A deep learning sample testing method and device based on loss function sensitivity

Abstract

The present invention discloses a deep learning sample testing method and device based on loss function sensitivity, which comprises the following steps: obtaining an image data set as a clean sample and constructing a deep learning network; performing an adversarial attack operation on the image data set to obtain an adversarial sample; and screening the image data set to obtain a total sample set, which is divided into a training sample set and a test sample set; setting a loss function sensitivity function; establishing a particle swarm optimization model, calculating a loss sensitivity drift value, performing iterative updating, and selecting two types of optimal drift sample sets, namely normal samples and adversarial samples; training using the optimal drift sample set to obtain a loss sensitivity classifier; inputting the two types of optimal drift sample sets into the deep learning network for retraining to obtain a test model; inputting the test sample set into the test model for iteration to find an optimal drift noise sample, calculating the loss function sensitivity drift value of the optimal drift noise sample, and distinguishing using the loss sensitivity classifier to complete sample detection.

Description

Technical Field

[0001] The present invention belongs to the field of security issues for deep learning samples, and specifically relates to a deep learning sample testing method and device based on loss function sensitivity. Background Art

[0002] Deep learning is one of the directions of artificial intelligence that has attracted much attention in recent years. As deep neural networks (DNNs) have achieved great success in many applications, massive amounts of data have also come along, and neural networks have also achieved good performance in image classification tasks. For example, the ImageNet dataset has 3.2 million manually annotated images. Although large platforms such as Amazon have tried their best to annotate the class labels of large-scale images, some errors are still inevitable in the annotation process, and samples with incorrect labels are likely to damage the performance of models trained on similar samples. In addition, the ability of deep neural networks to memorize massive data with randomly assigned labels proves the sensitivity of overfitting when training noisy samples. Therefore, a DNN algorithm that is robust to noisy labels is needed to solve potential problems. Furthermore, samples are easy to obtain but the cost of accurate labeling is very expensive. This algorithm can make datasets with more and noisy labels more beneficial than datasets with fewer and more accurate labels.

[0003] At present, AI attacks are mainly divided into two types: poisoning attacks and adversarial attacks. Poisoning attacks mainly create poisoned samples by adding marks to normal samples. The poisoned samples are then injected into the training data set, so that the backdoor trigger is embedded in the deep learning network during the training phase. The poisoned samples are input during the testing phase to trigger the attack. Adversarial attacks mainly add some disturbances that are imperceptible to the human eye to the original samples. Unlike other attacks, adversarial attacks mainly occur when constructing adversarial samples. The generated adversarial samples are input into the machine learning model like normal samples to obtain deceptive recognition results. Adversarial attacks are divided into white-box attacks and black-box attacks.

[0004] However, existing neural network testing methods focus on the recognition accuracy of the model and the robustness of the model under malicious samples. In addition, the sample testing method can only be used to identify a small number of samples or specific samples, ignoring the risk of multiple types of malicious samples damaging the model when applied to the edge. Different types of malicious samples still have a destructive effect on the defended neural network model. When neural networks are used in real life, such as in autonomous driving scenarios, malicious samples formed by samples of pedestrians or road signs generated by different weather and pollution will attack the automatic discrimination model, causing significant risks of model errors, so this potential risk cannot be ignored. Summary of the invention

[0005] In view of the shortcomings of the prior art, the present invention proposes a deep learning sample testing method and device based on loss function sensitivity.

[0006] To achieve the above objectives, the technical solution of the present invention is: 1. A deep learning sample testing method based on loss function sensitivity, comprising the following steps:

[0007] (1) Obtain image datasets as normal samples and build a deep learning network;

[0008] (2) selecting an adversarial attack method, performing an adversarial attack operation on the image data set obtained in step (1), and obtaining adversarial samples; screening the normal samples and adversarial samples after screening as the total sample set; and dividing the total sample set into a training sample set and a test sample set;

[0009] (3) Setting the loss function sensitivity function based on the loss function and the training sample set;

