Adversarial sample detection method and system based on quantum fuzzy convolutional neural network

Abstract

This invention belongs to the field of adversarial example detection and discloses a method and system for adversarial example detection based on a quantum fuzzy convolutional neural network. The method includes: inputting data from the input model into a quantum convolutional neural network and a fuzzy neural network respectively; fusing the feature maps extracted by the two networks through a fusion layer; using the fused data in the fusion layer as input to a predictor; and finally, outputting the result from the predictor. This invention uses a combination of quantum model and fuzzy system to train a quantum fuzzy convolutional neural network as an adversarial example detection method. It leverages the unique advantages of quantum convolutional neural networks in capturing global data attributes and the fuzzy system in handling uncertainty, thereby improving the detection rate to a certain extent. It can not only identify adversarial examples generated by existing attack methods, but also has a certain predictive and defensive effect against adversarial examples generated by different hyperparameters using the same attack method, as well as adversarial examples generated by different methods. The model's generalization ability is superior to that of general models.

Description

Technical Field

[0001] The present invention belongs to the field of adversarial sample detection, and in particular relates to an adversarial sample detection method and system based on quantum fuzzy convolutional neural network. Background Art

[0002] At present, quantum machine learning is a combination of machine learning and quantum computing. On the one hand, quantum computing is used to solve the problem of computational efficiency in machine learning; on the other hand, the properties of quantum mechanics are used to develop smarter machine learning algorithms. Although quantum machine learning has shown performance that exceeds that of classical machine learning in some aspects, quantum machine learning systems are also susceptible to adversarial attacks. Similar to classical machine learning, the most advanced quantum classifiers have recently been shown to be deceived by adversarial samples, causing quantum models to make incorrect classifications.

[0003] To mitigate this impact, the main approach currently adopted by defenders is to inject adversarial samples into the training set to retrain the quantum classifier and thus enhance the robustness of the model. This method is called quantum adversarial training. Another noteworthy technique is to protect quantum classifiers through differential privacy technology. Specifically, this method is used to protect quantum classifiers by utilizing depolarized noise in quantum circuits for classification.

[0004] Quantum adversarial training not only requires generating enough adversarial samples to train on quantum classifiers, but also does not necessarily have robustness against unknown adversarial attacks. Worse still, increased robustness leads to decreased accuracy. As for the use of quantum noise to defend against adversarial attacks, the main disadvantage of this method is that it requires the careful construction of depolarized noise circuits, and similar to quantum adversarial training, it requires a trade-off between the robustness and accuracy of the quantum classifier.

[0005] Another defense method is adversarial sample detection: discovering potentially dangerous adversarial samples and excluding them from the processing range. This method does not require quantum model retraining and does not affect the performance of the quantum model to be protected. However, there is currently no method that can detect adversarial samples using quantum classifiers. Therefore, it is of great application value to propose an adversarial sample detection method that can protect the original quantum classifier using quantum models.

[0006] Through the above analysis, the problems and defects of the prior art are as follows:

[0007] Existing quantum adversarial training methods not only need to generate enough adversarial samples to train on quantum classifiers, but also may not be robust to unknown adversarial attacks. At the same time, the increase in the robustness of the quantum classifier to be protected will lead to a decrease in its accuracy. Existing adversarial sample detection methods have not considered using quantum classifiers to detect adversarial samples. Summary of the invention

[0008] In view of the problems existing in the prior art, the present invention provides an adversarial sample detection method and system based on quantum fuzzy convolutional neural network.

[0009] The present invention is implemented as follows: a method for detecting adversarial samples based on quantum fuzzy convolutional neural network, comprising:

[0010] Step S1, acquisition and preprocessing of data set;

[0011] Step S2, training the quantum classifier model that needs to be protected;

[0012] Step S3, generating adversarial sample training set;

[0013] Step S4, constructing an adversarial sample detection training set for training the quantum fuzzy convolutional neural network;

[0014] Step S5, building a quantum fuzzy convolutional neural network model;

[0015] Step S6, performing quantum fuzzy convolutional neural network training based on the adversarial sample training detection training set in step S4 to obtain a quantum fuzzy convolutional neural network adversarial sample detection model;

[0016] Step S7, generating an adversarial sample test set, constructing an adversarial sample detection test set for testing the quantum fuzzy convolutional neural network;

[0017] Step S8: Perform a quantum fuzzy convolutional neural network adversarial sample detection model performance test based on step S7.

