Robust dataset distillation method and system
By incorporating adversarial perturbations during the dataset distillation process, the robustness of small-scale datasets is optimized, addressing the adversarial vulnerability of models in existing technologies and achieving improved robustness and accuracy maintenance in security tasks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- INST OF COMPUTING TECH CHINESE ACAD OF SCI
- Filing Date
- 2022-12-01
- Publication Date
- 2026-04-10
AI Technical Summary
Existing dataset distillation techniques fail to effectively consider the adversarial robustness of trained models, resulting in adversarial vulnerability in safety-sensitive tasks and an inability to provide robustness guarantees in tasks such as autonomous driving.
Adversarial perturbations are introduced during the dataset distillation process. This is achieved by random sampling, adding adversarial perturbation samples, calculating feature or network gradient differences as loss functions, and optimizing and updating the distilled dataset through backpropagation. This ensures the model is robust on small datasets.
It improves the model's adversarial robustness on small datasets while maintaining classification accuracy on clean samples, making it suitable for safety-sensitive tasks such as autonomous driving.
Smart Images
Figure CN115761414B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data set distillation, and in particular to a data set distillation method and device for training an adversarial robust model. BACKGROUND
[0002] Data set distillation, also known as data set compression, refers to compressing a large-scale training data set into a small-scale data set using a data set distillation algorithm, and training a model on the small-scale data set to achieve a similar effect to training the model on the original data set. Existing data set distillation techniques generally design a loss function for generating a data set (small-scale data set) and iteratively optimize the generated samples. The loss function for generating the data set is usually defined as the difference between the representation distribution of the generated data set and the original data set, or the difference between the training model parameters, so as to measure the quality of the generated data set, and through iterative optimization, the model trained on the generated data set can achieve similar results to the model trained on the original data set.
[0003] As the training data set is significantly compressed, the model trained on the small data set is more likely to overfit, and the trained model has more obvious adversarial vulnerability. However, the current data set distillation algorithm only considers that the accuracy of the model trained on the distilled data set on the test samples is similar to that of the original data set, and does not consider the adversarial robustness of the model trained on the distilled data set. Therefore, although the distilled data set can take advantage of its small size and fast training, if the robustness of the model trained on the distilled data set is not considered, the distilled data set cannot be further applied in safety-sensitive tasks such as autonomous driving because of the lack of robustness guarantee.
[0004] When the training data set is compressed, even if the model can be trained to achieve similar accuracy, the robustness of the model will decrease significantly. And even if the current more effective adversarial training is used to train the model on the distilled data set, a model with better robustness cannot be obtained, and experimental results show that the model obtained by adversarial training on the distilled data set actually exhibits more serious adversarial vulnerability, in other words, the distilled data set cannot be well adapted to the adversarial training algorithm.
[0005] The adversarial vulnerability of the model refers to the fact that the trained model will produce high-confidence misjudgments on adversarial samples carefully designed by attackers during the testing phase. For example, in the task of autonomous driving, an attacker pastes a carefully designed pattern on a STOP sign, and the model will mistakenly identify the STOP sign as a go sign. Previous data set distillation tasks have only considered the accuracy of the model on clean samples, but have not considered the adversarial vulnerability (or adversarial robustness) of the trained model. Therefore, there is an urgent need to propose a robust data set distillation method. SUMMARY
[0006] The purpose of the present application is to solve the problem that the existing data set distillation technology does not consider the robustness of the trained model, and a robust data set distillation framework is proposed, that is, the distillation data has an adversarial characteristic by adding an adversarial perturbation in the distillation process. Compared with the training set before compression, the trained model will be more robust.
[0007] Specifically, the present application proposes a robust data set distillation method, which includes:
[0008] Step 1, randomly sampling in the original training data set as an initial distillation data set;
[0009] Step 2, randomly sampling the original training data set to obtain an original sample sampling set;
[0010] Step 3, adding an adversarial perturbation to the original sample sampling set to obtain a perturbed sample sampling set;
[0011] Step 4, respectively calculating the feature representation or network gradient of the perturbed sample sampling set and the distillation data set, and taking the difference between the feature representation or network gradient as a loss function;
[0012] Step 5, updating and optimizing the distillation data set according to the loss function, and continuously iterating the optimization process until the loss function converges, and saving the current distillation data set as the final robust distillation data set.
