An image classification method, device and computer equipment for defending against adversarial attacks

Abstract

This application relates to various image classification methods, apparatuses, and computer devices for defending against adversarial attacks. First, a pre-constructed image classification model and the weights of the last layer feature extractor of the image classification model are obtained. Random noise, which follows a multivariate Gaussian distribution, is introduced into the weights. Then, the original image is input into the image classification model to obtain the original image features extracted by the last layer feature extractor. Next, a weight-based loss function is constructed based on the variance of the original image features and the random noise distribution. The loss function of the image classification model is then constructed based on the weight-based loss function. Finally, the loss function of the image classification model is optimized to obtain a trained image classification model for defending against adversarial attacks. This model is then used for image classification. This invention can significantly reduce training time and computational burden while ensuring the accuracy and robustness of the classification of the original image.

Description

Technical Field

[0001] This application relates to the field of computer vision technology, and in particular to an image classification method, apparatus and computer equipment for defending against adversarial attacks. Background Technology

[0002] Deep neural networks have been widely used in various fields and have achieved outstanding performance due to their powerful representation capabilities. However, deep neural networks are susceptible to subtle deliberate perturbations (also known as adversarial attacks), which poses a significant challenge to their application in security-critical scenarios. In recent years, many defensive methods have been proposed to improve the attack resistance of deep neural networks, namely adversarial robustness, thereby ensuring the stability of image classification results.

[0003] Most existing stochastic defense methods rely on adversarial training. Adversarial training first generates adversarial image samples through adversarial attacks, and then retrains the model using these samples. This approach sacrifices the accuracy of clean images to improve the model's adversarial robustness. Therefore, adversarial training is an inefficient process and hinders its real-world application, especially in scenarios requiring rapid decision-making. In conclusion, to improve the model's ability to defend against adversarial attacks and ensure the stability of image classification results, there is an urgent need for an image classification method that does not require adversarial training. Summary of the Invention

[0004] Based on this, an image classification method, apparatus, and computer device that do not require adversarial training to defend against adversarial attacks are provided to improve the efficiency and robustness of image classification.

[0005] An image classification method for defending against adversarial attacks, the method comprising:

[0006] Obtain the weights of a pre-built image classification model and the last layer feature extractor of the image classification model, and introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution.

[0007] The original image is input into the image classification model to obtain the original image features extracted by the last layer feature extractor;

[0008] A weighted loss function is constructed based on the original image features and the distribution variance of the random noise, and the loss function of the image classification model is constructed based on the weighted loss function.

[0009] The loss function of the image classification model is optimized to obtain a trained image classification model for defense against adversarial attacks, and the image classification model for defense against adversarial attacks is used for image classification.

[0010] In one embodiment, introducing random noise into the weights includes:

[0011] Sampling is performed in a multivariate Gaussian distribution to obtain a zero-mean, unit-variance vector; the mean of the multivariate Gaussian distribution... C represents the number of output categories of the image classification model, and D represents the dimension of the original image features extracted by the last layer feature extractor.

[0012] The covariance matrix of the anisotropic Gaussian distribution of random noise is obtained by multiplying the zero-mean unit variance vector and the lower triangular matrix:

[0013] ∑=L·L T

[0014] Where ∑ represents the covariance matrix, i.e., random noise. The distribution variance, This represents the product of a zero-mean unit variance vector and a lower triangular matrix;

[0015] Sampling is performed from the anisotropic Gaussian distribution, and anisotropic random noise is introduced into the weights.

[0016] In one embodiment, a weighted loss function is constructed based on the original image features and the variance of the random noise distribution as follows:

[0017]

[0018] in, This represents a weight-based loss function. Represents the original image. This represents the original image features extracted by the last feature extractor layer, and ∑ represents random noise. The distribution variance,

[0019] In one embodiment, the loss function for constructing the image classification model based on the weighted loss function is:

[0020]

[0021] Among them, L loss This represents the loss function of an image classification model. Represents the cross-entropy loss function. Let λ1 represent the l2 regularization term, λ2 represent the control coefficient for the weight regularization strength, and λ3 represent the control coefficient for the model parameter penalty strength.

