Adversarial training method, device and equipment based on adaptive group sample perturbation constraint

Abstract

The application provides an adversarial training method, device and equipment based on adaptive group sample perturbation constraint, which comprises the following steps: inputting a training image into an initial network model to obtain a network output vector corresponding to the training image and a predicted category; if it is determined that the classification result of the training image is wrong based on the predicted category and an actual category of the training image, the training image is determined as a natural sample image; if it is determined that the classification result of the training image is correct based on the predicted category and the actual category, a target adaptive group corresponding to the training image is determined based on the network output vector; a target perturbation vector corresponding to the training image is determined based on a target sample perturbation constraint corresponding to the target adaptive group, and a perturbation sample image is generated based on the target perturbation vector and the training image; and the initial network model is trained based on the natural sample image and the perturbation sample image to obtain a target network model. Through the technical scheme of the application, the anti-interference ability of the target network model to attack samples is significantly improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security technology, and in particular to an adversarial training method, apparatus and equipment based on adaptive group sample perturbation constraints. Background Technology

[0002] Deep learning is a new research direction in the field of machine learning, introduced to bring it closer to its original goal: achieving artificial intelligence. Deep learning learns the inherent patterns and hierarchical representations of sample data. The information gained during this learning process greatly aids in interpreting data such as text, images, and sound. The ultimate goal of deep learning is to enable machines to have analytical learning capabilities, allowing them to recognize data such as text, images, and sound. Deep learning is a complex machine learning algorithm that has achieved remarkable results in fields such as image recognition, speech recognition, and natural language processing, leading to its widespread application.

[0003] When using deep learning to implement functions such as image recognition, speech recognition, and natural language processing, a deep neural network model, such as a CNN (Convolutional Neural Network), needs to be trained first. This model is then used to perform these functions. However, in the field of deep learning, various deep neural network models, including CNNs, are highly vulnerable to attack samples. For example, if an attacker adds a small perturbation to the input sample, creating an attack sample, and then inputs this attack sample into the deep neural network model, the model will output an incorrect result with high confidence, thus reducing the reliability of the deep neural network model. For instance, when using a deep neural network model to implement image classification, the image needs to be input into the model, which then performs artificial intelligence processing to obtain the classification result. However, if an attacker adds a small perturbation to the image, and then inputs the modified image into the deep neural network model, the resulting classification result may be incorrect. Summary of the Invention

[0004] This application provides an adversarial training method based on adaptive group sample perturbation constraints, including:

[0005] Acquire multiple training images; for each training image, input the training image into the initial network model to obtain the network output vector and predicted category corresponding to the training image;

[0006] If the classification result of the training image is determined to be incorrect based on the predicted category and the actual category of the training image, then the training image is determined to be a natural sample image;

[0007] If the classification result of the training image is determined to be correct based on the predicted category and the actual category, then the target adaptive group corresponding to the training image is determined based on the network output vector; the target perturbation vector corresponding to the training image is determined based on the target sample perturbation constraint corresponding to the target adaptive group; and a perturbation sample image is generated based on the target perturbation vector and the training image.

[0008] Based on the natural sample images and perturbation sample images corresponding to the multiple training images, the initial network model is trained to obtain the trained target network model.

[0009] The target network model is used to classify the images to be classified.

[0010] This application provides an adversarial training device based on adaptive group sample perturbation constraints, comprising:

[0011] The acquisition module is used to acquire multiple training images; for each training image, the training image is input into the initial network model to obtain the network output vector and predicted category corresponding to the training image;

[0012] The determination module is used to determine the training image as a natural sample image if the classification result of the training image is incorrect based on the predicted category and the actual category of the training image;

[0013] If the classification result of the training image is determined to be correct based on the predicted category and the actual category, then the target adaptive group corresponding to the training image is determined based on the network output vector; the target perturbation vector corresponding to the training image is determined based on the target sample perturbation constraint corresponding to the target adaptive group; and a perturbation sample image is generated based on the target perturbation vector and the training image.

[0014] The training module is used to train the initial network model based on the natural sample images and perturbed sample images corresponding to the multiple training images, so as to obtain the trained target network model.

[0015] The target network model is used to classify the images to be classified.

[0016] This application provides an adversarial training device based on adaptive group sample perturbation constraints, including a processor and a machine-readable storage medium. The machine-readable storage medium stores machine-executable instructions that can be executed by the processor. The processor is used to execute the machine-executable instructions to achieve the following steps:

[0017] Acquire multiple training images; for each training image, input the training image into the initial network model to obtain the network output vector and predicted category corresponding to the training image;

[0018] If the classification result of the training image is determined to be incorrect based on the predicted category and the actual category of the training image, then the training image is determined to be a natural sample image;

[0019] If the classification result of the training image is determined to be correct based on the predicted category and the actual category, then the target adaptive group corresponding to the training image is determined based on the network output vector; the target perturbation vector corresponding to the training image is determined based on the target sample perturbation constraint corresponding to the target adaptive group; and a perturbation sample image is generated based on the target perturbation vector and the training image.

[0020] Based on the natural sample images and perturbation sample images corresponding to the multiple training images, the initial network model is trained to obtain the trained target network model.

[0021] The target network model is used to classify the images to be classified.

[0022] As can be seen from the above technical solutions, in the embodiments of this application, when training the target network model (such as a deep neural network model), natural sample images and perturbed sample images can be used to jointly train the target network model, thereby obtaining a target network model with high natural accuracy and robustness. This enables the target network model to improve its adversarial ability against attack samples and significantly enhances its anti-interference ability against attack samples. For example, if an attacker adds a small perturbation to an image to form an attack sample, after inputting the attack sample into the target network model, the target network model can still output the correct conclusion, thereby improving the reliability of the target network model. This allows the trained target network model to have a good classification effect on input images with added small perturbations and obtain accurate classification results. Furthermore, for the perturbation samples used in the training of the target network model, multiple adaptive groups can be divided, each corresponding to a unified sample perturbation constraint. Based on this, the target adaptive group corresponding to the training image can be determined, and the target perturbation vector corresponding to the training image can be determined based on the target sample perturbation constraint corresponding to the target adaptive group. Perturbation sample images are generated based on the target perturbation vector and the training image, and then the target network model is trained using the perturbation sample images. It is worth noting that the target adaptive group and perturbation constraint of the sample can be adjusted to change the trade-off between natural accuracy and robust accuracy, thereby meeting the needs of different application scenarios (focusing more on natural accuracy or robust accuracy) and having wider applicability. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0024] Figure 1 This is a flowchart illustrating the adversarial training method based on adaptive group sample perturbation constraints.

[0025] Figure 2 This is a flowchart illustrating the adversarial training method based on adaptive group sample perturbation constraints.

[0026] Figure 3 This is a schematic diagram of the adversarial training device based on adaptive group sample perturbation constraints;

[0027] Figure 4 This is a hardware structure diagram of an adversarial training device based on adaptive group sample perturbation constraints. Detailed Implementation

[0028] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0029] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0030] To improve the resilience of a network model against attack samples, one possible implementation involves constructing a training dataset. This dataset can include multiple natural samples (such as training images). Based on this dataset, adversarial examples can be derived from the natural samples. Adversarial examples are samples that have been slightly perturbed and added to natural samples that the network model could correctly classify. These adversarial examples cause the network model to output incorrect classification results. Since the training dataset includes both natural and adversarial examples, training the network model using this dataset involves using both natural and adversarial examples. Training the network model using natural samples ensures accurate classification of natural samples, while training it using adversarial examples improves its resilience against attack samples.

