Training method and device for neural network model

Abstract

The present disclosure provides a training method and device for a neural network model. The method includes: obtaining an original data set corresponding to the attack and defense requirements of the neural network model; pre-training the neural network model using the original data set to obtain a pre-trained model; and supplementing the pre-trained model with a training data set based on a covariance matrix adaptive evolution strategy CMA‑ES to obtain a target model. The training method and device for a neural network model provided by the present disclosure uses a neural network training algorithm based on a covariance matrix adaptive evolution strategy to supplement the training of the neural network to obtain a robust neural network model, improve the accuracy and efficiency of the neural network's adversarial defense, and ensure the security of deep learning related systems.

Description

Technical Field

[0001] The present disclosure relates to the field of deep learning, and in particular to a training method and device for a neural network model. Background Art

[0002] Machine learning technology, especially deep learning, has been widely used in life, including military, industry, medical and Internet fields. However, as machine learning related technologies and systems are increasingly used in various infrastructures in various fields around the world, more and more malicious people and organizations regard related systems as targets and try to attack them; attacks on machine learning systems will bring serious consequences to the scenarios in which they are applied. With the development and application of machine learning systems, their security issues have gradually attracted everyone's attention.

[0003] How to establish an effective defense mechanism is the key to ensuring the security of machine learning systems. Existing defense technologies include attack detection and defense methods based on Trojan horse pattern recognition, adversarial training defense methods using network gradient information and generative adversarial networks, and adversarial defense methods based on neuron repair and pruning. However, most defense technologies use the pattern information of known attack samples to achieve attack detection or build defense models; there is no effective way to prevent the pattern information of unknown attack samples. Summary of the invention

[0004] In view of this, the purpose of the present disclosure is to provide a training method and device for a neural network model.

[0005] Based on the above purpose, one or more embodiments of the present disclosure provide a method for training a neural network model, including: obtaining an original data set corresponding to the attack defense requirements of the neural network model;

[0006] Pre-training the neural network model using the original data set to obtain a pre-trained model;

[0007] Based on the covariance matrix adaptive evolution strategy CMA-ES, the pre-training model is supplemented with training data sets to obtain a target model.

[0008] As a further improvement of an embodiment of the present disclosure, based on the covariance matrix adaptive evolution strategy CMA-ES, the pre-trained model is supplemented with the training data set to obtain a target model, including the following steps:

[0009] S41 models the intermediate layer changes of the pre-trained model as a multi-dimensional Gaussian distribution;

[0010] S42 samples a set of candidate solutions for the intermediate layer parameters in the multidimensional Gaussian distribution to form a plurality of candidate neural network models;

[0011] S43 generates a training data set from the original data set based on the structure and parameter information of the candidate neural network model according to the training data generation method selected by the user;

[0012] S44: inputting the training data set into the candidate neural network model to evaluate the robustness of the candidate neural network model;

[0013] S45 sorts the models according to robustness from high to low, and selects a preset proportion of candidate neural network models starting from the highest robustness as the preferred neural network model;

[0014] S46: based on the intermediate layer parameters of the preferred neural network model, updating the parameters of the multidimensional Gaussian distribution to obtain a new multidimensional Gaussian distribution;

[0015] Repeat steps S42 to S46 until a preset termination condition is met, and then use the preferred neural network model as the target model.

[0016] As a further improvement of an embodiment of the present disclosure, the preset termination condition is:

[0017] At least one of a threshold of the number of repeated iterations, a threshold of the accuracy rate, or the accuracy rate no longer improving during the iteration process.

[0018] As a further improvement of an embodiment of the present disclosure, the intermediate layer changes of the pre-trained model are modeled as a multi-dimensional Gaussian distribution, including:

[0019] The solution space of the intermediate layer parameters of the pre-trained model is modeled as a multi-dimensional Gaussian distribution N(μ, σ 2 C), where μ is the mean of the distribution, σ is the learning step size, and C is the covariance matrix;

[0020] Obtain the intermediate layer parameter value of the pre-trained model, use the parameter value as the initial mean μ of the multidimensional Gaussian distribution, and initialize the learning step σ in the range of 0.0001-0.1.