[0022] An image classification device for defense against adversarial attacks, the device comprising:

[0023] A random noise introduction module is used to obtain a pre-built image classification model and the weights of the last layer feature extractor of the image classification model, and to introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution.

[0024] The original image feature acquisition module is used to input the original image into the image classification model and obtain the original image features extracted by the last layer feature extractor;

[0025] The loss function construction module is used to construct a weight-based loss function based on the original image features and the distribution variance of the random noise, and to construct the loss function of the image classification model based on the weight-based loss function.

[0026] The loss function optimization module is used to optimize the loss function of the image classification model to obtain a trained image classification model for defense against adversarial attacks, and to perform image classification using the image classification model for defense against adversarial attacks.

[0027] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps:

[0028] Obtain the weights of a pre-built image classification model and the last layer feature extractor of the image classification model, and introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution.

[0029] The original image is input into the image classification model to obtain the original image features extracted by the last layer feature extractor;

[0030] A weighted loss function is constructed based on the original image features and the distribution variance of the random noise, and the loss function of the image classification model is constructed based on the weighted loss function.

[0031] The loss function of the image classification model is optimized to obtain a trained image classification model for defense against adversarial attacks, and the image classification model for defense against adversarial attacks is used for image classification.

[0032] The aforementioned image classification method, apparatus, and computer device for defending against adversarial attacks first obtain a pre-constructed image classification model and the weights of the last layer feature extractor of the image classification model. Random noise is introduced into the weights, where the random noise follows a multivariate Gaussian distribution. Then, the original image is input into the image classification model to obtain the original image features extracted by the last layer feature extractor. Next, a weight-based loss function is constructed based on the distribution variance of the original image features and random noise, and a loss function for the image classification model is constructed based on the weight-based loss function. Finally, the loss function of the image classification model is optimized to obtain a trained image classification model for defending against adversarial attacks, which is then used for image classification. It can be seen that this invention does not use adversarial image samples throughout the entire process. Compared with existing defense methods that rely on adversarial training, this invention can significantly reduce training time and computational burden while ensuring the accuracy and robustness of the original image classification. Especially in scenarios requiring rapid decision-making, the elimination of adversarial training can greatly improve the efficiency of image classification. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating an image classification method for defending against adversarial attacks in one embodiment;

[0034] Figure 2 Here is a visualization of image classification results in one embodiment, where (a) is the classification result without adding random noise, and (b) is the classification result of WB-SNN;

[0035] Figure 3 This is a comparison chart of network training time in one embodiment;

[0036] Figure 4 This is a structural block diagram of an image classification device for defending against adversarial attacks in one embodiment;

[0037] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0039] In one embodiment, such as Figure 1 As shown, an image classification method for defending against adversarial attacks is provided, including the following steps:

[0040] Step 102: Obtain the pre-built image classification model and the weights of the last layer feature extractor of the image classification model, and introduce random noise into the weights.

[0041] Random noise It satisfies a multivariate Gaussian distribution, that is ∑ represents random noise The distribution variance.

[0042] This method does not restrict the network architecture of the image classification model, and different depths, widths and structure types can be selected, such as ResNet-18, ResNet-32 and GoogLeNet.

[0043] Step 104: Input the original image into the image classification model to obtain the original image features extracted by the last layer feature extractor.

[0044] An original image refers to a clean image that has not been disturbed.

[0045] For simplicity, consider a binary classification case. Given an input x, the model outputs a classification label y ∈ [-1, 1]. The model classification can then be expressed as:

[0046]

[0047] Where f(·) is a nonlinear mapping that embeds x into the feature space, and h is the target model. These represent the weights and biases of the last classification layer, i.e., the last feature extractor.

