Frank-wolfe based image adversarial sample defense method and system

Abstract

The application discloses a Frank-Wolfe-based image adversarial sample defense method and system, and the method comprises the following steps: (1) data collection and cleaning; (2) constructing a neural network model; (3) generating an initial adversarial sample based on an original image by using Frank-Wolfe and a dichotomy algorithm; (4) finely searching an adversarial sample boundary by using a Frank-Wolfe algorithm; and (5) training the generated adversarial sample to the model to improve the robustness of the model. The application designs a Frank-Wolfe-based image adversarial sample defense method. The core idea of the technology is to reduce the iteration number of initializing a small adversarial sample by using a dichotomy algorithm and a Frank-Wolfe algorithm, and to further search the generated adversarial sample based on the Frank-Wolfe algorithm, so as to achieve the effect of reducing the norm of the adversarial sample, thereby optimizing the number and efficiency of generating the adversarial sample. The application has small norm of the generated adversarial sample and high generation efficiency, thereby laying a foundation for constructing a more robust image classification system.

Description

Technical Field

[0001] The present invention relates to a Frank-Wolfe-based image adversarial sample defense method and system. Background Art

[0002] Deep learning has achieved remarkable success in many machine learning tasks and solved scientific problems that were previously difficult to solve. In the field of computer vision, models based on convolutional neural networks (CNNs) have achieved amazing performance in a very challenging large-scale visual recognition task, making deep learning the focus of attention.

[0003] Despite their tremendous success, deep neural networks are vulnerable to adversarial examples, where even specially crafted, rather than random, perturbations can cause state-of-the-art classifiers to make incorrect predictions.

[0004] Methods for attacking image classification models can be categorized as white-box or black-box attacks, depending on the model information obtained. With continued research into attack methods, even more challenging black-box attacks can be achieved quickly and with high success rates. Therefore, improving the robustness of adversarial examples and finding adversarial examples with minimal perturbation have become key research topics. Summary of the Invention

[0005] In response to the above-mentioned deficiencies in the prior art, the present invention provides a method and system for defending against image adversarial samples based on Frank-Wolfe. The present invention can achieve a high success rate in attacking the model, generate high-quality images, and quickly find minimum-norm adversarial samples, thereby laying a solid foundation for building a more robust image classification system.

[0006] According to the design scheme provided by the present invention, the Frank-Wolfe-based image adversarial sample defense method and system for visual image classification and recognition includes the following contents:

[0007] Collecting sample data for visual image classification and recognition, where the sample data includes an input image and label data corresponding to the input image;

[0008] Build a neural network model for adversarial sample generation;

[0009] This module generates adversarial examples based on sample data. By combining the Frank-Wolfe algorithm with binary search, this module reduces the norm of the adversarial example to a suitable, smaller initial adversarial example. Then, through precise search, the norm of the adversarial example is gradually reduced to find the minimum viable adversarial example.

[0010] Invention steps: The present invention is mainly divided into five parts: (1) data collection; (2) model construction; (3) generating initial adversarial samples; (4) searching for adversarial samples with small norm; (5) using adversarial samples to train the model.

[0011] The Frank-Wolfe-based image adversarial sample defense method includes the following steps:

[0012] Step 1, data collection, includes collecting public labeled datasets and unlabeled public or private data.

[0013] Step 2, model construction, includes building a model including a convolutional neural network.

[0014] Step 3: Based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm to quickly reduce the norm by determining whether it is a successful adversarial example;

[0015] In step 4, based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm to determine whether it is a successful adversarial sample and narrow the boundary within a small range.

[0016] Step 5: Use the generated adversarial samples to train the model to improve the robustness of the model.

[0017] Step 1 includes collecting and cleaning the collected data, where:

[0018] Data collection: Collect publicly available labeled image classification datasets and label unlabeled data to construct datasets. Data cleaning: Integrate data from multiple data sources, convert source image data, and perform operations such as data standardization, normalization, discretization, and aggregation.

[0019] Step 2 involves designing, building, and training a neural network, where:

[0020] First, determine the network structure, including the number of layers and neurons in each layer, and design the type of neural network for each layer. Next, set the weights and activation functions for each layer. Finally, set the activation function for the training process and begin training. Alternatively, use a publicly available model structure and weights. Training problems can be attributed to optimization issues:

[0021] minimizeJ(y,f(x)) (1) Step 3 generates the initial adversarial sample including:

[0022] Step 3-1, initialize the minimum bound l and maximum bound r of the sample norm. Initialize the adversarial result delta with the minimum norm that has been searched. search .

