A Adversarial Training Method Based on Latent Feature Similarity

Abstract

An adversarial training method based on latent feature similarity, involving neural network training. Aiming at the difference between the latent feature relationship of normal samples and adversarial samples, an adversarial training method based on constraining the latent feature similarity of normal samples and adversarial samples is proposed. It includes the following steps: Step 1: Select a batch of samples x clean , through the iterative attack algorithm T steps, we get the adversarial sample x adv Step 2: Input the clean sample and the adversarial sample into the neural network at the same time; use LFRC regularization and the ordinary adversarial training algorithm to calculate the gradient and update the neural network parameter θ. Step 3: Check whether the entire data set has been trained, otherwise jump back to step 1. Step 4: Check whether the neural network has converged, if not, jump back to step 1. Otherwise, output the neural network f θ After the training is completed, a neural network with adversarial robustness is obtained.

Description

Technical Field

[0001] The present invention relates to neural network training, and in particular to an adversarial training method based on latent layer feature similarity. Background Art

[0002] Neural networks have achieved remarkable results in many tasks. However, recent research has shown that neural network models are highly vulnerable to adversarial attacks. Attackers manipulate input images with noise imperceptible to the human eye, causing the neural network model to output erroneous calculation results. These attacks are widespread, posing a serious security threat to the implementation and deployment of neural network-based applications.

[0003] Faced with an increasing number of attack methods, a large number of defense methods have been invented, such as those based on knowledge distillation, popular projections, preprocessing, and the now relatively successful adversarial training method (see Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. ICLR, 2018). However, recent research has shown that most current defense methods are only effective in specific situations and fail to generalize to practical applications. The only relatively successful defense method is adversarial training (see Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. ICML, 2018). Adversarial training involves mixing adversarial examples generated by attack methods with original data to train a network model. It is essentially a data augmentation method. Summary of the Invention

[0004] The purpose of the present invention is to solve the above-mentioned defects of adversarial training, alleviate the problem of inconsistency in the relationship between latent features learned by the model for pure samples and adversarial samples in adversarial training scenarios, and at the same time improve the robustness of the model. An adversarial training method based on latent feature similarity is provided, which considers the latent feature similarity of normal samples and adversarial samples, calculates the latent feature similarity matrices of normal samples and adversarial samples respectively, and then constrains the difference between the two latent similarity matrices to perform adversarial training, so that the entire adversarial training captures the relationship between samples instead of focusing on only a single sample, effectively improving the adversarial robustness of the neural network.

[0005] The present invention is applicable to any field that uses convolutional neural networks and contains adversarial scenarios.

[0006] The present invention comprises the following steps:

[0007] 1) Select a batch of pure samples x clean , through the iterative attack algorithm T steps, generate adversarial samples x adv ;

[0008] 2) The pure sample x clean and adversarial examples x adv At the same time, input the neural network f θ In the above example, we calculate the pure sample x clean and adversarial examples x adv The latent feature similarity matrix is ​​constrained, and the difference between the two latent similarity matrices is constrained. The latent relationship consistency adversarial training is performed to make the relationship between the adversarial samples consistent with the relationship between the pure samples. The gradient is calculated using LFRC regularization and ordinary adversarial training to update the parameters θ of the neural network.

[0009] 3) Check if the entire dataset has been trained, otherwise jump back to step 1);

[0010] 4) Whether the neural network converges, if not, jump back to step 1), otherwise output the neural network f θ , that is, a neural network with adversarial robustness is obtained after training.

[0011] In step 2), the pure samples x are calculated respectively. clean and adversarial examples x adv The specific steps to constrain the difference between the two latent similarity matrices are:

[0012] (1) Latent feature similarity:

[0013] Select a batch of pure samples x clean , and its latent feature of layer l is The cosine similarity is used to measure the sample x i and sample x j Similarity:

[0014]

[0015] For each pair of samples in the batch, calculate the similarity between them. clean , and get the similarity matrix of its l-layer latent features: in:

[0016] Q i，j =Q j，i =simi，j

[0017] Similarly, we get the adversarial sample x adv , the latent feature similarity matrix at the same layer (layer l)

[0018] (2) Distance metric of similarity matrix:

[0019] Given the latent feature similarity matrix Q(x adv ) and the similarity matrix Q(x clean ), define the distance between two similarity matrices as:

[0020]

[0021] Use φ=exp to measure the distance, that is:

[0022]

[0023] Minimize L LFRC The latent feature similarity matrix of the adversarial sample is made consistent with the similarity matrix of the clean sample, that is, the relationship between the adversarial sample and the relationship between the clean sample are kept consistent.

