A defense method against cross-entropy based adversarial attacks

Abstract

The application provides a defense method against cross-entropy based adversarial attack. The method comprises the following steps: training a deep neural network model to be defended by using clean samples, so that the deep neural network model reaches a fitting state; after the deep neural network model reaches the fitting state, continuing to train the deep neural network model by using clean samples, so that the deep neural network model reaches an over-fitting state; the over-fitting state corresponds to a fitting state reached after training the deep neural network model by using an adversarial sample; and using the deep neural network model in the over-fitting state as a trained deep neural network model.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a defense method against cross-entropy adversarial attacks. Background Technology

[0002] With the rapid development of artificial intelligence and machine learning / deep learning methods, AI-based systems are widely deployed in real-world industrial production environments. However, because these systems are vulnerable to adversarial attacks, while bringing great convenience to production and daily life, they also present some security challenges. An adversarial attack refers to adding imperceptible, subtle perturbations to the original input before feeding it into the AI ​​system, causing it to obtain unexpected predictions. The vulnerability of an AI-based system to adversarial attacks essentially means that the algorithm's adversarial robustness (i.e., its ability to resist adversarial attacks) is too poor. Therefore, improving the adversarial robustness of deep neural network models is particularly important.

[0003] Currently, the main methods to improve adversarial robustness are: (1) Gradient hiding: hiding or obfuscating the gradient of the model so that the gradient-based adversarial sample generation algorithm cannot obtain the correct gradient of the model, thus making it difficult to attack the artificial intelligence system. (2) Image preprocessing: reducing adversarial perturbation by preprocessing the input. (3) Adversarial training: this method is also the current mainstream method; that is, during the training phase, the generated adversarial samples and the original samples (clean samples) are used as input together to participate in the training process; this method can effectively improve the adversarial robustness of the model. However, for adversarial attack samples based on cross-entropy, the adversarial robustness of the above three types of methods still needs to be improved, and the effectiveness of the adversarial attack defense of the above three types of methods cannot be verified in theory. Summary of the Invention

[0004] Faced with cross-entropy-based adversarial attack samples, existing methods for improving adversarial robustness have poor defensive effects, and the effectiveness of adversarial attack defense cannot be theoretically verified. This invention provides a defense method against cross-entropy-based adversarial attacks, which can theoretically and completely defend against cross-entropy-based adversarial attacks.

[0005] This invention provides a defense method against cross-entropy-based adversarial attacks, comprising:

[0006] The deep neural network model that needs to be defended against is trained using clean samples until it reaches a fit state;

[0007] Once the deep neural network model reaches a fitted state, it is trained again using clean samples to achieve an overfit state; the overfit state corresponds to the fitted state achieved after training the deep neural network model using adversarial samples.

[0008] The deep neural network model in the current overfit state is used as a trained deep neural network model.

[0009] Furthermore, during the process of continuing training with clean samples to achieve an overfit, the optimization method of minimizing irrelevant class scores is employed, with the optimization objective set as shown in the following formula:

[0010] minimize(z s -z y )

[0011] in,

[0012] s = argmax z i and s≠y

[0013] Among them, z s Let i be the maximum predicted score among all labels other than the true label y, where i = 0, 1, ..., K-1; and K represents the number of categories.

[0014] The beneficial effects of this invention are:

[0015] This invention provides a defense method against cross-entropy-based adversarial attacks, proposing the concept of an "overfitting state." In this state, although the model sacrifices accuracy on a small number of clean samples, its adversarial robustness is significantly improved. Furthermore, this invention analyzes the mathematical reasons for the overfitting phenomenon and theoretically proves that, under the architecture of modern floating-point computers, overfitting can perfectly solve cross-entropy-based white-box adversarial attacks and also provides defense against future cross-entropy-based white-box adversarial attacks.

[0016] Furthermore, to address the issue of excessive iterative training required for overfitting, this invention proposes a MUCS optimization strategy, significantly reducing the number of iterations needed for the model to reach a superfit state. Compared with current state-of-the-art defense models, the proposed defense method demonstrates optimal performance against white-box adversarial attacks based on cross-entropy. Attached Figure Description

[0017] Figure 1 A traffic diagram illustrating a defense method against cross-entropy adversarial attacks provided in an embodiment of the present invention;

[0018] Figure 2This is a schematic diagram illustrating the training of the MiddleCNN model and ResNet-18 model provided in this embodiment of the invention on the CIFAR-10 dataset. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0020] Generally speaking, the training state of deep learning-based network models always changes from underfitting (at the beginning of training) to fitting (training completed), and finally reaches the state of overfitting. Since overfitting reduces the generalization ability of the trained model, in the current training process, training is always stopped when the model reaches the fitting state.

