A method for defending against adversarial sample attacks for network digital image recognition
By using the CutMix algorithm to build a loss function in adversarial training, the robustness of deep neural network models to adversarial samples is improved, and the problem of low robustness of traditional adversarial training methods for complex photo recognition is solved. , achieves high recognition accuracy when fighting against sample attacks.
Patent Information
- Application Number
- CN202210540439.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-05-17
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2042-05-17
AI Technical Summary
Deep neural network models are susceptible to adversarial sample attacks when facing network digital image recognition. Traditional adversarial training methods have low robustness in recognition of complex photos, making it difficult to effectively defend against adversarial sample attacks.
Data enhancement is performed by combining the CutMix algorithm, and loss function terms are constructed through the sample importance metric function, the network model is optimized, and the data sets that are beneficial to adversarial training are generated, which improves the robustness of the model to adversarial samples.
Without increasing too much computing expenses, the model's robustness to the adversarial samples is significantly improved, the classification accuracy of natural samples is maintained, and it can effectively resist adversarial attack algorithms such as PGD and FGSM.
Smart Images
Figure CN115019121B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to artificial intelligence security technology, and in particular to a method for improving the robustness of a deep neural network model facing network digital image attacks. The present invention specifically discloses a method for defending against adversarial sample attacks for network digital image recognition, and belongs to the technical field of calculation, inference or counting. Background Art
[0002] With the rapid development of deep learning technology, deep learning technology has been widely used in various fields, and the security issues of deep learning technology have attracted more and more attention. Recent studies have shown that deep neural network models are vulnerable to adversarial samples. Digital adversarial samples modify pixel changes in photos that are not observable to the human eye to achieve the purpose of misleading deep neural network models. When performing network digital image recognition, due to the invisibility of perturbed pixels, it is easy to cause many security issues in the environment of unsupervised image recognition. Even under human supervision, the recognition results cannot be changed, which makes the recognition efficiency of deep learning-based algorithms in actual scenarios low.
[0003] The most effective method for digital adversarial samples is adversarial training. Adversarial training can improve the robustness of the model against adversarial samples, but the defense ability of the model after adversarial training against adversarial samples is still limited, and the recognition robustness for complex photos is still relatively low, while digital images in network environments are all relatively complex photos. To this end, the present invention aims to propose a method for improving adversarial training, which optimizes the loss function through data enhancement algorithm and sample importance measurement, in order to further enhance the robustness of the model on the basis of adversarial training, so as to ensure that the deep learning model still maintains a high reliability under the attack of digital adversarial samples. Summary of the invention
[0004] The purpose of the present invention is to address the deficiencies of the above-mentioned background technology and provide an adversarial sample attack defense method for network digital image recognition. On the basis of the traditional adversarial training method, the CutMix algorithm is combined to generate data that is beneficial to training, and the sample importance measurement function is used to construct the loss function term for network optimization, so as to solve the technical problem that the model after adversarial training has limited defense ability against adversarial samples, and achieve the purpose of the invention to improve the robustness of the model to adversarial samples without increasing too much additional computing expenses.
[0005] The present invention adopts the following technical solutions to achieve the above-mentioned invention object:
[0006] A method for defending against adversarial sample attacks in network digital image recognition includes the following five steps.
[0007] Step 1: Select the data samples that need to be tested, obtain a large number of images containing the data samples that need to be tested to build an original data set, and use the original data set as the original training data set for the model.
[0008] Step 2: Operate on the original training dataset and construct an adversarial sample dataset based on the original training dataset.
[0009] Step 3: Perform data augmentation on the adversarial sample dataset to make the data samples more beneficial to the training process.
[0010] Step 4: Use WideResNet or other large network models to train the enhanced adversarial sample dataset, where the training loss function is not the traditional loss function but a redesigned loss function.
[0011] Step 5: Read the network digital image, perform image preprocessing operations on the network digital image, send the network digital image to the trained network model, and determine the type information of the object contained in the network digital image.