[0013] Step 6, using the robust distillation data set to replace the original training data set to train the target deep neural network model to complete image recognition classification.
[0014] The robust data set distillation method, wherein the original training data set is composed of multiple images, and the optimization update includes: calculating the loss value according to the loss function and performing gradient back propagation to obtain the gradient of the pixel value update for each image in the distillation data set, modifying the corresponding pixel color according to the gradient multiplied by a certain weight, that is, the learning rate and step length, to realize the optimization update of the distillation data set.
[0015] The robust data set distillation method, wherein an adversarial perturbation is added to the parameters of the current target deep neural network model.
[0016] The present application also proposes a robust data set distillation system, which includes:
[0017] An initial module for distilling and compressing the original training data set to be distilled into a distillation data set;
[0018] A sampling module for randomly sampling the original training data set to obtain an original sample sampling set;
[0019] a perturbation module, configured to add an adversarial perturbation to the original sample set to obtain a perturbed sample set;
[0020] a training module, configured to calculate feature representations or network gradients of the perturbed sample set and the distilled data set respectively, take a difference between the feature representations or the network gradients as a loss function, and perform an optimization update on the distilled data set according to the loss function, and continuously iterate the optimization process until the loss function converges, and save the current distilled data set as a final robust distilled data set.
[0021] The robust data set distillation system, further comprising:
[0022] an image classification module, configured to replace the original training data set with the robust distilled data set, and train a target deep neural network model to complete image recognition and classification.
[0023] The robust data set distillation system, wherein the original training data set is composed of multiple images, and the optimization update comprises: calculating a loss value according to the loss function and performing gradient back propagation to obtain a gradient of a pixel value update for each image in the distilled data set, modifying a color of a corresponding pixel according to the gradient, and achieving the optimization update on the distilled data set.
[0024] The robust data set distillation system, wherein the adversarial perturbation is added to parameters of the current target deep neural network model.
[0025] The application further provides a storage medium for storing a program for executing any one of the robust data set distillation methods.
[0026] The application further provides a client for any one of the robust data set distillation systems.
[0027] As can be seen from the above solutions, the application has the following advantages:
[0028] The robust data set distillation method can distill the robustness attribute to a small-scale generated data set without changing the deep neural network model training method, and compared with an ordinary data set distillation algorithm without the adversarial perturbation module, a model trained by using the robust data set distilled by the robust data set distillation algorithm can achieve better adversarial robustness.
[0029] Table 1 below is the simulation experiment result of the adversarial robustness of the present application on the public data sets CIFAR10 and MNIST respectively for different data set sizes (number of images / class, Img / Cls). Table 2 is the simulation experiment result of the corresponding accuracy. When the present application is used for image classification, the input is the original data set, and the output is a small-scale distilled data set. The output small-scale data set is a small-scale data set that takes into account the accuracy and robustness of the training model, that is, a small and precise training data set distilled.
[0030] The experimental task is an image classification task, the data set CIFAR10 is a 10-classification task, and the data set MNIST is a 2-classification task. The baseline model for comparison is a feature matching-based distillation method (Feature Matching, FM) and a gradient matching-based distillation method (Gradient Matching, GM). These two types of data set distillation algorithms that do not consider robustness are collectively referred to as Dataset Condensation, abbreviated as DC. The present application (Adversarial Robust Dataset Condensation, AR-DC) adapts the robust data set distillation algorithm to the FM and GM algorithms. According to Table 1, the robust data set distillation method with the addition of the adversarial perturbation module has better robustness on the CIFAR10 data set than the ordinary data set distillation algorithm, and on the MNIST data set, it also achieves further robustness improvement under certain settings. As can be seen from Table 2 below, the robust data set distillation technology can basically maintain the accuracy on clean samples under the premise of achieving robustness improvement (results shown in Table 1).
[0031] Table 1: Robust data set distillation algorithm adversarial robustness
[0032]
[0033] Table 2: Robust data set distillation algorithm accuracy
[0034]
[0035]
[0036] Table 3 below is a data set obtained by a distillation method as a training set, and the experimental results of adapting the standard training method and the adversarial training method when training a deep neural network model, including model adversarial robustness and classification accuracy. The experimental data set uses CIFAR10, and the distillation data set size is 10Img / Cls. From the experimental results in Table 3, it can be seen that the AR-DC method proposed in the present application can achieve better model robustness and accuracy through normal training, while the ordinary distillation algorithm cannot surpass even through adversarial training.