[0018] Further, the specific process of step S1 is:

[0019] Obtain the data set used to train the quantum classifier, clean the data: check whether the data in the data set is missing, inconsistent, redundant, etc.; perform data conversion on the data: perform sampling processing and corresponding data conversion on the data; finally, perform feature extraction and dimensionality reduction on the data;

[0020] Further, the specific process of step S3 is:

[0021] Select normal samples from a part of the test set of the data set to generate adversarial samples through different attack methods, specifically, add disturbances to the image input in each round of iteration of the selected normal sample data set, and the attack methods include but are not limited to: fast gradient descent method (FGSM), projected gradient descent method (PGD), momentum iteration method (MIM) and deep deception (DeepFool);

[0022] Further, the specific process of step S4 is:

[0023] The selected normal sample data set and the adversarial sample training set are mixed as the adversarial sample detection training set, wherein the normal sample label is 0 and the adversarial sample label is 1, and finally the adversarial sample detection training set is randomly shuffled.

[0024] Further, the quantum fuzzy convolutional neural network model in step S5 includes:

[0025] Input layer, fuzzy network layer, quantum convolutional neural network, fusion layer and predictor (the predictor is composed of another quantum convolutional neural network), the quantum convolutional neural network consists of three parts: data encoding, variational quantum circuit and measurement operation; the quantum data after data encoding will pass through the variational quantum circuit to perform a series of unitary transformation operations, where the quantum circuit in the variational quantum circuit is usually composed of two-bit quantum circuit blocks, and these given quantum circuit blocks constitute quantum convolution circuits and quantum pooling circuits. Finally, all quantum bits in the circuit are measured to obtain the data in the quantum circuit.

[0026] The specific process is:

[0027] (1.1) The data is passed into the input layer, and the input layer inputs the input data into two channels respectively, one is passed into the fuzzy network layer, and the other is passed into the quantum convolutional neural network layer;

[0028] (1.2) After the data is processed by the fuzzy network layer and the quantum convolutional neural network layer, the fusion layer will fuse the membership degree from the fuzzy network calculation output data and the data output by the quantum convolutional neural network layer, and the merged data will be used as the input of the predictor;

[0029] (1.3) The predictor outputs a prediction result, where an output of 0 indicates that the predicted sample is a normal sample, and an output of 1 indicates that the input is an adversarial sample;

[0030] For the data input into the quantum convolutional neural network, the input classical data needs to be encoded into a quantum state. In the present invention, amplitude encoding is used to obtain the quantum state as follows:

[0031]

[0032] In the formula, x is the classic input data, is the i-th computational basis state, is the quantum state of the amplitude-encoded output, and N is the number of input data;

[0033] Encoding classical data into quantum states After that, the data will go through a series of unitary transformations through the variational quantum circuit;

[0034] The circuit structure of the quantum convolutional neural network layer includes a quantum convolution layer and a quantum pooling layer. When there are few remaining quantum bits in the circuit, a quantum fully connected layer is used to measure the circuit to obtain quantum state information in the circuit.

[0035] The quantum convolution layer and the pooling layer respectively realize feature extraction and dimensionality reduction of the input data. It can be expressed as:

[0036]

[0037] In the formula, R represents the number of layers in the circuit, U j is a parameterized unitary gate operation, including quantum convolution and pooling gates, q j Represents all parameters in the jth layer;

[0038] The fuzzy network layer includes two parts: a fuzzy layer and a fuzzy rule layer. The input data is connected to the fuzzy layer in the fuzzy network layer. The fuzzy layer assigns membership to each input data. The present invention uses a Gaussian membership function to assign membership, which is given in the form of:

[0039]

