A method to improve the adversarial robustness of deep neural network models
By inserting endogenous protection modules and adversarial training in the deep neural network model, the problem of insufficient adversarial robustness in the existing technology is solved, effective resistance to adversarial sample attacks is achieved, and the security of the model is improved.
Patent Information
- Application Number
- CN202210238956.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-03-07
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2042-03-07
AI Technical Summary
The prior art is difficult to effectively improve the adversarial robustness of deep neural network models, especially when facing adversarial sample attacks, which may lead to security risks. Existing methods such as gradient hiding, image preprocessing, and adversarial training have vulnerabilities or negative effects.
Insert endogenous protection modules, including attention units, are inserted into the deep neural network model structure, to process the original and adversarial samples, and optimize the model through adversarial training methods, adopting specific loss functions to enhance the adversarial robustness of the model.
It significantly improves the adversarial robustness of deep neural network models, can effectively resist multiple adversarial attack algorithms, and will not have a negative impact on model performance.
Smart Images
Figure CN114781583B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method for improving the adversarial robustness of a deep neural network model. Background Art
[0002] With the rapid development of artificial intelligence and deep learning methods, various systems based on artificial intelligence algorithms (referred to as artificial intelligence systems) are deployed in industrial production environments. While these artificial intelligence systems bring convenience to production and life, they also face some security issues, such as the inability to effectively resist adversarial sample attacks. The so-called adversarial sample attack refers to adding slight perturbations to the original input so that the perturbed input is re-entered into the artificial intelligence system to obtain unexpected outputs.
[0003] For AI systems with strict safety requirements (such as autonomous driving systems, malicious traffic detection systems, etc.), failure to effectively resist adversarial sample attacks can lead to very dangerous consequences. For example, during autonomous driving, when encountering a "No Left Turn" sign, the car should avoid turning left under normal circumstances; however, after adding adversarial perturbations to the image of the "No Left Turn" sign, the car may mistakenly think that the sign is a "You can turn left" sign, thus causing a great safety hazard. Therefore, it is very necessary to improve the adversarial robustness of AI systems.
[0004] At present, there are three main methods to improve the adversarial robustness of artificial intelligence systems. The first is the gradient hiding method, which hides or confuses the gradient of the neural network model, so that the gradient-based adversarial sample generation algorithm cannot obtain the correct gradient of the neural network model, and thus cannot easily attack the artificial intelligence system. However, in fact, the vulnerability itself still exists, and the artificial intelligence system is still facing the attack of adversarial samples using adversarial sample generation algorithms other than gradient-based. The second method is the image preprocessing method, which mainly enables the artificial intelligence system to preprocess the input image first, reduce / ignore the adversarial disturbance on the input image, so as to achieve the purpose of resisting adversarial sample attacks, but the processing process of adversarial disturbances is difficult. The third method is to conduct adversarial training on the artificial intelligence system. In the training stage, this method uses the generated adversarial samples and the original samples as the input of the artificial intelligence system, thereby improving the adversarial robustness of the artificial intelligence system, but it may bring other negative effects to the neural network model. Summary of the invention
[0005] In view of the above-mentioned problems existing in the current methods for improving the adversarial robustness of artificial intelligence systems, the present invention provides a method for improving the adversarial robustness of deep neural network models.
[0006] The present invention provides a method for improving the robustness of a deep neural network model, comprising the following steps:
[0007] Step 1: construct an endogenous protection module, wherein the endogenous protection module includes an attention unit, wherein the attention unit includes a first input terminal for inputting an original sample and a second input terminal for inputting an adversarial sample, and a corresponding first output terminal for outputting an original output and a second output terminal for outputting an adversarial output;
[0008] Step 2: Determine a number of insertion positions in a given deep neural network model structure, insert the endogenous protection module into the insertion positions, and obtain a new deep neural network model;
[0009] Step 3: Use adversarial training method to train the new deep neural network model.
[0010] Furthermore, the loss function of the endogenous protection module is shown in formula (1):
[0011]
[0012] Among them, x clean represents the original sample, x adv represents adversarial samples, sub_f represents endogenous protection module, sub_f(x clean ) and sub_f(x adv ) represent the original output and adversarial output of the original sample and adversarial sample after passing through the endogenous protection module, respectively. represents the function that calculates the distance between the original output and the adversarial output.
[0013] Furthermore, the The calculation formula of the function is shown in formula (2):
[0014]
[0015] Furthermore, in step 3, during the training process, the loss function shown in formula (3) is used as the loss function of the new deep neural network model:
[0016]
[0017] in, represents the loss between the original output and the label, represents the loss between the adversarial output and the label, ||δ|| p represents the L_p distance against the disturbance δ, ∈ is the sphere boundary against disturbance δ, α1 and α2 are used to balance and Hyperparameters; β and γ are used to balance the three component losses The parameter of balance between clean ) and f(x adv ) represent the outputs of the original sample and the adversarial sample after passing through the neural network f, It means to calculate f(x clean ) and f(x adv ) is a function of the distance between them.
