A method to improve adversarial robustness by using a lightweight denoising network with residual connections

Abstract

The present invention discloses a method for improving adversarial robustness by using a lightweight denoising network with residual connections, comprising the following steps: S1, normalizing the pixels of the original sample; S2, adding random perturbations to the original sample to form perturbed samples; S3, training the first stage of the network model: denoising the perturbed samples in a Denoising network 1 containing an internal denoising block, and obtaining corresponding restored samples through a conversion block; S4, training the second stage of the network model: processing the perturbed samples through an intermediate denoising block, and then fusing them with the restored samples to obtain a fused sample, which is denoised in a Denoising network 2. At this point, the original samples begin to participate in network training, and restored samples containing the original samples and the perturbed samples, as well as their respective predicted labels, are obtained. By using a lightweight denoising network LDN-RS with residual connections to form the internal denoising block and the intermediate denoising block, the network model implanted with the denoising block is ensured to have good adversarial robustness.

Description

Technical Field

[0001] The present invention belongs to the technical field of adversarial defense of deep neural network models, and in particular relates to a method for improving adversarial robustness by using a lightweight denoising network with residual connections. Background Art

[0002] Thanks to their outstanding performance, deep neural networks have been widely used in fields such as face recognition, autonomous driving, and image classification, achieving remarkable success and significantly boosting their development. However, due to the nonlinearity and uninterpretability of deep neural networks, they have also given rise to new challenges: adversarial examples. These examples are created by adding subtle, imperceptible perturbations to the sample. These examples are virtually unaffected to the human eye, allowing the true category to be easily discerned. However, deep neural networks are extremely vulnerable to adversarial examples, significantly reducing their recognition accuracy. This adverse impact has also hindered the widespread development of deep neural networks in other fields.

[0003] The defense methods for adversarial samples can be divided into: (1) data modification: including adversarial training, gradient hiding, data compression, and data randomization; (2) model modification: including model regularization, defensive distillation, feature compression, feature denoising, etc. For adversarial defense, adversarial training is the most direct and effective defense method. By introducing a certain type of adversarial sample into the input of the model, the model can be immune to the influence of such adversarial samples and has a very high recognition accuracy. However, adversarial training also has serious shortcomings, including: 1) poor generalization. Adversarial training is only effective against a certain type of adversarial attack. In the face of the ever-increasing number of attack methods, adversarial training becomes very passive. In order to obtain sufficient robustness, more adversarial samples need to be added to the input samples; 2) high computational cost. The training time required for one cycle of adversarial training is several times longer than the training time for normal samples, and the adversarial training model is difficult to converge; 3) reduced accuracy. While adversarial training ensures that the model has a certain degree of robustness against adversarial samples, it reduces the accuracy of the model for normal samples. The final result of training is often that the model reaches a relatively satisfactory compromise between robustness and accuracy.

[0004] To solve the vulnerability problem of deep neural network models to adversarial samples, current defense methods are mostly based on adversarial training, which does not fundamentally and effectively solve the impact of adversarial perturbations in adversarial samples on deep neural network models.

[0005] Inspired by the application of denoising technology in adversarial defense, this paper uses a lightweight denoising network with residual connections (LDN-RS) as the denoising block. On this basis, internal denoising blocks and intermediate denoising blocks are introduced to perform feature denoising and sample denoising respectively. The denoising blocks are used to remove adversarial perturbations in adversarial samples. By implanting specific denoising blocks into the network model in the feature processing stage and the data preprocessing stage, the impact of perturbations in adversarial samples on model prediction can be greatly alleviated, thereby improving the model's adversarial defense capability. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a method for improving the robustness of a lightweight denoising network with residual connections, which solves the problems raised in the background technology.

[0007] The present invention provides the following technical solutions:

[0008] The method of improving adversarial robustness by using a lightweight denoising network with residual connections includes the following steps:

[0009] S1, normalize the pixels of the original sample;

[0010] S2, adds random perturbations to the original samples to form perturbed samples;

[0011] The disturbance sample is:

[0012] s disturb =s original +(-tadpole)

[0013] Among them, s original represents the original sample, s disturb represents the perturbation sample, ò represents the perturbation added to the original sample;

[0014] S3, the first stage of network model training: the perturbation sample is denoised in DenoisingNetwork1 containing an internal denoising block, and the corresponding restored sample is obtained through the conversion block;

[0015] S4, the second stage of network model training: the perturbed sample is processed by the intermediate denoising block and then fused with the restored sample to obtain a fused sample. The fused sample is further denoised in Denoising network 2. At this time, the original sample begins to participate in network training, and finally a restored sample containing the original sample and the perturbed sample and their respective predicted labels is obtained.

