Image classification method, terminal device and storage medium

Abstract

The application discloses an image classification method, a terminal device and a storage medium. Step one, using a PGD algorithm to construct a data set for training a classification model into an adversarial training data set. Two, constructing a deep learning classification network model that needs to be enhanced in robustness. Three, constructing an FGAC module, which includes two parts of importance acquisition and adversarial activation inhibition of space and channel, and embedding the FGAC module into the constructed deep learning classification model network, and connecting multiple FGAC modules to obtain further enhancement of robustness. Step four, by adjusting the loss function, the standard loss function is converted into a model overall training loss function to train the FGAC module together with the classification model network, and an enhanced robustness classification model is obtained. The application can inhibit the activation of the channel that affects the model accuracy in the process of adversarial training, so as to improve the model robustness in the adversarial training and reduce the influence on the model accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to image classification technology, in particular to an image classification method, a terminal device and a storage medium. BACKGROUND

[0002] Neural networks have surpassed human performance in completing complex tasks in image recognition, autonomous driving, healthcare, finance, and other fields. It helps the embodiments of the present application to integrate and analyze massive data to make better decisions. However, Biggio et al. designed a simple gradient-based evasion attack for neural network models in 2013, which first revealed the vulnerability of deep learning models to the world. Since then, adversarial sample attacks have cast a shadow on rapidly developing deep learning, which threatens the security of the deep learning system at any time. Neural networks are both "intelligent" and "vulnerable", and it is urgent to solve the security risks of neural networks, especially in safety-critical areas.

[0003] Many researchers have tried to develop powerful attacks to evaluate the robustness of the model, because the robustness can reflect the security of the model. At the same time, many defense methods have been quickly proposed (Madry et al. 2018; Dziugaite, Ghahramani, and Roy 2016; Dziugaite, Ghahramani, and Roy 2016; Xu, Evans, and Qi 2017; Katz et al 2017) and so on. Among these defense methods, adversarial training (Madry et al. 2018) is considered to be the most effective method to improve the robustness of the model (Chen et al. 2022; Croce and Hein 2020), and adversarial training is a data augmentation technique that adds adversarial samples to natural samples to enhance the robustness of the model.

[0004] However, adversarial training has a major drawback that the slight improvement in model robustness is at the expense of model prediction accuracy, and almost all defense techniques in the field of adversarial training are committed to reconciling the contradiction between adversarial robustness and accuracy loss of natural samples. For example, Tsipras et al. (Tsipras et al. 2018) first separated the robust and non-robust features. They proved that adversarial training makes the model over-rely on robust features and reduces the accuracy of natural prediction that relies on non-robust features. For example, Nakkiran believes that as long as the model is large enough, robustness and accuracy can be achieved.

[0005] Existing image classification methods are easily misdirected by attackers to cause false classification results. Improving the robustness of image classification models is an effective means to defend against adversarial sample attacks. One of the methods commonly used to improve the robustness of classification models is to perform adversarial training on the classification model. However, adversarial training is at the expense of the accuracy of normal image samples. In order to improve the robustness of the image classification model and maintain the accuracy of the classification of normal samples, two works, CAS and CIFS, have made some contributions. Among them, the work of CAS found that adversarial samples and natural samples have two characteristics in channel activation: adversarial samples have larger amplitude of channel activation, and more uniform frequency activation of channels. Therefore, they proposed the CAS strategy to suppress the channels that are excessively activated by adversarial samples to improve the robustness of the model. The CIFS method uses the CIFS strategy to suppress the negative correlation channels activated by adversarial samples, because they believe that adversarial data will tend to amplify negative correlation channels. Therefore, existing technologies believe that removing redundant channels activated by adversarial samples and reducing their isomorphism can improve the robustness of the model. But CAS and CIFS both at the expense of prediction accuracy, adversarial training can solve the problem that the feature values activated by adversarial samples are larger in amplitude than the feature values activated by normal samples, but cannot solve the deviation of the activation distribution of adversarial samples and natural samples. SUMMARY

[0006] The technical problem to be solved by the present application is to provide an image classification method, a terminal device and a storage medium to improve the robustness of image classification while ensuring the accuracy of normal sample classification.