[0021] As a further improvement of an embodiment of the present disclosure, the learning step size σ is initialized to 0.1.

[0022] As a further improvement of an embodiment of the present disclosure, obtaining the original data set includes:

[0023] At least one of a public dataset or a custom dataset that matches the usage scenario of the pre-trained model is selected as the original data, and the original dataset includes pictures stored in pixel-level matrix data.

[0024] As a further improvement of an embodiment of the present disclosure, according to the training data generation method selected by the user, generating a training data set from the original data set based on the structure and parameter information of the candidate neural network model includes the following steps:

[0025] Based on the structure and parameter information of the candidate neural network model, the training data set is generated by adopting a multi-step training data generation method.

[0026] As a further improvement of an embodiment of the present disclosure, the multi-step method of generating training data includes: generating training data using a projected gradient descent method.

[0027] As a further improvement of an embodiment of the present disclosure, the robustness of the candidate neural network model includes at least one of the classification accuracy and loss function values ​​such as cross entropy of the training data set.

[0028] One or more embodiments of the present disclosure provide a neural network countermeasure defense device, including:

[0029] A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the training method for the neural network model as described above is implemented.

[0030] From the above, it can be seen that the training method and device of the neural network model provided by the present disclosure use the covariance matrix to model the randomness of unknown attacks, and use the combination of evolutionary strategy algorithm and neural network fine-tuning technology to ensure the network's effectiveness against known attacks, thereby improving the network's defense capabilities against unknown attacks and further improving the security of deep learning related systems. This method is not limited to the situation of the data set and the specific model. According to the situation of different data sets, the specified model is supplemented with training or repair, thereby improving the efficiency of the neural network's defense against known attacks and improving the security of deep learning related systems.

[0031] With reference to the following description and drawings, specific embodiments are disclosed in detail, indicating the manner in which the principles of the technical solutions of the present disclosure can be adopted. It should be understood that the embodiments of the present disclosure are not limited in scope. Within the spirit and scope of the appended claims, the embodiments of the present disclosure include many changes, modifications and equivalents. Features described and / or shown for one embodiment can be used in one or more other embodiments in the same or similar manner, combined with features in other embodiments, or replace features in other embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 A schematic diagram of a training method for a neural network model provided in an embodiment of the present disclosure;

[0034] Figure 2 A schematic diagram of a method for supplementing the training of a pre-trained model to obtain a target model provided in an embodiment of the present disclosure;

[0035] Figure 3 A schematic diagram of a neural network countermeasure defense device provided in an embodiment of the present disclosure. Specific embodiments

[0036] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0037] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0038] See also Figure 1 The training method of the neural network model provided by the embodiment of the present disclosure comprises the following steps:

[0039] S1, obtaining an original data set corresponding to the attack defense requirements of the neural network model;

[0040] S2, pre-training the neural network model using the original data set to obtain a pre-trained model;

[0041] S3, based on the covariance matrix adaptive evolution strategy CMA-ES, using the training data set to supplement the pre-training model to obtain the target model.

[0042] For step S1, an original data set corresponding to the attack defense requirements of the neural network model is obtained, and the original data set is selected according to the usage scenario of the pre-trained model to be optimized, or the test scenario.

[0043] The original data set can be an existing public data set or an uploaded custom data set. The original data is expressed as a "picture of pixel-level matrix data storage". The original data is used to train neural network models, such as training classification systems, face recognition and other neural network models. In the present disclosure, the original data has two uses. One is to train the pre-trained model to be optimized; the other is to generate training data through the training data generation method selected later.

[0044] For step S2, the neural network model is pre-trained using the original data set to obtain a pre-trained model. Before the optimization begins, the pre-trained model to be optimized is a pre-trained model trained with the original data, that is, a neural network model trained with the original data in the previous step. The pre-trained model can use a classic network structure or a custom network structure, input the original data into the pre-trained model, and complete the pre-training with the pre-trained model.

