Method for evaluating adversarial robustness of deep learning model and related device

Abstract

The application belongs to the field of deep learning security, and discloses a kind of adversarial robustness evaluation method and related device of deep learning model, including obtaining the pre-training quantization substitution model identical with the function of the to-be-evaluated deep learning model;The type of pre-training quantization substitution model is obtained, and according to the type of pre-training quantization substitution model, random quantization operation is introduced into the pre-training quantization substitution model to obtain a pre-processing substitution model;Obtain a plurality of image samples, and according to the pre-processing substitution model, obtain a plurality of adversarial image samples by transferring the adversarial attack algorithm;The plurality of adversarial image samples are input into the to-be-evaluated deep learning model, the output of the plurality of adversarial image samples is obtained, and the adversarial robustness evaluation result of the to-be-evaluated deep learning model is obtained according to the output of the plurality of adversarial image samples. Through the introduction of random quantization operation, the transferability of adversarial samples is improved, which can maximize the exposure of adversarial sample security risk and improve the reliability of adversarial robustness evaluation.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of deep learning security, and relates to an adversarial robustness evaluation method for a deep learning model and a related device. BACKGROUND

[0002] Deep learning has achieved the best performance on many tasks, such as image processing, speech recognition, and text processing. By using model quantization technology, deep learning models that originally require extremely high computational power can be deployed on embedded devices and Internet of Things devices with relatively low computing power, greatly expanding the application scenarios of deep learning models. However, in recent years, researchers have found that deep learning models are vulnerable to adversarial samples. Attackers can use this feature to generate adversarial samples by adding tiny perturbations that are not identifiable by the naked eye in normal samples, and use adversarial samples to deceive target deep learning models. The adversarial sample problem has threatened the security deployment and operation of deep learning models.

[0003] In image tasks, attackers generally apply adversarial perturbations by changing image pixel values. From the perspective of the attacker's understanding of the target deep learning model, adversarial attacks can be divided into white-box attacks and black-box attacks. Among them, white-box attacks assume that the attacker can obtain all information about the target deep learning model, including model gradient information, so that the attacker can directly use the backpropagation algorithm to generate adversarial samples. In real-world scenarios, the gradient information of the target deep learning model is often not available, so black-box attacks are more realistic, that is, the attacker can only obtain the prediction results of the target model. Because the gradient of the target deep learning model cannot be obtained, the attacker often uses transfer attacks to achieve black-box attacks. Transfer attacks refer to the attacker using model quantization to generate a local substitute model similar in function to the target model, then generating adversarial samples on the local substitute model, and then using the transferability of the adversarial samples to attack the target deep learning model, and finally evaluating the adversarial robustness of the target deep learning model according to the attack results.

[0004] However, since the method of generating a local substitute model similar in function to the target model by using model quantization will change the nature of the target deep learning model, thereby affecting the transferability of the adversarial samples, the adversarial samples generated in this form will not have good attack effects on the target deep learning model, thereby leading to unreliable evaluation results of the adversarial robustness of the deep learning model. SUMMARY

[0005] The purpose of the present application is to overcome the above-mentioned shortcomings of the prior art, that is, the unreliable evaluation results of the adversarial robustness of the deep learning model, and to provide an adversarial robustness evaluation method for a deep learning model and a related device.

[0006] To achieve the above object, the present application adopts the following technical solutions to achieve the above object:

[0007] In the first aspect of the present application, a method for evaluating the adversarial robustness of a deep learning model is provided, comprising:

[0008] Obtaining a pre-trained quantization replacement model with the same function as the deep learning model to be evaluated;

[0009] Obtaining the type of the pre-trained quantization replacement model, and introducing a random quantization operation into the pre-trained quantization replacement model according to the type of the pre-trained quantization replacement model to obtain a pre-processed replacement model;

[0010] Obtaining a plurality of image samples, and obtaining a plurality of adversarial image samples by using a transfer adversarial attack algorithm based on the pre-processed replacement model;

[0011] Inputting the plurality of adversarial image samples into the deep learning model to be evaluated to obtain the output of the plurality of adversarial image samples, and obtaining the evaluation result of the adversarial robustness of the deep learning model to be evaluated based on the output of the plurality of adversarial image samples.