[0031] In the above approach, adversarial examples need to be generated based on natural samples. To generate adversarial examples, fixed sample perturbation constraints are usually set (such as manually set by the user). Based on these perturbation constraints, adversarial examples are generated from natural samples. However, since all natural samples correspond to the same sample perturbation constraint, the differences in the anti-interference ability of natural samples are ignored (e.g., natural samples farther from the classifier decision boundary are more resistant to perturbation), resulting in low efficiency of adversarial training and poor adversarial ability of the network model.

[0032] Unlike the methods described above, another possible implementation involves dividing the network into multiple adaptive groups to generate adversarial examples based on natural samples. Each adaptive group corresponds to a sample perturbation constraint, and different adaptive groups can correspond to different sample perturbation constraints. Based on this, the adaptive group corresponding to each natural sample can be determined. Then, adversarial examples are generated based on the sample perturbation constraints corresponding to that adaptive group. These perturbation constraints consider both the anti-interference capabilities of different natural samples and improve the efficiency of adversarial training. Ultimately, this enhances the network model's adversarial capabilities against attack samples while maintaining high natural sample accuracy.

[0033] The technical solutions of the embodiments of this application will be described below with reference to specific examples.

[0034] This application proposes an adversarial training method based on adaptive group sample perturbation constraints. This method can be applied to any device. See [link to relevant documentation]. Figure 1 The diagram shown is a flowchart of the method, which includes:

[0035] Step 101: Obtain multiple training images; for each training image, input the training image into the initial network model to obtain the network output vector and predicted category corresponding to the training image.

[0036] For example, the training image can be input into the first sub-network of the initial network model, and the feature vector output by the first sub-network can be determined as the network output vector corresponding to the training image. The initial network model includes a first sub-network and a second sub-network. The second sub-network includes the last network layer in the initial network model, and the first sub-network includes all network layers except the last network layer.

[0037] Step 102: If the classification result of the training image is determined to be incorrect based on the predicted category and the actual category of the training image, then the training image is determined to be a natural sample image.

[0038] Step 103: If the classification result of the training image is determined to be correct based on the predicted category and the actual category of the training image, then the target adaptive group corresponding to the training image is determined based on the network output vector; the target perturbation vector corresponding to the training image is determined based on the target sample perturbation constraint corresponding to the target adaptive group; and a perturbation sample image is generated based on the target perturbation vector and the training image.

[0039] For example, determining the target adaptive group corresponding to the training image based on the network output vector may include, but is not limited to: determining the target feature value based on the maximum eigenvalue among the network output vectors corresponding to all training images with correct classification results, and determining at least two adaptive groups based on the target feature value; wherein each adaptive group corresponds to a feature value interval, and the feature value intervals corresponding to different adaptive groups are different. The feature value interval corresponding to the maximum eigenvalue in the network output vector is determined, and the adaptive group corresponding to this feature value interval is determined as the target adaptive group corresponding to the training image.

[0040] For example, at least two adaptive groups are determined based on the target feature value, including but not limited to: determining a first adaptive group, a second adaptive group, and a third adaptive group based on the target feature value. The starting value of the feature value interval corresponding to the first adaptive group is the difference between the target feature value and a preset first threshold (which can be configured empirically), and the ending value of the feature value interval corresponding to the first adaptive group is the sum of the target feature value and a preset second threshold (which can be configured empirically). The ending value of the feature value interval corresponding to the second adaptive group is the difference between the target feature value and the preset first threshold. The starting value of the feature value interval corresponding to the third adaptive group is the sum of the target feature value and the preset second threshold.

[0041] For example, the method for determining the target sample perturbation constraint corresponding to the target adaptive group includes, but is not limited to: obtaining the initial sample perturbation constraint; determining the initial perturbation vector based on the initial sample perturbation constraint; generating the initial sample image based on the initial perturbation vector and the training image corresponding to the target adaptive group; inputting the initial sample image into the configured reference network model to obtain the predicted category corresponding to the initial sample image; if the classification result of the initial sample image determined based on the predicted category is incorrect, then determining whether the initial sample perturbation constraint has met the search termination condition. If yes, determining the target sample perturbation constraint corresponding to the target adaptive group based on the initial sample perturbation constraint; if no, reducing the initial sample perturbation constraint, and returning to execute the operation of determining the initial perturbation vector based on the initial sample perturbation constraint based on the reduced initial sample perturbation constraint.

[0042] After inputting the initial sample image into the configured reference network model and obtaining the predicted category corresponding to the initial sample image, if the classification result of the initial sample image is determined to be correct based on the predicted category, an initial sample perturbation constraint can be added. It is then determined whether the added initial sample perturbation constraint is greater than the configured maximum value of the sample perturbation constraint. If not, the operation of determining the initial perturbation vector based on the added initial sample perturbation constraint is returned; if yes, the target sample perturbation constraint corresponding to the target adaptive group is determined based on the maximum value of the sample perturbation constraint.

[0043] Determining the target perturbation vector corresponding to the training image based on the target sample perturbation constraint corresponding to the target adaptive group may include, but is not limited to: determining the perturbation vector interval based on the target sample perturbation constraint corresponding to the target adaptive group; wherein, the maximum perturbation vector in the perturbation vector interval is determined based on the target sample perturbation constraint; and determining the perturbation vector in the perturbation vector interval as the target perturbation vector.

[0044] Step 104: Based on the natural sample images and perturbed sample images corresponding to multiple training images, train the initial network model to obtain the trained target network model. For example, the target network model is used to classify the image to be classified; that is, after the image to be classified is input into the target network model, the target network model can perform artificial intelligence processing on the image to be classified to obtain the classification result.

[0045] In one possible implementation, a natural sample image can be input into the initial network model to obtain a first feature vector corresponding to the natural sample image, and a first loss value can be determined based on the first feature vector. A perturbed sample image can be input into the initial network model to obtain a second feature vector corresponding to the perturbed sample image, and a second loss value can be determined based on the second feature vector. Then, a target loss value is determined based on the first and second loss values, and the initial network model is adjusted based on the target loss value to obtain an adjusted network model. Based on this, if the adjusted network model has converged, it is determined as the target network model; if the adjusted network model has not converged, it is determined as the initial network model, and the operation of inputting training images into the initial network model is returned.

[0046] As can be seen from the above technical solutions, in the embodiments of this application, when training the target network model (such as a deep neural network model), natural sample images and perturbed sample images can be used to jointly train the target network model, thereby obtaining a target network model with high natural accuracy and robustness. This enables the target network model to improve its adversarial ability against attack samples and significantly enhances its anti-interference ability against attack samples. For example, if an attacker adds a small perturbation to an image to form an attack sample, after inputting the attack sample into the target network model, the target network model can still output the correct conclusion, thereby improving the reliability of the target network model. This allows the trained target network model to have a good classification effect on input images with added small perturbations and obtain accurate classification results. Furthermore, for the perturbation samples used in the training of the target network model, multiple adaptive groups can be divided, each corresponding to a unified sample perturbation constraint. Based on this, the target adaptive group corresponding to the training image can be determined, and the target perturbation vector corresponding to the training image can be determined based on the target sample perturbation constraint corresponding to the target adaptive group. Perturbation sample images are generated based on the target perturbation vector and the training image, and then the target network model is trained using the perturbation sample images. It is worth noting that the target adaptive group and perturbation constraint of the sample can be adjusted to change the trade-off between natural accuracy and robust accuracy, thereby meeting the needs of different application scenarios (focusing more on natural accuracy or robust accuracy) and having wider applicability.

[0047] The adversarial training method based on adaptive group sample perturbation constraints according to embodiments of this application will be described below with reference to specific examples. See also Figure 2 The diagram shown is a flowchart of an adversarial training method based on adaptive group sample perturbation constraints according to an embodiment of this application. The method may include the following steps:

[0048] Step 201: Obtain the training dataset. The training dataset includes multiple natural samples. Natural samples can be image samples or other types of samples. There are no restrictions on this. In the following, we will take image samples as an example and refer to the natural samples in the training dataset as training images. That is, the training dataset includes multiple training images.

