Method, device, system and electronic device for enhancing robustness of deep neural network

Abstract

The present invention discloses a method, device, system and electronic device for enhancing the robustness of a deep neural network, including: obtaining original training samples and performing preprocessing; using random signals to perform conventional transformations on the preprocessed original training samples to generate weakly augmented samples; determining an attack strategy for the deep neural network, and performing aggressive perturbations on the preprocessed original training samples to generate strongly augmented samples; inputting the weakly augmented samples and strongly augmented samples into the deep neural network to be fortified to obtain corresponding representations and prediction results; imposing consistency constraints on the weakly augmented samples and strongly augmented samples to construct an objective function for deep neural network robustness enhancement training with consistency constraints as regularization terms; and performing robustness enhancement training on the deep neural network to be fortified according to the objective function. The present invention can effectively enhance the robustness of the deep learning model, thereby reducing the losses caused by aggressive perturbations and conventional perturbations to the deep learning model.

Description

Background Art

[0002] With the rapid growth of data scale and computing power, deep learning has received extensive attention and implementation in academic research and commercial promotion. However, the latest research finds that deep neural networks are vulnerable to adversarial examples, that is, adding carefully designed imperceptible perturbations to normal samples can cause deep neural networks with extremely high classification accuracy to completely fail.

[0003] Adversarial examples pose a huge security threat to actual application scenarios. For example, in a face recognition-based authentication system, an attacker can illegally obtain authorization using adversarial examples; in an autonomous driving scenario, an attacker can use adversarial examples to mislead the system's recognition of traffic signals, and so on. Therefore, it is urgent to improve the robustness of deep neural networks against adversarial example attacks.

[0004] Currently, a variety of methods have been proposed to enhance the robustness of deep neural networks. These methods can be roughly divided into two categories:

[0005] (1) Defense-based methods: By changing the network structure of the model, the training process, and preprocessing the input data, etc., the deep neural network can still accurately classify adversarial examples when under adversarial attacks. Typical methods include: adversarial training, defensive noise reduction preprocessing, defensive distillation, etc. Although these methods have achieved certain results, there are still some deficiencies: ① Defense methods based on adversarial training. Since a large number of training samples are used in training, these methods result in an over-reliance on adversarial examples, causing the trained model to have good performance for specific types of adversarial examples, but lacking applicability to unseen types of adversarial examples and adversarial examples with different attack intensities during the training process; ② Methods based on preprocessing often inevitably reduce the classification accuracy of the model for benign samples due to relying on noise reduction operations; ③ Defensive distillation methods: It has been proven difficult to defend against stronger adversarial example attacks such as C&W.

[0006] (2) Detection-based methods: By learning the differences between adversarial examples and normal samples, correctly identify adversarial examples, and prevent interference by rejecting adversarial examples from entering the model. Since the detector is essentially a binary classifier that distinguishes between benign samples and adversarial examples, it is unable to further identify adversarial examples. On the one hand, it is prone to overfitting to adversarial examples and misjudging input data slightly perturbed by normal noise; on the other hand, detection-based defense methods can only detect specific types of adversarial examples used during the training process, with poor generalization and ineffectiveness against multiple interferences. Summary of the Invention

[0007] The purpose of the embodiments of the present application is to provide a method, device, system and electronic device for enhancing the robustness of a deep neural network. This method adopts consistency constraints and incorporates the ideas of image transformation randomization and adversarial training to solve the technical problem of poor generalization in related technologies. It can effectively defend against various adversarial samples and maintain a high classification accuracy for benign samples, thereby improving the robustness and accuracy of the deep neural network in applications.

[0008] According to the first aspect of the embodiments of the present application, a method for enhancing the robustness of a deep neural network is provided, including:

[0009] Obtain the original training samples and perform preprocessing;

[0010] Use a random signal to perform a conventional transformation on the preprocessed original training samples to generate weakly augmented samples;

[0011] Determine an attack strategy against the deep neural network, and perform an adversarial perturbation on the preprocessed original training samples to generate strongly augmented samples;

[0012] Input the weakly augmented samples and the strongly augmented samples into the deep neural network to be fortified, and obtain the corresponding representations and prediction results;

[0013] Perform consistency constraints on the weakly augmented samples and the strongly augmented samples, and construct an objective function for enhancing the robustness of the deep neural network training with consistency constraints as the regularization term;

[0014] According to the objective function, perform robustness enhancement training on the deep neural network to be fortified.

