Training method and device of image classification network, computer device and storage medium

Abstract

The application relates to a training method and device of an image classification network, a computer device and a storage medium. The application relates to the technical field of image processing and artificial intelligence. The method comprises the following steps: acquiring adversarial samples corresponding to a plurality of attack algorithms, and calculating image classification results of the image classification network corresponding to each attack algorithm; based on the classification success rate in the image classification results, an initial target attack algorithm is screened from the attack algorithms, and the attack parameter of the initial target attack algorithm is adjusted; based on the adjusted initial target attack algorithm, the image classification network is attacked to obtain new image classification results of the image classification network, and the evaluation value of the image classification network is evaluated through a network evaluation function; the initial target attack algorithm is trained through the evaluation value to obtain a target attack algorithm, and the image classification network is trained through the target attack algorithm to obtain a target image classification network. The method can improve the defense effect of the trained deep learning neural network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of image processing and artificial intelligence, and particularly relates to a training method and device of an image classification network, a computer device, a storage medium and a computer program product. BACKGROUND

[0002] With the development of deep learning neural networks for image classification, the deep neural network for image classification is vulnerable to attacks of adversarial samples. The adversarial samples are usually carefully designed tiny modifications added to pictures, which leads to incorrect image classification results output by the deep neural network. Therefore, how to improve the defense effect of the deep learning neural network against adversarial samples is the current research focus.

[0003] At present, the traditional method is to attack the deep learning neural network by a large number of adversarial sample simulations, so as to improve the defense effect of the deep learning neural network against adversarial samples. However, the traditional method is based on different adversarial samples to train the deep learning neural network, and cannot directly train the defense weaknesses of different deep learning neural networks, so that the defense effect of the trained deep learning neural network is poor. SUMMARY

[0004] Therefore, it is necessary to provide a training method and device of an image classification network, a computer device, a computer readable storage medium and a computer program product in view of the above technical problems.

[0005] In a first aspect, the present application provides a training method of an image classification network. The method comprises:

[0006] obtaining adversarial samples corresponding to a plurality of attack algorithms, and inputting the adversarial samples of each attack algorithm into an image classification network to obtain image classification results of the image classification network;

[0007] based on a classification success rate in the image classification results, screening an initial target attack algorithm from the attack algorithms, and adjusting attack parameters of the initial target attack algorithm;

[0008] attacking the image classification network based on the adjusted initial target attack algorithm to obtain new image classification results of the image classification network, and evaluating an evaluation value of the image classification network through a network evaluation function;

[0009] In a case that the evaluation value is lower than a preset evaluation threshold, a step of adjusting an attack parameter of the initial target attack algorithm is returned to be executed until the evaluation value is higher than the preset evaluation threshold, the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold is taken as a target attack algorithm, and the image classification network is trained by using the target attack algorithm to obtain a target image classification network.

[0010] Optionally, the obtaining of the adversarial sample corresponding to each attack algorithm includes:

[0011] For each attack algorithm, the image classification network is subjected to a simulation attack based on the attack algorithm to obtain an interfered image classification network, and the adversarial sample corresponding to the attack algorithm is generated based on the interfered image classification network.

[0012] Optionally, the screening of the initial target attack algorithm from the attack algorithms based on the classification success rate in the image classification result includes:

[0013] The classification success rate of the image classification network is obtained by analyzing a correct classification number of the image classification result based on the image classification result of the image classification network.

[0014] The attack algorithm corresponding to the image classification network with the lowest classification success rate is screened as the initial target attack algorithm from the attack algorithms.

[0015] Optionally, the adjusting of the attack parameter of the initial target attack algorithm includes:

[0016] A current gradient step length of the image classification network attacked by the initial target attack algorithm is identified, and a correlation between the current gradient step length and the attack parameter of the initial target attack algorithm is identified.

[0017] The change information of the attack parameter when a unit gradient step length is added under the current gradient step length is calculated, the attack parameter is updated based on the change information to obtain a first attack parameter, and the initial target attack algorithm containing the first attack parameter is taken as an adjusted initial target attack algorithm.

[0018] Optionally, the attack on the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network includes:

[0019] The new adversarial sample corresponding to the adjusted initial target attack algorithm is obtained by using the image classification network based on the adjusted initial target attack algorithm, and the new adversarial sample is input into the image classification network to obtain the new image classification result of the image classification network.

[0020] Optionally, before the step of returning to adjust the attack parameter of the initial target attack algorithm, the method further comprises:

[0021] Based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, the difference information between the classification success rate and the new classification success rate is calculated, and based on the difference information, the change information of the initial target attack algorithm is adjusted to obtain new change information.

[0022] Based on the new change information, the first attack parameter of the adjusted initial target attack algorithm is adjusted to obtain the second attack parameter of the adjusted initial target attack algorithm, and the first attack parameter of the adjusted initial target attack algorithm is adjusted to the second attack parameter.

[0023] In a second aspect, the present application also provides a device for training an image classification network. The device comprises:

[0024] An acquisition module is configured to acquire a plurality of attack algorithms corresponding to adversarial samples, and for each attack algorithm, input the adversarial samples of the attack algorithm into an image classification network to obtain an image classification result of the image classification network.

[0025] A screening module is configured to screen an initial target attack algorithm from the attack algorithms based on the classification success rate in the image classification result, and adjust the attack parameter of the initial target attack algorithm.