[0010] (4) Establish a particle swarm optimization model, calculate the loss sensitivity drift values ​​of all samples, iteratively update the loss sensitivity drift values, select two types of optimal drift sample sets: normal samples and adversarial samples; use the optimal drift sample set for training to obtain a loss sensitivity classifier;

[0011] (5) The two types of optimal drift sample sets obtained in step (4) are input into the deep learning network constructed in step (1) for retraining to obtain a test model; the test sample set obtained in step (2) is input into the test model for iterative updating, the optimal drift noise sample corresponding to the test sample set is found, the loss function sensitivity drift value of the optimal drift noise sample is calculated, and the drift value is input into the loss sensitivity classifier constructed in step (4) for discrimination to complete the sample detection.

[0012] Furthermore, the image dataset is a typical image dataset such as MNIST, CIFAR10, ImageNet, GTSRB, and CASIA.

[0013] Furthermore, the deep learning network is a network such as VGG16, AlexNet, VGG11 or ResNet34.

[0014] Furthermore, the anti-attack method is one of FGSM, Boundary, and MIFGSM.

[0015] Furthermore, the step (3) is specifically as follows:

[0016] (3.1) Construct loss function: Set the cross entropy function as the loss function, the formula is:

[0017]

[0018] Where C represents the number of classification results; N represents the total number of training samples; h is the final output of the network, and h yi is the output of the class label after the deep learning network, h j is the output of the jth classification result after the deep learning network;

[0019] (3.2) Construct loss sensitivity function: The gradient function generated by the loss function on the training sample is used as the objective function, and the second-order norm is used to reduce its dimension. The function is:

[0020]

[0021] In the formula, ▽ x Loss means to use the loss function loss to find the partial derivative of the training sample x;

[0022] New noise samples are generated by adding different degrees of noise to the training sample set, and the training sample set and the noise sample are simultaneously input into the deep learning network to generate the loss function value; the offset value of the loss function of the training sample set and the noise sample is used as its loss sensitivity function:

[0023] Ls=Lf noise -Lf nor

[0024] Among them, Lf noise is the loss sensitivity value of the training sample after adding noise, Lf nor is the loss sensitivity value of the initial training sample without adding noise;

[0025] Furthermore, the step (4) specifically includes the following steps:

[0026] (4.1) Add random noise to the input samples and initialize the particle swarm optimization model;

[0027] (4.2) Sample loss sensitivity drift value calculation: For all input samples, the loss sensitivity value of each sample with random noise added after initialization is calculated using the loss sensitivity function set in step (3), and then the loss sensitivity value of the sample is subtracted from the loss sensitivity value of the sample to obtain the drift value of the loss sensitivity value of samples with different noises;

[0028] (4.3) Update the historical optimal position and the global optimal position: Calculate the loss function sensitivity value of the particle swarm, compare the historical best loss function sensitivity and update the historical optimal position p of each particle best , the global optimal position g of the particle swarm best ;

[0029] (4.4) Update the velocity vi and position xi of the particle group;

[0030] (4.5) Optimal drift sample selection: The loss function sensitivity of the input sample is continuously updated and optimized to generate noise samples with different loss sensitivities. In the iterative update of the same input sample, the noise sample with the maximum loss function sensitivity corresponding to each sample is recorded, that is, the optimal drift sample; the different optimal drift samples generated by normal samples and adversarial samples are summarized to form two types of optimal drift sample sets: normal samples and adversarial samples.

[0031] (4.6) Construction of loss sensitivity classifier: Select the optimal drift sample interval to record the drift intervals of different types of samples to form a sample interval data set, which includes normal sample drift interval class and adversarial sample drift interval class. Use a binary classifier to train the above data set to train a binary classifier that can distinguish normal samples from adversarial samples based on loss sensitivity; use this binary classifier as a loss sensitivity classifier.