[0023] Step 3-2: Calculate mid = (l + r) / 2 based on the current minimum and maximum boundaries, and project the adversarial sample to the current boundary mid. If the projected adversarial sample can cause the model to misclassify, jump to step 3-7; otherwise, jump to step 3-3.

[0024] Step 3-3, based on the logits value calculated by the model for the current adversarial sample, calculate the loss function value of the current adversarial sample through the loss function, where y is the original label of the image:

[0025]

[0026] Step 3-4: Calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where ||2 represents the second norm of the vector;

[0027]

[0028] According to the following formula, based on the characteristics of convex sets, the updated adversarial sample is still in the current boundary mid, and the adversarial sample delta currently searched is updated cur , delta cur is the adversarial example currently being searched

[0029] delta cur =(1-α)×delta cur +α×mid×v (4)

[0030] Where α is the update step size, set to t is the current search number;

[0031] Steps 3-5, calculate delta cur Norm value; by judging whether the current adversarial sample is successful and comparing the size of the norm, update the adversarial sample with the minimum norm; if the current delta cur It is an adversarial sample that can make the model fail to classify, and delta cur The second norm of is less than delt search The second norm of , update delta search Delta cur , jump to step 3-7; otherwise jump to step 3-6;

[0032] Step 3-6, repeat steps 3-2 to 3-4, T update times; T update is a hyperparameter representing the number of gradient updates performed under the current boundary mid. The repeated steps are to use Frank-Wolfe to better obtain the gradient information of the model and increase the probability that the adversarial sample is still a successful one after projection.

[0033] Steps 3-7, based on the currently searched adversarial sample delta cur , update the model's boundaries, if delta cur If it is a successful adversarial sample, then the upper boundary of the search is updated to mid, otherwise the lower boundary of the search is updated to mid;

[0034] Step 3-8, repeat steps 3-2 to 3-7T bs times; T bs It is a hyperparameter representing the number of binary searches performed; multiple independent binary searches are performed to accelerate convergence.

[0035] In step 4, the adversarial examples with small search norm include:

[0036] Step 4-1: Substitute the delta obtained in step 3 search As delta in step 4 cur and delta best The initial value of delta cur Represents the adversarial sample in the search process, delta best Represents the adversarial sample result with the smallest norm; the delta in step 3 search As an initial value, it can reduce the number of searches required in step 4; initialize norm best Delta best norm, norm best Represents the norm of the best adversarial sample found; initialize epsilon to delta best The norm of epsilon represents the adversarial sample delta currently being searched. cur The constraint boundary epsilon;

[0037] Step 4-2, based on the current adversarial sample delta cur The logits value obtained by the model is used to calculate the loss function value of the current adversarial sample through the loss function, where y is the original label of the image:

[0038]

[0039] Step 4-3, calculate the second norm Lp of the current adversarial sample, and determine whether the current adversarial sample can successfully predict the failure of the model, which is recorded as isAdv. IsAdv takes 1 to represent a successful adversarial sample, and 0 to represent a failed adversarial sample; calculate the current isSmaller = |delta cur |2≤norm best,isBoth=isSmaller∧isAdv; record isSmallerEps=Lp≤epsilon. Calculate the update condition of epsilon isBothEps=isSmallerEps∧isAdv, and update delta according to the following formula best 、epsilon、norm best ;

[0040]

[0041]

[0042]

[0043] Step 4-4, calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where ||2 represents the second norm of the vector;

[0044]

[0045] Update the adversarial sample currently being searched according to the following formula; where α is the update step size, which is generally set to t is the current search number;

[0046] delta cur =(1-α)×delta cur +α×epsilon×v (8)

[0047] Step 4-5, based on the adversarial sample delta of the current adversarial sample cur Whether the adversarial examples that cause the model to misclassify update boundaries;

[0048]

[0049] Steps 4-6: Project the current adversarial sample delta based on the current boundary cur to the current range and crop the adversarial sample according to the image constraints;

[0050]

[0051] Step 4-7, repeat steps 4-2 to 4-6T lr times; T lr is a hyperparameter representing the number of steps to reduce the norm of the adversarial sample.

[0052] Step 5 includes:

[0053] According to steps 3 and 4, the adversarial samples generated in steps 3 and 4 are used as input images, and the model trained in step 2 is trained again. The trained model has the characteristics of high robustness. The optimization problem of the training process is:

[0054]

[0055] Where minimize is the minimization function, the loss function J is the cross entropy loss function, and y is the true label of the image. is the adversarial sample obtained through steps 3 and 4.

[0056] The second aspect of the present invention relates to a system for implementing a Frank-Wolfe-based image adversarial sample defense method, comprising a data collection module, a model building module, and an adversarial sample generation module.