[0015] Further, the conventional transformation is selected from matrix flipping, cropping, padding, occlusion, and affine transformation.

[0016] Further, using a random signal to perform a conventional transformation on the preprocessed original training samples to generate weakly augmented samples includes:

[0017] Use a random signal to select, arrange, and combine the conventional transformations;

[0018] Apply the transformed T random_ccg Obtain the weakly augmented sample x wAug = T random_ccg (x0).

[0019] Further, determining an attack strategy against the deep neural network and performing an adversarial perturbation on the preprocessed original training samples to generate strongly augmented samples includes:

[0020] When the attack strategy adopted is non - targeted attack, perform an attack perturbation on the pre - processed original training samples according to the following formula:

[0021]

[0022] s.t. f(x0 + δ)≠y GT

[0023] where δ represents the vector representation of the attack perturbation, p is the norm value, represents the imperceptibility of the attack perturbation, x0 represents the vectorized representation of the original training samples after pre - processing, x0 + δ represents the strongly amplified sample synthesized by superimposing the attack perturbation δ on x0, and f(x0 + δ)≠y G T represents that the deep neural network f classifies the strongly amplified sample x0 + δ into a correct class y GT other than that, that is, any wrong class;

[0024] When the attack strategy adopted is targeted attack, perform an attack perturbation on the pre - processed samples according to the following formula:

[0025]

[0026] s.t. f(x0 + δ)=y target

[0027] where δ represents the vector representation of the attack perturbation, p is the norm value, represents the imperceptibility of the attack perturbation, x0 represents the vectorized representation of the original training samples after pre - processing, x0 + δ represents the strongly amplified sample synthesized by superimposing the attack perturbation δ on x0, and f(x0 + δ)=y target represents that the deep neural network f classifies the strongly amplified sample x0 + δ into the attacker - specified class y target .

[0028] Furthermore, input the weakly amplified samples and the strongly amplified samples into the deep neural network to be fortified, and obtain the corresponding representations and prediction results, including:

[0029] Select a preset layer j in the deep neural network model, input the weakly amplified samples into the deep neural network f to be fortified, and obtain its vectorized representation at the preset layer j and the prediction result f(x wAug );

[0030] Input the strongly amplified samples into the deep neural network f to be fortified, and obtain its vectorized representation at the preset layer j and the prediction result f(x sAug ).

[0031] Further, consistency constraints are imposed on the weakly amplified sample and the strongly amplified sample, including:

[0032] Consistency constraints are imposed on the representations of the weakly amplified sample and the strongly amplified sample based on a deep neural network, and its formal representation is:

[0033]

[0034] where D(a, b) represents the distance metric between a and b, and ||·||2 represents vector normalization; and,

[0035] Consistency constraints are imposed on the predictions made by the deep neural network for the weakly amplified sample and the strongly amplified sample, and its formal representation is:

[0036] l con_pred = MSE(f(x wAug )), f(x sAug ))),

[0037] where MSE(a, b) represents the MSE error between a and b.

[0038] Further, an objective function for enhancing the robustness of the deep neural network training with consistency constraints as the regularization term is constructed, including:

[0039] Construct a consistency regularization term:

[0040]

[0041] Construct an objective function for enhancing robustness training with consistency constraints as the regularization term:

[0042]

[0043] where θ represents the parameters of the deep neural network, l ori represents the objective function of the original learning task, and λ1 and λ2 are the weights of the representation consistency constraint term and the prediction consistency constraint term l con_pred respectively.

[0044] Further, according to the objective function, robustness enhancement training is performed on the deep neural network to be fortified, including:

[0045] In each training round, the original training samples are randomly shuffled and divided into m mini-batches, and m model parameter updates are performed based on the objective function;

[0046] Repeat n training rounds until the model training is completed.

[0047] According to a second aspect of an embodiment of the present invention, there is provided a device for enhancing the robustness of a deep neural network, including:

[0048] An acquisition and preprocessing unit, configured to acquire an original training sample and perform preprocessing;

[0049] A first generation unit, configured to perform a conventional transformation on the preprocessed original training sample by using a random signal to generate a weakly augmented sample;

[0050] A second generation unit, configured to determine an attack strategy for the deep neural network, perform an aggressive perturbation on the preprocessed original training sample, and generate a strongly augmented sample;

[0051] A feedforward unit, configured to input the weakly augmented sample and the strongly augmented sample into the deep neural network to be strengthened, and obtain corresponding representations and prediction results;

[0052] A construction unit, configured to perform a consistency constraint on the weakly augmented sample and the strongly augmented sample, and construct an objective function for enhancing the robustness training of the deep neural network with the consistency constraint as a regularization term;

[0053] A robust training unit, configured to perform robustness enhancement training on the deep neural network to be strengthened according to the objective function.