[0026] An evaluation module is configured to attack the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network, and evaluate the evaluation value of the image classification network through a network evaluation function.

[0027] A training module is configured to return to the step of adjusting the attack parameter of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold value, and when the evaluation value is higher than the preset evaluation threshold value, the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold value is taken as a target attack algorithm, and the image classification network is trained through the target attack algorithm to obtain a target image classification network.

[0028] Optionally, the acquisition module is specifically configured to:

[0029] For each attack algorithm, the image classification network is subjected to a simulation attack based on the attack algorithm to obtain an interfered image classification network, and the adversarial samples corresponding to the attack algorithm are generated based on the interfered image classification network.

[0030] Optionally, the screening module is specifically used for:

[0031] Based on the image classification result of the image classification network, analyzing the correct classification number of the image classification result to obtain a classification success rate of the image classification network.

[0032] Among the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate is selected as an initial target attack algorithm.

[0033] Optionally, the screening module is specifically used for:

[0034] Identifying a current gradient step length of the image classification network attacked by the initial target attack algorithm, and identifying the association between the current gradient step length and the attack parameters of the initial target attack algorithm.

[0035] Calculating the change information of the attack parameters when a unit gradient step length is added under the current gradient step length, and updating the attack parameters based on the change information to obtain first attack parameters.

[0036] Optionally, the evaluation module is specifically used for:

[0037] Based on the adjusted initial target attack algorithm, obtaining a new adversarial sample corresponding to the adjusted initial target attack algorithm through the image classification network, and inputting the new adversarial sample into the image classification network to obtain a new image classification result of the image classification network.

[0038] Optionally, the device further comprises:

[0039] A calculation module is configured to calculate difference information between the classification success rate of the image classification network corresponding to the initial target attack algorithm and a new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm based on the classification success rate and the new classification success rate, and adjust the change information of the initial target attack algorithm based on the difference information to obtain new change information.

[0040] An adjustment module is configured to adjust the first attack parameters of the adjusted initial target attack algorithm based on the new change information to obtain second attack parameters of the adjusted initial target attack algorithm, and adjust the first attack parameters of the adjusted initial target attack algorithm to the second attack parameters.

[0041] In a third aspect, the present application also provides a computer device. The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the steps of the method in any one of the first aspect when executing the computer program.

[0042] In a fourth aspect, the present application also provides a computer readable storage medium. The computer readable storage medium stores a computer program, and the computer program implements the steps of the method in any one of the first aspect when executed by a processor.

[0043] In a fifth aspect, the present application also provides a computer program product. The computer program product comprises a computer program, and the computer program implements the steps of the method in any one of the first aspect when executed by a processor.

[0044] The training method and device of the image classification network, the computer device and the storage medium described above, by obtaining the adversarial samples corresponding to a plurality of attack algorithms, and for each attack algorithm, inputting the adversarial samples of the attack algorithm into the image classification network to obtain the image classification result of the image classification network; based on the classification success rate in the image classification result, screening the initial target attack algorithm from the attack algorithms, and adjusting the attack parameters of the initial target attack algorithm; based on the adjusted initial target attack algorithm, attacking the image classification network to obtain a new image classification result of the image classification network, and evaluating the evaluation value of the image classification network through a network evaluation function; in the case that the evaluation value is lower than a preset evaluation threshold, returning to execute the step of adjusting the attack parameters of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, the image classification network corresponding to the adjusted initial target attack algorithm with the evaluation value higher than the evaluation threshold is taken as the target attack algorithm, and the image classification network is trained through the target attack algorithm to obtain a target image classification network. By attacking the image classification network through each attack algorithm respectively, the classification success rate of the image classification network is obtained to screen the initial target attack algorithm, and the attack parameters of the initial target attack algorithm are adjusted, so that the attack effect of the initial target attack algorithm on the image classification network reaches the best, the target attack algorithm is obtained, and thus the most suitable optimized target attack algorithm for training the defense weakness of the image classification network is found, and the defense effect of the trained deep learning neural network is improved. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart of the training method of the image classification network in one embodiment;

[0046] Figure 2 A flowchart of the training example of the image classification network in one embodiment;

[0047] Figure 3 A structural block diagram of a training device of an image classification network in an embodiment;

[0048] Figure 4 An internal structure diagram of a computer device in an embodiment. DETAILED DESCRIPTION

[0049] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not intended to limit the present application.

[0050] The training method of the image classification network provided by the embodiment of the present application can be applied to a terminal, a server, or a system including a terminal and a server, and is realized through the interaction of the terminal and the server. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, etc. The server can be realized by an independent server or a server cluster composed of multiple servers. The terminal attacks the image classification network by each attack algorithm respectively to obtain the classification success rate of the image classification network, screens an initial target attack algorithm, adjusts the attack parameters of the initial target attack algorithm, so that the attack effect of the initial target attack algorithm on the image classification network reaches the best, obtains a target attack algorithm, and thus finds the optimized target attack algorithm that is most suitable for training the defense weakness of the image classification network, thereby improving the defense effect of the trained deep learning neural network.

[0051] In one embodiment, as shown in Figure 1 A training method of an image classification network is provided, and the method is described by taking the terminal as an example, which includes the following steps:

[0052] In step S101, a plurality of attack algorithms corresponding to the adversarial samples are obtained, and for each attack algorithm, the adversarial samples of the attack algorithm are input into the image classification network to obtain the image classification result of the image classification network.