[0032] Furthermore, the step (5) is specifically as follows:

[0033] (5.1) Sort the two optimal drift sample sets obtained in step (4) according to the size of the drift value, select the top-K samples and labels of each category, input them into the deep learning network constructed in step (1) for retraining, and generate a test model;

[0034] (5.2) Input the test sample set divided in step (2) into the test model to obtain the predicted label; iteratively update the test sample and the predicted label input in the particle swarm optimization model to find the optimal drift noise sample corresponding to the test sample, calculate the loss function sensitivity drift value of the optimal drift noise sample, and input the changed drift value into step (4) for judgment, so as to infer whether the sample is a normal sample or an adversarial sample and complete the sample detection.

[0035] A second aspect of an embodiment of the present invention provides a deep learning sample testing device based on loss function sensitivity, comprising one or more processors for implementing the above-mentioned deep learning sample testing method based on loss function sensitivity.

[0036] A third aspect of an embodiment of the present invention is a computer-readable storage medium having a program stored thereon, which, when executed by a processor, is used for the above-mentioned deep learning sample testing method based on loss function sensitivity.

[0037] The beneficial effects of the present invention are as follows: the present invention can ensure that the input samples are security checked before being input into the deep learning network, to test whether the samples are malicious samples and whether they will disrupt the discrimination strategy of the deep learning network, so as to avoid serious consequences in practical applications, and ensure the effectiveness of commonly used model training and sample testing processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 is a flow chart of the method of the present invention;

[0039] Figure 2 Schematic diagram of the device of the present invention. DETAILED DESCRIPTION

[0040] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0041] The terms used in the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the present invention and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0042] It should be understood that although the terms first, second, third, etc. may be used in the present invention to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present invention, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0043] The following is a detailed description of the deep learning sample testing method and device based on loss function sensitivity of the present invention in conjunction with the accompanying drawings. In the absence of conflict, the features of the following embodiments and implementations can be combined with each other.

[0044] Before getting the sample library for model training, we first need to perform sample identification tasks on the model library. Specifically, by inputting the normal samples of the same type and the corresponding adversarial samples as test data sets into the model, we can find the loss sensitivity range of each type of sample and remove the abnormal samples that are not in the normal sample range. This can ensure the effect of removing malicious samples on the basis of the convergence of the main task training. When samples of different attack types are input into the test model, the drift degree of their loss function and the loss function of the optimized model is different. The difference in the drift interval is used to reversely infer the type of sample. Using the normal sample X clean and adversarial example X adv The three data sets are input into the model to generate the corresponding three loss function sensitivities. The generated loss sensitivities are optimized and sorted using the particle swarm optimization algorithm, and the top-k samples in each category are selected and input into the original model for retraining to generate a new discriminant model. The unknown samples to be tested are then input into the discriminant model, and the samples are discriminated using the regenerated loss sensitivity.

[0045] Reference Figure 1 , the deep learning malicious sample detection method based on loss function sensitivity proposed in the embodiment of the present invention comprises the following steps:

[0046] 1) Dataset selection:

[0047] Typical image datasets such as MNIST, CIFAR10, ImageNet, GTSRB, and CASIA are selected. The embodiment of the present invention takes the CIFAR10 dataset as an example. The CIFAR10 dataset is a dataset of 6,000 images of 10 categories with an image size of 32*32.

[0048] 2) Sample attack preparation:

[0049] 2.1) Select a deep learning network: You can choose a network such as VGG16, AlexNet, VGG11, ResNet34, etc. The embodiment of the present invention takes the VGG16 network as an example.

[0050] 2.3) Select an adversarial attack method and generate adversarial samples: Select adversarial attack methods such as FGSM, Boundary, and MIFGSM. In the embodiment of the present invention, FGSM and Boundary are used as examples in MNIST, where FGSM is a white-box attack and Boundary is a black-box attack. Both attacks are non-targeted attacks, that is, random noise is added, and only the original label needs to be changed.

[0051] 2.4) Sample screening and combination: The embodiment of the present invention screens the original normal samples and adversarial samples, first eliminating normal samples that the model cannot correctly classify and malicious samples that fail to counter the attack. Secondly, the two types of samples that have been screened are classified separately to form a total sample set. 4,000 samples of each category are selected from the total sample set to form a training sample set. Finally, 1,000 samples of each category that are different from the training samples are selected from the total sample set to form a test sample set for the final performance test.