[0007] To solve the above technical problems, the technical solution adopted by the present application is: an image classification method, comprising the following steps:

[0008] S1, obtaining image data, and generating adversarial samples using the image data;

[0009] S2, taking the generated adversarial samples as the input of a convolutional neural network, training the convolutional neural network, and obtaining an image classifier;

[0010] The convolutional neural network comprises an input layer and an output layer, the input layer comprises a plurality of serially connected convolutional layers, and the last convolutional layer is connected to the output layer through at least two serially connected activation compression modules.

[0011] The present application embeds an activation compression module in the convolutional neural network, which suppresses the activation of channels that affect model accuracy during adversarial training, thereby improving the robustness of the model while reducing the impact on model accuracy, improving the robustness of image classification, and ensuring the accuracy of normal sample classification.

[0012] The activation compression module comprises a feature pair input feature processing comprising the following steps:

[0013] 1) performing a convolution operation on the input feature map input into the activation compression module to obtain an intermediate feature map;

[0014] 2) determining the class c of the real label corresponding to the input feature map, and finding the intermediate feature map O corresponding to the class c according to the class c c , obtaining the convolution kernel parameters used for calculating the intermediate feature map O c .

[0015] 3) performing feature suppression on the input feature map using the convolution kernel parameters to obtain a suppressed feature map.

[0016] In the present application, by establishing the relationship between the feature value map (input feature map) and the class label, the importance degree of the feature value is obtained to perform a fine-grained activation suppression operation, dynamically learning the importance of the feature value in a fine-grained manner, which can greatly improve the model robustness, and even reduce the damage of the prediction accuracy of natural samples by the adversarial training defense method on some data sets.

[0017] In step 1), the intermediate output feature value O[m,n] of the intermediate feature map O indexed by m and n is represented as:

[0018]

[0019] wherein H, W and C represent the height, width and channel number of the input feature map of the activation compression module,

[0020] m∈H, n∈W, F[i,j] is a convolution kernel with a size of IxJ, and S[i+m,j+n] represents the feature value of the i+mth row and j+nth column of the input feature map S.

[0021] In the present application, I=H and J=W, which ensures that the input feature map is convolved into a feature output consistent with the number of real / predicted classes.

[0022] In step 3), the calculation formula of the suppressed feature map at the index position [h,w] is:

[0023]

[0024] wherein are the parameter values of the index [h,w] position in the convolution kernel corresponding to the class c in the training phase and the testing phase of the convolutional neural network respectively, and S c [h,w] is the feature value of the feature index [h,w] position corresponding to the input feature map.

[0025] Further, the method of the present application further comprises:

[0026] S3, classifying the real-time acquired image data by using the image classifier.

[0027] In the present application, the loss function of the activation compression module The expression is:

[0028]

[0029] wherein, represents the overall loss function of the activation compression module, represents the standard contrastive CE loss function, represents the loss function of the activation compression module, O(*) is the output of the activation compression module, x ′ is the adversarial sample, y is the label, theta is the parameter of the convolutional neural network after adding the activation compression module, F refers to the convolution kernel, lambda is the weight of the activation compression module, and Gamma is the hyperparameter of the activation compression module loss.

[0030] In the present application, the loss function of the activation compression module establishes the relationship between the input feature map of the module and the real label through the intermediate output of the module, obtains the importance of the feature values in the input feature map, and thus can suppress the expression of the features that are easily activated by the adversarial samples but are invalid for the classification of normal samples, and finally the neural network model embedded with the activation compression module is combined with the adversarial training, which can greatly improve the stability of the image recognition function of the model.

[0031] As an inventive concept, the present application also provides a terminal device, which comprises:

[0032] one or more processors;

[0033] a memory having one or more programs stored thereon, which, when executed by the one or more processors, cause the one or more processors to implement the steps of the above-mentioned method of the present application.