[0053] In this embodiment, the terminal generates, through each attack algorithm, an adversarial sample corresponding to the attack algorithm in the image classification network. Then the terminal acquires the classification network to be trained as the image classification network in response to the network training operation of the user. The attack algorithm is an attack algorithm for disturbing the image classification network to cause the classification information of the image classification network to deviate, for example, a fast gradient sign method (Fast Gradient Sign Method, FSGM). The image classification network is a reinforcement learning neural network for image recognition and classification labeling, for example, an Inception V3 neural network, an Inception V4 neural network, an Inception Resnet V2 neural network, and a Resnet V2 101, etc. The terminal inputs the adversarial sample of each attack algorithm into the image classification network performing the image classification task to obtain the image classification result of the image classification network. The image classification result contains the classification information of each image corresponding to the image classification task. The specific process of obtaining the adversarial sample will be described in detail later. The adversarial sample is interference information of the image classification network generated by the attack algorithm based on the image classification network. The interference information can be, but is not limited to, various types of image noise information, interference information for modifying the image size, and interference information for modifying the image pixel points, etc. The image classification network is used to identify the image type of each image and classify the image type. For example, the terminal inputs an animal image into the image classification network, and the image classification network can divide the animal image into the category of the animal corresponding to the animal image. The image classification result is the category of the animal.

[0054] In step S102, based on the classification success rate in the image classification result, the initial target attack algorithm is screened from the attack algorithms, and the attack parameter of the initial target attack algorithm is adjusted.

[0055] In this embodiment, the terminal identifies whether the classification information of each image is correct through a preset classification identification strategy, and takes the ratio of the number of correctly classified images to the number of all images as the classification success rate of the image classification result. Then the terminal screens the attack algorithm corresponding to the image classification network with the lowest classification success rate from each attack algorithm as the initial target attack algorithm. The terminal adjusts the attack parameter of the initial target attack algorithm based on the image classification network. The adjustment of the attack parameter of the initial target attack algorithm is used to improve the attack effect of the initial attack algorithm on the image classification network. The specific adjustment process will be described in detail later. The identification process of the classification identification strategy will be described in detail later.

[0056] Step S103, based on the adjusted initial target attack algorithm, attack the image classification network to obtain a new image classification result of the image classification network, and evaluate the evaluation value of the image classification network through the network evaluation function.

[0057] In this embodiment, the terminal re-acquires the attack samples of the initial target attack algorithm based on the adjusted initial target attack algorithm, and performs step S101 to obtain the new image classification result of the image classification network. Then, the terminal evaluates the evaluation value of the new image classification result of the image classification network through the network evaluation function. The network evaluation function can be, but is not limited to, Tenengrad evaluation function, Laplacian gradient function, Energy of Gradient (EOG), and Roberts function.

[0058] Step S104, in the case where the evaluation value is lower than the preset evaluation threshold, return to perform the step of adjusting the attack parameters of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, and the image classification network corresponding to the adjusted initial target attack algorithm with the evaluation value higher than the evaluation threshold is taken as the target attack algorithm, and the image classification network is trained through the target attack algorithm to obtain a target image classification network.

[0059] In this embodiment, the terminal presets the evaluation threshold, and returns to perform step S102 in the case where the evaluation value is lower than the preset evaluation threshold, and stops the iteration process when the evaluation value is higher than the preset evaluation threshold. Then, the terminal takes the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold as the target attack algorithm. Finally, the terminal trains the defense capability of the image classification network through the target attack algorithm to obtain a target image classification network.

[0060] Based on the above scheme, the classification success rate of the image classification network is obtained by respectively attacking the image classification network through each attack algorithm to screen the initial target attack algorithm, adjust the attack parameters of the initial target attack algorithm, so that the attack effect of the initial target attack algorithm on the image classification network reaches the best, and obtain the target attack algorithm, so as to find the optimized target attack algorithm most suitable for training the defense weakness of the image classification network, and improve the defense effect of the trained deep learning neural network.

[0061] Optionally, the plurality of attack algorithms correspond to a plurality of attack samples.

[0062] For each attack algorithm, based on the attack algorithm, the image classification network is simulated and attacked to obtain an interfered image classification network, and the attack sample corresponding to the attack algorithm is generated based on the interfered image classification network.

[0063] In this embodiment, the terminal performs simulation attack processing on the image classification network based on the attack algorithm for each attack algorithm to obtain an interfered image classification network. Then, the terminal generates the adversarial sample corresponding to the attack algorithm based on the interfered image classification network.

[0064] For example, the terminal disturbs the Inception V3 neural network by using the Fast Gradient Sign Method (FSGM) so that the Inception V3 neural network generates the adversarial sample.

[0065] Specifically, the basic idea of the FGSM adversarial sample generation strategy is to keep the change amount of the adversarial disturbance consistent with the change amount of the loss gradient of the image classification network. θ is the parameter of the image classification network, x is the input of the image classification network, y is the correct category corresponding to the input x, and the loss function of the image classification network is The gradient of the loss function with respect to x is The principle of FGSM is:

[0066]

[0067] Here, α is a hyperparameter representing the step size of the next gradient of the image classification network, and sign(.) is a sign function, so the adversarial disturbance obtained by this method is under the constraint of the l∞ norm.

