A neural network adversarial sample defense method, electronic equipment and storage medium
By segmenting and denoising the adversarial dataset, a set of defensive adversarial examples is generated, which solves the shortcomings of neural network adversarial example defense, achieves correct classification of adversarial examples, and reduces the risk of misclassification.
Patent Information
- Application Number
- CN202310362917.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-04-06
- Publication Date
- 2026-01-02
- Estimated Expiration
- 2043-04-06
AI Technical Summary
Existing neural network adversarial examples lack defenses, leading to misclassification and causing serious consequences, such as traffic accidents or unauthorized personnel passing through access control.
By acquiring an adversarial dataset, segmenting it into color channel images, applying preset masks and noise reduction methods to process high-frequency images, generating a set of adversarial defense samples, and using a target generator to fuse them, removing high-frequency noise and making the adversarial samples closer to the original images.
Effective defense against adversarial examples ensures that they can be correctly classified, reducing the risk of misclassification.
Smart Images
Figure CN116523000B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of deep learning, and particularly relates to a neural network adversarial sample defense method, an electronic device and a storage medium. BACKGROUND
[0002] In recent years, deep learning has become one of the most active computer research fields. Research has found that deep neural networks are easily disturbed by small input disturbances, which are imperceptible to humans but can cause errors in machines. This error-causing data is called an adversarial sample. The adversarial sample, that is, the addition of subtle disturbances in the data, can cause the model to give an incorrect output with high confidence. This is a blind spot in machine learning algorithm research. The existence of adversarial samples has drawn attention to the vulnerability of neural networks. For example, in the fields of autonomous driving and face recognition, the incorrect classification caused by adversarial samples can lead to extremely adverse consequences, such as causing traffic accidents or illegal personnel passing through access control, etc. Therefore, the existing adversarial samples do not have defense, leading to the occurrence of adverse consequences. SUMMARY
[0003] Therefore, the purpose of the present application is to provide a neural network adversarial sample defense method, an electronic device and a storage medium to solve the problem that the existing adversarial samples do not have defense, leading to the occurrence of adverse consequences.
[0004] To achieve the above purpose, the present application provides a neural network adversarial sample defense method in a first aspect, comprising:
[0005] obtaining an adversarial data set;
[0006] segmenting each image in the adversarial data set according to a color channel to obtain a segmented image set;
[0007] processing the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set;
[0008] performing noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set;
[0009] inputting the target low-frequency image set and the target noise-reduced high-frequency image set into a preset target generator for fusion to generate a defense adversarial sample set.
[0010] Further, the color channel includes a first color channel, a second color channel and a third color channel, the first color channel is a red channel, the second color channel is a green channel, and the third color channel is a blue channel.
[0011] The segmenting each image in the adversarial data set according to a color channel to obtain a segmented image set comprises:
[0012] segment each image in the adversarial dataset according to the first color channel to obtain a first segmented image set;
[0013] segment each image in the adversarial dataset according to the second color channel to obtain a second segmented image set;
[0014] segment each image in the adversarial dataset according to the third color channel to obtain a third segmented image set;
[0015] combine the first segmented image set, the second segmented image set and the third segmented image set to obtain a set of segmented images.
[0016] Further, the preset mask includes a first preset mask, and the first preset mask is a low-frequency image mask.
[0017] The processing of the set of segmented images according to the preset mask to obtain a target low-frequency image set includes:
[0018] superimpose the first preset mask and a first segmented image in the first segmented image set to obtain a first low-frequency image set;
[0019] superimpose the first preset mask and a second segmented image in the second segmented image set to obtain a second low-frequency image set;
[0020] superimpose the first preset mask and a third segmented image in the third segmented image set to obtain a third low-frequency image set;
[0021] combine the first low-frequency image set, the second low-frequency image set and the third low-frequency image set to obtain a target low-frequency image set.
[0022] Further, the preset mask includes a second preset mask, and the second preset mask is a high-frequency image mask.