[0048] As you can see, the model output It is the last layer of weight transpose. Features extracted by the last layer of feature extractor dot product plus layer bias Obtained.

[0049] Therefore, steps 102 and 104 of this method obtain the weights of the last layer feature extractor and the original image features extracted by the last layer feature extractor for subsequent processing.

[0050] Step 106: Construct a weight-based loss function based on the distribution variance of the original image features and random noise, and then construct the loss function of the image classification model based on the weight-based loss function.

[0051] Step 110: Optimize the loss function of the image classification model to obtain a trained image classification model that defends against adversarial attacks, and use the image classification model that defends against adversarial attacks for image classification.

[0052] The aforementioned image classification method for defending against adversarial attacks first obtains the weights of a pre-constructed image classification model and its final feature extractor. Random noise, which follows a multivariate Gaussian distribution, is introduced into the weights. Then, the original image is input into the image classification model to obtain the original image features extracted by the final feature extractor. Next, a weight-based loss function is constructed based on the variance of the original image features and the random noise distribution. This weight-based loss function is then used to construct the loss function of the image classification model. Finally, the loss function of the image classification model is optimized to obtain a trained image classification model for defending against adversarial attacks. This model is then used for image classification. As can be seen, this method does not use adversarial image samples throughout the entire process. Compared to existing defense methods that rely on adversarial training, this method can significantly reduce training time and computational burden while ensuring the accuracy and robustness of the original image classification. Especially in scenarios requiring rapid decision-making, the elimination of adversarial training greatly improves the efficiency of image classification.

[0053] Here is the derivation of the weight-based loss function:

[0054] Step 202: Input the original image and the corresponding attack image into the pre-built image classification model to obtain the original image features and attack image features extracted by the last layer feature extractor.

[0055] Step 204: Introduce random noise into the weights;

[0056] After introducing random noise into the weights, the model output is in therefore, It can be expressed as

[0057]

[0058] The decision boundary of the prediction is determined by It is worth noting that if the prediction is correct, the value of the decision boundary is positive; otherwise, it is negative.

[0059] The original decision boundary is obtained based on the weights, random noise, and original features:

[0060]

[0061] in, Let y represent the original image, and y represent the output category of the image classification model. This represents the weights of the last layer feature extractor in the image classification model. Let b represent the original features extracted by the last feature extractor, b represent the bias of the last feature extractor, and ∑ represent random noise. variance This represents the original decision boundary.

[0062] The attack decision boundary is obtained based on weights, random noise, and attack characteristics;

[0063]

[0064] in, Indicates an attack image. This represents the attack features extracted by the last layer of feature extractors. This indicates the attack decision boundary.

[0065] Step 206: Construct a difference function of the misclassification probability of the image classification model when processing the original image and the attack image, based on the original decision boundary and the attack decision boundary.

[0066] The focus is on the difference in the probability of misclassification between being attacked and not being attacked within the intensity δ. The difference function can be expressed as:

[0067]

[0068] Based on the cumulative distribution function, we can obtain:

[0069]

[0070]

[0071] in, This indicates that the image classification model misclassifies when processing adversarial images. This indicates that the image classification model misclassifies the image when processing the original image, and ||·||p represents the p-norm. This represents the noise added to the original image when generating an adversarial image, where ∈ represents the perturbation intensity corresponding to the noise.

[0072] Step 208: Calculate the upper bound of the difference function.

[0073] The probability difference function defined above It is bounded, and its boundedness is as follows:

[0074]

[0075] in Bounded, for any

[0076] The proof is as follows:

[0077] Lippitz constant c for probability difference function It can be written as:

[0078]

[0079] Based on the inequality scaling, we can obtain:

[0080]

[0081] To simplify the calculation, If we consider it as K, then it satisfies:

[0082]

[0083] As can be seen, increase This reduces the value of the probability difference function; that is, by optimizing the upper bound of the probability difference function, the difference in misclassification probabilities between the attacked and unattacked models can be minimized. Most existing non-randomized defense methods aim to keep the input predictions unchanged by adversarial attacks, while randomized defense methods should minimize the probability of the predictions being changed, i.e., minimize the difference in misclassification probabilities between the attacked and unattacked models.

