A phase-aware adversarial noise defense method

Abstract

The application discloses a kind of based on phase perception's anti-noise defense method, it is related to anti-noise defense technical field, including: obtaining training sample set;According to training sample set, obtain reference sample and initial counter sample;Phase perception counter defense model is constructed;Wherein, phase perception counter defense model includes phase level counter sample generation module and phase level counter training module;Initial counter sample and reference sample are input to phase level counter sample generation module, and phase level counter sample is generated;Training sample set and phase level counter sample are input to phase level counter training module, phase level counter training module is trained, and the trained phase level counter training module is obtained;According to phase level counter sample generation module and the trained phase level counter training module, the classification result of to-be-predicted sample is obtained, and counter defense is realized.The application can improve classification precision.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of anti-noise defense, and particularly relates to an anti-noise defense method based on phase perception. BACKGROUND

[0002] Deep neural networks are widely used in the field of computer vision due to their powerful performance, but deep neural networks are easily disturbed by adversarial noise that is difficult for the human eye to detect. Existing attack techniques can be divided into two techniques: white-box attack and black-box attack. The white-box attack refers to an attacker attacking according to the obtained model structure information, while the attacker does not know the model information when attacking in the black-box attack. In addition, with the development of attack techniques, attackers can design targeted attack methods according to the characteristics of the model, i.e., adaptive attack, which brings great challenges to the improvement of the robustness of the model.

[0003] In view of the attack in the prior art, researchers have proposed various defense techniques. Existing anti-adversarial defense techniques include pre-processing-based defense and adversarial training. The pre-processing-based defense removes adversarial noise in the image by learning a feature mapping function, while the adversarial training refers to adding adversarial samples to the training set, so that the model learns the characteristics of the adversarial samples during training and improves the robustness of the model.

[0004] Existing research has found that humans tend to use structural information to identify objects, and existing anti-adversarial defense techniques do not fully focus on identifying adversarial samples from the perspective of human perception, and the role of structural semantic information contained in the image in anti-adversarial defense lacks research.

[0005] Therefore, it is urgent to improve the lack of application of structural semantic information contained in the image in anti-adversarial defense in the prior art. SUMMARY

[0006] In order to solve the above problems existing in the prior art, the application provides an anti-adversarial defense method based on phase perception. The technical problem to be solved by the application is solved by the following technical scheme:

[0007] In a first aspect, the application provides an anti-adversarial defense method based on phase perception, comprising:

[0008] obtaining a training sample set; wherein the training sample set comprises a plurality of samples, and the same sample corresponds to the same category target;

[0009] obtaining a reference sample and an initial adversarial sample according to the training sample set;

[0010] constructing a phase perception anti-adversarial defense model; wherein the phase perception anti-adversarial defense model comprises a phase-level adversarial sample generation module and a phase-level adversarial training module;

[0011] Input the initial adversarial sample and the reference sample into the phase-level adversarial sample generation module to generate a phase-level adversarial sample;

[0012] Input the training sample set and the phase-level adversarial sample into the phase-level adversarial training module, train the phase-level adversarial training module, and obtain a trained phase-level adversarial training module;

[0013] According to the phase-level adversarial sample generation module and the trained phase-level adversarial training module, the classification results of the samples to be predicted are obtained to achieve adversarial defense.

[0014] Beneficial effects of the present invention:

[0015] (1) The present invention provides a phase-aware anti-noise defense method, which obtains a reference sample, uses style transfer technology to convert the style of the reference sample into the style of the initial adversarial sample, and extracts the amplitude spectrum of the reference sample. The amplitude spectrum of the reference sample is combined with the phase spectrum of the initial adversarial sample to reconstruct the phase spectrum, thereby obtaining an amplitude spectrum without disturbance and effectively reducing the interference information in the reconstructed sample, thereby effectively reducing the threat of amplitude spectrum disturbance to the robustness of the model.

[0016] (2) The present invention provides a phase-aware adversarial noise defense method, which uses a learning method of shared phase features to output phase-level adversarial samples and label information of corresponding training samples through a target classification network, and uses a specific distance measurement method to shorten the feature distance between the phase-level adversarial samples and the training sample set, thereby learning key phase features. Unlike traditional adversarial training that only focuses on correct classification, the present invention pays more attention to retaining key structural information used for defense, thereby improving the model defense performance in a way that is more in line with human cognition.

