An adversarial training method and system based on perturbation diversity enhancement

Abstract

The present application relates to a kind of based on the method and system of adversarial training of perturbation diversity enhancement, belong to deep learning security technical field.The method includes: S1: input training data into model, execute forward propagation and back propagation, obtain the gradient value of model loss function for input data;S2: based on maximum perturbation value ∈, calculate the random noise subject to uniform distribution U (- ∈, ∈);S3: based on the gradient value and random noise obtained, generate the adversarial perturbation projected into specified range [-, ∈];S4: add adversarial perturbation to corresponding original image, and project it into legal pixel range [0,1], obtain adversarial sample;S5: input adversarial sample into model, execute forward propagation and back propagation, update model parameter, complete adversarial training.The present application realizes the robustness similar to multi-step iteration method on the basis of greatly reducing operation amount, greatly shortening training time.

Description

Technical Field

[0001] This invention belongs to the field of deep learning security technology and relates to an adversarial training method and system based on perturbation diversity enhancement. Background Technology

[0002] Adversarial examples refer to carefully crafted, imperceptible perturbations added to images, allowing the human eye to correctly classify them, while network models misclassify them into other categories. The existence of adversarial examples poses a significant security risk to AI models in high-security scenarios such as facial recognition payment and autonomous driving. To eliminate or mitigate the security risks caused by adversarial examples, extensive research has been conducted both domestically and internationally on adversarial example defense methods.

[0003] Among current defense methods, adversarial training is one of the most popular and effective. Adversarial training uses adversarial examples to train the network model, enabling it to learn the relevant features of these examples and thus defend against them. Based on the number of iterations used to generate adversarial examples, current adversarial training methods can be divided into two categories: multi-step iterative adversarial training and single-step iterative adversarial training.

[0004] Multi-step iterative adversarial training constructs adversarial examples through small steps and multiple iterations, resulting in highly aggressive adversarial examples and thus a robust trained model. However, due to the iterative nature of this method, each iteration requires a forward and backward propagation, leading to high computational costs and significantly increasing training time. Single-step iterative adversarial training constructs adversarial examples through large steps and single iterations, resulting in significantly lower computational costs and training time compared to multi-step iterative adversarial training. However, single-step iterative adversarial training suffers from catastrophic overfitting, where the model's robustness initially increases but then decreases sharply. Affected by catastrophic overfitting, single-step iterative adversarial training has poor stability and struggles to train robust models. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a single-step iterative adversarial training method and system based on perturbation diversity enhancement. By enhancing the perturbation diversity of adversarial examples, this invention solves the catastrophic overfitting problem in single-step iterative adversarial training, achieving robustness similar to multi-step iterative adversarial training while reducing training time significantly. This invention can be applied to high-security scenarios such as facial recognition payment and autonomous driving, improving the robustness of artificial intelligence models in these scenarios and reducing the occurrence of security problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] Option 1: An adversarial training method based on perturbation diversity enhancement, specifically including the following steps:

[0008] S1: Input the training data into the model, perform forward and backward propagation, and obtain the gradient value of the model loss function with respect to the input data;

[0009] S2: Based on the maximum perturbation value ∈, calculate the random noise that follows a uniform distribution U(-∈, ∈);

[0010] S3: Based on the gradient value obtained in step S1 and the random noise obtained in step S2, generate adversarial perturbations projected onto the specified range [-∈, ∈].

[0011] S4: Add the adversarial perturbation obtained in step S3 to the corresponding original image, and project the original image with the adversarial perturbation to the legal pixel range [0,1] to obtain the adversarial sample;

[0012] S5: Input the adversarial examples obtained in step S4 into the model, perform forward and backward propagation, update the model parameters, and complete the adversarial training.

[0013] Furthermore, in step S1, the gradient value of the loss function with respect to the input data is obtained as follows: in, Here, θ is the loss function, x is the input data, y is the label corresponding to the input data x, and θ is the model parameters. This represents the gradient with respect to x.

