An adversarial training method based on joint label smoothing
By using a joint label smoothing adversarial training method, adversarial samples under different perturbations are generated and sample labels are processed, which solves the problem of insufficient robustness of existing models under large and small perturbations and achieves good recognition ability of the model under different perturbations.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA ACAD OF AEROSPACE SCI & TECH INNOVATION
- Filing Date
- 2022-12-29
- Publication Date
- 2026-05-26
AI Technical Summary
Existing adversarial training methods struggle to maintain model robustness under both large and small perturbations, leading to incorrect model identification or rejection of harmless samples under small perturbation attacks.
An adversarial training method based on joint label smoothing is adopted. This method generates adversarial examples with maximum and minimum perturbations, processes the sample labels using a label smoothing function, and designs a loss function for model training to enhance the robustness of the model under different perturbations.
This improves the model's ability to identify adversarial examples under large perturbations while maintaining correct classification under small perturbations, thus enhancing the model's generalization ability and robustness.
Smart Images
Figure CN116257755B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to an adversarial training method based on joint label smoothing, belonging to the field of artificial intelligence technology. Background Technology
[0002] Deep learning, as a crucial technology in the field of artificial intelligence, has been widely applied and achieved great success in recent years in areas such as smart healthcare, smart transportation, and smart security. However, by introducing specific perturbations into the samples, deep learning network models can be misclassified, posing a significant security risk.
[0003] Adversarial training is a typical model defense strategy. By introducing adversarial examples into the training phase, the robustness of the model can be enhanced, effectively resisting adversarial attacks. However, most models trained adversarially can only correctly identify adversarial examples under attacks with small perturbations, and cannot maintain good robustness against adversarial attacks with large perturbations.
[0004] Currently, some abstention-based model defense methods are emerging, which can enhance the robustness of the model by abandoning the current sample when dealing with large perturbations. However, abstention-based defense methods have the following problems: (1) it is difficult to detect adversarial attacks with small perturbations; (2) the model may abandon some harmless samples and some training samples with small noise, which greatly reduces the practicality of the model. Summary of the Invention
[0005] The technical problem solved by this invention is to overcome the shortcomings of the prior art and provide an adversarial training method based on joint label smoothing, which solves the problem that the existing adversarial training methods cannot simultaneously take into account the abstention under large perturbation attacks and the correct identification under small perturbation attacks.
[0006] The technical solution of this invention is: an adversarial training method based on joint label smoothing, comprising:
[0007] 1) Establish a convolutional neural network model and select an image dataset as training samples;
[0008] 2) Select the maximum attack disturbance size;
[0009] 3) Determine the magnitudes of the first and second disturbances based on the scaling factor; the first disturbance is greater than the second disturbance.
[0010] 4) Generate adversarial samples based on the first half of the current batch of data, according to the maximum perturbation attack size;
[0011] 5) Based on the size of the first perturbation, fuse the adversarial sample generated in step 4) with the original sample to obtain the adversarial sample with the first perturbation;
[0012] 6) Based on the second perturbation, generate corresponding adversarial examples from the latter half of the current batch of samples;
[0013] 7) Generate a label smoothing function based on the smoothing parameters;
[0014] 8) Generate labels for the maximum perturbation adversarial sample, the first perturbation adversarial sample, and the second perturbation adversarial sample sequentially using the label smoothing function;
[0015] 9) Based on the three types of samples generated in step 8) and their corresponding smoothed labels, feed them into the convolutional neural network, design a loss function to train the model, and update the network model.
[0016] 10) Iterate through steps 2) to 9) until the trained network converges, and give the confidence threshold for judging whether the input sample is an adversarial sample.
[0017] Furthermore, steps 4) and 6) generate adversarial samples based on the adversarial attack algorithms of the maximum perturbation and the second perturbation, respectively.
[0018] Further, step 5) uses a fusion coefficient to fuse the sample with the largest perturbation and the corresponding original sample.
[0019] Furthermore, a fusion coefficient is used to fuse the sample with the largest perturbation and the corresponding original sample, specifically: x α =αx + (1-α)x adv ;where x adv The adversarial sample generated by the maximum perturbation, where α is the larger perturbation coefficient and x is the original sample.
[0020] Furthermore, the label smoothing method in step 7) adopts the one-hot encoding method.
[0021] Furthermore, the label smoothing method is as follows:
[0022]
[0023]
[0024] Where a and b are fixed values, ε is the perturbation magnitude, K is the number of classes, δ is the label smoothing coefficient, e is the base of a natural number, one-hot encoding is the label encoding format, and y is the true label of the sample. s Let λ be the smoothed sample label, and λ be a function of δ.
[0025] Furthermore, in step 8), the label smoothing function of step 7) is used to smooth the labels of the maximum adversarial sample, the first adversarial sample, and the second adversarial sample, respectively.