[0017] (3) The present invention provides a phase-aware anti-noise defense method, which proposes an adversarial training loss function at the phase level to implement an adversarial training method for defending against phase spectrum adversarial perturbations. Through adversarial training, the model pays full attention to adversarial samples at the phase level, and guides the model to guard against phase spectrum perturbations, thereby further improving the classification accuracy.

[0018] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a phase-aware anti-noise defense method provided by an embodiment of the present invention;

[0020] Figure 2 This is a structural diagram of a phase-aware countermeasure defense model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0021] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0022] In view of the lack of application of the role of structural semantic information contained in images in adversarial defense in the existing technology, and considering that the phase information of an image can reflect the structural semantic features containing a large amount of information, the present invention provides a phase-aware anti-noise defense method, which achieves a more robust anti-noise defense method by making full use of the structural semantic features.

[0023] See Figures 1 and 2 As shown, Figure 1 This is a flow chart of a phase-aware anti-noise defense method provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of a phase-aware countermeasure defense model provided by an embodiment of the present invention. The present invention provides a phase-aware countermeasure noise defense method, including:

[0024] S101. Obtain a training sample set; wherein the training sample set includes multiple samples, and the same sample corresponds to the same category of targets.

[0025] Specifically, in this embodiment, a training sample set is obtained, the training sample set includes multiple samples, each sample includes a category of target, the training sample set includes samples of M categories of targets, each sample includes at least one image, and the training sample set includes N images in total, where M and N are both natural numbers greater than 0; it can be understood that the training sample set is used to train the phase-aware adversarial defense model.

[0026] In addition, in this embodiment, a test sample set needs to be obtained. The test sample set includes K test samples, where K is a natural number greater than 0. It can be understood that the test sample set is used to test the trained phase-aware countermeasure defense model.

[0027] S102: Obtain reference samples and initial adversarial samples based on the training sample set.

[0028] Specifically, in this embodiment, the training sample set is randomly shuffled and resampled to obtain a reference sample; an adversarial attack algorithm is used to obtain an initial adversarial sample corresponding to the training sample set; it should be noted that at least part of the training sample set for obtaining the reference sample is different from at least part of the training sample set for obtaining the initial adversarial sample.

[0029] S103. Construct a phase-aware adversarial defense model; wherein the phase-aware adversarial defense model includes a phase-level adversarial sample generation module and a phase-level adversarial training module.

[0030] For more details, please see Figure 2As shown, in this embodiment, it is necessary to first construct a phase-aware adversarial defense model, which includes a phase-level adversarial example crafting module and a phase-level adversarial training module. It should be noted that the phase-level adversarial sample generation module is a sample preprocessing module, and the phase-level adversarial training module is trained according to the output of the phase-level adversarial sample generation module.

[0031] S104: Input the initial adversarial sample and the reference sample into a phase-level adversarial sample generation module to generate a phase-level adversarial sample.

[0032] For more details, please see Figure 2 As shown, in this embodiment, the process of generating phase-level adversarial samples is as follows.

[0033] S1041. Perform style transfer on the initial adversarial sample based on the reference sample to obtain a transition reference sample.

[0034] It should be noted that converting the style of the reference sample into the style of the initial adversarial sample not only obtains an amplitude spectrum without perturbations, but also effectively reduces the interference information in the phase-level adversarial sample, effectively reducing the threat of amplitude spectrum perturbations to the robustness of the phase-aware adversarial defense model.

[0035] Specifically, the phase-level adversarial sample generation module includes a style transfer module, which is used to perform style transfer on the initial adversarial sample based on the reference sample to obtain a transition reference sample; wherein, the style transfer module includes an encoder, an AdaIN layer and a decoder. The encoder is composed of the first several layers of the pre-trained VGG-19 network. The structure of the decoder differs from that of the encoder in that the decoder uses nearest up-sampling, and the input and output of the decoder are reversed to those of the encoder. The decoder does not use any normalization layer to generate images of any style. Both the encoder and the decoder use reflection padding; it should be noted that the encoder is used to synthesize the feature maps corresponding to the content image and the style image; the AdaIN layer is used to align the mean and variance of the content image feature map and the style image feature map.

[0036] S1042. Use discrete Fourier transform to process the transition reference sample to obtain an amplitude spectrum feature sample.

[0037] S1043. Use discrete Fourier transform to process the initial adversarial sample to obtain a phase spectrum feature sample.