[0016] Preferably, the method further includes the step: S5, fine-tuning stage: using the restored sample as the input of the network model to obtain the corresponding second restored sample and predicted label again.

[0017] Preferably, in step S3, the mean square error between the restored sample output by the conversion block and the corresponding original sample must be less than a set threshold. The specific implementation process includes the following steps:

[0018] A. Calculate the restored samples and corresponding predicted labels of the perturbed samples and original samples. The specific calculation process is as follows:

[0019] r 1 , p 1 =f(s disturb )

[0020] r′ 1 , p′ 1 =f(s original )

[0021] Where f represents the network model, r represents the recovered sample, and p represents the predicted label;

[0022] B. Calculate the mean square error loss between the restored sample obtained after the perturbation sample is processed by the conversion block and the original sample. The calculation formula is as follows:

[0023] L recov1 =MSE(s origianl , r 1 )

[0024] Among them, MSE represents the mean square error loss function, L recov1 represents the mean square error loss of the perturbation sample;

[0025] C, through error back propagation, until the mean square error loss of the perturbed sample is less than the set threshold.

[0026] Preferably, in step S3, the network model is a deep neural network model, and the deep neural network model selects Resnet50 / 101 / 152 as the original network model for defending against adversarial attacks.

[0027] Preferably, the deep neural network model uses the original Resnet50 as a baseline, adopts the early-stop method for network training, and uses the Adversarial Robustness Toolbox (ART) tool to test the performance of the trained network model on different data sets.

[0028] Preferably, in step S5, the specific implementation of the fine-tuning stage includes the following steps:

[0029] a. Use the restored sample described in step S3 as the input of the network model in the fine-tuning stage to obtain the corresponding second restored sample and predicted label,

[0030] The specific calculation process is as follows:

[0031] r 2 , p 2 =f(r 1 )

[0032] r′ 2 , p′ 2 =f(r′ 1 );

[0033] b. Calculate the cross entropy loss and mean square error loss of the second restored sample. The specific calculation process is as follows:

[0034] L recov2 =MSE(s original , r 2 )

[0035] L adv2 =CE(s original , p 2 )

[0036] L orig2 =CE(s original , p′ 2 )

[0037] Among them, L recov2 It represents the mean square error between the second restored perturbation sample and the original sample, L adv2 represents the cross entropy loss of the second restored perturbation sample, L orig2 Represents the cross entropy loss of the original sample restored for the second time;

[0038] c, the specific calculation process is as follows:

[0039] L total2 =χL recov2 +γL adv2 +λL orig2

[0040] Among them, L total2 Represents the loss function of the network model during the fine-tuning stage.

[0041] Preferably, a lightweight denoising convolutional neural network L-DnCNN is used as a denoiser in the network model, and the depth of the L-DnCNN model is set to 7, and the number of intermediate blocks is set to 5.

[0042] Preferably, in step S4, the fused samples can not only reduce the special disturbances that are not removed in the feature denoising, but also increase the information about the original samples in terms of volume, thereby improving the detection and recognition ability of the network model for samples (perturbed samples, original samples). The specific implementation steps include:

[0043] I. Calculate the prediction error between the perturbed sample and the original sample. The specific calculation process is as follows:

[0044] L adv1 =CE(s original , p 1 )

[0045] L orig1 =CE(s original , p′ 1 )

[0046] Where CE represents the cross entropy loss function, L adv1 represents the cross entropy loss of the perturbation sample, L orig1 represents the cross entropy loss of the original sample,

[0047] II. Calculate the overall loss function of the network model. The calculation formula is as follows:

[0048] L total1 =χL recov1 +γL adv1 +λL orig1

[0049] Wherein, the scaling factor χ=γ=λ=1, L total1 Represents the overall loss function of the second stage of the network model;

[0050] III, Error back propagation.

