Method and electronic device for training a generator model for removing adversarial perturbations

Abstract

The present application provides a method and electronic device for training a generator model for removing adversarial perturbations. The method includes: training a neural network model using an original sample image set to obtain a neural network classification model; generating an adversarial sample image set based on the original sample image set using an adversarial sample generation algorithm; iteratively training the discriminator model and the generator model in the generative adversarial network based on the original sample image set, the adversarial sample image set, and the neural network classification model until the first loss of the discriminator model is no greater than a first preset threshold; and using the generator model obtained after the iterative training as the target generator model. The target generator model trained in this way can be used to remove adversarial perturbations to images to eliminate safety hazards.

Description

Technical Field

[0001] The present application relates to the training of a neural network model, and more particularly to a method and electronic device for training a generator model for removing adversarial disturbances. Background Art

[0002] With the widespread use of convolutional neural networks, security risks are gradually being discovered. Currently, adversarial examples can be used to add carefully crafted perturbations to the original image, imperceptible to the human eye, but still fooling the neural network into misclassifying the image. These perturbations are small and imperceptible to human observers. Furthermore, adversarial examples are transferable between similar network architectures and networks trained on disjoint data subsets. Adversarial example attacks are commonly used in fields such as image recognition, image classification, and video detection. The existence of adversarial examples poses significant security challenges to these applications. For example, in autonomous driving, the vision system of self-driving cars utilizes deep neural networks to recognize pedestrians, vehicles, and road signs. If an autonomous driving system is attacked by adversarial examples, adding carefully crafted adversarial example perturbations to the input can cause the neural network driving system to misclassify the image. If a left-turn sign is misclassified as a right-turn sign, or a stop sign is misclassified as a go-ahead sign, serious consequences for life and property could occur.

[0003] Current training methods for models that remove adversarial perturbations are limited by the dataset and the specific model, and are trained using only one loss function, resulting in low accuracy in removing perturbations. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a method and electronic device for training a generator model for removing adversarial perturbations.

[0005] Based on the above objectives, the present application provides a method for training a generator model for removing adversarial perturbations, comprising:

[0006] The neural network model is trained using the original sample image set to obtain a neural network classification model;

[0007] Based on the original sample image set, generating an adversarial sample image set using an adversarial sample generation algorithm;

[0008] Iteratively training the discriminator model and the generator model in the generative adversarial network according to the original sample image set, the adversarial sample image set, and the neural network classification model until a first loss of the discriminator model is no greater than a first preset threshold;

[0009] The generator model obtained after the iterative training is completed is used as the target generator model.

[0010] In a possible implementation, each round of training in the iterative training includes:

[0011] Inputting the adversarial sample image set into the generator model to obtain a generated sample image set output by the generator model;

[0012] Inputting the generated sample image set and the original sample image set into the discriminator model, and updating the discriminator model according to the first loss of the discriminator model;

[0013] The generated sample image set is input into the neural network classification model and the updated discriminator model, and the generator model is updated according to the second loss of the generator model.

[0014] In a possible implementation, the first loss is calculated using a cross entropy function.

[0015] In one possible implementation, the second loss is a joint loss consisting of an adversarial loss, a classification loss, and an image reconstruction loss. The adversarial loss and the classification loss are both calculated using a cross entropy function, and the image reconstruction loss is calculated using a structural similarity (SSIM) loss function.

[0016] In one possible implementation, updating the discriminator model according to the first loss of the discriminator model includes:

[0017] The discriminator model is updated by optimizing the first loss using an adaptive moment estimation optimizer.

[0018] In one possible implementation, updating the generator model according to the second loss of the generator model includes:

[0019] The generator model is updated by optimizing the second loss using an adaptive moment estimation optimizer.

[0020] In one possible implementation, the adversarial sample generation algorithm includes a projected gradient descent (PGD) algorithm, and the attack strength of the PGD algorithm is 40 iterations with a step size of 8 / 255.