[0038] Specifically, in this embodiment, in order to effectively construct a phase-aware adversarial defense, reduce the threat of the amplitude level of the adversarial perturbation to the robust performance improvement of the phase-aware adversarial defense model in the test phase, a more optimal reference sample is constructed by a style transfer method, the amplitude spectrum of the reference sample is extracted, and the amplitude spectrum of the reference sample is combined with the phase spectrum of the initial adversarial sample for reconstruction; wherein, although the non-adversarial of the reference sample reduces the amplitude spectrum perturbation, it is very likely to introduce a large amount of interference information that is not conducive to classification due to its randomness. Research has found that the amplitude spectrum is closely related to the image style. In view of this, the embodiment introduces an image style transfer technology to convert the style of the reference sample to the style of the initial adversarial sample, which not only obtains the amplitude spectrum without perturbation, but also effectively reduces the interference information in the reconstructed sample, effectively reducing the threat of amplitude spectrum perturbation to the robustness of the model.

[0039] S1044, combine the amplitude spectrum feature sample and the phase spectrum feature sample, and process them using inverse discrete Fourier transform to obtain a phase-level adversarial sample; it should be noted that combining the amplitude spectrum feature sample and the phase spectrum feature sample and processing them using inverse discrete Fourier transform can reduce the threat of amplitude spectrum perturbation and reduce the interference information in the phase-level adversarial sample that is not conducive to classification.

[0040] It should be noted that in the above process, the initial adversarial sample image includes two-dimensional finite information, and the image signal in the pixel space can be converted into a frequency signal by Fourier transform and further decoupled into phase spectrum and amplitude spectrum information. In view of this, the embodiment uses discrete Fourier transform and inverse discrete Fourier transform to obtain a phase-level adversarial sample.

[0041] S105, input the training sample set and the phase-level adversarial sample into the phase-level adversarial training module, train the phase-level adversarial training module, and obtain a trained phase-level adversarial training module.

[0042] Specifically, please continue to refer to Figure 2 As shown in FIG. 11, in this embodiment, the phase-level adversarial training module includes a shared phase feature learning module and a phase perturbation adversarial sample classification learning module. In view of the close relationship between phase information and structural semantic information and the importance of phase information to classification, the phase perturbation adversarial sample classification learning module is designed to enhance the robustness of the phase-aware adversarial defense model to phase perturbation.

[0043] The shared phase feature learning module is used to output the feature distance of the phase-level adversarial sample and the training sample set, learn the key phase features that are not easily disturbed by adversarial noise, and measure the way in which the phase-level adversarial sample has key structural semantic features, that is, the closer the feature distance between the phase-level adversarial sample and the training sample set, the better. The phase perturbation adversarial sample classification learning module is used to output the classification result of the phase-level adversarial sample and correctly classify the adversarial sample.

[0044] In this embodiment, the shared phase feature learning module includes a target classification network, ResNet-18 or Wide-ResNet (WRN-28-10) is selected as the target classification network, and the output of the shared phase feature learning module is used to calculate the shared phase feature loss; the phase perturbation adversarial sample classification learning module includes a target classification network, ResNet-18 or Wide-ResNet (WRN-28-10) is selected as the target classification network, and the output of the phase perturbation adversarial sample classification learning module is used to calculate the adversarial training classification loss.

[0045] For more details, please see Figure 2 As shown, in this embodiment, the above process reduces the interference information in the phase-level adversarial samples that is not conducive to classification, and then achieves better defense against phase spectrum perturbations. The training process of the phase-level adversarial training module is referred to below.

[0046] S1051. The phase-level adversarial sample is first processed by the target classification network of the phase perturbation adversarial sample classification learning module, and the processed phase-level adversarial sample and the preset true label are then processed by the adversarial training classification loss function to obtain the first eigenvector.

[0047] S1052. Process the phase-level adversarial sample through the target classification network of the shared phase feature learning module to obtain the feature vector of the phase-level adversarial sample; process the training sample set through the target classification network of the shared phase feature learning module to obtain the feature vector of the training sample set; obtain the feature distance between the feature vector of the phase-level adversarial sample and the feature vector of the training sample set; process the feature distance through the shared phase feature loss function to obtain the second feature vector.