[0014] Furthermore, step S3 specifically includes: [The text abruptly ends here, likely due to an incomplete sentence or a formatting error.] Let i be the gradient value corresponding to a single pixel in the input data x. Then the formula for generating the adversarial perturbation is as follows:

[0015]

[0016] Where δ represents the constructed adversarial perturbation, η~U(-∈,∈) is random noise, ∈ is the specified maximum perturbation value, λ is a hyperparameter, d is the dimension of the input image, and Π [-∈,∈] This represents the projection operation onto the interval [-, ∈].

[0017] Furthermore, in step S4, the formula for generating adversarial examples is as follows:

[0018]

[0019] Among them, Π [0,] This represents a projection operation onto the interval [0,1]. This is the final generated adversarial example.

[0020] Furthermore, in step S5, the update formula for the model parameters is as follows:

[0021]

[0022] Where α is the learning rate.

[0023] Option 2: An adversarial training system based on perturbation diversity enhancement, comprising:

[0024] The gradient acquisition module 401 is used to input training data into a specified model and obtain the gradient value of the model's loss function with respect to the input data.

[0025] The random noise generation module 402 is used to generate random noise that follows a uniform distribution U(-∈, ∈), where ∈ is the maximum perturbation value;

[0026] The perturbation generation module 403 is used to generate adversarial perturbations using the gradient values ​​and random noise obtained by the gradient acquisition module 401 and the random noise generation module 402.

[0027] Adversarial example generation module 404 is used to add the adversarial perturbation generated by the perturbation generation module 403 to the original image to generate adversarial examples;

[0028] The training module 405 is used to train the model using adversarial samples generated by the adversarial sample generation module 404, thereby obtaining a robust model that can resist adversarial attacks.

[0029] The beneficial effects of this invention are as follows: The single-step iterative adversarial training method based on perturbation diversity enhancement proposed in this invention, compared with existing single-step iterative methods, does not suffer from catastrophic overfitting, the training process is more stable, and the trained model is more robust. Compared with existing multi-step iterative methods, the method of this invention achieves robustness similar to multi-step iterative methods while significantly reducing computational load and training time.

[0030] This invention can be applied to high-security scenarios such as facial recognition payment and autonomous driving, improving the robustness of artificial intelligence models in these scenarios and reducing the occurrence of security problems. For example, attackers can use adversarial examples to make facial recognition models identify them as a specific person, and then impersonate the victim and use their account to make payments. This invention can effectively prevent the occurrence of such problems.

[0031] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0032] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0033] Figure 1 This is a flowchart of the single-step iterative adversarial training method based on perturbation diversity enhancement of the present invention.

[0034] Figure 2 This is a diagram illustrating the generation of adversarial examples.

[0035] Figure 3 The robustness changes of each method during training on the CIFA-10 dataset;

[0036] Figure 4 The robustness changes of each method during training on the CIFA-100 dataset;

[0037] Figure 5 This is a block diagram of the single-step iterative adversarial training system based on perturbation diversity enhancement of the present invention;

[0038] Figure 6 This is a block diagram of the terminal section. Detailed Implementation

[0039] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0040] Example 1:

[0041] like Figure 1 As shown, Figure 1 The diagram shows the overall flowchart of the single-step iterative adversarial training method based on perturbation diversity enhancement of the present invention, which specifically includes the following steps:

[0042] S1: Input the training data into the model, perform forward and backward propagation, and obtain the gradient value of the model loss function with respect to the input data.

[0043] This embodiment uses the CIFAR-10 and CiFAR-100 datasets, selecting ResNet-18 as the model for adversarial training. The learning rate is set to 0.05, momentum to 0.9, weight decay to 5e-4, and the number of training epochs to 100. Specifically, the gradient of the model's loss function with respect to the input data is:

[0044]

[0045] in, This represents the gradient with respect to x. x is the input data, which in this embodiment is image data from the CIFAR-10 or CIFAR-100 dataset. y is the label corresponding to the input data x. For the CIFAR-10 dataset, y has 10 possible values; for the CIFAR-100 dataset, y has 100 possible values. θ is the model parameters, which in this embodiment are the parameters of the ResNet-18 network model. The loss function is the cross-entropy loss function used in this example.