[0034] As an inventive concept, the present application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned method of the present application.

[0035] Compared with the prior art, the present application has the beneficial effects that:

[0036] 1、Adversarial training and its activation can significantly enhance the robustness of neural networks, but this improvement in robustness is at the expense of model prediction and real sample accuracy. FGAC (activation compression module) technology can suppress the activation of channels that affect model accuracy during adversarial training, thereby improving model robustness while reducing the impact on model accuracy during adversarial training;

[0037] 2、The present application proposes a general fine-grained feature value suppression module FGAC to suppress feature values that are easily activated by adversarial samples and retain robust feature values, and combines with the strategy of adversarial training to defend against adversarial sample attacks. By establishing the relationship between the feature value graph and the class label, the importance of the feature value is obtained to perform fine-grained activation suppression operation. The FGAC method dynamically learns the importance of the feature value in a more fine-grained manner, which can greatly improve the model robustness, and even reduce the damage to the prediction accuracy of natural samples by the adversarial training defense method on some data sets. This fine-grained suppression operation on feature values in space and channel dimensions has not been involved by the previous;

[0038] 3、The FGAC of the present application can be embedded in existing widely popular neural network models, and has been verified on various adversarial training defense methods. Research more clearly shows the influence of model structure on model robustness. Through the designed model structure and combined with existing defense strategies, the reliability of neural network model can be effectively improved. The FGAC module has enough flexibility and can be easily embedded in traditional neural network models, thereby improving the reliability of neural network models. By combining FGAC technology with adversarial training, AI models can defend against adversarial attacks during actual use, making the model more secure and robust in image recognition tasks. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 The method flowchart of the embodiment of the present application is shown in the figure.

[0040] Figure 2 The FGAC module of the embodiment of the present application is embedded in the Resnet18 neural network structure diagram in the training stage.

[0041] Figure 3 The FGAC module of the embodiment of the present application is embedded in the Resnet18 neural network structure diagram in the test stage.

[0042] Figure 4 The structure diagram of the FGAC module of the embodiment of the present application is shown in the figure.

[0043] Figures 5(a) to 5(d) The last layer channel activation amplitude of the resent18 model under natural training, adversarial training, CAS adversarial training and FGAC adversarial training is shown in the figure. DETAILED DESCRIPTION

[0044] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0045] The applicant found that the deviation between the distribution of the feature values activated by the adversarial samples and the distribution of the feature values activated by the natural samples is the reason for poor robustness of the adversarial training, so the deviation between the distribution of the feature values activated by the adversarial samples and the distribution of the feature values activated by the natural samples is the reason for poor robustness of the adversarial training. Therefore, the embodiment of the present application proposes a fine-grained feature value activation suppression (FGAC) module for suppressing feature values activated by adversarial samples but affecting the prediction accuracy of natural samples. The method flow of the embodiment of the present application is as shown in Figure 1 FGAC introduces activation distribution in adversarial samples and natural samples, thereby obtaining great robustness improvement. The embodiment of the present application finds that whether it is activation amplitude or activation frequency, as long as the distribution of the adversarial samples and the adversarial samples activated is closer, the robustness of the model can be improved. Therefore, the embodiment of the present application further suppresses the features easily activated by the adversarial samples in a more fine-grained manner from the spatial and channel dimensions to improve the robustness and accuracy of the model, and the embodiment of the present application calls this fine-grained feature suppression method FGAC.

[0046] During adversarial training, FGAC first acquires feature value importance by establishing the relationship between the feature value graph and the category label, and then performs fine-grained activation suppression operation. The FGAC method dynamically learns the importance of the feature value in a more fine-grained manner, so that the distribution of the feature values activated by the adversarial samples and the natural samples is closer, which can greatly improve the robustness of the model, and even reduce the damage of the adversarial training defense method to the prediction accuracy of the natural samples on some data sets.