[0021] In one possible implementation, the generator model adopts a U-NET structure, including a first convolutional layer and a first pooling layer for downsampling and a deconvolution layer for upsampling.

[0022] In one possible implementation, the discriminator model adopts a convolutional neural network structure, including a second convolutional layer, a second pooling layer and a fully connected layer.

[0023] Based on the same inventive concept, the present application also provides an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable by the processor, wherein the processor implements a method for training a generator model for removing adversarial perturbations as described in any one of the above when executing the computer program.

[0024] As can be seen from the above, the embodiments of the present application iteratively train the discriminator model and the generator model in the generative adversarial network according to the original sample image set, the adversarial sample image set and the neural network classification model until the first loss of the discriminator model is no greater than the first preset threshold, and finally obtain the target generator model. The embodiments of the present application effectively improve the accuracy of the trained target generator model in clearing adversarial perturbations in adversarial samples by jointly training the discriminator model and the generator model using multiple loss functions. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in this application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0026] Figure 1 A flowchart of a method for training a generator model for removing adversarial perturbations according to an embodiment of the present application;

[0027] Figure 2 This is a flowchart of each round of training in the iterative training of an embodiment of the present application;

[0028] Figure 3 A structural diagram of a device for training a generator model for removing adversarial disturbances according to an embodiment of the present application;

[0029] Figure 4 This is a structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the objectives, technical solutions and advantages of this application more clear, this application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0031] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should have the usual meanings understood by people with ordinary skills in the field to which this application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0032] As described in the background section, the related art uses a single loss function to train models for removing adversarial perturbations. The resulting models are not ideal for removing perturbations, exhibit low accuracy, and fail to effectively address security issues posed by adversarial examples. Furthermore, their applicability is limited by the dataset and specific model.

[0033] Taking the above considerations into consideration, this application proposes a method for training a generator model for removing adversarial perturbations. The method is not limited to the data set situation and the specific model. It can iteratively train the discriminator model and the generator model in the generative adversarial network based on different data set situations and multiple loss functions, effectively improving the accuracy of the model in removing adversarial perturbations in images and ensuring the security of deep learning related systems.

[0034] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0035] refer to Figure 1 , which is a flowchart of a method for training a generator model for removing adversarial perturbations according to an embodiment of the present application, comprising the following steps:

[0036] Step S101 : training a neural network model using the original sample image set to obtain a neural network classification model.

[0037] In this step, the original sample image set needs to be selected according to the usage scenario or test scenario of the neural network model to be optimized.

[0038] The original sample image set can be an existing public image set, such as CIFAR-10, MNIST, etc., or an uploaded custom image set. The original sample image set is represented as "images stored in pixel-level matrix data."

[0039] Neural network classification models can use either classic or custom network structures. The original sample image set is fed into the neural network model, and the model is pre-trained. In actual use, different neural network classification models are selected based on the user's device and model application scenario.

[0040] In this step, you can choose neural network models such as ResNet34 and Inception v3. The difference between ResNet34 and Inception v3 lies in the number of structural layers. If you need to quickly obtain an optimized model, you can use a neural network model with fewer layers, such as ResNet34. If you need a relatively secure model, you can use a neural network model with more layers, such as Inception v3.

[0041] Common neural network models can be implemented using open-source tools such as TensorFlow and PyTorch. Both TensorFlow and PyTorch serve as tools for implementing neural network models. If a classic neural network model does not meet your needs, you can upload a custom network structure model as a neural network classification model. The custom network structure model file can be a .py file written in Python. The original sample image set is input into the selected neural network classification model. When the classification model's classification accuracy for the original sample image set exceeds a predetermined threshold, a usable classification model for the original dataset is obtained.

[0042] Step S102: Based on the original sample image set, an adversarial sample generation algorithm is used to generate an adversarial sample image set.

