An adversarial training method based on a linear piecewise loss function

Abstract

This invention relates to an adversarial training method based on a linear piecewise loss function. The linear piecewise loss function employs the Taylor expansion concept, decomposing the cross-entropy loss function into a series of weighted polynomial bases. By adjusting the coefficients, a better-fitting loss function is obtained. L2 regularization is used to constrain the loss function parameters, increasing the robustness of the network model. In the feedforward network of adversarial training, large convolutional kernels are used to learn the overall features of the image first, reducing the influence of non-robust features. Simultaneously, 1*1 convolutional kernels are used for dimensionality reduction, and global average pooling layers are used to replace fully connected layers, reducing the number of computational parameters. After generating adversarial examples, batch normalization layers are integrated into the adversarial training stage of the network to reduce the uneven data distribution caused by adversarial examples, improving the robustness of the network model. This effectively solves the problems of low model robustness improvement and significant accuracy drop on clean data caused by traditional adversarial training.

Description

Technical fields:

[0001] This invention relates to the field of image processing technology for artificial intelligence models, and specifically to an adversarial training method based on a linear piecewise loss function. Background technology:

[0002] In recent years, deep convolutional neural networks (CNNs) have made groundbreaking progress in image processing. In image classification and recognition, trained network models can now replace manual image classification. While CNNs boast superior performance, their vulnerability to adversarial attacks raises concerns about their robustness. For example, adding adversarial perturbations to images can cause misclassification by the network model, even though these images appear indistinguishable from the original to the human eye. Furthermore, the presence of adversarial examples during network testing can significantly reduce the accuracy of the network model. In the physical world, especially in the field of autonomous driving, adding micro-perturbations to the input images can lead to incorrect classification results, potentially rendering the entire network model unusable.

[0003] To improve the robustness of convolutional neural networks, existing techniques have proposed a defense strategy against adversarial examples, namely adversarial training. The core of adversarial training is to mix the original dataset with adversarial examples before feeding it into the network for training, thereby enhancing the network's robustness. Therefore, the quality of the adversarial examples becomes a key factor affecting the network's robustness; superior adversarial examples can significantly improve the effectiveness of adversarial training, thus significantly enhancing the network's robustness.

[0004] In white-box attacks, common adversarial example generation methods currently rely on gradient information, such as FGSM, I-FGSM, and PGD. These methods iteratively generate adversarial perturbations along the ascending gradient of the loss function, which are then added to the original image to generate the adversarial example. While adversarial training using these methods can improve model robustness, it leads to a significant drop in accuracy on clean datasets, with adversarial example accuracy only reaching 30%–40%. This severe decline in clean dataset accuracy makes the adversarially trained model lack practical application value. Therefore, it is essential to design a new adversarial training method that aims to improve network model robustness while maintaining a high level of accuracy on clean datasets.

[0005] It should be noted that the above content falls within the inventor's technical knowledge and does not necessarily constitute prior art. Summary of the Invention:

[0006] The purpose of this invention is to solve the problems existing in the prior art and provide an adversarial training method based on a linear piecewise loss function. By creatively introducing the linear piecewise loss function into adversarial training, it can effectively solve the problems of low model robustness improvement and significant decrease in accuracy on clean data caused by traditional adversarial training.

[0007] The present invention achieves the above objectives by adopting the following technical solutions:

[0008] An adversarial training method based on a linear piecewise loss function includes the following steps:

[0009] S1. Obtain the original image x

[0010] The original images are obtained by preprocessing 50,000 training images of 32*32*3 from the public dataset CIFAR-10.

[0011] S2. Construct a feedforward network f(θ), where θ is the network parameter, and obtain the confidence scores P for different categories. i

[0012] The feedforward network structure includes a 3*3 convolutional layer, a deep residual structure layer consisting of four different residual layers, a 1*1 convolutional layer, and a global average pooling layer, which are arranged in sequence. The first residual layer uses a large convolutional kernel to extract the overall features, the 1*1 convolutional layer is used for data dimensionality reduction from 512 dimensions to 10 dimensions, and the global average pooling layer is used to output a one-dimensional vector.