[0068] Based on the above scheme, the terminal generates an adversarial sample in the image neural network by using an attack algorithm, so that the interference effect of the adversarial sample on the image neural network is more obvious, and the accuracy of subsequent screening of the initial target attack algorithm is improved.

[0069] Optionally, based on the classification success rate in the image classification result, the initial target attack algorithm is screened from the attack algorithms, including: based on the image classification result of the image classification network, analyzing the correct classification number of the image classification result to obtain the classification success rate of the image classification network; and screening, from the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate as the initial target attack algorithm.

[0070] In this embodiment, the terminal predefines the correct classification information of each image, then identifies the classification information of each image in the image classification result of the image classification network, and judges whether the normal classification information and the classification information of the same image are the same. Then, the terminal takes the proportion of the number of the same normal classification information and classification information of the same image to the number of all images as the classification success rate of the image classification network. Then, the terminal screens, from the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate as the initial target attack algorithm.

[0071] Based on the above scheme, the attack algorithm is screened by classification success rate, and the accuracy of screening the attack algorithm is improved.

[0072] Optionally, the attack parameter of the initial target attack algorithm is adjusted, including: identifying the current gradient step of the image classification network attacked by the initial target attack algorithm, and identifying the correlation between the current gradient step and the attack parameter of the initial target attack algorithm; calculating the change information of the attack parameter when a unit gradient step is added under the current gradient step, and updating the attack parameter based on the change information to obtain a first attack parameter, and taking the initial target attack algorithm containing the first attack parameter as the adjusted initial target attack algorithm.

[0073] In this embodiment, the terminal obtains the current gradient step of the image classification network by querying the parameter information of the image classification network attacked by the initial target attack algorithm. Then the terminal determines the correlation between the current gradient step of the image classification network and the attack parameter of the initial target attack algorithm based on the loss function of the image classification network.

[0074] Specifically, in the case that the gradient change mode of the loss function of the image classification network is linear, the terminal directly establishes the correlation between the current gradient step of the image classification network and the attack parameter of the initial target attack algorithm based on the loss function, and in the case that the gradient change mode of the loss function of the image classification network is nonlinear, the terminal determines the correlation between the current gradient step of the image classification network and the attack parameter of the initial target attack algorithm by establishing the correlation function between the loss function of the image classification network and the initial target attack algorithm.

[0075] For example, in the case that the gradient change mode of the loss function of the image classification network is nonlinear, the terminal establishes the correlation function between the loss function of the image classification network and the attack algorithm based on the loss function of the Inception V3 neural network and the FGSM attack algorithm, and the specific function formula is as follows:

[0076]

[0077] Wherein, is the adversarial sample data obtained by the attack algorithm after the i th adjustment, α is a parameter, represents the average change rate of each step gradient when iteration is performed, and Clip(.) principle is to set the variable greater than the maximum value to the maximum value and the variable less than the minimum value to the minimum value, which can set x A It is limited within a specified range, so as to improve the attack effect of the initial target attack algorithm and reduce the classification success rate of the image classification network.

[0078] The terminal calculates change information of the attack parameter when a unit gradient step is added under the current gradient step of the image classification network based on the association between the current gradient step of the image classification network and the attack parameter of the initial target attack algorithm. Then, the terminal determines a first attack parameter of the initial target attack algorithm based on the attack parameter of the initial target attack algorithm and the change information of the attack parameter. Finally, the terminal takes the initial target attack algorithm containing the first attack parameter as the adjusted initial target attack algorithm. The adjustment manner can be, but is not limited to, iterative optimization of the initial target attack algorithm.

[0079] Based on the above scheme, the terminal determines the change information of the attack parameter of the initial target attack algorithm based on the association between the current gradient step of the image classification network and the attack parameter of the initial target attack algorithm, thereby adjusting the attack parameter of the initial target attack algorithm, improving the attack effect of the initial target attack algorithm, and reducing the classification success rate of the image classification network.

[0080] Optionally, based on the adjusted initial target attack algorithm, the image classification network is attacked to obtain a new image classification result of the image classification network, including:

[0081] Based on the adjusted initial target attack algorithm, a new adversarial sample corresponding to the adjusted initial target attack algorithm is obtained through the image classification network, and the new adversarial sample is input into the image classification network to obtain a new image classification result of the image classification network.

[0082] In this embodiment, the terminal obtains a new adversarial sample corresponding to the adjusted initial target attack algorithm based on the image classification network based on the adjusted initial target attack algorithm through the manner of step S102. Then, the terminal inputs the new adversarial sample into the image classification network to obtain a new image classification result of the image classification network.

[0083] Based on the above scheme, the new adversarial sample is obtained to obtain the new image classification result, which ensures that the obtained image classification result can identify the attack effect of the adjusted initial target attack algorithm on the image classification network.

[0084] Optionally, before returning to the step of adjusting the attack parameter of the initial target attack algorithm, the method further comprises: calculating difference information between the classification success rate and the new classification success rate based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, and adjusting the change information of the initial target attack algorithm based on the difference information to obtain new change information; and adjusting the first attack parameter of the adjusted initial target attack algorithm based on the new change information to obtain a second attack parameter of the adjusted initial target attack algorithm, and adjusting the first attack parameter of the adjusted initial target attack algorithm to the second attack parameter.

