Robustness evaluation method and device of neural network, equipment and storage medium

Abstract

The application discloses a kind of robustness evaluation method, device and equipment of neural network, and storage medium, belong to computer technical field.The method comprises: data in benchmark dataset is annotated according to target multi-level structure, and the annotation information of data is obtained;Target multi-level structure includes m levels, and the lowest level in m levels includes at least one leaf characteristic;Data is classified based on the annotation information of data, and at least one atomic dataset is obtained, and the data in atomic dataset has the same annotation information;At least one atomic dataset is used to test the neural network to be evaluated, and the evaluation index value of at least one leaf characteristic is obtained;Based on the evaluation index value of at least one leaf characteristic, the evaluation index value of the neural network to be evaluated is determined, and the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated.The present application helps to improve the robustness evaluation efficiency of neural network.

Description

Technical Field

[0001] This invention belongs to the field of computer technology, and specifically relates to a method, apparatus, device, and storage medium for evaluating the robustness of neural networks. Background Technology

[0002] In the process of evaluating the robustness of neural networks, it is necessary to test the neural network with a dataset to evaluate the characteristic that the neural network can still maintain certain performance under perturbation or uncertainty.

[0003] In related technologies, robustness evaluation of neural networks requires first identifying possible perturbations or uncertainties, then performing a full dataset computation to determine the impact of these perturbations or uncertainties on the network's performance. In practical applications, if there are multiple perturbations or uncertainties, a full dataset computation needs to be performed for each possible perturbation or uncertainty—that is, multiple full dataset computations—to determine the impact of each possible perturbation or uncertainty on the network's performance, ultimately leading to a comprehensive evaluation of the network's robustness.

[0004] Based on this, the overall computational cost of comprehensive quantitative evaluation of the robustness of neural networks in related technologies is directly proportional to the product of the number of data characteristics and the total amount of data set. The amount of data computation is large, and the overall computational complexity is high. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for evaluating the robustness of neural networks, which helps reduce the amount of data processing and lower the overall computational complexity. The technical solution is as follows:

[0006] On the one hand, embodiments of this application provide a robustness evaluation method for neural networks, the method comprising:

[0007] The data in the benchmark dataset are labeled according to the target multi-level structure to obtain the labeling information of the data; the target multi-level structure includes m levels, and the lowest level of the m levels includes at least one leaf feature, where m is a positive integer greater than 1;

[0008] Based on the annotation information of the data, the data is classified to obtain at least one atomic dataset, and the data in the atomic dataset have the same annotation information.

[0009] The neural network to be evaluated is tested using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf characteristic;

[0010] Based on the evaluation index value of the at least one leaf characteristic, the evaluation index value of the neural network to be evaluated is determined, and the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated.

[0011] Optionally, the step of testing the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf feature includes: processing the at least one atomic dataset through the neural network to be evaluated to obtain the evaluation index value of the at least one atomic dataset; for the k-th leaf feature among the at least one leaf features, determining the evaluation index value of at least one label under the k-th leaf feature based on the evaluation index value of the at least one atomic dataset, where k is a positive integer; and determining the evaluation index value of the k-th leaf feature based on the evaluation index value of at least one label under the k-th leaf feature.

[0012] Optionally, determining the evaluation index value of at least one label under the k-th leaf characteristic based on the evaluation index value of the at least one atomic dataset includes: extracting the atomic dataset according to the at least one label under the k-th leaf characteristic to obtain atomic datasets corresponding to the at least one label under the k-th leaf characteristic respectively; for the t-th label among the at least one label under the k-th leaf characteristic, determining the evaluation index value of the t-th label based on the evaluation index value of the atomic dataset corresponding to the t-th label, where t is a positive integer less than or equal to k.

[0013] Optionally, determining the evaluation index value of the k-th leaf characteristic based on the evaluation index value of at least one label under the k-th leaf characteristic includes: constructing a judgment matrix among at least one label under the k-th leaf characteristic; if the judgment matrix passes the consistency test, determining the weight value of at least one label under the k-th leaf characteristic based on the normalized eigenvector corresponding to the largest eigenvalue of the judgment matrix; and performing a weighted summation of the evaluation index values ​​of at least one label under the k-th leaf characteristic based on the weight values ​​of at least one label under the k-th leaf characteristic to obtain the evaluation index value of the k-th leaf characteristic.

[0014] Optionally, determining the evaluation index value of the neural network to be evaluated based on the evaluation index value of the at least one leaf characteristic includes: determining the single-layer weight value of all characteristics included in the m layers according to the target multi-level structure, wherein the single-layer weight value is used to indicate the importance of the lower layer to the higher layer in two adjacent layers; determining the cross-layer weight value of the at least one leaf characteristic based on the single-layer weight value of all characteristics included in the m layers, wherein the cross-layer weight value is used to indicate the importance of the lowest layer to the highest layer in the m layers; and performing a weighted summation of the evaluation index values ​​of the leaf characteristics based on the cross-layer weight values ​​of the leaf characteristics to obtain the evaluation index value of the neural network to be evaluated.

