Adversarial sample defense method and system based on image reconstruction

Abstract

The present invention belongs to the field of image data processing technology, and particularly relates to an adversarial sample defense method and system based on image reconstruction. For an input image, a preset compression ratio is used and a Chebyshev node is selected to construct a compressed sample point space for sampling; for the compressed sample point space, the image is compressed by filtering interpolation; for compressed image data, a preset reconstruction ratio is used and a Chebyshev node is selected to construct a reconstructed sample space for sampling; for the reconstructed sample space, the image is reconstructed by interpolation filtering, and the reconstructed image data is output as adversarial sample data. The present invention adopts compression and reconstruction preprocessing methods for adversarial sample defense, and can maintain a high accuracy rate of a deep neural network DNN model on a clean sample set without training, which is convenient for application in actual scenarios.

Description

Technical Field

[0001] The present invention belongs to the technical field of image data processing, and in particular relates to an adversarial sample defense method and system based on image reconstruction. Background Art

[0002] Deep learning classification models have now been applied to fields including face recognition, autonomous driving, and text analysis. Adversarial sample defense technology is an important part of deep learning security research. Current research on adversarial sample defense technology is lagging behind, and can only passively improve adversarial sample generation technology. It often requires a lot of training based on specific models, which is costly and inflexible. Summary of the invention

[0003] To this end, the present invention provides an adversarial sample defense method and system based on image reconstruction, which adopts compression and reconstruction preprocessing to perform adversarial sample defense. The deep neural network DNN model can maintain a high accuracy on a clean sample set without training, which is convenient for application in actual scenarios.

[0004] According to the design scheme provided by the present invention, a method for defending against adversarial samples based on image reconstruction includes the following contents:

[0005] For the input image, a preset compression ratio is used and a Chebyshev node is selected to construct a compressed sample point space for sampling; for the compressed sample point space, the image is compressed by filtering interpolation;

[0006] For the compressed image data, a preset reconstruction ratio is used and the Chebyshev nodes are selected to construct a sampled reconstruction sample space; for the reconstructed sample space, the image is reconstructed through interpolation filtering, and the reconstructed image data is output as adversarial sample data.

[0007] As the adversarial sample defense method based on image reconstruction of the present invention, further, by selecting Chebyshev nodes to construct the sample point space, first, the corresponding image data is represented as an RGB mode vector, and then, discrete points are selected in the matrix to construct the sample point space.

[0008] As the adversarial sample defense method based on image reconstruction of the present invention, further, the RGB mode vector is expressed as: Among them, the input image size is expressed as n1×n2, and The spatial coordinate vector function f(x,y) = [f1(x,y), f2(x,y), f3(x,y)], where f1(x,y), f2(x,y), f3(x,y) correspond to R, G, and B coordinate vectors, respectively.

[0009] As the adversarial sample defense method based on image reconstruction of the present invention, further, the sample point space is represented as: in, represents the discrete points selected in the input image I, and are the zeros of the first kind Chebyshev polynomials of degree μ and ν respectively, and

[0010] As the adversarial sample defense method based on image reconstruction of the present invention, further, the formula for setting the compression and reconstruction ratio is expressed as: Among them, the input image size is expressed as n1×n2, and the reconstructed image size is N1×N2.

[0011] As an adversarial sample defense method based on image reconstruction of the present invention, further, in interpolation filtering, orthogonal VP polynomials are set and a polynomial space is obtained based on the orthogonal VP polynomials, in which there is an interpolation basis composed of basic VP polynomials, and the image is compressed or reconstructed by performing function approximation on Chebyshev sample nodes using the interpolation properties of the basic VP polynomials.

