A method and apparatus for optimizing a neural network

Abstract

The application provides a method and device for optimizing a neural network; at least one data pair is determined based on an image test dataset and a corresponding adversarial image test dataset; for any data pair, a first deep neural network is used to process the data pair to obtain a first output result corresponding to the image test data in the data pair and a second output result corresponding to the adversarial image test data; when the comparison relationship between the first output result and the second output result satisfies a condition rule, an individual value of an adversarial robustness index of the first deep neural network on the data pair is determined; based on the individual value, a target value of the adversarial robustness index of the first deep neural network on the image test dataset is determined; when the target value is lower than a threshold value, a second image training dataset determined based on a first image training dataset and a corresponding adversarial image training dataset is used to optimize and train the first deep neural network; and the adversarial robustness of the deep neural network is improved.

Description

Technical Field

[0001] This invention relates to the field of deep learning security, and more particularly to a method and apparatus for neural network optimization. Background Technology

[0002] With the widespread application of deep neural networks in various fields, the vulnerability of deep neural networks to attacks has become one of the important research issues in the development of deep learning.

[0003] Currently, effective methods for attacking deep neural networks, known as adversarial attacks, primarily involve perturbing the input samples to introduce subtle interference, causing the deep neural network to output an incorrect result with high confidence. This poses a significant security risk to the use of deep neural networks in various fields. Therefore, determining and improving the adversarial robustness of deep neural networks is a problem that needs to be solved. Summary of the Invention

[0004] This application provides a method and apparatus for optimizing a neural network, used to determine the adversarial robustness of a deep neural network, and to optimize and train the deep neural network based on the determined results, thereby improving the adversarial robustness of the deep neural network.

[0005] In a first aspect, embodiments of this application provide a method for optimizing a neural network, the method comprising:

[0006] Based on the image test dataset and the corresponding adversarial image test dataset, at least one data pair is determined, wherein each data pair contains image test data and adversarial image test data obtained by perturbing the image test data.

[0007] For each data pair, an adversarial robustness evaluation operation is performed to obtain the individual values ​​of the adversarial robustness index of the first deep neural network for each data pair. The adversarial robustness evaluation operation includes: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data contained in the data pair, and a second output result corresponding to the adversarial image test data contained in the data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing performed on the image test data in the data pair, the individual value corresponding to the data pair is determined.

[0008] Based on the individual values ​​corresponding to each data pair, the target value of the adversarial robustness index of the first deep neural network on the image test dataset is determined, where the adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks.

[0009] If the target value is lower than the adversarial robustness index threshold, then a second image training dataset is determined based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset, and the first deep neural network is optimized and trained based on the second image training dataset.

[0010] In this embodiment, when determining the adversarial robustness of the first deep neural network trained on the first image training dataset, at least one data pair determined based on the image test dataset and its corresponding adversarial image test dataset is input into the trained first deep neural network, and a first output result corresponding to the image test data and a second output result corresponding to the adversarial image test data are obtained for each data pair. The first output result and the second output result corresponding to the same data pair are compared. After determining that the condition rules are met, the individual value of the adversarial robustness index corresponding to the first deep neural network on the data pair is determined. Then, based on each individual value, the target value of the adversarial robustness index corresponding to the first deep neural network on the image test dataset is determined, thereby determining the adversarial robustness of the first deep neural network. After determining that the target value is lower than the adversarial robustness index threshold, a second image training dataset is determined based on the first image training dataset and its corresponding adversarial image training dataset. The first deep neural network is then optimized and trained based on the determined second image training dataset to improve the adversarial robustness of the first deep neural network.

[0011] In one possible implementation, the first deep neural network is a classification network, and the first output and the second output are the first classification result and the second classification result output by the classification network, respectively.

[0012] The conditional rules include: the first classification result is the same as the second classification result.

[0013] In one possible implementation, the first deep neural network is a detection and recognition network, and the first output result and the second output result are the first recognition result and the second recognition result output by the classification network, respectively.

[0014] The conditional rules include: the first recognition result is different from the second recognition result, and the overlap between the first detection region and the second detection region is less than the region overlap threshold; wherein, the first detection region is the detection region corresponding to the image test data processed by the detection and recognition network, and the second detection region is the detection region corresponding to the adversarial image data processed by the detection and recognition network.

[0015] In one possible implementation, the first deep neural network is a segmentation network, and the first output result and the second output result are the first segmentation result and the second segmentation result output by the segmentation network, respectively.

[0016] The conditional rule includes: the target difference between the first segmentation result and the second segmentation result is greater than the difference threshold.

[0017] In this application, different conditional rules are set for different first deep neural networks and their corresponding task objectives, so as to further realize the adversarial robustness determination for classification, detection and recognition, and segmentation networks.

[0018] In one possible implementation, the individual value is the perturbation matrix used when perturbing the image test data corresponding to the first output result that satisfies the conditional rule in order to obtain the adversarial image test data corresponding to the second output result.

[0019] Based on the individual values ​​corresponding to each data pair, the target value of the adversarial robustness index of the first deep neural network on the image test data pair is determined, including:

[0020] For any perturbation matrix, an intermediate value is determined based on the values ​​of each element in the perturbation matrix;

[0021] The expected value determined based on each intermediate value is used as the target value of the adversarial robustness index of the first deep neural network on the image test data pair.

[0022] In one possible implementation, for any perturbation matrix, the intermediate value is determined as follows:

[0023] The element values ​​in the perturbation matrix are normalized to determine the intermediate values.

[0024] This application provides a method for determining the target value of the adversarial robustness index corresponding to the first deep neural network on the image test dataset. This method can be used for classification networks, detection and recognition networks, and segmentation networks, making the method for determining the target value of the adversarial robustness index corresponding to the first deep neural network universal.