[0051] Preferably, in order to suppress or prevent the negative impact of adversarial perturbations in the network model, the present invention implants a denoising block inside the network model to improve the adversarial robustness of the network model. The steps for setting the internal denoising block are as follows:

[0052] Step 1: The number of L-DnCNNs in the internal denoising block is set to multiple, and the multiple L-DnCNNs are connected in series, and the number of series-connected L-DnCNNs is set to 2; the denoising capability of the denoising block is improved by increasing the capacity and number of denoisers;

[0053] In the second step, two L-DnCNNs in series are residually connected, and the lightweight denoising network with residual connection (LDN-RS) is used as the internal denoising block.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] (1) The method of improving adversarial robustness by using a lightweight denoising network with residual connections in the present invention adopts a lightweight denoising network LDN-RS with residual connections to form an internal denoising block and an intermediate denoising block. While ensuring that the network model implanted with the denoising block has good adversarial robustness and accuracy, the training cost of the network model is reduced.

[0056] (2) The method of improving adversarial robustness by using a lightweight denoising network with residual connections in the present invention is a staged denoising method in which a threshold is set during the first stage of training of the network model. When the mean square error loss function (MSE) value of the restored sample output by the conversion block in the network model and the original sample is less than the set threshold, the training of the network model enters the next stage, thereby increasing the denoising ability of the network model.

[0057] (3) The method of improving adversarial robustness by using a lightweight denoising network with residual connections in the present invention, by setting a fine-tuning stage and setting the mean loss function and the cross-entropy loss function, the restored samples become closer to the original samples, and the classification accuracy of the network model for the samples is further improved.

[0058] (4) The method of improving adversarial robustness by using a lightweight denoising network with residual connections in the present invention is to set the second stage training of the network model. The perturbation samples are processed by LDN-RS in the intermediate denoising block and then fused with the restored samples output by the first stage conversion block. The fused samples are sent to Denoising network2 for further denoising. The fused samples can not only reduce the special disturbances that are not removed in the feature denoising, but also increase the information about the original samples in terms of volume, thereby improving the network model's detection and recognition capabilities for samples (perturbation samples, original samples). BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0060] Figure 1 It is the overall framework diagram of the network model of the present invention.

[0061] Figure 2 This is the L-DnCNN model framework diagram of the present invention.

[0062] Figure 3 This is a framework diagram of the LDN-RS model of the present invention. DETAILED DESCRIPTION

[0063] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0064] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are also within the scope of protection of the present invention.

[0065] Example 1

[0066] See also Figure 1-3 As shown in FIG, a method for improving adversarial robustness by using a lightweight denoising network with residual connections includes the following steps:

[0067] S1, normalize the pixels of the original sample;

[0068] S2, adds random perturbations to the original samples to form perturbed samples;

[0069] The disturbance sample is:

[0070] s disturb =s original +(-tadpole)

[0071] Among them, s original represents the original sample, s disturb represents the perturbation sample, ò represents the perturbation added to the original sample;

[0072] S3, the first stage of network model training: the perturbation sample is denoised in DenoisingNetwork1 containing an internal denoising block, and the corresponding restored sample is obtained through the conversion block;

[0073] S4, the second stage of network model training: the perturbed sample is processed by the intermediate denoising block and then fused with the restored sample to obtain a fused sample. The fused sample is further denoised in Denoising network 2. At this time, the original sample begins to participate in network training, and finally a restored sample containing the original sample and the perturbed sample and their respective predicted labels is obtained.

[0074] The method further includes the step: S5, a fine-tuning stage: using the restored sample as the input of the network model to obtain the corresponding second restored sample and predicted label again.

[0075] In step S1, the specific steps for selecting original samples and adversarial samples are as follows:

[0076] Step 1: Make the original sample;

[0077] For the MNIST dataset, it is composed of 28×28 grayscale images, including 60,000 training images and 10,000 test images. For the CIFAR-10 dataset, it is composed of 32×32 color samples, including 50,000 training images and 10,000 test images. For the SVHN dataset, the present invention selects one of its two forms, consisting of 32×32 color samples, including 73,257 training images and 10,000 test images. During use, the image size is uniformly scaled to 64×64. In order to minimize the change of the network model settings, the present invention repeats the single channel of the grayscale image three times to become a three-channel;

[0078] Step 2: Create adversarial samples;

