General robust classifier training method and system based on single-step iteration

Abstract

The present invention provides a general robust classifier training method and system based on single-step iteration, including: an image fusion mask generator, a linear indicator for measuring the loss surface, and a flat minimum loss optimization module. The mask generator samples the low-frequency part in the frequency domain to generate a continuous mask with no fixed shape in the spatial domain for image augmentation. The linear indicator measures the degree of linear growth of the loss surface along the direction of adversarial perturbation and is used to suppress catastrophic overfitting in fast training. The flat minimum loss optimization module is intended to improve the flatness of the loss surface when the loss is minimized. The method provided by the present invention effectively improves the efficiency of adversarial training, avoids falling into catastrophic overfitting of single-step adversarial training, and has strong versatility on various backbone networks and data sets.

Description

Technical Field

[0001] The present invention relates to the technical field of machine learning security, and in particular to a general robust classifier training method and system based on single-step iteration, and more particularly to a general robust classifier fast training system and method based on single-step iteration. Background Art

[0002] In recent years, deep neural networks have achieved remarkable performance in various fields. In computer vision, deep learning techniques based on convolutional neural networks (CNNs) have been widely used and play a key role in image content review, face detection and recognition, and autonomous driving. However, numerous studies have shown that highly accurate neural networks are often vulnerable. Simply by adding subtle perturbations to the original input, imperceptible to humans, a highly accurate neural network can misclassify the original input. These subtle perturbations are called adversarial perturbations, and the corresponding examples are called adversarial examples. These issues raise safety concerns when neural networks are deployed in the real world. For example, in computer vision technology, which is relied upon for automated assisted driving, malicious noise, imperceptible to the human eye, can confuse the neural network, leading to misjudgments by the autonomous driving system. Therefore, when neural networks are deployed in real-world high-risk scenarios, robustness and safety become key concerns.

[0003] Numerous techniques have been proposed to improve the robustness of neural networks, such as adversarial example detection and input image reconstruction. However, most of these techniques are considered to be false robustness improvements based on gradient obfuscation. Only methods based on adversarial training can achieve true robustness. Therefore, adversarial training has become the mainstream method for improving the robustness of deep neural networks. Its core is to use gradient ascent to search for adversarial perturbations that maximize the loss within the perturbation space, and then minimize the adversarial loss on the perturbed image. Due to its multi-step iteration, adversarial training is dozens of times more efficient than normal training, making it difficult to generalize to large-scale datasets. In 2015, GoodFellow et al. analyzed the root cause of adversarial attacks as the linear nature of deep learning models in high-dimensional space. Based on this assumption, they proposed an algorithm for efficiently generating adversarial examples: the fast gradient descent method (FGSM). However, in practice, when images are significantly distorted (e.g., blurry or color-distorted) and the network structure is complex, the linear assumptions required by FGSM are often difficult to hold. Therefore, when FGSM is applied to adversarial training, it often leads to catastrophic overfitting. The model can defend against single-step weak attack algorithms, but remains vulnerable to multi-step, iterative, adaptive strong attack algorithms. This makes using only one iteration to generate adversarial samples a key approach to improving the efficiency of adversarial training. Adversarial training also has a more complex decision surface than normal training, requiring more training data. However, in practice, the amount of labeled data is limited, and adversarially trained models can easily suffer from adversarial overfitting. Currently, common data augmentation techniques cannot avoid robust overfitting.

[0004] Therefore, it is necessary to propose a new technical solution to improve the above technical problems. Summary of the Invention

[0005] In view of the defects in the prior art, the object of the present invention is to provide a general robust classifier training method and system based on single-step iteration.

[0006] According to the present invention, a general robust classifier training method based on single-step iteration is provided, the method comprising the following steps:

[0007] Step S1: Initialize the convolutional backbone network and optimizer;

[0008] Step S2: Sampling several samples from the training data set and sending them into the image fusion enhancement FreqMask module to generate enhanced samples;

[0009] Step S3: Fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples;

[0010] Step S4: Send the adversarial sample to the backbone network again and adjust the overall adversarial loss according to the linearity indicator;

[0011] Step S5: Derivative the total loss with respect to the network parameters, obtain the gradient, and then perform backpropagation. The flat loss optimizer updates the parameters.

[0012] Step S6: Repeat steps S2 to S5 until the loss function converges and a robust model is obtained.