[0012] As the adversarial sample defense method based on image reconstruction of the present invention, further, for any r=0:(n-1), the orthogonal VP polynomial is expressed as: Where ξ∈[-1,1], t∈[0,π] and ξ=cost, m and n represent adjustment parameters used to alleviate the oscillation of similarity points on the edge of the reconstructed sample; the polynomial space is expressed as:

[0013] Furthermore, the present invention also provides an adversarial sample defense system based on image reconstruction, comprising: an image compression module and an image reconstruction module, wherein:

[0014] The image compression module is used to construct a compressed sample point space for sampling by using a preset compression ratio and selecting Chebyshev nodes for the input image; and compress the image by filtering and interpolation for the compressed sample point space;

[0015] The image reconstruction module is used to construct a sampled reconstruction sample space for compressed image data using a preset reconstruction ratio and by selecting Chebyshev nodes; for the reconstructed sample space, the image is reconstructed through interpolation filtering, and the reconstructed image data is output as adversarial sample data.

[0016] Beneficial effects of the present invention:

[0017] In order to solve the problems that a large amount of training is required according to the specific DNN model in the existing input layer denoising defense, which leads to high cost and poor flexibility, the present invention adopts an adversarial sample defense (VP Filtered Interpolation for Image Compression, VPC) scheme based on VP (de la Vallée Poussin) filter interpolation image compression, samples Chebyshev nodes to construct the sample point space S, uses VP filter interpolation polynomials to compress and reconstruct the image, and uses the reconstructed image data samples as the input of the DNN model, which effectively avoids the excessive attention of the model caused by the violent oscillation of edge pixels, and makes the model's attention return to the recognition main part, thereby improving the robustness and universality of the model, and has good application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flowchart of the adversarial sample defense method based on image reconstruction in the embodiment;

[0019] Figure 2 This is a schematic diagram of the defense principle against samples in the embodiment;

[0020] Figure 3 A comparison diagram of the Lagrange interpolation method and the VP filter interpolation method in the embodiment;

[0021] Figure 4 Schematic diagram of the heat map comparison of clean samples, adversarial samples, and VPC reconstructed samples in the embodiment. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0023] In view of the problems that the existing input layer denoising defense requires a lot of training according to the specific DNN model, which leads to high cost and poor flexibility, the embodiment of the present invention provides an adversarial sample defense method based on image reconstruction, see Figure 1 As shown, it contains the following contents:

[0024] S101, for an input image, using a preset compression ratio and selecting Chebyshev nodes to construct a sampled compressed sample point space; for the compressed sample point space, compressing the image by filtering interpolation;

[0025] S102. For the compressed image data, a reconstructed sample space for sampling is constructed by using a preset reconstruction ratio and selecting Chebyshev nodes; for the reconstructed sample space, the image is reconstructed by interpolation filtering, and the reconstructed image data is output as adversarial sample data.

[0026] By using the VP Filtered Interpolation for Image Compression (VPC) scheme based on VP (de la Vallée Poussin) filter interpolation image compression, Chebyshev nodes are sampled to construct the sample point space S, and VP filter interpolation polynomials are used for image compression and reconstruction. The reconstructed image data samples are used as the input of the DNN model, which effectively avoids the excessive attention of the model caused by the violent oscillation of edge pixels, and makes the model's attention return to the recognition main part, thereby improving the robustness and universality of the model.

[0027] In the embodiment of the present case, further, by selecting Chebyshev nodes to construct the sample point space, first, the corresponding image data is represented as an RGB mode vector, and then discrete points are selected in the matrix to construct the sample point space. Further, in the interpolation filter, an orthogonal VP polynomial is set and a polynomial space is obtained based on the orthogonal VP polynomial, in which there is an interpolation basis composed of basic VP polynomials, and the image is compressed or reconstructed by performing function approximation on the Chebyshev sample nodes using the interpolation properties of the basic VP polynomials.

[0028] See also Figure 2 As shown, the matrix I represents a color image of n1×n2 pixels, where In RGB mode it is represented as:

[0029] I=[I1,I2,I3] (1)

[0030] The elements of these matrices are the pixel values ​​of each point, ranging from [0, max f ], an image represented by 8-bit pixels, max f =255.