[0012] Optionally, the obtaining of the pre-trained quantization replacement model with the same function as the deep learning model to be evaluated comprises:

[0013] Obtaining a deep learning model with the same classification target as the deep learning model to be evaluated, and trained based on a simulation quantization technology on a data set identical to or similar to the data set of the deep learning model to be evaluated to obtain the pre-trained quantization replacement model.

[0014] Optionally, the type of the pre-trained quantization replacement model comprises a quantization-aware training model trained based on a simulation quantization technology and a post-training quantization model based on a simulation quantization technology.

[0015] Optionally, when the type of the pre-trained quantization replacement model is a quantization-aware training model trained based on a simulation quantization technology, the introduction of the random quantization operation into the pre-trained quantization replacement model comprises:

[0016] Randomly selecting a depth value before each forward propagation of the pre-trained quantization replacement model, so that all layers of the pre-trained quantization replacement model before the depth value use full-precision activation values, and all layers of the pre-trained quantization replacement model after the depth value use quantized activation values, and all layers of the pre-trained quantization replacement model use quantized weights.

[0017] Optionally, before the obtaining of the plurality of adversarial image samples based on the pre-processed replacement model by using the transfer adversarial attack algorithm, the method further comprises:

[0018] Obtaining a training set of the pre-trained quantization replacement model;

[0019] The pre-training quantization substitute model is trained by a training set of the pre-training quantization substitute model, until an accuracy of the pre-training quantization substitute model is not less than a preset accuracy threshold.

[0020] Optionally, when the type of the pre-training quantization substitute model is a post-training quantization model based on analog quantization technology, the introducing of the random quantization operation in the pre-training quantization substitute model comprises:

[0021] Before each forward propagation of the pre-training quantization substitute model, it is randomly determined whether to use quantization, if quantization is used, all layers of the pre-training quantization substitute model use quantized weights and quantized activation values, and if quantization is not used, all layers of the pre-training quantization substitute model use original weights and original activation values.

[0022] Optionally, the obtaining of the plurality of adversarial image samples by the transfer adversarial attack algorithm comprises:

[0023] The disturbance step is iteratively performed on each image sample until a predetermined number of iterations is reached, and a plurality of adversarial image samples are obtained; wherein the disturbance step comprises: inputting the image sample into the pre-processing substitute model to obtain an output loss value of the image sample, and calculating a gradient matrix of the output loss value with respect to the image sample by a back propagation mechanism, and superimposing a preset step size of disturbance on the image sample in the disturbance direction of the gradient matrix.

[0024] In the second aspect of the present application, a system for evaluating adversarial robustness of a deep learning model is provided, comprising:

[0025] An acquisition module is configured to acquire a pre-training quantization substitute model having the same function as a deep learning model to be evaluated;

[0026] A preprocessing module is configured to acquire a type of the pre-training quantization substitute model, and introduce a random quantization operation in the pre-training quantization substitute model according to the type of the pre-training quantization substitute model, to obtain a pre-processing substitute model;

[0027] A generation module is configured to acquire a plurality of image samples, and obtain a plurality of adversarial image samples by a transfer adversarial attack algorithm according to the pre-processing substitute model;

[0028] An evaluation module is configured to input the plurality of adversarial image samples into the deep learning model to be evaluated, to obtain outputs of the plurality of adversarial image samples, and obtain an evaluation result of adversarial robustness of the deep learning model to be evaluated according to the outputs of the plurality of adversarial image samples.

[0029] In the third aspect of the present application, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method for evaluating adversarial robustness of a deep learning model.

[0030] In a fourth aspect, the present application provides a computer readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for evaluating the adversarial robustness of a deep learning model.

[0031] Compared with the prior art, the present application has the following beneficial effects:

[0032] The method for evaluating the adversarial robustness of a deep learning model improves the black-box transferability of the generated adversarial image samples from the perspective of improving the pre-processing substitute model. Specifically, the random quantization operation with randomness is introduced into the pre-training quantization substitute model to obtain the pre-processing substitute model, so that the pre-processing substitute model can exhibit multiple different quantization states during runtime, alleviating the overfitting problem in the adversarial sample generation process, thereby helping to generate adversarial samples with higher transferability. Therefore, the adversarial image samples generated based on the pre-processing substitute model can achieve a high attack success rate on both the full-precision deep learning model to be evaluated and the quantized deep learning model to be evaluated, so that the attacker can still achieve effective adversarial attack in the black-box scenario where the quantization state of the deep learning model to be evaluated is unknown. The transfer attack algorithm is highly combined, thereby further improving the transferability of the adversarial image samples, maximizing the exposure of the adversarial sample security risks of the deep learning model to be evaluated, and further improving the reliability of the evaluation results of the adversarial robustness of the deep learning model, thereby assisting the security deployment and security risk control of the deep learning model to be evaluated. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 The flowchart of the method for evaluating the adversarial robustness of a deep learning model of the embodiment of the present application.