[0013] Preferably, step S2 includes the following steps:

[0014] Step S2.1: Randomly sample two samples from the training set, denoted as (x a ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W;

[0015] Step S2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d α , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient;

[0016] Step S2.3: Perform a Fourier shift on the frequency domain matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial domain matrix s.

[0017] Step S2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the ratio λ of the positions with a value of 1 in the image mask m to the total number of pixels;

[0018] Step S2.5: Use the image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector:

[0019] x * =m⊙x a +(1-m)⊙x b

[0020] y * =λy a +(1-λ)yb

[0021] Preferably, step S3 includes the following steps:

[0022] Step S3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈;

[0023] Step S3.2: Put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * );

[0024] Step S3.3: Calculate the derivative of the loss function with respect to the perturbation and the derivatives with respect to the parameters

[0025] Step S3.4: Perform gradient ascent on the input to obtain adversarial perturbation

[0026] Preferably, step S4 includes the following steps:

[0027] Step S4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * );

[0028] Step S4.2: Calculate the linear indicator value Ind=l(x * +δ,y * )-l(x * ,y * )+l(x * +kδ,y * )-l(x * ,y * ) / k;

[0029] Step S4.3: When Ind is greater than 0, execute step S4.4; when Ind is less than 0, execute step S4.5;

[0030] Step S4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of the logits becomes c, and obtain a new loss function;

[0031] Step S4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function.

[0032] Preferably, step S5 includes the following steps:

[0033] Step S5.1: Use the gradient of the loss obtained in step S3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ;

[0034] Step S5.2: Add the normalized gradient v to the model parameter w to obtain the worst-case model parameter w + v, that is, perform a gradient ascent on the model parameter;

[0035] Step S5.3: After obtaining the loss function in step S4, perform stochastic gradient descent via backpropagation;

[0036] Step S5.4: After updating the model parameters, subtract the parameter v added in step S5.1 to obtain the minimum flat loss.

[0037] Preferably, the image fusion enhancement FreqMask module is based on frequency domain sampling; the image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; and the flat loss optimizer prevents the model from falling into a local minimum.

[0038] The present invention also provides a general robust classifier training system based on single-step iteration, the system comprising the following modules:

[0039] Module M1: Initialize the convolutional backbone network and optimizer;

[0040] Module M2: Samples several samples from the training data set and feed them into the image fusion enhancement FreqMask module to generate enhanced samples;

[0041] Module M3: fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples;

[0042] Module M4: Feed the adversarial sample back into the backbone network and adjust the overall adversarial loss according to the linearity indicator;

[0043] Module M5: Derivative of the total loss with respect to the network parameters, backpropagation is performed after obtaining the gradient, and the flat loss optimizer updates the parameters;

[0044] Module M6: Repeatedly call modules M2-M5 until the loss function converges and a robust model is obtained.

[0045] Preferably, the module M2 includes the following modules:

[0046] Module M2.1: Randomly sample two samples from the training set, denoted as (xa ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W;

[0047] Module M2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d a , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient;

[0048] Module M2.3: Perform a Fourier shift on the frequency domain matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial domain matrix s.

[0049] Module M2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the proportion λ of the positions with a value of 1 in the image mask m to the total number of pixels;

[0050] Module M2.5: Use image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector:

[0051] x * =m⊙x a +(1-m)⊙x b

[0052] y * =λy a +(1-λ)y b

[0053] Preferably, the module M3 includes the following modules:

[0054] Module M3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈;

[0055] Module M3.2: put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * );

[0056] Module M3.3: Computing the derivative of the loss function with respect to perturbations and the derivatives with respect to the parameters

[0057] Module M3.4: Gradient ascent of the input to obtain adversarial perturbations

[0058] Preferably, the module M4 includes the following modules:

[0059] Module M4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * );

[0060] Module M4.2: Calculate the value of the linear indicator Ind = l(x * +δ,y * )-l(x * ,y * )+l(x * +kδ,y * )-l(x * ,y * ) / k;

[0061] Module M4.3: When Ind is greater than 0, execute module M4.4; when Ind is less than 0, execute module M4.5;

[0062] Module M4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of logits becomes c, and obtain a new loss function;

[0063] Module M4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function;

[0064] The module M5 includes the following modules:

[0065] Module M5.1: Use the gradient of the loss obtained in module M3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ;

[0066] Module M5.2: Add the normalized gradient v to the model parameters w to obtain the worst-case model parameters w + v, that is, perform a gradient ascent on the model parameters;

[0067] Module M5.3: After obtaining the loss function in Module M4, perform stochastic gradient descent via backpropagation.