[0084] This method derives and optimizes the upper bound of robustness error from a weight perspective to improve the robustness of the model. The derivation process shows that this method performs image classification based on a theoretically guaranteed weight-based stochastic neural network, and the derivation results also demonstrate why this method does not require adversarial training. Specifically, stochastic neural networks, by injecting random noise during training, selectively enhance the model, showing great potential in improving the robustness of classification results. Based on the location of the injected noise, it can be mainly divided into two categories: one is injecting noise into the model's features, and the other is injecting random noise into the model's weights. Although the above methods improve the stability of image classification results to some extent, most stochastic neural networks are based on intuition and empirical heuristics, lacking theoretical guarantees.

[0085] In one embodiment, introducing random noise into the weights includes:

[0086] One straightforward idea is to inject isotropic noise into the model weights. Following this idea, isotropic noise can be easily implemented, typically by drawing isotropic noise from a multivariate Gaussian distribution with a diagonal covariance matrix, implying that it is independent of perturbations to learned features across different dimensions. However, such a strong assumption is unreasonable. Therefore, this method implements more reasonable anisotropic noise, which can flexibly provide a richer noise distribution. In this case, isotropic noise can be considered a special case. Implementing anisotropic noise in the model weights is not easy; its implementation will be detailed below:

[0087] Sampling is performed within a multivariate Gaussian distribution to obtain a zero-mean, unit-variance vector, where the mean of the multivariate Gaussian distribution is... C represents the number of output categories of the image classification model, and D represents the dimension of the original image features extracted by the last layer feature extractor.

[0088] The covariance matrix of the anisotropic Gaussian distribution of random noise is obtained by multiplying the zero-mean unit variance vector and the lower triangular matrix:

[0089] ∑=L·L T

[0090] Where ∑ represents the covariance matrix, i.e., random noise. The distribution variance, This represents the product of a zero-mean unit variance vector and a lower triangular matrix;

[0091] Sampling is performed from an anisotropic Gaussian distribution, and anisotropic random noise is introduced into the weights.

[0092] In one embodiment, a weighted loss function is constructed based on the variance of the original image features and the distribution of random noise as follows:

[0093]

[0094] in, This represents a weight-based loss function. Represents the original image. This represents the original image features extracted by the last feature extractor layer, and ∑ represents random noise. The distribution variance,

[0095] The loss function for constructing an image classification model based on a weighted loss function is:

[0096]

[0097] Among them, L loss This represents the loss function of an image classification model. Represents the cross-entropy loss function. Let λ1 represent the l2 regularization term, λ2 represent the control coefficient for the weight regularization strength, and λ3 represent the control coefficient for the model parameter penalty strength.

[0098] The following experimental procedure demonstrates the effectiveness of this method:

[0099] 1. Dataset:

[0100] The datasets used in the experiments were SVHN, CIFAR-10, and CIFAR-100.

[0101] The SVHN dataset consists of 73K training data and 26K test data, with a data size of 32x32x3 and ten classes. The CIFAR-10 and CIFAR-100 datasets contain 50K training data and 10K test data, both of which are 32x32x3 color images. CIFAR-10 has 10 classes, each containing 6000 images. CIFAR-100 has 100 classes, each containing 600 images.

[0102] 2. Countering attacks:

[0103] White-box attacks, including FGSM and PGD 10 And more powerful attack methods like PGD 100 .

[0104] Black box attacks include One-Pixel attacks, as well as the more sophisticated Square attacks.

[0105] Further EOT attacks were used to evaluate whether the model corresponding to the proposed method was not subject to gradient confusion.