[0026] Furthermore, the loss function in step 9) is
[0027]
[0028] Where B is the number of samples in a batch, dividing the current batch into two equal parts, and b is the sample index in a batch of data. This is an adversarial example generated from the b-th original sample of the first half of the data under the maximum perturbation ε. The smoothed label corresponds to the adversarial example with the maximum perturbation. The larger adversarial perturbation sample is obtained by fusing the b-th original sample from the first half of the data with the corresponding largest perturbation adversarial sample. These are the smoothed sample labels corresponding to samples with larger perturbations. This is an adversarial example generated from the b-th original sample of the latter half of the data under a relatively small perturbation ε'. The smoothed label corresponds to the sample with smaller perturbation.
[0029] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the adversarial training method based on joint label smoothing.
[0030] An adversarial training device based on joint label smoothing includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the adversarial training method based on joint label smoothing.
[0031] The advantages of this invention compared to the prior art are:
[0032] 1) The adversarial training method based on joint labels proposed in this invention proposes a new label smoothing method, which makes the sample labels exhibit different smoothing results under large and small perturbations. The label smoothing method under large and small perturbations increases the upper limit of small perturbation samples in adversarial training, enhances the model's classification ability under small perturbations, and maintains good suppression ability under large perturbation conditions.
[0033] 2) This invention integrates training samples and adversarial samples in a certain proportion, which enhances the data representation capability and improves the robustness of the model. Attached Figure Description
[0034] Figure 1 This is a flowchart of the algorithm of the present invention;
[0035] Figure 2 This is a schematic diagram illustrating the test results of the present invention on a handwritten digit dataset. Detailed Implementation
[0036] To better understand the above technical solutions, the technical solutions of this application will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of this application and the specific features in the embodiments are detailed descriptions of the technical solutions of this application, rather than limitations on the technical solutions of this application. In the absence of conflict, the embodiments of this application and the technical features in the embodiments can be combined with each other.
[0037] The following description, in conjunction with the accompanying drawings, provides a more detailed explanation of an adversarial training method based on joint label smoothing provided in this application. Specific implementation methods may include (e.g.) Figures 1-2 As shown: A label smoothing function is designed. This function ensures that under small perturbations, the confidence of one-hot format sample labels is very low for all categories except the true label, while under large perturbations, the confidence of each category is averaged. By fusing adversarial examples with original samples, the model has stronger generalization ability. The adversarial training method using label smoothing with combined large and small perturbations allows the model to learn more feature knowledge and acquire a confidence threshold for judging whether an input sample is an adversarial example. This ensures that the model has the ability to resist neural network models with different perturbation sizes. The model can identify the existence of adversarial examples under large perturbation attacks and reject their output, and can correctly identify the true category of the sample under small perturbation attacks.
[0038] Specifically, it includes the following steps:
[0039] 1) Build a convolutional neural network model and select the image dataset Data_src as the training samples;
[0040] 2) Select an appropriate maximum attack disturbance size;
[0041] 3) Determine the magnitudes of larger and smaller disturbances based on the proportionality coefficient;
[0042] 4) Generate adversarial samples based on the first half of the current batch of data, according to the maximum perturbation attack size;
[0043] 5) Based on the magnitude of the larger perturbation, fuse the adversarial sample generated in step 4) with the original sample to obtain the adversarial sample with the larger perturbation;
[0044] 6) Generate corresponding adversarial examples based on the latter half of the samples in the current batch, according to the smaller perturbation;
[0045] 7) Generate a label smoothing function based on the smoothing parameters;
[0046] 8) Generate labels for the largest perturbation adversarial sample, the larger perturbation adversarial sample, and the smaller perturbation adversarial sample sequentially using the label smoothing function;
[0047] 9) Based on the three types of samples generated in step 8) and their corresponding smoothed labels, feed them into the convolutional neural network, design a loss function to train the model, and update the network model.
[0048] 10) Iterate through steps 2) to 9) until the trained network converges, and give the confidence threshold for judging whether the input sample is an adversarial sample.
[0049] Furthermore, steps 4) and 6) employ adversarial attack algorithms with maximum and smaller perturbation sizes, respectively. These adversarial attack algorithms are based on a multi-step iterative PGD attack algorithm.
[0050] In one possible implementation, step 5) uses a fusion coefficient to fuse the sample with the largest perturbation and the corresponding original sample to obtain an adversarial sample with a larger perturbation. The higher the fusion coefficient, the smaller the perturbation of the resulting adversarial sample, and vice versa. The formula is as follows:
[0051] x α =αx + (1-α)x adv
[0052]
[0053] Where x adv For the generated adversarial example, α is the fusion coefficient, and x is the original sample. b Here are the true labels for the first half of the samples, K is the number of categories, and δ is the label smoothing coefficient. The processed label.