[0023] The processing of the set of segmented images according to the preset mask to obtain a target high-frequency image set includes:
[0024] superimpose the second preset mask and a first segmented image in the first segmented image set to obtain a first high-frequency image set;
[0025] superimpose the second preset mask and a second segmented image in the second segmented image set to obtain a second high-frequency image set;
[0026] superimpose the second preset mask and a third segmented image in the third segmented image set to obtain a third high-frequency image set;
[0027] Merge the first high-frequency image set, the second high-frequency image set and the third high-frequency image set to obtain a target high-frequency image set.
[0028] Further, the target low-frequency image set and the target denoised high-frequency image set are input into a preset target generator for fusion to generate a defense adversarial sample set, including:
[0029] The low-frequency image in the target low-frequency image set and the denoised high-frequency image corresponding to the low-frequency image are input into a preset target generator for fusion to generate the defense adversarial sample set.
[0030] Further, the training process of the preset target generator includes:
[0031] The generator and the discriminator are iteratively trained according to the target low-frequency image set and the target denoised high-frequency image set.
[0032] In response to determining that the loss of the iterated discriminator reaches a preset threshold, the iterated generator is taken as a target generator.
[0033] Further, the training process of the preset target generator includes:
[0034] The generator and the discriminator are iteratively trained according to the target low-frequency image set and the target denoised high-frequency image set.
[0035] In response to the iteration round number reaching an iteration round number threshold, the iterative training is stopped, and the generator trained in this round of iteration is output as the target generator.
[0036] Further, the generator and the discriminator are iteratively trained according to the target low-frequency image set and the target denoised high-frequency image set, including:
[0037] For each round of iterative training, the following operations are performed:
[0038] The low-frequency image and the corresponding denoised high-frequency image are spliced and input into the generator to obtain a fusion image.
[0039] The fusion image and the original sample corresponding to the image are input into the discriminator to obtain the loss of the discriminator.
[0040] According to the loss of the discriminator, the discriminator is updated to obtain a discriminator in the next round of iteration.
[0041] According to the discriminator in the next round of iteration, the generator is updated to obtain a generator in the next round of iteration.
[0042] To achieve the above object, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the program to implement the method according to any one of the above.
[0043] To achieve the above object, the present application provides a non-transitory computer readable storage medium storing computer instructions for causing a computer to execute the method according to any one of the above.
[0044] As can be seen from the above, the neural network adversarial sample defense method provided by the present application first acquires an adversarial data set, then segments each image in the adversarial data set to obtain a segmented image set; processes the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set; performs noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set; inputs the target low-frequency image set and the target noise-reduced high-frequency image set into a preset target generator for fusion to generate a defense adversarial sample set. The defense adversarial sample generated by the method removes the noise in the high-frequency image, i.e., removes the adversarial perturbation distributed in the high-frequency component image, so that the adversarial sample is closer to the original image, and the adversarial sample can be correctly classified. BRIEF DESCRIPTION OF DRAWINGS
[0045] In order to more clearly illustrate the technical solutions in the present application or related art, the drawings needed to be used in the embodiments or related art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.
[0046] Figure 1 A neural network adversarial sample defense method flowchart of an embodiment of the present application;
[0047] Figure 2 A neural network adversarial sample defense device structure framework schematic diagram of an embodiment of the present application;
[0048] Figure 3 An electronic device hardware structure schematic diagram of an embodiment of the present application. DETAILED DESCRIPTION
[0049] To make the object, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to specific embodiments and drawings.
[0050] It should be noted that, unless otherwise defined, technical terms or scientific terms used in the embodiments of the present application shall have the common meaning understood by one of ordinary skill in the art to which the present application pertains. The terms "first", "second", and similar terms used in the embodiments of the present application do not denote any order, quantity, or importance, but are merely used to distinguish different components. The terms "include", "contain", and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms do not mean physical or mechanical connection, but can include electrical connection, whether direct or indirect. The terms "upper", "lower", "left", "right", and the like are merely used to represent relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships can also change accordingly.