[0025] In one possible implementation, after optimizing and training the first deep neural network based on the second image training dataset, the method further includes:

[0026] If it is determined that the target value corresponding to the first deep neural network trained on the second image training dataset is lower than the adversarial robustness index threshold, then a noise reduction module for reducing noise is added to the first deep neural network to obtain the second deep neural network.

[0027] The second deep neural network is optimized and trained based on the third image training dataset.

[0028] In this application, when it is determined that the target value obtained after further optimization training is still lower than the adversarial robustness index threshold, in order to improve adversarial robustness, the network structure of the first deep neural network will be improved by adding a noise reduction module to the first deep neural network to obtain a second deep neural network, so as to filter out noise in the data during training or use and improve adversarial robustness; and the second deep neural network will be optimized and trained based on the third image training dataset.

[0029] Secondly, embodiments of this application provide a neural network optimization device, the device comprising:

[0030] At least one memory and at least one processor, wherein:

[0031] Memory, used to store program instructions;

[0032] The processor is configured to determine at least one data pair based on an image test dataset and an adversarial image test dataset corresponding to the image test dataset, wherein each data pair contains image test data and adversarial image test data obtained by perturbing the image test data.

[0033] For each data pair, an adversarial robustness evaluation operation is performed to obtain the individual values ​​of the adversarial robustness index of the first deep neural network for each data pair. The adversarial robustness evaluation operation includes: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data contained in the data pair, and a second output result corresponding to the adversarial image test data contained in the data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing performed on the image test data in the data pair, the individual value corresponding to the data pair is determined.

[0034] Based on the individual values ​​corresponding to each data pair, the target value of the adversarial robustness index of the first deep neural network on the image test dataset is determined, where the adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks.

[0035] If the target value is lower than the adversarial robustness index threshold, then a second image training dataset is determined based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset, and the first deep neural network is optimized and trained based on the second image training dataset.

[0036] Thirdly, embodiments of this application provide a neural network optimization apparatus, the apparatus comprising:

[0037] The first determining module is used to determine at least one data pair based on the image test dataset and the adversarial image test dataset corresponding to the image test dataset, wherein each data pair contains image test data and adversarial image test data obtained by interfering with the image test data.

[0038] The acquisition module is used to perform adversarial robustness evaluation operations on each data pair to obtain the individual values ​​of the adversarial robustness index corresponding to the first deep neural network on each data pair. The adversarial robustness evaluation operation includes: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data contained in the data pair, and a second output result corresponding to the adversarial image test data contained in the data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing of the image test data in the data pair, the individual value corresponding to the data pair is determined.

[0039] The second determining module is used to determine the target value of the adversarial robustness index of the first deep neural network on the image test dataset based on the individual values ​​of each data pair, wherein the adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks.

[0040] The optimization training module is used to determine the second image training dataset based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset if the target value is lower than the adversarial robustness index threshold, and to optimize the training of the first deep neural network based on the second image training dataset.

[0041] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the method steps for neural network optimization provided in embodiments of this application.

[0042] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A flowchart of a neural network optimization method provided in this application embodiment;

[0045] Figure 2 A schematic diagram illustrating the determination of the overlapping area between a first detection area and a second detection area provided in this application embodiment;

[0046] Figure 3 A schematic diagram illustrating the determination of a minimum target region comprising a first detection region and a second detection region, provided in an embodiment of this application;

[0047] Figure 4 A schematic diagram of a second deep neural network with an added noise reduction module provided in an embodiment of this application;

[0048] Figure 5 A flowchart illustrating an overall method for optimizing a deep neural network, as provided in this application embodiment;

[0049] Figure 6 A structural diagram of a neural network optimization device provided in an embodiment of this application;

[0050] Figure 7 This is a structural diagram of a neural network optimization device provided in an embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and beneficial effects of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0053] The design concept of the embodiments of this application will be briefly introduced below.

[0054] Deep neural networks are applied in various fields, and their vulnerability to attack has become one of the important research issues in the development of deep learning.

[0055] Currently, various methods have been proposed to effectively attack deep neural networks, collectively known as adversarial attack methods. Adversarial attacks involve adding slight perturbations to the input samples fed into a deep neural network, causing it to output an incorrect result with high confidence. This poses a significant security risk to the deployment and use of deep neural networks in various fields. Therefore, determining and improving the adversarial robustness of deep neural networks is a problem that needs to be solved.

[0056] In related technologies, the widely studied field of image classification often uses the classification accuracy of deep neural networks on image test datasets to determine the adversarial robustness of the first deep neural network. However, this method is limited by the difficulty of the image test datasets, and cannot fairly reflect the adversarial robustness of the deep neural network itself. Furthermore, this method is only applicable to image classification, and cannot determine the adversarial robustness of deep neural networks used in tasks such as image detection and recognition, and image segmentation.

[0057] Based on the above problems, this application provides a method for determining the adversarial robustness of various types of deep neural networks, realizing the universality of determining the adversarial robustness of deep neural networks. At the same time, it provides a method for determining whether a deep neural network needs further optimization based on the determined adversarial robustness, and after determining that the deep neural network needs further optimization, it optimizes and trains the deep neural network to improve its adversarial robustness, so that the deep neural network can better defend against attacks.

[0058] In one possible implementation, based on an image test dataset and a corresponding adversarial image test dataset, at least one data pair is determined. Each data pair contains image test data and adversarial image test data obtained by perturbing the image test data. For any given test data, a first deep neural network trained on a first image training dataset is used to obtain a first output result corresponding to the image test data in the data pair and a second output result corresponding to the adversarial image test data. After determining that the comparison relationship between the first and second output results satisfies the conditional rules, the individual value of the corresponding robustness index of the first deep neural network on the image test data is determined. Then, based on the individual values ​​determined for each data pair, the target value of the adversarial robustness index of the first deep neural network on the image test dataset is determined. After determining that the target value is lower than the adversarial robustness index threshold, a second image training dataset is determined based on the first image training dataset and its corresponding adversarial image training dataset, and the first deep neural network is optimized and trained based on the second image training dataset. Therefore, the embodiments of this application determine the adversarial robustness of the first deep neural network and optimize the training of the first deep neural network based on the determination result, thereby improving the adversarial robustness of the first deep neural network.