[0049] Step 202: For each training image in the training dataset, input the training image into the initial network model to obtain the network output vector and predicted category corresponding to the training image.

[0050] For example, a pre-configured network model can be used as the initial network model. The structure of this initial network model is not limited; it can be a network model employing deep learning algorithms (such as a deep neural network model) or other machine learning algorithms. The type of this initial network model is also not limited; for example, it could be a CNN model, an RNN (recurrent neural network) model, or a fully connected network model. This initial network model can be used to implement classification functions, that is, to identify the category of target objects in an image. The functionality of this initial network model is not limited.

[0051] The initial network model can be an untrained network model. The initial network model can be trained using a training dataset. For the training process, please refer to the following examples.

[0052] The initial network model can include multiple network layers, which may include, but are not limited to, convolutional layers (Conv), pooling layers (Pool), activation layers, fully connected layers (FC), etc. There are no restrictions on the type of network layer. Based on this, all network layers of the initial network model can be divided into a first sub-network and a second sub-network. The second sub-network includes the last network layer in the initial network model, and the first sub-network includes all network layers except the last one. For example, if the initial network model includes M network layers, then the second sub-network includes the Mth network layer, and the first sub-network includes the 1st to the (M-1)th network layers. If M is 5, the first sub-network includes the 1st network layer (denoted as network layer a1), the 2nd network layer (denoted as network layer a2), the 3rd network layer (denoted as network layer a3), and the 4th network layer (denoted as network layer a4), and the second sub-network includes the 5th network layer (denoted as network layer a5).

[0053] For example, for each training image in the training dataset, the training image can be input into the initial network model to obtain the network output vector and predicted category corresponding to the training image. For instance, the training image can be input into the first sub-network of the initial network model, and the feature vector output by the first sub-network can be determined as the network output vector corresponding to the training image. Furthermore, the predicted category corresponding to the training image can be determined based on this network output vector. For example, if the initial network model is used to identify 10 categories, the network output vector can correspond to 10 probability values, each corresponding to one of the 10 categories. The category with the highest probability value is taken as the predicted category corresponding to the training image; this process is not restricted.

[0054] For example, for each training image, the image is input into network layer a1 of the initial network model. Layer a1 processes the image to obtain feature vector b1. Feature vector b1 is then input into network layer a2, which processes it to obtain feature vector b2. Feature vector b2 is then input into network layer a3, which processes it to obtain feature vector b3. Feature vector b3 is then input into network layer a4, which processes it to obtain feature vector b4. Feature vector b4 is used as the network output vector for that training image. After obtaining feature vector b4, the predicted category for that training image can be determined based on it.

[0055] In summary, for each training image in the training dataset, after inputting the training image into the initial network model, we can obtain the network output vector and predicted category corresponding to the training image.

[0056] For example, it can be defined For an initial network model with parameter θ, this initial network model can be represented as: The feature vector (Logit) output by the penultimate layer of this initial network model is denoted as... This paper refers to this feature vector (Logit) as the network output vector. Based on the feature vector output from the penultimate layer of the initial network model, the network output vector and predicted category corresponding to the training image can be obtained. In summary, it can be seen that after inputting the training image into the initial network model, the network output vector and predicted category corresponding to the training image can be obtained.

[0057] Step 203: For each training image in the training dataset, the training image can correspond to an actual category (the labeled category of the training image, which is the true category of the training image) and a predicted category (the category obtained after inputting the training image into the initial network model). If the classification result of the training image is determined to be incorrect based on the predicted category and the actual category, that is, the predicted category is different from the actual category, then the training image is stored in the first subset. If the classification result of the training image is determined to be correct based on the predicted category and the actual category, that is, the predicted category is the same as the actual category, then the training image is stored in the second subset.

[0058] In summary, for all training images in the training dataset, some training images may be stored in the first subset, while the remaining training images are stored in the second subset. For example, if the training dataset includes training images c1-c10, training images c1-c6 are stored in the first subset (the first subset is used to store training images with incorrect classification results), and training images c7-c10 are stored in the second subset (the second subset is used to store training images with correct classification results).

[0059] For example, for the training images in the first subset, it is not necessary to generate adversarial examples corresponding to the training images. The initial network model can be trained based on the training images. For ease of distinction, in subsequent embodiments, the training images in the first subset are referred to as natural sample images. For the training images in the second subset, it is necessary to generate adversarial examples corresponding to the training images. The initial network model can be trained based on the adversarial examples. For ease of distinction, the adversarial examples are referred to as perturbation sample images.

[0060] Step 204: For each training image in the second subset, the network output vector corresponding to the training image may include multiple feature values. Select the largest feature value (denoted as z) from all the feature values ​​of the network output vector. max The target feature value is determined based on the largest feature value among all network output vectors.

[0061] In one possible implementation, the network output vector includes multiple eigenvalues ​​(also called element values), such as an m*n dimensional matrix where each value is called an eigenvalue. For each training image in the second subset, the largest eigenvalue is selected from all eigenvalues ​​of the network output vector corresponding to that training image. For example, the largest eigenvalue d1 is selected from all eigenvalues ​​of the network output vector corresponding to training image c7, d2 from training image c8, d3 from training image c9, and d4 from training image c10. The target eigenvalue is determined based on the largest eigenvalues ​​d1, d2, d3, and d4. For example, the average of the four largest eigenvalues, the maximum value, or the minimum value can be used as the target eigenvalue; there are no restrictions on this.

[0062] Step 205: Determine at least two adaptive groups based on the target feature value. Each adaptive group corresponds to a feature value interval (the feature value range of the feature value interval can be determined based on the target feature value), and the feature value intervals corresponding to different adaptive groups are different, that is, the adaptive groups and feature value intervals can correspond one-to-one.

[0063] For example, based on the target feature value, a first adaptive group and a second adaptive group can be determined. The first adaptive group corresponds to the feature value interval e1, and the second adaptive group corresponds to the feature value interval e2. The ending value of the feature value interval e1 is the target feature value (hereinafter denoted as d), and the starting value of the feature value interval e1 can be 0 or -∞, i.e., e1 = (-∞, d). The starting value of the feature value interval e2 is the target feature value d, and the ending value of the feature value interval e2 can be +∞, i.e., e2 = [d, +∞).

[0064] For example, based on the target feature value, a first adaptive group, a second adaptive group, and a third adaptive group can be determined. The first adaptive group corresponds to the feature value interval e3, the second adaptive group corresponds to the feature value interval e4, and the third adaptive group corresponds to the feature value interval e5. The starting value of the feature value interval e3 can be the difference between the target feature value d and a preset first threshold (which can be configured empirically, denoted as f1, where f1 is a positive number). The ending value of the feature value interval e3 can be the sum of the target feature value d and a preset second threshold (which can be configured empirically, denoted as f2, where f2 is a positive number, and f2 and f1 can be the same or different), i.e., e3 = [d - f1, d + f2]. The ending value of the feature value interval e4 can be the difference between the target feature value d and the preset first threshold. The starting value of the feature value interval e4 can be 0 or -∞, i.e., e4 = (-∞, d - f1). The starting value of the feature value interval e5 can be the sum of the target feature value d and the preset second threshold, and the ending value of the feature value interval e5 can be +∞, that is, e5 = (d + f2, +∞).

[0065] In summary, we can select training images that are correctly classified by the initial network model to obtain the z-value of the training images. max The frequency distribution of the z-axis approximates a normal distribution, and the frequency distribution is concentrated in z. max Training images near the mean (i.e., the target feature value d) are grouped into one group (the first adaptive group), and those below z are grouped into another group. max The training images with the mean were divided into one group (the second adaptive group), and those with a mean greater than z were grouped together. max The training images with the mean were grouped into one group (the third adaptive group).