[0046] S2: Calculate random noise following a uniform distribution U(-∈, ∈) based on the maximum perturbation value ∈.

[0047] Under small perturbations, catastrophic overfitting does not occur in single-step iterative adversarial training. However, adversarial examples constructed using small adversarial perturbations are relatively weak, making it difficult to achieve strong robustness when using such adversarial examples for adversarial training. Under large perturbations, catastrophic overfitting occurs in single-step iterative adversarial training, and becomes increasingly severe as the perturbation value increases. Therefore, this embodiment sets a maximum perturbation value ∈ = 16 to verify the effectiveness of the invention under large perturbation conditions.

[0048] S3: Based on the gradient value obtained in step S1 and the random noise obtained in step S2, generate adversarial perturbations projected onto the specified range [-∈, ∈].

[0049] Specifically, the formula for generating adversarial perturbations is as follows:

[0050]

[0051] Where η~U(-∈,∈) is random noise, Π [,∈] The projection operation is represented by δ, which represents the constructed adversarial perturbation. λ is a hyperparameter; for the CIFAR-10 dataset, λ = 1.0; for the CIFAR-100 dataset, λ = 1.1. d is the dimension of the input image; for both the CIFAR-10 and CIFAR-100 datasets, d is 32 × 32 × 3 = 3072.

[0052] Unlike the traditional single-step iterative adversarial example generation method FGSM, this method generates adversarial perturbations that are more evenly distributed across l because it no longer uses the sign(·) function to normalize the gradient values. ∞ The spheres are distributed in [-∈, ∈], rather than only in l. ∞ The sphere's boundary {-,∈} enhances the diversity of adversarial perturbations. Generally, the diversity of adversarial perturbations can be viewed as the adversarial perturbations on the l... ∞ The degree of disorder in the distribution within the sphere [-∈, ∈]. Since the uniform distribution has the highest degree of disorder and the largest entropy under unconstrained conditions, we use the KL divergence between the data distribution with adversarial perturbation and the uniform distribution U(-∈, ∈) as a measure of perturbation diversity, as shown in the following formula:

[0053]

[0054] Where P(·) represents the data distribution of the perturbation, and Q(·) represents the uniform distribution U(-∈, ∈). The smaller the KL divergence, the stronger the perturbation diversity. When the KL divergence is 0, the perturbation diversity reaches its maximum value.

[0055] Furthermore, unlike FGM, which normalizes the gradient by dividing by the gradient's L2 norm, this method normalizes the gradient by dividing by a combination of the gradient mean and the hyperparameter λ. Since the gradient's L2 norm is much larger than the gradient value, FGM typically generates relatively small adversarial perturbations, resulting in adversarial examples that lack strong attack power, making it difficult to train robust models. By using a combination of the gradient mean and the hyperparameter λ instead of the gradient's L2 norm, this method avoids the aforementioned problem.

[0056] S4: Add the adversarial perturbation obtained in step S3 to the corresponding original image, and project the original image with the adversarial perturbation to the legal pixel range [0,1] to obtain the adversarial sample.

[0057] Specifically, the formula for generating adversarial examples is as follows:

[0058]

[0059] Among them, Π [0,] This represents a projection operation onto the interval [0,1]. This is the final generated adversarial example. See the diagram illustrating adversarial example generation. Figure 2 .

[0060] S5: Input the adversarial examples obtained in step S4 into the model, perform forward and backward propagation, update the model parameters, and complete the adversarial training.

[0061] Specifically, the formula for updating the model parameters is as follows:

[0062]

[0063] Wherein, α is the learning rate. In this embodiment, the learning rate α is set to 0.05.

[0064] For the ResNet-18 model trained through adversarial training, we used various attacks such as FGSM, PGD, and AutoAttack to test its robustness, comparing it with multi-step iterative adversarial training methods such as PGD and GradAlign, and single-step iterative adversarial training methods such as FGM, FGSM, FGSM-RS, and FGSM-CKPT. Furthermore, to ensure the accuracy of the experimental results, we conducted three experiments on three different random number seeds and took the average of the three results as the final result. Finally, to better illustrate the impact of catastrophic overfitting on the training process, we selected the model from the last iteration for testing; the test results are shown in Tables 1 and 2.