[0051] The embodiments of the present application are described in detail below with reference to the accompanying drawings.
[0052] Reference Figure 1 A neural network adversarial sample defense method, comprising:
[0053] Step S100, acquiring an adversarial data set.
[0054] In this step, the adversarial data set is adversarial data generated by using an attack method on the original data set, and the attack method adopts any one of FGSM, PGD, CW, DeepFool, and a self-defined attack method.
[0055] The original data set is a public data set, for example, CIFAR-10, MNIST, and a self-defined data set.
[0056] Step S200, segmenting each image in the adversarial data set according to a color channel to obtain a segmented image set.
[0057] In this step, the color channel refers to the RGB color channel, and the image in the adversarial data set is segmented according to the RGB color channel to obtain an image set corresponding to the RGB color channel, i.e., the segmented image set.
[0058] Step S300, processing the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set.
[0059] In this step, the preset mask is a mask (i.e., an image mask) of the same size as the images in the segmented image set, which is constructed in advance, and the preset mask includes a low-frequency image mask and a high-frequency image mask. The low-frequency image mask is superimposed on the low-frequency images in the segmented image set to retain only the low-frequency components of the images, thereby obtaining a target low-frequency image set. The high-frequency image mask is superimposed on the high-frequency images in the segmented image set to retain only the high-frequency components of the images, thereby obtaining a target high-frequency image set.
[0060] Step S400: performing denoising processing on the target high-frequency image set according to a preset denoising method, to obtain a target denoised high-frequency image set.
[0061] In this step, the preset denoising method is to calculate each pixel point in the image by using a denoising formula to obtain a target denoised pixel point, generate a target denoised high-frequency image according to the target denoised pixel point, and perform denoising processing on all images in the target high-frequency image set to obtain a target denoised high-frequency image set.
[0062] The denoising formula is as follows:
[0063]
[0064] wherein x represents a pixel point currently processed; v'(x) represents a pixel point value of x after denoising; Ω x represents a set of pixel points in the neighborhood of x, and the range of the neighborhood needs to be selected according to actual conditions; y represents a pixel point in Ω x ; v(y) represents a pixel point value of y before denoising; w(x, y) represents a weight, which is calculated according to the similarity between x and y; and n represents the sum of all weights.
[0065] Further, the calculation formula of w(x, y) is as follows:
[0066]
[0067]
[0068] wherein w'(x, y) represents a temporary weight; k represents a preset similarity threshold value, and the value of k needs to be selected according to actual conditions; v(x) represents a pixel point value of x before denoising; and v(y) represents a pixel point value of y before denoising.
[0069] Step S500: inputting the target low-frequency image set and the target denoised high-frequency image set into a preset target generator for fusion, to generate a defensive adversarial sample set.
[0070] In this step, the low-frequency images in the low-frequency image set correspond to the denoised high-frequency images in the target denoised high-frequency image set. The preset target generator is obtained by iterative training of the low-frequency images and the corresponding denoised high-frequency images. The low-frequency images and the corresponding denoised high-frequency images are input into the preset target generator for fusion to generate a defensive adversarial sample set.
[0071] Specifically, the defensive adversarial sample generated by steps S100-S500 removes the noise in the high-frequency image, i.e., removes the adversarial perturbation distributed in the high-frequency component image, so that the adversarial sample is closer to the original image, and the adversarial sample can be correctly classified.
[0072] In some embodiments, in step S200, the color channels include a first color channel, a second color channel, and a third color channel, the first color channel is a red channel (i.e., an R color channel), the second color channel is a green channel (i.e., a G color channel), and the third color channel is a blue channel (i.e., a B color channel).
[0073] The segmentation of each image in the adversarial data set according to the color channel to obtain a segmented image set includes:
[0074] Segmenting each image in the adversarial data set according to the first color channel to obtain a first segmented image set;
[0075] Segmenting each image in the adversarial data set according to the second color channel to obtain a second segmented image set;
[0076] Segmenting each image in the adversarial data set according to the third color channel to obtain a third segmented image set;
[0077] The first segmented image set, the second segmented image set, and the third segmented image set are combined into a set and serve as the segmented image set.