[0066] For example, based on the target feature value, four adaptive groups can be determined. The feature value interval corresponding to the first adaptive group is [d-f1, d+f2], the feature value interval corresponding to the second adaptive group is (-∞, d-f1), the feature value interval corresponding to the third adaptive group is (d+f2, d+f2+f3], and the feature value interval corresponding to the fourth adaptive group is (d+f2+f3, +∞). Of course, the above are just a few examples. As long as multiple adaptive groups can be divided based on the target feature value, there is no restriction on the way these adaptive groups are divided.

[0067] Step 206: For each adaptive group, determine the sample perturbation constraints corresponding to that adaptive group.

[0068] For example, since the determination method of the sample perturbation constraints corresponding to each adaptive group is the same, in the following embodiments, the determination process of the sample perturbation constraints corresponding to an adaptive group will be taken as an example.

[0069] For step 206, the sample perturbation constraints corresponding to the adaptive group can be determined using the following steps:

[0070] Step 2061: Obtain the initial sample perturbation constraint. This initial sample perturbation constraint can be arbitrarily configured based on experience. For example, initialize a sample perturbation constraint interval [ε]. l , ε r ], ε l ε represents the minimum value of the sample perturbation constraint interval. r The maximum value of the sample perturbation constraint interval can be configured empirically and is not restricted, as long as ε l Less than ε r That is, ε can be r This serves as the initial sample perturbation constraint.

[0071] Step 2062: Determine the initial perturbation vector based on the initial sample perturbation constraint. For example, first determine the perturbation vector interval based on the initial sample perturbation constraint. The maximum perturbation vector within this interval is determined based on the initial sample perturbation constraint. The perturbation vectors within this interval are then determined as the initial perturbation vectors. It should be noted that the initial perturbation vector can include multiple perturbation values. That is, for each pixel in the image, there is a corresponding perturbation value. The perturbation values ​​corresponding to different pixels can be the same or different, but the perturbation value corresponding to each pixel must be within the perturbation vector interval.

[0072] For example, the perturbation vector interval can be [-ε] r , ε r There are no restrictions on this, as long as the maximum perturbation vector in the perturbation vector interval is equal to the initial sample perturbation constraint ε. r That's it. After obtaining the perturbation vector interval, any perturbation vector within the perturbation vector interval is determined as the initial perturbation vector. There are no restrictions on this, as long as the initial perturbation vector lies within the perturbation vector interval. For example, from the perturbation vector interval [-ε r , ε r A perturbation vector is randomly selected from the interval [-ε], and this selected perturbation vector is used as the initial perturbation vector. It is important to note that within the perturbation vector interval [-ε]... r , ε r When randomly selecting the initial perturbation vector, multiple perturbation values ​​need to be randomly selected, meaning each pixel corresponds to one perturbation value, and all of these perturbation values ​​must be located within the perturbation vector range [-ε]. r , ε r ].

[0073] Step 2063: Generate initial sample images based on the initial perturbation vector and the training images corresponding to the adaptive group.

[0074] For example, assuming we divide the training image into a first adaptive group, a second adaptive group, and a third adaptive group, when determining the sample perturbation constraints corresponding to the first adaptive group (the implementation of the second and third adaptive groups is similar, using the first adaptive group as an example), for each training image in the second subset, we select the largest eigenvalue z from all the eigenvalues ​​of the network output vector corresponding to that training image. max If the largest eigenvalue z max If the feature value is within the feature value interval e3 corresponding to the first adaptive group, then the training image is assigned to the first adaptive group. If the maximum feature value z max If a training image is not located in the feature value interval e3 corresponding to the first adaptive group, then the training image will not be assigned to the first adaptive group. In summary, the training images corresponding to the first adaptive group (there can be multiple ones) can be obtained. Taking the training image c7 corresponding to the first adaptive group as an example.

[0075] Based on the initial perturbation vector corresponding to the first adaptive group and the training image c7 corresponding to the first adaptive group, an initial sample image c7' corresponding to the training image c7 can be generated. For example, the initial perturbation vector is added to the training image c7 to obtain the initial sample image c7'. That is, the initial perturbation vector is added to the pixel value of each pixel in the training image c7 to obtain the initial sample image c7'.

[0076] The initial perturbation vector includes multiple perturbation values, meaning each pixel corresponds to one perturbation value. For each pixel, the perturbation value corresponding to that pixel is added to the pixel value.

[0077] Step 2064: Input the initial sample image into the configured reference network model (i.e., the reference network model configured based on experience) to obtain the predicted category corresponding to the initial sample image.

[0078] For example, in determining the sample perturbation constraints corresponding to the adaptive group, the reference network model is used to provide the predicted category corresponding to the initial sample image. During the determination of the sample perturbation constraints, the reference network model remains unchanged; that is, it does not change and therefore does not require training.

[0079] For example, the structure of the reference network model can be the same as that of the initial network model, the function of the reference network model can be the same as that of the initial network model, and the parameter values ​​in the reference network model can be different from those in the initial network model. During the training of the initial network model, the parameter values ​​in the initial network model will change, while the parameter values ​​in the reference network model will not change.

[0080] For example, after the initial sample image is input into the reference network model, the reference network model can process the initial sample image and obtain the predicted category corresponding to the initial sample image. The method for obtaining the predicted category can be found in step 202, and will not be repeated here.

[0081] Step 2065: Based on the predicted category and the actual category of the initial sample image, determine whether the classification result of the initial sample image is incorrect.

[0082] If yes, meaning the predicted category of the initial sample image is different from the actual category of the initial sample image, then proceed to step 2066. If no, meaning the predicted category of the initial sample image is the same as the actual category of the initial sample image, then proceed to step 2069.

[0083] Step 2066: If the classification result of the initial sample image is incorrect, determine whether the initial sample perturbation constraint has met the search termination condition. If yes, proceed to step 2067; otherwise, proceed to step 2068.

[0084] Step 2067: Determine the sample perturbation constraint corresponding to the initial sample image based on the initial sample perturbation constraint. For example, use the initial sample perturbation constraint as the sample perturbation constraint corresponding to the initial sample image.

[0085] Step 2068: Reduce the initial sample perturbation constraint. Based on the reduced initial sample perturbation constraint, return to step 2062. When step 2062 is re-executed, the initial sample perturbation constraint is the reduced initial sample perturbation constraint, that is, the initial perturbation vector is determined based on the reduced initial sample perturbation constraint.

[0086] For steps 2066-2068, it can be determined whether the search termination condition has been met. This search termination condition can be configured based on experience and is not restricted. For example, the search termination condition could be: the maximum value ε of the sample perturbation constraint interval. r (i.e., initial sample perturbation constraint ε) r The minimum value ε between the sample perturbation constraint interval and the sample perturbation constraint interval. l The difference between them is less than or equal to a preset threshold γ, i.e., ε r -ε l ≤γ, of course, the search termination condition can also be other conditions, and there are no restrictions on this. Based on this, if ε r With ε l If the difference is less than or equal to γ, then the initial sample perturbation constraint ε is applied. r This serves as the sample perturbation constraint corresponding to the initial sample image. If ε r With ε lIf the difference is greater than γ, then reduce the initial sample perturbation constraint ε. r That is, the sample perturbation constraint interval [ε] l , ε r ε in ] r Reduce, and reduce ε r Update to the initial sample perturbation constraint, that is, update to the sample perturbation constraint interval.