[0068] Module M5.4: After updating the model parameters, subtract the parameter v added by module M5.1 to obtain the minimum flat loss;

[0069] The image fusion enhancement FreqMask module is based on frequency domain sampling; the image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; the flat loss optimizer prevents the model from falling into a local minimum.

[0070] Compared with the prior art, the present invention has the following beneficial effects:

[0071] 1. The data augmentation module of this invention overcomes the defect of the previous image fusion mask being fixed to a rectangular shape, effectively enhancing the data distribution and preventing the model from learning specific data augmentation. The large amount of new data obtained by augmentation effectively prevents adversarial training from falling into overfitting of the input samples;

[0072] 2. While maintaining adversarial robustness, this invention uses single-step iteration to significantly improve the efficiency of adversarial training and effectively shorten the training time. This enables adversarial training to be extended to large-scale datasets.

[0073] 3. The present invention has strong portability and universality and can be applied to different backbone networks and data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings:

[0075] Figure 1 Schematic diagram of fast reading adversarial training based on single-step iteration in an embodiment of the present invention;

[0076] Figure 2 This is a flow chart of a data fusion module based on frequency domain sampling in an embodiment of the present invention;

[0077] Figure 3 This is a diagram showing the effect of the frequency domain data fusion module on a sample image in an embodiment of the present invention;

[0078] Figure 4 The accuracy and robustness of the embodiments of the present invention are improved compared with the native method on the CIFAR10 test set;

[0079] Figure 5 3 is a comparison diagram of the effects on the loss surface in the embodiment of the present invention. DETAILED DESCRIPTION

[0080] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0081] Example 1:

[0082] According to the present invention, a general robust classifier training method based on single-step iteration is provided, the method comprising the following steps:

[0083] Step S1: Initialize the convolutional backbone network and optimizer;

[0084] Step S2: Sampling several samples from the training data set and sending them into the image fusion enhancement FreqMask module to generate enhanced samples;

[0085] Step S2.1: Randomly sample two samples from the training set, denoted as (x a ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W;

[0086] Step S2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d α , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient;

[0087] Step S2.3: Perform a Fourier shift on the frequency domain matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial domain matrix s.

[0088] Step S2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the ratio λ of the positions with a value of 1 in the image mask m to the total number of pixels;

[0089] Step S2.5: Use the image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector:

[0090] x * =m⊙x a +(1-m)⊙x b

[0091] y * =λy a +(1-λ)y b

[0092] Step S3: Fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples;

[0093] Step S3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈;

[0094] Step S3.2: Put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * );

[0095] Step S3.3: Calculate the derivative of the loss function with respect to the perturbation and the derivatives with respect to the parameters

[0096] Step S3.4: Perform gradient ascent on the input to obtain adversarial perturbation

[0097] Step S4: Send the adversarial sample to the backbone network again and adjust the overall adversarial loss according to the linearity indicator;

[0098] Step S4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * );

[0099] Step S4.2: Calculate the linear indicator value Ind=l(x * +δ,y * )-l(x * , y* ) +l(x * +kδ,y * )-l(x * ,y * ) / k;

[0100] Step S4.3: When Ind is greater than 0, execute step S4.4; when Ind is less than 0, execute step S4.5;

[0101] Step S4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of the logits becomes c, and obtain a new loss function;

[0102] Step S4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function.

[0103] Step S5: Derivative the total loss with respect to the network parameters, obtain the gradient, and then perform backpropagation. The flat loss optimizer updates the parameters.

[0104] Step S5.1: Use the gradient of the loss obtained in step S3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ;

[0105] Step S5.2: Add the normalized gradient v to the model parameter w to obtain the worst-case model parameter w + v, that is, perform a gradient ascent on the model parameter;

[0106] Step S5.3: After obtaining the loss function in step S4, perform stochastic gradient descent via backpropagation;

[0107] Step S5.4: After updating the model parameters, subtract the parameter v added in step S5.1 to obtain the minimum flat loss.

[0108] Step S6: Repeat steps S2 to S5 until the loss function converges and a robust model is obtained.

[0109] The image fusion enhancement FreqMask module is based on frequency domain sampling; the image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; the flat loss optimizer prevents the model from falling into the local minimum.