[0079] Under white-box attack: On the MNIST dataset, under infinity norm attack, the adversarial perturbation ∈ = 0.3 is used with a stride of 0.1 for FGSM, a stride of 100 for PGD, and a stride of 10 for C&W. Under the 2-norm attack, the adversarial perturbation ∈=1.5, for FGSM, the step size is 0.1, for PGD, the step size is 100, the step size is 0.1, for DeepFool, the adversarial perturbation ∈=1.5, the step size is 100, on the CIFAR-10 dataset, the present invention adopts the infinite norm attack method, compared with the 2-norm attack, the infinite norm attack is more powerful and effective, and can better evaluate the adversarial robustness of a model, under the infinite norm attack, the adversarial perturbation ∈=8 / 255, for FGSM, the step size is 0.1, for PGD, the step size is 40, the step size is 2 / 255, for C&W the step size is 10, on the SVHN dataset, since the SVHN dataset and the CIFAR-10 dataset are both color samples and the sample sizes are similar, the attack methods and parameters for the two datasets are also set to be consistent;

[0080] Under black box attack: Evaluate the performance of the original network model and the enhanced network model under black box attack on the CIFAR-10 dataset, using L ∞ -FGSM、L ∞ -PGD adversarial attack method, adversarial perturbation ∈ = 8 / 255, for FGSM, the step size is 0.1, for PGD, the step size is 40, the step size is 2 / 255;

[0081] In step S3, the network model is a deep neural network model, and the deep neural network model selects Resnet50 / 101 / 152 as the original network model for defending against adversarial attacks.

[0082] The deep neural network model uses the original Resnet50 as the baseline, adopts the early-stop method for network training, and uses the Adversarial Robustness Toolbox (ART) tool to test the performance of the trained network model on different datasets.

[0083] In step S3, the network model is a deep neural network model. The deep neural network model is selected, and the specific steps are as follows:

[0084] Step 1: Select Resnet50 / 101 / 152 as the original network model for defense against adversarial attacks, and LDN-RS(·) represents the network model for defense against adversarial attacks using the method of the present invention;

[0085] Step 2: The adversarial defense process is also a process of minimizing and maximizing the network model. Adversarial examples cause the network model's prediction results to deviate from their true labels, thereby achieving an adversarial attack on the network model. Adversarial defense minimizes the network model's prediction error for adversarial examples. The optimization objective formula is as follows:

[0086]

[0087] In (x, y), x is a clean sample and y is the true label corresponding to x. F represents the network model, x′ is the adversarial sample about x, L represents the loss function such as the cross entropy loss function, θ represents the parameters of the network model, p is the distance between the adversarial sample and the clean sample, such as L1, L2, L ∞ The adversarial attack maximizes the internal loss function in formula (14), and the present invention achieves external minimization of the network model;

[0088] Step 3: Using the original Resnet50 as the baseline, the network training adopts the early-stop method to save the best training model, and the Adversarial Robustness Toolbox (ART) tool is used to test the performance of the trained network model on different datasets.

[0089] The present invention selects a lightweight denoising convolutional neural network (L-DnCNN) as a denoiser. Figure 2As shown in the figure, the present invention sets the depth of the L-DnCNN model to 7, where the number of intermediate blocks is 5. Compared with the original DnCNN intermediate block, the number of connections is only 1 / 3. Although the number of L-DnCNN intermediate blocks is reduced, its denoising ability can still be effectively retained. On the other hand, while reducing the volume of the original denoiser, the corresponding computational cost and training time can be significantly improved, which facilitates further combination between denoising blocks or between denoising blocks and the original network, thereby expanding the scope of application of the denoising block.

[0090] Example 2

[0091] Based on the first embodiment, in step S3, the mean square error between the restored sample output by the conversion block and the corresponding original sample must be less than a set threshold. The specific implementation process includes the following steps:

[0092] A. Calculate the restored samples and corresponding predicted labels of the perturbed samples and original samples. The specific calculation process is as follows:

[0093] r 1 , p 1 =f(s disturb )

[0094] r′ 1 , p′ 1 =f(S original )

[0095] Where f represents the network model, r represents the recovered sample, and p represents the predicted label;

[0096] B. Calculate the mean square error loss between the restored sample obtained after the perturbation sample is processed by the conversion block and the original sample. The calculation formula is as follows:

[0097] L recov1 =MSE(s origianl , r 1 )

[0098] Among them, MSE represents the mean square error loss function, L recov1 represents the mean square error loss of the perturbation sample;

[0099] C, through error back propagation, until the mean square error loss of the perturbed sample is less than the set threshold.