[0087] Based on the reduced initial sample perturbation constraint ε r Return to steps 2062-2065. In step 2065, if the classification result of the initial sample image is incorrect, then determine ε. r With ε l If the difference is less than or equal to γ, then ε r As a sample perturbation constraint corresponding to the initial sample image, if the difference is greater than γ, then the initial sample perturbation constraint ε is reduced. r And so on. In the above process, ε r This refers to the reduced initial sample perturbation constraint, ε l It is the minimum value of the sample perturbation constraint interval. Obviously, in the above process, ε is continuously adjusted. r To reduce, while ε l It remains unchanged, i.e., ε r With ε l The difference becomes smaller and smaller until ε r -ε l ≤γ.

[0088] For example, in reducing the initial sample perturbation constraint ε r At this time, the bisection method can be used to reduce the initial sample perturbation constraint ε. r That is, the reduced initial sample perturbation constraint ε r It is half of the initial sample perturbation constraint before reduction. Of course, other methods can also be used to reduce the initial sample perturbation constraint ε. r No restrictions are placed on this.

[0089] Step 2069: If the classification result of the initial sample image is correct, increase the initial sample perturbation constraint and determine whether the increased initial sample perturbation constraint is greater than the configured maximum value of the sample perturbation constraint (this can be configured empirically). If not, based on the increased initial sample perturbation constraint, return to step 2062. When re-executing step 2062, the initial sample perturbation constraint is the increased initial sample perturbation constraint; that is, the initial perturbation vector is determined based on the increased initial sample perturbation constraint. If yes, the sample perturbation constraint corresponding to the initial sample image is determined based on the maximum value of the sample perturbation constraint. For example, the maximum value of the sample perturbation constraint is used as the sample perturbation constraint corresponding to the initial sample image.

[0090] For step 2069, an initial sample perturbation constraint ε can be added. r That is, the sample perturbation constraint interval [ε] l , ε r ε in ] r Increase, and the increased ε r Update to the initial sample perturbation constraints, that is, update to the sample perturbation constraint interval. Additionally, the sample perturbation constraint interval [ε] can be expanded. l , ε r ε in ] l , will increase ε l Update to the sample perturbation constraint interval, i.e., the sample perturbation constraint interval [ε]. l , ε r ε in ] l and ε r All increased.

[0091] For example, when increasing the initial sample perturbation constraint ε r In such cases, the following methods can be used: These values ​​are configured based on experience and can be positive, meaning they are set within the initial sample perturbation constraint ε. r Add numerical values ​​based on The increased initial sample perturbation constraint ε is obtained. r In the range of increased sample perturbation constraints [ε] l , ε r ε in ] l In such cases, the following methods can be used: These values ​​are configured based on experience and can be positive, i.e., within ε. l Add numerical values ​​based on The increased ε l In the above process, the numerical values With numerical values They can be the same or different; this embodiment uses numerical values. With numerical values Using the same example. Of course, other methods can also be used to increase the initial sample perturbation constraint ε. r No restrictions are placed on this.

[0092] In practical applications, to prevent initial sample perturbation constraints ε r If the value is too large, it can be addressed by continuously updating ε. l ←(ε l +ε r ) / 2 or ε r ←(ε l +ε r ) / 2, thus continuously shrinking [ε l,ε r The scope of ].

[0093] The initial sample perturbation constraint ε after the addition can be determined. r If the value is greater than the maximum value of the sample perturbation constraint, then the maximum value of the sample perturbation constraint is used as the sample perturbation constraint corresponding to the initial sample image. If not, then the increased initial sample perturbation constraint ε is used. r Return to steps 2062-2065. In step 2065, if the classification result of the initial sample image is correct, then continue to increase the initial sample perturbation constraint ε. r And so on, until the initial sample perturbation constraint ε is increased. r Greater than the maximum value of the sample perturbation constraint, or based on the increased initial sample perturbation constraint ε. r If the classification result of the initial sample image is found to be incorrect, steps 2066-2068 are executed to finally obtain the sample perturbation constraints corresponding to the initial sample image.

[0094] In summary, for each training image corresponding to the first adaptive group, steps 2061-2069 can be used to obtain the sample perturbation constraints corresponding to the initial sample image of that training image. Based on the sample perturbation constraints corresponding to the training images of the first adaptive group, the sample perturbation constraints corresponding to the first adaptive group can be obtained. For example, the average value of the sample perturbation constraints corresponding to the training images of the first adaptive group can be used as the sample perturbation constraints corresponding to the first adaptive group; or, the maximum value of the sample perturbation constraints corresponding to the training images of the first adaptive group can be used as the sample perturbation constraints corresponding to the training images of the first adaptive group; or, the minimum value of the sample perturbation constraints corresponding to the training images of the first adaptive group can be used as the sample perturbation constraints corresponding to the training images of the first adaptive group. There are no restrictions on this.

[0095] Similarly, we can obtain the sample perturbation constraints corresponding to the second adaptive group and the third adaptive group, and thus obtain the sample perturbation constraints corresponding to each adaptive group.

[0096] Step 207: For each training image in the second subset, select the largest feature value from all feature values ​​of the network output vector corresponding to the training image, and determine the target adaptive group corresponding to the training image based on the largest feature value; determine the target perturbation vector corresponding to the training image based on the target sample perturbation constraint corresponding to the target adaptive group, and generate a perturbation sample image based on the target perturbation vector and the training image.

[0097] For example, assuming we divide the network into a first adaptive group, a second adaptive group, and a third adaptive group, we can select the largest eigenvalue z from all the eigenvalues ​​of the network output vector corresponding to the training image.max If the largest eigenvalue z max If the eigenvalue is within the eigenvalue interval e3 corresponding to the first adaptive group, then the target adaptive group is the first adaptive group. If the largest eigenvalue z max If the eigenvalue is within the eigenvalue interval e4 corresponding to the second adaptive group, then the target adaptive group is the second adaptive group. If the maximum eigenvalue z max If the eigenvalue is within the eigenvalue interval e5 corresponding to the third adaptive group, then the target adaptive group is the third adaptive group. If the target adaptive group is the first adaptive group, then the sample perturbation constraint corresponding to the first adaptive group is determined as the target sample perturbation constraint.

[0098] Then, a perturbation vector interval is determined based on the target sample perturbation constraint. The maximum perturbation vector within this interval is determined based on the target sample perturbation constraint. The perturbation vectors within this interval are defined as the target perturbation vectors corresponding to the training image. A perturbation sample image is then generated based on the target perturbation vector and the training image. It is important to note that the target perturbation vector can include multiple perturbation values; that is, each pixel in the image corresponds to one perturbation value. The perturbation values ​​for different pixels can be the same or different, but the perturbation value for each pixel must fall within the perturbation vector interval.

[0099] For example, the perturbation vector interval can be [-ε] r , ε r There are no restrictions on this, as long as the maximum perturbation vector in the perturbation vector interval is equal to the target sample perturbation constraint ε. r That's it. After obtaining the perturbation vector interval, any perturbation vector within the interval is designated as the target perturbation vector corresponding to the training image. There are no restrictions on this, as long as the target perturbation vector lies within the perturbation vector interval. It should be noted that within the perturbation vector interval [-ε]... r , ε r When randomly selecting a target perturbation vector in [], multiple perturbation values ​​need to be randomly selected, meaning each pixel corresponds to one perturbation value, and all of these perturbation values ​​must be located within the perturbation vector interval [-ε]. r , ε r ].

[0100] After obtaining the target perturbation vector corresponding to the training image, the target perturbation vector is added to the training image to obtain the perturbation sample image. That is, the target perturbation vector is added to the pixel value of each pixel in the training image to obtain the perturbation sample image. Then, the perturbation sample image can be used to replace the training image in the second subset, that is, to update the second subset.

[0101] The target perturbation vector includes multiple perturbation values, meaning that each pixel corresponds to one perturbation value. For each pixel, the perturbation value corresponding to that pixel is added to the pixel value of that pixel.

