor, the method for removing adversarial noise for adversarial samples of a deep neural network according to any one of claims 1-7 is implemented.

Images