[0021] However, the inventors discovered that the concepts of different fitting states are relative. In fact, there is a corresponding relationship: over-fitting for ordinary / original / clean samples is actually under-fitting for adversarial samples. By increasing the number of iterations in the training process, the model can also reach a fitting state on adversarial samples. This state is far beyond over-fitting for clean samples, and is referred to as super-fitting in this invention.

[0022] Example 1

[0023] Based on the above, this embodiment of the invention provides a defense method against cross-entropy-based adversarial attacks, comprising the following steps:

[0024] S101: Train the deep neural network model that needs to be defended against using clean samples until it reaches a fit state;

[0025] S102: After the deep neural network model reaches the fitting state, it is trained again using clean samples to reach the overfit state; the overfit state corresponds to the fitting state reached after training the deep neural network model using adversarial samples;

[0026] S103: Use the deep neural network model in the current overfit state as a trained deep neural network model.

[0027] To verify the effectiveness of the embodiments of the present invention, the present invention also provides the following experiments.

[0028] First, we trained the model on the CIFAR-10 dataset using MiddleCNN (a network structure consisting of 3 convolutional layers, each followed by batch regularization, LeakReLU, and max pooling operations, with output channels of 64, 128, and 256 respectively, followed by two fully connected layers with output units of 1024 and 10 respectively) and ResNet-18 to achieve a super-fit state.

[0029] Figure 1 This demonstrates partial information about two network models (or defense models) during the training process. Figure 1 In the image, the top two sub-images show the accuracy of the MiddleCNN model on clean samples of the training set and the accuracy on adversarial samples of the test set (left), and the value of the loss function calculated using the cross-entropy loss function (CE-Loss) on adversarial samples (right); the bottom two sub-images show the accuracy of the ResNet-18 model on clean samples of the training set and the accuracy on adversarial samples of the test set (left), and the value of the loss function calculated using the cross-entropy loss function (CE-Loss) on adversarial samples (right).

[0030] exist Figure 1 In the experiments described above, both network models were trained using clean samples. The training process employed CE-Loss and the Adam optimizer (learning rate set to 1e-3, other parameters default). No defensive measures were used; only the number of training epochs was increased (set to 30,000) to achieve overfitting. Then, adversarial robustness was evaluated on the CIFAR-10 test set using PGD-20 (using adversarial examples to test adversarial robustness). MiddleCNN achieved an accuracy of 83.72% on the adversarial examples generated by PGD-20 (compared to 88.97% on the original samples); ResNet-18 achieved 68.75% adversarial robustness (compared to 83.85% on the original samples). This demonstrates that overfitting sacrifices only some generalization ability (lower accuracy on clean samples), but significantly improves the model's adversarial robustness.

[0031] Furthermore, theoretically, the method of this invention can completely defend against adversarial attacks based on cross-entropy. The theoretical verification process is as follows:

[0032] Since lnx is not differentiable when x≤0, CE-Loss implementations often employ an equivalent computational process:

[0033]

[0034] in,

[0035]

[0036]

[0037] Where b is the model output after passing through the softmax and ln functions, and t is the one-hot encoding format of the sample's true label.

[0038] It can be deduced that:

[0039]

[0040]

[0041]

[0042] then:

[0043]

[0044] It can be observed that when z k When k ∈ [0, K) and k ≠ y, Then we have:

[0045]

[0046] At this point, gradient vanishing occurs, meaning attacks based on cross-entropy loss will be ineffective. Therefore, this invention can mathematically explain how overfitting resists adversarial attacks, and theoretically, the method of this invention can completely defend against adversarial attacks based on cross-entropy.

[0047] Example 2

[0048] Overfitting may face two problems: 1) It cannot make z k 1) Reaching mathematical -∞; 2) Taking too long; for example, even with an RTX 3090 graphics card, it takes 30,000 iterations to get ResNet-18 to overfit, which takes several days.