[0106] 3. Network architecture:

[0107] For network architecture, a wide range of networks were selected to fully validate the effectiveness of the proposed method, including networks with different widths, depths, and structural types. Specifically, ResNet-18, ResNet-20[1.5×], ResNet-20[2X], ResNet-20[4X], ResNet-32, ResNet-44, ResNet-50, WRN-34-10, ResNeXt29-2x64d, and GoogLeNet were used in the experiments.

[0108] 4. Experimental details:

[0109] All experiments were conducted using the PyTorch platform on a GPU server with 24GB of memory and an NVIDIA RTX 3090 GPU. The PyTorch version used was 1.7.0, and some attack algorithms followed Foolbox, a publicly available attack library.

[0110] This method uses the most commonly used ResNet-18 model as the backbone of the experiments, and also uses many different network architectures to generalize the image classification model. The attacks are parameterized according to the literature.

[0111] Specifically, FGSM and PGD 10 The attack strength set for CIFAR-10 and CIFAR-100 is ∈ = 8 / 255. PGD 10The step size is α = ∈ / 10, and the number of steps for all benchmarks is k = 10. For PGD 100 For the attack, we set k = 100 and α = ∈ / 100 accordingly. For the One-Pixel attack, the size N is set to 400, and the maximum number of iterations k max =75, we further conducted stronger 5-pixel attacks and Square attacks. For fair comparison, some competing results were extracted from publicly available literature. For the hyperparameters, the default settings for λ1, λ2, and λ3 are 0.001, 1, and 0.01, respectively.

[0112] 5. Experimental Results:

[0113] To evaluate the effectiveness of the proposed method, the defensive performance of WB-SNN (the weighted stochastic neural network corresponding to this method) is compared with that of four recent state-of-the-art weighted stochastic defense methods.

[0114] No Defense: The original ResNet-18 model without any defense methods.

[0115] Adv.Train: A model trained using adversarial methods.

[0116] PNI: Learn a parameter to control the randomness of trainability.

[0117] Adv-BNN: Defense using adversarial training of Bayesian neural networks.

[0118] L2P: Improves PNI by learning a perturbation injection module and introducing an alternating backpropagation method to continuously train the network and noise parameters.

[0119] Experiments were conducted on the ResNet-18 model, CIFAR-10, and CIFAR-100 datasets for fair comparison. It is worth noting that previous weight-based stochastic neural networks were empirically effective and relied on adversarial training, while the proposed WB-SNN is theoretically guaranteed and does not involve adversarial training.

[0120] 5.1 White-box attack experiment:

[0121] We first evaluate the proposed WB-SNN on the CIFAR-10 dataset using the well-known white-box attacks FGSM and PGD. FGSM is a single-step attack, while PGD is an iterative attack method. Experimental results are shown in Tables 1 and 2.

[0122] Table 1 Comparison Results

[0123]

[0124] Table 1 compares networks of different depths: ResNet-18, ResNet-32, and ResNet-44. The results show that the proposed WB-SNN performs well on these three networks. The proposed WB-SNN does not sacrifice accuracy on clean data and achieves strong adversarial robustness. The proposed WB-SNN is then compared with other state-of-the-art stochastic defense systems at different network widths: ResNet-20 [1.5x], ResNet-20 [2x], and ResNet-20 [4x]. The proposed WB-SNN still outperforms these existing weight-based SNNs. Specifically, for accuracy on clean data, compared to the best defense method PNI, the proposed method achieves improvements of 7.2%, 7.4%, and 6.2% on ResNet-20 [1.5x], ResNet-20 [2x], and ResNet-20 [4x], respectively. For robust accuracy against PGD and FGSM attacks, this method achieves the best robust accuracy compared to the state-of-the-art defense method L2P, except for ResNet-20 [1.5x]. In PGD attacks, this method achieves similar results to L2P.

