Adversarial sample detection method, system and device based on incremental learning and medium

Abstract

The application discloses an adversarial sample detection method based on incremental learning, comprising: an adversarial sample detection model training step: collecting a normal service sample data set, attacking the normal service sample data set by using multiple adversarial attack modes, generating multiple types of adversarial samples, and training an adversarial sample detection model based on incremental learning; a known attack adversarial sample detection step: based on the adversarial sample detection model based on incremental learning, the known attack type of adversarial sample is preliminarily filtered and detected; an unknown attack adversarial sample detection step: for the characteristics of the unknown type of adversarial attack sample, randomly adopting a similarity comparison judgment method or adopting an adversarial sample distance model decision method, and outputting the original sample with a detection result greater than a threshold value as a normal sample; the original sample with a detection result less than the threshold value is an unknown type of adversarial sample, and the detection of the adversarial sample based on the incremental model is realized. The application also discloses an adversarial sample detection system based on incremental learning.

Description

Technical Field

[0001] This application relates to a method for preventing adversarial attacks, and more particularly to an adversarial example detection method and system based on incremental learning. Background Technology

[0002] Currently, deep learning models used in production are the result of continuous iterative training using massive amounts of data and computing resources. They involve a great deal of human and material resources and have enormous economic value. If attackers were to steal these models and generate replacement models, it would cause direct economic losses. Moreover, training data often contains some private data. If this private data is obtained by attackers, it will inevitably lead to data leakage, which will bring great legal risks.

[0003] Model theft requires numerous query operations. Commercial models are often billed on a per-use basis, and risk control systems use device fingerprints and usage habits to flag devices that may be making abnormal calls, employing two-factor authentication and other methods to strengthen model protection. The large number of query operations increases the cost of model theft. In practice, constructing adversarial examples for querying is crucial for establishing alternative models. Therefore, detecting adversarial examples during calls can effectively protect models from theft.

[0004] Therefore, there is an urgent need to propose an adversarial sample detection method based on an online hot update model with incremental learning. This method can detect known and unknown types of adversarial samples through a two-level detection approach while the samples uploaded by the client are processed in the business process. This will help to identify whether the samples are normal samples and, at the same time, to perform incremental learning on the adversarial sample detection model to enhance the detection capability of new adversarial samples. Summary of the Invention

[0005] This application provides an adversarial example detection method based on incremental learning, which enables the detection of known and unknown types of adversarial examples through a two-level detection method while the samples uploaded by the client are used in the business process.

[0006] In a first aspect, embodiments of this application provide an adversarial example detection method based on incremental learning, including:

[0007] Adversarial example detection model training steps: Collect normal business sample dataset, use multiple detection methods to detect normal business sample dataset, generate multiple types of adversarial examples, and train an adversarial example detection model based on incremental learning;

[0008] Known attack adversarial sample detection steps: Based on the incremental learning adversarial sample detection model, perform preliminary filtering and detection of adversarial samples with known attack types;

[0009] The steps for detecting adversarial samples of unknown attack types are as follows: For the characteristics of adversarial attack samples of unknown types, a similarity comparison method or an adversarial sample distance model decision method is randomly adopted to output the detection results of adversarial attack samples of unknown types. The detection results are compared with a predetermined threshold. The original sample with the detection result greater than the threshold is a normal sample; the original sample with the detection result less than the threshold is an adversarial sample of unknown type, thus realizing the detection of adversarial samples based on incremental model.

[0010] In some embodiments of the present invention, the above-described adversarial example detection method based on incremental learning further includes:

[0011] The incremental iterative update steps for the detection model are as follows: Based on the unknown types of adversarial examples, the dataset is updated for the adversarial example detection model based on incremental learning.

[0012] In some embodiments of the present invention, the above-mentioned adversarial example detection model construction steps include:

[0013] Collection steps: Collect a dataset of normal business samples;

[0014] Adversarial sample dataset generation steps: Use normal business sample datasets to attack the business model, and generate multiple adversarial sample datasets using different attack methods and attack parameters.