[0037] Table 3: Experimental results of data set distillation algorithm adapting different training methods
[0038] BRIEF DESCRIPTION OF DRAWINGS
[0039] Figure 1 Robust data set distillation flowchart;
[0040] Figure 2 Robust data set distillation system architecture diagram;
[0041] Figure 3 Robust data set distillation flowchart based on feature matching;
[0042] Figure 4 Robust data set distillation flowchart based on gradient matching;
[0043] Figure 5 Robust data set distillation device. DETAILED DESCRIPTION
[0044] The present application proposes a robust data set distillation framework, which adds an adversarial perturbation module in the data set distillation process, and can adapt the framework to existing distillation algorithms, distill adversarial robustness to data samples, and improve the robustness of the model trained by the distillation data set. In order to achieve the above technical effects, the present application includes the following key technical points:
[0045] Key point 1, a robust data set distillation framework. Randomly initialize the distillation data set; randomly initialize the deep neural network; randomly extract small batches of samples from the large-scale original data set and the small-scale robust distillation data set; add adversarial perturbation to the small batch of original data samples; calculate the feature representation / network gradient according to the deep neural network, and calculate the matching loss; update the small batch of robust distillation data sets by loss backpropagation; for the distillation process based on gradient matching, update the deep neural network parameters according to the updated robust distillation data set. The small-scale robust data set finally distilled can replace the original large-scale data set to train the deep neural network model.
[0046] Key point 2, an apparatus for adding adversarial perturbation to data set distillation. For the robust data set distillation method based on feature matching, the feature representation of the data sample is calculated according to the randomly sampled network parameters, so the corresponding apparatus for adding adversarial perturbation is calculated according to the sampled network parameters; for the robust data set distillation method based on gradient matching, since the network parameters are dynamically updated according to the updated distillation data set in the iterative distillation process, the corresponding apparatus for adding adversarial perturbation is calculated according to the dynamically updated network parameters in each round.
[0047] Key point 3, a method for improving model robustness through data set distillation. By adding corresponding adversarial perturbation to the original data sample for the distillation network during data set distillation, the robust attribute is distilled into the training sample, that is, the robust data set distillation algorithm can improve the robustness of the model obtained by modifying the training data set.
[0048] In order to make the above features and effects of the present application more clear and easy to understand, the following embodiments are described in detail below, and the accompanying drawings are described as follows.
[0049] Figure 1 is a robust data set distillation framework, which is adapted to data distillation algorithms based on feature matching and network gradient matching. As shown in Figure 1 , the method comprises:
[0050] Step S101 initializes the distillation data set using the robust data set initialization module;
[0051] Step S102 randomly initializes the deep neural network using the neural network initialization module; the purpose of the neural network here is to obtain the dense feature expression of the data sample and the network gradient. For the gradient matching distillation algorithm, the network gradients of the large-scale original data set and the small-scale distillation data set are matched to generate the distillation data set; the feature matching based distillation algorithm matches the features obtained by the neural network of the large-scale original data set and the small-scale distillation data set to generate the distillation data set.
[0052] Step S103 samples a small batch of samples using the random sampling module;
[0053] Step S104 inputs the sampled small batch of original data samples into the adversarial perturbation module to obtain samples with added adversarial perturbation; the adversarial perturbation is a perturbation designed for the model and opposite to the optimization goal of the model (the meaning of adversarial), which aims to add adversarial perturbation to clean samples (the obtained samples are called adversarial samples) to cause the model to output incorrect judgments.
[0054] Step S105 inputs the sample after adding the disturbance and the small batch distillation sample obtained by sampling to the feature or gradient matching module respectively to obtain a small batch sample loss.
[0055] Step S106 inputs the sample loss to the sample update module to update the small batch distillation data sample. Taking the image data as an example, because the image can be regarded as a matrix, for example, a 32*32 size color image contains 32*32 pixel points in total, each pixel point contains RGB three channels, and each channel is a pixel value of 0-255, which represents the degree of RGB three colors. The so-called image update process is to update the continuous pixel value. After the loss value is calculated according to the loss function involved in the present application and the gradient is back propagated, the gradient size required for updating each pixel value is obtained. The gradient is also a continuous value. At this time, only the gradient is superimposed on the original image pixel value to a certain extent, that is, the RGB value of each pixel point on the image is modified, and the image update is realized.