[0015] Optionally, determining the cross-layer weight value of the at least one leaf characteristic based on the single-layer weight values ​​of all characteristics included in the m levels includes: modifying the weight value of the sub-characteristic by multiplying the weight value of the characteristic in the s-th level with the weight value of the sub-characteristic included in the (s+1)-th level, where the s-th level is higher than the (s+1)-th level, and s is a positive integer less than or equal to m; setting s equal to s+1, and re-executing the step of modifying the weight value of the sub-characteristic by multiplying the weight value of the characteristic in the s-th level with the weight value of the sub-characteristic included in the (s+1)-th level; and, if s equals m, determining the modified weight value of the sub-characteristic included in the m-th level as the cross-layer weight value of the at least one leaf characteristic.

[0016] Optionally, the evaluation metrics include any of the following: precision, recall, and cross-class average precision (mAP).

[0017] On the other hand, embodiments of this application provide a robustness evaluation device for neural networks, the device comprising:

[0018] The data annotation module is used to annotate the data in the benchmark dataset according to the target multi-level structure to obtain the annotation information of the data; the target multi-level structure includes m levels, and the lowest level among the m levels includes at least one leaf feature, where m is a positive integer greater than 1;

[0019] A data classification module is used to classify the data based on the annotation information of the data to obtain at least one atomic dataset, wherein the data in the atomic dataset have the same annotation information;

[0020] The feature evaluation module is used to test the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf feature.

[0021] A network evaluation module is used to determine the evaluation index value of the neural network to be evaluated based on the evaluation index value of the at least one leaf characteristic, wherein the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated.

[0022] In another aspect, embodiments of this application provide a computer device, which includes a memory and a processor. The memory stores a computer program, which is loaded and executed by the processor to implement the aforementioned robustness evaluation method for neural networks.

[0023] In another aspect, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the robustness evaluation method for the neural network described above.

[0024] In another aspect, embodiments of this application provide a computer program product that, when run on a computer device, causes the computer device to perform a robustness evaluation method for neural networks as described above.

[0025] The technical solutions provided in this application have at least the following beneficial effects:

[0026] By annotating the benchmark dataset in a multi-dimensional manner according to the target multi-level structure, and classifying the benchmark dataset into several independent and unrelated atomic datasets based on the annotation information, the neural network to be evaluated is then tested using these atomic datasets. This yields the evaluation index values ​​for the leaf characteristics included in the lowest level of the target multi-level structure. Finally, the evaluation index values ​​of each leaf characteristic are combined to obtain the evaluation index value of the neural network to be evaluated. In this way, the comprehensive quantitative evaluation of the robustness of the neural network only requires a single computation of the entire dataset for multiple leaf characteristics, reducing the amount of data computation and overall computational complexity, thus improving the efficiency of robustness evaluation. Furthermore, in this embodiment, the calculation of the evaluation index value of the neural network to be evaluated is shifted down to the lowest level of the target multi-level structure, achieving decoupling and separation of model evaluation and model prediction, which is beneficial for subsequent updates and maintenance. In addition, this embodiment also creates a hierarchical data feature description framework of "characteristic-sub-characteristic-leaf characteristic" through multi-dimensional data annotation, introducing detailed classification and labeled descriptions of data characteristics, which helps improve the robustness of the neural network. Attached Figure Description

[0027] Figure 1 This is a flowchart of a robustness evaluation method for neural networks provided in one embodiment of this application.

[0028] Figure 2 This is a schematic diagram of a data feature hierarchy description framework provided in one embodiment of this application.

[0029] Figure 3 This is a schematic diagram illustrating the calculation of the evaluation index value of a label provided in one embodiment of this application.

[0030] Figure 4 This is a schematic diagram of a single-layer weight value provided in one embodiment of this application.

[0031] Figure 5 This is a robust comprehensive quantitative evaluation framework diagram provided in one embodiment of this application.

[0032] Figure 6 This is a block diagram of a robustness evaluation device for a neural network provided in one embodiment of this application.

[0033] Figure 7 This is a block diagram of a robustness evaluation device for a neural network provided in another embodiment of this application. Detailed Implementation

[0034] The present application will now be described in further detail with reference to the accompanying drawings. The examples given are for illustrative purposes only and are not intended to limit the scope of the application.

[0035] First, it should be noted that in the technical solutions provided in the embodiments of this application, the executing entity of each step can be a computer device, such as a server with computing and storage capabilities, or a terminal such as a mobile phone, tablet computer, multimedia playback device, wearable device, or other computer device. Optionally, when the computer device is implemented as a server, the computer device can be a single server, a server cluster composed of multiple servers, or a cloud computing service center.

[0036] Please refer to Figure 1 The diagram illustrates a flowchart of a robustness evaluation method for a neural network provided in one embodiment of this application. This method can be applied to the computer device described above and may include at least some of the steps (110-140) below.

[0037] Step 110: Label the data in the benchmark dataset according to the target multi-level structure to obtain the data labeling information; the target multi-level structure includes m levels, and the lowest level among the m levels includes at least one leaf feature, where m is a positive integer greater than 1.