[0054] According to a third aspect of an embodiment of the present invention, there is provided a system for enhancing the robustness of a deep neural network, characterized by including:

[0055] An identification system and the device described in the first aspect, where the device is connected to the identification system and shares its network structure, and the data to be measured is input into the robustness enhancement device to output a prediction result.

[0056] According to a fourth aspect of an embodiment of the present invention, there is provided an electronic device, including:

[0057] One or more processors;

[0058] A memory, configured to store one or more programs;

[0059] When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in the first aspect.

[0060] The technical solutions provided by the embodiments of the present application may include the following beneficial effects:

[0061] As can be seen from the above embodiments, since the present application introduces image transformation and its randomization into adversarial training, it overcomes the problem of poor generalization existing in the prior art. In addition, the present application implements consistency constraints on weakly augmented samples and strongly augmented samples, and matches conventional randomly transformed samples and adversarial samples in the feature space and the output space respectively, so as to be able to defend against both conventional random interference and unconventional adversarial interference simultaneously, thereby ensuring the accuracy and reliability of the model in practical applications.

[0062] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings here are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application.

[0064] Figure 1 It is a flowchart of a method for enhancing the robustness of a deep neural network model provided in Embodiment 1 of the present invention.

[0065] Figure 2 It is a comparison diagram of the effects of the standard training model provided in Embodiment 1 of the present invention and the robustness-enhanced model obtained by the present invention.

[0066] Figure 3 It is a schematic structural diagram of a device for enhancing the robustness of a deep neural network model provided in Embodiment 2 of the present invention.

[0067] Figure 4 It is a schematic structural diagram of a system for enhancing the robustness of a deep neural network model provided in Embodiment 3 of the present invention.

[0068] Figure 5 It is a schematic structural diagram of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0069] In order to more clearly illustrate the technical solutions of the present invention, the technical solutions in the embodiments of the present invention will be further described below with reference to the drawings in the embodiments of the present invention. Obviously, the content described in the embodiments of this specification is only a list of the implementation forms of the inventive concept, and the protection scope of the present invention should not be regarded as limited to the specific forms stated in the embodiments. The protection scope of the present invention also extends to equivalent technical means that can be thought of by those skilled in the art according to the inventive concept.

[0070] Those skilled in the art can understand that various aspects of the present invention can be implemented as a system, a method, or a program product. Therefore, various aspects of the present invention can be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation, or an implementation combining hardware and software aspects.

[0071] Example 1:

[0072] Please refer to Figure 1 , Figure 1 which is a flowchart of a method for enhancing the robustness of a deep neural network model provided by the first embodiment of the present invention. The following will elaborate on the Figure 1 shown process in detail. The method includes:

[0073] Step S100: Obtain the original training samples and perform preprocessing.

[0074] Specifically, obtaining the original training samples and performing preprocessing includes: obtaining the original training samples and representing them as a data matrix; performing noise reduction processing on the data matrix; randomly flipping the data matrix; scaling the data matrix; padding or cropping the data matrix around the edges; and performing normalization processing on the data matrix.

[0075] Based on the first aspect, in a possible design, the original samples are image data. In this embodiment, the publicly available dataset CIFAR-10 is downloaded, including the image set of the CIFAR-10 dataset and the corresponding class labels. The class labels are one-hot encoded, and the dataset is divided into a training set and a test set in a ratio of 4:1. The training set is used for training, and the test set is used for parameter tuning and model evaluation.

[0076] Based on the first aspect, in a possible design, when the original samples are image data, the step of obtaining the original training samples and representing them as a data matrix can represent the original training samples as an RGB (Red Green Blue) three-primary-color data matrix, where the values of R, G, and B range from 0 to 255. For example, for a pixel point with the color NavyBlue, since its three-primary-color values are R = 0, G = 0, and B = 128 respectively, it can be represented as (0, 0, 128). Therefore, by decoding the image data through a decoder matching the image format (for example, the jpg format), the sample can be represented as a data matrix;

[0077] It is understandable that the noise reduction process for the data matrix is to use a filter to remove background noise in the data and enhance signals that are helpful for recognition, thereby destroying the perturbations of adversarial samples to a certain extent. Preferably, in this embodiment, the Gaussian curvature filtering method is adopted to effectively retain edge features and texture details while reducing the noise of image data;

[0078] As an implementation manner, for the random flipping of the data matrix, random horizontal flipping or vertical flipping can be adopted;

[0079] It is understandable that the resizing of the data matrix is to make the input data meet the requirements of the neural network for the input size. In this embodiment, since ResNet18 is used as the deep neural network model, the target size for resizing is 224*224.