[0013] The original image is processed by a feedforward network to obtain the confidence scores P corresponding to different classification categories i. i ;

[0014] S3. Construct a linear piecewise loss function L and calculate the loss of the network output structure.

[0015]

[0016] In the formula, δ represents the polynomial coefficients, and P i For confidence level, L CE Let λ be the cross-entropy loss function, λ be the regularization coefficient, and k be the number of parameters. Here, ||θ|| represents the regularization coefficient, and θ represents the network parameter. 2 For L2 regularization terms;

[0017] During backpropagation, the SGD optimizer is used for parameter updates, and the gradient of the linear piecewise loss function L is:

[0018]

[0019] The SGD optimizer updates its parameters along the gradient descent direction, where α is the learning rate for each descent. The presence of the L2 regularization term transforms the optimization process of the loss function L into:

[0020]

[0021] Network parameters θ i Before gradient descent, first compare the coefficients. Multiply, where Therefore, it can be ensured that the network parameter θ is updated every time. i+1 By continuously reducing the size, the convergence ability of the network can be improved.

[0022] S4. Construct adversarial example x′

[0023] Taking the partial derivative of the linear piecewise loss function L with respect to the original image x, we obtain the gradient grad:

[0024]

[0025] The projective gradient descent method is used to find the adversarial perturbation η and construct the adversarial example x′:

[0026] To prevent visually altering the original image by adding perturbations to each pixel, a maximum perturbation space ε is defined within the ∞ norm space. Within this space, the sign function sign() is used to retrieve the direction of gradient change. Following the direction of gradient ascent, an iteration is performed using the perturbation coefficient α to generate an adversarial perturbation η.

[0027] η = αsign(grad);

[0028] If η≤ε, it means that the generated adversarial perturbation is within the maximum perturbation space, and adding the adversarial perturbation η to the original image x completes one iteration:

[0029] x′=x+η;

[0030] if This indicates that the generated adversarial perturbation is outside the maximum perturbation space. Projecting it back into the perturbation space, i.e., adding ε to the original image x, completes one iteration. In subsequent iterations, the generated adversarial perturbation η will be projected onto the boundary of the perturbation range.

[0031] x′=x+ε;

[0032] In the K-step iterations, the above process is repeated, and after the iterations are completed, the adversarial sample x′ is output;

[0033] or,

[0034] Using the fast gradient sign method, construct the adversarial example x′:

[0035] The adversarial perturbation η = αsign(grad) generated by single-step iteration will be added to the original image to form adversarial examples:

[0036] x′=x+η;

[0037] S5. Optimize adversarial training to improve network robustness.

[0038] Adversarial sample x′ is mixed with the original image x and fed into the feedforward network f(θ) for adversarial training to obtain a robust network model. Since the adversarial sample x′ is formed by adding adversarial perturbation η to the original image, there is a difference in data distribution between it and the original image. In order to prevent the phenomenon of internal covariate shift during network training, a batch normalization layer is added after each convolutional layer, and learnable parameters are added for normalization processing to reduce the error caused by the difference in data distribution and improve the robustness of the network.

[0039] S6. Update the network and complete the adversarial training.

[0040] After the network learns the features of adversarial examples, it performs backpropagation based on the loss value of the linear piecewise loss function to update the network. The model is then saved based on whether the accuracy has improved, thus completing the adversarial training based on the linear piecewise loss function.

[0041] The data preprocessing in step S1 includes first filling the training image of size 32*32*3 with pixels to make it 40*40*3, then cropping it to a uniform size of 32*32*3, and then randomly flipping it horizontally to perform data augmentation.