[0040] In the formula, C represents the number of Gaussian membership functions, m k and k is the mean and standard deviation of the kth Gaussian membership function, o i Represents the output of the corresponding input node. The fuzzy rule layer applies AND fuzzy logic to the membership of the output in the fuzzy layer, and the fuzzy network layer finally obtains the fuzzy degree:

[0041]

[0042] For the fusion layer, the purpose of the fusion layer is to combine the output results of the two to ensure that the complex structure and high-level features in the data are captured to better detect adversarial samples. In the present invention, the fusion layer adopts a densely connected fusion method, and its output is:

[0043]

[0044]

[0045] In the formula, o q and f Represent the outputs of the quantum convolutional layer and the fuzzy network, respectively, and the weights w q and w f Fusion, b represents the corresponding bias, l represents the number of layers in the fuzzy network, Represents the densely connected input in layer l+1;

[0046] The circuit structure of the predictor includes a quantum convolution layer and a quantum pooling layer. The circuit finally obtains the data of the quantum circuit in the predictor by measuring the quantum state, and finally uses the fully connected layer to take over the measurement results of the quantum bits to finally obtain the results. In the present invention, all the quantum bits in the predictor are measured to obtain the expected value.

[0047] Further, the specific process of step S6 is:

[0048] (2.1) Perform the quantum fuzzy convolutional neural network model initialization operation; the bias b between all layers in the quantum fuzzy convolutional neural network is set to 0, the parameters in the quantum circuit, the m in the fuzzy network layer k The weights w between all layers are randomly initialized according to a uniform distribution, and the s in the fuzzy network layer k Set to 1;

[0049] (2.2) Select cross entropy as the loss function and use the Adam optimization algorithm to optimize the parameters in the quantum fuzzy convolutional neural network model to minimize the cost function;

[0050] (2.3) Set the training parameters of the quantum fuzzy convolutional neural network model, including optimization algorithm, training batch size, round iteration T, and learning rate;

[0051] (2.4) Using the adversarial sample detection data set to train the quantum fuzzy convolutional neural network, the parameters in the quantum fuzzy convolutional neural network model are updated according to the selected optimization algorithm and learning rate until the quantum fuzzy convolutional neural network model stops training after T iterations, thereby generating a quantum fuzzy convolutional neural network adversarial sample detection model.

[0052] Further, the specific process of step S7 is:

[0053] Generate adversarial samples from all normal samples in the data set through different attack methods, specifically, add disturbances to the images input in each round of iteration of the selected normal sample data set, and the attack methods include but are not limited to: FGSM, PGD, MIM and DeepFool;

[0054] Further, the specific process of step S8 is:

[0055] The normal samples of the test set of the data set and the adversarial sample test set are mixed as the adversarial sample detection test set, wherein the normal sample label is 0 and the adversarial sample label is 1, and finally the adversarial sample detection test set is randomly shuffled.

[0056] Further, the specific process of step S9 is:

[0057] Based on step S8, the quantum fuzzy convolutional neural network adversarial sample detection model is tested to calculate the proportion of the adversarial sample test set labels correctly assigned by the model.

[0058] Another object of the present invention is to provide an adversarial sample detection system based on a quantum fuzzy convolutional neural network for implementing the adversarial sample detection method based on a quantum fuzzy convolutional neural network, wherein the adversarial sample detection system based on a quantum fuzzy convolutional neural network comprises:

[0059] A preprocessing module, used to obtain a data set for training a quantum classifier and preprocess the selected data set;

[0060] Training module, used to train the quantum classifier model;

[0061] The quantum fuzzy convolutional neural network module is used to build a quantum fuzzy convolutional neural network based on the generated adversarial sample training set and adversarial sample detection training set, and to train the quantum fuzzy convolutional neural network based on the quantum classifier model to obtain a quantum fuzzy convolutional neural network adversarial sample detection model;

[0062] The performance testing module is used to perform performance testing of the quantum fuzzy convolutional neural network adversarial sample detection model based on the generated adversarial sample test set and adversarial sample detection test set.

[0063] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the adversarial sample detection method based on quantum fuzzy convolutional neural network.

[0064] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the adversarial sample detection method based on quantum fuzzy convolutional neural network.