[0018] Furthermore, the The calculation formula of the function is shown in formula (4):
[0019]
[0020] Beneficial effects of the present invention:
[0021] The method for improving the adversarial robustness of a deep neural network model provided by the present invention starts from the deep neural network model structure itself, and adds multiple endogenous protection modules to the original model structure as a new adversarial defense structure, thereby forming a new deep neural network model. By performing adversarial training on it, the adversarial robustness of the deep neural network model can be greatly improved without having a negative impact on its performance. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 A flowchart of a method for improving the adversarial robustness of a deep neural network model provided by an embodiment of the present invention;
[0023] Figure 2 A schematic diagram of the structure of an endogenous protection module provided in an embodiment of the present invention;
[0024] Figure 3 Schematic diagram of the structure of the network model structure A (left figure) and A+ (right figure) provided in the embodiment of the present invention;
[0025] Figure 4 Schematic diagrams of the structures of the network model B (left figure) and B+ (right figure) provided in embodiments of the present invention. DETAILED DESCRIPTION
[0026] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0027] Combination Figure 1 and Figure 2 As shown, an embodiment of the present invention provides a method for improving the robustness of a deep neural network model, comprising the following steps:
[0028] S101: Build endogenous protection modules, such as Figure 2 As shown, the endogenous protection module includes an attention unit, and the attention unit includes a first input terminal for inputting an original sample and a second input terminal for inputting an adversarial sample, and a corresponding first output terminal for outputting an original output and a second output terminal for outputting an adversarial output;
[0029] As an implementable method, the loss function of the endogenous protection module is shown in formula (1):
[0030]
[0031] Among them, x clean represents the original sample, x adv represents adversarial samples, f represents neural network, sub_f represents endogenous protection module, sub_f(x clean ) and sub_f(x adv ) represent the original output and adversarial output of the original sample and adversarial sample after passing through the endogenous protection module, respectively. represents the function that calculates the distance between the original output and the adversarial output.
[0032] Said The calculation formula of the function is shown in formula (2):
[0033]
[0034] Where n is the value of the sample dimension.
[0035] The attention unit can select Non-local attention, multi-head attention unit, etc. As an implementable method, Figure 2 A specific structure of the endogenous protection module is given. Figure 2In the example, T is the number of samples in a batch, H and W represent the two dimensions (length and width) of the input matrix, IN_C is the number of input channels, q_f, k_f, v_f and o_f are convolution operations, MID_C is the channel of the convolution operation, transpose is the transposition operation (permutation matrix dimension), and softmax and ReLu are two activation functions.
[0036] It can be understood that the original sample refers to a clean sample without adding adversarial perturbations.
[0037] S102: determining a number of insertion positions in a given deep neural network model structure, inserting the endogenous protection module into the insertion positions, and obtaining a new deep neural network model;
[0038] S103: Using an adversarial training method to train the new deep neural network model.
[0039] Specifically, during the training process, the loss function shown in formula (3) is used as the loss function of the new deep neural network model:
[0040]
[0041] in, represents the loss between the original output and the label, represents the loss between the adversarial output and the label, ||δ|| p represents the L_p distance against the disturbance δ, ∈ is the sphere boundary that counteracts the disturbance of δ (limiting δ to a very small range, making it difficult for the human eye to distinguish), α1 and α2 represent the balancing and Hyperparameters; β and γ are used to balance the three component losses The parameter of balance between clean ) and f(x adv ) represent the outputs of the original sample and the adversarial sample after passing through the neural network, It means to calculate f(x clean ) and f(x adv ) is a function of the distance between them. The role of β and γ is to balance the three component losses The balance between them stabilizes the training process.
[0042] As an implementation method, the The calculation formula of the function is shown in formula (4):
[0043]
[0044] The method for improving the adversarial robustness of a deep neural network model provided by an embodiment of the present invention starts from the deep neural network model structure itself, and adds multiple endogenous protection modules to the original model structure as a new adversarial defense structure, thereby forming a new deep neural network model. By performing adversarial training on it, the adversarial robustness of the deep neural network model can be greatly improved.
[0045] In order to verify the effectiveness of the method provided by the present invention, the present invention also provides the following experimental data.
[0046] (I) Experiment 1
[0047] The original deep neural network model structure is: 2 convolutional layers (the number of convolution kernels is 32 and 64 respectively), each convolutional layer is connected to a maximum pooling layer, and the maximum pooling layer is connected to a fully connected layer with 1024 outputs. For the convenience of description, the original deep neural network model structure is recorded as A. Figure 3 In the figure, the parameters of the convolution operation mean: taking 3*3*32 as an example, the length and width of the convolution window size is 3*3, and the number of convolution kernel channels is 32; BatchNorm is the batch normalization operation for the input samples, ReLu is the nonlinear activation function, Linear is the fully connected layer and the parameter in the brackets is the number of internal neurons.