[0052] 3) Set the loss function sensitivity function:

[0053] 3.1) Constructing the loss function: Ideally, there is a clean dataset where x i is the feature space, y i is the class label. The role of the classifier is to find different class labels f:x→R in different feature spaces c In the embodiment of the present invention, the output layer of the DNN model is set as the softmax layer, and the cross entropy function is set as the loss function, so the loss function is:

[0054]

[0055] Among them, C represents the number of classification results; N represents the total number of training samples, h is the final output of the network, and h yi is the output of the class label after the deep learning network, h j It is the output of the j-th classification result after the deep learning network.

[0056] 3.2) Constructing loss sensitivity function: First, in order to further improve the sensitivity of the loss function to the sample, the gradient function generated by the derivation of the loss function on the training sample is used as the objective function, and the second-order norm is used to reduce its dimension. The function Lf is:

[0057]

[0058] In the formula, ▽ x Loss means to use the loss function loss to find the partial derivative of the training sample x;

[0059] New noise samples are generated by adding different degrees of noise to the training sample set, and the training sample set and the noise sample are simultaneously input into the deep learning network to generate the loss function value. The offset value of the loss function of the training sample set and the noise sample is used as the loss function sensitivity function Ls:

[0060] Ls=Lf noise -Lf nor

[0061] Among them, Lf noise is the loss sensitivity value of the training samples after adding noise, and Lf nor is the loss sensitivity value of the initial training samples without adding noise.

[0062] When adding noise to the samples, it is selected to add noise along the gradient direction, and the process of adding noise is as follows:

[0063] x' = x + s * grad

[0064] where s is the iteration step size.

[0065] When changing the pixel values of the image, the following conditions need to be met:

[0066]

[0067] Among them, x represents the original image; x' represents the image after changing the pixel values; L0 represents the maximum number of pixels that have been changed; L∞ represents the maximum value of pixel changes; size(x) is the number of pixels in the image where 0 < x; 0 < α, β < 1.

[0068] 4) Establishment of the Particle Swarm Optimization Model (PSO)

[0069] 4.1) Initialization of the Particle Swarm Optimization Model

[0070] PSO is initialized as a group of random particles. In the embodiments of the present invention, when each sample is input into the particle swarm optimization model, 20 initialization samples with different random noises are constructed by adding random noises. Each initialization sample is used as a particle to construct 20 particles of the PSO model. The RGB values of all pixel points of each input sample are used as the position matrix x of the particle i , and the change matrix of the RGB values is used as the velocity matrix v of the particle i . And the current iteration number g, the maximum iteration number G k , the current inertia weight factor ω g . The historical optimal position p of the i-th particle best , the global optimal position g discovered by the particle swarm best .

[0071] 4.2) Calculation of the sample loss sensitivity value

[0072] Calculate the loss function sensitivity of the above 20 initialization samples with added random noises after the initialization is completed through the loss function sensitivity function set in step (3), and then calculate the drift value of the loss function sensitivity of different noise samples by taking the difference from the loss function sensitivity of the input sample.

[0073] 4.3) Calculate the loss function sensitivity value of the particle swarm, compare the historical best loss function sensitivity and update the historical best position p of each particle best , the global optimal position g of the particle swarm best .

[0074] 4.4) Update the speed vi and position xi of the particle group. In the process of updating the particle speed and position, the inertia factor is used. When its value is large, the global search ability is strong, and when its value is small, the local search ability is strong. The calculation formula is as follows:

[0075] ω (g) =(ω ini -ω end )(G k -g) / G k +ω end

[0076] υ i =ω (g) ×υ i +c1×rand()×(pbest i -x i )+c2×rand()×(gbest i -x i )

[0077] x i =x i +υ i

[0078] Among them, ω ini is the initial weight factor value, ω end is the final weight factor value, c1 and c2 are the initialization learning factors, and rand() is a random number between (0, 1) generated by the system.