[0031] Then in space coordinates, there exists a vector function:

[0032] f(x,y)=[f1(x,y),f2(x,y),f3(x,y)] (1)

[0033] satisfy:

[0034]

[0035] in, Represents the discrete points selected in the matrix I, the sample point space is X, and we have:

[0036]

[0037] The matrix R represents a color image of N1×N2 pixels reconstructed by I, where Similarly, R in RGB mode is expressed as: R = [R1, R2, R3], with:

[0038]

[0039] Any finite interval [a,b] can be mapped to [-1,1]. Assuming that each of the following spatial coordinates belongs to the interval [-1,1], then: the sample point space X is contained in [-1,1] 2 .

[0040] Traditional image compression methods usually use a sampling method with equidistant points, namely: and It is a set of nodes that divides the reference interval [-1,1] into μ+1 and ν+1 segments.

[0041] The method of selecting Chebyshev nodes as the sample point space can be used, namely: and are the zeros of the first kind Chebyshev polynomials of degree μ and ν respectively, so:

[0042]

[0043] in,

[0044]

[0045] In this embodiment, an approximate tool filter interpolation polynomial is used, and this interpolation is based on the generalization of the average value of the trigonometric function VP. Specifically, it can be described as follows:

[0046] For any So that:

[0047] n=(n1,n2),m=(m1,m2) (7)

[0048] For any r = 0:(n-1), define the orthogonal VP polynomial:

[0049]

[0050] where ξ∈[-1,1], t∈[0,π] and ξ=cost.

[0051] The polynomial in formula (8) consists of univariate polynomials of the highest order n+m-1 that are orthogonal to the scalar product:

[0052]

[0053] That is, an n-dimensional polynomial space is generated:

[0054]

[0055] space There exists an interpolation basis consisting of basic VP polynomials, which can be expanded according to the orthogonal basis formula (8) as follows:

[0056]

[0057] The Lagrange polynomial is defined as:

[0058]

[0059] The basic VP polynomial has the same interpolation property as the Lagrange polynomial, that is, for any h, k = 1:n, we have:

[0060]

[0061] Using the basic VP polynomial, it is possible to approximate any function g(x,y) on the Chebyshev sample node, namely:

[0062]

[0063] In the sample point space Inside, there are:

[0064]

[0065] The VP interpolation method does not limit the specifications of the original image I and the reconstructed image R, so it can achieve compression and restoration of the input samples. The VPC method is based on the VP filter interpolation polynomial and completes the compression and reconstruction of the image by setting different reconstruction ratios.

[0066] Assume that the input sample I is a color image of n1×n2 pixels, the compressed image R′ is a color image of N1′×N2′ pixels, and the reconstructed sample R is a N1×N2, where N1′<n1, N1>n1, N2′<n2, N2>n2. Assume that I=[I1,I2,I3] is distributed by a continuous function f=[f1,f2,f3], then R′ can be obtained by the following transformation:

[0067]

[0068] Therefore, the process is as follows:

[0069]

[0070] In practical applications, the image reconstruction ratio s can be introduced as a parameter, and the definition of s is as follows:

[0071]

[0072] Furthermore, based on the above method, an embodiment of the present invention also provides an adversarial sample defense system based on image reconstruction, comprising: an image compression module and an image reconstruction module, wherein:

[0073] The image compression module is used to construct a compressed sample point space for sampling by using a preset compression ratio and selecting Chebyshev nodes for the input image; and compress the image by filtering and interpolation for the compressed sample point space;

[0074] The image reconstruction module is used to construct a sampled reconstruction sample space for compressed image data using a preset reconstruction ratio and by selecting Chebyshev nodes; for the reconstructed sample space, the image is reconstructed through interpolation filtering, and the reconstructed image data is output as adversarial sample data.

[0075] In order to verify the effectiveness of this solution, the following is a further explanation based on the test data:

[0076] Traditional image compression usually uses equidistant points and Lagrange interpolation polynomials to perform image compression operations. In this embodiment, sampling Chebyshev nodes and VP filtering interpolation polynomials are selected to alleviate the Gibbs phenomenon. Figure 3 As shown in the figure, the sample point at the center of the image is taken as the center. The solid line represents the function image fitted by the Lagrange interpolation method, while the dotted line represents the function image fitted by the VP filter interpolation method. It can be found that: at the edge pixels, the Lagrange interpolation method produces violent oscillations, while the VP filter interpolation method does not. This means that choosing the Lagrange interpolation method will lead to drastic changes in the values ​​of edge pixels.