[0048] The method of the present invention is used to insert an endogenous protection module at a suitable position in the network model structure A, specifically: an endogenous protection module is inserted before each convolutional layer and the first fully connected layer to obtain a new deep neural network model. For the convenience of description, the new deep neural network model structure is recorded as A+.
[0049] Experimental data set: The standard data set MNIST is selected as the original sample; then ∈ = 0.3, step_size = 0.01 are taken as the hyperparameters required to generate MNIST adversarial samples to generate adversarial samples.
[0050] Model parameter setting: Set the optimizer of the network model to Adam, the initial learning rate to 1e-2, and the learning rate decays to 0.1 every 50 epochs. The defensive effects of network model A and A+ against various adversarial attack algorithms are shown in Table 1.
[0051] Table 1. Adversarial attack defense effects of network model A and A+
[0052]
[0053] Among them, FGSM, CW, and PGD are the mainstream adversarial sample generation algorithms, and the numbers behind them represent the number of iterative attacks.
[0054] From the data in Table 1, we can see that the network model structure A+ implanted with the endogenous protection module has a significantly improved defense success rate when facing various mainstream adversarial attack algorithms compared with the network model structure A without the endogenous protection module.
[0055] (II) Experiment 2
[0056] The first original deep neural network model structure is: 3 convolutional layers (the number of convolution kernels is 64, 128, and 256 respectively), each convolutional layer is followed by a maximum pooling layer, and the maximum pooling layer is connected to 2 fully connected layers (containing 1024 and 10 outputs respectively). For the convenience of description, the first original deep neural network model structure is recorded as B. Figure 4 The meaning of the parameters in Figure 3 The same as in, no further description is given here.
[0057] The second original deep neural network model structure is: ResNet18; for the convenience of description, the second original deep neural network model structure is recorded as C.
[0058] The third original deep neural network model structure is: WRN34-10; for the convenience of description, the third original deep neural network model structure is denoted as D.
[0059] By using the method of the present invention, an endogenous protection module is inserted before each convolutional layer or residual block with a downsampling function in the network model structures B, C, and D, respectively, to obtain new deep neural network models, which are respectively recorded as B+, C+, and D+ for the convenience of description. It should be noted that the reason for not adding the endogenous protection module before all convolutional layers is to reduce the extra calculation amount caused by the endogenous protection module.
[0060] Experimental data set: The standard data set CIFAR10 is selected as the original sample; then ∈ = 8 / 255, step_size = 2 / 255 are used as the hyperparameters required to generate CIFAR10 adversarial samples to generate adversarial samples.
[0061] Model parameter setting: Set the optimizer of the network model to Adam, the initial learning rate to 1e-3, and the learning rate decays to 0.5 every 20 epochs. The defense effects of network model structures B, C, D and B+, C+, and D+ against various adversarial attack algorithms are shown in Table 2.
[0062] Table 2. Defense effects of adversarial attacks on network model structures B, C, D and B+, C+, D+
[0063]
[0064] From the data in Table 2, we can see that the defense success rate of the network model structure with the endogenous protection module implanted is improved to varying degrees compared with the network model structure without the endogenous protection module implanted, which proves the effectiveness of the endogenous protection module.
[0065] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for improving the adversarial robustness of a deep neural network model for image recognition, characterized in that: include: Step 1: construct an endogenous protection module, wherein the endogenous protection module includes an attention unit, wherein the attention unit includes a first input terminal for inputting an original image and a second input terminal for inputting an adversarial image, and a corresponding first output terminal for outputting an original output and a second output terminal for outputting an adversarial output; Step 2: Determine a number of insertion positions in a given deep neural network model structure, insert the endogenous protection module into the insertion positions, and obtain a new deep neural network model; Step 3: Using adversarial training method to train the new deep neural network model; The loss function of the endogenous protection module is shown in formula (1): Among them, x clean represents the original image, x adv represents the adversarial image, f represents the neural network, sub_f represents the endogenous protection module, sub_f(x clean ) and sub_f(x adv ) represent the original output and adversarial output of the original image and adversarial image after they pass through the intrinsic protection module, respectively. represents the function that calculates the distance between the original output and the adversarial output; Said The calculation formula of the function is shown in formula (2): Where n is the value of the sample image dimension; In step 3, during the training process, the loss function shown in formula (3) is used as the loss function of the new deep neural network model: in, represents the loss between the original output and the label, represents the loss between the adversarial output and the label, ||δ|| p represents the L_p distance against the disturbance δ, ∈ is the sphere boundary against disturbance δ, α1 and α2 are used to balance and Hyperparameters; β and γ are used to balance the three component losses The parameter of balance between clean ) and f(x adv ) represent the outputs of the original image and the adversarial image after passing through the neural network f, It means to calculate f(x clean ) and f(x adv ) is a function of the distance between them; Said The calculation formula of the function is shown in formula (4):