[0059] In one possible implementation, after optimizing the training of the first deep neural network, a target value for its adversarial robustness index is determined. Once the target value of the optimized first deep neural network is determined to be below the adversarial robustness index threshold, a noise reduction module is added to the first deep neural network to obtain a second deep neural network. This second deep neural network is then optimized based on a third image training dataset. This provides a technical solution for secondary optimization of deep neural networks, further enhancing their adversarial robustness.

[0060] In summary, the neural network optimization method provided in this application is applicable to various application scenarios involving image detection and recognition, image classification, and image segmentation.

[0061] The network optimization method provided by the exemplary embodiments of this application is described below with reference to the accompanying drawings. It should be noted that the above description is only for the purpose of understanding the spirit and principles of this application, and the embodiments of this application are not limited in any way.

[0062] To ensure the accuracy of the output of the first deep neural network, a training dataset consisting of a large amount of training data is used to train the first deep neural network, and a test dataset consisting of a large amount of test data is used to test the trained first deep neural network to determine its ability to resist attacks, so as to optimize the trained first deep neural network.

[0063] In this embodiment, an adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks, and an optimized training method for the image classification network, image detection and recognition network, and image segmentation network is proposed to improve adversarial robustness.

[0064] It should be noted that the image classification network, image detection and recognition network, and image segmentation network can be any custom-designed first deep neural network f1 (DNNs).

[0065] Before optimization, the first deep neural network f1 should be trained. The specific training process is as follows:

[0066] Obtain the first image training dataset; the first image training dataset can be any image dataset used for object classification, object detection and recognition, or object segmentation;

[0067] Based on the first image training data values, the first deep neural network f1 is trained until the conditions are met, and then the trained first deep neural network f1 is obtained.

[0068] To ensure the adversarial robustness of the first deep neural network f1, the target value of the adversarial robustness index corresponding to the first deep neural network f1 is first determined. Then, the target value is compared with the threshold of the adversarial robustness index. Based on the comparison result, it is determined that the first deep neural network f1 needs to be optimized and trained. Then, the network optimization training of the first deep neural network f1 is continued to improve the adversarial robustness of the first deep neural network f1.

[0069] Please refer to Figure 1 , Figure 1 An exemplary embodiment of this application provides a method for neural network optimization, the method comprising the following steps:

[0070] Step S100: Based on the image test dataset and the adversarial image test dataset corresponding to the image test dataset, determine at least one data pair, wherein each data pair contains image test data and adversarial image test data obtained by interfering with the image test data.

[0071] The image test dataset is an image dataset of the same type as the first image training dataset; that is, the image test dataset can be any image dataset used for object classification, object detection and recognition, or object segmentation.

[0072] After obtaining the image test dataset, the first deep neural network f1, trained based on the first image training dataset, is used as the base network. Adversarial training is performed using the image test dataset as input data to obtain adversarial image test data that corresponds one-to-one with each image test data in the image test dataset, thus obtaining the adversarial image test dataset corresponding to the image test dataset.

[0073] In this process, adversarial training can select one or more adversarial attack methods. For example, adversarial attack methods include, but are not limited to, gradient-based attack methods and optimization-based attack methods.

[0074] Adversarial attack methods involve perturbing the image test data by adding subtle interference to obtain adversarial image test data that corresponds to the original image test data. Then, a first deep neural network is used to perform corresponding task processing on the adversarial image test data, such as classification, detection and recognition, and segmentation.

[0075] Therefore, after obtaining the data pairs containing image test data and their corresponding adversarial image test data, the adversarial image test data in each data pair is obtained by interfering with the image test data.

[0076] In this embodiment of the application, after obtaining each data pair, an adversarial robustness evaluation operation is performed on each data pair to obtain the individual values ​​of the adversarial robustness index of the first deep neural network on each data pair.

[0077] For the adversarial robustness evaluation operation for any one of the data pairs, please refer to steps S101 to S102.

[0078] Step S101: For any data pair, process the data pair based on the first deep neural network to obtain the first output result corresponding to the image test data in the data pair, and the second output result corresponding to the adversarial image test data.

[0079] The first deep neural network is obtained by training on the first image training dataset.

[0080] After obtaining at least one data pair containing image test data and its corresponding adversarial image test data, for any data pair, the image test data and the adversarial image test data in the data pair are respectively input into the first deep neural network f1 to obtain the output result of the first deep neural network f1.

[0081] It should be noted that, in the embodiments of this application, the result output by the first deep neural network for the image test data is taken as the first output result, and the result output by the first deep neural network for the adversarial image test data is taken as the second output result.

[0082] Step S102: For any data pair, if the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing performed on the image test data in a data pair, determine the individual value corresponding to the data pair.

[0083] Since classification networks, detection and recognition networks, and segmentation networks are proposed in this application embodiment, conditional rules are set for each network according to different network types and task objectives.

[0084] For example, if the first deep neural network f1 is a classification network, then the first output result and the second output result are the first classification result and the second classification result output by the classification network, respectively, and the conditional rule includes that the first classification result and the second classification result are inconsistent; see Formula 1 for details:

[0085] Formula 1: C f (x+r,x)=f(x+r)≠f(x);

[0086] Among them, C f(x+r,x) is used to represent a conditional rule, f is used to represent a classification network, f(x+r) is used to represent the second classification result, f(x) is used to represent the first classification result, x is used to represent image test data, (x+r) is used to represent adversarial image test data, and r is used to represent the magnitude of the perturbation added to the image test data;

[0087] That is, for the classification network, the conditional rule f(x+r)≠f(x) indicates that the classification result is incorrect after the interference processing.