[0042] The feedforward network f(θ) in step S2 is mainly constructed using ResNet34, and includes a convolutional layer 1, residual layer 1, residual layer 2, residual layer 3, residual layer 4, convolutional layer 2, and a global average pooling layer arranged sequentially. The convolutional layer 1 has a kernel size of 3 and a stride of 1, with a total of 64 convolutional kernels. The output size of the convolutional layer 1 is 32*32*64. The convolutional kernels in the residual layer 1 use large 21*21 kernels to extract the overall features of the image and prevent the network from overfitting non-robust features in the image. The output size is 32*32*64. In each residual layer structure, the input is led to the output through a branch structure. If the number of input and output channels does not match, a 1*1 convolutional kernel is added to the branch structure to change the dimension. The feature map size after extraction by residual layer 1, residual layer 2, residual layer 3 and residual layer 4 is 4*4*512. Then, convolutional layer 2 is used for dimensionality reduction. Convolutional layer 2 uses a 1*1 convolutional kernel to reduce the dimension to the number of classification categories, 10. Then, a global average pooling layer is used to obtain a 1*1*10 one-dimensional vector, which, after flattening, corresponds to the confidence P of different categories. i .

[0043] In step 5, a batch normalization layer is added after each convolutional layer to constrain the data distribution. First, the mean and variance of the m samples in each batch are calculated using the following formula:

[0044]

[0045] Normalization is performed using the mean and variance of m samples in the batch, where ζ is a very small positive number, calculated as follows:

[0046]

[0047] To prevent the data from being confined to a normal distribution after normalization, two learnable coefficients, γ and β, are added to enhance the network's expressive power. The calculation formula is as follows:

[0048]

[0049] After batch normalization, the network can automatically learn and record the data distribution during the training phase, and normalize the data distribution of the test samples to the training set during the testing phase, thereby reducing errors caused by differences in data distribution and improving the robustness of the network.

[0050] The present invention, employing the above-described structure, can bring the following beneficial effects:

[0051] (1) An innovative adversarial training method based on a linear piecewise loss function is proposed. The linear piecewise loss function adopts the idea of ​​Taylor expansion, decomposes the commonly used cross-entropy loss function in classification networks into a series of weighted polynomial bases through Taylor expansion, obtains a loss function that fits the current convolutional neural network well by adjusting the coefficients, and uses L2 regularization to constrain the parameters of the loss function so that the parameters tend to decrease continuously during the update, thereby increasing the robustness of the model. At the same time, it can obtain adversarial perturbations with larger gradients when generating adversarial examples, effectively enhancing the harm of adversarial examples.

[0052] (2) Innovatively, a large convolutional kernel is used in the adversarial training feedforward network to learn the overall features of the image first, thereby expanding the receptive field of the network and reducing the impact of non-robust features. At the same time, after dimensionality reduction using a 1*1 convolutional kernel, a global average pooling layer is used to replace the fully connected layer, reducing the number of computational parameters.

[0053] (3) Innovatively, after generating adversarial examples using a linear piecewise loss function, a batch normalization layer is integrated into the adversarial training stage of the network. By normalizing the distribution of the input images, the uneven data distribution caused by adversarial examples is reduced, which is beneficial for the network to learn from the data, accelerates the convergence speed of the network, and improves the robustness of the network model. Attached image description:

[0054] Figure 1 This is a flowchart illustrating the adversarial training method of the present invention;

[0055] Figure 2 (a) is a schematic diagram of the residual module 1 of the present invention; Figure 2 (b) is a schematic diagram of the residual module 2 of the present invention;

[0056] Figure 3 This invention describes the process of generating PGD adversarial examples using a linear piecewise loss function. Detailed implementation method:

[0057] To more clearly illustrate the overall concept of the present invention, a detailed description will be provided below with reference to the accompanying drawings and examples.

[0058] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0059] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0060] Example 1

[0061] like Figure 1 As shown in the figure, an adversarial training method based on a linear piecewise loss function disclosed in this invention includes the following steps:

[0062] S1. Obtain the original image x

[0063] The original images are obtained by preprocessing 50,000 training images of 32*32*3 from the public dataset CIFAR-10.