[0125] Table 2 Comparison Results

[0126]

[0127] Table 2 compares the results of state-of-the-art SNNs trained on the CIFAR-10 and CIFAR-100 datasets, with ResNet-18 as the backbone network. The results for the "Adv.Train" model show that conventional adversarial training yields the worst results under both FGSM and PGD attacks. It is worth emphasizing that, in contrast, the state-of-the-art randomized defenses "Adv-BNN," "PNI," and "L2P" all require adversarial training—that is, generating adversarial examples and retraining the network—which incurs high computational costs and sacrifices accuracy on clean data. The results demonstrate that adversarial training and its variants do indeed sacrifice accuracy on clean data. Compared to "PNI," the best defense method in terms of clean data accuracy, our method achieves improvements of 6.5% and 13.1% on the CIFAR-10 and CIFAR-100 datasets, respectively. For robustness to the CIFAR-10 dataset, compared to the best randomized defense method L2P, the proposed WB-SNN achieves a 13.9% improvement against FGSM attacks and a 14.6% improvement against PGD attacks without sacrificing accuracy on clean data. For robust accuracy on the CIFAR-100 dataset under FGSM attacks, the proposed method achieves approximately 18.7% improvement compared to the best randomized defense methods Adv-BNN and L2P. For PGD attacks, while the proposed method does not achieve the highest accuracy, it is still highly competitive. Furthermore, these methods are empirically effective, while the proposed WB-SNN has theoretical guarantees.

[0128] 5.2 Black-box attack experiment:

[0129] Next, our method evaluates defense against black-box attacks, specifically n-pixel attacks. These attacks are derivative-free and rely on evolutionary optimization; their strength is controlled by the number of pixels they destroy. Our method implements 1, 2, and 3-pixel attacks, and achieves a stronger 5-pixel attack. The results are shown in Table 3, demonstrating our method's n-pixel attack on a ResNet-18 model trained on the CIFAR-10 dataset. It can be seen that our WB-SNN does not sacrifice accuracy on clean data. Compared to PNI's best clean data accuracy, our method achieves an improvement of approximately 7.0%. Compared to the best stochastic defense method, Adv-BNN, our WB-SNN achieves improvements of 17.5%, 14.6%, and 14.6% on 1, 2, and 3-pixel attacks, respectively. Even under the stronger 5-pixel attack, the proposed WB-SNN provides robustness of 60%, even surpassing all stochastic defense methods under 3-pixel attacks.

[0130] Table 3 Results of Black-box Attack Experiments

[0131]

[0132] In Table 4, we present the experimental results for two stronger attacks: PGD100, a stronger white-box attack, and Square, a stronger black-box attack. The experiments show that our method can still maintain good performance under stronger attacks.

[0133] Table 4 Results of the Strong Attack Experiment

[0134]

[0135] Here, we directly compare the proposed WB-SNN with previous state-of-the-art defense methods, some of which are stochastic and others are not. For stochastic defense methods, some are weight-based and others are feature-based. The model is evaluated on the CIFAR-10 non-targeted PGD attack, and the evaluation results are shown in Table 5. Two conclusions can be drawn from the results. First, our proposed WB-SNN does not require adversarial training. In contrast, most previous state-of-the-art defense methods require adversarial training, and our method achieves the best clean data accuracy even on deeper networks. Second, our method achieves the highest adversarial robustness on the ResNet-18 model, achieving comparable results even compared to deeper or broader networks. More specifically, the proposed WB-SNN is theoretically guaranteed, while most state-of-the-art defense methods are not.

[0136] Table 5 Model Evaluation Results

[0137]

[0138] 1000 images were extracted from the CIFAR-10 dataset. Figure 2 The visualization results of the embedding vectors obtained from ResNet-18 are shown below. Figure 2 (a) shows the classification results without adding random noise. Figure 2 (b) shows the classification results of WB-SNN. The visualization of both methods shows ten main clusters. Figure 2 (a) The boundaries between several clusters are not clear. Figure 2 (b) compared to Figure 2 (a) Smoother, indicating that the proposed WB-SNN can be highly adversarial. The visualization of WB-SNN shows ten clusters with considerable margin between them. Furthermore, each cluster can be linearly separated from the others, something ResNet-18 cannot achieve without defenses.