[0065] As shown in Tables 1 and 2, this method generally outperforms other single-step iterative adversarial training methods on both the CIFAR-10 and CIFAR-100 datasets. Specifically, the training time of this method is similar to other single-step iterative adversarial training methods. Except for its lower robustness against FGSM attacks compared to the FGSM-CKPT adversarial training method, its robustness against other adversarial attacks is higher than that of other single-step iterative adversarial training methods. Furthermore, although the robustness of this method is slightly lower than that of the PGD single-step iterative adversarial training method, its training time is significantly shorter. Specifically, the PGD method with 16 iterations takes nearly 15 hours for adversarial training, more than 7 times longer than this method. Compared to another multi-step iterative adversarial training method, GradAlign, this method not only has a shorter training time but also outperforms GradAlign in some aspects on the CIFAR-10 dataset.

[0066] The robustness changes during the training process of the above method are shown in [the figure]. Figure 3 and Figure 4 .from Figure 3 as well as Figure 4 As can be seen, the training process of this method is very stable, and no catastrophic overfitting problem occurs during training. In contrast, other single-step iterative training and adversarial training methods struggle to train robust models due to the existence of catastrophic overfitting.

[0067] Table 1. Test Results of CIFAR-10 Dataset

[0068]

[0069] Table 2. Test Results of the CIFAR-100 Dataset

[0070]

[0071] The above experiments and related results analysis verify the effectiveness of the adversarial training method proposed in this invention.

[0072] Example 2:

[0073] Reference Figure 5 This invention provides a system for single-step iterative adversarial training based on perturbation diversity enhancement, used to implement the adversarial training method in the above embodiments. The system includes:

[0074] The gradient acquisition module 401 is used to input training data into a specified model and obtain the gradient value of the model's loss function with respect to the input data.

[0075] The random noise generation module 402 is used to generate random noise that follows a uniform distribution U(-∈, ∈), where ∈ is the maximum perturbation value.

[0076] The perturbation generation module 403 is used to generate adversarial perturbations using the gradient values ​​and random noise obtained by the gradient acquisition module 401 and the random noise generation module 402.

[0077] The adversarial example generation module 404 is used to add adversarial perturbations generated by the perturbation generation module 403 to the original image to generate adversarial examples.

[0078] The training module 405 is used to train the model using adversarial examples generated by the adversarial example generation module 404, thereby obtaining a robust model that can resist adversarial attacks.

[0079] Example 3:

[0080] This invention also provides a terminal, such as... Figure 6 As shown, for ease of explanation, only the parts related to the embodiments of the present invention are illustrated. The terminal may include any terminal device such as a mobile phone, tablet, computer, or POS machine; a computer is used as an example.

[0081] Figure 6 This diagram shows a partial structural representation of a computer associated with a terminal provided in an embodiment of the present invention. (Reference) Figure 6 A computer includes components such as: memory, input devices, display devices, audio circuitry, wireless fidelity (WIFI) module, processor, and power supply. Those skilled in the art will understand that... Figure 6The computer architecture shown does not constitute a limitation on the computer and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0082] The following is combined Figure 6 A detailed introduction to the various components of a computer:

[0083] A memory is used to store software programs and modules. The processor executes these stored software programs and modules to perform various computer functions and data processing. The memory primarily includes a program storage area and a data storage area. The program storage area stores the operating system, at least one application program required for a function (such as sound playback, image playback, etc.), etc. The data storage area stores data created based on computer usage (such as audio data, phone books, etc.). In this invention, the data storage area stores the original images to be used to generate adversarial examples. Furthermore, the memory may include high-speed random access memory (RAM) and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0084] An input device can be used to receive input numeric or character information, and to generate key signal inputs related to user settings and function control of a computer. The input device in this invention can be used to receive raw image data from which adversarial examples are to be generated.

[0085] Output devices are used to display information input by the user or provided to the user, as well as various computer menus. Output devices may include a display panel, optionally configured as a liquid crystal display (LCD), organic light-emitting diode (OLED), or similar type of display panel.