[0064] The data preprocessing is as follows: the image of size 32*32*3 is padded with pixels to 40*40*3, then randomly cropped to size 32*32*3, and randomly horizontally flipped for data augmentation;

[0065] S2. Construct a feedforward network f(θ), where θ is the network parameter, and obtain the confidence scores P for different categories. i

[0066] The feedforward network f(θ) is mainly constructed using ResNet34, and contains 2 convolutional layers, 4 residual structures, and 1 global average pooling layer. A schematic diagram of the residual structure is shown below. Figure 2As shown in (a). Since the CIFAR-10 dataset is relatively small (32*32*3), in this embodiment, the kernel size of convolutional layer 1 is set to 3, the stride to 1, and the padding to 1, for a total of 64 kernels. The output size after convolutional layer 1 is 32*32*64. The main feature extraction stage in the network occurs in four residual structures. The convolutional kernels in residual layer 1 use large 21*21 kernels to extract overall image features and prevent the network from overfitting non-robust features in the image. In each residual structure, a branch structure guides the input to the output. If the number of input and output channels does not match, a 1*1 convolutional kernel is added to the branch structure to change the dimension, such as... Figure 2 As shown in (b), the feature map size after extraction through residual layers 1, 2, 3, and 4 is 4*4*512. Then, convolutional layer 2 (1*1 convolutional kernel) is used for dimensionality reduction. Since the CIFAR-10 dataset has 10 classification categories, the dimension needs to be reduced to 10. Afterwards, a global average pooling layer is used to obtain a 1*1*10 one-dimensional vector, which, after flattening, corresponds to the confidence scores P for different categories. i .

[0067] The detailed structure of the feedforward network is shown in Table 1:

[0068] Table 1. Detailed structure of the feedforward network based on ResNet34

[0069] enter operate kernel size Number of convolution kernels Step length Output 32*32*3 Convolutional layer 1 3 64 1 32*32*64 32*32*64 Residual layer 1 21 64 1 32*32*64 32*32*64 Residual layer 2 3 128 2，1 16*16*128 16*16*128 Residual layer 3 3 256 2，1 8*8*256 8*8*256 Residual layer 4 3 512 2，1 4*4*512 4*4*512 Convolutional layer 2 1 10 1 4*4*10 4*4*10 Global average pooling layer - - - 1*1*10

[0070] The forward propagation of the adversarial training network is as follows: After preprocessing, the original image from the CIFAR-10 dataset has a size of 32*32*3. It then passes through a standard 3*3 convolutional layer (convolutional layer 1) before entering a deep residual structure layer. Residual layer 1 uses large-size convolutional kernels to ensure the integrity of the network's learned features. Residual layers 2, 3, and 4 use 3*3 convolutional kernels for feature extraction. Simultaneously, the branching structure in residual layer 1 can directly lead the input to the output, while the inputs in residual layers 2, 3, and 4 need to undergo dimensionality transformation through 1*1 convolutional kernels before being led to the output. After feature extraction through the residual structure, the image undergoes dimensionality reduction through 1*1 convolutional kernels (convolutional layer 2), reducing the dimension to the number of classification categories (10). A global average pooling layer then yields a one-dimensional vector, which, after flattening, corresponds to the confidence scores P for different categories. i .

[0071] S3. Construct a linear piecewise loss function L and calculate the loss of the network output structure.