[0088] Exemplarily, if the first deep neural network f1 is a detection and recognition network, the first output result is the first recognition result, and the second output result is the second recognition result; the conditional rule includes that the first recognition result is inconsistent with the second recognition result, and the region overlap degree between the first detection region corresponding to when the detection and recognition network processes the image test data and the second detection region corresponding to when the detection and recognition network processes the adversarial image test data is less than the region overlap degree threshold; specifically, refer to Formula 2:

[0089] Formula 2: C f (x+r,x) = k*f(x+r)≠f(x)+t*I f (x+r,x)<th1;

[0090] Where, C f (x+r,x) is used to represent the conditional rule, f is used to represent the detection and recognition network, f(x+r) is used to represent the second recognition result, f(x) is used to represent the first recognition result, x is used to represent image test data, (x+r) is used to represent adversarial image test data, r is used to represent the magnitude of the perturbation added to the image test data, I f (x+r,x) is used to represent the region overlap degree between the first detection region and the second detection region, th1 is used to represent the region overlap degree threshold, k is used to represent the coefficient of the recognition condition, and t is used to represent the coefficient of the detection condition;

[0091] It should be noted that th1, k, and t are constants that can be set by oneself, and by default, k = t = 1, th1 = 0.5;

[0092] That is, for the detection and recognition network, k*f(x+r)≠f(x) in the conditional rule indicates that the recognition result is incorrect after the interference processing; t*I f (x+r,x)<th1 indicates that the detection result is incorrect after the interference processing.

[0093] In the embodiments of the present application, the region overlap degree between the first detection region and the second detection region is determined in the following manner:

[0094] Determine the overlapping area between the first and second detection areas, and determine the smallest target area within both the first and second detection areas. For details, please refer to [link / reference needed]. Figure 2 and Figure 3 , Figure 2 An exemplary schematic diagram for determining overlapping regions is provided. Figure 3 An exemplary schematic diagram for determining the minimum target region is provided;

[0095] Then, based on the determined overlapping region and the minimum target region, the degree of overlap between the first detection region and the second detection region is determined; see Formula 3 below:

[0096] Formula 3: I f (x+r,x)=B f (x+r)∩B f (x) / min(B f (x+r),B f (x));

[0097] Among them, I f (x+r,x) is used to characterize the degree of overlap between the first and second detection regions, B f (x) is used to characterize the first detection region of the first deep neural network f1 in the image test data, B f (x+r) is used to characterize the second detection region of the first deep neural network f1 in the adversarial image test data.

[0098] For example, if the first deep neural network f1 is a segmentation network, then the first output result is the first segmentation result, and the second output result is the second segmentation result; the conditional rule includes that the target difference between the first segmentation result and the second segmentation result is greater than the difference threshold; see Formula 4 for details:

[0099] Formula 4: C f (x+r,x)=H f (x+r,x)>th2;

[0100] Among them, C f (x+r,x) is used to characterize the conditional rule, f is used to characterize the segmentation network, and H... f (x+r,x) is used to characterize the target difference between the first segmentation result and the second segmentation result, and th2 is used to characterize the difference threshold; it should be noted that th2 is a constant and can be set by yourself;

[0101] In other words, for segmented networks, H f (x+r,x)>th2 indicates that the segmentation failed after interference processing.

[0102] In this embodiment of the application, the target difference between the first segmentation result and the second segmentation result is determined in the following manner:

[0103] The first sub-difference degree between the first segmentation result and the second segmentation result is determined by the one-way Hausdorff distance algorithm; the largest sub-difference degree is selected from the first sub-difference degree and the second sub-difference degree as the target difference degree between the first segmentation result and the second segmentation result.

[0104] In other words, in this embodiment of the application, the target difference between the first segmentation result and the second segmentation result is determined by the bidirectional House multi-shot distance algorithm; see Formula 5 for details.

[0105] Formula 5: H f (x+r,x)=hausdorff(S f (x+r,x),S f (x));

[0106] Wherein, hausdorff is used to characterize the bidirectional hausdorff distance, S f (x) is used to characterize the first segmentation result of the first deep neural network f1 on the image test data, S f (x+r,x) is used to characterize the second segmentation result of the first deep neural network f1 on the adversarial image test data, H f (x+r,x) is used to characterize the target difference between the first segmentation result and the second segmentation result, and measures the distance between the two segmentation results.

[0107] Based on the above-defined condition rules, after determining that the comparison relationship between the first output result and the second output result satisfies the condition rules, the individual value of the adversarial robustness index of the first deep neural network f1 on the image test data in each data pair that satisfies the condition rules is determined.

[0108] The individual value is the perturbation matrix used when perturbing the image test data corresponding to the first output result that satisfies the condition rules to obtain the adversarial image test data corresponding to the second output result.

[0109] In one possible case, the individual value is such that condition rule C f The minimum perturbation that holds true for (x+r,x) can be found in Formula 6.

[0110] Formula 6: R(x,f)=min r ||r||2s.tC f (x+r,x);

[0111] Where R(x,f) is used to characterize the individual value of the adversarial robustness index corresponding to the first deep neural network f1 at the image test data x, and r is the perturbation matrix.

[0112] Step S103: Based on the individual values ​​corresponding to each data pair, determine the target value of the adversarial robustness index of the first deep neural network on the image test dataset.

[0113] After determining the adversarial robustness index of the first deep neural network f1 on the image test data in each data pair, the target value of the adversarial robustness index of the first deep neural network f1 on the image test dataset is determined based on the individual values ​​determined for each data pair.

[0114] In one possible implementation, based on the perturbation matrix corresponding to each data pair, the target value of the adversarial robustness index of the first deep neural network f1 on the image test dataset is determined, including:

[0115] For any perturbation matrix, normalize the element values ​​in the perturbation matrix to determine an intermediate value.