[0139] Intuitively, this experiment demonstrates that WB-SNN can learn a more robust architecture, achieving intra-class compactness and even better performance in inter-class separation, which essentially reduces potential adversarial regions. Therefore, in an unbounded, high-variance setting, this method can maintain high uncertainty and adaptively learn more meaningful and robust representations. Furthermore, uncertainty helps the network avoid getting trapped in local optima and instead explore the global optimum, thereby improving the model's robustness and classification ability.

[0140] To evaluate the generalization ability of the proposed WB-SNN, FGSM and PGD attacks were performed on different network architectures. First, the impact of dataset size was explored, as shown in Table 6. Three different dataset sizes were used in the experiments: SVHN: a relatively small dataset; CIFAR-10: a medium-sized dataset with 60K training data and 10K test data; and CIFAR-100: a large dataset with one hundred classes. The experiments were conducted using the ResNet-18 backbone. The results show that WB-SNN exhibits good generalization ability across different dataset sizes.

[0141] Table 6 Generalization performance results of WB-SNN on different datasets

[0142]

[0143] Table 7 primarily discusses the impact of network architecture on the proposed WB-SNN. More specifically, four network architectures were used in this experiment: ResNet, Wide-ResNet, ResNext, and GoogLeNet. The results show that the proposed WB-SNN can generalize well to various architectures with different widths, depths, and network structures.

[0144] Table 7 Generalization performance results of WB-SNN under different network structures

[0145]

[0146] like Figure 3As shown, a time consumption comparison of WB-SNN with standard and general adversarial training is presented, including comparisons of four different network architectures: ResNet-18, ResNet-20 (4x), whose network width is four times that of the standard ResNet-20, ResNet-44, and GoogleNet. Compared to networks with different architectures, widths, and depths, the proposed WB-SNN demonstrates an advantage in time consumption. Specifically, this method saves approximately 3.37, 3.33, 2.94, and 3.45 times the computational cost of normal adversarial training, while incurring only 2.02, 2.07, 1.72, and 2.12 times more time than standard training. This proves that this method can achieve a more powerful model with only a slightly higher computational cost than standard training.

[0147] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0148] In one embodiment, such as Figure 4 As shown, an image classification device for defending against adversarial attacks is provided, comprising: a random noise introduction module, an original image feature acquisition module, a loss function construction module, and a loss function optimization module, wherein:

[0149] The random noise introduction module is used to obtain the weights of the pre-built image classification model and the last layer feature extractor of the image classification model, and introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution;

[0150] The original image feature acquisition module is used to input the original image into the image classification model and obtain the original image features extracted by the last layer feature extractor;

[0151] The loss function construction module is used to construct a weighted loss function based on the distribution variance of the original image features and random noise, and to construct the loss function of the image classification model based on the weighted loss function.

[0152] The loss function optimization module is used to optimize the loss function of the image classification model to obtain a trained image classification model that defends against adversarial attacks. The image classification model that defends against adversarial attacks is then used for image classification.

[0153] In one embodiment, the random noise introduction module is further configured to sample from a multivariate Gaussian distribution to obtain a zero-mean unit variance vector; the mean of the multivariate Gaussian distribution... C represents the number of output categories of the image classification model, and D represents the dimension of the original image features extracted by the last layer feature extractor.

[0154] The covariance matrix of the anisotropic Gaussian distribution of random noise is obtained by multiplying the zero-mean unit variance vector and the lower triangular matrix:

[0155] ∑=L·L T

[0156] Where ∑ represents the covariance matrix, i.e., random noise. The distribution variance, This represents the product of a zero-mean unit variance vector and a lower triangular matrix;

[0157] Sampling is performed from an anisotropic Gaussian distribution, and anisotropic random noise is introduced into the weights.