[0065] Another object of the present invention is to provide an information data processing terminal, which is used to implement the adversarial sample detection system based on quantum fuzzy convolutional neural network.

[0066] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0067] The present invention improves the adversarial sample detection network and proposes to use quantum fuzzy convolutional neural network training combined with quantum model and fuzzy system as an adversarial sample detection method, which utilizes the unique advantages of quantum convolutional neural network in capturing global properties of data and fuzzy system in processing uncertainty, thereby improving the detection rate to a certain extent.

[0068] The present invention can not only identify adversarial samples generated by the original attack method, but also has a certain prediction and defense effect on adversarial samples generated by different hyperparameters in the same attack method and adversarial samples generated by different methods. The model generalization is better than the general model.

[0069] Once the model is successfully trained, it can be deployed to different quantum classification models and is easy to use.

[0070] The expected benefits and commercial value of the technical solution of the present invention after transformation are as follows: after the model proposed by the solution completes training, the model proposed by the solution can be deployed to the relevant quantum machine learning system to protect the relevant quantum machine learning model.

[0071] The technical solution of the present invention fills the technical gap in the industry at home and abroad: the technical solution provides a practical defense solution for protecting quantum machine learning systems against attacks using quantum classifiers.

[0072] Does the technical solution of the present invention solve the technical problems that people have always been eager to solve but have never succeeded in solving: by utilizing the ability of quantum convolutional neural networks to capture global characteristics and the advantages of fuzzy systems in dealing with uncertainty problems, the detection rate of adversarial samples has been enhanced to a certain extent, and the generalization of the model detection of different adversarial attack methods and hyperparameters in different adversarial attack methods has been improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a framework diagram of an adversarial sample detection method based on a quantum fuzzy convolutional neural network provided by an embodiment of the present invention;

[0074] Figure 2 It is a flow chart of an adversarial sample detection method based on a quantum fuzzy convolutional neural network provided by an embodiment of the present invention;

[0075] Figure 3 It is a framework diagram of a quantum fuzzy convolutional neural network provided by an embodiment of the present invention;

[0076] Figure 4 It is a diagram of the structure of a quantum convolutional neural network provided by an embodiment of the present invention;

[0077] Figure 5 It is a circuit diagram of a quantum convolution layer provided by an embodiment of the present invention;

[0078] Figure 6 is a circuit diagram of a quantum pooling layer provided in an embodiment of the present invention;

[0079] Figure 7 is a circuit diagram of a quantum fully connected layer provided by an embodiment of the present invention;

[0080] Figure 8 It is a structural diagram of a predictor provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0081] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0082] In order to enable those skilled in the art to fully understand how to implement the present invention in detail, this section is an explanatory embodiment that expands and describes the technical solution of the claims.

[0083] Aiming at the adversarial attack problem in quantum machine learning models, the present invention studies the quantum convolutional neural network model structure and fuzzy system, and provides an adversarial sample detection method. The method transfers the data in the input model to the quantum convolutional neural network and the fuzzy neural network respectively, fuses the feature graphs extracted by the two networks through a fusion layer, and uses the fused data in the fusion layer as the predictor input, and finally the predictor outputs the result.

[0084] The quantum fuzzy convolutional neural network adversarial sample detection method provided by the embodiment of the present invention comprises the following steps:

[0085] Step S101, acquisition and preprocessing of data set;

[0086] Step S102, training the quantum classifier model that needs to be protected: training the quantum classifier so that the quantum classifier has better performance for the task classification that needs to be performed;

[0087] Step S103, generating adversarial sample training set;

[0088] Step S104, constructing an adversarial sample detection training set for training a quantum fuzzy convolutional neural network;

[0089] Step S105, building a quantum fuzzy convolutional neural network;

[0090] Step S106: Perform quantum fuzzy convolutional neural network training based on step S102 to obtain a quantum fuzzy convolutional neural network adversarial sample detection model;

[0091] Step S107, generating an adversarial sample test set;

[0092] Step S108, constructing an adversarial sample detection test set for testing the quantum fuzzy convolutional neural network;

[0093] Step S109: Perform a quantum fuzzy convolutional neural network adversarial sample detection model performance test based on step S108.