[0110] Example 2:

[0111] Example 2 is a preferred example of Example 1 and is used to illustrate the present invention in more detail.

[0112] The present invention also provides a general robust classifier training system based on single-step iteration, which includes the following modules:

[0113] Module M1: Initialize the convolutional backbone network and optimizer;

[0114] Module M2: Samples several samples from the training data set and feed them into the image fusion enhancement FreqMask module to generate enhanced samples;

[0115] Module M2.1: Randomly sample two samples from the training set, denoted as (x a ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W;

[0116] Module M2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d α , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient;

[0117] Module M2.3: Perform a Fourier shift on the frequency domain matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial domain matrix s.

[0118] Module M2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the proportion λ of the positions with a value of 1 in the image mask m to the total number of pixels;

[0119] Module M2.5: Use image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector:

[0120] x * =m⊙x a +(1-m)⊙x b

[0121] y * =λy a +(1-λ)y b

[0122] Module M3: fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples;

[0123] Module M3 includes the following modules:

[0124] Module M3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈;

[0125] Module M3.2: put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * );

[0126] Module M3.3: Computing the derivative of the loss function with respect to perturbations and the derivatives with respect to the parameters

[0127] Module M3.4: Gradient ascent of the input to obtain adversarial perturbations

[0128] Module M4: Feed the adversarial sample back into the backbone network and adjust the overall adversarial loss according to the linearity indicator;

[0129] Module M4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * );

[0130] Module M4.2: Calculate the value of the linear indicator Ind = l(x * +δ,y * )-l(x * ,y * )+l(x * +kδ,y * )-l(x * ,y * ) / k;

[0131] Module M4.3: When Ind is greater than 0, execute module M4.4; when Ind is less than 0, execute module M4.5;

[0132] Module M4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of logits becomes c, and obtain a new loss function;

[0133] Module M4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function;

[0134] Module M5: Derivative of the total loss with respect to the network parameters, backpropagation is performed after obtaining the gradient, and the flat loss optimizer updates the parameters;

[0135] Module M5.1: Use the gradient of the loss obtained in module M3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ;

[0136] Module M5.2: Add the normalized gradient v to the model parameters w to obtain the worst-case model parameters w + v, that is, perform a gradient ascent on the model parameters;

[0137] Module M5.3: After obtaining the loss function in Module M4, perform stochastic gradient descent via backpropagation.

[0138] Module M5.4: After updating the model parameters, subtract the parameter v added by module M5.1 to obtain the minimum flat loss;

[0139] Module M6: Repeatedly call modules M2-M5 until the loss function converges and a robust model is obtained.

[0140] The image fusion enhancement FreqMask module is based on frequency domain sampling; the image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; the flat loss optimizer prevents the model from falling into the local minimum.

[0141] Example 3:

[0142] Example 3 is a preferred example of Example 1 and is used to illustrate the present invention in more detail.

[0143] The present invention introduces a fast adversarial training process and method based on single-step iteration, including: using single-step iteration to quickly generate adversarial samples, and using a flat minimization loss optimizer to update the parameters of adversarial training.

[0144] Reference Figure 1 , the FreqMask image enhancement module, linear indicator, flat loss optimizer.

[0145] FreqMask image enhancement module: After sampling the low-frequency region in the frequency domain, it performs an inverse Fourier transform to obtain a mask for the continuous region in the spatial domain. It fuses the two images by bit-by-bit multiplication and generates the corresponding labels.

[0146] Linearity indicator: This refers to the linearity of the loss curve around clean samples, calculated based on the loss output. When the output value is negative, the loss curve becomes more distorted. Regularization may be needed to smooth the loss curve.

[0147] Flat optimizer: optimizes the model parameters in the worst case, making the loss surface of the model parameters flat around clean samples. It is used to improve the generalization performance of the model and prevent the model from falling into the local minimum.

[0148] The specific training methods are as follows:

[0149] Step S1: Load and preprocess the training data to the same shape. Initialize the convolutional feature extraction backbone network and optimizer. Set hyperparameters as needed.

[0150] Step S2: The training data generates enhanced samples through the image fusion module.

[0151] Furthermore, step S2 includes the following sub-steps:

[0152] Step S2.1: Randomly select a batch of samples from the training dataset, whose shape is H×W.