[0048] It is understandable that, considering that the phase information of an image contains rich structural semantic information, it helps humans recognize the content in the image; when the initial adversarial sample is generated, its phase information is inevitably destroyed by the attacker, but a considerable portion of the phase information still remains intact in the sample; the image content can still be correctly judged by the structural information of the object in the initial adversarial sample, which means that the remaining phase information that has not been destroyed in the initial adversarial sample is likely to be the key information for achieving classification defense. This embodiment outputs the phase-level adversarial sample and the label information of the corresponding training sample through the target network, and uses a specific distance metric to bring them closer, thereby learning the key phase features; unlike traditional adversarial training that only focuses on correct classification, the method used in this embodiment pays more attention to retaining key structural information for defense, thereby improving the model defense performance in a way that is more consistent with human cognition.

[0049] S1053. Perform a weighted summation on the first eigenvector and the second eigenvector to obtain a phase-level adversarial training loss function.

[0050] S1054. Use the batch gradient descent algorithm to process the phase-level adversarial training loss function to obtain the minimum value of the phase-level adversarial training loss function to update the parameters of the target classification network in the phase-level adversarial training module;

[0051] It should be noted that the batch gradient descent algorithm is used to minimize the phase-level adversarial training loss function value. At this time, the parameters of the updated phase-level adversarial training module are used to construct the trained phase-level adversarial training module, and the trained phase-level adversarial training module is directly used for adversarial defense.

[0052] Specifically, the expression of the phase-level adversarial training loss function Loss is:

[0053] Loss=Loss C +Loss S ;

[0054] Among them, Loss C For adversarial training classification loss function, Loss S is the shared phase feature loss function.

[0055] Adversarial training classification loss function Loss C The expression is:

[0056]

[0057]

[0058] Among them, N is the number of samples in the training sample set, x i ' is the i-th initial adversarial sample, is the reference sample corresponding to the i-th initial adversarial sample, is a phase-level adversarial sample, is the phase spectrum feature sample, is the amplitude spectrum feature sample, is the discrete Fourier transform, is the discrete inverse Fourier transform, Based on the reference sample For the initial adversarial sample x i 'Perform style transfer, h θ (·) is the target classification network, θ is the target classification network parameter, y i is the i-th initial adversarial sample x i 'The default true label, log(·) is the logarithmic function.

[0059] Loss S The expression is:

[0060]

[0061] Wherein, N is the sample quantity of the training sample set, x i is the i-th initial adversarial sample, is the reference sample corresponding to the i-th initial adversarial sample, is the phase-level adversarial sample, h θ (·) is the target classification network, and theta is the target classification network parameter, l d (·,·) is the distance measurement method, and optionally, the distance measurement method selects the KL divergence, x i is the i-th training sample.

[0062] It can be understood that, considering the significant threat of phase spectrum adversarial perturbation to model robustness, the embodiment proposes a phase-level adversarial training loss function to realize an adversarial training method for defending phase spectrum adversarial perturbation; in view of the fact that humans naturally ignore the tiny perturbation added in the image when judging the content of the adversarial sample, the judgment is made through structural information; and research shows that phase features can directly reflect structural information, and the destruction of phase information will significantly reduce the classification accuracy, fully illustrating that the phase-level perturbation will pose a serious threat to the defense means; in order to alleviate this threat, the embodiment proposes a phase-level adversarial training loss function, which makes the model fully focus on the phase-level adversarial sample through adversarial training, guides the model to prevent phase spectrum perturbation, and thus further improves the classification accuracy.

[0063] S1055, obtaining the trained phase-level adversarial training module according to the updated parameters of the target classification network in the phase-level adversarial training module.

[0064] S106, obtaining the classification result of the to-be-predicted sample according to the phase-level adversarial sample generation module and the trained phase-level adversarial training module, and realizing adversarial defense.

[0065] Specifically, in the embodiment, the to-be-predicted sample is first input into the phase-level adversarial sample generation module, and the phase-level adversarial sample is output, and then the trained phase-level adversarial training module is processed to output the classification result of the to-be-predicted sample.

[0066] In summary, among the existing adversarial defense methods, most only focus on the defense against original adversarial samples, without paying attention to the different importance of different types of information in the image for defense; although direct use of adversarial samples as defense objects has achieved certain defense effects, its robustness still needs to be improved due to the failure to fully utilize structural information for classification defense; a phase-aware anti-noise defense method provided in this embodiment can focus on defending against phase spectrum adversarial disturbances and effectively improve defense performance.