[0047] The FGAC of the embodiment of the present application can be embedded in various neural network models and verified on various adversarial training defense methods. Experiments show that embedding the FGAC module in the neural network model can enhance the robustness of the model, and more clearly show the influence of the model structure on the robustness of the model. Through the designed model structure and combined with the existing defense strategy, the reliability of the model can be effectively improved.

[0048] The technical details of the embodiment of the present application are illustrated by embedding the FGAC module into the Resnet18 network model. The Resnet model is a convolutional neural network proposed by four scholars from Microsoft Research. The Resnet neural network can be used to solve the problem of neural network degradation, that is, as the depth of the network increases, the accuracy gradually reaches saturation and then rapidly degrades. This degradation is manifested in that adding more layers to a model of appropriate depth will result in higher training error, both on the training set and on the test set. However, this degradation is not caused by overfitting, because overfitting is manifested as high accuracy on the training set and poor accuracy on the test set. The Resnet network solves this problem through a residual learning framework, that is, using residual mapping instead of the previous direct stacking method. The Resnet network regards several layers as a block (block), which can be regarded as a function F(x). The expected potential mapping is H(x). The Resnet network uses the method of learning the residual H(x)-x to replace the learning of the potential mapping of F(x), that is, F(x) is defined as H(x)-x. Therefore, the path of the forward propagation network becomes F(x)+x.

[0049] The effectiveness of the embodiment of the present application is verified on multiple public data sets, which are CIFAR-10 and SVHN. The CIFAR-10 data set is used to identify a small data set of common objects, which contains 60,000 32*32 color images, and is divided into ten categories, 6000 images for each category, 50,000 images in the training set, and 10,000 images in the test set, and the batch size is 128. The SVHN data set is extracted from the house numbers in the Google Street View images, which has a similar style to MNIST (the cropped digits are very small), but contains a larger order of magnitude of labeled data (more than 600,000 digit images). It has a total of 10 categories, and the numbers 1-9 correspond to labels 1-9, and the label of "0" is 10. The training set has 73,257 images, and the test set has 26,032 images. In the training phase, the true label of the image can be obtained, so in the activation suppression phase, the label can be easily associated with the feature map, as shown in Figure 2 , and in the test phase, only the predicted label can be obtained, so in the test phase, only the predicted label can be used for feature suppression, as shown in Figure 3 .

[0050] In the experiment, the FGAC module needs to be inserted into the Resnet18, and the structure diagram of the FGAC module is shown in Figure 4, the trained model is verified after inserting the FGAC module, which can improve the robustness of the model without losing too much accuracy, thereby improving the AI model to be free from attacks by adversarial samples in actual application. Specifically, the following steps are included:

[0051] (I) Generating training data

[0052] Generating training data is the experimental preparation stage of the embodiment of the present application. In the experiment, the embodiment of the present application needs to use adversarial samples to conduct adversarial training on the model to enhance the robustness of the AI model. In the embodiment of the present application, the PGD method is used to generate adversarial samples. The PGD (Projected Gradient Descent) method is an effective empirical defense method proposed by Madry et al. In the experiment, the embodiment of the present application uses the PGD algorithm to generate adversarial samples to construct an adversarial training dataset.

[0053] (II) Selecting a target model that needs to enhance the robustness of the FGAC module

[0054] The selected neural network is Resnet18 network. The embodiment of the present application inserts two FGAC modules before the last layer of the Resnet18 network, so the entire network will be divided into three parts. The first part is the convolutional network processing before the FGAC module, the second part is the two FGAC modules, and the third part is the pooling, linear layer and other network processing.

[0055] The FGAC module mainly includes two parts. One part is the importance acquisition part of space and channel, which is realized in the form of convolution in the code. The other part is the adversarial activation suppression part, which is realized in the form of Hadamard product.

[0056] Finally, the FGAC module will construct a loss function together with other parts of the Resnet network, and solve the optimal value through gradient descent to complete the training of the network.