[0100] In step S5, the specific implementation of the fine-tuning stage includes the following steps:

[0101] a. Use the restored sample described in step S3 as the input of the network model in the fine-tuning stage to obtain the corresponding second restored sample and predicted label,

[0102] The specific calculation process is as follows:

[0103] r 2 , p 2 =f(r 1 )

[0104] r′ 2 , p′ 2 =f(r′ 1 );

[0105] b. Calculate the cross entropy loss and mean square error loss of the second restored sample. The specific calculation process is as follows:

[0106] L recov2 =MSE(s original , r 2 )

[0107] L adv2 =CE(s original , p 2 )

[0108] L orig2 =CE(s original , p′ 2 )

[0109] Among them, L recov2 It represents the mean square error between the second restored perturbation sample and the original sample, L adv2 represents the cross entropy loss of the second restored perturbation sample, L orig2 Represents the cross entropy loss of the original sample restored for the second time;

[0110] c, the specific calculation process is as follows:

[0111] L total2 =χL recov2 +γL adv2 +λL orig2

[0112] Among them, L total2 Represents the loss function of the network model during the fine-tuning stage.

[0113] By setting the mean loss function and the cross entropy loss function, the restored samples become closer to the original samples, and the classification accuracy of the network model for the samples is further improved.

[0114] In step S4, the fused samples not only reduce the special disturbances that are not removed in the feature denoising, but also increase the volume of information about the original samples, thereby improving the network model's ability to detect and identify samples (perturbed samples, original samples). The specific implementation steps include:

[0115] I. Calculate the prediction error between the perturbed sample and the original sample. The specific calculation process is as follows:

[0116] L adv1 =CE(s original , p 1 )

[0117] L orig1 =CE(s original , p′ 1 )

[0118] Where CE represents the cross entropy loss function, L adv1 represents the cross entropy loss of the perturbation sample, L orig1 represents the cross entropy loss of the original sample,

[0119] II. Calculate the overall loss function of the network model. The calculation formula is as follows:

[0120] L total1 =χL recov1 +γL adv1 +λL orig1

[0121] Wherein, the scaling factor χ=γ=λ=1, L total1 Represents the overall loss function of the second stage of the network model;

[0122] III, Error back propagation.

[0123] The fused samples are fed into Denoising Network 2 for further denoising. The fused samples not only reduce the special perturbations not removed by feature denoising, but also increase the volume of information about the original samples, improving the network model's ability to detect and identify samples (perturbed samples, original samples).

[0124] In order to suppress or prevent the negative impact of adversarial disturbances in the network model, the present invention implants a denoising block inside the network model to improve the adversarial robustness of the network model, such as Figure 3 As shown, the steps for setting up the internal denoising block are as follows:

[0125] Step 1: The number of L-DnCNNs in the internal denoising block is set to multiple, and the multiple L-DnCNNs are connected in series, and the number of series-connected L-DnCNNs is set to 2; the denoising capability of the denoising block is improved by increasing the capacity and number of denoisers;

[0126] In the second step, two L-DnCNNs in series are residually connected, and the lightweight denoising network with residual connection (LDN-RS) is used as the internal denoising block.

[0127] The two L-DnCNNs connected in series are residually connected. This not only retains the original connection mode of the location where the internal denoising block is implanted in the original network model, and the functions implemented by the original network model, but also the network model with the implanted denoising block has good denoising ability. At this time, the lightweight denoising network with residual connection (LDN-RS) is used as the internal denoising block. The present invention aims to perform feature denoising in the shallow layer of the network model, that is, to implant the internal denoising block after the first layer and the second layer of the original network model, a total of 2. In this way, the adversarial robustness of the model can be improved while minimizing the change of the original network framework and function.

[0128] In step S4, since the disturbance in the sample does not only include the disturbance we manually added, but also other special noises carried by the sample itself, in order to minimize the impact of these noises on the model decision, the present invention introduces an intermediate denoising block. The steps for setting up the intermediate denoising block are as follows:

[0129] Step 1: Process the noisy sample through LDN-RS.