[0057] The data collection module is used to collect sample data for visual image classification and recognition, and the sample data includes an input image and label data corresponding to the input image.

[0058] The model building module is used to build a neural network model for adversarial sample generation, train, and select a model with high robustness.

[0059] The adversarial example generation module is used to generate adversarial examples for sample data. This module combines the Frank-Wolfe algorithm with binary search to reduce the norm of the adversarial examples to a suitable, smaller initial adversarial example. In step 4, a precise search for adversarial examples with a smaller norm is performed to test the robustness of the corresponding model.

[0060] By combining the Frank-Wolfe algorithm with binary search, this method allows the adversarial example norm reduction process to start with a suitable, smaller initial adversarial example. A good initial value can reduce the number of times required to accurately search for adversarial examples. Using Frank-Wolfe to update adversarial examples keeps them within the current bounds, reducing the impact of projections on the success rate of adversarial examples. By determining whether the current attack is successful, convergence of the bounds is accelerated.

[0061] The advantages of the present invention are that the generated adversarial samples have a small norm and can better detect the classification boundaries of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a flow chart of the method of the present invention.

[0063] Figure 2 is a flow chart of step 3 of the method of the present invention.

[0064] Figure 3This is a flow chart of the image classification method for countermeasure defense according to the present invention.

[0065] Figure 4 Schematic diagram of the original sample and the adversarial sample generated by the present invention in an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The technical solution of the present invention is further described below with reference to the accompanying drawings.

[0067] Example 1

[0068] like Figure 2 As shown, the present invention primarily leverages the Frank-Wolfe algorithm's high efficiency in generating adversarial examples. First, the Frank-Wolfe algorithm is combined with a bisection algorithm to more quickly generate adversarial examples with a smaller norm. Then, the Frank-Wolfe algorithm is combined with the success of the current adversarial example to fine-tune the current boundary, achieving the effect of a precise search for the adversarial example boundary at the decision boundary.

[0069] like Figure 1 The present invention provides an e-commerce image classification method based on a Frank-Wolf image adversarial sample method, the steps of which include:

[0070] Step 1: Collect and clean the collected data. Data collection.

[0071] Step 2 is to design and build the neural network.

[0072] In step 3, based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm. By determining whether it is a successful adversarial sample, the binary algorithm is used to quickly search for the boundary, thereby achieving the possibility of quickly reducing the boundary.

[0073] In step 4, based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm to determine whether it is a successful adversarial sample and narrow the boundary within a small range.

[0074] Step 5: Use the generated adversarial samples to train the model to improve the robustness of the model.

[0075] Step 6: Use the trained model to assign labels to e-commerce images.

[0076] Step 1 includes:

[0077] Collect publicly available labeled image classification datasets and label unlabeled data to construct datasets. Data cleaning: Integrate data from multiple data sources, convert source image data, and perform operations such as data standardization, normalization, discretization, and aggregation.

[0078] Step 2 includes:

[0079] First, design the network structure, determining the number of layers, the number of neurons in each layer, and the type of neural network for each layer. Next, set the weights and activation functions for each layer. Finally, set the activation function for training and begin training. Alternatively, use a publicly available model structure and weights.

[0080] Step 3 includes:

[0081] Specifically, taking Google's online image classification system Cloud Vision as an example, the task of generating adversarial samples is to create adversarial samples that are as different from the original images as possible, so as to test the robustness of the classification system.

[0082] Step 3-1, initialize the minimum bound l and maximum bound r of the sample norm. Initialize the adversarial result delta with the minimum norm that has been searched. search .

[0083] Step 3-2: Calculate mid = (l + r) / 2 based on the current minimum and maximum boundaries, and project the adversarial sample to the current boundary mid. If the projected adversarial sample can cause the model to misclassify, jump to step 3-7; otherwise, jump to step 3-3.

[0084] Step 3-3, based on the logits value calculated by the model for the current adversarial sample, calculate the loss function value of the current adversarial sample through the loss function, where y is the original label of the image:

[0085]

[0086] Step 3-4: Calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where ||2 represents the second norm of the vector;

[0087]

[0088] According to the following formula, based on the characteristics of convex sets, the updated adversarial sample is still in the current boundary mid, and the adversarial sample delta currently searched is updated cur , delta cur is the adversarial sample currently being searched, where α is the step size of the update, set to t is the current search number;

[0089] delta cur =(1-α)×delta cur +α×mid×v (3) Steps 3-5, calculate delta curNorm value; by judging whether the current adversarial sample is successful and comparing the size of the norm, update the adversarial sample with the minimum norm; if the current delta cur It is an adversarial sample that can make the model fail to classify, and delta cur The second norm of is less than delt search The second norm of , update delta search Delta cur , jump to step 3-7; otherwise jump to step 3-6;

[0090] Step 3-6, repeat steps 3-2 to 3-4, T update times; T update is a hyperparameter representing the number of gradient updates performed under the current boundary mid. The repeated steps are to use Frank-Wolfe to better obtain the gradient information of the model and increase the probability that the adversarial sample is still a successful one after projection.