[0102] Obviously, after performing the above processing on each training image in the second subset, we can obtain the perturbation sample image corresponding to each training image, so that all images included in the second subset are perturbation sample images. The perturbation sample image is an adversarial sample obtained by adding perturbation to the training image.

[0103] It should be noted that since different training images may correspond to different adaptive groups, different training images can correspond to different sample perturbation constraints. Considering the anti-interference ability of different training images, the ability to resist attack samples is improved while the natural accuracy is appropriately protected.

[0104] In summary, we can obtain a first subset and a second subset. The first subset includes multiple natural sample images (i.e., non-adversarial samples), and the second subset includes multiple perturbation sample images (i.e., adversarial samples). Based on these, model training can be performed using the first and second subsets, as detailed in subsequent steps.

[0105] Step 208: Based on the natural sample images in the first subset and the perturbation sample images in the second subset, train the initial network model to obtain the trained target network model.

[0106] In one possible implementation, the initial network model can be trained using the following steps:

[0107] Step 2081: Input the natural sample images in the first subset into the initial network model to obtain the first feature vector corresponding to the natural sample images, and determine the first loss value based on the first feature vector.

[0108] For example, for each natural sample image in the first subset, the natural sample image is input into the first sub-network of the initial network model, and the feature vector output by the first sub-network is used as the first feature vector corresponding to the natural sample image (that is, the first feature vector corresponds to the network output vector in the above embodiment).

[0109] After obtaining the first feature vectors corresponding to all natural sample images, the loss value of the target loss function 1 can be determined based on these first feature vectors, denoted as the first loss value. For example, the target loss function 1 can be pre-configured, with the first feature vectors as input and the first loss value as output. There are no restrictions on the target loss function 1, as long as the above input-output relationship is satisfied. Based on this, after obtaining these first feature vectors, they can be substituted into the target loss function 1 to obtain the first loss value of the target loss function 1.

[0110] Step 2082: Input the perturbation sample images in the second subset into the initial network model to obtain the second feature vector corresponding to the perturbation sample images, and determine the second loss value based on the second feature vector.

[0111] For example, for each perturbation sample image in the second subset, the perturbation sample image can be input into the first sub-network of the initial network model to obtain the second feature vector.

[0112] After obtaining the second feature vectors corresponding to all perturbed sample images, the loss value of the target loss function 2 can be determined based on these second feature vectors, denoted as the second loss value. The target loss function 2 can be the same as or different from the target loss function 1; assuming they are the same, we will use that as an example. After obtaining the second feature vectors, these second feature vectors can be substituted into the target loss function 2 to obtain the second loss value.

[0113] Step 2083: Determine the target loss value based on the first loss value and the second loss value, and adjust the initial network model based on the target loss value to obtain the adjusted network model.

[0114] For example, the target loss value can be determined based on the sum of the first loss value and the second loss value. Then, the parameters of the initial network model can be updated based on the target loss value, such as by updating the network parameters (i.e., network weights) of the initial network model through the backpropagation algorithm, resulting in an updated network model (denoted as the adjusted network model). There are no restrictions on this update process. An example of the backpropagation algorithm can be gradient descent, i.e., updating the network weights of the initial network model through gradient descent.

[0115] Step 2084: After obtaining the adjusted network model, if the adjusted network model has converged, then the adjusted network model is determined as the target network model, that is, the model training process is completed, and the trained target network model is obtained. If the adjusted network model has not converged, then the adjusted network model is determined as the initial network model, and the process returns to step 202, that is, each training image in the training dataset is input into the adjusted network model, and the above steps are repeated until the adjusted network model has converged, and the target network model is obtained.

[0116] For example, if the target loss value is less than a preset threshold, the adjusted network model can be determined to have converged; otherwise, it is determined that the adjusted network model has not converged. Alternatively, if the number of iterations of the initial network model reaches a preset threshold, the adjusted network model can be determined to have converged; otherwise, it is determined that the adjusted network model has not converged. Or, if the iteration duration of the initial network model reaches a preset duration threshold, the adjusted network model can be determined to have converged; otherwise, it is determined that the adjusted network model has not converged. Of course, the above are just a few examples of whether the adjusted network model has converged, and there are no restrictions on the determination method.

[0117] After obtaining the target network model, the target network model is used to classify the image to be classified. That is, after the image to be classified is input into the target network model, the target network model can perform artificial intelligence processing on the image to be classified and obtain the classification result. There are no restrictions on the processing process of the target network model.

[0118] As can be seen from the above technical solutions, in order to generate adversarial examples based on natural samples in this embodiment, multiple adaptive groups can be divided, each corresponding to a sample perturbation constraint; that is, different adaptive groups correspond to different sample perturbation constraints. Based on this, the adaptive group corresponding to the natural sample can be determined. Based on the sample perturbation constraints corresponding to that adaptive group, adversarial examples are generated from the natural sample, enabling different natural samples to correspond to different sample perturbation constraints. This considers the anti-interference capabilities of different natural samples, improves the efficiency of adversarial training, enhances the network model's adversarial capability against attack samples, and yields a target network model with high natural accuracy and robustness, meeting the needs of different application scenarios. max It can roughly measure the distance between a sample and the decision boundary of the classifier, with similar z values. max The samples have similar robustness to disturbances, therefore, based on z... max Grouping samples into adaptive groups and applying adaptive perturbation constraints to each group improves the efficiency of adaptive training, avoids excessively small or large perturbation constraints, facilitates a trade-off between robust accuracy and natural accuracy, improves the trade-off between robustness and natural accuracy, and can flexibly cope with different scenarios.

[0119] The technical solutions of the embodiments of this application will be described below in conjunction with specific application scenarios.

[0120] This application proposes an adversarial training method based on adaptive group sample perturbation constraints. This method can be applied to any type of electronic device and may include the following steps:

[0121] Step S11: Divide the training dataset D into K minibatch datasets. Each minibatch dataset includes M samples (i.e., the training images in the above embodiment). Set T epochs (using all the data in the training dataset to perform a complete training process on the initial network model once, i.e., 1 epoch). T epochs represent performing T complete trainings on the initial network model.

[0122] For example, the training dataset D can be a training dataset such as CIFAR-10 and ImageNet-30.

[0123] Step S12: Input all natural samples from the first subset of the dataset into the initial network model to obtain the maximum eigenvalue z in the network output vector corresponding to that natural sample. max And prediction categories.

[0124] Step S13: Determine whether the classification result is correct based on the predicted category corresponding to the natural sample. If not, store the natural sample in the first subset; if yes, store the natural sample in the second subset.

[0125] Step S14: Based on the natural samples in the second subset, and based on the maximum eigenvalue z in the network output vector corresponding to the natural samples. max Divide the sample into multiple adaptive groups, determine the sample perturbation constraints corresponding to each adaptive group, generate perturbation samples based on the natural sample under the constraints of the sample perturbation constraints corresponding to the adaptive group corresponding to the natural sample, and store the perturbation samples in the second subset to replace the natural sample.

[0126] Step S15: Input the natural samples in the first subset and the perturbation samples in the second subset into the initial network model to obtain the target loss value. Based on the target loss value, perform backpropagation to update the network parameters of the initial network model, thereby completing the training process of a subset (minibatch).

[0127] For the remaining K-1 subsets of data, the training process is repeated using steps S12-S15 to continuously update the network parameters of the initial network model, completing one epoch of training.

[0128] Then, the entire training dataset is shuffled, and for the new K subsets, steps S12-S15 are repeated to continuously update the network parameters of the initial network model, completing another epoch of training. This process is repeated continuously until the training of T epochs is completed.