[0116] In one possible implementation, normalization can be performed using Equation 7, or it can be performed using Equation 8:

[0117] Formula 7:

[0118] Where Y represents the intermediate value, R(x,f) represents the perturbation matrix, G(R(x,f)) represents the normalization process, and z i z is used to characterize the values ​​of each element in the perturbation matrix. min z is used to characterize the minimum element value in the perturbation matrix. max Used to characterize the maximum element value in the perturbation matrix;

[0119] Formula 8:

[0120] Where ρ is used to characterize the target value of the adversarial robustness index corresponding to the first deep neural network f1 on the image test dataset, E is used to characterize the expectation, x is used to characterize the image test data, TE is used to characterize the image test dataset, and R(x,f) is used to characterize the individual value of the adversarial robustness index corresponding to the first deep neural network f1.

[0121] After determining the intermediate values ​​corresponding to each perturbation matrix, the expected value will be determined based on each intermediate value, and the expected value will be used as the target value of the adversarial robustness index corresponding to the first deep neural network f1; see Formula 9 for details:

[0122] Formula 9: ρ=Ex∈TE G(R(x,f));

[0123] Where ρ is used to characterize the target value of the adversarial robustness index corresponding to the first deep neural network f1 on the image test dataset, E is used to characterize the expectation, x is used to characterize the image test data, TE is used to characterize the image test dataset, and G(R(x,f)) is used to characterize the intermediate value.

[0124] Step S104: If the target value is lower than the adversarial robustness index threshold, then based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset, determine the second image training dataset, and optimize the training of the first deep neural network based on the second image training dataset.

[0125] In this embodiment of the application, after obtaining the target value ρ, the obtained target value ρ is compared with the adversarial robustness index threshold ρ0, and the comparison result determines whether the first deep neural network needs to be optimized and trained.

[0126] For example, if the target value ρ is determined to be not less than the robustness index threshold ρ0, then the first deep neural network is determined to have good adversarial robustness, and there is no need to optimize the first deep neural network.

[0127] If the target value ρ is determined to be less than the robustness index threshold ρ0, then it is determined that the first deep neural network needs to be optimized.

[0128] After determining that the first deep neural network needs to be optimized, a second image training dataset needs to be obtained, and the network parameters in the first deep neural network are adjusted based on the second image training dataset, that is, the first deep neural network is optimized and trained to improve the adversarial robustness of the first deep neural network.

[0129] The second image training dataset includes the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset.

[0130] In one possible implementation, the adversarial image training dataset is obtained as follows:

[0131] Using the first deep neural network f1 trained on the first image training dataset as the base network, and taking the first image training dataset as input data, adversarial training is performed to obtain adversarial image training data that corresponds one-to-one with the image training data in the first image training dataset, that is, to obtain the adversarial image training dataset corresponding to the first image training dataset.

[0132] After optimizing the training of the first deep neural network f1 based on the second image training dataset, in order to ensure the adversarial robustness of the first deep neural network f1 obtained after optimization training, in this embodiment of the application, after obtaining the first deep neural network f1 obtained after optimization training, the target value of the adversarial robustness index corresponding to the first deep neural network f1 after optimization training is determined. For details, please refer to steps S100 to S104. The principle is similar and will not be repeated here.

[0133] After determining the target value of the adversarial robustness index corresponding to the first deep neural network f1 after optimization training, it is determined whether the target value of the adversarial robustness index corresponding to the first deep neural network f1 after optimization training reaches the adversarial robustness index threshold. That is, the target value of the adversarial robustness index corresponding to the first deep neural network after optimization training is compared with the adversarial robustness index threshold. Then, based on the comparison result, it is determined whether the first deep neural network f1 after optimization training needs to be optimized again.

[0134] Similarly, after determining that the target value of the adversarial robustness index corresponding to the first deep neural network f1 after optimization training is less than the adversarial robustness index threshold, it is determined that the first deep neural network f1 after optimization training needs to be optimized again.

[0135] When retraining for optimization, the network structure of the first deep neural network f1 will be changed. Specifically, a noise reduction module will be added to the optimized first deep neural network f1 to obtain the second deep neural network f2. Please refer to [reference needed]. Figure 4 , Figure 4 An exemplary schematic diagram of a second deep neural network with an added noise reduction module is provided in an embodiment of this application; and the second deep neural network f2 is optimized and trained based on a third image training dataset.

[0136] It should be noted that the third image training dataset can be a dataset that includes the first image training dataset and the adversarial image training dataset.

[0137] In this embodiment, after determining that the conditions for optimizing the training of the second deep neural network f2 are met, the optimized training of the second deep neural network f2 is obtained, and the relationship between the target value of the adversarial robustness index corresponding to the second deep neural network f2 and the adversarial robustness threshold is determined to determine whether the second deep neural network f2 needs to be optimized. After determining that the second deep neural network f2 needs to be optimized, the second deep neural network f2 is optimized by using the same method as optimizing the training of the first deep neural network f1, so as to ensure the adversarial robustness of the deep neural network used for target classification, target recognition and detection, and target segmentation.

[0138] Please refer to Figure 5 , Figure 5 An exemplary flowchart of a neural network optimization method according to an embodiment of this application is provided, including the following steps:

[0139] Step S500: Obtain the first image training dataset, and train the first deep neural network based on the first image training dataset to obtain the trained first deep neural network.

[0140] Step S501: Obtain the image test dataset and the adversarial image test dataset corresponding to the image test dataset, and based on the image test dataset and the adversarial image test dataset, determine at least one data pair, each data pair containing image test data and adversarial image test data obtained by interfering with the image test data.

[0141] Step S502: For any data pair, based on the first deep neural network, obtain the first output result corresponding to the image test data in the data pair, and the second output result corresponding to the adversarial image test data.

[0142] Step S503: For any data pair, after the ratio between the first output result and the second output result satisfies the condition rule, determine the individual value of the adversarial robustness index of the first deep neural network on the data pair.