[0056] Step S107 inputs the updated distillation data set to the network parameter update model for updating the deep neural network parameters for the distillation process based on gradient matching.
[0057] Figure 2 is a robust data set distillation system architecture diagram. As shown in Figure 2 , the
[0058] 110 is an original large-scale data set, which is input to the 120 adversarial disturbance module to add adversarial disturbance, and then input to the same deep neural network model 140 with the small-scale robust distillation data set 130. The model output result is input to the gradient / feature matching module 150 to calculate the matching loss, and the loss is back propagated to update the robust distillation data set 130. The above optimization process is iterated constantly, and finally the generated small-scale robust distillation data set is obtained.
[0059] Figure 3 is a robust data set distillation system architecture diagram. As shown in Figure 3 , the
[0060] Step S201 initializes the distillation data set by using a robust data set initialization module;
[0061] Step S202 randomly initializes the deep neural network by using a neural network initialization module;
[0062] Step S203 samples a small batch sample by using a random sampling module;
[0063] Step S204 inputs the sampled small-batch original data sample into the adversarial perturbation module to obtain a sample after adding adversarial perturbation;
[0064] Step S205 respectively inputs the sample after adding perturbation and the sampled small-batch distillation sample into the feature / gradient matching module, matches according to the feature representation, and obtains a small-batch sample loss;
[0065] Step S206 inputs the sample loss into the sample update module to update the small-batch distillation data sample.
[0066] Figure 4 is a gradient matching-based robust dataset distillation flowchart, which is an example of adapting the robust dataset distillation architecture to the gradient matching-based dataset distillation algorithm. As shown in Figure 4 , the method comprises:
[0067] Step S301 initializes the distillation dataset by using a robust dataset initialization module;
[0068] Step S302 randomly initializes the deep neural network by using a neural network initialization module;
[0069] Step S303 samples a small batch of samples by using a random sampling module;
[0070] Step S304 inputs the sampled small-batch original data sample into the adversarial perturbation module to obtain a sample after adding adversarial perturbation;
[0071] Step S305 respectively inputs the sample after adding perturbation and the sampled small-batch distillation sample into the feature / gradient matching module, matches according to the network gradient, and obtains a small-batch sample loss;
[0072] Step S306 inputs the sample loss into the sample update module to update the small-batch distillation data sample;
[0073] Step S307 inputs the updated distillation dataset into the network parameter update model to update the deep neural network parameters.
[0074] Figure 5 is a robust dataset distillation device. As shown in Figure 5 , the method comprises
[0075] Robust distillation dataset initialization module S401: randomly sample or use random noise to initialize the robust distillation dataset from the original dataset;
[0076] Neural network initialization module S402: randomly initialize the deep neural network parameters;
[0077] A random sampling module S403: randomly sampling a small batch of samples from the original data set and the robust distillation data set respectively;
[0078] An adversarial perturbation module S404: according to the input small batch of original data samples, performing a white-box attack on the current deep neural network to obtain an adversarial perturbation, and adding the adversarial perturbation to the small batch of original data samples;
[0079] A feature / gradient matching module S405: calculating the difference between the features / gradient of the input samples according to the deep neural network to obtain a sample loss;
[0080] A sample updating module S406: using a stochastic gradient descent algorithm to update the robust distillation data samples in a reverse propagation manner according to the sample loss;
[0081] A network parameter updating module S407: for a gradient-based distillation algorithm, updating the deep neural network parameters using the updated robust distillation data set, and for a feature-based distillation algorithm, the module is not needed.
[0082] The following is a system embodiment corresponding to the above method embodiment. The technical details mentioned in the above embodiment are still valid in this embodiment. To avoid repetition, they will not be described here. Correspondingly, the technical details mentioned in this embodiment can also be applied to the above embodiment.
[0083] The application also provides a robust data set distillation system, which comprises:
[0084] An initial module for randomly sampling in an original training data set to obtain an initialized distillation data set;
[0085] A sampling module for randomly sampling the original training data set to obtain an original sample sampling set;
[0086] A perturbation module for adding an adversarial perturbation to the original sample sampling set to obtain a perturbed sample sampling set;
[0087] A training module for calculating the feature representation or network gradient of the perturbed sample sampling set and the distillation data set respectively, using the difference between the feature representation or network gradient as a loss function, and updating the distillation data set in a reverse propagation manner according to the loss function, and continuously iterating the optimization process until the loss function converges, and saving the current distillation data set as the final robust distillation data set.