[0078] Specifically, when extracting the low-frequency image and the high-frequency image in the image, it is necessary to convert the image into a frequency spectrum image through Fourier transform, and process the frequency spectrum image using a mask to obtain the low-frequency image and the high-frequency image, respectively. Since Fourier transform can only process a single color channel, each image in the adversarial data set is segmented into three color channel images, i.e., each image is segmented into three images, and all segmented images are combined into a set and serve as the segmented image set.
[0079] In some embodiments, in step S300, the preset mask includes a first preset mask, and the first preset mask is a low-frequency image mask.
[0080] The processing of the segmented image set according to the preset mask to obtain a target low-frequency image set includes:
[0081] superimpose the first preset mask and a first segmentation image in the first set of segmentation images to obtain a first set of low-frequency images;
[0082] superimpose the first preset mask and a second segmentation image in the second set of segmentation images to obtain a second set of low-frequency images;
[0083] superimpose the first preset mask and a third segmentation image in the third set of segmentation images to obtain a third set of low-frequency images;
[0084] combine the first set of low-frequency images, the second set of low-frequency images and the third set of low-frequency images to obtain a target set of low-frequency images.
[0085] Specifically, the low-frequency image mask is pre-constructed, the size of the low-frequency image mask is consistent with the size of the images in the set of segmentation images, the pixel values of the low-frequency image mask are all set to 0, a square sub-region (which is a preset low-frequency region of the image) is set in the central region of the low-frequency image mask, and the pixel values in the square sub-region are all set to 1.
[0086] The images in the set of segmentation images are converted into frequency spectrum images through Fourier transform.
[0087] The first segmentation image is superimposed with the low-frequency image mask (i.e. the pixel points of the low-frequency image mask are multiplied by the pixel points of the first segmentation image (frequency spectrum image) to obtain a frequency spectrum image that only retains low frequencies), the pixel points of the first segmentation image in the square sub-region remain unchanged, and the pixel values of the external region of the square sub-region all become 0, that is, the high-frequency components of the first segmentation image are removed, only the low-frequency components are retained, inverse Fourier transform is performed to obtain a first low-frequency image.
[0088] The second segmentation image is superimposed with the low-frequency image mask (i.e. the pixel points of the low-frequency image mask are multiplied by the pixel points of the second segmentation image to obtain a frequency spectrum image that only retains low frequencies), the pixel points of the second segmentation image in the square sub-region remain unchanged, and the pixel values of the external region of the square sub-region all become 0, that is, the high-frequency components of the second segmentation image are removed, only the low-frequency components are retained, inverse Fourier transform is performed to obtain a second low-frequency image.
[0089] The third segmentation image is superimposed with the low-frequency image mask (i.e. the pixel points of the low-frequency image mask are multiplied by the pixel points of the third segmentation image to obtain a frequency spectrum image that only retains low frequencies), the pixel points of the third segmentation image in the square sub-region remain unchanged, and the pixel values of the external region of the square sub-region all become 0, that is, the high-frequency components of the third segmentation image are removed, only the low-frequency components are retained, inverse Fourier transform is performed to obtain a third low-frequency image.
[0090] The first low-frequency image (i.e. the low-frequency image of the R color channel), the second low-frequency image (i.e. the low-frequency image of the G color channel), and the third low-frequency image (i.e. the low-frequency image of the B color channel) correspond to the low-frequency images of the three color channels of an image. The first low-frequency image, the second low-frequency image, and the third low-frequency image are combined to obtain a low-frequency image of a complete color channel, i.e. a target low-frequency image. All images in the segmented image set are sequentially processed in the above manner, and all target low-frequency images are combined to obtain a target low-frequency image set.
[0091] In some embodiments, in step S300, the preset mask includes a second preset mask, and the second preset mask is a high-frequency image mask.