[0015] Binary classification model training steps: Use the adversarial example dataset as two categories to train the binary classification model and obtain an adversarial example detection model based on incremental learning.

[0016] In some embodiments of the present invention, the above-mentioned unknown attack adversarial sample detection step includes:

[0017] Similarity comparison and judgment steps: Modify the original sample, use the same model to perform reasoning on the original sample before and after the modification, and judge the similarity of the output results. The original sample with a similarity greater than the preset threshold is a normal sample, and the original sample with a similarity less than the preset threshold is an unknown type adversarial sample.

[0018] In some embodiments of the present invention, the above-mentioned unknown attack adversarial sample detection step further includes:

[0019] Adversarial sample distance model decision steps: Apply an iterative adversarial attack to the input original sample to move it toward the decision boundary of the adversarial sample distance model. If the number of iterations is less than the preset number, the original sample is an unknown type of adversarial sample.

[0020] In some embodiments of the present invention, the above-mentioned incremental iterative update step of the detection model further includes:

[0021] The adversarial example detection model based on incremental learning is incrementally learned using a joint training-based incremental learning approach until the end of the iterative training, at which point the iteratively updated adversarial example detection model is used.

[0022] Secondly, embodiments of this application provide an adversarial example detection system based on incremental learning, employing the adversarial example detection method based on incremental learning as described above, including:

[0023] Adversarial Example Detection Model Training Module: This module is used to collect normal business sample datasets, detect normal business sample datasets using multiple detection methods, generate various types of adversarial examples, and train an adversarial example detection model based on incremental learning.

[0024] Known Attack Adversarial Sample Detection Module: Used for the incremental learning-based adversarial sample detection model to perform preliminary filtering and detection of adversarial samples with known attack types;

[0025] The unknown attack adversarial sample detection module is used to randomly apply similarity comparison or adversarial sample distance model decision methods to the characteristics of unknown types of adversarial attack samples. It outputs the detection results of unknown types of adversarial attack samples. The detection results are compared with the predetermined thresholds. The original samples with detection results greater than the threshold are normal samples; the original samples with detection results less than the threshold are unknown types of adversarial samples, realizing the detection of adversarial samples based on incremental model.

[0026] In some embodiments of the present invention, the above-described adversarial example detection system based on incremental learning further includes:

[0027] The incremental iterative update module for the detection model is used to update the dataset for the adversarial example detection model based on incremental learning, based on unknown types of adversarial examples.

[0028] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the incremental learning-based adversarial example detection method described above.

[0029] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the incremental learning-based adversarial example detection method described above.

[0030] Compared with existing technologies, it has the following outstanding advantages:

[0031] To prevent attackers from maliciously stealing models using adversarial examples, this invention performs parallel verification of sample legitimacy while maintaining normal business processes. A two-stage detection method is used to detect both known and unknown types of adversarial examples, thus determining whether a sample is legitimate. By accumulating adversarial examples and incrementally learning the adversarial example detection model, the method's ability to detect novel adversarial examples is enhanced. Attached Figure Description

[0032] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0033] Figure 1 This is a schematic diagram of the adversarial example detection method based on incremental learning of the present invention;

[0034] Figure 2a This is a schematic diagram of the original sample of a specific embodiment of the present invention;

[0035] Figure 2b This is a schematic diagram of an adversarial sample according to a specific embodiment of the present invention;

[0036] Figure 3 This is a flowchart of an adversarial sample detection method according to a specific embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of the adversarial example detection system based on incremental learning according to the present invention;

[0038] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of this application.

[0039] In the above image:

[0040] 10 Adversarial Example Detection Model Training Module; 20 Known Attack Adversarial Example Detection Module

[0041] 30 Unknown attack adversarial sample detection module. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the application is described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application. All other embodiments obtained by those skilled in the art based on the embodiments provided in this application without inventive effort are within the scope of protection of this application.