[0143] Step S504: Based on the individual values ​​corresponding to each data pair, determine the target value of the adversarial robustness index of the first deep neural network on the image test dataset.

[0144] Step S505: Determine whether the target value is lower than the adversarial robustness index threshold. If it is lower, proceed to step S506; otherwise, proceed to step S510.

[0145] Step S506: Based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset, determine the second image training dataset, and optimize the training of the first deep neural network based on the second image training dataset.

[0146] Step S507: Determine the target value of the adversarial robustness index corresponding to the first deep neural network after optimization training.

[0147] Step S508: Determine whether the target value is lower than the adversarial robustness index threshold. If it is lower, proceed to step S509; otherwise, proceed to step S510.

[0148] Step S509: Add a noise reduction module to the first deep neural network to obtain a second deep neural network, and use a third image training dataset composed of the first image training dataset and its corresponding adversarial image training dataset to optimize and train the second deep neural network.

[0149] Step S510: End optimization training.

[0150] It should be noted that, in the embodiments of this application, after determining the target value of the adversarial robustness index of the first deep neural network on the image test data based on the individual values ​​corresponding to each data pair, if the target value is determined to be the first adversarial robustness index threshold, the network structure of the first deep neural network can be directly improved, that is, a noise reduction module is added to the first deep neural network to obtain a second deep neural network, and the second deep neural network is optimized and trained.

[0151] In this embodiment, a target value for the adversarial robustness index can be determined for the deep neural network for target classification, target detection and recognition, and target segmentation. Based on the relationship between the target value and the adversarial robustness threshold, it is determined that the deep neural network needs to be optimized and trained. Two optimization training methods are proposed to improve the adversarial robustness of the deep neural network for target classification, target detection and recognition, and target segmentation.

[0152] Based on the same inventive concept, this application also provides a neural network optimization device, please refer to... Figure 6 , Figure 6 An exemplary embodiment of this application provides a neural network optimization device, which includes at least one memory 601 and at least one processor 600, wherein:

[0153] Memory 601 is used to store program instructions;

[0154] The processor 600 is used to determine at least one data pair based on an image test dataset and an adversarial image test dataset corresponding to the image test dataset, wherein each data pair contains image test data and adversarial image test data obtained by interfering with the image test data.

[0155] For each data pair, an adversarial robustness evaluation operation is performed to obtain the individual values ​​of the adversarial robustness index of the first deep neural network for each data pair. The adversarial robustness evaluation operation includes: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data contained in the data pair, and a second output result corresponding to the adversarial image test data contained in the data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing performed on the image test data in the data pair, the individual value corresponding to the data pair is determined.

[0156] Based on the individual values ​​corresponding to each data pair, the target value of the adversarial robustness index of the first deep neural network on the image test dataset is determined, where the adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks.

[0157] If the target value is lower than the adversarial robustness index threshold, then a second image training dataset is determined based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset, and the first deep neural network is optimized and trained based on the second image training dataset.

[0158] In one possible implementation, the first deep neural network is a classification network, and the first output and the second output are the first classification result and the second classification result output by the classification network, respectively.

[0159] The conditional rules include: the first classification result is the same as the second classification result.

[0160] In one possible implementation, the first deep neural network is a detection and recognition network, and the first output result and the second output result are the first recognition result and the second recognition result output by the classification network, respectively.

[0161] The conditional rules include: the first recognition result is different from the second recognition result, and the overlap between the first detection region and the second detection region is less than the region overlap threshold; wherein, the first detection region is the detection region corresponding to the image test data processed by the detection and recognition network, and the second detection region is the detection region corresponding to the adversarial image data processed by the detection and recognition network.

[0162] In one possible implementation, the first deep neural network is a segmentation network, and the first output result and the second output result are the first segmentation result and the second segmentation result output by the segmentation network, respectively.

[0163] The conditional rule includes: the target difference between the first segmentation result and the second segmentation result is greater than the difference threshold.

[0164] In one possible implementation, the processor 600 determines the overlap between the first detection region and the second detection region in the following manner:

[0165] Determine the overlapping area between the first detection area and the second detection area, and determine the smallest target area within the first detection area and the second detection area;

[0166] The degree of overlap between the first detection area and the second detection area is determined based on the overlapping area and the minimum target area.

[0167] In one possible implementation, the processor 600 determines the target difference between the first segmentation result and the second segmentation result in the following manner:

[0168] The first sub-difference between the first segmentation result and the second segmentation result is determined by the one-way Hausdorff distance algorithm.

[0169] Between the first and second sub-difference scores, the largest sub-difference score is selected as the target difference score between the first and second segmentation results.

[0170] In one possible implementation, the individual value is the perturbation matrix used when perturbing the image test data corresponding to the first output result that satisfies the conditional rule in order to obtain the adversarial image test data corresponding to the second output result.

[0171] Processor 600 is specifically used for:

[0172] For any perturbation matrix, an intermediate value is determined based on the values ​​of each element in the perturbation matrix;

[0173] The expected value determined based on each intermediate value is used as the target value of the adversarial robustness index of the first deep neural network on the image test dataset.

[0174] In one possible implementation, the processor 600 determines the intermediate value in the following manner:

[0175] The element values ​​in the perturbation matrix are normalized to determine the intermediate values.

[0176] In one possible implementation, after optimizing the first deep neural network based on the second image training dataset, the processor 600 is also used for:

[0177] If it is determined that the target value corresponding to the first deep neural network trained on the second image training dataset is lower than the adversarial robustness index threshold, then a noise reduction module for reducing noise is added to the first deep neural network to obtain the second deep neural network.

[0178] The second deep neural network is optimized and trained based on the third image training dataset.

