A training method, system and model for improving the adversarial performance of a neural network model

Abstract

The present application relates to a kind of training methods for improving the adversarial performance of neural network model, comprising the following steps: obtaining training sample and its sample label;The training sample is input into the representation layer of neural network model, and the original feature of the training sample in representation space is extracted;The original feature is sampled several times, and the several sampling features corresponding to the original feature are obtained;Each sampling feature is input into the output layer of the neural network model, and the processing result output by the output layer is obtained;According to the sample label and the processing result, determine the loss, and minimize the loss as training target, train the neural network model.Correspondingly, the present application discloses a training system and model for improving the adversarial performance of neural network model.The present application improves the coverage of model to representation space in training process, improves the ability of model adversarial attack, and has the advantages of generalization and easy implementation.

Description

Technical Field

[0001] This invention relates to the field of adversarial model technology, and more specifically to a training method, system, and model for improving the adversarial performance of neural network models. Background Technology

[0002] Neural network models, due to their powerful information representation capabilities, are applied to many complex real-world problems. However, adversarial attacks are ubiquitous in these applications, posing a potential threat to neural network models. Attackers introduce slight perturbations into the original samples to alter the model's output, thereby affecting subsequent policy behavior. For example, since training data cannot possibly contain all samples, the sample space is discontinuous, making classification models vulnerable to attack. Consequently, in high-dimensional representation spaces, samples near the classification hyperplane, when subjected to small perturbations, lack constraints, potentially altering the classification results. Therefore, researching defenses against adversarial attacks on deep learning models and improving their adversarial performance is of crucial practical significance.

[0003] Existing adversarial attack schemes primarily focus on sample augmentation to increase the diversity of training samples. However, this approach requires specific sample augmentation design for particular scenarios, lacks universality, and is difficult to implement. Summary of the Invention

[0004] One of the objectives of this invention is to provide a training method for improving the adversarial performance of neural network models. This method adds a variational network layer, which makes the representation of training samples spatially continuous, effectively enhancing the adversarial performance of the model. It is also universal and easy to implement.

[0005] Based on the aforementioned objective, this invention proposes a training method to improve the adversarial performance of neural network models, comprising the following steps:

[0006] Obtain training samples and their labels;

[0007] The training samples are input into the representation layer of the neural network model to extract the original features of the training samples in the representation space.

[0008] The original features are sampled several times to obtain several sampled features corresponding to the original features;

[0009] Each sampled feature is input into the output layer of the neural network model to obtain the processing result output by the output layer;

[0010] The loss is determined based on the sample labels and the processing results, and the neural network model is trained with minimizing the loss as the training objective.

[0011] Furthermore, the sampling includes resampling.

[0012] Furthermore, the resulting sampled features corresponding to the original features include:

[0013] The original features are input into the variational network layer of the neural network model to obtain the sampling parameters output by the variational network layer;

[0014] Based on the sampling parameters, a specified neighborhood range of the original feature is determined, and the sampling probability of sampling each smallest unit within the specified neighborhood range is determined.

[0015] Within the specified domain, the original features are resampled several times based on the sampling probability.

[0016] Furthermore, the sampling parameters include multidimensional Gaussian distribution parameters.

[0017] Furthermore, the loss includes the difference between the sample labels and the processing results.

[0018] Another object of the present invention is a training system for improving the adversarial performance of neural network models, comprising:

[0019] The acquisition module is set to acquire training samples and their labels.

[0020] The extraction module is configured to input the training samples into the representation layer of the neural network model and extract the original features of the training samples in the representation space.

[0021] The generation module is configured to perform several samplings on the original features to obtain several sampled features corresponding to the original features;

[0022] The calculation module is configured to input each sampled feature into the output layer of the neural network model to obtain the processing result output by the output layer;

[0023] The training module is configured to determine the loss based on the sample labels and the processing results, and train the neural network model with the goal of minimizing the loss.

[0024] Furthermore, the generation module includes:

[0025] The data processing unit is configured to input the original features into the variational network layer of the neural network model to obtain the sampling parameters output by the variational network layer;

[0026] The data analysis unit is configured to determine a specified neighborhood range of the original feature based on the sampling parameters, and to determine the sampling probability of sampling each smallest unit within the specified neighborhood range.

[0027] The sampling unit is configured to resample the original feature several times based on the sampling probability within the specified domain.