[0130] Step 2: Fuse the samples processed in step 1 with the restored samples output by the conversion block in the first stage.

[0131] During this period, on the one hand, the network model continues the state that has been adjusted in the first stage and has a certain de-perturbation ability. On the other hand, the fused samples enrich the information about the original samples. Compared with simply processing the original samples, the fused samples enable the network model to more fully extract the key information in the original samples. Therefore, the accuracy and adversarial robustness of the network model can be improved.

[0132] Example 3

[0133] On the basis of Example 2, in order to verify the performance of the present invention, the original samples and adversarial samples were tested using the original network model and the LDN-RS network model respectively. The experimental results are compared in Tables 5-8:

[0134] Among them, Table 5 shows the accuracy of the original network model and the LDN-RS network model under white box attack on the MNIST dataset.

[0135] Table 6 shows the accuracy of the original network model and the LDN-RS network model on the CIFAR-10 dataset under white-box attack.

[0136] Table 7 shows the accuracy of the original network model and the LDN-RS network model on the SVHN dataset under white-box attack.

[0137] Table 8 shows the accuracy of the original network model and the LDN-RS network model on the CIFAR-10 dataset under black box attack.

[0138]

[0139]

[0140] Table 5

[0141] As can be seen from Table 5, the original ResNet50 / 101 / 152 network models have higher detection accuracy than LDN-RS (Resnet50) in terms of clean samples. LDN-RS (Resnet50) is 0.07% lower than the best accuracy. However, in the adversarial defense, the network models strengthened by the LDN-RS method show higher robustness than the original network models, especially in the original ResNet50 / 101 network model against LDN-RS. ∞ -PGD attack is completely ineffective, the network model enhanced by LDN-RS method still has 78.91% accuracy. Similarly, the performance of LDN-RS (Resnet50) model under C&W and DeepFool attack is also worthy of recognition. It can also be found that the attack strength of FGSM and PGD using L2 attack method is not as good as that under L ∞ The intensity in L ∞ The attack is a powerful means of attack, capable of rendering unprotected network models nearly defenseless. Of course, both C&W and DeepFool also demonstrate excellent attack performance, significantly undermining the defense capabilities of the original network model. The data in Table 5 shows that the LDN-RS (Resnet50) model enhanced using the LDN-RS method not only maintains high recognition accuracy for clean samples but also demonstrates a strong advantage in adversarial defense.

[0142]

[0143] Table 6

[0144] From Table 6, we can see that the LDN-RS (Resnet50) enhanced by the LDN-RS method has better ability to resist various adversarial attacks than the original Resnet50 / 101 / 152 network model. ∞Under the -PGD attack, the LDN-RS (Resnet50) model achieved an accuracy of 65%, significantly higher than the original network model under the same attack conditions. The C&W adversarial attack significantly damaged the defense capabilities of all models, and even the enhanced LDN-RS (Resnet50) model was not particularly effective against it. This remains a major challenge to be addressed in the future. It is worth noting that the enhanced LDN-RS (Resnet50) model achieved higher recognition accuracy on clean samples than the original network model, which is closely related to the phased denoising and fine-tuning in the network model training strategy. The overall performance of the Resnet50 / 101 / 152 networks on CIFAR-10 was not as good as on MNIST. One important reason may be that the CIFAR-10 dataset is a color dataset with animals as the objects to be recognized, while the MNIST dataset consists of grayscale handwritten digits, which is much more complex.

[0145]

[0146] Table 7

[0147] From Table 7, we can see that the enhanced LDN-RS (Resnet50) has an accuracy of 93.47% in clean sample classification, which is 5.26% higher than the original Resnet50 network model. ∞ Under the -PGD attack, network models without defensive measures almost completely failed, while LDN-RS (Resnet50) achieved an accuracy of 63.78%. It can also be found that on simple datasets, the enhanced network model (LDN-RS (Resnet50)) has better defense against C&W adversarial attacks. For example, when sorting the SVHN and CIFAR-10 datasets from simple to complex, LDN-RS (Resnet50) achieved an accuracy of 93.39% and 13.35% on the two datasets, respectively. On the simpler MNIST dataset, LDN-RS (Resnet50) achieved an accuracy of 99.47%. These experimental data are consistent with the initial conclusions. By observing Tables 6 and 7, it can be seen that the network model enhanced using the LDN-RS method performs better than the original network model (Resnet50 / 101 / 152) in both clean sample classification and adversarial defense.