[0080] Preferably, the resizing method adopted in this embodiment is as follows: First, the original image is enlarged to 1.2 times the target size by bicubic interpolation, and then an image of the target size is cropped at a random position, which not only introduces the randomness of enhancing the generalization ability of the model but also meets the requirements of the model for the input size. In other alternative embodiments, the nearest neighbor interpolation method, bilinear interpolation method, etc. can also be adopted.

[0081] The zero-padding or truncation of the data matrix includes: performing zero-padding on the data matrix smaller than the input size of the deep neural network, and conversely, performing random truncation to meet the requirements of the neural network for the input size. For example, when the deep neural network is ResNet18, the model input size requirement is 224*224.

[0082] As an implementation manner, the data matrix in this embodiment is normalized as follows:

[0083]

[0084] where x is the pixel value of the image data, μ is the pixel mean, σ is the pixel standard deviation, and x′ is the normalized pixel value.

[0085] Step S200: Using a random signal to perform a conventional transformation on the preprocessed sample to generate a weakly augmented sample.

[0086] Drawing on the idea of randomization to perform a conventional transformation on the preprocessed sample enables the present invention to handle various modes of interference, making it computationally difficult for an attacker to exhaust all modes to attack the model trained by the method of the present invention, thereby achieving the improvement of the robustness of the deep neural network.

[0087] Specifically, step S300 includes: selecting, arranging, and combining the conventional transformations using random signals; applying the transformed T random_ccg obtained after selection, arrangement, and combination to the preprocessed samples to obtain weakly augmented samples x wAug = T random_ccg (x0).

[0088] As an implementation, random signals 0 < p i (i = 1, 2…, n) < 1 are used to select the conventional transformations. When p i (i = 1, 2,..., n) > 0.5, the transformation is applied to the samples; otherwise, it is not. And the implementation order of each transformation operation is determined by rearranging and combining the elements of the vector [1, 2,..., n]. Further, the conventional transformations include: matrix flipping, truncation, padding, occlusion, and affine transformation.

[0089] Preferably, the CutMix technique is used to implement matrix element occlusion; Colour Jitter is used to implement matrix element jitter; grayscale conversion is used to implement the affine transformation of the RGB data matrix. In other feasible implementation manners, the Cutout technique can also be used to implement matrix element occlusion; Colour distortion can be used to implement matrix element jitter.

[0090] Step S300: Determine the attack strategy for the deep neural network, apply an attack perturbation to the preprocessed samples, and generate strongly augmented samples. Specifically, step S300 includes:

[0091] When the attack strategy adopted is a non - targeted attack, the attack perturbation is applied to the preprocessed samples according to the following formula:

[0092]

[0093] s.t. f(x0 + δ) ≠ y GT

[0094] where δ represents the vector representation of the attack perturbation, p is the norm value, represents the imperceptibility of the attack perturbation, x0 represents the vectorized representation of the original training samples after preprocessing, x0 + δ represents the strongly augmented sample synthesized by superimposing the attack perturbation δ on x0, and f(x0 + δ) ≠ y GT means that the deep neural network f classifies the strongly augmented sample x0 + δ into a category other than the correct category y GT , that is, any wrong category;

[0095] When the attack strategy adopted is a targeted attack, the attack perturbation is applied to the preprocessed samples according to the following formula:

[0096]

[0097] such that f(x0 + δ) = y target

[0098] where δ represents the vector representation of the adversarial perturbation, p is the value of the norm represents the imperceptibility of the adversarial perturbation, x0 represents the vectorized representation after preprocessing the original training sample, x0 + δ represents the strongly augmented sample synthesized by superimposing the adversarial perturbation δ on x0, and f(x0 + δ) = y target represents that the deep neural network f classifies the strongly augmented sample x0 + δ into the category y specified by the attacker target .