[0092] The processing of the segmented image set according to the preset mask to obtain a target high-frequency image set includes:
[0093] The second preset mask is superimposed on the first segmented image in the first segmented image set to obtain a first high-frequency image set.
[0094] The second preset mask is superimposed on the second segmented image in the second segmented image set to obtain a second high-frequency image set.
[0095] The second preset mask is superimposed on the third segmented image in the third segmented image set to obtain a third high-frequency image set.
[0096] The first high-frequency image set, the second high-frequency image set, and the third high-frequency image set are combined to obtain a target high-frequency image set.
[0097] Specifically, the high-frequency image mask is pre-constructed, the size of the high-frequency image mask is consistent with the size of the images in the segmented image set, the pixel values of the high-frequency image mask are all set to 1, a square sub-region (which is a preset low-frequency region of the image) is set in the center region of the high-frequency image mask, and the pixel values in the square sub-region are all set to 0.
[0098] The first segmented image is superimposed on the high-frequency image mask (i.e. the pixel points of the high-frequency image mask are multiplied by the pixel points of the first segmented image to obtain a frequency spectrum graph that only retains high frequencies), the pixel points of the first segmented image in the square sub-region all become 0, and the pixel point values of the external region of the square sub-region remain unchanged, i.e. the low-frequency component of the first segmented image is removed, only the high-frequency component is retained, inverse Fourier transform is performed to obtain a first high-frequency image.
[0099] The second segmentation image is superimposed with the high-frequency image mask (i.e., the pixel points of the high-frequency image mask are multiplied by the pixel points of the second segmentation image to obtain a spectrum graph that only retains high frequencies), the pixel points of the second segmentation image located in the square sub-regions all become 0, and the pixel point values of the regions outside the square sub-regions remain unchanged, that is, the low-frequency components of the first segmentation image are removed, only the high-frequency components are retained, inverse Fourier transform is performed, and a second high-frequency image is obtained.
[0100] The third segmentation image is superimposed with the high-frequency image mask (i.e., the pixel points of the high-frequency image mask are multiplied by the pixel points of the third segmentation image to obtain a spectrum graph that only retains high frequencies), the pixel points of the third segmentation image located in the square sub-regions all become 0, and the pixel point values of the regions outside the square sub-regions remain unchanged, that is, the low-frequency components of the first segmentation image are removed, only the high-frequency components are retained, inverse Fourier transform is performed, and a third high-frequency image is obtained.
[0101] The first high-frequency image (i.e., the high-frequency image of the R color channel), the second high-frequency image (i.e., the high-frequency image of the G color channel), and the third high-frequency image (i.e., the high-frequency image of the B color channel) correspond to the high-frequency images of the three color channels of an image. The first high-frequency image, the second high-frequency image, and the third high-frequency image are combined to obtain a high-frequency image of a complete color channel, that is, a target high-frequency image. All images in the segmentation image set are processed in the above manner, and all target high-frequency images are combined to obtain a target high-frequency image set.
[0102] In some embodiments, in step S500, the target low-frequency image set and the target denoised high-frequency image set are input into a preset target generator for fusion to generate a defensive adversarial sample set, including:
[0103] The low-frequency image in the target low-frequency image set and the denoised high-frequency image corresponding to the low-frequency image are input into a preset target generator for fusion to generate the defensive adversarial sample set.
[0104] Specifically, the low-frequency images in the target low-frequency image set and the denoised high-frequency images in the target denoised high-frequency image set correspond to each other in order, each low-frequency image corresponds to a denoised high-frequency image, the low-frequency image and the corresponding denoised high-frequency image are input into a preset target generator for fusion to generate a defensive adversarial sample, all defensive adversarial samples are combined to obtain a defensive adversarial sample set, noise in the high-frequency image is removed, that is, adversarial perturbations distributed in the high-frequency component image are removed, so that the adversarial sample is closer to the original image, and the adversarial sample can be correctly classified.