[0057] (III) Training and testing

[0058] The generated adversarial samples are put into the Resnet18 neural network embedded with the FGAC module for training, and the trained model is obtained to prepare for the next step of testing its robustness and classification accuracy.

[0059] First, FGAC obtains the importance of feature values ​​by constructing a relationship between feature maps and class labels. Then, based on the obtained feature importance, it performs fine-grained suppression on the original feature values ​​activated by adversarial samples in both space and channel. The intermediate outputs of FGAC are designed to set the adversarial training loss function, improving the robustness of the model. As the layers deepen, the extracted information becomes more complex, abstract, and high-level. Embedding the FGAC module deeper into the model maximizes the direct relationship with the target class and suppresses the expression of non-robust "high-level" features.

[0060] (I) The Importance of Space and Passage

[0061] Define the input feature map S∈R of a certain layer of the model. H×W×C H, W, and C represent the height, width, and number of channels of the feature map, respectively. For the c-th input feature map S[H,W], F[I,J] is a filter of size I×J. Let (m,n) be the index...

[0062] Eigenvalue O c∈C The formula for calculating [m,n] is as follows:

[0063]

[0064] When the size of the convolution kernel is consistent with the size of the input feature map of the module (I = H, J = W0), and the number of convolution kernels is consistent with the number of dataset labels, according to the formula in (1), the input feature map will be convolved into a 1-dimensional feature output consistent with the number of predicted categories. During the training phase, the embodiment of the present invention can easily obtain the true label for this training, while during the testing phase, after obtaining the 1-dimensional feature output consistent with the number of predicted categories, the embodiment of the present invention determines the predicted label by taking the maximum value of the weights. Thus, the embodiment of the present invention establishes the connection between the feature map and the true label / predicted label during the training and testing phases.

[0065] (II) Counteractivation inhibition

[0066] Assuming a feature map S[H,W] is input to the FGAC module, this embodiment of the invention can establish a connection between the feature map and the data label based on (1) spatial and channel angles to obtain feature importance in order to suppress adversarial sample activation on the feature map. The weights of the output feature values ​​with the same values ​​as the real labels are selected and the input image is subjected to the following feature suppression, wherein the feature suppression parameters obtained after executing the suppression function Suppression(*) are... The mathematical formalization of it is as follows:

[0067]

[0068] These represent the convolutional kernels used for the true labels obtained directly during the training phase and the convolutional kernels used for the predicted labels during the testing phase, respectively. Specifically, These are the parameter values ​​at specific indices [h, w] in the convolution kernel used for the corresponding classification category c. To a certain extent, they represent the feature values ​​S at the corresponding feature indices [h, w] of the original input feature map. c The importance of [h, w] for category c. The main difference between the training and testing phases lies in the selection of labels. Since the true labels of the data can be obtained during the training phase, the weights F corresponding to the true labels can be used directly. y To achieve feature suppression; however, since the test phase data lacks feature labels, the weights corresponding to the labels predicted by the model are used. This is used to perform feature weighting. ⊙ represents the Hadamard product, a type of matrix operation where matrix A = (a... ij ) and B = (b ij If ) are matrices of the same order, and d ij =a ij ×b ij Then matrix D = (d ij Let f(x) be the Hadamard product of matrices A and B. During the backpropagation phase after the Hadamard product operation, the input convolution kernel parameters are adjusted based on the importance of each feature value in both the spatial and channel dimensions. This changes the input feature map in both the spatial and channel dimensions, achieving feature suppression—that is, suppressing feature values ​​activated by adversarial examples that affect the prediction accuracy of natural samples, thereby enhancing the model's robustness. Compared to the channel suppression mode of CAS, FGAC can obtain channel importance from both spatial and channel dimensions in a more fine-grained manner, thus achieving fine-grained suppression of activated features.