[0054] In one possible implementation, step 7) uses a novel label smoothing method to process the sample labels.
[0055]
[0056]
[0057] Where a and b are fixed values, ε is the perturbation magnitude, K is the number of classes, δ is the label smoothing coefficient, e is the base of a natural number, one-hot encoding is the label encoding format, and y is the true label of the sample. s Let λ be the smoothed sample label, and λ be a function of δ.
[0058] In one possible implementation, step 8) uses the label smoothing function from step 7) to smooth the labels of the largest adversarial sample, the larger adversarial sample, and the smaller adversarial sample, respectively. Smaller perturbations ε and larger perturbations ε' are used to smooth the true labels of the first half and the second half of the samples, respectively, resulting in lower smoothness of the sample labels when the perturbation is small and higher smoothness when the perturbation ε is large.
[0059] Furthermore, in one possible implementation, the loss function designed in step 9) is formulated as follows:
[0060]
[0061] Where B is the number of samples in a batch, the current batch is divided into two parts, and b is the sample index in a batch of data. This is an adversarial example generated from the b-th original sample of the first half of the data under the maximum perturbation ε. The smoothed label corresponds to the adversarial example with the maximum perturbation. The larger adversarial perturbation sample is obtained by fusing the b-th original sample from the first half of the data with the corresponding largest perturbation adversarial sample. These are the smoothed sample labels corresponding to samples with larger perturbations. This is an adversarial example generated from the b-th original sample of the latter half of the data under a relatively small perturbation ε'. The smoothed label corresponds to the sample with smaller perturbation.
[0062] The solution provided in this application includes the following steps:
[0063] Step 1: Select ResNet50 as the convolutional neural network model and Cifar10 image dataset as the training sample Data_src;
[0064] Step 2: In this example, 0.4 is selected as the maximum disturbance;
[0065] Step 3: Select the largest disturbance multiplied by 0.4 as the larger disturbance, and the largest disturbance multiplied by 1 / 6 as the smaller disturbance size;
[0066] Step 4: Select training data Data with a batch size of 64 from Data_src, labeled as Label, as the current batch training samples. Divide the current batch training samples equally, with the first half being Data1 labeled as Label1 and the second half being Data2 labeled as Label2. Use the PGD adversarial attack algorithm with perturbations of 0.4 and 0.07 and 40 iterations to obtain the adversarial sample with the largest perturbation, Data_att1, and the adversarial sample with the smallest perturbation, Data_att2. The formula is as follows:
[0067] x t =x+x noise
[0068]
[0069] In the formula x t Let x represent the generated adversarial example, and x represent the original sample. noise This represents uniform noise with the same dimensions as the input sample. The loss function is L(θ,x) t ,y) with respect to x t The derivative of θ, the model parameters, sign, the sign function, t = 0, 1, 2, 3..., S, the magnitude of the added perturbation, β, the attack step size, and y, the label corresponding to the sample.
[0070] Step 5: Fuse the adversarial sample Data_att1 with the largest perturbation generated in Step 4) and the original sample Data1 with a coefficient of 0.4 to obtain the adversarial sample with larger perturbation. The larger the fusion coefficient, the more the fused image is similar to the original sample Data1, and the smaller the fusion coefficient, the more the fused image is similar to the adversarial sample Data_att1. The fusion formula is as follows:
[0071]
[0072] Where x adv The generated adversarial sample is x, the original sample is α, and the fusion coefficient is 0.4.
[0073] Step 6: For the second half of the current batch, Data2, labeled Label2, use the PGD adversarial attack algorithm with a small perturbation of 0.07 and 40 iterations to obtain the small perturbation adversarial sample Data_att2.
[0074] Step 7: Generate a label smoothing function based on the smoothing parameters, and smooth the labels using a new label smoothing method, as shown in the formula below:
[0075]
[0076]
[0077] Where a and b are 40 and 0.02 respectively, ε selects three perturbation sizes: maximum perturbation 0.4, relatively large perturbation 0.16, and relatively small perturbation 0.07, k is the number of classes in the CIFAR-10 dataset (10), δ is the label smoothing coefficient ranging from [0, 0.4], e is the base of a natural number, and one_hot is a coding format. For example, the one_hot format corresponding to the sample label y of 5 is [0,0,0,0,0,1,0,0,0,0].
[0078] Step 8: Process the labels Label1 and Label2 of the current batch of training samples using a label smoothing formula, resulting in Label_soft1 and Label_soft2 respectively. Smooth the true labels of the first and second halves of the samples using the largest perturbation of 0.4 and the smallest perturbation of 0.07, respectively. This results in lower smoothness for smaller perturbations and higher smoothness for larger perturbations. For the fused adversarial samples with larger perturbations, the label Label_fuse1 is processed using the following formula:
[0079]
[0080] Where α is the fusion coefficient, taken as 0.4, and y b The labels of the original samples are represented by K, which is the number of classes (10), and δ. b y is the label smoothing coefficient. b α The processed label.