[0085] In this embodiment, the terminal calculates difference information between the classification success rate and the new classification success rate based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm. The difference information includes a positive difference and a negative difference. In the case of the positive difference, the terminal determines that the change information of the initial target attack algorithm is correct, and directly takes the first attack parameter of the initial target attack algorithm as the second attack parameter of the initial target attack algorithm. In the case of the negative difference, the terminal determines that the change information of the initial target attack algorithm is incorrect. Then the terminal returns to the step of adjusting the attack parameter of the initial target attack algorithm based on the difference information to adjust the change information of the initial target attack algorithm to obtain new change information. Then the terminal adjusts the first attack parameter of the adjusted initial target attack algorithm based on the new change information to obtain a second attack parameter of the adjusted initial target attack algorithm. Finally, the terminal adjusts the first attack parameter of the adjusted initial target attack algorithm to the second attack parameter.

[0086] Based on the above scheme, the change information of the initial target attack algorithm is adjusted through the difference information between the classification success rate and the new classification success rate, so as to ensure that the attack efficiency of the initial target attack algorithm gradually increases with the increase of the iteration number, and the optimization efficiency of the initial target attack algorithm is further improved.

[0087] In one embodiment, as shown in Figure 2 a training example of an image classification network is provided, which includes the following steps:

[0088] Step S201, for each attack algorithm, based on the attack algorithm, the image classification network is simulated and attacked to obtain an interfered image classification network, and the attack algorithm corresponding to the adversarial sample is generated based on the interfered image classification network.

[0089] Step S202, for each attack algorithm, the adversarial sample of the attack algorithm is input into the image classification network to obtain the image classification result of the image classification network.

[0090] Step S203, based on the image classification result of the image classification network, analyzing the correct classification number of the image classification result, obtaining the classification success rate of the image classification network.

[0091] Step S204, in each attack algorithm, the attack algorithm corresponding to the image classification network with the lowest classification success rate is selected as the initial target attack algorithm.

[0092] Step S205, identifying the current gradient step of the image classification network attacked by the initial target attack algorithm, and identifying the association between the current gradient step and the attack parameters of the initial target attack algorithm.

[0093] Step S206, calculating the change information of the attack parameters when adding a unit gradient step under the current gradient step, and updating the attack parameters based on the change information, obtaining the first attack parameters, and taking the initial target attack algorithm containing the first attack parameters as the adjusted initial target attack algorithm.

[0094] Step S207, based on the adjusted initial target attack algorithm, obtaining the new adversarial sample corresponding to the adjusted initial target attack algorithm through the image classification network, and inputting the new adversarial sample into the image classification network to obtain the new image classification result of the image classification network.

[0095] Step S208, based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, calculating the difference information of the classification success rate and the new classification success rate, and adjusting the change information of the initial target attack algorithm based on the difference information, obtaining new change information.

[0096] Step S209, based on the new change information, adjusting the first attack parameters of the adjusted initial target attack algorithm to obtain the second attack parameters of the adjusted initial target attack algorithm, and adjusting the first attack parameters of the adjusted initial target attack algorithm to the second attack parameters.

[0097] Step S210, in the case where the evaluation value is lower than the preset evaluation threshold, returning to execute the step of adjusting the attack parameters of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, taking the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold as the target attack algorithm, and training the image classification network through the target attack algorithm to obtain the target image classification network.

[0098] It should be understood that although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless explicitly stated herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or steps or stages in other steps.

[0099] Based on the same inventive concept, the embodiments of the present application also provide a training device of an image classification network for implementing the training method of the image classification network as described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more image classification network training device embodiments provided below can refer to the limitations of the image classification network training method in the above text, which will not be repeated here.

[0100] In one embodiment, as shown in Figure 3 An image classification network training device is provided, comprising: an acquisition module 310, a screening module 320, an evaluation module 330 and a training module 340, wherein:

[0101] The acquisition module 310 is configured to acquire adversarial samples corresponding to a plurality of attack algorithms, and input the adversarial samples of each attack algorithm into an image classification network to obtain an image classification result of the image classification network.

[0102] The screening module 320 is configured to screen an initial target attack algorithm from the attack algorithms based on a classification success rate in the image classification result, and adjust attack parameters of the initial target attack algorithm.

[0103] The evaluation module 330 is configured to attack the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network, and evaluate an evaluation value of the image classification network through a network evaluation function.

[0104] The training module 340 is configured to: in a case where the evaluation value is lower than the preset evaluation threshold, return to perform an attack parameter step of adjusting the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold; and in a case where the evaluation value is higher than the preset evaluation threshold, classify the image classification network corresponding to the initial target attack algorithm as a target attack algorithm, and train the image classification network by using the target attack algorithm to obtain a target image classification network.

[0105] Optionally, the obtaining module 310 is specifically configured to:

[0106] For each attack algorithm, the image classification network is subjected to simulation attack processing based on the attack algorithm to obtain an interfered image classification network, and the attack algorithm corresponding to the interfered image classification network is generated as a corresponding adversarial sample.

[0107] Optionally, the screening module 320 is specifically configured to:

[0108] Based on the image classification result of the image classification network, the number of correct classifications of the image classification result is analyzed to obtain a classification success rate of the image classification network.

[0109] Among the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate is screened as an initial target attack algorithm.