[0067] In the existing technology, most adversarial training methods aim to correctly classify adversarial samples. They can judge them through the residual structural features in the adversarial samples. This phase information that is difficult to be destroyed by noise is likely to be the key information for adversarial defense, but most existing methods ignore this point. In order to be able to mine the key structural features inside the adversarial samples that are not easily disturbed by noise and use them for adversarial training, the present invention provides a phase-aware based adversarial noise defense method, which sets a shared phase feature learning module to help the model learn and make full use of this feature by narrowing the feature distance between the phase-level adversarial samples and natural samples.

[0068] In an optional embodiment of the present invention, the method provided by the present invention is verified through simulation experiments.

[0069] As shown in Table 1, the robustness accuracy of the proposed method was tested against three classic adversarial training algorithms: AT, TRADES, and MART, on seven attacks. The results show that the proposed method significantly improves robustness against all seven attacks. For example, when defending against the STA attack on CIFAR10, the robustness accuracy of the proposed method significantly increases from less than 3% to 56.61% compared to other methods. Furthermore, as shown in Table 2, the proposed method simulates the robustness of the model against adaptive attacks. The proposed method is tested against two preprocessing-based defenses: APE-G and HGD, on three adaptive attacks. The results show that the proposed method exhibits greater robustness against adaptive attacks. For example, against the classic BPDA method, the proposed method achieves a 16.81% improvement in robustness over HGD and a 22.73% improvement over APE-G. By specifically constructing phase-level adversarial examples and incorporating them into adversarial training, the proposed method fully utilizes the structurally rich phase features, which are more robust. This results in a model that performs well against various attacks, including adaptive ones.

[0070] Table 1 Simulation table

[0071]

[0072]

[0073] Table 2 Simulation parameters

[0074]

[0075] Among them, AT seeks to correctly classify adversarial samples with perturbations within a certain range as much as possible, TRADES ensures natural accuracy while improving robustness, and MART improves model robustness by exploiting the phenomenon that incorrectly classified samples and correctly classified samples contribute inconsistently to robustness. These three methods all directly defend against the entire sample, without focusing on the feature information in the image that is more important for improving robustness. The present invention directly defends against phase perturbations, constructing adversarial samples containing only phase spectrum perturbations and inputting them into the classification model. Through adversarial training, the classification model is prompted to fully learn the structural features of the objects in the sample, thereby enhancing the model's attention to local information such as structural features.

[0076] Among them, HGD and APE-G are both based on pre-processing defense, that is, after the adversarial sample passes through these two methods, its noise is eliminated as much as possible, and then the sample is input into the classification model, thereby enhancing the robustness of the classification model; however, the pre-processing model is only used to remove adversarial noise, without considering its own robustness, so when it is attacked, the robustness of the model will be greatly damaged. The present invention directly starts with phase-level adversarial training for defense. During the training process, the model continuously learns how to defend against phase-level perturbations, thereby continuously improving the robustness of the model. This enables the present invention to more accurately grasp the structural information in the image when facing adaptive attacks against the model, significantly reducing the threat posed by adaptive attacks to the model.

[0077] In summary, the above-mentioned preprocessing methods and adversarial training algorithms all utilize the feature information of adversarial samples from different perspectives, but ignore the fact that adversarial samples still contain features that are difficult to be destroyed by adversarial noise and the importance of such features for improving robustness. The present invention constructs a shared phase feature learning module. First, a phase-level adversarial sample is constructed. This sample is then input into the target network together with the corresponding natural sample. During the training process, the output feature distance between the two is calculated and continuously reduced, thereby prompting the model to learn structural semantic features that are difficult to be destroyed by adversarial perturbations during the adversarial training process, further enhancing the model's attention to structural features.

[0078] It should be noted that, in this document, relational terms such as first and second are used solely to distinguish one entity or operation from another, and do not necessarily require or imply any actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not explicitly listed. Without further limitation, an element defined by the phrase "comprising a..." does not preclude the presence of additional identical elements in the article or device comprising the element. Terms such as "connected" or "connected" are not limited to physical or mechanical connections but may include electrical connections, whether direct or indirect. References to orientations or positional relationships, such as "upper," "lower," "left," and "right," are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate description and simplify the description of the present invention. They do not indicate or imply that the device or element referred to must have, be constructed, or operate in a specific orientation, and are therefore not to be construed as limiting the present invention.