[0072] The confidence level P obtained from the feedforward network i A new loss function (linear piecewise loss function) is constructed to calculate the classification loss of the network. By performing a Taylor expansion of the cross-entropy loss function, it is decomposed into a series of weighted polynomial bases, as shown in the following formula:

[0073]

[0074] In the formula α j ∈R + P represents the polynomial coefficients. i The linear piecewise expansion of the cross-entropy loss function for different classification confidence levels is shown in the following formula:

[0075]

[0076] Experiments have shown that at least 600 higher-order terms are needed in the above expansion to fit the effect of the cross-entropy loss function. Therefore, the infinite number of higher-order terms cannot be easily discarded. Furthermore, adjusting the coefficients of the first polynomial term can yield results that surpass the original function L. CE Therefore, by adjusting the coefficients of the first polynomial in the above formula, we obtain the following formula:

[0077] L=(1+ε)(1-P i )+1 / 2(1-P i ) 2 +...

[0078] =δ(1-P i )+(1-P i )+1 / 2(1-P i ) 2 +...

[0079] =δ(1-P i )+L CE

[0080] Based on the above conclusions, the piecewise linear loss function L can ultimately be expressed as the following formula:

[0081] L=δ(1-P i )+L CE

[0082] δ represents the polynomial coefficients; in this embodiment, δ = 1.3 is chosen to provide a good fit for the network. CE The cross-entropy loss function;

[0083] Add an L2 regularization term to the linear piecewise loss function L, as shown in the following formula:

[0084]

[0085] The linear piecewise loss function L then becomes:

[0086]

[0087] When using the SGD optimizer for parameter optimization, the gradient of the linear piecewise loss function L is:

[0088]

[0089] When updating parameters along the gradient descent direction, the parameter optimization process with α as the learning rate (step size) becomes as follows:

[0090]

[0091] Where the coefficient Therefore, it can be guaranteed that during gradient descent, the model parameter θ remains constant. i+1 The decreasing value plays an important role in improving the robustness of the model.

[0092] S4. Construct adversarial example x′

[0093] like Figure 3 As shown, the gradient of the linear piecewise loss function L with respect to the original image x is obtained by taking the partial derivative with respect to the original image, as shown in the following formula:

[0094]

[0095] Adversarial examples are generated using Projected Gradient Descent (PGD). Given a perturbation space ε in the ∞ norm space, the method iterates 10 times along the direction of gradient ascent of the loss function L. The magnitude of the generated perturbation is shown below:

[0096] η = αsign(grad)

[0097] If the perturbation space ε is not exceeded, then a perturbation η is added to the original image x, as shown below:

[0098] x'=x+η

[0099] If the perturbation exceeds the perturbation space ε, then ε is added to the original image x, as shown below:

[0100] x'=x+ε

[0101] Repeat the above steps until the iteration is complete, and obtain the adversarial sample x′.

[0102] S5. Optimize adversarial training to improve network robustness.

[0103] The adversarial example x′ obtained in step S4 is mixed into the original image x to obtain training data, which is then fed into the feedforward network for learning. The adversarial example adds perturbation to each pixel, changing non-robust features in the original image such as texture, but has no effect on robust features such as shape and color that are visible to the naked eye. In this case, using a large convolutional kernel in the residual layer 1 of the feedforward network can obtain a larger receptive field and improve the robustness of the model.

[0104] Adding an adversarial perturbation η to the original image x will cause the data distribution of the adversarial sample x′ to differ from that of the original image, resulting in internal covariate shift during network training. Therefore, a batch normalization layer is added after each convolutional layer to constrain the data distribution. First, the mean and variance of the m samples in each batch are calculated, as shown below:

[0105]

[0106] Normalization is performed using the mean and variance of m samples in the batch, with ζ taking a value of 0.000001, as shown below:

[0107]

[0108] To prevent the data from being confined to a normal distribution after normalization, two learnable coefficients, γ and β, are added to enhance the network's expressive power, as shown below:

[0109]

[0110] After batch normalization, the network can automatically learn and record the data distribution during the training phase, and normalize the data distribution of the test samples to the training set during the testing phase, thereby reducing errors caused by differences in data distribution and improving the robustness of the network.

[0111] S6. Update the network and complete the adversarial training.