[0034] Figure 2 The principle diagram of the method for evaluating the adversarial robustness of a deep learning model of the embodiment of the present application.

[0035] Figure 3 The principle diagram of the random quantization operation of the embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0037] It should be noted that the terms "first", "second", and the like in the description and in the claims of the present application and in the above-described drawings are intended to distinguish similar objects and not necessarily describe a particular chronological or sequential order. It should be understood that the data thus used can be interchanged, where appropriate, so that the embodiments of the application described herein can be practiced in other than the illustrated or described order. Furthermore, the terms "comprise" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, processes, methods, systems, products, or devices that include a list of steps or units not necessarily limited to those clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products, or devices.

[0038] The application will be described in further detail below with reference to the drawings:

[0039] Referring to Figure 1 In an embodiment of the present application, a method for evaluating the adversarial robustness of a deep learning model is provided, which helps the model owner to more reliably verify the adversarial robustness of the deep learning model.

[0040] Specifically, the method for evaluating the adversarial robustness of the deep learning model includes the following steps:

[0041] S1: Obtain a pre-trained quantization substitute model with the same function as the deep learning model to be evaluated.

[0042] S2: Obtain the type of the pre-trained quantization substitute model, and according to the type of the pre-trained quantization substitute model, introduce a random quantization operation in the pre-trained quantization substitute model to obtain a pre-processed substitute model.

[0043] S3: Obtain a plurality of image samples, and according to the pre-processed substitute model, obtain a plurality of adversarial image samples by using a transfer adversarial attack algorithm.

[0044] S4: Input the plurality of adversarial image samples to the deep learning model to be evaluated to obtain the outputs of the plurality of adversarial image samples, and according to the outputs of the plurality of adversarial image samples, obtain the evaluation result of the adversarial robustness of the deep learning model to be evaluated.

[0045] Referring to Figure 2, the basic principle of the adversarial robustness evaluation method of the deep learning model of the present application is shown, including two parts of SQE (Self Quantization Ensemble, self quantization ensemble) model training and attack iteration process. By introducing a random quantization operation T into the pre-trained quantization substitute model (i.e. the SQE model), a pre-processing substitute model is obtained. The pre-processing substitute model can exhibit multiple quantization states during runtime, thereby integrating the full-precision substitute model and the quantization substitute model in a single model, thereby avoiding the overfitting problem in the black-box migration adversarial sample generation process, and ultimately improving the migration attack success rate of the adversarial sample. After the pre-processing substitute model is trained, the pre-processing substitute model can be used to generate adversarial samples, and then the adversarial samples are used to implement a migration attack with a higher success rate on the deep learning model to be evaluated, and then the adversarial robustness evaluation is realized according to the migration attack result.

[0046] In summary, the adversarial robustness evaluation method of the deep learning model of the present application essentially improves the black-box migration of the generated adversarial image samples from the perspective of improving the pre-processing substitute model. Specifically, by introducing a random quantization operation with randomness into the pre-trained quantization substitute model, a pre-processing substitute model is obtained, so that the pre-processing substitute model can exhibit multiple different quantization states during runtime, thereby reducing the overfitting problem in the adversarial sample generation process, thereby helping to generate adversarial samples with higher migration. Therefore, the adversarial image samples generated based on the pre-processing substitute model can achieve a higher attack success rate on both the full-precision deep learning model to be evaluated and the quantized deep learning model to be evaluated, thereby enabling the attacker to still achieve effective adversarial attack in the black-box scenario where the quantization state of the deep learning model to be evaluated cannot be known. Highly combined with the migration attack algorithm, thereby further improving the migration of the adversarial image samples, which can maximize the exposure of the adversarial sample security risk of the deep learning model to be evaluated, and then the reliability of the evaluation result of the adversarial robustness of the deep learning model, assisting the security deployment and security risk control of the deep learning model to be evaluated.