[0088] The robust data set distillation system, wherein it further comprises:
[0089] The image classification module is configured to train the target deep neural network model to complete image recognition classification by replacing the original training dataset with the robust distillation dataset.
[0090] The robust dataset distillation system, wherein the original training dataset is composed of multiple images, and the optimization update comprises: calculating a loss value according to a loss function and performing gradient back propagation to obtain a gradient of pixel value update for each image in the distillation dataset, and modifying the color of the corresponding pixel with the gradient to achieve optimization update of the distillation dataset.
[0091] The robust dataset distillation system, wherein the added adversarial perturbation specifically comprises: adding an adversarial perturbation for the parameters of the target deep neural network model to the samples in the original sample set, and the adversarial perturbation is a technical term in the art, which can be calculated for the model parameters.
[0092] The application also provides a storage medium for storing a program for executing any of the robust dataset distillation methods.
[0093] The application also provides a client for any of the robust dataset distillation systems.
Claims
1. A robust dataset distillation method, characterized in that, include: Step 1: Randomly sample from the original training dataset to create the initial distillation dataset; Step 2: Randomly sample the original training dataset to obtain the original sample set; Step 3: Add adversarial perturbation to the original sample set to obtain the perturbed sample set; Step 4: Calculate the feature representation or network gradient of the perturbation sample set and the distillation dataset respectively, and use the difference between the feature representation or network gradient as the loss function; Step 5: Optimize and update the distillation dataset by backpropagation based on the loss function, and repeat steps 2 to 5 to iterate the optimization process until the loss function converges. Save the current distillation dataset as the final robust distillation dataset. The original training dataset consists of multiple images. The optimization update includes: calculating the loss value based on the loss function and performing gradient backpropagation to obtain the gradient of the pixel value update for each image in the distillation dataset, and modifying the color of the corresponding pixel based on the gradient to achieve the optimization update of the distillation dataset.
2. The robust dataset distillation method as described in claim 1, characterized in that, Also includes: Step 6: Replace the original training dataset with the robust distillation dataset and train the target deep neural network model to complete image recognition and classification.
3. The robust dataset distillation method as described in claim 2, characterized in that, The added adversarial perturbation specifically includes: adding adversarial perturbations to the samples in the original sample set that target the parameters of the current deep neural network model.
4. A robust dataset distillation system, characterized in that, include: The initial module is used to distill and compress the original training dataset to be distilled into a distilled dataset; The sampling module is used to randomly sample the original training dataset to obtain the original sample set. The perturbation module is used to add adversarial perturbations to the original sample set to obtain a perturbed sample set. The training module is used to calculate the feature representation or network gradient of the perturbation sample set and the distillation dataset respectively. The difference between the feature representation or network gradient is used as the loss function. The distillation dataset is optimized and updated by backpropagation based on the loss function. The optimization process is iterated until the loss function converges. The current distillation dataset is saved as the final robust distillation dataset. The original training dataset consists of multiple images. The optimization update includes: calculating the loss value based on the loss function and performing gradient backpropagation to obtain the gradient of the pixel value update for each image in the distillation dataset, and modifying the color of the corresponding pixel based on the gradient to achieve the optimization update of the distillation dataset.
5. The robust dataset distillation system as described in claim 4, characterized in that, Also includes: The image classification module is used to replace the original training dataset with this robust distillation dataset to train the target deep neural network model to complete image recognition and classification.
6. The robust dataset distillation system as described in claim 5, characterized in that, The added adversarial perturbation specifically includes: adding adversarial perturbations to the parameters of the target deep neural network model for the samples in the original sample set.
7. A storage medium for storing a program that executes any of the robust dataset distillation methods as described in claims 1 to 3.
8. A client for implementing any one of the robust dataset distillation systems of claims 4 to 6.
Citation Information
Patent Citations
Remote sensing image classification network robustness improvement method based on self-supervised learning
CN114067177A
Robustness image classification method based on multi-model adversarial distillation
CN114842257A