[0099] Since the defense against non - targeted attacks is more difficult than that against targeted attacks, this embodiment adopts non - targeted attacks. If the model can achieve ideal performance under non - targeted attacks, then it will also be able to defend well against targeted attack samples.

[0100] In the actual implementation process, for the above - mentioned optimization problem, various different methods can be used to solve it. For example: the Fast Gradient Sign Method (FGSM), the method based on Projected Gradient Descend (PGD), and the Contrast Reduction Attack (CRD), etc.

[0101] Preferably, this embodiment adopts the PGD method to generate adversarial perturbations to obtain adversarial samples with smaller perturbations and stronger aggressiveness. The generation method of adversarial samples based on PGD can be formally expressed as:[[]]

[0102]

[0103] where x′ represents the adversarial sample, the subscripts t + 1 and t represent the (t + 1) - th and t - th iterations respectively, α represents the step size, in this embodiment, α = 2 / 255, sign is the sign function, x represents the original sample, 5 represents the effective adversarial perturbation amplitude represents the projection operator that projects the pixel value to the effective value range, J is the cross - entropy loss function represents the negative gradient of the cross - entropy loss function J of the deep neural network classification model with respect to each pixel point of x′ t y represents the true category of the sample, θ represents the parameters of the deep neural network classification model. In this embodiment the maximum amplitude of is 8 / 255 to limit the adversarial perturbation from being easily perceptible to the naked eye.

[0104] Further preferably, the initial value x′0 of the adversarial sample is as follows:

[0105]

[0106] where ε represents the initial maximum perturbation amplitude of the pixel value, which is also set to 8 / 255. Similarly, random(-1, 1) represents a random vector with the same size as the original sample x and a value range within (-1, 1).

[0107] A model that is robust to adversarial samples generated based on PGD will also have a relatively robust performance for other types of adversarial samples.

[0108] Step S400: Input the weakly augmented samples and strongly augmented samples into the deep neural network to be fortified, and obtain the corresponding representations and prediction results. Specifically, step S400 includes: inputting the weakly augmented samples and strongly augmented samples into the deep neural network; selecting a preset layer j in the deep neural network model, inputting the weakly augmented samples into the deep neural network f to be fortified, and obtaining its vectorized representation and prediction result f(x wAug ); inputting the strongly augmented samples into the deep neural network f to be fortified, and obtaining its vectorized representation and prediction result f(x sAug ).

[0109] The computational complexity of strongly augmented samples is very high. Therefore, a too high proportion of strongly augmented samples will lead to slow convergence of the training process; however, if the proportion of strongly augmented samples is significantly reduced, it will cause the model to not fully learn robust features. Preferably, in this embodiment, the weakly augmented samples and strongly augmented samples are input into the deep neural network in a ratio of 1:1.

[0110] Preferably, in this embodiment, the last convolutional layer of the neural network to be fortified is used as the preset layer, and the input data is represented by the activation feature map of this layer to extract richer and higher-level semantic features of the dataset. Input the weakly augmented samples into the deep neural network f, and obtain its vectorized representation and prediction result f(x wAug ); input the strongly augmented samples into the deep neural network f, and obtain its vectorized representation and prediction result f(x sAug ).

[0111] Step S500: Implement consistency constraints on weakly amplified samples and strongly amplified samples, and construct an objective function for enhancing the robustness training of a deep neural network with the consistency constraint as a regularization term.

[0112] Specifically, implementing consistency constraints on weakly amplified samples and strongly amplified samples includes:

[0113] Implement consistency constraints on the representations of weakly amplified samples and strongly amplified samples based on a deep neural network, and its formal representation is:

[0114]

[0115] where D(a, b) represents the distance metric between a and b, and ||·||2 represents vector normalization; and,

[0116] Implement consistency constraints on the predictions made by the deep neural network for weakly amplified samples and strongly amplified samples, and its formal representation is:

[0117] l con_pred = MSE(f(x wAug ), f(x sAug ))

[0118] where MSE(a, b) represents the mean squared error between a and b.

[0119] Preferably, in this embodiment, the JS divergence is used as the distance metric function D. Thus, the implementation of the consistency constraint on the representation can be further expressed as:

[0120]

[0121] In other feasible embodiments, the metric function D can also be the KL divergence, the MSE distance, etc.