[0028] Another objective of this invention is to provide a training model for improving the adversarial performance of neural network models, comprising a representation layer, a variational network layer, and an output layer connected in sequence, wherein...

[0029] The representation layer is configured to receive training samples and their labels, and extract the original features of the training samples in the representation space.

[0030] The variational network layer is configured to receive the original features and sample the original features several times to obtain several sampled features corresponding to the original features;

[0031] The output layer is configured to receive the sampled features and process each sampled feature to obtain the processing result;

[0032] The output of the output layer is connected to the input of the representation layer to determine the loss based on the sample labels of the training samples and the processing results, and to train the neural network model with the goal of minimizing the loss.

[0033] Furthermore, the variational network layer is configured to receive the original features and obtain sampling parameters; then, based on the sampling parameters, determine a specified neighborhood range of the original features and determine the sampling probability for sampling each smallest unit within the specified neighborhood range; finally, within the specified neighborhood range, the original features are resampled several times based on the sampling probability.

[0034] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the above-described training method for improving the adversarial performance of a neural network model.

[0035] The present invention also provides a computing device including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it executes the above-described training method for improving the adversarial performance of a neural network model.

[0036] The training method, system, and model for improving the adversarial performance of neural network models described in this invention have the following beneficial effects:

[0037] First, this invention proposes a variational network layer, which, after resampling, can greatly improve the model's coverage of the representation space during training, thereby enhancing the model's ability to resist attacks.

[0038] Secondly, compared with existing adversarial attack schemes, this invention has the advantages of being universal and easy to implement, and can be combined with almost any depth representation model. Attached Figure Description

[0039] Figure 1 This is a flowchart illustrating one implementation of the training method for improving the adversarial performance of neural network models according to the present invention.

[0040] Figure 2 An exemplary diagram of the system architecture of the training system for improving the adversarial performance of neural network models according to one embodiment of the present invention is shown.

[0041] Figure 3 An exemplary diagram of the system architecture of the training model for improving the adversarial performance of neural network models according to one embodiment of the present invention is shown. Detailed Implementation

[0042] The method and system for improving the adversarial performance of deep learning models according to the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. However, this detailed description does not constitute a limitation of the present invention.

[0043] In one embodiment of the present invention, a training method for improving the adversarial performance of neural network models is proposed. Figure 1 An exemplary flowchart of one implementation of the training method for improving the adversarial performance of neural network models according to the present invention is shown.

[0044] like Figure 1 As shown, the training method for improving the adversarial performance of a neural network model includes the following steps:

[0045] 100: Obtain the training samples and their labels.

[0046] 200: Input the training samples into the representation layer of the neural network model to extract the original features of the training samples in the representation space.

[0047] 300: Perform several resampling operations on the original features to obtain several sampled features corresponding to the original features.

[0048] 400: Input each sampled feature into the output layer of the neural network model to obtain the processing result output by the output layer.

[0049] 500: Determine the loss based on the sample labels and the processing results, and train the neural network model with minimizing the loss as the training objective. The loss includes the difference between the processing results output by the output layer and the sample labels of the training samples. The trained neural network model exhibits significantly improved adversarial performance compared to the original neural network model.

[0050] The aforementioned sampled features are generated through the variational network layer of the neural network model, which is located between the representation layer and the output layer of the neural network model.

[0051] Specifically, the method for generating post-sampling features includes the following steps:

[0052] 301: The original features are input into the variational network layer of the neural network model to generate a multidimensional Gaussian distribution. The parameters of the multidimensional Gaussian distribution are the sampling parameters output by the variational network layer. The multidimensional Gaussian distribution is described by the following formula:

[0053]

[0054]

[0055] In the formula, μ and σ i (i = 1, 2, ..., n) represents the output of the variational network layer, n represents the number of samples, and I represents the covariance diagonal matrix.

[0056] 302: Based on the sampling parameters, determine the specified neighborhood range of the original feature, and determine the sampling probability of sampling each smallest unit within the specified neighborhood range.

[0057] 303: Within a specified domain, resample the original features several times based on the sampling probability.

[0058] During training, sample features are resampled multiple times, which can theoretically cover the entire representation space, thereby solving the risk of attack caused by discontinuous training sample features and improving the model's resistance to attacks.

[0059] In this embodiment, neural network models can be classified into convolutional neural networks, deep neural networks, etc. according to model type, and into text classification models, image classification models, etc. according to target tasks.