[0038] This application embodiment uses a benchmark dataset to evaluate the robustness of the neural network to be evaluated. Optionally, when the technical solution provided in this application embodiment is geared towards vision tasks, the benchmark dataset can be ImageNet (the largest database for image recognition), Kitti (real-world scene data for autonomous vehicles), or Cityscapes (scene data of real city roads), etc. This application embodiment does not limit the type of benchmark dataset.

[0039] Because traditional datasets lack categorized and labeled descriptions of data characteristics, the robustness evaluation of neural networks may be biased based on the statistical properties of the dataset. Therefore, embodiments of this application perform multi-dimensional data annotation on the benchmark dataset according to a target multi-level structure to create a complete hierarchical description framework for data features. Optionally, multi-dimensional data annotation can be performed by computer devices, manually, or a combination of both.

[0040] In this embodiment, the target multi-level structure includes m levels, where m is a positive integer greater than 1, meaning the target multi-level structure includes at least two levels. Each level of the target multi-level structure includes at least one characteristic. For ease of description, in this embodiment, the characteristic included in the higher level of two adjacent levels is called a "characteristic," and the characteristic included in the lower level is called a "sub-characteristic." Furthermore, the characteristic included in the lowest level of the target multi-level structure is called a "leaf characteristic." Based on this, this embodiment creates a data feature hierarchy description framework of "characteristic-sub-characteristic-leaf characteristic" through multi-dimensional data annotation. It should be noted that when the target multi-level structure includes two levels, the data feature hierarchy description framework is implemented as "characteristic-sub-characteristic (leaf characteristic)"; when the target multi-level structure includes three or more levels, the data feature hierarchy description framework includes multiple sub-characteristics.

[0041] For example, such as Figure 2 As shown, for neural networks designed for vision tasks, data characteristics that can be obtained based on the imaging mechanism include, but are not limited to, the background environment, foreground objects, and data acquisition.

[0042] The background environment covers the entire image environment and typically remains unchanged or changes only slightly within a certain timeframe, exhibiting a degree of stability. Therefore, as... Figure 2 As shown, the sub-features of the background environment feature include, but are not limited to: scene, weather, and lighting. Optionally, as... Figure 2As shown, the labels for the weather sub-feature include, but are not limited to: foggy, rainy, snowy, cloudy, and sunny; the labels for the lighting sub-feature include, but are not limited to: early morning, morning, noon, dusk, and night; and the labels for the scene sub-feature include, but are not limited to: plains, mountains, snowfields, mudflats, deserts, and cities.

[0043] Foreground objects are the focus of attention in visual tasks, primarily reflecting the static and dynamic characteristics of objects and the relationships between them, such as whether objects are occluded, dense, or sparse. Figure 2 As shown, the sub-properties of this foreground object characteristic include, but are not limited to: distance, occlusion, and density. Optionally, as... Figure 2 As shown, the labels for the distance sub-characteristic include, but are not limited to: near, medium, far; the labels for the occlusion sub-characteristic include, but are not limited to: no occlusion, partial occlusion, and most occlusion; the labels for the density sub-characteristic include, but are not limited to: low density, medium density, and high density.

[0044] Data acquisition primarily considers factors affecting image acquisition, editing and setting the relative position height and pitch angle in the rendering model, thereby, such as Figure 2 As shown, the sub-features of data acquisition include, but are not limited to: viewpoint and noise. Optionally, as... Figure 2 As shown, the labels for the sub-characteristic of viewpoint include, but are not limited to: eye level, looking up, looking down; the labels for the sub-characteristic of noise include, but are not limited to: none, Gaussian, Poisson, multiplicative, salt and pepper.

[0045] Step 120: Classify the data based on the annotation information to obtain at least one atomic dataset, in which the data have the same annotation information.

[0046] By labeling the data in the benchmark dataset according to the target multi-level structure, the labeling information of the data can be obtained. Then, a computer device further classifies the data based on the labeling information to obtain at least one atomic dataset. In this embodiment, when classifying the data in the benchmark dataset, data with the same labeling information are classified into the same atomic dataset, so that the data in an atomic dataset have the same labeling information. Optionally, in this embodiment, let represent the i-th leaf characteristic, and let represent the j-th label of the i-th leaf characteristic, where i is a positive integer and j is a positive integer. Thus, the atomic dataset can be represented as {c1:l}. 11 c2:l 21 c i :l ij c n :l nz}, where n represents the number of leaf features, and n is a positive integer; z represents the number of tags for the leaf features, and z is a positive integer.

[0047] For example, suppose the benchmark dataset includes 6 images. After multi-dimensional data annotation in step 110, the annotation information of these 6 images is shown in Table 1 below.