[0045] Specifically, different pre-trained models are selected according to the needs of the user's device and model application scenarios, such as ResNet18, ResNet50 and other neural network models. The difference between ResNet18 and ResNet50 is that the two neural network models have different number of structural layers. If you need to quickly obtain an optimized model, you can use a neural network model with fewer structural layers, such as ResNet18. If you need to obtain a relatively safe model, you can use a neural network model with more structural layers, such as ResNet50.

[0046] Common neural network models can be implemented using open source tools such as TensorFlow and pytorch. TensorFlow and pytorch are both used as tools for implementing neural network models. If the classic neural network model does not meet the needs of use, you can also upload a custom network structure model as a pre-trained model; the custom network structure model file can be a py file written in python; input the obtained original data set into the selected pre-trained model, and when the classification accuracy of the pre-trained model for the original data set is higher than the predetermined threshold, a usable pre-trained model can be obtained.

[0047] For step S3, please also refer to Figure 2 , is a schematic diagram of the covariance matrix adaptive evolution strategy CMA-ES provided in an embodiment of the present disclosure, which uses a training data set to supplement the pre-training model to obtain a target model.

[0048] In step S41, the change of the intermediate layer of the pre-trained model is modeled as a multi-dimensional Gaussian distribution. The intermediate layer parameters of the pre-trained model to be optimized are extracted, and the extracted intermediate layer of the neural network model includes all network layers except the first layer and the last layer. The solution space of the intermediate layer parameters of the pre-trained model is modeled as a multi-dimensional Gaussian distribution N(μ, σ 2 C). Where μ is the mean of the distribution, σ is the learning step, and C is the covariance matrix. The intermediate layer parameter value of the pre-trained model to be optimized is used as the initial mean μ0 of the Gaussian distribution; then the learning step σ0 is initialized in the range of 0.0001-0.1; preferably, the learning step σ0 is initialized with 0.1.

[0049] Step S42, sampling a candidate solution set of the intermediate layer parameters in the multidimensional Gaussian distribution to form multiple candidate neural network models. Sampling all candidate solution sets in the current multidimensional Gaussian distribution, each candidate solution corresponds to a candidate neural network model; replacing the intermediate layer parameters of the pre-trained model to be optimized with the sampled intermediate layer parameters to obtain multiple candidate neural network models.

[0050] Step S43, according to the training data generation method selected by the user, a training data set is generated from the original data set based on the structure and parameter information of the candidate neural network model. The source of the training data set is the original data. On the basis of the original data, the artificial attack data is calculated for the purpose of training the pre-trained model to be optimized. There are two ways to generate training data: a single-step training method and a multi-step training data method. The single-step training method has a small time cost, but a relatively low precision; the multi-step training data method has a large time cost, but a relatively high precision.

[0051] When the training speed is required to be high, a single-step data generation method with low overhead can be selected; when the training speed is not required to be high, a data generation method with a longer time, such as PGD (projected gradient descent method), can be selected; PGD performs multiple iterations, taking a small step each time, and each iteration projects the disturbance into the specified range; PGD is the strongest first-order attack, and among all first-order adversarial samples, PGD is considered to be the optimal method in terms of effect; it has a higher simulation effect on real-scene attack data and a better improvement in effect; in this embodiment, the preferred method is to generate training data in multiple steps.

[0052] The generation of training data is based on the structure and model parameters of the pre-trained model to be optimized. When generating training data, first obtain the specific structure and model parameters of the pre-trained model to be optimized, including the number of hidden layers of the deep neural network, the number of neurons in each layer, the input layer, the output layer, etc.; generate training data on the original data set according to the selected training data generation method.

[0053] Step S44, input the training data set into the candidate neural network model, and evaluate the robustness of the candidate neural network model. The training data obtained in step S43 are respectively input into the multiple candidate neural network models to obtain the classification results of the training data by different candidate neural network models, and evaluate the robustness of the multiple candidate neural network models. It can be imagined by those skilled in the art that when evaluating the robustness of the candidate neural network model, a variety of common parameters can be used for evaluation, for example, calculating the classification accuracy of the classification result. Preferably, the robustness of the candidate neural network model includes at least one of the classification accuracy of the training data set and the loss function value such as cross entropy.