[0060] In the neural network model training process of this embodiment, the backpropagation algorithm is used for iterative training. Specifically, the gradient of the error corresponding to the weights of the neural network model is calculated, the weights are adjusted according to the direction of the fastest error reduction, and then the error is backpropagated to the previous layer of the neural network model. This process is repeated until convergence or the stopping iteration condition is met.

[0061] In another embodiment of the present invention, a training system for improving the adversarial performance of neural network models is proposed. Figure 2 An exemplary schematic diagram of the architecture of the training system for improving the adversarial performance of neural network models according to one embodiment of the present invention is shown.

[0062] like Figure 2 The training systems shown that improve the adversarial performance of neural network models include:

[0063] The acquisition module is set to acquire training samples and their labels.

[0064] The extraction module is configured to input training samples into the representation layer of the neural network model and extract the original features of the training samples in the representation space.

[0065] The generation module is configured to resample the original features several times to obtain several sampled features corresponding to the original features.

[0066] The calculation module is configured to input each sampled feature into the output layer of the neural network model to obtain the processing result output by the output layer.

[0067] The training module is configured to determine the loss based on the sample labels and processing results, and train the neural network model with the goal of minimizing the loss. The loss includes the difference between the processing result output by the output layer and the sample labels of the training samples.

[0068] In addition, the above-mentioned generation module includes:

[0069] The data processing unit is configured to input the raw features into the variational network layer of the neural network model to obtain the sampling parameters output by the variational network layer. These sampling parameters include multidimensional Gaussian distribution parameters, which are described by the following formula:

[0070]

[0071]

[0072] In the formula, μ and σ i (i = 1, 2, ..., n) represents the output of the variational network layer, n represents the number of samples, and I represents the covariance diagonal matrix.

[0073] The data analysis unit is configured to determine a specified neighborhood range of the original features based on the sampling parameters, and to determine the sampling probability of sampling each smallest unit within the specified neighborhood range.

[0074] The sampling unit is configured to resample the original features several times within a specified neighborhood based on the sampling probability.

[0075] In another embodiment of the present invention, a training model for improving the adversarial performance of neural network models is proposed. Figure 3 An exemplary schematic diagram of the architecture of the training model for improving the adversarial performance of neural network models according to the present invention is shown in one implementation.

[0076] like Figure 3 The training model shown here, designed to improve the adversarial performance of a neural network model, comprises a representation layer, a variational network layer, and an output layer connected in sequence.

[0077] The representation layer is configured to receive training samples and their labels, and extract the original features of the training samples in the representation space.

[0078] The variational network layer is configured to receive the original features and perform several sampling operations on the original features to obtain several sampled features corresponding to the original features. Specifically, the variational network layer is configured to receive the original features and obtain sampling parameters; then, based on the sampling parameters, determine a specified neighborhood range of the original features and determine the sampling probability for sampling each smallest unit within the specified neighborhood range; finally, within the specified neighborhood range, the original features are resampled several times based on the sampling probability.

[0079] The output layer is configured to receive sampled features and process each sampled feature to obtain a processing result. Furthermore, the output of the output layer is connected to the input of the representation layer to determine the loss based on the sample labels of the training samples and the processing result. The neural network model is trained until convergence or the stopping iteration condition is met, with minimizing the loss as the training objective.

[0080] Since the output of the representation layer is discrete, with limited training data, the output can only cover a portion of the points in the space. This invention, by adding a variational network layer and performing multiple resampling operations, can theoretically cover the entire representation space, thereby mitigating the attack risk caused by discontinuous training data and improving the model's resistance to attacks.

[0081] This invention is versatile and therefore has a wide range of applications, such as auditing black market users (money laundering, gambling operators, fraud) in financial risk control, identifying fraudulent traffic in advertising scenarios, and image recognition.

[0082] One embodiment of the present invention also provides a computer-readable storage medium storing a computer program that, when executed in a computer, causes the computer to perform the method for improving the adversarial performance of a neural network model as described in the above embodiments of the present invention. Since the execution steps are the same as those described above, they will not be repeated here.

[0083] One embodiment of the present invention also provides a computing device including a memory and a processor. The memory stores executable code, and when the processor executes the executable code, it performs the method for improving the adversarial performance of a neural network model as described in the above embodiments of the present invention. Since the steps performed are the same as those described above, they will not be repeated here.