[0110] Optionally, the screening module 320 is specifically configured to:

[0111] The current gradient step length of the image classification network attacked by the initial target attack algorithm is identified, and a correlation between the current gradient step length and the attack parameter of the initial target attack algorithm is identified.

[0112] The change information of the attack parameter when a unit gradient step length is added to the current gradient step length is calculated, the attack parameter is updated based on the change information to obtain a first attack parameter, and the initial target attack algorithm containing the first attack parameter is taken as an adjusted initial target attack algorithm.

[0113] Optionally, the evaluation module 330 is specifically configured to:

[0114] Based on the adjusted initial target attack algorithm, a new adversarial sample corresponding to the adjusted initial target attack algorithm is obtained by using the image classification network, and the new adversarial sample is input into the image classification network to obtain a new image classification result of the image classification network.

[0115] Optionally, the apparatus further includes:

[0116] The calculation module is used to calculate the difference between the classification success rate and the new classification success rate based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, and to adjust the change information of the initial target attack algorithm based on the difference information to obtain new change information.

[0117] An adjustment module is used to adjust the first attack parameters of the adjusted initial target attack algorithm based on the new change information, to obtain the second attack parameters of the adjusted initial target attack algorithm, and to adjust the first attack parameters of the adjusted initial target attack algorithm to the second attack parameters.

[0118] Each module in the training device of the aforementioned image classification network can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0119] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 4 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a training method for an image classification network. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0120] Those skilled in the art will understand that Figure 4 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0121] In one embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program:

[0122] obtaining a plurality of attack algorithms corresponding to the adversarial samples, and for each attack algorithm, inputting the adversarial samples of the attack algorithm into the image classification network to obtain an image classification result of the image classification network;

[0123] based on the classification success rate in the image classification result, screening an initial target attack algorithm from the attack algorithms, and adjusting the attack parameters of the initial target attack algorithm;

[0124] based on the adjusted initial target attack algorithm, attacking the image classification network to obtain a new image classification result of the image classification network, and evaluating the evaluation value of the image classification network through a network evaluation function;

[0125] in the case where the evaluation value is lower than a preset evaluation threshold, returning to the step of adjusting the attack parameters of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, taking the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold as a target attack algorithm, and training the image classification network through the target attack algorithm to obtain a target image classification network.

[0126] Optionally, the obtaining of the adversarial samples corresponding to the plurality of attack algorithms comprises:

[0127] for each attack algorithm, based on the attack algorithm, performing a simulation attack processing on the image classification network to obtain an interfered image classification network, and generating the adversarial samples corresponding to the attack algorithm based on the interfered image classification network.

[0128] Optionally, the screening of the initial target attack algorithm from the attack algorithms based on the classification success rate in the image classification result comprises:

[0129] based on the image classification result of the image classification network, analyzing the number of correct classifications of the image classification result to obtain the classification success rate of the image classification network;

[0130] screening, from the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate as the initial target attack algorithm.

[0131] Optionally, the adjusting of the attack parameters of the initial target attack algorithm comprises:

[0132] Identify the current gradient step size of the image classification network attacked by the initial target attack algorithm, and identify the correlation between the current gradient step size and the attack parameters of the initial target attack algorithm;

[0133] Calculate the change information of the attack parameters when adding a unit gradient step size under the current gradient step size, and update the attack parameters based on the change information to obtain the first attack parameters. Use the initial target attack algorithm containing the first attack parameters as the adjusted initial target attack algorithm.

[0134] Optionally, the step of attacking the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result for the image classification network includes:

[0135] Based on the adjusted initial target attack algorithm, the image classification network obtains new adversarial samples corresponding to the adjusted initial target attack algorithm, and inputs the new adversarial samples into the image classification network to obtain the new image classification result of the image classification network.

[0136] Optionally, before the step of returning to perform the attack parameter adjustment of the initial target attack algorithm, the method further includes:

[0137] Based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, the difference between the classification success rate and the new classification success rate is calculated, and based on the difference, the change information of the initial target attack algorithm is adjusted to obtain the new change information.

[0138] Based on the new change information, the first attack parameter of the adjusted initial target attack algorithm is adjusted to obtain the second attack parameter of the adjusted initial target attack algorithm, and the first attack parameter of the adjusted initial target attack algorithm is adjusted to the second attack parameter.

[0139] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0140] Multiple adversarial samples corresponding to attack algorithms are obtained, and for each attack algorithm, the adversarial samples of the attack algorithm are input into an image classification network to obtain the image classification result of the image classification network.

[0141] Based on the classification success rate in the image classification results, an initial target attack algorithm is selected from each of the attack algorithms, and the attack parameters of the initial target attack algorithm are adjusted.

[0142] attack the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network, and evaluate the image classification network by using a network evaluation function to obtain an evaluation value of the image classification network;

[0143] In a case where the evaluation value is lower than a preset evaluation threshold, the step of adjusting the attack parameter of the initial target attack algorithm is returned to be executed until the evaluation value is higher than the preset evaluation threshold, and the image classification network corresponding to the adjusted initial target attack algorithm with the evaluation value higher than the evaluation threshold is taken as a target attack algorithm, and the image classification network is trained by using the target attack algorithm to obtain a target image classification network.