[0043] Obviously, the accompanying drawings described below are merely some examples or embodiments of this application. Those skilled in the art can apply this application to other similar scenarios based on these drawings without any inventive effort. Furthermore, it is understood that although the efforts made in this development process may be complex and lengthy, for those skilled in the art related to the content disclosed in this application, any changes to design, manufacturing, or production based on the technical content disclosed in this application are merely conventional technical means and should not be construed as insufficient disclosure of the content of this application.

[0044] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent.

[0045] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment that is mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0046] Unless otherwise defined, the technical or scientific terms used in this application shall have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms “a,” “an,” “an,” “the,” and similar words used in this application do not indicate quantity limitation and may indicate singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units not listed, or may include other steps or units inherent to these processes, methods, products, or devices. The terms “connected,” “linked,” “coupled,” and similar words used in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. “Multiple” used in this application refers to two or more. “And / or” describes the relationship between related objects, indicating that three relationships may exist; for example, “A and / or B” can represent: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following objects are in an "or" relationship. The terms "first," "second," and "third" used in this application are merely to distinguish similar objects and do not represent a specific ordering of the objects.

[0047] To prevent attackers from maliciously stealing models using adversarial examples, this invention addresses the need for parallel verification of sample legitimacy during normal business processes. This invention aims to improve the model protection capabilities of deep learning algorithm services by filtering adversarial examples used by attackers. This invention presents an adversarial example detection method based on incremental learning and online hot-updating models. First, it utilizes multiple methods to detect and generate various types of adversarial examples, training detection models for both normal and adversarial examples. In practical applications, it enhances the system's detection capabilities by combining the detection models with adversarial example detection methods. For newly detected attack methods, incremental learning is used to continuously learn and update the detection model, enhancing the system's continuous learning ability.

[0048] like Figure 1 As shown in the embodiments of this application, an adversarial example detection method based on incremental learning is provided, including:

[0049] Adversarial example detection model training step S10: Collect normal business sample dataset, use multiple detection methods to detect normal business sample dataset, generate multiple types of adversarial examples, and train an adversarial example detection model based on incremental learning.

[0050] Known attack adversarial sample detection step S20: Based on the incremental learning adversarial sample detection model, perform preliminary filtering and detection of adversarial samples with known attack types;

[0051] Unknown attack adversarial sample detection step S30: Based on the characteristics of unknown type adversarial attack samples, a similarity comparison judgment method or an adversarial sample distance model decision method is randomly adopted to output the detection result of unknown type adversarial attack samples. The detection result is compared with a predetermined threshold. The original sample with the detection result greater than the threshold is a normal sample; the original sample with the detection result less than the threshold is an unknown type adversarial sample, thus realizing the detection of adversarial samples based on incremental model.

[0052] In some embodiments of the present invention, the above-described adversarial example detection method based on incremental learning further includes:

[0053] Incremental Iterative Update Step S40 for Detection Model: Based on unknown types of adversarial examples, update the dataset for the adversarial example detection model based on incremental learning.

[0054] In some embodiments of the present invention, the above-mentioned adversarial example detection model construction step S10 includes:

[0055] Collection steps: Collect a dataset of normal business samples;

[0056] Adversarial sample dataset generation steps: Use normal business sample datasets to attack the business model, and generate multiple adversarial sample datasets using different attack methods and attack parameters.

[0057] Binary classification model training steps: Use the adversarial example dataset as two categories to train the binary classification model and obtain an adversarial example detection model based on incremental learning.

[0058] In some embodiments of the present invention, the above-mentioned unknown attack adversarial sample detection step S30 includes:

[0059] Similarity comparison and judgment steps: Modify the original sample, use the same model to perform reasoning on the original sample before and after the modification, and judge the similarity of the output results. The original sample with a similarity greater than the preset threshold is a normal sample, and the original sample with a similarity less than the preset threshold is an unknown type adversarial sample.