[0047] In one possible implementation, the pre-training quantization substitute model with the same function as the deep learning model to be evaluated includes: obtaining a deep learning model with the same classification target as the deep learning model to be evaluated, and trained based on a simulation quantization technology on a data set identical to or similar to the data set of the deep learning model to be evaluated, to obtain a pre-training quantization substitute model.

[0048] Optionally, the type of the pre-training quantization substitute model includes: a quantization-aware training model based on a simulation quantization technology and a post-training quantization model based on a simulation quantization technology.

[0049] The compatibility considers two mainstream quantization processes, namely, quantization-aware training and post-training quantization. Based on the compatibility of the two quantization methods, the adversarial robustness evaluation method of the deep learning model can be applied to various scenes, and the flexibility of the method is enhanced.

[0050] In a possible implementation, when the type of the pre-trained quantization substitute model is a quantization-aware training model trained based on the analog quantization technology, the introducing the random quantization operation in the pre-trained quantization substitute model comprises: before each round of forward propagation of the pre-trained quantization substitute model, randomly selecting a depth value, so that the pre-trained quantization substitute model uses full-precision activation values for all layers before the depth value, uses quantized activation values for all layers after the depth value, and all layers of the pre-trained quantization substitute model use quantized weights.

[0051] Referring to Figure 3 , specifically, for the pre-trained quantization substitute model of the type of the quantization-aware training model trained based on the analog quantization technology, different quantization states can be determined layer by layer when the random quantization operation is introduced. Specifically, a random layer number h can be determined before each round of forward propagation, all layers before the h-th layer are closed for activation value quantization, and full-precision activation values are used for backward propagation; all layers after the h-th layer are opened for activation value quantization, and quantized activation values are used for backward propagation. At the same time, the weights of each layer all use quantized weights.

[0052] When the type of the pre-trained quantization substitute model is a post-training quantization model based on the analog quantization technology, the introducing the random quantization operation in the pre-trained quantization substitute model comprises: before each round of forward propagation of the pre-trained quantization substitute model, randomly selecting whether to use quantization, if quantization is used, all layers of the pre-trained quantization substitute model use quantized weights and quantized activation values; if quantization is not used, all layers of the pre-trained quantization substitute model use original weights and original activation values.

[0053] Referring to Figure 3 again, specifically, for the pre-trained quantization substitute model of the type of the post-training quantization model based on the analog quantization technology, when the random quantization operation is introduced, the randomness of the quantization state needs to be considered from the whole of the pre-trained quantization substitute model. Specifically, whether to start quantization can be randomly selected before each round of forward propagation. If yes, weight quantization and activation value quantization are started for all layers to perform forward propagation; if no, full-precision weights and activation values are used to perform forward propagation.

[0054] The quantized weights and the quantized activation values can be obtained based on the full-precision weights and the activation values through a weight quantization operator and an activation value quantization operator. The weight quantization operator and the activation value quantization operator can be obtained by using an existing quantization algorithm.

[0055] In a possible implementation, when the type of the pre-trained quantization substitute model is a quantization-aware training model trained based on the analog quantization technology, before the step of obtaining a plurality of adversarial image samples by migrating the adversarial attack algorithm, the method further includes: obtaining a training set of the pre-trained quantization substitute model; and training the pre-processing substitute model based on the training set of the pre-trained quantization substitute model until an accuracy of the pre-processing substitute model is not less than a preset accuracy threshold.

[0056] Specifically, for the pre-trained quantization substitute model of the quantization-aware training model based on the analog quantization technology, the random quantization operation needs to be started during training, to ensure that the normal accuracy of the pre-processing substitute model will not be greatly reduced when the random quantization operation is started during running. For the pre-trained quantization substitute model of the post-training quantization model based on the analog quantization technology, fine-tuning is not needed.

[0057] In a possible implementation, the step of obtaining a plurality of adversarial image samples by migrating the adversarial attack algorithm includes: iteratively performing a perturbation step on each image sample until a predetermined number of iterations is reached, to obtain the plurality of adversarial image samples; and the perturbation step includes: inputting the image sample into the pre-processing substitute model to obtain an output loss value of the image sample, and calculating a gradient matrix of the output loss value with respect to the image sample by using a back propagation mechanism, and superimposing a preset step size of perturbation on the image sample in a direction of the gradient matrix.