[0077] In exploring the characteristics of adversarial samples, adversarial samples will cause the DNN model to focus on edge pixels, such as Figure 4 As shown in (a) and (b) in the figure. The dark area in the target represents the model's attention area, and the darker the color, the more focused the attention. The model focuses on the center of the subject for clean samples, such as the wheel of a bicycle, the cabin of a sailboat, the body of a car, etc. After adding adversarial perturbations, the model's attention will shift to the edge pixels, that is, the attention to the center of the subject will decrease, or the attention to background objects and environmental objects will increase. Therefore, in order to defend against adversarial samples, in this embodiment, Chebyshev node sampling and VP filtering interpolation are selected as the image reconstruction scheme, which can effectively avoid the excessive attention of the model caused by the violent oscillation of edge pixels, such as Figure 4 As shown in (c) in the figure, after reconstructing the sample using the VPC method, the model's attention is returned to the recognition main part, improving the model application effect.

[0078] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0079] Based on the above method and / or system, an embodiment of the present invention also provides a server, including: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0080] Based on the above method and / or system, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, wherein the above method is implemented when the program is executed by a processor.

[0081] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0082] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0083] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for defending against adversarial samples based on image reconstruction, characterized in that: Contains the following: For the input image, a preset compression ratio is used and a Chebyshev node is selected to construct a compressed sample point space for sampling; for the compressed sample point space, the image is compressed by filtering interpolation, wherein the sample point space is constructed by selecting a Chebyshev node, firstly, the corresponding image data is represented as an RGB mode vector, and then discrete points are selected in the matrix to construct the sample point space; the RGB mode vector is represented as: The input image size is represented as n1×n2, and The spatial coordinate vector function f(x,y) = [f1(x,y), f2(x,y), f3(x,y)], where f1(x,y), f2(x,y), f3(x,y) correspond to R, G, and B coordinate vectors respectively; the sample point space is represented as: represents the discrete points selected in the input image I, and are the zeros of the first kind Chebyshev polynomials of degree μ and ν respectively, and In interpolation filtering, for any r = 0: (n-1), the orthogonal VP polynomial is expressed as: And according to the orthogonal VP polynomial, a polynomial space is obtained, in which there is an interpolation basis composed of basic VP polynomials, and the image is compressed or reconstructed by performing function approximation on the Chebyshev sample nodes using the interpolation properties of the basic VP polynomials, ξ∈[-1,1], t∈[0,π] and ξ=cost, m, n respectively represent adjustment parameters for alleviating the oscillation of similar points on the edge of the reconstructed sample; the polynomial space is expressed as: For the compressed image data, a preset reconstruction ratio is used and the Chebyshev nodes are selected to construct a sampled reconstruction sample space; for the reconstructed sample space, the image is reconstructed through interpolation filtering, and the reconstructed image data is output as adversarial sample data.

2. The adversarial sample defense method based on image reconstruction according to claim 1, characterized in that: The formula for setting the compression and reconstruction ratio is expressed as: Among them, the input image size is expressed as n1×n2, and the reconstructed image size is N1×N2.

3. An adversarial sample defense system based on image reconstruction, characterized in that: The method according to claim 1 is implemented, comprising: an image compression module and an image reconstruction module, wherein: The image compression module is used to construct a compressed sample point space for sampling by using a preset compression ratio and selecting Chebyshev nodes for the input image; and compress the image by filtering and interpolation for the compressed sample point space; The image reconstruction module is used to construct a sampled reconstruction sample space for compressed image data using a preset reconstruction ratio and by selecting Chebyshev nodes; for the reconstructed sample space, the image is reconstructed through interpolation filtering, and the reconstructed image data is output as adversarial sample data.

4. A computing device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method according to claim 1.

5. A computer-readable storage medium, wherein at least one executable instruction is stored in the storage medium, and when the executable instruction is executed by a processor, an operation corresponding to the method according to claim 1 is implemented.

Images