[0043] In one possible implementation, the adversarial sample generation algorithm includes a projected gradient descent (PGD) algorithm, and the attack strength of the PGD algorithm is 40 iterations with a step size of 8 / 255.

[0044] Step S103, iteratively training the discriminator model and the generator model in the generative adversarial network according to the original sample image set, the adversarial sample image set and the neural network classification model until the first loss of the discriminator model is no greater than a first preset threshold.

[0045] Step S104: The generator model obtained after the iterative training is completed is used as the target generator model.

[0046] refer to Figure 2 In one possible implementation, each round of training in the iterative training includes:

[0047] Step S201 inputs the adversarial sample image set into the generator model to obtain a generated sample image set output by the generator model;

[0048] Step S202: inputting the generated sample image set and the original sample image set into the discriminator model, and updating the discriminator model according to the first loss of the discriminator model;

[0049] Step S203 inputs the generated sample image set into the neural network classification model and the updated discriminator model, and updates the generator model according to the second loss of the generator model.

[0050] In step S202, the generated sample image set output by the generator model is input into the discriminator together with the original sample image set. The discriminator performs a binary classification on the generated sample image set output by the generator model and the original sample image set. The discriminator determines whether the generated sample image set generated by the generator can deceive the discriminator, that is, whether the discriminator can believe that the generated sample image set generated by the generator is indistinguishable from the original sample image set.

[0051] The discriminator model discriminates the generated sample image set output by the generator model and the original sample image set, and the discrimination result can indicate the authenticity of the generated sample image set output by the generator model relative to the original sample image set.

[0052] In a possible implementation, inputting the generated sample image set and the original sample image set into the discriminator model, and updating the discriminator model according to the first loss of the discriminator model includes:

[0053] inputting the generated sample image set and the original sample image set into the discriminator model to obtain a first discriminant probability;

[0054] Obtaining a first loss according to the label of the generated sample image set and the first discriminant probability;

[0055] The discriminator model is updated using the first loss to obtain an updated discriminator model.

[0056] In a possible implementation, a first loss is obtained according to the label of the generated sample image set and the first discriminant probability;

[0057] In a possible implementation, the first loss is calculated using a cross entropy function.

[0058] In this step, the cross entropy function can measure the similarity between the distribution of the true label and the distribution of the predicted label. In addition, the benefit of using the cross entropy function is that the sigmoid function can avoid the problem of reduced learning rate of the mean square error loss function during gradient descent, because the learning rate can be controlled by the output error.

[0059] In one possible implementation, updating the discriminator model according to the first loss of the discriminator model includes:

[0060] The discriminator model is updated by optimizing the first loss using an adaptive moment estimation optimizer.

[0061] In step S203, the generated sample image set output by the generator model is input into the neural network classification model and the updated discriminator model. The generator model uses the discriminator model to evaluate its ability to generate clean samples. The purpose of the generator model is to generate clean pictures that are indistinguishable from the original sample image set as much as possible, so that the generated sample image set generated by the generator model can deceive the discriminator.

[0062] In one possible implementation, the second loss is a joint loss consisting of an adversarial loss, a classification loss, and an image reconstruction loss. The adversarial loss and the classification loss are both calculated using a cross entropy function, and the image reconstruction loss is calculated using a structural similarity (SSIM) loss function.

[0063] In one possible implementation, inputting the generated sample image set into the neural network classification model and the updated discriminator model, and updating the generator model according to the second loss of the generator model includes:

[0064] Inputting the generated sample image set into the updated discriminator model to obtain a second discriminant probability;

[0065] Obtaining an adversarial loss according to the second discriminant probability and the label of the generated sample image set;

[0066] Inputting the generated sample image set into a neural network classification model to obtain classification probability;

[0067] Obtaining a classification loss based on the labels of the generated sample image set and the classification probability;

[0068] The generator model is updated using the adversarial loss, the classification loss, and the image reconstruction loss.