[0012] As a further optimization scheme for the adversarial sample attack defense method under network digital image recognition, step 2 uses the PGD adversarial sample generation algorithm to batch process the original training data set in step 1, generate adversarial samples corresponding to each batch of training data, and generate an adversarial sample data set.
[0013] As a further optimization scheme for the adversarial sample attack defense method under network digital image recognition, it is necessary to perform data enhancement on the acquired adversarial sample data set in step 3, and provide a multi-data enhancement algorithm suitable for adversarial training, which specifically includes steps 3-1 to 3-4.
[0014] Step 3-1: Filter the second and third category samples from the adversarial sample dataset. The remaining data samples that are useless for training are recorded as the first category samples. The second category samples indicate that the adversarial sample is misclassified but the corresponding original training data is correctly classified. The third category samples indicate that the original training data corresponding to the adversarial sample is misclassified. The second and third category samples are defined as follows:
[0015] The second type of samples:
[0016]
[0017] The third type of sample:
[0018]
[0019] Among them, x is the sample data in the original training data set, x * is the adversarial sample data generated according to x, θ is the parameter of the network model, is the cth element of the network model’s predicted output under parameter θ, ∩ is the AND operation, y c is the true label of sample data x, y c The superscript c in y indicates that y is defined as a one-hot label.
[0020] Step 3-2: Combine the second and third category samples into a new training data set Using random shuffling method Generate sample sets after random shuffling
[0021] Step 3-3: Set the sample The image in the image is calculated according to the coordinates C = (r x ,r y ,r w ,r h ) for random shearing, requiring r w With r h That is, the width and height of the cut image cannot be less than 1 pixel, or the width of the cut image cannot be greater than the minimum length of the original image and the height of the cut image cannot be greater than the minimum width of the original image. x ,r y The coordinates of the upper left corner pixel of the cut image are used as the sample set. New dataset.
[0022] Step 3-4: Based on the training data set With sample set According to the corresponding relationship of the cut sample set C = (r x ,r y ,r w ,r h ), for the training data set Each image in the sample set is cut, which is different from the sample set Training Dataset Remove the cropped part of the image, keep the uncropped part of the image, and then set the sample set The retained cut-off part of the image is pasted to the training data set without the cut-off part of the image The enhanced adversarial sample dataset is formed in the enhanced adversarial sample dataset. It can be expressed as:
[0023]
[0024] sample and For and Take a sample from each of From the training data set A random sample from A for The corresponding true label, From the sample set A random sample from B for The corresponding true label, M is a binary mask that determines which part of the image should be retained and which part of the image should be removed, M∈{0,1} W×H , ⊙ is the pixel-by-pixel multiplication, W and H are the width and height of the cropped image. By traversing the training dataset All samples in construct a new training sample dataset.
[0025] As a further optimization scheme for the adversarial sample attack defense method under network digital image recognition, step 4 requires to reconstruct the loss function and provide a data importance perception algorithm after multi-data enhancement. The data importance perception algorithm includes steps 4-1 to 4-3.
[0026] Step 4-1: Based on the sample With sample The logit layer outputs of the calculation model are recorded as logit_A and logit_B respectively. Compute the logit layer output of the model, denoted as logit_adv.
[0027] Step 4-2: Define the KL divergence function:
[0028]
[0029] Among them, {(x i ,y i )} i＝1,...,K is the data set, x i is the i-th data sample, y i For x i The corresponding label, K is the total number of samples in the data set, p(x i ,θ) is the distribution probability of the i-th data sample under the network model parameter θ, p(y i ,θ) is the distribution probability of the label corresponding to the i-th data sample under the network model parameter θ, p k (x i ,θ) is p(x i ,θ)’s Softmax activation function, p k (y i ,θ) is p(y i ,θ).