[0060] In some embodiments of the present invention, the above-mentioned unknown attack adversarial sample detection step S30 further includes:

[0061] Adversarial sample distance model decision steps: Apply an iterative adversarial attack to the input original sample to move it toward the decision boundary of the adversarial sample distance model. If the number of iterations is less than the preset number, the original sample is an unknown type of adversarial sample.

[0062] In some embodiments of the present invention, the above-mentioned incremental iterative update step S40 of the detection model further includes:

[0063] The adversarial example detection model based on incremental learning is incrementally learned using a joint training-based incremental learning approach until the end of the iterative training, at which point the iteratively updated adversarial example detection model is used.

[0064] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings:

[0065] The specific steps of a specific embodiment of the present invention are as follows:

[0066] I. Adversarial Example Detection Algorithms

[0067] like Figure 2a and Figure 2b As shown, adversarial examples refer to adding imperceptible perturbations to normal images, causing the model to make incorrect judgments. Figure 2a The image shows the original sample ants. Figure 2b After perturbation, it is displayed as an adversarial example, a bee. At this point, the adversarial example has crossed the boundary line of the model's decision classification in the high-dimensional feature space.

[0068] The specific process is as follows: Figure 3 As shown:

[0069] 1. For adversarial examples with known attack types, adversarial example detectors are primarily used for detection. The construction method of an adversarial example detector is as follows:

[0070] (1) Collect a normal business sample dataset, denoted as D1.

[0071] (2) Use the normal sample dataset D1 to attack the business model. Use known attack methods and configure the corresponding attack parameters according to different attack methods to generate multiple adversarial sample datasets D2 = {D2_1, D2_2, ..., D2_n}.

[0072] (3) Use dataset D = {D1, D2}, where D1 and D2 are two categories, to train the binary classification model M0.

[0073] 2. M0 provides sample detection functionality, performing initial filtering on all samples. Due to the diverse nature of attacks, while M0 has good detection capabilities for adversarial attacks that appeared in D2, its detection capability for samples not appearing in D2 is weak. For adversarial samples of unknown types, adversarial attack methods are detected randomly using the following two methods based on adversarial sample characteristics.

[0074] (1) Utilizing the characteristic of minimal perturbation in adversarial attacks, the original sample is simply modified. The same model is then used to infer the similarity between the samples before and after modification. The similarity of the output results is then determined. One or more combinations of image processing tools such as compression, filtering, super-resolution, and PCA are randomly selected to process the original image. The same business model is then used to predict the two types of samples. Based on the model output, Euclidean distance, cosine distance, and other methods are used to measure the model output results. Original samples with a similarity greater than a threshold t are considered normal samples; otherwise, they are considered adversarial samples.

[0075] (2) Use the business model to extract features from normal samples. For samples of the same category with similar feature distances, determine whether the distance between the input image and the center of a certain type of sample is less than a set threshold. If it is greater than the intra-class threshold, determine the distance to the center of other categories. If it is greater than the set extra-class threshold, it is a normal sample; otherwise, it is an adversarial sample.

[0076] 3. Incremental learning of model M0. The dataset is updated, and the adversarial example detected in step 2 is denoted as ND2, which is combined with the original dataset to form dataset D'. Since no new categories are added, incremental learning based on joint training is used, and incremental learning on M0 achieves good results. During training, process models M0.1, ..., etc., are obtained and used together with M0 for sample detection until training is complete, at which point model M1 replaces M0.

[0077] II. Overall Architecture Diagram

[0078] To prevent attackers from maliciously stealing the model using adversarial examples, the legitimacy of samples is checked in parallel during normal business processes. A two-stage detection method is used to detect both known and unknown types of adversarial examples, thus determining whether a sample is legitimate. Adversarial examples are accumulated, and the adversarial example detection model is incrementally learned to enhance the method's ability to detect novel adversarial examples.