[0069] In one possible implementation, updating the generator model according to the second loss of the generator model includes:

[0070] The generator model is updated by optimizing the second loss using an adaptive moment estimation optimizer.

[0071] In this embodiment, the Adaptive Moment Estimation Optimizer (Adam-Optimizer) is an optimization algorithm for finding the global optimal point, which introduces quadratic gradient correction. The Adaptive Moment Estimation (Adam) algorithm has certain advantages over other types of algorithms.

[0072] In one possible implementation, the adversarial loss, classification loss, and first loss are all calculated using the following cross entropy function:

[0073]

[0074] Among them, L represents adversarial loss, classification loss or first loss, y i represents the i-th sample label of the generated sample image set;

[0075] When using the above formula to calculate the adversarial loss, represents the second discriminant probability of the i-th sample in the generated sample image set;

[0076] When using the above formula to calculate the classification loss, represents the classification probability of the i-th sample in the generated sample image set;

[0077] When using the above formula to calculate the first loss, represents the first discriminant probability of the i-th sample in the generated sample image set.

[0078] In one possible implementation, the image reconstruction loss is calculated using the following formula:

[0079]

[0080]

[0081]

[0082] Wherein, l(X,Y) represents the brightness comparison between the images of the generated sample image set and the images of the original sample image set, c(X,Y) represents the contrast comparison between the images of the generated sample image set and the images of the original sample image set, s(X,Y) represents the structure comparison between the images of the generated sample image set and the images of the original sample image set, μ X Represents the image mean of the generated sample image set, μ Y represents the image mean of the original sample image set, σ X represents the variance of the image of the generated sample image set, σ Yrepresents the variance of the image of the original sample image set, σ XY represents the covariance between the images of the generated sample image set and the images of the original sample image set, and C1, C2, and C3 respectively represent constants that are not equal to zero.

[0083] In one possible implementation, the generator model adopts a U-NET structure, including a first convolutional layer and a first pooling layer for downsampling and a deconvolution layer for upsampling.

[0084] In one possible implementation, the discriminator model adopts a convolutional neural network structure, including a second convolutional layer, a second pooling layer and a fully connected layer.

[0085] It can be seen from the above embodiments that the method for training a generator model for removing adversarial disturbances in the embodiments of the present application is based on a generative adversarial network. First, the neural network model is trained using the original sample image set to obtain a neural network classification model. Secondly, based on the original sample image set, an adversarial sample image set is generated using an adversarial sample generation algorithm. Finally, based on the original sample image set, the adversarial sample image set and the neural network classification model, the discriminator model and the generator model in the generative adversarial network are iteratively trained until the first loss of the discriminator model is no greater than the first preset threshold, and finally a target generator model is obtained. The target generator model can be used to remove adversarial disturbances of adversarial samples. This method is not limited to the situation of the data set and the specific model. According to the situation of different data sets, iterative training of the generator model can eliminate adversarial disturbances for the data set, thereby ensuring the security of deep learning related systems.

[0086] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied in a distributed scenario and performed by multiple devices working together. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the method.

[0087] It should be noted that the above description is limited to some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0088] Based on the same inventive concept, one or more embodiments of the present application further provide a device for training a generator model for removing adversarial perturbations. Figure 3 , the device comprises:

[0089] The classification model training module 11 is used to train the neural network model using the original sample image set to obtain a neural network classification model;

[0090] An adversarial sample generation module 12 is configured to generate an adversarial sample image set based on the original sample image set using an adversarial sample generation algorithm;

[0091] The iterative training module 13 is used to: iteratively train the discriminator model and the generator model in the generative adversarial network according to the original sample image set, the adversarial sample image set and the neural network classification model until the first loss of the discriminator model is no greater than a first preset threshold; and use the generator model obtained after the iterative training as the target generator model.