[0094] The specific process of step S101 is as follows:

[0095] Obtain the data set used to train the quantum classifier and preprocess the selected data set.

[0096] The specific process of step S103 is as follows:

[0097] Normal samples in a part of the test set of the data set are selected to generate adversarial samples through different attack methods. Specifically, perturbations are added to the images input in each round of iteration of the selected normal sample data set. The attack methods include but are not limited to: fast gradient descent method (FGSM), projected gradient descent method (PGD), momentum iteration method (MIM) and deep deception (DeepFool).

[0098] The specific process of step S104 is as follows:

[0099] The selected normal sample data set and the adversarial sample training set are mixed as the adversarial sample detection training set, wherein the normal sample label is 0 and the adversarial sample label is 1, and finally the adversarial sample detection training set is randomly shuffled.

[0100] The specific process of step S105 is as follows:

[0101] The quantum fuzzy convolutional neural network consists of five parts: input layer, fuzzy network layer, quantum convolutional neural network layer, fusion layer and predictor (the predictor consists of another quantum convolutional neural network). First, the input data will be input into two channels: the fuzzy network and the first quantum convolutional neural network. After the data is processed by different modules, the results of the data from the fuzzy network and the first quantum convolutional neural network will be merged through the fusion module, and the merged data will be used as the input of the predictor; finally, the predictor will output the prediction result. If the output is 0, it means that the predicted sample is a normal sample, and if the output is 1, it means that the input is an adversarial sample. In the quantum convolutional neural network model, the quantum convolutional neural network consists of three parts: the data encoding part, the variational quantum circuit part and the measurement operation.

[0102] The specific process of step S106 is as follows:

[0103] Select cross entropy as the loss function; set model training parameters: including optimization algorithm, training batch size, round iteration T, and learning rate; use the adversarial sample detection data set to train the quantum fuzzy convolutional neural network, update the parameters in the model according to the selected optimization algorithm and learning rate until the training is stopped after a total of T iterations, and generate a quantum fuzzy convolutional neural network adversarial sample detection model.

[0104] The specific process of step S107 is as follows:

[0105] All normal samples in the data set are used to generate adversarial samples through different attack methods. Specifically, perturbations are added to the input images of each round of iteration of the selected normal sample data set. The attack methods include but are not limited to: FGSM, PGD, MIM and DeepFool.

[0106] The specific process of step S108 is as follows:

[0107] The normal samples of the test set of the data set and the adversarial sample test set are mixed as the adversarial sample detection test set, wherein the normal sample label is 0 and the adversarial sample label is 1, and finally the adversarial sample detection test set is randomly shuffled.

[0108] The specific process of step S109 is as follows:

[0109] Based on step S108, the quantum fuzzy convolutional neural network detection model is tested to calculate the proportion of the adversarial sample test set labels correctly assigned by the model.

[0110] In order to prove the creativity and technical value of the technical solution of the present invention, this section provides application examples of the claimed technical solution on specific products or related technologies.

[0111] The present invention uses the pictures in the MNIST handwriting dataset to conduct experiments. Figure 1 , Figure 2 As shown, the adversarial sample detection method of the present invention specifically includes the following steps:

[0112] Step 1: Construct an adversarial sample detection training set.

[0113] First, a quantum classifier is selected as the target protection model to be protected, and the training set is input into the quantum classifier for training. Different attack algorithms are used to generate adversarial sample data sets, which means that different attack methods are used to input images for each round of iteration of the clean sample data set to generate adversarial sample data sets.

[0114] The clean sample dataset and the corresponding adversarial sample dataset are shuffled to obtain the adversarial sample training set, where the label of the clean sample is 0 and the label of the adversarial sample is 1.

[0115] Step 2: Construct a quantum fuzzy convolutional neural network model, such as Figure 3 Shown is the specific structure of the quantum fuzzy convolutional neural network model of the present invention, including an input layer, a fuzzy network layer, a quantum convolutional neural network layer, a fusion layer and a predictor.

[0116] First, for data that needs to be passed into the input layer, the input layer inputs the input data into two channels separately, one copy is passed to the fuzzy network layer and the other copy is passed to the quantum convolutional neural network layer.