[0024] (3) Adversarial training of latent relation consistency:

[0025] In order to make the normal samples and adversarial samples learned by the neural network have the same latent feature relationship, the difference between the two is penalized, that is:

[0026]

[0027] In order to make the neural network more robust, an adversarial training method based on latent relationship consistency is proposed. The specific definition is as follows:

[0028]

[0029] Among them, L is the cross entropy loss function commonly used in classification tasks, y clean Represents the original sample x ctean The true label of , where λ is a parameter that balances the cross entropy loss and the latent feature relationship consistency loss; the value range of λ is [0,1; when λ = 0, the latent relationship consistency adversarial training degenerates into ordinary adversarial training;

[0030] Latent relation consistency adversarial training is orthogonal to ordinary adversarial training and can be combined with ordinary adversarial training to further improve the robustness of the model.

[0031] Compared with the prior art, the present invention has the following outstanding advantages:

[0032] The present invention performs adversarial training of neural networks by constraining the similarity of the latent features of normal samples and adversarial samples. The latent feature relationship consistency constraint proposed by the present invention alleviates the inconsistency problem of the latent feature relationship learned by traditional adversarial training for pure samples and adversarial samples, while improving the robustness of the neural network. The latent feature relationship consistency fully captures the relationship between the latent features of normal samples and adversarial samples, forcing the latent relationship of adversarial samples and the latent relationship of normal samples to remain consistent in the latent space, thereby improving the generalization and robustness of the neural network. Experiments have shown that the present invention can effectively improve the robustness of neural networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 Schematic diagram of the overall framework of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following examples will illustrate the present invention in detail with reference to the accompanying drawings.

[0035] The purpose of the present invention is to alleviate the problem of inconsistency between the latent feature relationships learned by the model for pure samples and adversarial samples in adversarial training scenarios, while improving the robustness of the model. Figure 1 As shown, an adversarial attack algorithm is first used to generate adversarial samples. Then, both the adversarial samples and clean samples are input into the neural network. By penalizing the difference between the similarity matrix of the clean sample latent features and the similarity matrix of the adversarial sample latent features, the neural network is trained in combination with conventional adversarial training methods. This invention can significantly improve the robustness and generalization ability of the neural network model under various attacks.

[0036] The present invention comprises the following parts:

[0037] 1 Latent feature relationship

[0038] Symbolic representation: Use f θ Represents a neural network model with parameter θ, using To represent the latent features of the neural network layer l, x clean represents a pure sample, x adv Denotes adversarial samples. D denotes the entire instance dataset, D clean represents a data set containing only pure samples, D adv represents a data set containing only adversarial examples.

[0039] 1.1 Latent Feature Similarity

[0040] Consider a batch of pure samples x clean , and its latent feature of layer l is The cosine similarity is used to measure the sample x iand sample x j Similarity:

[0041]

[0042] For each pair of samples in the batch, the similarity between them is calculated. Finally, for the batch of samples x clean , we can get the similarity matrix of its l-layer latent features: in:

[0043] Q i，j =Q j，i =sim i，j .

[0044] Similarly, we can get the adversarial sample x adv , the latent feature similarity matrix at the same layer (layer l)

[0045] 1.2 Distance metric of similarity matrix

[0046] Given two similarity matrices Q(x adv ), Q(x clean ) (the size of the matrix is ​​B×B), and the distance between the two similarity matrices is defined as (Latent Feature Relation Consistency):

[0047]

[0048] Use φ=exp to measure the distance, that is:

[0049]

[0050] Minimize L LFRC The latent feature similarity matrix of the adversarial sample can be made consistent with the similarity matrix of the pure sample, that is, the relationship between the adversarial sample and the relationship between the pure sample are consistent.

[0051] 2 Adversarial Training Method for Latent Relational Consistency

[0052] In order to make the normal samples and adversarial samples learned by the neural network have the same latent feature relationship, the difference between the two is penalized, that is:

[0053]

[0054] In order to make the neural network more robust, an adversarial training method based on latent relationship consistency is proposed. The specific definition is as follows:

[0055]

[0056] Among them, L is the cross entropy loss function commonly used in classification tasks, y clean Represents the original sample x clean The true label of , λ is a parameter that balances the cross entropy loss and the latent feature relation consistency loss. The value range of λ is [0, 1]. When λ = 0, latent relation consistency adversarial training degenerates into normal adversarial training.