[0122] Specifically, constructing an objective function for enhancing the robustness training of a deep neural network with the consistency constraint as a regularization term includes:

[0123] Construct a consistency loss function:

[0124]

[0125] Furthermore, construct an objective function for enhancing robustness training with the consistency constraint as a regularization term:

[0126]

[0127] where l ori represents the objective function of the original learning task, and λ1 and λ2 are the representation consistency constraint term and the prediction consistency constraint term l con_predweight.

[0128] Based on the observations and comparisons in a large number of experiments in this embodiment, preferably, λ1 = 0.01 and λ2 = 0.1. In practical applications, λ1 and λ2 can be adjusted according to specific circumstances. For example, on the test set, the model is evaluated by the accuracy rate on benign samples and the classification accuracy rate under adversarial attacks. Among them, the types of adversarial attacks used to test the model include FGSM attack, PGD attack, and C&W attack. Testing the model through various types of adversarial attacks can better evaluate the generalization of the model. Improving the applicability of the model to different types of adversarial samples, that is, the generalization of the model, is the main technical problem to be solved in this application.

[0129] If in practical applications, the performance of the model obtained by training with λ1 = 0.01 and λ2 = 0.1 is not ideal enough, λ1 and λ2 can be modified respectively and then trained again until ideal classification performance and defense effects are obtained.

[0130] Step S600: Perform robustness enhancement training on the deep neural network to be fortified according to the objective function.

[0131] Specifically, performing robustness enhancement training includes:

[0132] In each training round, the original training samples are randomly shuffled and divided into m small batches, and the model parameters are updated m times based on the above robustness enhancement objective function;

[0133] Repeat n training rounds until the model training is completed.

[0134] Preferably, in this embodiment, the stochastic gradient descent method is used for iterative training, the momentum term coefficient is 0.9, the weight decay coefficient is 2×10, and the learning rate is 0.01. In this example, batch iteration is adopted. In each training round, the original training samples are randomly shuffled and divided into m small batches, and the model parameters are updated m times based on the above robustness enhancement objective function; repeat n training rounds until the model training is completed.

[0135] Preferably, the training settings are as follows: m = 100, n = 1000.

[0136] The model trained by the method of the present invention can not only maintain the accuracy rate on benign samples, but also effectively resist conventional random interference and unconventional aggressive interference at the same time. The effect schematic diagram is as Figure 2 shown.

[0137] It should be understood that the present invention is not limited by the specifically adopted image denoising method, image normalization method, the order of using conventional transformations, the adversarial sample generation method, and the representation form. Whether it is the existing image denoising method, image normalization method, the order of using conventional transformations, the adversarial sample generation method, and the representation form, or the image denoising method, image normalization method, the order of using conventional transformations, the adversarial sample generation method, and the representation form developed in the future, they can all be applied to the robustness enhancement method according to the embodiments of the present invention and should also be included within the protection scope of the present invention.

[0138] Embodiment 2:

[0139] Please refer to Figure 3 , Figure 3 which is a schematic structural diagram of a deep neural network model robustness enhancement device 400 provided by the second embodiment of the present invention.

[0140] It should be noted that similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present invention, the terms "first" and "second" are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0141] Next, the Figure 3 shown structural block diagram will be elaborated. The shown device includes:

[0142] An acquisition and preprocessing unit 410, configured to: acquire an original training sample and perform preprocessing;

[0143] A first generation unit 420, configured to perform a conventional transformation on the preprocessed sample using a random signal to generate a weakly augmented sample;

[0144] A second generation unit 430, configured to determine an attack strategy for the deep neural network, perform an adversarial perturbation on the preprocessed sample, and generate a strongly augmented sample;

[0145] A feedforward unit 440, configured to input the weakly augmented sample and the strongly augmented sample into the deep neural network to be fortified, and obtain corresponding representations and prediction results;

[0146] A construction unit 450, configured to perform a consistency constraint on the weakly augmented sample and the strongly augmented sample, and construct an objective function for deep neural network robustness enhancement training with the consistency constraint as a regularization term;

[0147] A robust training unit 460, configured to perform robustness enhancement training on the deep neural network to be fortified according to the objective function.

[0148] For the process of each functional unit of the robustness enhancement device 400 to implement its respective functions in this embodiment, please refer to the content described in the above Figure 3 illustrated embodiment, which will not be elaborated here.

[0149] Embodiment 3:

[0150] Please refer to Figure 4 , Figure 4 which is a structural diagram of a deep neural network model robustness enhancement system provided by the third embodiment of the present invention. The system includes: an identification system 300 and the robustness enhancement device 400 described in the second embodiment. The device is connected to the identification system and shares the network structure of the identification system. The data to be measured is input into the robustness enhancement device, and a prediction result is output.