[0048] Table 1 Data Labeling Information

[0049] data weather illumination Scene distance density Perspective Image 1 sunny noon Plains middle medium density eye level Image 2 rain afternoon mountainous areas close low density Looking up Image 3 sunny noon Plains middle Medium density eye level Image 4 Snowy day morning snow Far low density eye level Image 5 rain afternoon mountainous areas close low density Looking up Image 6 cloudy day morning City middle High density eye level

[0050] The computer equipment classifies these six images based on the annotation information described in Table 1 above. Images with the same annotation information are grouped into the same atomic dataset, resulting in four atomic datasets: Atomic Dataset 1 {Weather: Sunny, Illumination: Midday, Scene: Plain, Distance: Medium, Density: Medium, Viewpoint: Eye-level}, Atomic Dataset 2 {Weather: Rainy, Illumination: Afternoon, Scene: Mountainous, Distance: Close, Density: Low, Viewpoint: Looking Up}, Atomic Dataset 3 {Weather: Snowy, Illumination: Morning, Scene: Snowy, Distance: Far, Density: Low, Viewpoint: Eye-level}, and Atomic Dataset 4 {Weather: Cloudy, Illumination: Morning, Scene: City, Distance: Medium, Density: High, Viewpoint: Eye-level}. Atomic Dataset 1 corresponds to images 1 and 3, Atomic Dataset 2 corresponds to images 2 and 5, Atomic Dataset 3 corresponds to image 4, and Atomic Dataset 4 corresponds to image 6.

[0051] Step 130: Test the neural network to be evaluated using at least one atomic dataset to obtain an evaluation index value for at least one leaf characteristic.

[0052] After obtaining at least one atomic dataset through classification, the computer device further tests the neural network to be evaluated using at least one atomic dataset with multi-dimensional labels to obtain the evaluation index value of the neural network for at least one leaf characteristic included in the target multi-level structure. Optionally, for the evaluation index value of a certain leaf characteristic, the computer device can first classify at least one atomic dataset according to the label of that leaf characteristic, so that atomic datasets with the same label of leaf characteristic are classified into a set of atomic datasets, and then process the set of atomic datasets through the neural network to be evaluated to obtain the evaluation index value of the label of the leaf characteristic. Finally, by combining the evaluation index values ​​of all labels of the leaf characteristic, the evaluation index value of the leaf characteristic can be obtained. Optionally, the computer device can also first process at least one atomic dataset through the neural network to be evaluated to obtain the evaluation index value of at least one atomic dataset, and then extract the corresponding atomic dataset from the at least one atomic dataset for the evaluation index value of a certain leaf characteristic, so as to combine the evaluation index values ​​of these atomic datasets to obtain the evaluation index value of the leaf characteristic. The following is a further explanation of the latter method.

[0053] In one example, step 130 above may include at least some of the steps (132 to 136) below.

[0054] Step 132: Process at least one atomic dataset using the neural network to be evaluated to obtain the evaluation index value of at least one atomic dataset.

[0055] The computer device inputs all the atomic datasets obtained from the classification in step 120 into the neural network to be evaluated. The evaluation index values ​​of each atomic dataset are obtained through the processing of the neural network to be evaluated. In this way, the entire dataset only needs to be processed once in the robustness evaluation process of the neural network to be evaluated.

[0056] For example, such as Figure 3 As shown, the atomic datasets are represented as D{c1:l 11 c2:l 21 c i :l i1 c n :l n1}……D{c1:l 1j c2:l 2j c i :l ij c n :l nj}……D{c1:l 1z c2:l 2z c i :l iz c n :l nz The computer device processes the aforementioned atomic dataset using the neural network to be evaluated, and obtains the evaluation index values ​​of the aforementioned atomic dataset. These evaluation index values ​​can be expressed as M(F, D{c1:l) 11 c2:l 21 c i :l i1 c n :l n1})……M(F,D{c1:l 1j c2:l 2j c i :l ij c n :l nj})……M(F,D{c1:l 1z c2:l 2z c i :l iz c n :l nz}).

[0057] Step 134: For the kth leaf characteristic among at least one leaf characteristic, determine the evaluation index value of at least one label under the kth leaf characteristic based on the evaluation index value of at least one atomic dataset, where k is a positive integer.

[0058] Suppose that evaluating the robustness of the neural network requires calculating the evaluation index value of the k-th leaf feature. Then, for the k-th leaf feature, the computer device first determines the evaluation index values ​​of all labels under the k-th leaf feature based on the evaluation index values ​​of at least one atomic dataset. Optionally, step 134 above includes: extracting atomic datasets according to at least one label under the k-th leaf feature to obtain atomic datasets corresponding to each of the at least one label under the k-th leaf feature; for the t-th label among the at least one label under the k-th leaf feature, determining the evaluation index value of the t-th label based on the evaluation index value of the atomic dataset corresponding to the t-th label, where t is a positive integer less than or equal to k.

[0059] For example, such as Figure 3 As shown, for the t-th label in at least one label under the k-th leaf characteristic, the computer device extracts two atomic datasets from at least one atomic dataset, and based on the evaluation index value M(F, D{c1:l) of these two atomic datasets... 11 c2:l 21 c k :l kt c n :l n1}) and M(F, D{c1:l 12 c2:l 21 c k :l kt c n :l n3}), calculate the evaluation index value of the t-th label. Optionally, such as Figure 3 As shown, the computer device can obtain the weight values ​​w1 and w2 of the two atomic datasets respectively, and perform a weighted summation of the evaluation index values ​​of the two atomic datasets based on the weight values ​​to obtain the evaluation index value of the t-th label. Optionally, the weight values ​​of the atomic datasets can be randomly generated by the computer device or manually set, and this embodiment does not limit this.