[0069] (III) Loss Function for Adversarial Training

[0070] FGAC modules can be easily embedded into different layers of any neural network. Network models with FGAC modules can be combined with existing adversarial training techniques (e.g., standard adversarial training (Citemadry 2018 Towards), Trades (Zhang et al. 2019), and Mart (CiteWang 2020 Improving), etc.) to achieve robust training. During adversarial training, the FGAC-based modules dynamically suppress features activated by adversarial examples that are detrimental to natural accuracy predictions, thereby improving the robustness of the original model.

[0071] The suppression loss of the FGAC module can be expressed as:

[0072]

[0073] Taking standard adversarial training as an example, the overall adversarial training loss function of this model can be expressed as:

[0074]

[0075] This represents the overall loss function of FGAC. This represents the standard adversarial loss function. Let O(*) represent the loss function of the FGAC module. x′ represents the adversarial example, y represents the label, θ represents the model parameters, and F refers to the convolutional kernel. λ represents the weights of the FGAC module, which to some extent represent the suppression strength. Γ is another hyperparameter balancing the loss of the FGAC modules; typically, Γ is set to the number of FGAC modules added.

[0076] Figures 5(a) to 5(d) The values ​​NT represent the activation magnitudes of adversarial and normal samples for the penultimate layer channels of the ResNet18 model under normal training, standard adversarial training, standard adversarial training (AT), CAS adversarial training (CAS_AT), and FGAC adversarial training (FGAC_AT), respectively. These correspond to the activation frequencies of the penultimate layer channels in the ResNet18 model trained using different training strategies. The activation frequencies are arranged in descending order of adversarial samples. Observations show that the models with adversarial training have more similar activation distributions in terms of weight magnitude and frequency, as shown in Figures 5(a) and 5(b). The separation between the activation frequency distributions of adversarial and natural samples is the reason for the poor robustness of this model. Figures 5(a) to 5(d) This phenomenon can be clearly observed. AT, CAS_AT, and FGAC_AT alleviate this problem to some extent. AT, CAS_AT, and FGAC_AT all smooth out the difference between the two distributions to some degree. The FGAC strategy proposed in this embodiment can simultaneously narrow the distance between the activation amplitudes of adversarial examples and natural examples, as well as the distance between their activation frequencies, which is why FGAC can achieve stronger model robustness. Therefore, the more convergent the activation distributions of adversarial and natural examples are, the better the model's robustness.

[0077] In Table 1, the embodiments of the present application respectively use CIFAR-10 and SVHN data sets for training, and it can be seen from the table that the FGAC method proposed by the embodiments of the present application realizes almost the same natural accuracy as CAS, but its robustness is much higher than CAS and CIFS on CIFAR-10 and SVHN. In addition, the channel suppression method CAS proposed by Bai et al. (Bai et al. 2021) suppresses the channel activated by the adversarial sample to a certain extent, but it will also suppress the features that contribute more to the prediction of natural samples. In contrast, FGAC suppresses the features activated by adversarial samples in a more fine-grained manner, which significantly reduces the gap between the activation distribution of adversarial samples and natural samples. Therefore, FGAC can resist more aggressive PGD-20 attacks.

[0078] Table 1 Effect of different defense strategies on CIFAR-10 and SVHN data sets

[0079]

[0080]

[0081] The embodiments of the present application propose an FGAC module to dynamically suppress the part of the features activated by adversarial samples that do not contribute to the accuracy of adversarial samples and natural samples. The deviation between the activation distribution of adversarial samples and natural samples is reduced, and the robustness of the model is greatly improved. Experiments show that the FGAC module can significantly improve the effect of AI model defense against PGD-20 and other adversarial attacks on CIFAR-10 data set and SVHN data set. The FGAC module can be easily embedded in the currently popular AI image classification model to avoid the AI being misled by attackers and making wrong judgments in the image recognition process.

[0082] Embodiment 2

[0083] Embodiment 2 of the present application provides a terminal device corresponding to the above-mentioned embodiment 1, which can be a processing device for a client, such as a mobile phone, a notebook computer, a tablet computer, a desktop computer, etc., to execute the method of the above-mentioned embodiment.