[0158] In one embodiment, the loss function construction module is further configured to construct a weight-based loss function based on the variance of the original image features and the distribution of random noise:

[0159]

[0160] in, This represents a weight-based loss function. Represents the original image. This represents the original image features extracted by the last feature extractor layer, and ∑ represents random noise. The distribution variance,

[0161] The loss function for constructing an image classification model based on a weighted loss function is:

[0162]

[0163] Among them, L loss This represents the loss function of an image classification model. Represents the cross-entropy loss function. Let λ1 represent the l2 regularization term, λ2 represent the control coefficient for the weight regularization strength, and λ3 represent the control coefficient for the model parameter penalty strength.

[0164] For specific limitations regarding an image classification device for defending against adversarial attacks, please refer to the limitations of an image classification method for defending against adversarial attacks mentioned above, which will not be repeated here. Each module in the aforementioned image classification device for defending against adversarial attacks can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0165] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores image data. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements an image classification method for defending against adversarial attacks.

[0166] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0167] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0168] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0169] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0170] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0171] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An image classification method for defending against adversarial attacks, characterized in that, The method includes: Obtain the weights of a pre-built image classification model and the last layer feature extractor of the image classification model, and introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution. The original image is input into the image classification model to obtain the original image features extracted by the last layer feature extractor; A weighted loss function is constructed based on the original image features and the distribution variance of the random noise, and the loss function of the image classification model is constructed based on the weighted loss function. The loss function of the image classification model is optimized to obtain a trained image classification model that defends against adversarial attacks, and the image classification model that defends against adversarial attacks is used for image classification. Introducing random noise into the weights includes: Sampling is performed in a multivariate Gaussian distribution to obtain a zero-mean, unit-variance vector; the mean of the multivariate Gaussian distribution... , This represents the number of output categories of the image classification model. This indicates the dimension of the original image features extracted by the last layer of feature extractors; The covariance matrix of the anisotropic Gaussian distribution of random noise is obtained by multiplying the zero-mean unit variance vector and the lower triangular matrix: ； in, Represents the covariance matrix, i.e., random noise. The distribution variance, This represents the product of a zero-mean unit variance vector and a lower triangular matrix; Sampling is performed from the anisotropic Gaussian distribution, and anisotropic random noise is introduced into the weights; A weighted loss function is constructed based on the original image features and the variance of the random noise distribution, including: Based on the original image features and the variance of the random noise distribution, a weighted loss function is constructed as follows: ； in, This represents a weight-based loss function. Represents the original image. This represents the original image features extracted by the last feature extractor layer. Represents random noise The distribution variance, .

2. The method according to claim 1, characterized in that, The loss function of the image classification model is constructed based on the weight-based loss function, including: The loss function for constructing the image classification model based on the weight-based loss function is as follows: ； in, This represents the loss function of an image classification model. Represents the cross-entropy loss function. express Regularization term, The control coefficient representing the strength of weighted regularization. The control coefficients represent the intensity of the penalty for model parameters.

3. An image classification device for defending against and resisting attacks, characterized in that, The image classification method for defending against attacks as described in claim 1 or 2, the apparatus comprising: A random noise introduction module is used to obtain a pre-built image classification model and the weights of the last layer feature extractor of the image classification model, and to introduce random noise into the weights; the random noise follows a multivariate Gaussian distribution. The original image feature acquisition module is used to input the original image into the image classification model and obtain the original image features extracted by the last layer feature extractor; The loss function construction module is used to construct a weight-based loss function based on the original image features and the distribution variance of the random noise, and to construct the loss function of the image classification model based on the weight-based loss function. The loss function optimization module is used to optimize the loss function of the image classification model to obtain a trained image classification model for defense against adversarial attacks, and to perform image classification using the image classification model for defense against adversarial attacks.

4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method of claim 1 or 2.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method of claim 1 or 2.

Images