[0030] Use logit_A and logit_adv, logit_B and logit_adv to construct the metric functions, which are: KL(p(logit_adv,θ)||p(logit_A,θ)) and KL(p(logit_adv,θ)||p(logit_B,θ)). For the convenience of representation, we can write them as and
[0031] Step 4-3: The comparison between logit_A and logit_adv can highlight the impact of adding logit_B on logit_adv. Similarly, the comparison between logit_B and logit_adv can highlight the impact of adding logit_A on logit_adv. According to this method, the importance perception function term is constructed:
[0032]
[0033] Among them, λ is the suppression coefficient with a value between 0 and 1, is the distribution probability of the Ath data sample under the network model parameter θ, is the distribution probability of the Bth data sample under the network model parameter θ.
[0034] The present invention designs importance-aware function items through the CutMix algorithm, and constructs a final loss function for optimizing the network model based on the importance-aware function items.
[0035] As a further optimization scheme for the adversarial sample attack defense method in network digital image recognition, the training process in step 5 can include two stages.
[0036] In the first stage, the total number of training rounds is set to 100, and the traditional loss function is used in the first 30 rounds:
[0037]
[0038] Where n is the total number of network digital images input in each round of training, According to the i-th original training data x i Generated adversarial sample data, The network model predicts under the parameter θ Output,y i For x i The real label.
[0039] In the second stage, starting from the 31st round of training, the model is trained using the redesigned loss function:
[0040]
[0041] in, is the network prediction under the network model parameter θ The true label is y A The loss function is is the network prediction under the network model parameter θ The true label is y B The loss function is β, which is the proportion of the control importance measurement function in the overall loss, 0<β<1.
[0042] As a further optimization scheme for the adversarial sample attack defense method in network digital image recognition, certain constraints are imposed on the size of the cut image in step 3:
[0043] Set the shear ratio is a fixed value, such as 0.25. Then set the coordinates of the upper left corner of the cut and the length and width C = (r x ,r y ,r w ,r h )for:
[0044] r x ~Unif(value1,value2),
[0045] r y ~Unif(value1,value2),
[0046] Among them, Unif(·) is a random distribution, value1 and value2 are the upper and lower limits of the interval, and r w With r h is a fixed value, so the clipping area should actually be a rectangular area with fixed length and width, but the location of the clipping area appears randomly in the image.
[0047] As a further optimization scheme for the adversarial sample attack defense method for network digital image recognition, step 5 performs true category discrimination on the network digital image according to steps 5-1 to 5-3.
[0048] Step 5-1: First, keep the ratio of the length and width of the input network digital image fixed and perform normalization on the input photo image.
[0049] Step 5-2: Send the processed photos to a computer or edge computing device, which stores a computing hardware system and a trained network recognition model.
[0050] Step 5-3: The trained network digital image recognition model processes the input photo to determine the true category information of the image after malicious interference.
[0051] The present invention adopts the above technical scheme and has the following beneficial effects: based on the framework of traditional adversarial training, the present invention proposes a new adversarial training method, generates adversarial samples by selecting data sets useful for training, and performs data enhancement on the adversarial samples in combination with the CutMix algorithm, constructs an importance perception function that characterizes the importance of training samples to model training in combination with the adversarial samples before and after enhancement, and then constructs the final loss function by the importance perception function. The model trained by the final loss function has stronger model robustness to iterative or non-iterative attack algorithms such as PGD and FGSM than the original adversarial training, and maintains the classification accuracy of the model for natural samples while enhancing the robustness of the model to adversarial samples, greatly improving the robustness of the model with extremely low training costs, and using the trained robust model to maintain high recognition accuracy when performing image recognition when network digital images are maliciously contaminated. BRIEF DESCRIPTION OF THE DRAWINGS
[0052] Figure 1 Schematic diagram of the model training of the present invention.
[0053] Figure 2 A schematic diagram of constructing an importance metric function for the present invention.
[0054] Figure 3 Schematic diagram of the multi-data enhancement algorithm combined with adversarial training of the present invention.
[0055] Figure 4 It is a flow chart of the present invention.
[0056] Figure 5 This is a diagram of the overall architecture of the model trained by the present invention for image recognition. DETAILED DESCRIPTION
[0057] The technical solution of the invention is described in detail below with reference to the accompanying drawings.