[0144] Optionally, the obtaining of the adversarial sample corresponding to each attack algorithm includes:

[0145] For each attack algorithm, the image classification network is subjected to a simulation attack based on the attack algorithm to obtain an interfered image classification network, and the adversarial sample corresponding to the attack algorithm is generated based on the interfered image classification network.

[0146] Optionally, the screening of the initial target attack algorithm from the attack algorithms based on the classification success rate in the image classification result includes:

[0147] The classification success rate of the image classification network is obtained by analyzing the number of correct classifications of the image classification result based on the image classification result of the image classification network.

[0148] The attack algorithm corresponding to the image classification network with the lowest classification success rate is screened as the initial target attack algorithm from the attack algorithms.

[0149] Optionally, the adjusting of the attack parameter of the initial target attack algorithm includes:

[0150] The current gradient step length of the image classification network attacked by the initial target attack algorithm is identified, and a correlation between the current gradient step length and the attack parameter of the initial target attack algorithm is identified.

[0151] The change information of the attack parameter when a unit gradient step length is added to the current gradient step length is calculated, the attack parameter is updated based on the change information to obtain a first attack parameter, and the initial target attack algorithm containing the first attack parameter is taken as an adjusted initial target attack algorithm.

[0152] Optionally, the attack of the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network includes:

[0153] Based on the adjusted initial target attack algorithm, a new adversarial sample corresponding to the adjusted initial target attack algorithm is obtained through the image classification network, and the new adversarial sample is input into the image classification network to obtain a new image classification result of the image classification network.

[0154] Optionally, before the step of returning to adjust the attack parameter of the initial target attack algorithm, the method further comprises:

[0155] Based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, difference information of the classification success rate and the new classification success rate is calculated, and based on the difference information, change information of the initial target attack algorithm is adjusted to obtain new change information.

[0156] Based on the new change information, a first attack parameter of the adjusted initial target attack algorithm is adjusted to obtain a second attack parameter of the adjusted initial target attack algorithm, and the first attack parameter of the adjusted initial target attack algorithm is adjusted to the second attack parameter.

[0157] In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the following steps:

[0158] Obtaining adversarial samples corresponding to a plurality of attack algorithms, and inputting, for each attack algorithm, the adversarial sample of the attack algorithm into an image classification network to obtain an image classification result of the image classification network;

[0159] Based on the classification success rate in the image classification result, an initial target attack algorithm is screened from the attack algorithms, and an attack parameter of the initial target attack algorithm is adjusted;

[0160] Based on the adjusted initial target attack algorithm, the image classification network is attacked to obtain a new image classification result of the image classification network, and an evaluation value of the image classification network is evaluated through a network evaluation function;

[0161] In the case where the evaluation value is lower than a preset evaluation threshold, the step of adjusting the attack parameter of the initial target attack algorithm is returned to execute until the evaluation value is higher than the preset evaluation threshold, the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold is taken as a target attack algorithm, and the image classification network is trained through the target attack algorithm to obtain a target image classification network.

[0162] Optionally, the obtaining of the adversarial samples corresponding to the plurality of attack algorithms comprises:

[0163] For each attack algorithm, based on the attack algorithm, the image classification network is subjected to a simulation attack process to obtain an interfered image classification network, and based on the interfered image classification network, the corresponding adversarial sample of the attack algorithm is generated.

[0164] Optionally, the initial target attack algorithm is screened from the attack algorithms based on the classification success rate in the image classification result, including:

[0165] Based on the image classification result of the image classification network, the number of correct classifications of the image classification result is analyzed to obtain the classification success rate of the image classification network.

[0166] In each of the attack algorithms, the attack algorithm corresponding to the image classification network with the lowest classification success rate is screened as the initial target attack algorithm.

[0167] Optionally, the attack parameter of the initial target attack algorithm is adjusted, including:

[0168] The current gradient step of the image classification network attacked by the initial target attack algorithm is identified, and the correlation between the current gradient step and the attack parameter of the initial target attack algorithm is identified.

[0169] The change information of the attack parameter when a unit gradient step is added under the current gradient step is calculated, and the attack parameter is updated based on the change information to obtain a first attack parameter. The initial target attack algorithm containing the first attack parameter is taken as the adjusted initial target attack algorithm.

[0170] Optionally, the image classification network is attacked based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network, including:

[0171] Based on the adjusted initial target attack algorithm, the new adversarial sample corresponding to the adjusted initial target attack algorithm is obtained through the image classification network, and the new adversarial sample is input into the image classification network to obtain a new image classification result of the image classification network.

[0172] Optionally, before returning to the step of adjusting the attack parameter of the initial target attack algorithm, it further includes:

[0173] Based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, the difference information of the classification success rate and the new classification success rate is calculated, and based on the difference information, the change information of the initial target attack algorithm is adjusted to obtain new change information.

[0174] Adjust the first attack parameter of the adjusted initial target attack algorithm based on the new change information to obtain a second attack parameter of the adjusted initial target attack algorithm, and adjust the first attack parameter of the adjusted initial target attack algorithm to the second attack parameter.

[0175] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties.

[0176] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. Any reference to memory, database or other medium used in the embodiments provided by the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided by the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided by the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0177] Any technical features in the above embodiments can be combined, and for the sake of brevity, not all possible combinations are described above, however, as long as the combinations of technical features do not have contradictions, they shall be considered within the scope of the present disclosure.