[0129] Based on the same concept as the methods described above, this application proposes an adversarial training device based on adaptive group sample perturbation constraints. See [link to relevant documentation]. Figure 3 The diagram shown is a structural schematic of the adversarial training device based on adaptive group sample perturbation constraints. The device may include:

[0130] The acquisition module 31 is used to acquire multiple training images; for each training image, the training image is input into the initial network model to obtain the network output vector and predicted category corresponding to the training image;

[0131] The determining module 32 is configured to, if the classification result of the training image is determined to be incorrect based on the predicted category and the actual category of the training image, then determine the training image as a natural sample image; the determining module 32 is further configured to, if the classification result of the training image is determined to be correct based on the predicted category and the actual category, then determine the target adaptive group corresponding to the training image based on the network output vector; determine the target perturbation vector corresponding to the training image based on the target sample perturbation constraint corresponding to the target adaptive group; and generate a perturbation sample image based on the target perturbation vector and the training image;

[0132] Training module 33 is used to train the initial network model based on the natural sample images and perturbed sample images corresponding to the multiple training images to obtain the trained target network model;

[0133] The target network model is used to classify the images to be classified.

[0134] In one possible implementation, the acquisition module 31 inputs the training image to the initial network model to obtain the network output vector corresponding to the training image, specifically for:

[0135] The training image is input into the first sub-network of the initial network model, and the feature vector output by the first sub-network is determined as the network output vector; wherein, the initial network model includes a first sub-network and a second sub-network, the second sub-network includes the last network layer in the initial network model, and the first sub-network includes the remaining network layers except for the last network layer.

[0136] In one possible implementation, when the determining module 32 determines the target adaptive group corresponding to the training image based on the network output vector, it is specifically used for:

[0137] The target feature value is determined based on the maximum feature value in the network output vector corresponding to all training images with correct classification results, and at least two adaptive groups are determined based on the target feature value; wherein, each adaptive group corresponds to a feature value interval, and the feature value intervals corresponding to different adaptive groups are different;

[0138] Determine the feature value interval corresponding to the largest feature value in the network output vector, and determine the adaptive group corresponding to the feature value interval as the target adaptive group corresponding to the training image.

[0139] In one possible implementation, when the determining module 32 determines at least two adaptive groups based on the target feature value, it is specifically used to: determine a first adaptive group, a second adaptive group, and a third adaptive group based on the target feature value; the starting value of the feature value interval corresponding to the first adaptive group is the difference between the target feature value and a preset first threshold, and the ending value of the feature value interval corresponding to the first adaptive group is the sum of the target feature value and a preset second threshold; the ending value of the feature value interval corresponding to the second adaptive group is the difference between the target feature value and the preset first threshold; and the starting value of the feature value interval corresponding to the third adaptive group is the sum of the target feature value and the preset second threshold.

[0140] In one possible implementation, the determining module 32, when determining the target sample perturbation constraint corresponding to the target adaptive group, specifically performs the following steps: obtaining an initial sample perturbation constraint; determining an initial perturbation vector based on the initial sample perturbation constraint; generating an initial sample image based on the initial perturbation vector and the training image corresponding to the target adaptive group; inputting the initial sample image to the configured reference network model to obtain the predicted category corresponding to the initial sample image; if the classification result of the initial sample image is determined to be incorrect based on the predicted category, then determining whether the initial sample perturbation constraint has met the search termination condition; if yes, then determining the target sample perturbation constraint corresponding to the target adaptive group based on the initial sample perturbation constraint; if no, then reducing the initial sample perturbation constraint, and based on the reduced initial sample perturbation constraint, returning to the operation of determining the initial perturbation vector based on the initial sample perturbation constraint.

[0141] In one possible implementation, the determining module 32 inputs the initial sample image to the configured reference network model, and after obtaining the predicted category corresponding to the initial sample image, it is further used for:

[0142] If the classification result of the initial sample image is determined to be correct based on the predicted category, then the initial sample perturbation constraint is increased, and it is determined whether the increased initial sample perturbation constraint is greater than the configured maximum value of the sample perturbation constraint; if not, then based on the increased initial sample perturbation constraint, the operation of determining the initial perturbation vector based on the initial sample perturbation constraint is returned; if yes, then the target sample perturbation constraint corresponding to the target adaptive group is determined based on the maximum value of the sample perturbation constraint.

[0143] In one possible implementation, when determining the target perturbation vector corresponding to the training image based on the target sample perturbation constraint corresponding to the target adaptive group, the determining module 32 is specifically used for:

[0144] The perturbation vector interval is determined based on the target sample perturbation constraints corresponding to the target adaptive group; wherein, the maximum perturbation vector in the perturbation vector interval is determined based on the target sample perturbation constraints;

[0145] The perturbation vector within the perturbation vector range is determined as the target perturbation vector.

[0146] In one possible implementation, when the training module 33 trains the initial network model based on the natural sample images and perturbed sample images corresponding to the plurality of training images to obtain the trained target network model, it specifically performs the following steps: inputting the natural sample images into the initial network model to obtain a first feature vector corresponding to the natural sample images, and determining a first loss value based on the first feature vector; inputting the perturbed sample images into the initial network model to obtain a second feature vector corresponding to the perturbed sample images, and determining a second loss value based on the second feature vector;

[0147] A target loss value is determined based on the first loss value and the second loss value, and the initial network model is adjusted based on the target loss value to obtain an adjusted network model.

[0148] If the adjusted network model has converged, then the adjusted network model is determined as the target network model;

[0149] If the adjusted network model does not converge, the adjusted network model will be determined as the initial network model, and the operation of inputting the training image into the initial network model will be returned.

[0150] Based on the same concept as the methods described above, this application proposes an adversarial training device (i.e., electronic device) based on adaptive group sample perturbation constraints. See [link to relevant documentation]. Figure 4As shown, the adversarial training device based on adaptive group sample perturbation constraints may include: a processor 41 and a machine-readable storage medium 42, wherein the machine-readable storage medium 42 stores machine-executable instructions that can be executed by the processor 41; the processor 41 is used to execute the machine-executable instructions to achieve the following steps:

[0151] Acquire multiple training images; for each training image, input the training image into the initial network model to obtain the network output vector and predicted category corresponding to the training image;

[0152] If the classification result of the training image is determined to be incorrect based on the predicted category and the actual category of the training image, then the training image is determined to be a natural sample image;

[0153] If the classification result of the training image is determined to be correct based on the predicted category and the actual category, then the target adaptive group corresponding to the training image is determined based on the network output vector; the target perturbation vector corresponding to the training image is determined based on the target sample perturbation constraint corresponding to the target adaptive group; and a perturbation sample image is generated based on the target perturbation vector and the training image.

[0154] Based on the natural sample images and perturbation sample images corresponding to the multiple training images, the initial network model is trained to obtain the trained target network model.

[0155] The target network model is used to classify the images to be classified.

[0156] Based on the same concept as the methods described above, this application also provides a machine-readable storage medium storing a plurality of computer instructions. When executed by a processor, these computer instructions can implement the adversarial training method based on adaptive group sample perturbation constraints disclosed in the examples above. The machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device, and can contain or store information such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid-state drive, any type of storage disk (such as optical disc, DVD, etc.), or similar storage media, or combinations thereof.