[0058] The present invention aims to incorporate the weight perception after sample data enhancement into the adversarial training process and design a new adversarial sample training process, in order to improve the robustness of the model under digital adversarial sample attacks with almost no increase in training costs, so as to significantly improve the classification ability of the network model for such adversarial samples under the attack of network digital samples generated by adversarial attack algorithms such as PGD and FGSM.
[0059] Training model such as Figure 1As shown in the figure, the PGD algorithm is used to generate an adversarial sample dataset A, which is randomly shuffled as dataset B. The CutMix data enhancement algorithm is used to mix the samples in dataset A with the samples in dataset B to generate a new dataset C, which is the training sample set. Then, a new loss function additional term is designed by sensing the importance or contribution of dataset C to model training.
[0060] like Figure 5 As shown in FIG. 1 , a model training method for adversarial sample attack defense method for network digital image recognition includes two parts:
[0061] The first part is the training part. The second part is the reasoning part, which is divided into the following steps:
[0062] Step 1), obtaining an input network digital image to be detected, fixing the ratio of the length and width of the input network digital image to remain unchanged, and performing a normalization operation.
[0063] Step 2), sending the processed photos to a computer or edge computing device, which stores a computing hardware system and a trained network recognition model.
[0064] Step 3), based on the trained network digital image recognition model, the network digital image is used as the input of the training model, and the category of the object contained in the image is identified through the discriminative ability of the model.
[0065] Step 4), the object category judged by the model in step 3 is the final output of the model, and is also the true category label information of the maliciously interfered image.
[0066] like Figure 4 As shown in FIG. 1 , the model training part of a method for defending against adversarial sample attacks in network digital image recognition can be divided into the following steps:
[0067] Step 1), select the data set to be trained, set all training hyperparameters, select the model to be trained, and set the optimizer and learning rate.
[0068] Step 2) Perform data augmentation on the training image dataset by randomly cropping the edges and then padding them, fixing the length and width to a certain pixel value.
[0069] Step 3), extract a batch of training data and use the PGD algorithm to generate a set of adversarial samples Select some useful samples as the training sample set. According to the adversarial sample type: ① adversarial samples that are not misclassified by the model ② adversarial samples that are misclassified after at least one iteration ③ adversarial samples that are misclassified at the beginning, select some samples in the adversarial sample set as training samples. Select the second and third category samples from the adversarial sample data set. The second category samples are defined as:
[0070]
[0071] The third type of sample is defined as:
[0072]
[0073] x is the sample data in the original training data set, x * is the adversarial sample data generated based on x, θ is the parameter of the network model, h(·) represents the predicted value of the model, is the cth element of the network model’s predicted output under parameter θ, ∩ represents the AND operation, y c is the true label of sample data x, y c The superscript c in y indicates that y is defined as a one-hot label.
[0074] Step 4) Combine the second and third category samples into a new training data set Using random shuffling method Generate sample sets after random shuffling The samples in the two sets are processed by the CutMix algorithm to generate a new training sample set and construct a redesigned loss function. The specific steps are as follows:
[0075] (1) Collect samples The samples in the array are randomly shuffled to generate new samples. from and Take a sample from each and
[0076] (2) Generate new adversarial samples using the CutMix algorithm:
[0077]
[0078] Among them, the sample and For and Take a sample from each of From the training data set A random sample from A for The corresponding true label, From the sample set A random sample from B for The corresponding true label, M∈{0,1} W×H is a binary mask that determines which part of the image should be retained and which part should be removed, ⊙ is the pixel-by-pixel multiplication, and W and H are the width and height of the cropped image. The loss function is redesigned based on the new adversarial sample:
[0079]
[0080] represents the cross entropy loss function, λ is the suppression coefficient ranging from 0 to 1, β is the proportion of the control importance metric function in the overall loss, 0<β<1.