[0060] Step 136: Determine the evaluation index value of the k-th leaf characteristic based on the evaluation index value of at least one label under the k-th leaf characteristic.

[0061] Step 134 above yields the evaluation index values ​​for each label under the k-th leaf characteristic. The computer device then further integrates the evaluation index values ​​of all labels to determine the evaluation index value for the k-th leaf characteristic. Optionally, the computer device can perform any of the following processing on the evaluation index values ​​of all labels under the k-th leaf characteristic: summation, weighted summation, averaging, statistical summation, etc., to obtain the evaluation index value for the k-th leaf characteristic.

[0062] Taking the weighted summation of the evaluation index values ​​of all tags by the computer device as an example, in one example, step 136 above includes: constructing a judgment matrix between at least one tag under the k-th leaf characteristic; if the judgment matrix passes the consistency test, determining the weight value of at least one tag under the k-th leaf characteristic based on the normalized eigenvector corresponding to the largest eigenvalue of the judgment matrix; and performing a weighted summation of the evaluation index values ​​of at least one tag under the k-th leaf characteristic based on the weight value of at least one tag under the k-th leaf characteristic to obtain the evaluation index value of the k-th leaf characteristic.

[0063] For example, when calculating the evaluation index value of the weather characteristic, the Analytic Hierarchy Process (AHP) can be used to construct a judgment matrix among the labels "foggy, rainy, snowy, cloudy, and sunny" related to the weather characteristic. After the judgment matrix passes the consistency check, the largest eigenvalue of the judgment matrix and its corresponding characteristic vector are calculated. Then, the characteristic vector is normalized to obtain a normalized vector. The weight values ​​of each label "foggy, rainy, snowy, cloudy, and sunny" can be obtained through the normalized vector. Then, the evaluation index values ​​of these labels are weighted and summed based on the weight values ​​of these labels to obtain the evaluation index value of the weather characteristic.

[0064] Step 140: Determine the evaluation index value of the neural network to be evaluated based on the evaluation index value of at least one leaf characteristic. The evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated.

[0065] By combining the evaluation index values ​​of the neural network to be evaluated on at least one leaf characteristic, a computer device can further determine the evaluation index value of the neural network to be evaluated. This evaluation index value can then be used to indicate the robustness of the neural network to be evaluated. Optionally, the evaluation index value includes, but is not limited to, any of the following: precision, recall, and mAP (mean Average Precision, cross-class average precision). This embodiment of the application achieves decoupling and separation of model evaluation and model prediction by shifting the calculation of the evaluation index value of the neural network to be evaluated to the lowest level of the target multi-level structure, which is beneficial for subsequent updates and maintenance. Optionally, the computer device can perform any of the following processing on the evaluation index values ​​of at least one leaf characteristic: summation, weighted summation, averaging, statistical summation, etc., to obtain the evaluation index value of the neural network to be evaluated.

[0066] Taking the weighted summation of evaluation index values ​​for at least one leaf characteristic by a computer device as an example, in one example, step 140 above may include at least some of the steps (142 to 146) below.

[0067] Step 142: According to the target multi-level structure, determine the single-level weight values ​​of all characteristics included in the m levels. The single-level weight values ​​are used to indicate the importance of the lower level to the higher level in two adjacent levels.

[0068] Optionally, the computer device can construct a judgment matrix for all characteristics included in two adjacent levels according to the target multi-level structure and hierarchical analysis method. If the judgment matrix passes consistency verification, the single-level weight value of the characteristic is determined based on the normalized vector corresponding to the largest eigenvalue of the judgment matrix. Using a similar method, the computer device can obtain the single-level weight values ​​of all characteristics included in the target multi-level structure. For example, as... Figure 4 As shown, the higher level in two adjacent layers includes the background environment, and the lower level includes weather, lighting, and scene. The weight values ​​of weather, lighting, and scene can be obtained through the analytic hierarchy process, which are used to indicate the importance of weather, lighting, and scene to the background environment.

[0069] Step 144: Based on the single-level weight values ​​of all characteristics included in the m levels, determine the cross-level weight value of at least one leaf characteristic. The cross-level weight value is used to indicate the importance of the lowest level to the highest level among the m levels.

[0070] Since the calculation of the evaluation index value of the neural network to be evaluated is shifted down to the lowest level of the target multi-level structure in this embodiment, the computer device needs to determine the importance of all leaf features included in the target multi-level structure to the highest level, that is, the cross-level weight value of the leaf features. Optionally, the above step 144 includes: using the product of the weight value of the feature in the s-th level and the weight value of the sub-feature contained in the feature in the s+1-th level, to correct the weight value of the sub-feature, where the s-th level is higher than the s+1-th level, and s is a positive integer less than or equal to m; letting s equal s+1, and starting from the step of correcting the weight value of the sub-feature by using the product of the weight value of the feature in the s-th level and the weight value of the sub-feature contained in the feature in the s+1-th level; when s equals m, determining the corrected weight value of the sub-feature contained in the m-th level (i.e., the lowest level) as the cross-level weight value of at least one leaf feature.