[0117] For the input quantum convolutional neural network, the input classical data needs to be encoded into a quantum state. In the present invention, amplitude encoding is used to obtain the quantum state as follows:

[0118]

[0119] In formula (1), x is the classic input data. is the i-th computational basis state, The quantum state of the output is encoded as amplitude. Encoding classical data into quantum states Afterwards, the data undergoes a series of unitary transformations through the parameterized quantum circuit module. Figure 4 The structure of the quantum convolutional neural network of the present invention is shown, where the QCNN layer circuit structure includes two quantum convolutional layers (C1 and C2), two pooling layers (P1 and P2) and a quantum fully connected layer (QFC). Figure 4 U i and V i They represent the circuit blocks of the i-th quantum convolution layer and the i-th quantum pooling layer respectively. The quantum convolution layer and the quantum pooling layer respectively realize feature extraction and dimensionality reduction of the input data. The quantum state after passing through multiple layers of quantum circuits can be expressed as:

[0120]

[0121] In formula (2), R represents the number of layers in the circuit, U j is a parameterized unitary gate operation, including quantum convolution and pooling gates, q j Represents all parameters in the jth layer. The circuits used in the quantum convolution layer in the present invention are as follows Figure 5 As shown, the quantum pooling layer circuit is as follows Figure 6 The quantum fully connected layer circuit is shown in Figure 7 shown. Figure 5 and Figure 6 R z and R y Represents the revolving Z door and revolving Y door, q i represents the rotation angle of the i-th gate in the line gate, Figure 7The G in represents a universal single-qubit gate, each containing three trainable parameters.

[0122] For the fuzzy neural network, each node of the input layer is connected to the fuzzy layer in the fuzzy neural network, and the fuzzy layer assigns a membership degree to each node. In the present invention, the form of Gaussian membership function is adopted:

[0123]

[0124] In formula (3), m k and k is the mean and standard deviation of the Cth Gaussian membership function, o i Represents the output of the corresponding input node. The fuzzy rule layer applies AND fuzzy logic to the membership of all input nodes, and finally obtains the fuzziness of the fuzzy network as:

[0125]

[0126] For the fusion layer, the purpose of the fusion layer is to combine the output results of the two to ensure that the complex structure and high-level features in the data are captured to better detect adversarial samples. In the present invention, the fusion layer adopts a densely connected fusion method, and its output is:

[0127]

[0128] In formula (5), o q and f Represent the outputs of the quantum convolution layer and the fuzzy network respectively. They are respectively related to the weight w q and w f Fusion, b represents the corresponding bias, l represents the number of layers in the fuzzy network,.

[0129] For the predictor, Figure 8 The structure of the predictor of the present invention is shown. The circuit structure of the predictor includes a quantum convolution layer (C3) and a pooling layer (P3). U and V represent the quantum convolution circuit block and the quantum pooling circuit block respectively. The specific circuit is the same as the quantum convolution neural network layer circuit. The circuit finally obtains the data of the quantum circuit in the predictor by measuring the quantum state, and finally uses the fully connected layer to take over the measurement results of the quantum bit to finally obtain the result.

[0130] Step 3: Train the quantum fuzzy convolutional neural network model.

[0131] Model initialization operation: The bias b between all layers in the quantum fuzzy convolutional neural network is set to 0, the parameters in the quantum circuit, and the m in the fuzzy network k The weights w between all layers are randomly initialized according to a uniform distribution, blurring the s in the network k Set to 1.

[0132] Cross entropy was selected as the loss function, and the Adam optimization algorithm was used to optimize the parameters in the model to minimize the cost function. The learning rate was 0.003, the batch size was set to 16, and a total of 30 epochs were trained. Due to the particularity of quantum circuits, in order to calculate the partial derivatives of the parameters in the variational circuit, in the present invention, the "parameter shift rule" was used to obtain the gradient in the quantum circuit.

[0133] Step 4: Performance test of quantum fuzzy convolutional neural network adversarial sample detection model.