[0178] The above embodiments only express several implementation manners of the present application, and the description is relatively specific and detailed, but it shall not be understood as a limitation on the patent scope of the present application. It shall be pointed out that, for ordinary skilled persons in the art, several modifications and improvements can be made without departing from the concept of the present application, and these shall be within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A method for training an image classification network, characterized in that, The method comprises: obtaining a plurality of attack algorithms corresponding to the adversarial samples, and for each attack algorithm, inputting the adversarial samples of the attack algorithm into an image classification network to obtain an image classification result of the image classification network; based on the classification success rate in the image classification result, screening an initial target attack algorithm from each of the attack algorithms, and adjusting the attack parameters of the initial target attack algorithm; based on the adjusted initial target attack algorithm, attacking the image classification network to obtain a new image classification result of the image classification network, and evaluating the evaluation value of the image classification network through a network evaluation function; if the evaluation value is lower than a preset evaluation threshold, return to execute the step of adjusting the attack parameters of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, then take the adjusted initial target attack algorithm corresponding to the image classification network with the evaluation value higher than the evaluation threshold as a target attack algorithm, and train the image classification network through the target attack algorithm to obtain a target image classification network; wherein, before returning to execute the step of adjusting the attack parameters of the initial target attack algorithm, it further comprises: based on the classification success rate of the image classification network corresponding to the initial target attack algorithm and the new classification success rate of the image classification network corresponding to the adjusted initial target attack algorithm, calculating the difference information of the classification success rate and the new classification success rate, and adjusting the change information of the initial target attack algorithm based on the difference information to obtain new change information; adjusting the first attack parameters of the adjusted initial target attack algorithm based on the new change information to obtain the second attack parameters of the adjusted initial target attack algorithm, and adjusting the first attack parameters of the adjusted initial target attack algorithm to the second attack parameters; wherein, the difference information includes positive difference and negative difference, in the case of positive difference, the terminal determines that the change information of the initial target attack algorithm is correct, and directly takes the first attack parameters of the initial target attack algorithm as the second attack parameters of the initial target attack algorithm; in the case of negative difference, the terminal determines that the change information of the initial target attack algorithm is incorrect.

2. The method of claim 1, wherein, The method comprises: for each attack algorithm, based on the attack algorithm, the image classification network is simulated and attacked to obtain an interfered image classification network, and the adversarial samples corresponding to the attack algorithm are generated based on the interfered image classification network.

3. The method of claim 1, wherein, The method comprises: based on the image classification result of the image classification network, analyzing the correct classification number of the image classification result to obtain the classification success rate of the image classification network; screening the attack algorithm corresponding to the image classification network with the lowest classification success rate as the initial target attack algorithm from each of the attack algorithms.

4. The method of claim 1, wherein, The method comprises: identify a current gradient step of an image classification network attacked by the initial target attack algorithm, and identify a correlation between the current gradient step and an attack parameter of the initial target attack algorithm; calculate change information of the attack parameter when a unit gradient step is added to the current gradient step, and update the attack parameter based on the change information to obtain a first attack parameter, and use an initial target attack algorithm containing the first attack parameter as an adjusted initial target attack algorithm.

5. The method of claim 1, wherein, The method further includes: The method further includes:

6. A training device for an image classification network, characterized in that, The apparatus includes: an obtaining module configured to obtain adversarial samples corresponding to a plurality of attack algorithms, and input, for each attack algorithm, an adversarial sample of the attack algorithm into an image classification network to obtain an image classification result of the image classification network; a screening module configured to screen an initial target attack algorithm from the attack algorithms based on a classification success rate in the image classification result, and adjust an attack parameter of the initial target attack algorithm; an evaluation module configured to attack the image classification network based on the adjusted initial target attack algorithm to obtain a new image classification result of the image classification network, and evaluate an evaluation value of the image classification network by using a network evaluation function; a training module configured to, in a case where the evaluation value is lower than a preset evaluation threshold, return to perform the step of adjusting the attack parameter of the initial target attack algorithm until the evaluation value is higher than the preset evaluation threshold, use an adjusted initial target attack algorithm corresponding to an image classification network with an evaluation value higher than the evaluation threshold as a target attack algorithm, and train the image classification network by using the target attack algorithm to obtain a target image classification network; The apparatus further includes: a calculation module configured to calculate difference information between a classification success rate of an image classification network corresponding to the initial target attack algorithm and a new classification success rate of an image classification network corresponding to the adjusted initial target attack algorithm based on the classification success rate and the new classification success rate, and adjust change information of the initial target attack algorithm based on the difference information to obtain new change information; and an adjustment module configured to adjust a first attack parameter of the adjusted initial target attack algorithm based on the new change information to obtain a second attack parameter of the adjusted initial target attack algorithm, and adjust the first attack parameter of the adjusted initial target attack algorithm to the second attack parameter. The difference value information includes a positive difference value and a negative difference value, in the case of the positive difference value, the terminal determines that the change information of the initial target attack algorithm is correct, and directly takes the first attack parameter of the initial target attack algorithm as the second attack parameter of the initial target attack algorithm; in the case of the negative difference value, the terminal determines that the change information of the initial target attack algorithm is incorrect. 7.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-6 when the computer program is executed by the processor. The processor, when executing the computer program, implements the steps of the method of any one of claims 1 to 5.

8. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 5.

9. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 5. The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 5.

Images