[0054] Step S45, sorting from high to low according to robustness, and selecting a preset ratio of candidate neural network models starting from the highest robustness as the preferred neural network model. After obtaining the robustness evaluation results of multiple candidate neural networks based on step S44, all candidate neural networks are sorted from high to low based on robustness, and a certain ratio of candidate neural network models from high to low robustness are selected as the preferred neural network models. Preferably, the candidate neural network models ranked in the top 30% are selected as the preferred neural network models.

[0055] Step S46, based on the intermediate layer parameters of the preferred neural network model, update the parameters of the multidimensional Gaussian distribution to obtain a new multidimensional Gaussian distribution. From these preferred neural network models, obtain the intermediate layer parameters, update the mean, covariance and other parameters of the multidimensional Gaussian distribution, and calculate a new multidimensional Gaussian distribution. Then, through the new multidimensional Gaussian distribution, carry out the process of establishing a candidate neural network model - generating a training data set - evaluating the robustness of the candidate neural network model - selecting a preferred neural network model - updating the multidimensional Gaussian distribution based on the preferred neural network model as described in steps S43 to S46. Through such a cyclic process, the optimal intermediate layer parameters are obtained.

[0056] Step S46, repeat the above steps until the preset termination condition is met. Determine whether the preset termination condition is met. When the number of iterations reaches the preset threshold, or the robustness parameter in the evaluation result exceeds the preset robustness parameter threshold, or the robustness parameter is no longer improved after multiple iterations, the algorithm stops running, and the selected preferred neural network model is the optimized target neural network model.

[0057] Optionally, the training method of the neural network model provided by the present disclosure further includes: generating simulated attack data to test the robustness of the optimized neural network model. The generation of the simulated attack data is based on the structure and model parameters of the optimized neural network model, and the simulated attack data is generated on the original data set according to the selected training data generation method, and the simulated attack data is input into the optimized neural network model to obtain the classification result of the optimized neural network model, and the classification result is compared with the correct classification result of the simulated attack data, thereby obtaining the classification accuracy of the optimized neural network model as a robustness evaluation index to evaluate the robustness of the optimized neural network model.

[0058] From the above, it can be seen that the training method of the neural network model provided by the present invention uses the covariance matrix to model the randomness of unknown attacks, and uses the combination of the evolutionary strategy algorithm and the neural network fine-tuning technology to ensure the effectiveness of the network against known attacks, thereby improving the network's defense capabilities against unknown attacks and further improving the security of deep learning related systems. The neural network opponent defense method and device provided by the present disclosure are not limited to the situation of the data set and the structure of the neural network model, improve the accuracy and efficiency of the neural network defense, and improve the security of deep learning related systems.

[0059] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present disclosure also provides a neural network adversarial defense device. The neural network adversarial defense device includes: a data set selection unit, which is used to select the original data set according to specific needs; a model selection unit, which is used to select an existing neural network model as a pre-trained model to be optimized. The impact of pre-trained models to be optimized with different structures is mainly reflected in the differences in training overhead and model accuracy brought by models of different complexity. And, a robust training module is used to train the robustness of the pre-trained model to be optimized. The robust training module generates training data based on the original data, and trains and optimizes the intermediate layer parameters of the pre-trained model to be optimized based on the covariance matrix adaptive evolution strategy, thereby providing adversarial defense capabilities for the neural network model.

[0060] Optionally, the neural network adversarial defense device further includes a data set uploading unit for selecting to upload a custom data set when the public data set cannot meet the requirements.

[0061] Optionally, the neural network defense device further comprises a neural network model uploading unit for uploading a file of a custom neural network model structure, and preferably, the model file is a py file written in python language.