[0112] After the network learns the features of adversarial examples, it backpropagates the loss value based on the linear piecewise loss function to update the network. The model is then saved based on whether the accuracy improves, thus completing the adversarial training.

[0113] The experimental results using Example 1 are shown in Table 2:

[0114] Table 2 shows the classification accuracy of the network after training with PGD adversarial attacks.

[0115]

[0116] Example 2

[0117] The difference between this embodiment and Embodiment 1 is that:

[0118] This embodiment employs the Fast Gradient Sign (FGSM) method to generate adversarial examples. It uses a single-step iterative process to generate an adversarial perturbation η = αsign(grad), which is then added to the original image to form the adversarial example.

[0119] x' = x + η.

[0120] The experimental results using Example 2 are shown in Table 3:

[0121] Table 3 shows the classification accuracy of the trained network using the FGSM attack.

[0122]

[0123] The experimental results of the two embodiments are shown in Tables 2 and 3. In the CIFAR-10 dataset, without adversarial examples, the classification accuracy of the normally trained network is 89.98%, while under PGD attack, the accuracy drops to 6.01%; under FGSM attack, the accuracy drops to 15.67%. After improving the robustness of the network model using the method proposed in this invention, the classification accuracy increases to 54.59% and 55.36% respectively under adversarial attacks. Furthermore, the improved robustness of the model on clean datasets results in classification accuracies of 72.14% and 73.07%, respectively. Compared to the model trained using the cross-entropy loss function, both the robustness and practical application value of the model are significantly improved. Therefore, the adversarial training method based on a linear piecewise loss function proposed in this invention effectively solves the problems of low model robustness improvement and significant decrease in accuracy on clean data caused by traditional adversarial training.

[0124] The above specific embodiments should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, any alternative improvements or modifications made to the embodiments of the present invention shall fall within the scope of protection of the present invention.

[0125] Any aspects of this invention not described in detail are well-known to those skilled in the art.

Claims

1. An adversarial training method based on a linear piecewise loss function, characterized in that, Includes the following steps: S1. Obtain the original image x The original images are obtained by preprocessing 50,000 training images of 32*32*3 from the public dataset CIFAR-10. S2. Construct a feedforward network f(θ), where θ is the network parameter, and obtain the confidence scores P for different categories. i The feedforward network structure includes a 3*3 convolutional layer, a deep residual structure layer consisting of four different residual layers, a 1*1 convolutional layer, and a global average pooling layer, which are arranged in sequence. The first residual layer uses a large convolutional kernel to extract the overall features, the 1*1 convolutional layer is used for data dimensionality reduction from 512 dimensions to 10 dimensions, and the global average pooling layer is used to output a one-dimensional vector. The original image is processed by a feedforward network to obtain the confidence scores P corresponding to different classification categories i. i ; S3. Construct a linear piecewise loss function L and calculate the loss of the network output structure. In the formula, δ represents the polynomial coefficients, and P i For confidence level, L CE Let λ be the cross-entropy loss function, λ be the regularization coefficient, and k be the number of parameters. Here, ||θ|| represents the regularization coefficient, and θ represents the network parameter. 2 For L2 regularization terms; During backpropagation, the SGD optimizer is used for parameter updates, and the gradient of the linear piecewise loss function L is: The SGD optimizer updates its parameters along the gradient descent direction, where α is the learning rate for each descent. The presence of the L2 regularization term transforms the optimization process of the loss function L into: Network parameters θ i Before gradient descent, first compare the coefficients. Multiply, where Therefore, ensure that the network parameter θ is updated every time. i+1 By continuously reducing the size, the convergence ability of the network can be improved. S4. Construct adversarial example x′ Taking the partial derivative of the linear piecewise loss function L with respect to the original image x, we obtain the gradient grad: The projective gradient descent method is used to find the adversarial perturbation η and construct the adversarial example x′: To prevent visually altering the original image by adding perturbations to each pixel, a maximum perturbation space ε is defined within the ∞ norm space. Within this space, the sign function sign() is used to retrieve the direction of gradient change. Following the direction of gradient ascent, an iteration is performed using the perturbation coefficient α to generate an adversarial perturbation η. η = αsign(grad); If η≤ε, it means that the generated adversarial perturbation is within the maximum perturbation space, and adding the adversarial perturbation η to the original image x completes one iteration: x′=x+η; If η > ε, it means that the generated adversarial perturbation is outside the maximum perturbation space. Projecting it back into the perturbation space, i.e., adding ε to the original image x, completes one iteration. In subsequent iterations, the generated adversarial perturbation η will be projected onto the boundary of the perturbation range. x′=x+ε; In the K-step iterations, the above process is repeated, and after the iterations are completed, the adversarial sample x′ is output; or, Using the fast gradient sign method, construct the adversarial example x′: The adversarial perturbation η = αsign(grad) generated by single-step iteration will be added to the original image to form adversarial examples: x′=x+η; S5. Optimize adversarial training to improve network robustness. Adversarial sample x′ is mixed with the original image x and fed into the feedforward network f(θ) for adversarial training to obtain a robust network model. Since the adversarial sample x′ is formed by adding adversarial perturbation η to the original image, there is a difference in data distribution between it and the original image. In order to prevent the phenomenon of internal covariate shift during network training, a batch normalization layer is added after each convolutional layer, and learnable parameters are added for normalization processing to reduce the error caused by the difference in data distribution and improve the robustness of the network. S6. Update the network and complete the adversarial training. After the network learns the features of adversarial examples, it performs backpropagation based on the loss value of the linear piecewise loss function to update the network. The model is then saved based on whether the accuracy has improved, thus completing the adversarial training based on the linear piecewise loss function.