[0086] The audio module converts the received audio data into electrical signals, transmits them to the speaker, and the speaker then converts them into sound signals for output.

[0087] WiFi modules are a type of short-range wireless transmission technology. Computers can use WiFi modules to help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access.

[0088] The processor is the control center of a computer. It connects various parts of the computer via various interfaces and lines, and performs various computer functions and processes data by running or executing software programs and / or modules stored in memory, and by accessing data stored in memory, thereby providing overall monitoring of the computer. Optionally, the processor may include one or more processing units; preferably, the processor may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may also not be integrated into the processor.

[0089] The power source (such as a battery) can preferably be connected to the processor logic through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0090] Although not in Figure 6 As shown in the diagram, the computer may also include a camera, Bluetooth module, etc., which will not be elaborated here.

[0091] Specifically, in this embodiment, the processor in the terminal loads the executable files corresponding to the processes of one or more applications into the memory according to the following instructions, and the processor runs the applications stored in the memory to achieve various functions:

[0092] Input the stored training data into the specified model and obtain the gradient value of the model's loss function with respect to the input data;

[0093] Based on the maximum perturbation value ∈, calculate the random noise that follows a uniform distribution U(-∈, ∈);

[0094] Based on the obtained gradient values ​​and random noise, generate adversarial perturbations projected onto the specified range [-∈, ∈].

[0095] The obtained adversarial perturbation is added to the corresponding original image, and the original image with the adversarial perturbation is projected into the legal pixel range [0,1] to obtain the adversarial sample;

[0096] The obtained adversarial examples are input into the model, forward and backward propagation are performed, the model parameters are updated, and adversarial training is completed.

[0097] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An adversarial training method based on perturbation diversity enhancement, characterized in that, The method specifically includes the following steps: S1: Input the training data into the model, perform forward and backward propagation, and obtain the gradient value of the model loss function with respect to the input data; S2: Based on the maximum disturbance value The calculation follows a uniform distribution. Random noise; S3: Based on the gradient value obtained in step S1 and the random noise obtained in step S2, generate a projection to the specified range. The adversarial perturbations in the middle; specifically including: making For input data single pixel i The corresponding gradient value is then used to generate the adversarial perturbation, as follows: in, This represents the constructed adversarial perturbation. It is random noise. For the specified maximum disturbance value, For hyperparameters, The dimension of the input image, Indicates projection to interval Projection operation; S4: Add the adversarial perturbation obtained in step S3 to the corresponding original image, and project the original image with the added adversarial perturbation onto the legal pixel range. In this process, adversarial examples are obtained; S5: Input the adversarial examples obtained in step S4 into the model, perform forward and backward propagation, update the model parameters, and complete the adversarial training.

2. The adversarial training method based on perturbation diversity enhancement according to claim 1, characterized in that, In step S1, the gradient value of the loss function with respect to the input data is obtained as follows: ,in, For loss function, For input data, For input data The corresponding tags For model parameters, Indicates for The gradient.

3. The adversarial training method based on perturbation diversity enhancement according to claim 1, characterized in that, In step S4, the formula for generating adversarial examples is as follows: in, Indicates projection to interval Projection operation, This is the final generated adversarial example.

4. The adversarial training method based on perturbation diversity enhancement according to claim 3, characterized in that, In step S5, the formula for updating the model parameters is as follows: in, This is the learning rate.

5. A system for implementing the adversarial training method based on perturbation diversity enhancement as described in any one of claims 1 to 4, characterized in that, The system includes: The gradient acquisition module (401) is used to input training data into a specified model and obtain the gradient value of the model's loss function with respect to the input data; Random noise generation module (402) is used to generate noise that follows a uniform distribution. random noise, where This represents the maximum disturbance value. The perturbation generation module (403) is used to generate adversarial perturbations using the gradient values ​​and random noise obtained by the gradient acquisition module (401) and the random noise generation module (402); The adversarial example generation module (404) is used to add the adversarial perturbation generated by the perturbation generation module (403) to the original image to generate adversarial examples; The training module (405) is used to train the model using adversarial samples generated by the adversarial sample generation module (404) to obtain a robust model that can resist adversarial attacks.

Images