[0062] Furthermore, the neural network adversarial defense device also includes a testing module, which includes: a test data generation unit, which is used to generate attack test data for the optimized neural network model based on the original data; a robustness evaluation unit, which inputs the test data into the optimized neural network model to obtain a classification result of the optimized neural network model, and compares the classification result with the correct classification result of the test data, thereby obtaining a robustness evaluation index of the optimized neural network model, which is used to evaluate the robustness of the optimized neural network model.

[0063] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0064] The device of the above embodiment is used to implement the training method of the corresponding neural network model in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0065] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0066] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0067] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides a neural network defense device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the training method of the neural network model described in any of the above embodiments is implemented.

[0068] Figure 3The hardware structure diagram of a neural network defense device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0069] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0070] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0071] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0072] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0073] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0074] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0075] The device of the above embodiment is used to implement the training method of the corresponding neural network model in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0076] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0077] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A training method for a neural network model, characterized in that: include: Acquire an original data set corresponding to the attack and defense requirements of the neural network model; Pre-training the neural network model using the original data set to obtain a pre-trained model; Based on the covariance matrix adaptive evolution strategy CMA-ES, the pre-trained model is supplemented with training data sets to obtain a target model; Based on the covariance matrix adaptive evolution strategy CMA-ES, the pre-trained model is supplemented with training data sets to obtain a target model, including the following steps: S41 models the intermediate layer changes of the pre-trained model as a multi-dimensional Gaussian distribution; S42 samples a set of candidate solutions for the intermediate layer parameters in the multidimensional Gaussian distribution to form a plurality of candidate neural network models; S43 generates a training data set from the original data set based on the structure and parameter information of the candidate neural network model according to the training data generation method selected by the user; S44: inputting the training data set into the candidate neural network model to evaluate the robustness of the candidate neural network model; S45 sorts the models according to robustness from high to low, and selects a preset proportion of candidate neural network models starting from the highest robustness as the preferred neural network model; S46: based on the intermediate layer parameters of the preferred neural network model, updating the parameters of the multidimensional Gaussian distribution to obtain a new multidimensional Gaussian distribution; Repeat steps S42 to S46 until a preset termination condition is met, and use the preferred neural network model as the target model; The intermediate layer changes of the pre-trained model are modeled as a multi-dimensional Gaussian distribution, including: The solution space of the intermediate layer parameters of the pre-trained model is modeled as a multi-dimensional Gaussian distribution N(μ, σ 2 C), where μ is the mean of the distribution, σ is the learning step size, and C is the covariance matrix; Obtain the intermediate layer parameter value of the pre-trained model, use the parameter value as the initial mean μ of the multidimensional Gaussian distribution, and initialize the learning step σ in the range of 0.0001-0.

1.

2. The training method of the neural network model according to claim 1, characterized in that: The pre-set termination condition is: At least one of a threshold of the number of iterations, a threshold of the robustness parameter, or the robustness parameter no longer improving during the iteration process is repeated.

3. The training method of the neural network model according to claim 1, characterized in that: The learning step size σ is initialized to 0.

1.

4. The training method of the neural network model according to claim 1, characterized in that: The obtaining of the original data set comprises: At least one of a public dataset or a custom dataset that matches the usage scenario of the pre-trained model is selected as the original data, and the original dataset includes pictures stored in pixel-level matrix data.

5. The training method of the neural network model according to claim 1, characterized in that: According to the training data generation method selected by the user, a training data set is generated from the original data set based on the structure and parameter information of the candidate neural network model, including the following steps: Based on the structure and parameter information of the candidate neural network model, the training data set is generated by adopting a multi-step training data generation method.

6. The training method of the neural network model according to claim 5, characterized in that: The multi-step method of generating training data includes: generating training data by using a projected gradient descent method.

7. The training method of the neural network model according to claim 1, characterized in that: The robustness of the candidate neural network model includes at least one of the classification accuracy and the cross entropy loss function value of the training data set.

8. A training device for a neural network model, characterized in that: include: A memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the program, the training method of the neural network model as described in any one of claims 1 to 7 is implemented.

Images