[0151] In a possible design, the identification system is an image recognition system. Specifically, this embodiment is based on an image recognition system with ResNet18 as the network structure, which can recognize the following 10 categories of color images: airplane (airplane), automobile (car), bird (bird), cat (cat), deer (deer), dog (dog), frog (frog), horse (horse), ship (ship), truck (truck).

[0152] By connecting the robustness enhancement device 400 described in the second embodiment and the image recognition system described in this embodiment, the robustness of the recognition system can be enhanced.

[0153] In other possible designs, the identification system can also be a face recognition system, an audio recognition system, a target tracking system, an autonomous driving system, etc.

[0154] Embodiment 4:

[0155] Correspondingly, the present application also provides an electronic device, including: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the deep neural network robustness enhancement method as described above. As Figure 5 shown, it is a hardware structural diagram of a device with any data processing ability where a deep neural network robustness enhancement device provided by an embodiment of the present invention is located. In addition to Figure 5 the shown processor and memory, any device with data processing ability where the device in the embodiment is located usually includes other hardware according to the actual function of the device with any data processing ability, which will not be elaborated here.

[0156] Correspondingly, the present application further provides a computer-readable storage medium, on which computer instructions are stored, and characterized in that when the instructions are executed by a processor, the above-described method for enhancing the robustness of a deep neural network is implemented. The computer-readable storage medium may be an internal storage unit of any device with data processing capabilities described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium may also be an external storage device of a wind turbine, such as a plug-in hard disk, a Smart Media Card (SMC), an SD card, a Flash Card, etc. equipped on the device. Further, the computer-readable storage medium may also include both an internal storage unit of any device with data processing capabilities and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and may also be used to temporarily store data that has been output or will be output.

[0157] In the embodiments provided by the present application, it should be understood that the disclosed device and method may also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of devices, methods, and computer program products according to multiple embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order from that marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combination of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware device for performing the specified function or action, or may be implemented by a combination of dedicated hardware and computer instructions.

[0158] In addition, in each embodiment of the present invention, the various functional modules may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0159] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for enhancing the robustness of a deep neural network, characterized in that, Including: Obtain the original training samples and perform preprocessing, specifically: the original training samples are image data, and represent the original training samples as an RGB three-primary color data matrix; Perform noise reduction processing on the data matrix; Perform random flipping on the data matrix; Perform scaling on the data matrix; Perform padding or cropping on the four sides of the data matrix; perform normalization processing on the data matrix; Use random signals to perform conventional transformations on the preprocessed original training samples to generate weakly augmented samples; Determine the attack strategy against the deep neural network, and perform aggressive perturbations on the preprocessed original training samples to generate strongly augmented samples; Input the weakly augmented samples and the strongly augmented samples into the deep neural network to be fortified, and obtain the corresponding representations and prediction results; Perform consistency constraints on the weakly augmented samples and the strongly augmented samples, and construct an objective function for enhancing the robustness training of the deep neural network with the consistency constraint as the regularization term; According to the objective function, perform robustness enhancement training on the deep neural network to be fortified; Wherein, the conventional transformations are selected from matrix flipping, cropping, padding, occlusion, and affine transformation; Wherein, inputting the weakly augmented samples and the strongly augmented samples into the deep neural network to be fortified, obtaining the corresponding representations and prediction results, and performing consistency constraints on the weakly augmented samples and the strongly augmented samples includes: Select a preset layer j in the deep neural network model, and input the weakly augmented samples into the deep neural network to be fortified , and obtain its vectorized representation at the preset layer j and the prediction result ; Input the strongly amplified sample into the deep neural network to be fortified to obtain its vectorized representation at the preset layer j and the prediction result where represents the vector representation of the adversarial perturbation; Perform consistency constraints on the representations of the weakly augmented samples and the strongly augmented samples based on the deep neural network, and its formal representation is: ， Wherein, D(a, b) represents the distance metric between a and b, and ||·||2 represents vector normalization; and, Perform consistency constraints on the predictions made by the deep neural network on the weakly augmented samples and the strongly augmented samples, and its formal representation is: ， Wherein, MSE(a, b) represents the MSE error between a and b; Construct a consistency regularization term: 。 2. The method according to claim 1, characterized in that, Using random signals to perform conventional transformations on the preprocessed original training samples to generate weakly augmented samples includes: Use random signals to select, arrange, and combine the conventional transformations; Apply the transformed ones after selection, arrangement, and combination to the preprocessed original training samples to obtain weakly augmented samples .