[0081] Step 5) Use the weight-aware function to measure the contribution of the data-enhanced samples to the model, add the redesigned loss function to the weight function, and construct the final loss function term. The specific steps are as follows:
[0082] Step 5-1) Place the sample and With adversarial examples The KL divergence is used to measure the distribution difference. The KL divergence is defined as:
[0083]
[0084] Among them, p k (x i ,θ) is p(x i ,θ)’s softmax activation function, p k (y i ,θ) is p(y i ,θ) is the Softmax activation function.
[0085] Step 5-2) Construct the importance-aware function term by using KL divergence for distribution difference measurement:
[0086]
[0087] Step 6), use the newly constructed loss function to perform the model training process, and output the robustness detection model after a certain number of training times.
[0088] like Figure 2 As shown, the importance perception function calculation steps of the present invention are:
[0089] The gray rectangular area represents the sample The black rectangle represents the sample The black slash area represents the sample importance measurement area.
[0090] Step A: Based on the sample With sample The logit layer outputs of the calculation model are recorded as logit_A and logit_B respectively. Calculate the logit layer output of the model, denoted as logit_adv.
[0091] Step B, define the KL divergence function:
[0092]
[0093] Use logit_A and logit_adv to build a metric function with logit_B and logit_adv. They are: KL(p(logit_adv,θ)||p(logit_A,θ)) and KL(p(logit_adv,θ)||p(logit_B,θ)). For the convenience of representation, they are written uniformly as and
[0094] Step C: The comparison between logit_A and logit_adv can highlight the impact of adding logit_B on logit_adv. Similarly, the comparison between logit_B and logit_adv can highlight the impact of adding logit_A on logit_adv. Figure 2 In the KL divergence measurement of the gray rectangular area and the mixed photo, we can measure the impact of the addition of the black rectangular area on the overall sample, so we can determine the importance of the black rectangular area. Similarly, we can determine the importance of the gray rectangular area. According to this method, we construct the importance perception function term:
[0095]
[0096] like Figure 3 As shown, the steps of the multi-data enhancement algorithm combined with adversarial training of the present invention are:
[0097] Step I: Use the PGD adversarial sample generation algorithm to generate corresponding adversarial samples for each batch of training data, and use the generated adversarial samples as the training sample data set to be processed.
[0098] Step II: Filter out the second and third category samples in the sample set. The second and third category samples are defined as follows:
[0099] The second type of samples:
[0100]
[0101] The third type of sample:
[0102]
[0103] Step III: Combine the second and third category samples into a new training data set Using random shuffling method Generate sample sets after random shuffling
[0104] Step IV: Set the sample set The image in the image is calculated according to the coordinates C = (r x ,r y ,r w ,r h ) for random shearing, requiring r w With r h That is, the width and height of the cut image cannot be less than 1 pixel or greater than the minimum length or width of the original image. The cut image is used as New dataset.
[0105] Step V: Set the sample set Each image in corresponds to a sample set The coordinates of the upper left corner of each image cut in the image are the length and width C = (r x ,r y ,r w ,r h ) to cut, different from the sample set Sample Set Remove the cropped part of the image, keep the uncropped part of the image, and then set the sample set The clipped part is pasted to the sample set that removes the clipped part A new sample set is formed.
[0106] A single sample can be represented as:
[0107]
[0108] sample and For and A sample is drawn from each of them. Where M∈{0,1} W×H It is a binary mask that determines which part of the image should be retained and which part should be removed, and ⊙ is the pixel-by-pixel multiplication. For the constructed new samples. A new training sample data set is constructed by traversing all samples.
[0109] As shown in Table 1, the robustness improvement effect of the model trained by the present invention against the attack of adversarial samples generated maliciously by humans (the classification success rate of the model successfully classifying the contaminated samples into the original sample category).