[0084] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of the invention. Various variations can be made to the above embodiments of the present invention. That is, all simple and equivalent changes and modifications made based on the claims and description of this invention fall within the protection scope of the claims of this patent. All aspects not described in detail in this invention are conventional technical content.

Claims

1. A training method for improving the adversarial performance of a neural network model, comprising the following steps: Obtain training samples and their labels; The training samples are input into the representation layer of the neural network model to extract the original features of the training samples in the representation space. The original features are sampled several times to obtain several sampled features corresponding to the original features; Each sampled feature is input into the output layer of the neural network model to obtain the processing result output by the output layer; The loss is determined based on the sample labels and the processing results, and the neural network model is trained with minimizing the loss as the training objective. Among them, the trained neural network model is applied to at least image recognition; The resulting sampled features corresponding to the original features include: The original features are input into the variational network layer of the neural network model to obtain the sampling parameters output by the variational network layer; Based on the sampling parameters, a specified neighborhood range of the original feature is determined, and the sampling probability of sampling each smallest unit within the specified neighborhood range is determined. Within the specified domain, the original features are resampled several times based on the sampling probability.

2. The training method for improving the adversarial performance of a neural network model according to claim 1, wherein the sampling includes resampling.

3. The training method for improving the adversarial performance of a neural network model according to claim 1, wherein the sampling parameters include multidimensional Gaussian distribution parameters.

4. The training method for improving the adversarial performance of a neural network model according to claim 1, wherein the loss includes the difference between the sample labels and the processing results.

5. A training system for improving the adversarial performance of neural network models, comprising: The acquisition module is set to acquire training samples and their labels. The extraction module is configured to input the training samples into the representation layer of the neural network model and extract the original features of the training samples in the representation space. The generation module is configured to perform several samplings on the original features to obtain several sampled features corresponding to the original features; The calculation module is configured to input each sampled feature into the output layer of the neural network model to obtain the processing result output by the output layer; The training module is configured to determine the loss based on the sample labels and the processing results, and train the neural network model with minimizing the loss as the training objective. Among them, the trained neural network model is applied to at least image recognition; The generation module includes: The data processing unit is configured to input the original features into the variational network layer of the neural network model to obtain the sampling parameters output by the variational network layer; The data analysis unit is configured to determine a specified neighborhood range of the original feature based on the sampling parameters, and to determine the sampling probability of sampling each smallest unit within the specified neighborhood range. The sampling unit is configured to resample the original feature several times based on the sampling probability within the specified domain.

6. The training system for improving the adversarial performance of a neural network model according to claim 5, wherein the sampling includes resampling.

7. The training system for improving the adversarial performance of neural network models according to claim 5, wherein the sampling parameters include multidimensional Gaussian distribution parameters.

8. The training system for improving the adversarial performance of a neural network model according to claim 5, wherein the loss includes the difference between the sample labels and the processing results.

9. A training model for improving the adversarial performance of a neural network model, comprising a representation layer, a variational network layer, and an output layer connected sequentially, wherein, The representation layer is configured to receive training samples and their labels, and extract the original features of the training samples in the representation space. The variational network layer is configured to receive the original features and sample the original features several times to obtain several sampled features corresponding to the original features; The output layer is configured to receive the sampled features and process each sampled feature to obtain the processing result; The output of the output layer is connected to the input of the representation layer to determine the loss based on the sample labels of the training samples and the processing results, and to train the neural network model with minimizing the loss as the training objective. Among them, the trained neural network model is applied to at least image recognition; The variational network layer is configured to receive the original features and obtain sampling parameters; then, based on the sampling parameters, determine a specified neighborhood range of the original features and determine the sampling probability for sampling each smallest unit within the specified neighborhood range; finally, within the specified neighborhood range, the original features are resampled several times based on the sampling probability.

10. The training model for improving the adversarial performance of a neural network model according to claim 9, wherein the sampling includes resampling.

11. The training model for improving the adversarial performance of a neural network model according to claim 9, wherein the sampling parameters include multidimensional Gaussian distribution parameters.

12. The training model for improving the adversarial performance of a neural network model according to claim 9, wherein the loss includes the difference between the sample labels and the processing results.

13. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the training method for improving the adversarial performance of a neural network model as described in any one of claims 1-4.

14. A computing device comprising a memory and a processor, the memory storing executable code, wherein when the processor executes the executable code, it performs the training method for improving the adversarial performance of a neural network model as described in any one of claims 1-4.

Images