[0105] In some embodiments, the training process of the preset target generator includes:
[0106] training the generator and the discriminator iteratively according to the target low-frequency image set and the target denoised high-frequency image set;
[0107] in response to determining that the loss of the iterated discriminator reaches a preset threshold, taking the iterated generator as a target generator.
[0108] Specifically, the generator and the discriminator are an adversarial network, the discriminator is used to distinguish the generated samples and the real samples, and the generator is used to generate generated samples as close to the real samples as possible, so as to effectively capture the distribution characteristics of the real data. After training, the generator can be used to generate defensive adversarial samples. The generator and the discriminator are repeatedly iteratively trained by the low-frequency images in the target low-frequency image set and the corresponding denoised high-frequency images, until a preset termination condition is met. It is judged whether the preset termination condition is met. When the discriminator loss reaches a specified threshold, the algorithm stops running, and the obtained generator is the target generator required.
[0109] In some embodiments, the training process of the preset target generator comprises:
[0110] training the generator and the discriminator iteratively according to the target low-frequency image set and the target denoised high-frequency image set;
[0111] in response to the number of iteration rounds reaching an iteration round threshold, stopping the iterative training, and outputting the generator trained in this round of iterative training as the target generator.
[0112] Specifically, the generator and the discriminator are an adversarial network, the discriminator is used to distinguish the generated samples and the real samples, and the generator is used to generate generated samples as close to the real samples as possible, so as to effectively capture the distribution characteristics of the real data. After training, the generator can be used to generate defensive adversarial samples. The generator and the discriminator are repeatedly iteratively trained by the low-frequency images in the target low-frequency image set and the corresponding denoised high-frequency images, until a preset termination condition is met. It is judged whether the preset termination condition is met. When the number of iteration rounds reaches a specified threshold, the algorithm stops running, and the obtained generator is the target generator required.
[0113] In some embodiments, training the generator and the discriminator iteratively according to the target low-frequency image set and the target denoised high-frequency image set comprises:
[0114] For each round of iterative training, the following operations are performed:
[0115] splicing the low-frequency image and the corresponding denoised high-frequency image, and inputting them into the generator to obtain a fused image;
[0116] input the fusion image and the original sample corresponding to the image into the discriminator to obtain a loss of the discriminator;
[0117] update the discriminator according to the loss of the discriminator to obtain a discriminator in a next round of iteration;
[0118] update the generator according to the discriminator in the next round of iteration to obtain a generator in the next round of iteration.
[0119] Specifically, the low-frequency image is spliced with the corresponding denoised high-frequency image, and input into the generator to obtain the defensive adversarial sample. The defensive adversarial sample and the original sample are input into the discriminator to determine whether the disturbance in the generator can cause the discriminator to misclassify, that is, whether it can deceive the discriminator. At this time, the discriminator outputs a loss, and the discriminator is updated according to the loss of the discriminator to obtain a discriminator in a next round of iteration. The generator is updated according to the discriminator in the next round of iteration to obtain a generator in the next round of iteration.
[0120] It should be noted that the embodiments of the present application can be further described in the following manner:
[0121] Initialize the model parameters of the generator G and the discriminator D.
[0122] Extract n samples from the original data set, and obtain the corresponding low-frequency image and denoised high-frequency image.
[0123] Alternately train the discriminator and the generator. For each round of iteration, the following operations are performed:
[0124] First, fix the model parameters of the generator G, and train the discriminator D. The low-frequency image and the denoised high-frequency image are spliced in the 0th dimension, and the spliced image is input into the generator to obtain a fusion image. The fusion image is input into the discriminator to obtain a loss of the discriminator, and the discriminator is updated through the loss.
[0125] After training the discriminator D for k times, fix the model parameters of the discriminator D, and train the generator G. The low-frequency adversarial sample and the denoised high-frequency adversarial sample are spliced in the 0th dimension, and the spliced image is input into the generator to obtain a fusion image. The fusion image is input into the discriminator to obtain a loss of the discriminator, and the generator is updated through the loss. The training goal is to make the sample generated by the generator difficult to be distinguished by the discriminator.