[0079] In the description of this specification, the reference terms "one embodiment," "some embodiments," "example," "specific example," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0080] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A phase-aware anti-noise defense method, characterized in that: include: Obtaining a training sample set; wherein the training sample set includes multiple samples, the same sample corresponds to the same category of target, and each sample includes at least one image; Obtaining reference samples and initial adversarial samples based on the training sample set; Constructing a phase-aware adversarial defense model; wherein the phase-aware adversarial defense model includes a phase-level adversarial sample generation module and a phase-level adversarial training module; Inputting the initial adversarial sample and the reference sample into the phase-level adversarial sample generation module to generate a phase-level adversarial sample; Inputting the training sample set and the phase-level adversarial sample into the phase-level adversarial training module, training the phase-level adversarial training module, and obtaining a trained phase-level adversarial training module; According to the phase-level adversarial sample generation module and the trained phase-level adversarial training module, a classification result of the sample to be predicted is obtained to achieve adversarial defense; The phase-level adversarial training module includes a shared phase feature learning module and a phase perturbation adversarial sample classification learning module, and both the shared phase feature learning module and the phase perturbation adversarial sample classification learning module include a target classification network; wherein the shared phase feature learning module is used to output the feature distance between the phase-level adversarial sample and the training sample set, and the phase perturbation adversarial sample classification learning module is used to output the classification result of the phase-level adversarial sample; The training process of the phase-level adversarial training module includes: The phase-level adversarial sample is first processed by the target classification network of the phase perturbation adversarial sample classification learning module, and the processed phase-level adversarial sample and the preset true label are then processed by the adversarial training classification loss function to obtain a first eigenvector; Processing the phase-level adversarial sample through the target classification network of the shared phase feature learning module to obtain a feature vector of the phase-level adversarial sample; processing the training sample set through the target classification network of the shared phase feature learning module to obtain a feature vector of the training sample set; obtaining a feature distance between the feature vector of the phase-level adversarial sample and the feature vector of the training sample set; processing the feature distance through a shared phase feature loss function to obtain a second feature vector; Performing a weighted summation on the first eigenvector and the second eigenvector to obtain a phase-level adversarial training loss function; Using a batch gradient descent algorithm to process the phase-level adversarial training loss function, obtaining a minimum value of the phase-level adversarial training loss function to update the parameters of the target classification network in the phase-level adversarial training module; According to the updated parameters of the target classification network in the phase-level adversarial training module, the trained phase-level adversarial training module is obtained.

2. The phase-aware anti-noise defense method according to claim 1, characterized in that: The process of obtaining the reference sample includes: The training sample set is randomly shuffled and resampled to obtain reference samples.

3. The phase-aware anti-noise defense method according to claim 1, characterized in that: The process of obtaining the initial adversarial sample includes: An adversarial attack algorithm is used to obtain the initial adversarial sample corresponding to the training sample set.

4. The phase-aware anti-noise defense method according to claim 1, characterized in that: The generation process of the phase-level adversarial sample includes: Performing style transfer on the initial adversarial sample according to the reference sample to obtain a transition reference sample; Processing the transition reference sample using discrete Fourier transform to obtain an amplitude spectrum feature sample; Processing the initial adversarial sample using discrete Fourier transform to obtain a phase spectrum feature sample; The amplitude spectrum feature samples and the phase spectrum feature samples are combined and processed using an inverse discrete Fourier transform to obtain the phase-level adversarial samples.

5. The phase-aware anti-noise defense method according to claim 1, characterized in that: The phase-level adversarial training loss function The expression is: ； in, is the adversarial training classification loss function, is the shared phase feature loss function.

6. The phase-aware anti-noise defense method according to claim 5, characterized in that: The adversarial training classification loss function The expression is: ； ； in, is the number of samples in the training sample set, For the Initial adversarial examples, For the reference samples corresponding to the initial adversarial samples, is a phase-level adversarial sample, is the phase spectrum feature sample, is the amplitude spectrum feature sample, is the discrete Fourier transform, is the discrete inverse Fourier transform, According to the reference sample For the initial adversarial sample Perform style transfer, For target classification network, is the target classification network parameter, For the said Initial adversarial examples The default true label, is a logarithmic function.

7. The phase-aware anti-noise defense method according to claim 5, characterized in that: The shared phase feature loss function The expression is: ； in, is the number of samples in the training sample set, For the Initial adversarial examples, For the reference samples corresponding to the initial adversarial samples, is a phase-level adversarial sample, For target classification network, is the target classification network parameter, is the distance metric, For the said training samples.

8. The phase-aware anti-noise defense method according to claim 1, characterized in that: Also includes: A test sample set is obtained, and the phase-aware countermeasure defense model is tested using the test sample set.

Images