[0058] Specifically, the plurality of adversarial image samples are obtained by migrating the adversarial attack algorithm, and any kind of migration adversarial attack algorithm can be used. In this embodiment, a classic migration attack algorithm MI-FGSM is taken as an example to introduce the process.

[0059] S401: First, input an image sample to obtain an output loss value of the pre-processing substitute model.

[0060] S402: Use a back propagation mechanism to calculate a gradient matrix of the output loss value with respect to the input image sample.

[0061] S403: Take the direction of the gradient matrix calculated in S402 as a perturbation direction, superimpose a perturbation on the image sample with a certain fixed step size, and optimize by using a momentum gradient descent method. The momentum gradient descent method is a common optimization algorithm, which weights and averages the gradient direction calculated at the current time and the gradient direction at the last iteration round to obtain a new gradient direction. This method can improve the stability of the optimization process, and thus improve the attack success rate of the adversarial sample. Then return to S401 for repeated iteration until a predetermined number of iterations is reached.

[0062] It can be seen that the adversarial robustness evaluation method of the deep learning model has the advantages that, due to the consideration of the quantization factor in the preprocessing substitute model, a single preprocessing substitute model can exhibit multiple quantization states at runtime, thereby improving the transferability of the adversarial sample. The algorithm framework of the present application is flexible and has a plug-in feature, which is compatible with two quantization processes, quantization-aware training and post-training quantization, and is also compatible with other black-box transfer attack algorithms, giving attackers greater flexibility and higher attack success rate. The present application can more reliably evaluate the adversarial attack security risk of the deep learning quantization model in a real scene, thereby providing certain help for the landing deployment and security risk prevention of the deep learning model.

[0063] In a possible implementation, it is verified through experiments that, even if the network structure, quantization method and quantization precision of the deep learning model to be evaluated are different, the present application can achieve a good transfer attack success rate on most target models, and further obtain a more reliable adversarial robustness evaluation result.

[0064] Experiments on two typical data sets CIFAR-10 and ImageNet show that the adversarial robustness evaluation method of the deep learning model can be applied to different data scale task scenarios. Compatibility experiments with other transfer attack algorithms show that the present application is fully compatible with other transfer attack algorithms, and can further improve the transfer attack success rate for deep learning quantization models. The above experiments prove that the present application not only achieves the expected target well, but also has good expansibility and flexibility.

[0065] The following is an apparatus embodiment of the present application, which can be used to execute the method embodiment of the present application. For details not disclosed in the apparatus embodiment, please refer to the method embodiment of the present application.

[0066] In another embodiment of the present application, an adversarial robustness evaluation system of a deep learning model is provided, which can be used to implement the adversarial robustness evaluation method of the deep learning model described above. Specifically, the adversarial robustness evaluation system of the deep learning model comprises an acquisition module, a preprocessing module, a generation module and an evaluation module.

[0067] The obtaining module is configured to obtain a pre-training quantization substitute model having the same function as the to-be-evaluated deep learning model; the preprocessing module is configured to obtain a type of the pre-training quantization substitute model, and introduce a random quantization operation into the pre-training quantization substitute model according to the type of the pre-training quantization substitute model, to obtain a preprocessed substitute model; the generating module is configured to obtain a plurality of image samples, and obtain a plurality of adversarial image samples by using a transfer adversarial attack algorithm based on the preprocessed substitute model; and the evaluation module is configured to input the plurality of adversarial image samples into the to-be-evaluated deep learning model, obtain an output of the plurality of adversarial image samples, and obtain an adversarial robustness evaluation result of the to-be-evaluated deep learning model based on the output of the plurality of adversarial image samples.

[0068] In a possible implementation, the obtaining of the pre-training quantization substitute model having the same function as the to-be-evaluated deep learning model includes: obtaining a deep learning model having a same classification target as the to-be-evaluated deep learning model and trained based on a simulation quantization technology on a same data set as a data set of the to-be-evaluated deep learning model or a data set similar to the data set of the to-be-evaluated deep learning model by less than a preset value, to obtain the pre-training quantization substitute model.