[0110] The SVHN (German traffic sign) and CIFAR-10 datasets (10 types of object images, including airplanes, cars, cats, dogs, etc.) were analyzed and compared, and the comparison algorithms were compared with the standard adversarial training algorithm, TRADES, MART, and GAIRAT algorithms. FGSM and PGD-20 were used as white-box attack algorithms to attack the ResNet18 model, and the original natural sample evaluation model was used to weigh the trade-off between natural samples and adversarial samples. As can be seen from Table 1, the algorithm of this patent has the strongest robustness against adversarial samples while balancing the classification accuracy between natural samples and adversarial samples.
[0111]
[0112] Table 1
[0113] In summary, the present invention can prevent the model from having strong robustness against adversarial sample attacks on digital images caused by malicious interference or malicious data poisoning in the field of network digital image classification and recognition, such as online object recognition, image intelligent matching, image intelligent screening and review, etc.
Claims
1. A method for defending against adversarial sample attacks for network digital image recognition, characterized in that: Construct an adversarial sample dataset based on the original training dataset, filter sample data that have an impact on model training from the adversarial sample dataset based on the classification results of sample data in the original training dataset and the adversarial sample dataset, perform enhancement operations on the filtered sample data, construct importance perception function items based on the sample data before and after enhancement, establish a loss function containing importance perception function items, and use the trained model to recognize the input network digital image; The sample data that has an impact on model training includes two types of sample data, one of which is a second type of sample data selected from an adversarial sample data set, the second type of sample is misclassified adversarial sample data, and the original training data corresponding to the misclassified adversarial sample data is correctly classified. The expression for selecting the second type of sample is: The other type of sample data is the third type of samples screened from the adversarial sample data set. The original training data corresponding to the third type of samples is misclassified. The expression for screening the third type of samples is: x is the sample data in the original training data set, x * is the adversarial sample data generated according to x, θ is the parameter of the network model, is the cth element of the network model’s predicted output under parameter θ, ∩ is the AND operation, y c is the true label of sample data x, y c The superscript c in indicates that y is defined as a one-hot label; The specific method of performing the enhancement operation on the screened sample data is as follows: record the data set consisting of the second type of samples and the third type of samples as the training data set, randomly shuffle the training data set to generate a sample set; perform a shearing operation on the sample set and retain the image sheared from each sample data; based on the corresponding relationship between the training data set and the sample set, shear the training data set using the shearing sample set operation method, and retain the image left after the shearing operation on the training data set; According to the correspondence between the training data set and the sample set, the cut sample set is concatenated with the cut training data set to generate an enhanced adversarial sample data set. The importance perception function constructed based on the sample data before and after enhancement is: Among them, λ is the suppression coefficient with a value between 0 and 1, is the enhanced adversarial sample under the network model parameter θ The distribution probability of is the distribution probability of the Ath data sample under the network model parameter θ, is the distribution probability of the Bth data sample under the network model parameter θ; The loss function including the importance perception function term is: Among them, l final (θ) is the loss function under the network model parameter θ, n is the total number of network digital images input in each round of training, is the network prediction under the network model parameter θ The true label is y A The loss function is is the network prediction under the network model parameter θ The true label is y B The loss function is β, which is the proportion of the control importance measurement function in the overall loss, 0<β<1.
2. The method for defending against adversarial sample attacks against network digital image recognition according to claim 1, characterized in that: According to the coordinates in the image (r x ,r y ,r w ,r h ) performs shearing operation on the sample set, r x ,r y is the coordinate of the upper left corner pixel of the cut image, r w 、r h The width and height of the cropped image.
3. The method for defending against adversarial sample attacks against network digital image recognition according to claim 2, characterized in that: A single sample in the enhanced adversarial sample dataset for: in, is the Ath data sample in the training data set, y A for The corresponding true label, is the Bth data sample in the sample set, y B for The corresponding true label, M is a binary mask, M∈{0,1} W×H , W and H are the width and height of the cropped image.
4. The method for defending against adversarial sample attacks against network digital image recognition according to claim 1, characterized in that: Coordinate (r x ,r y ,r w ,r h ) satisfies the following constraints: x ~Unif(value1,value2),r y ~Unif(value1,value2), Unif(·) is a random distribution, and value1 and value2 are the lower and upper limits of the interval.