3. The method according to claim 1, characterized in that Determine the attack strategy against the deep neural network, and perform aggressive perturbations on the preprocessed original training samples to generate strongly augmented samples, including: When the attack strategy adopted is a non-targeted attack, perform aggressive perturbations on the preprocessed original training samples according to the following formula: ， Among them, represents the vector representation of the adversarial perturbation, , represents the imperceptibility of the adversarial perturbation, represents the vectorized representation after preprocessing the original training samples, represents that on superimposing the adversarial perturbation the synthesized strongly augmented sample, represents the deep neural network classifies the strongly augmented sample into a class other than the correct class, that is, any wrong class; ​ When the attack strategy adopted is a targeted attack, perform aggressive perturbations on the preprocessed samples according to the following formula: ， Among them, represents the vector representation of the adversarial perturbation, , represents the imperceptibility of the adversarial perturbation, represents the vectorized representation after preprocessing the original training samples, represents the operation of superimposing the adversarial perturbation to synthesize the strongly augmented sample, represents the deep neural network classifying the strongly augmented sample into the attacker-specified category .

4. The method according to claim 1, characterized in that, Construct an objective function for robustness enhancement training with the consistency constraint as the regularization term: ， Among them, represents the parameters of the deep neural network, represents the objective function of the original learning task, and are the representation consistency constraint term and the prediction consistency constraint term weights respectively.

5. The method according to claim 1, characterized in that, According to the objective function, perform robustness enhancement training on the deep neural network to be fortified, including: In each training round, randomly shuffle the original training samples and divide them into m mini-batches, and perform m model parameter updates based on the objective function; Repeat n training rounds until the model training is completed.

6. A device for enhancing the robustness of a deep neural network, characterized in that, Including: An acquisition and preprocessing unit, configured to obtain the original training samples and perform preprocessing, specifically: the original training samples are image data, represent the original training samples as an RGB three-primary color data matrix; perform noise reduction processing on the data matrix; perform random flipping on the data matrix; Scale the data matrix; Pad or crop the data matrix around its perimeter; normalize the data matrix; A first generation unit, configured to perform a conventional transformation on the preprocessed original training samples using a random signal to generate weakly augmented samples; A second generation unit, configured to determine an attack strategy to be taken against the deep neural network, perform an attack perturbation on the preprocessed original training samples to generate strongly augmented samples; A feedforward unit, configured to input the weakly augmented samples and the strongly augmented samples into the deep neural network to be fortified, and obtain corresponding representations and prediction results; A construction unit, configured to impose a consistency constraint on the weakly augmented samples and the strongly augmented samples, and construct an objective function for enhancing the robustness training of the deep neural network with the consistency constraint as a regularization term; A robust training unit, configured to perform robustness enhancement training on the deep neural network to be fortified according to the objective function; wherein the conventional transformation is selected from matrix flipping, cropping, padding, occlusion, and affine transformation; wherein inputting the weakly augmented samples and the strongly augmented samples into the deep neural network to be fortified, and obtaining corresponding representations and prediction results, and imposing a consistency constraint on the weakly augmented samples and the strongly augmented samples includes: Select a preset layer j in the deep neural network model, and input the weakly augmented samples into the deep neural network to be fortified , and obtain its vectorized representation at the preset layer j and the prediction result ; Input the strongly amplified sample into the deep neural network to be fortified to obtain its vectorized representation at the preset layer j and the prediction result , where represents the vector representation of the attack perturbation; Imposing a consistency constraint on the representations of the weakly augmented samples and the strongly augmented samples based on the deep neural network, and its formal representation is: ， where D(a, b) represents the distance metric between a and b, and ||·||2 represents vector normalization; and, Imposing a consistency constraint on the predictions made by the deep neural network on the weakly augmented samples and the strongly augmented samples, and its formal representation is: ， where MSE(a, b) represents the MSE error between a and b; Construct a consistency regularization term: 。 7. A deep neural network robustness enhancement system, characterized in that, including: An identification system and the device according to claim 6, the device being connected to the identification system and sharing its network structure, and the data to be measured is input into the robustness enhancement device, and a prediction result is output.

8. An electronic device, characterized in that, including: One or more processors; A memory, configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1-5.

Images