[0148]

[0149] Table 8

[0150] From Table 8, we can see that in terms of the classification accuracy of clean samples, the network model LDN-RS (Resnet50) enhanced by the LDN-RS method has the best performance, 10.35% higher than the second place. ∞ - Under PGD attack, the defense accuracy of the original network model (Resnet50 / 101 / 152) is 2%-3%, almost losing its accuracy against L ∞ -PGD's defense capability against anti-attacks, and the network model LDN-RS (Resnet50) enhanced by the LDN-RS method has an accuracy of 65.23%, which can effectively improve the adversarial robustness of the original network model (Resnet50).

[0151] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for improving adversarial robustness by using a lightweight denoising network with residual connections, characterized in that: The following steps are involved: S1, normalize the image pixels of the original sample; S2, adds random perturbations to the original samples to form perturbed samples; S3, training of the first stage of the network model: the perturbation sample is denoised in the Denoising network 1 containing an internal denoising block, and the corresponding restored sample is obtained. The Denoising network 1 consists of three convolutional layers and two internal denoising blocks; S4, training of the second stage of the network model: the perturbation sample is processed by the intermediate denoising block, and then fused with the restored sample to obtain a fused sample, and the fused sample is further denoised in the Denoising network 2, which has the same structure as the Denoising network 1; The network model uses a lightweight denoising convolutional neural network L-DnCNN as a denoising block; The steps for setting up the internal denoising block are as follows: Step 1: multiple L-DnCNNs are set, and the multiple L-DnCNNs are connected in series, and the number of series connections is set to 2; the denoising ability of the denoising block is improved by increasing the capacity and number of denoising blocks; Step 2: residual connection is performed on the two series-connected L-DnCNNs, and a lightweight denoising network with residual connection (LDN-RS) is used as the internal denoising block; The steps of setting up the intermediate denoising block are as follows: Step 1: Processing the noisy samples with LDN-RS; Step 2: Fusing the samples processed in Step 1 with the restored samples output by the first-stage conversion block.

2. The method for improving adversarial robustness using a lightweight denoising network with residual connections according to claim 1, characterized in that: The method further includes the step: S5, a fine-tuning stage: using the restored sample in S4 as the input of the network model to obtain the corresponding second restored sample and predicted label again.

3. The method for improving adversarial robustness using a lightweight denoising network with residual connections according to claim 1, characterized in that: In step S3, the mean square error between the restored sample output by the conversion block and the corresponding original sample must be less than a set threshold. The specific implementation process includes the following steps: A, calculate the restored samples of the perturbed samples and the original samples and the corresponding predicted labels; B, calculate the mean square error loss between the restored sample obtained after the perturbation sample is processed by the conversion block and the original sample; C, through error back propagation, until the mean square error loss of the perturbed sample is less than the set threshold 。 4. The method for improving adversarial robustness using a lightweight denoising network with residual connections according to claim 1, characterized in that: In step S3, the network model is a deep neural network model, and the deep neural network model selects Resnet50 / 101 / 152 as the original network model for defending against adversarial attacks.

5. The method for improving adversarial robustness using the residual-connected lightweight denoising network according to claim 4, characterized in that: The deep neural network model uses the original Resnet-50 as the baseline, adopts the early-stop method for network training, and uses the Adversarial Robustness Toolbox (ART) tool to test the performance of the trained network model on different data sets.

6. The method for improving adversarial robustness using a lightweight denoising network with residual connections according to claim 2, characterized in that: In step S5, the specific implementation of the fine-tuning stage includes the following steps: a. Use the restored sample described in step S3 as the input of the network model in the fine-tuning stage to obtain the corresponding second restored sample and predicted label, b. Calculate the cross entropy loss and mean square error loss of the second restored sample.

7. The method for improving adversarial robustness using a lightweight denoising network with residual connections according to any one of claims 1 to 6, characterized in that: The depth of the L-DnCNN model is set to 7, and the number of intermediate blocks is set to 5.

Images