[0092] For the convenience of description, the above devices are described as being functionally divided into various modules. Of course, when implementing one or more embodiments of the present application, the functions of each module may be implemented in the same or multiple software and / or hardware.

[0093] The apparatus of the above embodiment is used to implement the corresponding method in the above embodiment and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0094] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and run on the processor, wherein when the processor executes the program, it implements the method of training a generator model for removing adversarial disturbances as described in any of the above embodiments.

[0095] Figure 4 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown. The electronic device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other within the device via the bus 1050.

[0096] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0097] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present application are implemented through software or firmware, the relevant program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0098] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0099] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0100] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0101] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, those skilled in the art will understand that the above device may also include only the components necessary to implement the embodiments of the present application, and does not necessarily include all the components shown in the figure.

[0102] The electronic device of the above embodiment is used to implement the corresponding method of training the generator model for removing adversarial disturbances in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0103] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. Within the scope of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0104] In addition, for simplicity of description and discussion, and in order not to make the embodiment of the application difficult to understand, the known power supply / ground connection with integrated circuit (IC) chip and other components may or may not be shown in the accompanying drawings provided. In addition, the device can be shown in the form of a block diagram to avoid making the embodiment of the application difficult to understand, and this also takes into account the following fact, that is, the details of the embodiment of these block diagram devices are highly dependent on the platform to be implemented in the embodiment of the application (that is, these details should be fully within the scope of understanding of those skilled in the art). When specific details (for example, circuit) are set forth to describe exemplary embodiments of the application, it will be apparent to those skilled in the art that the embodiment of the application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0105] Although the present invention has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may utilize the embodiments discussed.

[0106] The embodiments of the present application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of this application.

Claims

1. A method for training a generator model for removing adversarial perturbations, comprising: The neural network model is trained using the original sample image set to obtain a neural network classification model; Based on the original sample image set, generating an adversarial sample image set using an adversarial sample generation algorithm; Iteratively training the discriminator model and the generator model in the generative adversarial network according to the original sample image set, the adversarial sample image set, and the neural network classification model until a first loss of the discriminator model is no greater than a first preset threshold; The generator model obtained after the iterative training is completed is used as the target generator model; Each round of training in the iterative training includes: Inputting the adversarial sample image set into the generator model to obtain a generated sample image set output by the generator model; Inputting the generated sample image set and the original sample image set into the discriminator model, and updating the discriminator model according to the first loss of the discriminator model; The generated sample image set is input into the neural network classification model and the updated discriminator model, and the generator model is updated according to the second loss of the generator model.

2. The method according to claim 1, wherein The first loss is calculated using the cross entropy function.

3. The method according to claim 2, wherein: The second loss is a joint loss consisting of adversarial loss, classification loss and image reconstruction loss. The adversarial loss and the classification loss are both calculated using a cross entropy function, and the image reconstruction loss is calculated using a structural similarity SSIM loss function.

4. The method according to any one of claims 1 to 3, wherein Updating the discriminator model according to the first loss of the discriminator model includes: The discriminator model is updated by optimizing the first loss using an adaptive moment estimation optimizer.

5. The method according to any one of claims 1 to 3, wherein Updating the generator model according to the second loss of the generator model includes: The generator model is updated by optimizing the second loss using an adaptive moment estimation optimizer.

6. The method according to any one of claims 1 to 3, wherein The adversarial sample generation algorithm includes a projected gradient descent (PGD) algorithm. The attack strength of the PGD algorithm is 40 iterations with a step size of 8 / 255.

7. The method according to any one of claims 1 to 3, wherein The generator model adopts a U-NET structure, including a first convolutional layer and a first pooling layer for downsampling and a deconvolution layer for upsampling.

8. The method according to any one of claims 1 to 3, wherein The discriminator model adopts a convolutional neural network structure, including a second convolutional layer, a second pooling layer and a fully connected layer.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein: The processor implements the method according to any one of claims 1 to 8 when executing the computer program.

Images