[0057] Latent relation consistency adversarial training is orthogonal to previous adversarial training methods and can be combined with previous adversarial training methods to further improve the robustness of the model.

[0058] The specific algorithm process is as follows:

[0059] Input parameters: neural network f θ , dataset D, number of iterative attacks T, learning rate η, and balance factor λ.

[0060] Output: Robust neural network f θ .

[0061] Step 1: Select a batch of samples x clean , through the iterative attack algorithm T steps, we can get the adversarial sample x adv .

[0062] Step 2: Input the clean sample and the adversarial sample into the neural network simultaneously. Use LFRC regularization and the common adversarial training algorithm to calculate the gradient and update the neural network parameters θ.

[0063] Step 4: Check whether the entire dataset has been trained, otherwise jump back to step 1.

[0064] Step 5: Check whether the neural network has converged. If not, go back to step 1. Otherwise, output the neural network f θ .

[0065] The algorithm flow is as follows:

[0066]

[0067] The present invention first uses an adversarial attack algorithm to generate adversarial samples, and then inputs both the adversarial samples and the clean samples into the neural network. By penalizing the difference between the similarity matrix of the latent features of the clean samples and the similarity matrix of the latent features of the adversarial samples, the neural network is trained in combination with the common adversarial training method. Based on the scheme proposed by the present invention, experimental verification was carried out on two data sets, and the experimental results are shown in Tables 1 and 2. Table 1 shows the classification accuracy of ResNet-18 under white box attack on CIFAR-10 and CIFAR-100 data sets. Table 2 shows the classification accuracy of ResNet-18 under black box attack on CIFAR-10 and CIFAR-100 data sets.

[0068] Table 1

[0069]

[0070] Table 2

[0071]

[0072] The experimental measurement metric is the classification accuracy. Through the comparison of experimental results, the solution of the present invention can significantly improve the robustness and generalization ability of the neural network model under various attacks.

Claims

1. A latent feature similarity-based adversarial training method, characterized by The following steps are involved: 1) Select a batch of pure samples x clean , through the iterative attack algorithm T steps, generate adversarial samples x adv ; 2) The pure sample x clean and adversarial examples x adv At the same time, input the neural network f θ In the above example, we calculate the pure sample x clean and adversarial examples x adv The latent feature similarity matrix is ​​constrained, and the difference between the two latent similarity matrices is constrained. The latent relationship consistency adversarial training is performed to make the relationship between the adversarial samples consistent with the relationship between the pure samples. The gradient is calculated using LFRC regularization and ordinary adversarial training to update the parameters θ of the neural network. The pure samples x are calculated separately clean and adversarial examples x adv The specific steps to constrain the difference between the two latent similarity matrices are: (1) Latent feature similarity: Clean sample x clean , and its latent feature of layer l is The cosine similarity is used to measure the sample x i and sample x j Similarity: For a batch of pure samples x selected in step 1) clean For each pair of samples in the batch, calculate the similarity between them. clean , and get the similarity matrix of its l-layer latent features: in: Q i,j =Q j,j =sim i,j Similarly, we get the adversarial sample x adv Latent feature similarity matrix at the same layer (2) Distance metric of similarity matrix: Given the latent feature similarity matrix Q(x adv ) and the similarity matrix Q(x clean ), define the distance between two similarity matrices as: Use φ=exp to measure the distance, that is: Minimize L LFRC Make the latent feature similarity matrix of the adversarial sample consistent with the similarity matrix of the clean sample, that is, the relationship between the adversarial sample and the relationship between the clean sample are consistent; (3) Adversarial training of latent relation consistency: In order to make the normal samples and adversarial samples learned by the neural network have the same latent feature relationship, the difference between the two is penalized, that is: In order to make the neural network more robust, an adversarial training method based on latent relationship consistency is proposed. The specific definition is as follows: Among them, L is the cross entropy loss function commonly used in classification tasks, y clean Represents the original sample x clean The true label of , where λ is a parameter that balances the cross entropy loss and the latent feature relationship consistency loss; the value range of λ is [0,1]; when λ = 0, the latent relationship consistency adversarial training degenerates into ordinary adversarial training; 3) Check if the entire dataset has been trained, otherwise jump back to step 1); 4) Whether the neural network converges, if not, jump back to step 1), otherwise output the neural network f θ , that is, a neural network with adversarial robustness is obtained after training.

2. The adversarial training method based on latent feature similarity as claimed in claim 1, characterized in that In step 2), latent relation consistency adversarial training and ordinary adversarial training are orthogonal, and the two are combined to improve the robustness of the model.

Images