[0081] Step 9: Input the adversarial examples and labels Data_att1, Label_soft1 generated from a batch of data, the fused samples and labels Data_fuse1, Label_fuse1, and the adversarial examples and smoothed labels Data_att2, Label_soft2 into the ResNet50 convolutional neural network, use the SGD optimization algorithm, train the model using the following loss function, and update the network model.
[0082]
[0083] Where B is the number of samples in a batch (64), and b is a single original training sample in a batch. This is an adversarial example generated from the b-th original sample among the first 32 samples in the current batch, under a maximum perturbation of 0.4. The soft label is the smoothed label of the b-th original sample from the first 32 samples. This is the fused sample of the b-th original sample and its corresponding adversarial sample with a fusion coefficient of 0.4. The soft labels for the fused samples. This is an adversarial example generated from the b-th original sample among the 32nd samples after perturbation of 0.07. is the smoothed label corresponding to the b-th original sample.
[0084] Step 10: Iterate from Step 2) to Step 8) until the trained network converges, and give the confidence threshold for judging whether the input sample is an adversarial sample.
[0085] This application provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform... Figure 1 The method described.
[0086] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.
[0087] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0090] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0091] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.
[0092] The contents not described in detail in this specification are common knowledge to those skilled in the art.
Claims
1. An adversarial training method based on joint label smoothing, characterized in that, include: 1) Establish a convolutional neural network model and select an image dataset as training samples; 2) Select the maximum attack disturbance size; 3) Determine the magnitudes of the first and second disturbances based on the scaling factor; the first disturbance is greater than the second disturbance. 4) Generate adversarial examples based on the first half of the current batch of data, according to the maximum perturbation attack size; 5) Based on the size of the first perturbation, fuse the adversarial sample generated in step 4) with the original sample to obtain the adversarial sample with the first perturbation; 6) Based on the second perturbation, generate corresponding adversarial examples from the latter half of the current batch of samples; 7) Generate a label smoothing function based on the smoothing parameters; 8) Use the label smoothing function sequentially to generate the labels for the largest perturbation adversarial example, the first perturbation adversarial example, and the second perturbation adversarial example; 9) Based on the generated three types of samples and their corresponding smoothed labels, feed them into a convolutional neural network, design a loss function to train the model, and update the network model; 10) Iterate from step 2) to step 9) until the trained network converges, and give the confidence threshold for judging whether the input sample is an adversarial sample.
2. The adversarial training method based on joint label smoothing according to claim 1, characterized in that, Steps 4 and 6 generate adversarial samples based on the adversarial attack algorithms for the maximum perturbation and the second perturbation, respectively.
3. The adversarial training method based on joint label smoothing according to claim 1, characterized in that, Step 5) uses a fusion coefficient to fuse the sample with the largest perturbation and the corresponding original sample.
4. The adversarial training method based on joint label smoothing according to claim 3, characterized in that, The maximum perturbation sample and its corresponding original sample are fused using a fusion coefficient, specifically as follows: ; in, x adv Adversarial examples generated for the maximum perturbation. α The disturbance coefficient of the first disturbance is . x This is the original sample.
5. The adversarial training method based on joint label smoothing according to claim 1, characterized in that, The label smoothing method in step 7) adopts the one-hot encoding method.
6. The adversarial training method based on joint label smoothing according to claim 5, characterized in that, The label smoothing method is as follows: Where a and b are fixed values, ε is the perturbation magnitude, K is the number of classes, δ is the label smoothing coefficient, e is the base of a natural number, one-hot encoding is the label encoding format, and y is the true label of the sample. s Let λ be the smoothed sample label, and λ be a function of δ.
7. The adversarial training method based on joint label smoothing according to claim 1, characterized in that, In step 8), the label smoothing function from step 7) is used to smooth the labels of the maximum adversarial sample, the first adversarial sample, and the second adversarial sample, respectively.
8. The adversarial training method based on joint label smoothing according to claim 1, characterized in that, The loss function in step 9) is ； Where B is the number of samples in a batch, dividing the current batch into two equal parts, and b is the sample index in a batch of data. This is the adversarial example generated from the b-th original sample of the first half of the data under the maximum perturbation ε. The smoothed label corresponds to the adversarial example with the maximum perturbation. The first adversarial perturbation sample is obtained by fusing the b-th original sample from the first half of the data with the corresponding maximum perturbation adversarial sample. This represents the smoothed sample label corresponding to the first perturbed sample. For the b-th original sample of the second half of the data, in the second perturbation The generated adversarial examples This is the smoothed label corresponding to the second perturbation sample.
9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 8.
10. An adversarial training device based on joint label smoothing, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 8.