[0153] Step S2.2: Randomly sample a spectrum matrix f with a shape of H×W from a uniform distribution between -1 and 1, and multiply the (i, j) position in the matrix f by an adjustment coefficient 1 / d a , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 α is the pre-selected distance attenuation coefficient.

[0154] Step S2.3: Perform a Fourier shift so that the low-frequency region of the frequency domain matrix f moves from the center of the spectrum to the four corners of the spectrum, and then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial domain matrix s.

[0155] Step 2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the proportion λ of the positions with a value of 1 in the image mask m to the total number of pixels.

[0156] Step 2.5: Use the image mask m to fuse the two samples (xa, ya) and (xb, yb) to obtain a new training sample. Here, ⊙ is a bitwise multiplication operation. The label is encoded into a one-hot vector.

[0157] x*=m⊙xa+(1-m)⊙xb

[0158] y*=λya+(1-λ)yb

[0159] Step S3: Send the enhanced sample into the backbone network for back propagation to generate adversarial samples.

[0160] Furthermore, step S3 includes the following sub-steps:

[0161] Step S3.1: Randomly generate an initial perturbation δ with the same shape as the input x* and uniformly randomly sampled from -∈ to ∈.

[0162] Step S3.2: Add the initial perturbation δ to x* and send it to the backbone network. According to the label, the corresponding loss function l(x*+δ, y*) is obtained.

[0163] Step S3.3: Calculate the derivative of the loss function with respect to the perturbation and the derivatives with respect to the parameters

[0164] Step S3.4: Perform gradient ascent on the input x* to obtain the adversarial perturbation And the adversarial example x′=x*+δ′.

[0165] Step S4: Calculate the adversarial loss including the linearity control of the loss curve.

[0166] Furthermore, step S4 includes the following sub-steps:

[0167] Step S4.1: Send the adversarial sample x′ into the backbone network, and use the cross entropy loss function combined with the label information to obtain the adversarial loss l(x′, y*).

[0168] Step S4.2: Calculate the linear indicator value Ind=l(x * +δ,y * )-l(x * ,y * )+((l(x * +kδ,y * )-l(x * ,y * )) / k).

[0169] Step S4.3: When Ind is greater than 0, execute step S4.4. When Ind is less than 0, execute step S4.5.

[0170] Step S4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of logits becomes c, and then obtain the new loss function.

[0171] Step S4.5: Add β*Ind to the adversarial loss l(x′, y*) to obtain a new loss L=l(x′, y*) that includes the linearity of the loss curve. * +δ,y * )+β-max(0,Ind). The linear index Ind serves as both an indicator and a regularizer.

[0172] Step S5: While minimizing the loss, take into account the flatness of the loss surface and update the model parameters.

[0173] Furthermore, step S5 includes the following sub-steps:

[0174] Step S5.1: Use the gradient of the loss obtained in step S3 with respect to the model parameters The gradient is processed to obtain the normalized gradient v = γ||w||2 2 g / ||g||2 2 .

[0175] Step S5.2 adds the normalized gradient v to the model parameter w to obtain the worst-case model parameter w+v, that is, performs a gradient ascent on the model parameter.

[0176] Step S5.3: After obtaining the loss function in step S4, perform stochastic gradient descent via backpropagation

[0177] Step S5.4: After updating the model parameters, subtract the parameter v added in step S5.1 to obtain the minimum flat loss.

[0178] Step S6: Repeat steps S2-S5 until the loss curve converges and derive the robust model parameter weights.

[0179] This method improves the efficiency of adversarial training, avoids catastrophic overfitting in single-step adversarial training, and improves the robustness of single-step adversarial training. Figure 4 The figure uses the CIFAR10 dataset. The left side shows the learning curve for the original single-step adversarial training, and the right side shows the learning curve for our method. We can see that the original method suffers from catastrophic overfitting, with the Ind value becoming negative. However, our method ensures that the Ind value remains positive, thus maintaining the robustness of the model and preventing catastrophic overfitting. Figure 5 This method demonstrates the effect on the loss surface. Before the model falls into catastrophic overfitting, the loss surface is smooth and flat. However, after the model falls into overfitting, the loss surface becomes extremely distorted, and the single-step iterative method is unable to find suitable adversarial examples. This method flattens the loss surface again.