[0069] In a possible implementation, the type of the pre-training quantization substitute model includes: a quantization-aware training model trained based on the simulation quantization technology and a post-training quantization model based on the simulation quantization technology.

[0070] In a possible implementation, when the type of the pre-training quantization substitute model is the quantization-aware training model trained based on the simulation quantization technology, the introducing of the random quantization operation into the pre-training quantization substitute model includes: randomly selecting a depth value before each forward propagation of the pre-training quantization substitute model, so that all layers of the pre-training quantization substitute model before the depth value use full-precision activation values, all layers of the pre-training quantization substitute model after the depth value use quantized activation values, and all layers of the pre-training quantization substitute model use quantized weights.

[0071] In a possible implementation, before the obtaining of the plurality of adversarial image samples based on the preprocessed substitute model by using the transfer adversarial attack algorithm, the method further includes: obtaining a training set of the pre-training quantization substitute model; and training the preprocessed substitute model based on the training set of the pre-training quantization substitute model, until an accuracy of the preprocessed substitute model is not less than a preset accuracy threshold.

[0072] In a possible implementation, when the type of the pre-trained quantization substitute model is a post-training quantization model based on analog quantization technology, the introducing random quantization operations in the pre-trained quantization substitute model comprises: before each round of forward propagation of the pre-trained quantization substitute model, randomly selecting whether to use quantization, if quantization is used, all layers of the pre-trained quantization substitute model use quantized weights and quantized activation values; if quantization is not used, all layers of the pre-trained quantization substitute model use original weights and original activation values.

[0073] In a possible implementation, the obtaining a plurality of adversarial image samples through the transfer adversarial attack algorithm comprises: iteratively performing a perturbation step on each image sample to a predetermined number of iterations to obtain a plurality of adversarial image samples; wherein the perturbation step comprises: inputting the image sample into the pre-processing substitute model to obtain an output loss value of the image sample, and calculating a gradient matrix of the output loss value with respect to the image sample through a back propagation mechanism, and superimposing a preset step size of perturbation on the image sample in the gradient matrix as a perturbation direction.

[0074] The foregoing embodiments of the adversarial robustness evaluation method of the deep learning model involve all related contents of each step, which can be referred to the function description of the function module corresponding to the adversarial robustness evaluation system of the deep learning model in the embodiments of the present application, and will not be repeated here.

[0075] The division of the modules in the embodiments of the present application is illustrative, and is only a logical function division. In actual implementation, another division manner can be used. In addition, each function module in each embodiment of the present application can be integrated in one processor, or can be physically separated, or two or more modules can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module.

[0076] In another embodiment of the present application, a computer device is provided, which comprises a processor and a memory, the memory is configured to store a computer program, the computer program comprises program instructions, and the processor is configured to execute the program instructions stored in the computer storage medium. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., which are the computing core and control core of the terminal, and are suitable for implementing one or more instructions, and are particularly suitable for loading and executing one or more instructions in the computer storage medium to implement a corresponding method process or a corresponding function; the processor in the embodiments of the present application can be used for the operation of the adversarial robustness evaluation method of the deep learning model.

[0077] In another embodiment of the present application, the present application further provides a storage medium, specifically a computer readable storage medium (Memory), which is a memory device in a computer device, and is configured to store programs and data. It can be understood that the computer readable storage medium herein can include an internal storage medium in the computer device, and of course can also include an expansion storage medium supported by the computer device. The computer readable storage medium provides a storage space, and the storage space stores an operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and the instructions can be one or more computer programs (including program codes). It should be noted that the computer readable storage medium herein can be a high-speed RAM memory, or a non-volatile memory such as at least one disk memory. One or more instructions stored in the computer readable storage medium can be loaded and executed by the processor to implement the corresponding steps of the adversarial robustness evaluation method of the deep learning model in the above embodiments.

[0078] Those skilled in the art will appreciate that embodiments of the application can be devised for a method, a system, or a computer program product. Accordingly, the present application can be embodied in the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0079] The present application is described in reference to the flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0080] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart illustrations and / or block diagrams. Figure 1 one or more functions specified in one or more of the flowchart illustrations and / or block diagrams. Figure 1 means for performing one or more functions specified in one or more of the flowchart illustrations and / or block diagrams.