[0079] Secondly, such as Figure 4 As shown, this application provides an adversarial example detection system based on incremental learning, employing the adversarial example detection method based on incremental learning as described above, including:

[0080] Adversarial Example Detection Model Training Module 10: Used to collect normal business sample datasets, detect normal business sample datasets using multiple detection methods, generate various types of adversarial examples, and train an adversarial example detection model based on incremental learning.

[0081] Known attack adversarial sample detection module 20: used to perform preliminary filtering and detection of adversarial samples with known attack types based on an incremental learning-based adversarial sample detection model;

[0082] The unknown attack adversarial sample detection module 30 is used to randomly adopt a similarity comparison judgment method or an adversarial sample distance model decision method to judge the characteristics of unknown types of adversarial attack samples, and output the detection results of unknown types of adversarial attack samples. The detection results are compared with a predetermined threshold. The original sample with the detection result greater than the threshold is a normal sample; the original sample with the detection result less than the threshold is an unknown type of adversarial sample, realizing the detection of adversarial samples based on incremental model.

[0083] In some embodiments of the present invention, the above-described adversarial example detection system based on incremental learning further includes:

[0084] Incremental Iterative Update Module 40 for Detection Model: Used to update the dataset of the adversarial example detection model based on incremental learning, based on unknown types of adversarial examples.

[0085] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the incremental learning-based adversarial example detection method described above.

[0086] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, wherein the program, when executed by a processor, implements the unstructured data parsing method based on flink as described above.

[0087] In addition, combined Figure 1 The incremental learning-based adversarial example detection method described in this application can be implemented by a computer device. Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of this application.

[0088] The computer device may include a processor 81 and a memory 82 storing computer program instructions.

[0089] Specifically, the processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0090] The memory 82 may include a mass storage device for data or instructions. For example, and not limitingly, the memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 82 may include removable or non-removable (or fixed) media. Where appropriate, the memory 82 may be internal or external to a data processing device. In a particular embodiment, the memory 82 is non-volatile memory. In a particular embodiment, the memory 82 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0091] The memory 82 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 81.

[0092] The processor 81 reads and executes computer program instructions stored in the memory 82 to implement any of the incremental learning-based adversarial example detection methods in the above embodiments.

[0093] In some embodiments, the computer device may further include a communication interface 83 and a bus 80. For example, Figure 5 As shown, the processor 81, memory 82, and communication interface 83 are connected through bus 80 and complete communication with each other.

[0094] The communication interface 83 is used to enable communication between the various modules, devices, units, and / or equipment in the embodiments of this application. The communication port 83 can also enable data communication with other components such as external devices, image / data acquisition devices, databases, external storage, and image / data processing workstations.

[0095] Bus 80 includes hardware, software, or both, that couples components of a computer device together. Bus 80 includes, but is not limited to, at least one of the following: data bus, address bus, control bus, expansion bus, and local bus. For example, and not as a limitation, bus 80 may include Accelerated Graphics Port (AGP) or other graphics buses, Extended Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), Hyper Transport (HT) interconnect, Industry Standard Architecture (ISA) bus, InfiniBand interconnect, Low Pin Count (LPC) bus, memory bus, Microchannel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced Technology Accessory (SATA) bus, and Video Electronics Standards Association (VESA) bus. Standards As a whole on Local Bus (VLB) or other suitable buses, or combinations of two or more of these. Where appropriate, bus 80 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0096] Compared to existing technologies, this invention prevents attackers from maliciously stealing models using adversarial examples by performing parallel verification of sample legitimacy during normal business processes. A two-stage detection method is used to detect both known and unknown types of adversarial examples, thus determining whether a sample is legitimate. By accumulating adversarial examples and incrementally learning the adversarial example detection model, this method enhances its ability to detect novel adversarial examples.