[0091] Steps 3-7, based on the currently searched adversarial sample delta cur , update the model's boundaries, if delta cur If it is a successful adversarial sample, then the upper boundary of the search is updated to mid, otherwise the lower boundary of the search is updated to mid;

[0092] Step 3-8, repeat steps 3-2 to 3-7T bs times; T bs It is a hyperparameter representing the number of binary searches performed; multiple independent binary searches are performed to accelerate convergence.

[0093] Step 4 includes:

[0094] Step 4-1: Substitute the delta obtained in step 3 search As delta in step 4 cur and delta best The initial value of delta cur Represents the adversarial sample in the search process, delta best Represents the adversarial sample result with the smallest norm; the delta in step 3 search As an initial value, it can reduce the number of searches required in step 4; initialize norm best Delta best norm, norm best Represents the norm of the best adversarial sample found; initialize epsilon to delta best The norm of epsilon represents the adversarial sample delta currently being searched. cur The constraint boundary epsilon;

[0095] Step 4-2, according to the current adversarial sample edlta cur The logits value obtained by the model is used to calculate the loss function value of the current adversarial sample through the loss function, where y is the original label of the image:

[0096]

[0097] Step 4-3, calculate the second norm Lp of the current adversarial sample, and determine whether the current adversarial sample can successfully predict the failure of the model, which is recorded as isAdv. IsAdv takes 1 to represent a successful adversarial sample, and 0 to represent a failed adversarial sample; calculate the current isSmaller = |delta cur |2≤norm best ,isBoth=isSmaller∧isAdv; record isSmallerEps=Lp≤epsilon. Calculate the update condition of epsilon isBothEps=isSmallerEps∧isAdv, and update delta according to the following formula best 、epsilon、norm best ;

[0098]

[0099]

[0100]

[0101] Step 4-4, calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where ||2 represents the second norm of the vector;

[0102]

[0103] Update the adversarial sample currently being searched according to the following formula; where α is the update step size, which is generally set to t is the current search number;

[0104] delta cur =(1-α)×delta cur +α×epsilon×v (8)

[0105] Step 4-5, based on the adversarial sample delta of the current adversarial sample cur Whether the adversarial examples that cause the model to misclassify update boundaries;

[0106]

[0107] Steps 4-6: Project the current adversarial sample delta based on the current boundary cur to the current range and crop the adversarial sample according to the image constraints;

[0108]

[0109] Step 4-7, repeat steps 4-2 to 4-6T lr times; T lr is a hyperparameter representing the number of steps to reduce the norm of the adversarial sample.

[0110] Step 5 includes:

[0111] According to steps 3 and 4, the adversarial samples generated in steps 3 and 4 are used as input images to train the model trained in step 2. The trained model has the characteristics of high robustness. The optimization problem of the training process is:

[0112]

[0113] Where minimize is the minimization function, the loss function J is the cross entropy loss function, and y is the true label of the image. is the adversarial sample obtained through steps 3 and 4.

[0114] Step 6 includes:

[0115] The model trained using the model from step 5 can automatically provide classification labels for existing images on the e-commerce platform. Users can also automatically provide classification labels for e-commerce images uploaded by the model.

[0116] This paper designs a Frank-Wolfe-based defense method for image adversarial examples. The core concept of this technique is to reduce the number of iterations required to initialize a smaller adversarial example using a binary algorithm and the Frank-Wolfe algorithm. Furthermore, the Frank-Wolfe algorithm is used to further search for already generated adversarial examples to reduce the norm of the adversarial examples, thereby optimizing the number and efficiency of adversarial example generation. This method generates adversarial examples with a small norm and high generation efficiency, laying a solid foundation for building more robust image classification systems.

[0117] Example 2

[0118] This embodiment relates to a Frank-Wolf-based image adversarial sample defense system for implementing the Frank-Wolfe-based image adversarial sample defense method of the present invention, including:

[0119] The data collection module is used to collect sample data for visual image classification and recognition, where the sample data includes an input image and label data corresponding to the input image.

[0120] The model building module is used to build a neural network model for adversarial sample generation. It trains and selects models with high robustness.