[0084] The terminal device of the present embodiment includes a memory, a processor and a computer program stored in the memory; the processor executes the computer program on the memory to realize the steps of the method of embodiment 1.

[0085] In some implementations, the memory can be a high-speed random access memory (RAM: Random Access Memory), and can also include a non-volatile memory, such as at least one disk memory.

[0086] In other implementations, the processor can be a central processing unit (CPU), a digital signal processor (DSP), a microprocessor, or other processing unit or device, without limitation.

[0087] Embodiment 3

[0088] Embodiment 3 of the present application provides a computer readable storage medium corresponding to the above-mentioned embodiment 1, which stores computer programs / instructions. The computer programs / instructions are executed by a processor to implement the steps of the method of embodiment 1.

[0089] The computer readable storage medium can be a tangible device that maintains and stores instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof.

[0090] Those skilled in the art will understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code. The solutions in the embodiments of the present application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript, etc.

[0091] The present application is described with reference to flowcharts and / or block diagrams according to the methods, devices (systems), and computer program products of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1 The functions specified in a flow or multiple flows and / or blocks

[0092] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable data processing apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable data processing apparatus provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in a flow or multiple flows and / or blocks Figure 1steps of the functions specified in the block or blocks.

[0093] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the preferred embodiments by those of skill in the art once they have the benefit of the present disclosure. Therefore, the appended claims are intended to encompass within their scope all possible variations and modifications of the preferred embodiments.

[0094] It is apparent that those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. It is therefore intended that the application cover all such changes and modifications that are within its scope.

Claims

1. An image classification method, characterized in that, Includes the following steps: S1. Acquire image data and generate adversarial examples using the image data; S2. Use the generated adversarial examples as input to the convolutional neural network to train the convolutional neural network and obtain an image classifier; The convolutional neural network includes an input layer and an output layer. The input layer includes multiple convolutional layers in series, and the last convolutional layer is connected to the output layer through at least two convolutional activation compression modules. The activation compression module includes processing the input features using the following steps: 1) Perform a convolution operation on the input feature map input to the activated compression module to obtain an intermediate feature map; 2) Determine the category c of the true label corresponding to the input feature map, and find the corresponding intermediate feature map based on category c. Obtain the intermediate feature map for computation The parameters of the convolution kernel used; 3) Use the convolution kernel parameters to perform feature suppression on the input feature map to obtain a suppressed feature map; In step 1), the intermediate output feature values ​​of the intermediate feature map O, indexed by m and n. The representation is: in, These represent the height, width, and number of channels of the input feature map for activating the compression module, respectively. It is the size of convolution kernel, Represents the input feature map The eigenvalue of the (i+m)th row and (j+n)th column.

2. The image classification method according to claim 1, characterized in that, 。 3. The image classification method according to claim 1, characterized in that, In step 3), the suppressed feature map at index position [h,w] The calculation formula is: in, These represent the parameter values ​​at index [h, w] in the convolutional kernel corresponding to category c during the training and testing phases of the convolutional neural network, respectively. This is the feature value at the feature index [h, w] corresponding to the input feature map.

4. The image classification method according to any one of claims 1 to 3, characterized in that, Also includes: S3. Use the image classifier to classify the real-time acquired image data.

5. The image classification method according to any one of claims 1 to 3, characterized in that, The loss function of the activated compression module The expression is: in, This represents the overall loss function for activating the compression module. This represents the standard adversarial CE loss function. This represents the loss function for activating the compression module. This is the output of activating the compression module. This is an adversarial example, where y is the label. For the parameters of the convolutional neural network after the activation compression module has been added, F refers to the convolutional kernel. It is the weight that activates the compression module. It is the hyperparameter lost when activating the compression module.

6. A terminal device, characterized in that, include: One or more processors; A memory having stored one or more programs thereon, which, when executed by the one or more processors, cause the one or more processors to perform the steps of the method according to any one of claims 1 to 5.

7. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method as described in any one of claims 1 to 5.

Images