[0179] Based on the same inventive concept, embodiments of this application also provide a neural network optimization device 700, please refer to... Figure 7 , Figure 7 An exemplary embodiment of this application provides a neural network optimization apparatus 700, the apparatus comprising:

[0180] The first determining module 701 is used to determine at least one data pair based on the image test dataset and the adversarial image test dataset corresponding to the image test dataset, wherein each data pair contains image test data and adversarial image test data obtained by interfering with the image test data.

[0181] The module 702 is used to perform adversarial robustness evaluation operations on each data pair to obtain the individual values ​​of the adversarial robustness index corresponding to each data pair for the first deep neural network. The adversarial robustness evaluation operation includes: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data contained in the data pair, and a second output result corresponding to the adversarial image test data contained in the data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies the condition rule, then based on the interference processing of the image test data in the data pair, the individual value corresponding to the data pair is determined.

[0182] The second determining module 703 is used to determine the target value of the adversarial robustness index of the first deep neural network on the image test dataset based on the individual values ​​of each data pair, wherein the adversarial robustness index is used to characterize the ability of the first deep neural network to resist attacks.

[0183] The optimization training module 704 is used to determine a second image training dataset based on the first image training dataset and the adversarial image training dataset corresponding to the first image training dataset if the target value is lower than the adversarial robustness index threshold, and to optimize the training of the first deep neural network based on the second image training dataset.

[0184] In one possible implementation, the first deep neural network is a classification network, and the first output and the second output are the first classification result and the second classification result output by the classification network, respectively.

[0185] The conditional rules include: the first classification result is the same as the second classification result.

[0186] In one possible implementation, the first deep neural network is a detection and recognition network, and the first output result and the second output result are the first recognition result and the second recognition result output by the classification network, respectively.

[0187] The conditional rules include: the first recognition result is different from the second recognition result, and the overlap between the first detection region and the second detection region is less than the region overlap threshold; wherein, the first detection region is the detection region corresponding to the image test data processed by the detection and recognition network, and the second detection region is the detection region corresponding to the adversarial image data processed by the detection and recognition network.

[0188] In one possible implementation, the first deep neural network is a segmentation network, and the first output result and the second output result are the first segmentation result and the second segmentation result output by the segmentation network, respectively.

[0189] The conditional rule includes: the target difference between the first segmentation result and the second segmentation result is greater than the difference threshold.

[0190] In one possible implementation, the overlap between the first detection region and the second detection region is determined as follows:

[0191] Determine the overlapping area between the first detection area and the second detection area, and determine the smallest target area within the first detection area and the second detection area;

[0192] The degree of overlap between the first detection area and the second detection area is determined based on the overlapping area and the minimum target area.

[0193] In one possible implementation, the target difference between the first and second segmentation results is determined as follows:

[0194] The first sub-difference between the first segmentation result and the second segmentation result is determined by the one-way Hausdorff distance algorithm.

[0195] Between the first and second sub-difference scores, the largest sub-difference score is selected as the target difference score between the first and second segmentation results.

[0196] In one possible implementation, the individual value is the perturbation matrix used when perturbing the image test data corresponding to the first output result that satisfies the conditional rule in order to obtain the adversarial image test data corresponding to the second output result.

[0197] The second determining module 703 is specifically used for:

[0198] For any perturbation matrix, an intermediate value is determined based on the values ​​of each element in the perturbation matrix;

[0199] The expected value determined based on each intermediate value is used as the target value of the robustness index of the first deep neural network on the image test dataset.

[0200] In one possible implementation, for any perturbation matrix, the second determining module 703 determines the intermediate value in the following manner:

[0201] The element values ​​in the perturbation matrix are normalized to determine the intermediate values.

[0202] In one possible implementation, after optimizing the training module 704 trains the first deep neural network based on the second image training dataset, it is further used for:

[0203] If it is determined that the target value corresponding to the first deep neural network trained on the second image training dataset is lower than the adversarial robustness index threshold, then a noise reduction module for reducing noise is added to the first deep neural network to obtain the second deep neural network.

[0204] The second deep neural network is optimized and trained based on the third image training dataset.

[0205] In some possible implementations, various aspects of the network optimization method provided in this application can also be implemented as a program product comprising program code that, when run on a computer device, causes the computer device to perform the steps of the network optimization method according to the various exemplary embodiments of this application described above.

[0206] The program product may employ any combination of one or more readable media. A readable media may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0207] The SMS sending control program product of the embodiments of this application can be a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a computing device.

[0208] A readable signal medium may include a data signal propagated in baseband or as a carrier-submodel, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0209] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0210] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages.

[0211] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to the embodiments of this application, the feature vectors and functions of the two or more units described above can be embodied in each unit. Conversely, the feature vectors and functions of each unit described above can be further divided and embodied by multiple units.

[0212] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into a single step, and / or each step may be broken down into multiple steps.

[0213] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method of neural network optimization, the method comprising: The method comprises: determining at least one data pair based on an image test dataset and an adversarial image test dataset corresponding to the image test dataset, wherein each data pair comprises image test data and adversarial image test data obtained by performing interference processing on the image test data; performing adversarial robustness evaluation operations on each data pair to obtain individual values of an adversarial robustness index corresponding to each data pair on the first deep neural network, wherein the adversarial robustness evaluation operations comprise: processing one data pair in each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data in the one data pair and a second output result corresponding to the adversarial image test data in the one data pair; if it is determined that a comparison relationship between the first output result and the second output result satisfies a condition rule, determining an individual value corresponding to the one data pair based on interference processing performed on the image test data in the one data pair; the individual value is a perturbation matrix used when interference processing is performed on the image test data corresponding to the first output result that satisfies the condition rule to obtain the adversarial image test data corresponding to the second output result; the first deep neural network is obtained by training based on a first image training dataset; for any perturbation matrix, determining an intermediate value based on each element value in the perturbation matrix, and determining an expected value based on each intermediate value as a target value of an adversarial robustness index corresponding to the first deep neural network on the image test dataset, wherein the adversarial robustness index is used to represent the ability of the first deep neural network to resist attacks; if the target value is lower than an adversarial robustness index threshold value, determining a second image training dataset based on the first image training dataset and an adversarial image training dataset corresponding to the first image training dataset, and performing optimization training on the first deep neural network based on the second image training dataset; wherein, after performing optimization training on the first deep neural network based on the second image training dataset, the method further comprises: if it is determined that a target value corresponding to the first deep neural network trained based on the second image training dataset is lower than the adversarial robustness index threshold value, adding a noise reduction module for reducing noise in the first deep neural network to obtain a second deep neural network; performing optimization training on the second deep neural network based on a third image training dataset.