2. The adversarial training method based on a linear piecewise loss function according to claim 1, characterized in that, The data preprocessing in step S1 includes first filling the training image of size 32*32*3 with pixels to a size of 40*40*3, then cropping it to a uniform size of 32*32*3, and randomly flipping it horizontally to perform data augmentation. The feedforward network f(θ) in step S2 is mainly constructed using ResNet34, and includes a convolutional layer 1, residual layer 1, residual layer 2, residual layer 3, residual layer 4, convolutional layer 2, and a global average pooling layer arranged sequentially. The convolutional layer 1 has a kernel size of 3 and a stride of 1, with a total of 64 convolutional kernels. The output size of the convolutional layer 1 is 32*32*64. The convolutional kernels in the residual layer 1 use large 21*21 kernels to extract the overall features of the image and prevent the network from overfitting non-robust features in the image. The output size is 32*32*64. In each residual layer structure, the input is led to the output through a branch structure. If the number of input and output channels does not match, a 1*1 convolutional kernel is added to the branch structure to change the dimension. The feature map size after extraction by residual layer 1, residual layer 2, residual layer 3 and residual layer 4 is 4*4*512. Then, convolutional layer 2 is used for dimensionality reduction. Convolutional layer 2 uses a 1*1 convolutional kernel to reduce the dimension to the number of classification categories, 10. Then, a global average pooling layer is used to obtain a 1*1*10 one-dimensional vector, which, after flattening, corresponds to the confidence P of different categories. i .

3. The adversarial training method based on a linear piecewise loss function according to claim 2, characterized in that, In step S5, a batch normalization layer is added after each convolutional layer to constrain the data distribution. First, the mean and variance of the m samples in each batch are calculated using the following formula: Normalization is performed using the mean and variance of m samples in the batch, with ζ set to 0.000001. The calculation formula is as follows: To prevent the data from being confined to a normal distribution after normalization, two learned coefficients, γ and β, are added to enhance the network's expressive power. The calculation formula is as follows: After batch normalization, the network automatically learns and records the data distribution during the training phase, and normalizes the data distribution of the test samples to the training set during the testing phase, reducing errors caused by differences in data distribution and improving the robustness of the network.

Images