[0126] At the end of the iteration, the final discriminator D cannot distinguish whether the sample generated by the generator G is a real original sample or a generated sample generated by the generator G. At this time, the confidence of judging the generated sample as a generated sample is equal to the confidence of judging it as a real sample, both being 0.5.
[0127] Wherein the number of samples n, the number of times k of training the discriminator in each round of iteration can be selected according to actual conditions.
[0128] It should be noted that the method of the embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices will interact with each other to complete the method.
[0129] It should be noted that some embodiments of the present application have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.
[0130] Based on the same inventive concept, the present application also provides a neural network adversarial sample defense device corresponding to any of the above-mentioned embodiment methods.
[0131] Reference Figure 2 , the neural network adversarial sample defense device comprises:
[0132] The acquisition module 201 is configured to acquire an adversarial data set.
[0133] The segmentation module 202 is configured to segment each image in the adversarial data set according to a color channel to obtain a segmented image set.
[0134] The first processing module 203 is configured to process the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set.
[0135] The second processing module 204 is configured to perform noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set.
[0136] The generation module 205 inputs the target low-frequency image set and the target noise-reduced high-frequency image set into a preset target generator for fusion to generate a defense adversarial sample set.
[0137] For the convenience of description, the above device is described as various modules respectively described in terms of functions. Of course, the functions of the modules can be implemented in the same or multiple software and / or hardware when implementing the present application.
[0138] The device of the above embodiment is used to implement the neural network adversarial sample defense method of any one of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described here.
[0139] Based on the same inventive concept, the present application also provides an electronic device corresponding to the method of any one of the above embodiments, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the neural network adversarial sample defense method of any one of the above embodiments when executing the program.
[0140] Figure 3 A more specific hardware structure schematic diagram of an electronic device provided by the present embodiment is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.
[0141] The processor 1010 can be implemented by a general CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit) or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the present embodiment.
[0142] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the present embodiment are implemented by software or firmware, the related program codes are stored in the memory 1020 and called and executed by the processor 1010.
[0143] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.
[0144] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through wired mode (such as USB, network cable, etc.), or can realize communication through wireless mode (such as mobile network, WIFI, Bluetooth, etc.).
[0145] The bus 1050 includes a path for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.
[0146] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary for the implementation of the embodiments of the present application, and does not have to contain all the components shown in the figure.
[0147] The electronic device of the above embodiment is used to implement the neural network adversarial sample defense method corresponding to any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.
[0148] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the neural network adversarial sample defense method of any of the above embodiments.
[0149] The computer readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be realized by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible by a computing device.
[0150] The computer instructions stored in the storage medium of the above embodiments are used to make the computer execute the neural network adversarial sample defense method according to any one of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which are not described herein again.
[0151] Those skilled in the art should understand that the discussion of any embodiment above is only exemplary, and is not intended to imply that the scope (including claims) of the present application is limited to these examples; the above embodiments or technical features among different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the embodiments of the present application as described above, which are not provided in details for the sake of brevity.
[0152] In addition, in order to simplify the description and discussion, and so as not to make the embodiments of the present application difficult to understand, the well-known power / ground connections of integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. In addition, the apparatus can be shown in the form of a block diagram in order to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram apparatus are highly dependent on the platform to be implemented the embodiments of the present application (i.e. these details should be fully within the understanding of those skilled in the art). Where specific details (e.g. circuits) are set forth in order to describe an exemplary embodiment of the present application, it will be apparent to those skilled in the art that the embodiments of the present application can be practiced without these specific details or with variations on these specific details. Therefore, these descriptions should be considered as illustrative rather than limiting.
[0153] Although the present application has been described in conjunction with the specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g. dynamic RAM (DRAM)) can use the embodiments discussed.
[0154] The embodiments of the present application are intended to cover all such alternatives, modifications and variations as falling within the broad scope of the appended claims. Accordingly, any omission, modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the present application should be included in the protection scope of the present application.