2. The method of claim 1, wherein, The first deep neural network is a classification network, and the first output result and the second output result are first and second classification results output by the classification network; The condition rule comprises: the first classification result is the same as the second classification result.

3. The method of claim 1, wherein, The first deep neural network is a detection and recognition network, and the first output result and the second output result are first and second recognition results output by the detection and recognition network; The condition rule comprises: The first recognition result is different from the second recognition result, and the area coincidence degree between the first detection area and the second detection area is less than an area coincidence degree threshold; the first detection area is a detection area corresponding to processing of the detection recognition network on the image test data, and the second detection area is a detection area corresponding to processing of the detection recognition network on the adversarial image data.

4. The method of claim 1, wherein, The first deep neural network is a segmentation network, and the first output result and the second output result are first segmentation result and second segmentation result output by the segmentation network. The conditional rule includes: A target difference degree between the first segmentation result and the second segmentation result is greater than a difference degree threshold.

5. The method of claim 1, wherein, For any perturbation matrix, the intermediate value is determined by: The element values in the perturbation matrix are normalized to determine the intermediate value.

6. An apparatus for neural network optimization, the apparatus comprising: The device includes at least one memory and at least one processor, wherein: The memory is configured to store program instructions. The processor is configured to determine at least one data pair based on an image test data set and an adversarial image test data set corresponding to the image test data set, wherein each data pair includes image test data and adversarial image test data obtained by performing interference processing on the image test data; For each data pair, an adversarial robustness evaluation operation is performed to obtain an individual value of an adversarial robustness index corresponding to each data pair of the first deep neural network, the adversarial robustness evaluation operation including: based on the first deep neural network processing one data pair in each data pair, obtaining a first output result corresponding to the image test data included in the one data pair, and a second output result corresponding to the adversarial image test data included in the one data pair; if it is determined that the comparison relationship between the first output result and the second output result satisfies a conditional rule, then based on the interference processing on the image test data in the one data pair, an individual value corresponding to the one data pair is determined; the individual value is a perturbation matrix used when the image test data corresponding to the first output result satisfying the conditional rule is interfered to obtain the adversarial image test data corresponding to the second output result; the first deep neural network is obtained by training based on a first image training data set; For any perturbation matrix, based on each element value in the perturbation matrix, an intermediate value is determined, and an expected value determined based on each intermediate value is used as a target value of an adversarial robustness index corresponding to the first deep neural network on the image test data set, wherein the adversarial robustness index is used to represent the defense capability of the first deep neural network against attacks; If the target value is lower than an adversarial robustness index threshold, a second image training data set is determined based on the first image training data set and an adversarial image training data set corresponding to the first image training data set, and the first deep neural network is optimized and trained based on the second image training data set. The processor is further configured to: after the first deep neural network is trained and optimized based on the second image training dataset, if it is determined that a target value corresponding to the first deep neural network trained based on the second image training dataset is lower than the adversarial robustness index threshold, adding a noise reduction module for reducing noise in the first deep neural network to obtain a second deep neural network; and training and optimizing the second deep neural network based on a third image training dataset.

7. An apparatus for neural network optimization, the apparatus comprising: The apparatus comprises: A first determination module configured to determine at least one data pair based on an image test dataset and an adversarial image test dataset corresponding to the image test dataset, wherein each data pair comprises image test data and adversarial image test data obtained by performing interference processing on the image test data; An obtaining module configured to perform an adversarial robustness evaluation operation on each data pair to obtain an individual value of an adversarial robustness index corresponding to each data pair of the first deep neural network, wherein the adversarial robustness evaluation operation comprises: processing one data pair of each data pair based on the first deep neural network to obtain a first output result corresponding to the image test data included in the one data pair and a second output result corresponding to the adversarial image test data included in the one data pair; if it is determined that a comparison relationship between the first output result and the second output result satisfies a condition rule, determining an individual value corresponding to the one data pair based on interference processing on the image test data in the one data pair; the individual value is a perturbation matrix used when the image test data corresponding to the first output result satisfying the condition rule is interfered to obtain the adversarial image test data corresponding to the second output result; and the first deep neural network is trained based on a first image training dataset; A second determination module configured to, for any perturbation matrix, determine an intermediate value based on each element value in the perturbation matrix, and determine an expected value based on each intermediate value as a target value of an adversarial robustness index corresponding to the first deep neural network on the image test dataset, wherein the adversarial robustness index is used to represent the ability of the first deep neural network to resist attacks; An optimization training module configured to, if the target value is lower than an adversarial robustness index threshold, determine a second image training dataset based on the first image training dataset and an adversarial image training dataset corresponding to the first image training dataset, and train and optimize the first deep neural network based on the second image training dataset. The optimization training module is further configured to: after the first deep neural network is trained and optimized based on the second image training dataset, if it is determined that the target value corresponding to the first deep neural network trained based on the second image training dataset is lower than the adversarial robustness index threshold, add a noise reduction module for reducing noise in the first deep neural network to obtain a second deep neural network; and train and optimize the second deep neural network based on a third image training dataset.

8. A computer readable storage medium for storing a computer program, characterized in that, The computer program, when executed by a processor, is configured to implement the method of any one of claims 1-5.

Images