[0071] For example, by using the single-layer weight values ​​of all features included in the target multi-level structure, some data elements can be formed to record the current feature, the current feature weight value, and the sub-features contained in the current feature. The recording format of the data elements can be {"name": feature name, "body": [sub-feature, ..., sub-feature], "value": weight value}, such as {"name": imaging, "body": [resolution, hue, saturation, brightness], "value": [0.3, 0.2, 0.3, 0.2]}; based on this... These data elements can be used to construct a feature queue and a sub-feature queue. The feature queue is initialized with a data structure containing all feature weight values, while the sub-feature queue is initialized empty. The feature at the head of the feature queue is retrieved, and its weight value is multiplied by the weight values ​​of its constituent lower-level sub-features to correct the weight values ​​of those sub-features. If a data element corresponds to a lower-level sub-feature, it is added to the tail of the feature queue. This process is repeated until the feature queue is empty. The weight values ​​corresponding to all sub-features in the sub-feature queue are output, which represent the cross-level weight values ​​of the leaf features contained in the target multi-level structure.

[0072] Step 146: Based on the cross-layer weight values ​​of the leaf characteristics, the evaluation index values ​​of the leaf characteristics are weighted and summed to obtain the evaluation index values ​​of the neural network to be evaluated.

[0073] The computer device obtains both the cross-layer weight values ​​of all leaf features and the evaluation index values ​​of all leaf features. A weighted summation process can then be performed to obtain the evaluation index value of the neural network to be evaluated. For example, suppose the evaluation index values ​​of the leaf features are represented as follows: And assume that the cross-layer weights of the leaf characteristics are expressed as follows: Therefore, the evaluation index value of the neural network to be evaluated can be expressed as:

[0074] Please refer to Figure 5 This illustrates a schematic diagram of a robustness evaluation method for neural networks provided in one embodiment of this application. On one hand, as... Figure 5 As shown, firstly, the benchmark dataset is labeled and classified to obtain atomic datasets with multi-dimensional labels. Data with the same labeling information in the benchmark dataset are classified into the same atomic dataset. Then, all atomic datasets are used to test the neural network to be evaluated, and the evaluation index values ​​of each atomic dataset are obtained. Next, for each label of each leaf feature, the corresponding atomic datasets are extracted from the atomic datasets and the evaluation index values ​​of these atomic datasets are combined to obtain the evaluation index value of the corresponding label. Finally, the evaluation index values ​​of all labels under the leaf feature are combined to obtain the evaluation index value of the leaf feature. On the other hand, as... Figure 5 As shown, the single-layer weight values ​​of all characteristics in the multi-level structure are first determined using the analytic hierarchy process (AHP) and consistency analysis. Then, the single-layer weight values ​​of the characteristics at each level are progressively adjusted to obtain the cross-layer weight values ​​of the leaf characteristics. Finally, the computer device uses the cross-layer weight values ​​of the leaf characteristics to perform a weighted summation of the evaluation index values ​​of the leaf characteristics, thereby obtaining the evaluation index values ​​of the neural network to be evaluated.

[0075] In summary, the technical solution provided in this application, by performing multi-dimensional data annotation on the data in the benchmark dataset according to the target multi-level structure, and classifying the benchmark dataset into several independent and unrelated atomic datasets based on the annotation information, then using the atomic datasets to test the neural network to be evaluated, obtains the evaluation index values ​​of the leaf characteristics included in the lowest level of the target multi-level structure, and then combines the evaluation index values ​​of each leaf characteristic to obtain the evaluation index value of the neural network to be evaluated. In this way, the comprehensive quantitative evaluation of the robustness of the neural network to be evaluated only requires one calculation of the entire dataset for multiple leaf characteristics, reducing the amount of data computation, lowering the overall computational complexity, and helping to improve the efficiency of robustness evaluation. Furthermore, in this application embodiment, the calculation of the evaluation index value of the neural network to be evaluated is shifted down to the lowest level of the target multi-level structure, realizing the decoupling and separation of model evaluation and model prediction, which is beneficial for subsequent updates and maintenance. In addition, this application embodiment also creates a data feature hierarchical description framework of "characteristic-sub-characteristic-leaf characteristic" through multi-dimensional data annotation, introducing detailed classification and labeled description of data characteristics, which helps to improve the robustness of the neural network.

[0076] Please refer to Figure 6This diagram illustrates a block diagram of a robustness evaluation apparatus for a neural network according to an embodiment of this application. The apparatus 600 has the functionality to implement the method example described above; this functionality can be implemented in hardware or by hardware executing corresponding software. The apparatus 600 can be the aforementioned computer device or can be disposed within the aforementioned computer device. The apparatus 600 may include: a data annotation module 610, a data classification module 620, and a network evaluation module 640.

[0077] The data annotation module 610 is used to annotate the data in the benchmark dataset according to the target multi-level structure to obtain the annotation information of the data; the target multi-level structure includes m levels, and the lowest level among the m levels includes at least one leaf feature, where m is a positive integer greater than 1.