[0097] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0098] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. An adversarial example detection method based on incremental learning, characterized in that, Applied to the image domain, the adversarial examples are samples obtained by adding perturbations to normal images, including: Adversarial example detection model training steps: Collect a normal business sample dataset, attack the normal business sample dataset using multiple attack methods, generate multiple types of adversarial examples, and train an adversarial example detection model based on incremental learning. Known attack adversarial sample detection steps: Based on the incremental learning-based adversarial sample detection model, perform preliminary filtering and detection of adversarial samples with known attack types; The steps for detecting adversarial samples of unknown attack types are as follows: For the characteristics of adversarial attack samples of unknown types, a similarity comparison judgment method or an adversarial sample distance model decision method is randomly adopted to output the detection results of adversarial attack samples of unknown types. The detection results are compared with predetermined thresholds. Original samples with detection results greater than the threshold are normal samples; original samples with detection results less than the threshold are adversarial samples of unknown types, thus realizing adversarial sample detection based on incremental learning. The unknown attack adversarial sample detection steps include: Similarity comparison and judgment steps: Modify the original sample, use the same model to perform reasoning on the original sample before and after the modification, and judge the similarity of the output results. The original sample with a similarity greater than a preset threshold is a normal sample, and the original sample with a similarity less than a preset threshold is the unknown type adversarial sample. The unknown attack adversarial sample detection step also includes: Adversarial sample distance model decision steps: Apply an iterative adversarial attack to the input original sample to move it toward the decision boundary of the adversarial sample distance model. If the number of iterations is less than a preset number, the original sample is the unknown type of adversarial sample.

2. The adversarial example detection method based on incremental learning according to claim 1, characterized in that, Also includes: The incremental iterative update steps for the detection model are as follows: Based on the unknown type of adversarial examples, the dataset of the adversarial example detection model based on incremental learning is updated.

3. The adversarial example detection method based on incremental learning according to claim 1 or 2, characterized in that, The steps for constructing the adversarial example detection model include: Collection steps: Collect a dataset of normal business samples; Adversarial sample dataset generation steps: Using the normal business sample dataset, attack the business model, and generate multiple adversarial sample datasets using different attack methods and attack parameters; Binary classification model training steps: Use the adversarial sample dataset and the normal business sample dataset as two categories to train the binary classification model and obtain the adversarial sample detection model based on incremental learning.

4. The adversarial example detection method based on incremental learning according to claim 2, characterized in that, The incremental iterative update step of the detection model also includes: The adversarial example detection model based on incremental learning is incrementally learned using a joint training-based incremental learning approach until the iterative training is completed, at which point the iteratively updated adversarial example detection model is used.

5. An adversarial example detection system based on incremental learning, employing the adversarial example detection method based on incremental learning as described in any one of claims 1-4, characterized in that, Applied to the image domain, the adversarial examples are samples obtained by adding perturbations to normal images, including: Adversarial Example Detection Model Training Module: This module is used to collect a normal business sample dataset, detect the normal business sample dataset using multiple detection methods, generate various types of adversarial examples, and train an adversarial example detection model based on incremental learning. Known attack adversarial sample detection module: used to perform preliminary filtering and detection of adversarial samples with known attack types based on the incremental learning-based adversarial sample detection model; The unknown attack adversarial sample detection module is used to randomly apply a similarity comparison method or an adversarial sample distance model decision method to the characteristics of unknown types of adversarial attack samples, and output the detection results of unknown types of adversarial attack samples. The detection results are compared with predetermined thresholds. Original samples with detection results greater than the threshold are normal samples; original samples with detection results less than the threshold are unknown types of adversarial samples, realizing the detection of adversarial samples based on incremental model.

6. The adversarial example detection system based on incremental learning according to claim 5, characterized in that, Also includes: The incremental iterative update module for the detection model is used to update the dataset of the adversarial sample detection model based on the unknown type of adversarial sample.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the adversarial example detection method based on incremental learning as described in any one of claims 1 to 4.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the adversarial example detection method based on incremental learning as described in any one of claims 1 to 4.

Images