[0049] Problem 1) above is easily solved. With the floating-point arithmetic mechanism of modern computers, it is only necessary to let z... k Reaching a very small value (and z) k <0), it is not necessary to reach -∞ in mathematics to make This leads to the overfitting state being established.

[0050] To address problem 2) above, this embodiment of the invention also provides a novel optimization process, specifically: during the process of continuing training with clean samples to achieve an overfit, the Minimum Irrelevant Class Score (MUCS) method is used for optimization, with the optimization objective set as shown in the following formula:

[0051] minimize(z s -z y )

[0052] in,

[0053] s = argmax z i and s≠y

[0054] Among them, z s Let be the maximum predicted score among all labels other than the true label y, where i = 0, 1, ..., K-1; and K represents the number of categories. The predicted scores of all labels other than the true label y are the scores of categories irrelevant to the true label.

[0055] Specifically, simply by minimizing z S This achieves the goal of minimizing the scores of all irrelevant categories.

[0056] To verify the effectiveness of the MUCS optimization method provided in this embodiment of the invention, related experiments were also conducted, and the experimental results are shown in Table 1. Table 1 shows the impact of MUCS and ordinary cross-entropy loss on the overfitting state of CIFAR-10, including the convergence speed (expressed in terms of the number of iterations) and the final adversarial robust accuracy (resistance to PGD-20).

[0057] Table 1 shows the performance of MUCS and cross-entropy loss function.

[0058]

[0059] To further verify the effectiveness of the overfitting method provided by this invention, it was also compared with other currently advanced defense models.

[0060] To compare with current advanced defense models, the method of this invention employs the more aggressive PGD-100, APGD-100, and standard A... 3Testing was conducted using the CIFAR-10 and CIFAR-100 datasets. In the experiments, the optimizer used for overfitting training was Adam, with a learning rate of 1e-3. The attack algorithm was set with a perturbation radius of 8.0 / 255 and a step size of 0.8 / 255. CE-Loss was used to calculate the gradient during the attack, while other parameters remained at their default values. The experimental results are shown in Tables 2 and 3. The experimental data demonstrate that overfitting outperforms other advanced defense methods.

[0061] Table 2 shows the performance of the superfitting method of this invention and other advanced defense models on CIFAR-10.

[0062]

[0063]

[0064] Table 3. Performance of the superfitting method of this invention and other advanced defense models on CIFAR-100.

[0065]

[0066]

[0067] This invention compares the performance of overfitting with other recent excellent defense methods. The experiments used test sets from the CIFAR-10 and CIFAR-100 datasets (1280 images randomly selected, batch size set to 128), and employed clean samples, PGD-100, APGD-100, and the default version of A... 3 The generated adversarial examples were used to evaluate the robustness of the models across nine network architectures (three basic architectures: MiddleCNN, ResNet, and Wide ResNet). The first column of Tables 2 and 3 lists the different defense methods, the network model architecture used, and the number of model parameters (indicated by...). The marking indicates a disturbance radius of 0.031, with... The column indicating clean samples shows the model's accuracy on clean samples (marked by additional unlabeled datasets used during training). PGD, APGD, and A... 3 The columns represent the model's performance in PGD-100, APGD-100, and default version A, respectively. 3 The accuracy of the algorithm under adversarial examples. As shown in Tables 2 and 3, the overfitting method proposed in this invention can achieve higher adversarial robustness with a smaller model (i.e., fewer parameters).

[0068] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A defense method against cross-entropy-based adversarial attacks, characterized in that, include: The deep neural network model to be defended is trained using clean image samples until it reaches a fitted state; after the deep neural network model reaches a fitted state, it is trained again using clean image samples until it reaches an overfit state; the overfit state corresponds to the fitted state reached after training the deep neural network model using adversarial image samples. The deep neural network model under the current overfitting state is used as a trained deep neural network model for image recognition. During the process of continuing training with clean image samples to achieve an overfit, the optimization method of minimizing irrelevant class scores is used, and the optimization objective is set as shown in the following formula: minimize(with s -With y ) in, s=argmaxz i and s≠y Among them, z s Let i be the maximum predicted score among all labels other than the true label y, where i = 0, 1, ..., K-1; and K represents the number of categories.

Images