[0078] The data classification module 620 is used to classify the data based on the annotation information of the data to obtain at least one atomic dataset, wherein the data in the atomic dataset have the same annotation information.

[0079] The feature evaluation module 630 is used to test the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf feature.

[0080] The network evaluation module 640 is used to determine the evaluation index value of the neural network to be evaluated based on the evaluation index value of the at least one leaf characteristic, wherein the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated.

[0081] In one example, such as Figure 7 As shown, the feature evaluation module 630 includes: a dataset evaluation unit 632, used to process the at least one atomic dataset through the neural network to be evaluated to obtain the evaluation index value of the at least one atomic dataset; a label evaluation unit 634, used to determine the evaluation index value of at least one label under the k-th leaf feature based on the evaluation index value of the at least one atomic dataset, where k is a positive integer; and a feature evaluation unit 636, used to determine the evaluation index value of the k-th leaf feature based on the evaluation index value of at least one label under the k-th leaf feature.

[0082] In one example, such as Figure 7As shown, the label evaluation unit 634 is used to: extract the atomic dataset according to at least one label under the k-th leaf characteristic to obtain the atomic datasets corresponding to at least one label under the k-th leaf characteristic; and determine the evaluation index value of the t-th label based on the evaluation index value of the atomic dataset corresponding to the t-th label in the at least one label under the k-th leaf characteristic, where t is a positive integer less than or equal to k.

[0083] In one example, such as Figure 7 As shown, the aforementioned feature evaluation unit 636 is used to: construct a judgment matrix between at least one label under the k-th leaf feature; if the judgment matrix passes the consistency test, determine the weight value of at least one label under the k-th leaf feature based on the normalized feature vector corresponding to the largest eigenvalue of the judgment matrix; and perform a weighted summation of the evaluation index values ​​of at least one label under the k-th leaf feature based on the weight value of at least one label under the k-th leaf feature to obtain the evaluation index value of the k-th leaf feature.

[0084] In one example, such as Figure 7 As shown, the network evaluation module 640 includes: a single-layer determination unit 642, configured to determine the single-layer weight values ​​of all characteristics included in the m layers according to the target multi-level structure, wherein the single-layer weight values ​​are used to indicate the importance of the lower layer to the higher layer in two adjacent layers; a cross-layer determination unit 644, configured to determine the cross-layer weight value of at least one leaf characteristic based on the single-layer weight values ​​of all characteristics included in the m layers, wherein the cross-layer weight value is used to indicate the importance of the lowest layer to the highest layer in the m layers; and a network evaluation unit 646, configured to perform a weighted summation of the evaluation index values ​​of the leaf characteristic based on the cross-layer weight values ​​of the leaf characteristic to obtain the evaluation index value of the neural network to be evaluated.

[0085] In one example, such as Figure 7 As shown, the aforementioned cross-layer determination unit 644 is configured to: modify the weight value of the sub-characteristic by multiplying the weight value of the characteristic in the s-th layer with the weight value of the sub-characteristic contained in the characteristic in the (s+1)-th layer, wherein the s-th layer is higher than the (s+1)-th layer, and s is a positive integer less than or equal to m; set s equal to s+1, and repeat the step of modifying the weight value of the sub-characteristic by multiplying the weight value of the characteristic in the s-th layer with the weight value of the sub-characteristic contained in the characteristic in the (s+1)-th layer; and, if s equals m, determine the modified weight value of the sub-characteristic contained in the m-th layer as the cross-layer weight value of the at least one leaf characteristic.

[0086] In one example, the evaluation metric values ​​include any of the following: precision, recall, and cross-class average precision (mAP).

[0087] In an exemplary embodiment, a computer device is also provided, the computer device including a memory and a processor, the memory storing a computer program, the computer program being loaded and executed by the processor to implement the above-described robustness evaluation method for neural networks.

[0088] In an exemplary embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the robustness evaluation method for the neural network described above.

[0089] In an exemplary embodiment, a computer program product is also provided, which, when run on a computer device, causes the computer device to perform a robustness evaluation method for neural networks as described above.

[0090] Although specific embodiments of the invention have been disclosed for illustrative purposes to aid in understanding and implementing the invention, those skilled in the art will understand that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the invention and the appended claims. Therefore, the invention should not be limited to the content disclosed in the preferred embodiments, and the scope of protection claimed by the invention is defined by the claims.

Claims

1. A robustness evaluation method for neural networks, characterized in that, The method includes: The image data in the benchmark dataset is labeled according to the target multi-level structure to obtain the labeling information of the image data; the target multi-level structure includes m levels, and the lowest level of the m levels includes at least one leaf feature, where m is a positive integer greater than 1; The image data is classified based on the annotation information of the image data to obtain at least one atomic dataset, and the data in the atomic dataset have the same annotation information. The neural network to be evaluated is tested using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf characteristic; Based on the evaluation index value of the at least one leaf characteristic, the evaluation index value of the neural network to be evaluated is determined, and the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated. The step of testing the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf characteristic includes: The at least one atomic dataset is processed by the neural network to be evaluated to obtain the evaluation index value of the at least one atomic dataset; For the kth leaf characteristic among the at least one leaf characteristic, based on the evaluation index value of the at least one atomic dataset, determine the evaluation index value of at least one label under the kth leaf characteristic, where k is a positive integer; The evaluation index value of the kth leaf characteristic is determined based on the evaluation index value of at least one label under the kth leaf characteristic. The step of determining the evaluation index value of at least one label under the k-th leaf characteristic based on the evaluation index value of the at least one atomic dataset includes: extracting the atomic dataset according to the at least one label under the k-th leaf characteristic to obtain the atomic datasets corresponding to the at least one label under the k-th leaf characteristic respectively; for the t-th label among the at least one label under the k-th leaf characteristic, determining the evaluation index value of the t-th label based on the evaluation index value of the atomic dataset corresponding to the t-th label, where t is a positive integer less than or equal to k.