[0079] 4.5) Optimal drift sample set selection

[0080] After continuously updating and optimizing the loss function sensitivity of the input sample in step 4.4), noise samples with different loss sensitivities are generated. In the iterative update of the same input sample, the noise sample with the maximum loss function sensitivity corresponding to each sample is recorded, i.e., the optimal drift sample. The different optimal drift samples generated by normal samples and adversarial samples are summarized to form two types of optimal drift sample sets: normal samples and adversarial samples.

[0081] 4.6) Loss Sensitivity Classifier Construction

[0082] Select the optimal drift sample interval to record the drift intervals of different types of samples to form a sample interval data set, which includes normal sample drift interval classes and adversarial sample drift interval classes. Use a binary classifier to train the above data set, so as to train a binary classifier that can distinguish normal samples from adversarial samples based on loss sensitivity. This binary classifier is used as a loss sensitivity classifier.

[0083] 5) Sample testing

[0084] 5.1) Model retraining

[0085] In order to increase the discrimination of the loss function of the two types of samples, the two types of optimal drift sample sets in 4.5) are sorted according to the size of the drift value, and the top-K samples and labels of each type are selected and sent to the deep learning network trained in step (1) (the VGG16 model in this embodiment) for retraining to generate a test model for subsequent testing of the test data set.

[0086] 5.2) Sample testing

[0087] Input each sample in the test sample set in 2.4) into the test model in 5.1) to obtain the predicted label. Input the test sample and the predicted label into the particle swarm optimization model in 5.1) for iterative update, find the optimal drift noise sample corresponding to the test sample, calculate the loss function sensitivity drift value of the optimal drift noise sample, and input the drift value into the binary classifier constructed in step 4.6) for discrimination, so as to infer whether the sample is a normal sample or an adversarial sample, thereby completing the sample detection.

[0088] Corresponding to the aforementioned embodiment of the deep learning sample testing method based on loss function sensitivity, the present invention also provides an embodiment of the deep learning sample testing device based on loss function sensitivity.

[0089] See also Figure 2 , a deep learning sample testing device based on loss function sensitivity provided by an embodiment of the present invention includes one or more processors for implementing the deep learning sample testing method based on loss function sensitivity in the above embodiment.

[0090] The embodiment of the deep learning sample testing device based on the sensitivity of the loss function of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory for execution. From the hardware level, if Figure 2 As shown, it is a hardware structure diagram of any device with data processing capability where the deep learning sample testing device based on loss function sensitivity of the present invention is located, except Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0091] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0092] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0093] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, the deep learning sample testing method based on loss function sensitivity in the above embodiment is implemented.

[0094] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capability and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0095] The above embodiments are only used to illustrate the design ideas and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design ideas disclosed by the present invention are within the protection scope of the present invention.