[0082] Finally, it should be noted that the above-mentioned embodiments are merely intended for describing and illustrating, not limiting, the technical solutions of the present application. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the specific embodiments of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the present application, and any modifications or equivalent replacements without departing from the spirit and scope of the present application should be covered in the protection scope of the claims of the present application.

Claims

1. A method for evaluating the adversarial robustness of a deep learning model, characterized in that, include: Obtain a pre-trained quantized alternative model with the same functionality as the deep learning model to be evaluated; Obtain the type of the pre-trained quantization alternative model, and based on the type of the pre-trained quantization alternative model, introduce random quantization operation into the pre-trained quantization alternative model to obtain the pre-processed alternative model; Several image samples are obtained, and several adversarial image samples are obtained through a transfer adversarial attack algorithm based on a preprocessing substitution model. Several adversarial image samples are input into the deep learning model to be evaluated, and several adversarial image samples are output. Based on the output of several adversarial image samples, the adversarial robustness evaluation result of the deep learning model to be evaluated is obtained. The acquisition of pre-trained quantized alternative models that have the same functionality as the deep learning model to be evaluated includes: Obtain a pre-trained quantized substitute model by acquiring a deep learning model that has the same classification objective as the deep learning model to be evaluated and is trained on a dataset that is the same as the dataset of the deep learning model to be evaluated or on a dataset with a similarity of less than a preset value, based on simulated quantization techniques. The types of the pre-trained quantization alternative models include: quantization perception training models based on analog quantization technology and post-trained quantization models based on analog quantization technology; When the type of the pre-trained quantization substitution model is a quantization-aware training model trained based on simulated quantization techniques, the introduction of random quantization operations into the pre-trained quantization substitution model includes: Before each forward propagation of the pre-trained quantized substitution model, a depth value is randomly selected, so that all layers of the pre-trained quantized substitution model before the depth value use full-precision activation values, and all layers after the depth value use quantized activation values, and all layers of the pre-trained quantized substitution model use quantized weights. When the type of the pre-trained quantization alternative model is a post-trained quantization model based on analog quantization technology, the introduction of random quantization operation in the pre-trained quantization alternative model includes: Before each forward propagation of the pre-trained quantized alternative model, it is randomly selected whether to use quantization. If quantization is used, all layers of the pre-trained quantized alternative model use quantized weights and quantized activation values; if quantization is not used, all layers of the pre-trained quantized alternative model use the original weights and original activation values.

2. The adversarial robustness evaluation method for deep learning models according to claim 1, characterized in that, Before obtaining several adversarial image samples through a transfer adversarial attack algorithm based on the preprocessing substitution model, the process also includes: Obtain the training set of the pre-trained quantization alternative model; The preprocessed alternative model is trained using the training set of the pre-trained quantized alternative model until the accuracy of the preprocessed alternative model is not lower than a preset accuracy threshold.

3. The adversarial robustness evaluation method for deep learning models according to claim 1, characterized in that, The adversarial image samples obtained through the migration adversarial attack algorithm include: Each image sample is iteratively perturbed up to a predetermined number of times to obtain several adversarial image samples. The perturbing step includes: inputting the image sample into the preprocessing substitution model to obtain the output loss value of the image sample, calculating the gradient matrix of the output loss value with respect to the image sample through the backpropagation mechanism, and superimposing a perturbation of a predetermined step size on the image sample with the gradient matrix as the perturbation direction.

4. A system for evaluating the adversarial robustness of a deep learning model based on the adversarial robustness evaluation method of the deep learning model according to claim 1, characterized in that, include: The acquisition module is used to acquire a pre-trained quantized alternative model that has the same functionality as the deep learning model to be evaluated. The preprocessing module is used to obtain the type of the pre-trained quantization alternative model and, based on the type of the pre-trained quantization alternative model, introduce random quantization operations into the pre-trained quantization alternative model to obtain the pre-processed alternative model. The generation module is used to acquire several image samples and, based on the preprocessing substitution model, obtain several adversarial image samples through a transfer adversarial attack algorithm. The evaluation module is used to input several adversarial image samples into the deep learning model to be evaluated, obtain the output of several adversarial image samples, and obtain the adversarial robustness evaluation result of the deep learning model to be evaluated based on the output of several adversarial image samples.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the adversarial robustness evaluation method for the deep learning model as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the adversarial robustness evaluation method for the deep learning model as described in any one of claims 1 to 3.

Images