[0134] The adversarial samples generated by different attack algorithms in the adversarial sample detection test set are input into the adversarial sample detection model in turn, and the calculation model calculates the ratio of correct samples to adversarial samples predicted correctly.

[0135] The embodiments of the present invention have achieved some positive effects during the development or use process, and indeed have great advantages over the prior art. The following content is described in conjunction with data, charts, etc. of the test process.

[0136] The effects of the present invention are further described below in conjunction with simulation experiments.

[0137] This experiment uses the Pennylane quantum computing framework, which is a cross-platform Python library for differentiable programming of quantum computers. It can train quantum computers in the same way as neural networks. The simulation experiment hardware platform is AMD Ryzen75800H with radeon Ggaphics′8, GPU NVIDIA GeForce RTX3060Laptop. The adversarial sample attack method uses four methods: FGSM, PGD, MIM and DeepFool to generate adversarial samples.

[0138] The present invention randomly selects 600 samples from the MNIST test set and uses the above algorithm to generate 600 adversarial samples as the adversarial sample training set. In addition, 600 samples are randomly selected from the MNIST test set and 600 adversarial samples are generated as the adversarial sample test set using the above algorithm. Table 1 shows the adversarial sample detection results of the quantum fuzzy convolutional neural network adversarial sample detection model. (F), (P), (M) and (D) correspond to the adversarial samples generated by the FGSM, PGD, MIM and DeepFool attack methods, respectively. Different attack methods have different adversarial samples in the training set X. train and the test set X test The adversarial datasets generated in and

[0139] Table 1

[0140]

[0141]

[0142] From the adversarial sample detection results in Table 1, it can be seen that the adversarial sample detector based on quantum fuzzy convolutional neural network can effectively detect adversarial samples.

[0143] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0144] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for detecting adversarial samples based on quantum fuzzy convolutional neural network, characterized in that: The adversarial sample detection method based on quantum fuzzy convolutional neural network includes: Step S1, acquisition and preprocessing of data set; Step S2, training the quantum classifier model that needs to be protected; Step S3, generating adversarial sample training set; Step S4, constructing an adversarial sample detection training set for training the quantum fuzzy convolutional neural network; Step S5, building a quantum fuzzy convolutional neural network model; Step S6, performing quantum fuzzy convolutional neural network training based on the quantum classifier model in step S2 to obtain a quantum fuzzy convolutional neural network adversarial sample detection model; Step S7, generating an adversarial sample test set, constructing an adversarial sample detection test set for testing the quantum fuzzy convolutional neural network; Step S8, performing a quantum fuzzy convolutional neural network adversarial sample detection model performance test based on step S7; The quantum fuzzy convolutional neural network model in step S5 includes: Input layer, fuzzy network layer, quantum convolutional neural network, fusion layer and predictor, the quantum convolutional neural network consists of three parts: data encoding, variational quantum circuit and measurement operation; the quantum data after data encoding will pass through the variational quantum circuit to perform a series of unitary transformation operations, the quantum circuit in the variational quantum circuit is usually composed of two-bit quantum circuit blocks, these given quantum circuit blocks constitute quantum convolution circuits and quantum pooling circuits, and all quantum bits in the circuit are measured to obtain data in the quantum circuit; The specific process is: (1.1) The data is passed into the input layer. The input layer inputs the input data into two channels respectively, one is passed into the fuzzy network layer, and the other is passed into the quantum convolutional neural network layer; (1.2) After the data is processed by the fuzzy network layer and the quantum convolutional neural network layer, the fusion layer will fuse the membership degree from the fuzzy network calculation output data and the data output by the quantum convolutional neural network layer, and the merged data will be used as the input of the predictor; (1.3) The predictor outputs a prediction result. If the output is 0, it indicates that the predicted sample is a normal sample, and if the output is 1, it indicates that the input is an adversarial sample. For the data input into the quantum convolutional neural network, the input classical data needs to be encoded into a quantum state; After encoding classical data into quantum states, the data undergoes a series of unitary transformations through variational quantum circuits; The circuit structure of the quantum convolutional neural network layer includes a quantum convolution layer and a quantum pooling layer. When there are few remaining quantum bits in the circuit, a quantum fully connected layer is used to measure the circuit to obtain quantum state information in the circuit. The quantum convolution layer and the pooling layer respectively realize feature extraction and dimensionality reduction of input data; The fuzzy network layer includes two parts: a fuzzy layer and a fuzzy rule layer. The input data is connected to the fuzzy layer in the fuzzy network layer, and the fuzzy layer assigns a membership degree to each input data. The fuzzy rule layer applies AND fuzzy logic to the membership output in the fuzzy layer. For the fusion layer, the purpose of the fusion layer is to combine the output results of the two to ensure that the complex structure and high-level features in the data are captured to better detect adversarial samples; The circuit structure of the predictor includes a quantum convolution layer and a quantum pooling layer. The circuit finally obtains the data of the quantum circuit in the predictor by measuring the quantum state, and finally uses the fully connected layer to take over the measurement results of the quantum bits to finally obtain the results.