[0157] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0158] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0159] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0160] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0161] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0162] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0163] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A method for adversarial training based on adaptive group sample perturbation constraint, characterized in that, The method comprises the following steps: obtaining a plurality of training images; for each training image, inputting the training image into an initial network model to obtain a network output vector corresponding to the training image and a predicted category; if it is determined that the classification result of the training image is incorrect based on the predicted category and an actual category of the training image, determining the training image as a natural sample image; if it is determined that the classification result of the training image is correct based on the predicted category and the actual category, determining a target feature value based on a maximum feature value in network output vectors corresponding to all training images with correct classification results, and determining a first adaptive group, a second adaptive group and a third adaptive group based on the target feature value; each adaptive group corresponds to a feature value interval, and different adaptive groups correspond to different feature value intervals; the interval start value of the feature value interval corresponding to the first adaptive group is the difference between the target feature value and a preset first threshold, and the interval end value of the feature value interval corresponding to the first adaptive group is the sum of the target feature value and a preset second threshold; the interval end value of the feature value interval corresponding to the second adaptive group is the difference between the target feature value and the preset first threshold; the interval start value of the feature value interval corresponding to the third adaptive group is the sum of the target feature value and the preset second threshold; determining the feature value interval corresponding to the maximum feature value in the network output vector, and determining the adaptive group corresponding to the feature value interval as a target adaptive group corresponding to the training image; determining a target perturbation vector corresponding to the training image based on a target sample perturbation constraint corresponding to the target adaptive group, and generating a perturbed sample image based on the target perturbation vector and the training image; different adaptive groups correspond to different sample perturbation constraints. training the initial network model based on the natural sample images and the perturbed sample images corresponding to the plurality of training images to obtain a trained target network model; wherein the target network model is used for classifying an image to be classified.

2. The method of claim 1, wherein, The method further comprises the following steps: inputting the training image into a first sub-network of the initial network model, and determining a feature vector output by the first sub-network as the network output vector; the initial network model comprises the first sub-network and a second sub-network, the second sub-network comprises a last network layer in the initial network model, and the first sub-network comprises the remaining network layers except the last network layer.

3. The method of claim 1, wherein the target sample perturbation constraint corresponding to the target adaptive group is determined in the following manner: obtaining an initial sample perturbation constraint, determining an initial perturbation vector based on the initial sample perturbation constraint, and generating an initial sample image based on the initial perturbation vector and the training image corresponding to the target adaptive group. ​ inputting the initial sample image into a configured reference network model to obtain a predicted category corresponding to the initial sample image; if it is determined based on the predicted category that a classification result of the initial sample image is incorrect, determining whether an initial sample perturbation constraint has met a search end condition; if yes, determining a target sample perturbation constraint corresponding to the target adaptive group based on the initial sample perturbation constraint; if no, reducing the initial sample perturbation constraint, and based on the reduced initial sample perturbation constraint, returning to performing the operation of determining an initial perturbation vector based on the initial sample perturbation constraint.

4. The method of claim 3, wherein, after the operation of inputting the initial sample image into the configured reference network model to obtain the predicted category corresponding to the initial sample image, the method further comprises: if it is determined based on the predicted category that the classification result of the initial sample image is correct, increasing the initial sample perturbation constraint, and determining whether the increased initial sample perturbation constraint is greater than a maximum sample perturbation constraint; if no, returning to performing the operation of determining the initial perturbation vector based on the initial sample perturbation constraint based on the increased initial sample perturbation constraint; if yes, determining the target sample perturbation constraint corresponding to the target adaptive group based on the maximum sample perturbation constraint.

5. The method of claim 1, wherein, the operation of determining the target perturbation vector corresponding to the training image based on the target sample perturbation constraint corresponding to the target adaptive group comprises: determining a perturbation vector interval based on the target sample perturbation constraint corresponding to the target adaptive group; wherein a maximum perturbation vector of the perturbation vector interval is determined based on the target sample perturbation constraint; determining a perturbation vector in the perturbation vector interval as the target perturbation vector.

6. The method of claim 1, wherein the operation of training the initial network model based on the natural sample images and the perturbed sample images corresponding to the plurality of training images to obtain a trained target network model comprises: inputting the natural sample image into the initial network model to obtain a first feature vector corresponding to the natural sample image, and determining a first loss value based on the first feature vector; inputting the perturbed sample image into the initial network model to obtain a second feature vector corresponding to the perturbed sample image, and determining a second loss value based on the second feature vector; determining a target loss value based on the first loss value and the second loss value, adjusting the initial network model based on the target loss value to obtain an adjusted network model; if the adjusted network model has converged, determining the adjusted network model as the target network model; if the adjusted network model has not converged, determining the adjusted network model as the initial network model, and returning to performing the operation of inputting the training image into the initial network model.

7. An apparatus for adversarial training based on adaptive group sample perturbation constraint, comprising: comprises: an acquisition module configured to acquire a plurality of training images; for each training image, inputting the training image into an initial network model to obtain a network output vector and a predicted category corresponding to the training image; determining that the training image is a natural sample image if it is determined that the classification result of the training image is incorrect based on the predicted category and an actual category of the training image; if it is determined that the classification result of the training image is correct based on the predicted category and the actual category, determining a target feature value based on a maximum feature value in network output vectors corresponding to all training images with correct classification results, and determining a first adaptive group, a second adaptive group and a third adaptive group based on the target feature value; each adaptive group corresponds to a feature value interval, and different adaptive groups correspond to different feature value intervals; an interval start value of the feature value interval corresponding to the first adaptive group is a difference between the target feature value and a preset first threshold, and an interval end value of the feature value interval corresponding to the first adaptive group is a sum of the target feature value and a preset second threshold; the interval end value of the feature value interval corresponding to the second adaptive group is the difference between the target feature value and the preset first threshold; the interval start value of the feature value interval corresponding to the third adaptive group is the sum of the target feature value and the preset second threshold; a feature value interval corresponding to the maximum feature value in the network output vector is determined, and an adaptive group corresponding to the feature value interval is determined as a target adaptive group corresponding to the training image; a target disturbance vector corresponding to the training image is determined based on a target sample disturbance constraint corresponding to the target adaptive group, and a disturbed sample image is generated based on the target disturbance vector and the training image; different adaptive groups correspond to different sample disturbance constraints; a training module configured to train the initial network model based on the natural sample images and the disturbed sample images corresponding to the plurality of training images, to obtain a trained target network model; The target network model is configured to classify an image to be classified.

8. A device for adversarial training based on adaptive group sample perturbation constraint, characterized in that, The machine readable storage medium stores machine executable instructions executable by the processor; and the processor is configured to execute the machine executable instructions to implement the following steps: obtaining a plurality of training images; for each training image, inputting the training image into an initial network model to obtain a network output vector corresponding to the training image and a predicted category; if it is determined that the classification result of the training image is incorrect based on the predicted category and an actual category of the training image, determining that the training image is a natural sample image; If it is determined that the classification result of the training image is correct based on the predicted category and the actual category, a target feature value is determined based on a maximum feature value in a network output vector corresponding to all training images with correct classification results, and a first adaptive group, a second adaptive group and a third adaptive group are determined based on the target feature value; each adaptive group corresponds to a feature value interval, and different adaptive groups correspond to different feature value intervals; an interval start value of the feature value interval corresponding to the first adaptive group is a difference between the target feature value and a preset first threshold, and an interval end value of the feature value interval corresponding to the first adaptive group is a sum of the target feature value and a preset second threshold; the interval end value of the feature value interval corresponding to the second adaptive group is the difference between the target feature value and the preset first threshold; the interval start value of the feature value interval corresponding to the third adaptive group is the sum of the target feature value and the preset second threshold; a feature value interval corresponding to a maximum feature value in the network output vector is determined, and an adaptive group corresponding to the feature value interval is determined as a target adaptive group corresponding to the training image; a target disturbance vector corresponding to the training image is determined based on a target sample disturbance constraint corresponding to the target adaptive group, and a disturbed sample image is generated based on the target disturbance vector and the training image; different adaptive groups correspond to different sample disturbance constraints; The initial network model is trained based on the natural sample images and the disturbed sample images corresponding to the plurality of training images, and a trained target network model is obtained; The target network model is used for classifying to-be-classified images.

Images