[0180] Compared with the prior art, this method uses single-step iteration to greatly improve the efficiency of adversarial training, while effectively avoiding the catastrophic overfitting problem in single-step iteration, and achieves accuracy and robustness comparable to that of the multi-step method. Those skilled in the art know that in addition to implementing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code format, it is entirely possible to implement the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0181] Those skilled in the art may understand this embodiment as a more specific description of Embodiment 1 and Embodiment 2.

[0182] The above describes specific embodiments of the present invention. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. The embodiments of this application and the features in the embodiments may be combined with each other in any manner unless there is a conflict.

Claims

1. A general robust classifier training method based on single-step iteration, characterized in that: The method comprises the following steps: Step S1: Initialize the convolutional backbone network and optimizer; Step S2: Sampling several samples from the training data set and sending them into the image fusion enhancement FreqMask module to generate enhanced samples; Step S3: Fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples; Step S4: Send the adversarial sample to the backbone network again and adjust the overall adversarial loss according to the linearity indicator; Step S5: Derivative the total loss with respect to the network parameters, obtain the gradient, and then perform backpropagation. The flat loss optimizer updates the parameters. Step S6: Repeat steps S2 to S5 until the loss function converges and a robust model is obtained; The image fusion enhancement FreqMask module samples the low-frequency region in the frequency domain, performs an inverse Fourier transform, and obtains a mask of the continuous region in the spatial domain. It then fuses the two images by bit-by-bit multiplication and generates corresponding labels. The linearity indicator calculates the linearity of the loss curve near the clean sample based on the loss output. When the output value is negative, the loss surface is more distorted, and a regularization term needs to be added to smooth the loss surface. The flat loss optimizer optimizes the model parameters in the worst case, making the loss surface of the model parameters flat around clean samples. It is used to improve the generalization performance of the model and prevent the model from falling into the local minimum.

2. The general robust classifier training method based on single-step iteration according to claim 1, characterized in that: The step S2 comprises the following steps: Step S2.1: Randomly sample two samples from the training data set, denoted as (x a ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W; Step S2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d α , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient; Step S2.3: Perform a Fourier shift on the spectrum matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial matrix s. Step S2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the ratio λ of the positions with a value of 1 in the image mask m to the total number of pixels; Step S2.5: Use the image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector: x * =m⊙x a +(1-m)⊙x b and * =λy a +(1-λ)y b 。 3. The general robust classifier training method based on single-step iteration according to claim 1, characterized in that: The step S3 comprises the following steps: Step S3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈; Step S3.2: Put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * ); Step S3.3: Calculate the derivative of the loss function with respect to the perturbation and the derivatives with respect to the parameters Step S3.4: Perform gradient ascent on the input to obtain adversarial perturbation 4. The general robust classifier training method based on single-step iteration according to claim 1, characterized in that: The step S4 comprises the following steps: Step S4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * ); Step S4.2: Calculate the value of the linearity indicator Ind = l(x * +δ,y * )-l(x * ,y * )+((l(x * +kδ,y * )-l(x * ,y * )) / k); Step S4.3: When Ind is greater than 0, execute step S4.4; when Ind is less than 0, execute step S4.5; Step S4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of the logits becomes c, and obtain a new loss function; Step S4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function.

5. The general robust classifier training method based on single-step iteration according to claim 1, characterized in that: The step S5 comprises the following steps: Step S5.1: Use the gradient of the loss obtained in step S3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ; Step S5.2: Add the normalized gradient v to the model parameter w to obtain the worst-case model parameter w + v, that is, perform a gradient ascent on the model parameter; Step S5.3: After obtaining the loss function in step S4, perform stochastic gradient descent via backpropagation; Step S5.4: After updating the model parameters, subtract the parameter v added in step S5.1 to obtain the minimum flat loss.

6. The general robust classifier training method based on single-step iteration according to claim 1, characterized in that: The image fusion enhancement FreqMask module is based on frequency domain sampling; the image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; the flat loss optimizer prevents the model from falling into a local minimum.