2. The adversarial sample detection method based on quantum fuzzy convolutional neural network as claimed in claim 1, characterized in that: The specific process of step S1 is as follows: Obtain a data set for training a quantum classifier and preprocess the selected data set.

3. The adversarial sample detection method based on quantum fuzzy convolutional neural network as claimed in claim 1, characterized in that: The specific process of step S3 is: Normal samples in a test set of a part of the data set are selected to generate different adversarial samples through different attack methods, specifically: adding perturbations to the images input in each round of iteration of the selected normal sample data set; the attack methods include fast gradient descent method, projected gradient descent method, momentum iteration method and deep deception.

4. The adversarial sample detection method based on quantum fuzzy convolutional neural network as claimed in claim 1, characterized in that: The specific process of step S4 is as follows: The selected normal sample data set and the adversarial sample training set are mixed as the adversarial sample detection training set, wherein the normal sample label is 0 and the adversarial sample label is 1, and finally the adversarial sample detection training set is randomly shuffled.

5. The adversarial sample detection method based on quantum fuzzy convolutional neural network as claimed in claim 1, characterized in that: The specific process of step S6 is as follows: (2.1) Perform model parameter initialization operation. The bias between all layers in the quantum fuzzy convolutional neural network is set to 0. The parameters in the quantum circuit, the weights in the fuzzy network and between all layers are randomly initialized according to uniform distribution, and those in the fuzzy network are set to 1. (2.2) Select cross entropy as the loss function and use the Adam optimization algorithm to optimize the parameters in the model to minimize the cost function; (2.3) Set model training parameters, including optimization algorithm, training batch size, round iteration T, and learning rate; (2.4) Using the adversarial sample detection data set to train the quantum fuzzy convolutional neural network, updating the parameters in the model according to the selected optimization algorithm and learning rate, and stopping the training after T iterations to generate a quantum fuzzy convolutional neural network adversarial sample detection model.

6. The adversarial sample detection method based on quantum fuzzy convolutional neural network as claimed in claim 1, characterized in that: The specific process of step S8 is as follows: Based on step S7, the quantum fuzzy convolutional neural network detection model is tested to calculate the proportion of the adversarial sample test set labels correctly assigned by the model.

7. An adversarial sample detection system based on a quantum fuzzy convolutional neural network that implements the adversarial sample detection method based on a quantum fuzzy convolutional neural network as described in any one of claims 1 to 6, characterized in that: The adversarial sample detection system based on quantum fuzzy convolutional neural network includes: A preprocessing module, used to obtain a data set for training a quantum classifier and preprocess the selected data set; Training module, used to train the quantum classifier model; A quantum fuzzy convolutional neural network module is used to build a quantum fuzzy convolutional neural network based on the generated adversarial sample training set and adversarial sample detection training set, and to train the quantum fuzzy convolutional neural network based on the quantum classifier model to obtain a quantum fuzzy convolutional neural network adversarial sample detection model; The performance testing module is used to perform performance testing of the quantum fuzzy convolutional neural network adversarial sample detection model based on the generated adversarial sample test set and adversarial sample detection test set.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the adversarial sample detection method based on quantum fuzzy convolutional neural network as described in any one of claims 1-6.

Images