2. The method according to claim 1, characterized in that, The determination of the evaluation index value of the k-th leaf characteristic based on the evaluation index value of at least one label under the k-th leaf characteristic includes: Construct a judgment matrix between at least one label under the k-th leaf characteristic; If the judgment matrix passes the consistency test, the weight value of at least one label under the k-th leaf characteristic is determined based on the normalized eigenvector corresponding to the largest eigenvalue of the judgment matrix. Based on the weight value of at least one label under the k-th leaf characteristic, the evaluation index values ​​of at least one label under the k-th leaf characteristic are weighted and summed to obtain the evaluation index value of the k-th leaf characteristic.

3. The method according to claim 1, characterized in that, Determining the evaluation index value of the neural network to be evaluated based on the evaluation index value of the at least one leaf characteristic includes: According to the target multi-level structure, determine the single-level weight value of all characteristics included in the m levels, and the single-level weight value is used to indicate the importance of the lower level to the higher level in two adjacent levels; Based on the single-level weight values ​​of all characteristics included in the m levels, the cross-level weight value of the at least one leaf characteristic is determined, and the cross-level weight value is used to indicate the importance of the lowest level to the highest level among the m levels. Based on the cross-layer weight values ​​of the leaf characteristics, the evaluation index values ​​of the leaf characteristics are weighted and summed to obtain the evaluation index values ​​of the neural network to be evaluated.

4. The method according to claim 3, characterized in that, Determining the cross-layer weight value of the at least one leaf characteristic based on the single-layer weight values ​​of all characteristics included in the m levels includes: The weight value of the sub-characteristic is corrected by multiplying the weight value of the characteristic in the s-th level by the weight value of the sub-characteristic contained in the characteristic in the (s+1)-th level, wherein the s-th level is higher than the (s+1)-th level, and s is a positive integer less than or equal to m. Let s equal s+1, and start again from the step of modifying the weight value of the sub-feature by using the product of the weight value of the feature in the s-th level and the weight value of the sub-feature contained in the feature in the s+1-th level. When s equals m, the weight values ​​of the sub-features contained in the m-th level obtained by the correction are determined as the cross-level weight values ​​of the at least one leaf feature.

5. The method according to any one of claims 1 to 4, characterized in that, The evaluation metrics include any one of the following: accuracy, recall, and cross-class average precision (mAP).

6. A robustness evaluation device for a neural network, characterized in that, The device includes: The data annotation module is used to annotate the image data in the benchmark dataset according to the target multi-level structure to obtain the annotation information of the image data; the target multi-level structure includes m levels, and the lowest level among the m levels includes at least one leaf feature, where m is a positive integer greater than 1; The data classification module is used to classify the image data based on the annotation information of the image data to obtain at least one atomic dataset, wherein the data in the atomic dataset have the same annotation information; The feature evaluation module is used to test the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf feature. A network evaluation module is used to determine the evaluation index value of the neural network to be evaluated based on the evaluation index value of the at least one leaf characteristic, wherein the evaluation index value of the neural network to be evaluated is used to indicate the robustness of the neural network to be evaluated. The step of testing the neural network to be evaluated using the at least one atomic dataset to obtain the evaluation index value of the at least one leaf characteristic includes: The at least one atomic dataset is processed by the neural network to be evaluated to obtain the evaluation index value of the at least one atomic dataset; For the kth leaf characteristic among the at least one leaf characteristic, based on the evaluation index value of the at least one atomic dataset, determine the evaluation index value of at least one label under the kth leaf characteristic, where k is a positive integer; The evaluation index value of the kth leaf characteristic is determined based on the evaluation index value of at least one label under the kth leaf characteristic. The step of determining the evaluation index value of at least one label under the k-th leaf characteristic based on the evaluation index value of the at least one atomic dataset includes: extracting the atomic dataset according to the at least one label under the k-th leaf characteristic to obtain the atomic datasets corresponding to the at least one label under the k-th leaf characteristic respectively; for the t-th label among the at least one label under the k-th leaf characteristic, determining the evaluation index value of the t-th label based on the evaluation index value of the atomic dataset corresponding to the t-th label, where t is a positive integer less than or equal to k.

7. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing a computer program, which is loaded and executed by the processor to implement the robustness evaluation method for neural networks as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the robustness evaluation method for the neural network as described in any one of claims 1 to 5.

Images