7. A general robust classifier training system based on single-step iteration, characterized in that: The system includes the following modules: Module M1: Initialize the convolutional backbone network and optimizer; Module M2: Samples several samples from the training data set and feed them into the image fusion enhancement FreqMask module to generate enhanced samples; Module M3: fix the backbone network parameters, send the enhanced samples into the backbone network for back propagation, and generate adversarial samples; Module M4: Feed the adversarial sample back into the backbone network and adjust the overall adversarial loss according to the linearity indicator; Module M5: Derivative of the total loss with respect to the network parameters, backpropagation is performed after obtaining the gradient, and the flat loss optimizer updates the parameters; Module M6: Repeatedly call modules M2-M5 until the loss function converges and a robust model is obtained; The image fusion enhancement FreqMask module samples the low-frequency region in the frequency domain, performs an inverse Fourier transform, and obtains a mask of the continuous region in the spatial domain. It then fuses the two images by bit-by-bit multiplication and generates corresponding labels. The linearity indicator calculates the linearity of the loss curve near the clean sample based on the loss output. When the output value is negative, the loss surface is more distorted, and a regularization term needs to be added to smooth the loss surface. The flat loss optimizer optimizes the model parameters in the worst case, making the loss surface of the model parameters flat around clean samples. It is used to improve the generalization performance of the model and prevent the model from falling into the local minimum.

8. The general robust classifier training system based on single-step iteration according to claim 7, characterized in that: The module M2 includes the following modules: Module M2.1: Randomly sample two samples from the training data set, denoted as (x a ,y a ), (x b ,y b ), where x represents the image data, y represents the corresponding label, and the shape of x is H×W; Module M2.2: Initialize a random spectrum matrix f with H rows and W columns, which is uniformly sampled from -1 to 1. For the position (i, j) in the matrix f, multiply it by an adjustment coefficient 1 / d α , d is the Euclidean distance from position (i, j) to the center of the matrix, that is, d = (iH / 2) 2 +(jW / 2) 2 ;α is the pre-selected distance attenuation coefficient; Module M2.3: Perform a Fourier shift on the spectrum matrix f so that the low-frequency region moves from the center of the spectrum to the four corners of the spectrum. Then perform an inverse fast Fourier transform on the centralized spectrum to obtain the spatial matrix s. Module M2.4: Binarize the spatial matrix s to obtain the image mask m, and calculate the proportion λ of the positions with a value of 1 in the image mask m to the total number of pixels; Module M2.5: Use image mask m to (x a ,y a ), (x b ,y b ) to fuse the two samples to obtain a new training sample; where ⊙ is a bit-by-bit multiplication operation, and the label is encoded into a one-hot vector: x * =m⊙x a +(1-m)⊙x b and * =λy a +(1-λ)y b 。 9. The general robust classifier training system based on single-step iteration according to claim 7, characterized in that: The module M3 includes the following modules: Module M3.1: Randomly generate a * The initial perturbation δ has the same shape and is uniformly randomly sampled from -∈ to ∈; Module M3.2: put x * After adding the initial perturbation δ, it is fed into the backbone network and the corresponding loss function l(x * +δ,y * ); Module M3.3: Computing the derivative of the loss function with respect to perturbations and the derivatives with respect to the parameters Module M3.4: Gradient ascent of the input to obtain adversarial perturbations 10. The general robust classifier training system based on single-step iteration according to claim 7, characterized in that: The module M4 includes the following modules: Module M4.1: Send the adversarial sample x″ into the backbone network to obtain the new adversarial loss l(x * +δ,y * ); Module M4.2: Calculate the value of the linearity indicator Ind = l(x * +δ,y * )-l(x * ,y * )+l(x * +kδ,y * )-l(x * ,y * ) / k; Module M4.3: When Ind is greater than 0, execute module M4.4; when Ind is less than 0, execute module M4.5; Module M4.4: Scale the unnormalized probability logits so that the difference between the maximum score and the second largest score of logits becomes c, and obtain a new loss function; Module M4.5: Keeping logits unchanged, the original loss function is added with the β*Ind regularization term to form a new loss function; The module M5 includes the following modules: Module M5.1: Use the gradient of the loss obtained in module M3 with respect to the model parameters And process the gradient to get the normalized gradient v = γ||w||2 2 g / ||g||2 2 ; Module M5.2: Add the normalized gradient v to the model parameters w to obtain the worst-case model parameters w + v, that is, perform a gradient ascent on the model parameters; Module M5.3: After obtaining the loss function in Module M4, perform stochastic gradient descent via backpropagation. Module M5.4: After updating the model parameters, subtract the parameter v added by module M5.1 to obtain the minimum flat loss; The image fusion enhancement FreqMask module is based on frequency domain sampling; The image fusion enhancement FreqMask module is used to enhance the fusion between training samples; the linearity indicator is used to control the direction of loss optimization during training; and the flat loss optimizer prevents the model from falling into a local minimum.

Images