Claims
1. A neural network adversarial sample defense method, characterized in that, The method comprises the following steps: obtaining an adversarial data set; segmenting each image in the adversarial data set according to a color channel to obtain a segmented image set; processing the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set; performing noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set; inputting the target low-frequency image set and the target noise-reduced high-frequency image set into a preset target generator for fusion to generate a defensive adversarial sample set.
2. The method of claim 1, wherein, The color channel comprises a first color channel, a second color channel and a third color channel, the first color channel is a red channel, the second color channel is a green channel, and the third color channel is a blue channel. The step of segmenting each image in the adversarial data set according to a color channel to obtain a segmented image set comprises the following steps: segmenting each image in the adversarial data set according to the first color channel to obtain a first segmented image set; segmenting each image in the adversarial data set according to the second color channel to obtain a second segmented image set; segmenting each image in the adversarial data set according to the third color channel to obtain a third segmented image set; combining the first segmented image set, the second segmented image set and the third segmented image set into a set, and taking the set as the segmented image set.
3. The method of claim 2, wherein, The preset mask comprises a first preset mask, and the first preset mask is a low-frequency image mask. The step of processing the segmented image set according to a preset mask to obtain a target low-frequency image set comprises the following steps: superimposing the first preset mask and a first segmented image in the first segmented image set to obtain a first low-frequency image set; superimposing the first preset mask and a second segmented image in the second segmented image set to obtain a second low-frequency image set; superimposing the first preset mask and a third segmented image in the third segmented image set to obtain a third low-frequency image set; combining the first low-frequency image set, the second low-frequency image set and the third low-frequency image set to obtain the target low-frequency image set.
4. The method of claim 2, wherein, The preset mask comprises a second preset mask, and the second preset mask is a high-frequency image mask. The step of processing the segmented image set according to a preset mask to obtain a target high-frequency image set comprises the following steps: superimposing the second preset mask and a first segmented image in the first segmented image set to obtain a first high-frequency image set; superimposing the second preset mask and a second segmented image in the second segmented image set to obtain a second high-frequency image set; superimposing the second preset mask and a third segmented image in the third segmented image set to obtain a third high-frequency image set; combining the first high-frequency image set, the second high-frequency image set and the third high-frequency image set to obtain the target high-frequency image set.
5. The method of claim 1, wherein, The step of inputting the target low-frequency image set and the target noise-reduced high-frequency image set into a preset target generator for fusion to generate a defensive adversarial sample set comprises the following step: inputting a low-frequency image in the target low-frequency image set and a noise-reduced high-frequency image corresponding to the low-frequency image into a preset target generator for fusion to generate the defensive adversarial sample set.
6. The method of claim 1, wherein, The training process of the preset target generator comprises: iteratively training the generator and the discriminator according to the target low-frequency image set and the target denoised high-frequency image set; in response to determining that the loss of the iterated discriminator reaches a preset threshold, outputting the iterated generator as the target generator.
7. The method of claim 1, wherein, The training process of the preset target generator comprises: iteratively training the generator and the discriminator according to the target low-frequency image set and the target denoised high-frequency image set; in response to the number of iteration rounds reaching a threshold of the number of iteration rounds, stopping the iterative training and outputting the generator trained in this round of iteration as the target generator.
8. The method according to claim 6 or 7, characterized in that, The iteratively training the generator and the discriminator according to the target low-frequency image set and the target denoised high-frequency image set comprises: for each round of iteration, performing the following operations: concatenating the low-frequency image and the corresponding denoised high-frequency image and inputting them into the generator to obtain a fused image; inputting the fused image and the original sample corresponding to the image into the discriminator to obtain the loss of the discriminator; updating the discriminator according to the loss of the discriminator to obtain the discriminator in the next round of iteration; updating the generator according to the discriminator in the next round of iteration to obtain the generator in the next round of iteration.
9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the method of any one of claims 1 to 8 when executing the program.
10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to make the computer execute the method of any one of claims 1 to 8.