Claims

1. A deep learning sample testing method based on loss function sensitivity, characterized in that: The following steps are involved: (1) Obtain image datasets as normal samples and build a deep learning network; (2) selecting an adversarial attack method, performing an adversarial attack operation on the image data set obtained in step (1), and obtaining an adversarial sample; And screen them, and use the screened normal samples and adversarial samples as the total sample set; Divide the total sample set into a training sample set and a test sample set; (3) Setting the loss sensitivity function based on the loss function and the training sample set; The step (3) is specifically: (3.1) Construct loss function: Set the cross entropy function as the loss function, the formula is: Where C represents the number of classification results; N represents the total number of training samples; h is the final output of the network, and h yi is the output of the class label after the deep learning network, h j is the output of the jth classification result after the deep learning network; (3.2) Construct loss sensitivity function: The gradient function generated by the loss function on the training sample is used as the objective function, and the second-order norm is used to reduce its dimension. The function is: In the formula, ▽ x Loss means to use the loss function loss to find the partial derivative of the training sample x; New noise samples are generated by adding different degrees of noise to the training sample set, and the training sample set and the noise sample are simultaneously input into the deep learning network to generate the loss function value; the offset value of the loss function of the training sample set and the noise sample is used as its loss sensitivity function: Ls=Lf noise -Lf nor Among them, Lf noise is the loss sensitivity value of the training sample after adding noise, Lf nor is the loss sensitivity value of the initial training sample without adding noise; (4) Establish a particle swarm optimization model, calculate the loss sensitivity drift values ​​of all samples, iteratively update the loss sensitivity drift values, select two types of optimal drift sample sets: normal samples and adversarial samples; use the optimal drift sample set for training to obtain a loss sensitivity classifier; The step (4) specifically comprises the following steps: (4.1) Add random noise to all input samples and initialize the particle swarm optimization model; (4.2) Sample loss sensitivity drift value calculation: For all input samples, the loss sensitivity value of each sample with random noise added after initialization is calculated using the loss sensitivity function set in step (3), and then the loss sensitivity value of the sample is subtracted from the loss sensitivity value of the sample to obtain the drift value of the loss sensitivity value of samples with different noises; (4.3) Update the historical optimal position and the global optimal position: Calculate the loss function sensitivity value of the particle swarm, compare the historical best loss function sensitivity and update the historical optimal position p of each particle best , the global optimal position g of the particle swarm best ; (4.4) Update the velocity v of the particle swarm i and position x i ; (4.5) Optimal drift sample selection: The loss function sensitivity of all input samples is continuously updated and optimized to generate noise samples with different loss sensitivities. In the iterative update of the same input sample, the noise sample with the maximum loss function sensitivity corresponding to each sample is recorded, i.e., the optimal drift sample; the different optimal drift samples generated by normal samples and adversarial samples are aggregated to form two types of optimal drift sample sets: normal samples and adversarial samples; (4.6) Construction of loss sensitivity classifier: Select the optimal drift sample interval to record the drift intervals of different types of samples to form a sample interval data set. The data set includes a normal sample drift interval class and an adversarial sample drift interval class. Use a binary classifier to train the above data set to train a binary classifier that can distinguish normal samples from adversarial samples based on loss sensitivity. Use this binary classifier as a loss sensitivity classifier. (5) The two types of optimal drift sample sets obtained in step (4) are input into the deep learning network constructed in step (1) for retraining to obtain a test model; the test sample set obtained in step (2) is input into the test model for iterative updating, the optimal drift sample corresponding to the test sample set is found, the loss function sensitivity drift value of the optimal drift sample is calculated, and the drift value is input into the loss sensitivity classifier constructed in step (4) for discrimination to complete the sample detection.

2. The deep learning sample testing method based on loss function sensitivity according to claim 1 is characterized in that: The image datasets are typical image datasets such as MNIST, CIFAR10, ImageNet, GTSRB, and CASIA.

3. The deep learning sample testing method based on loss function sensitivity according to claim 1 is characterized in that: The deep learning network is a VGG16, AlexNet, VGG11 or ResNet34 network.

4. The deep learning sample testing method based on loss function sensitivity according to claim 1 is characterized in that: The counter-attack method is one of FGSM, Boundary, and MIFGSM.

5. The deep learning sample testing method based on loss function sensitivity according to claim 1 is characterized in that: The step (5) is specifically as follows: (5.1) Sort the two optimal drift sample sets obtained in step (4) according to the size of the drift value, select the top-K samples and labels of each category, input them into the deep learning network constructed in step (1) for retraining, and generate a test model; (5.2) Input the test sample set divided in step (2) into the test model to obtain the predicted label; The test sample and the predicted label are input into the particle swarm optimization model for iterative update, and the optimal drift noise sample corresponding to the test sample is found. The loss function sensitivity drift value of the optimal drift noise sample is calculated, and the drift value is input into step (4) for judgment, so as to infer whether the sample is a normal sample or an adversarial sample and complete the sample detection.

6. A deep learning sample testing device based on loss function sensitivity, characterized in that: It includes one or more processors for implementing the deep learning sample testing method based on loss function sensitivity as described in any one of claims 1-5.

7. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, it is used to implement the deep learning sample testing method based on loss function sensitivity described in any one of claims 1-5.

Images