[0121] The adversarial example generation module is used to generate adversarial examples for sample data. This module combines the Frank-Wolfe algorithm with binary search to reduce the norm of adversarial examples to a suitable, smaller initial adversarial example. Through step 4, it accurately searches for adversarial examples with a smaller norm to test the robustness of the corresponding model.

Claims

1. The Frank-Wolfe-based image adversarial sample defense method includes the following steps: Step 1: Data collection, which includes collecting public labeled datasets and unlabeled public or private data; Step 2: Model construction, building a model including convolutional neural network; Step 3: Based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm to quickly reduce the norm by determining whether it is a successful adversarial example; include: Step 3-1, initialize the minimum bound l and maximum bound r of the sample norm; initialize the adversarial result with the minimum norm that has been searched ; Step 3-2, calculate based on the current minimum and maximum boundaries , project the adversarial sample to the current boundary If the projected adversarial sample can cause the model to misclassify, jump to step 3-7, otherwise jump to step 3-3; Step 3-3, calculated based on the current adversarial sample Value, calculate the loss function value of the current adversarial sample through the loss function, where The original label of the image: Step 3-4, calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where Represents the second norm of the vector; According to the following formula, based on the characteristics of convex sets, the updated adversarial sample is still within the current boundary. In the current search, update the adversarial sample , is the adversarial example currently being searched in is the update step size, set to , The current search count; Steps 3-5, calculate Norm value; by judging whether the current is a successful adversarial sample and comparing the size of the norm, update the adversarial sample with the minimum norm; if the current is an adversarial example that can cause the model to fail to classify, and The second norm is less than The second norm of for , jump to step 3-7; otherwise jump to step 3-6; Step 3-6, repeat steps 3-2 to 3-4, Second-rate; is a hyperparameter representing the current boundary The purpose of repeating the steps is to use Frank-Wolfe to better obtain the gradient information of the model and increase the probability that the adversarial sample is still a successful one after projection. Steps 3-7, based on the currently searched adversarial samples , update the model boundaries if is a successful adversarial sample, then the upper boundary of the search is updated to , otherwise update the lower boundary of the search to ; Step 3-8, repeat steps 3-2 to 3-7 Second-rate; is a hyperparameter representing the number of binary searches performed; multiple independent binary searches are used to accelerate convergence; Step 4: Based on the original image, the classification label obtained by the model is input into the Frank-Wolfe algorithm to determine whether it is a successful adversarial example and narrow the boundary within a small range; Step 5: Use the generated adversarial samples to train the model to improve the robustness of the model.

2. The Frank-Wolfe-based image adversarial sample defense method according to claim 1, wherein: Step 1 collects and cleans the collected data, where: Data collection: Collect publicly available image classification datasets with labels, and label unlabeled data to construct datasets; Data cleaning: Integrate data from multiple data sources, convert source image data, and perform data standardization, normalization, discretization, and aggregation operations.

3. The Frank-Wolfe-based image adversarial sample defense method according to claim 1, wherein: Step 2 involves designing and building a neural network, specifically: First, design the network structure, determine the number of neural network layers and the number of neurons in each layer, and design the type of neural network for each layer; then set the weights and activation functions for each layer; finally, set the activation function during training and conduct training. Training problems can be attributed to optimization problems: in To minimize the function, the loss function is the cross entropy loss function, is the true label of the image, is the original image, Predict the classification function for the model.

4. The Frank-Wolfe-based image adversarial sample defense method according to claim 1, wherein: Step 4 includes: Step 4-1: convert the As in step 4 and The initial value of represents the adversarial sample in the search process, Represents the adversarial sample result with the smallest norm; initialization for The norm of Represents the norm of the best adversarial sample found; initialization for The norm of Represents the adversarial example currently being searched Constraint boundary ; Step 4-2, based on the current adversarial sample Calculated by the model Value, calculate the loss function value of the current adversarial sample through the loss function, where The original label of the image: Step 4-3, calculate the second norm of the current adversarial sample , to determine whether the current adversarial sample can successfully predict the failure of the model is recorded as , 1 represents a successful adversarial sample, and 0 represents a failed adversarial sample; calculate the current , ;Record .calculate Update conditions ， Update according to the following formula 、 、 ; Step 4-4, calculate the current adversarial sample gradient based on the current loss function value, and calculate the gradient within the boundary according to the following formula; where Represents the second norm of the vector; Update the adversarial sample currently being searched according to the following formula; is the update step size, which is generally set to , The current search count; Step 4-5, based on the adversarial sample of the current adversarial sample Whether the adversarial examples that cause the model to misclassify update boundaries; Steps 4-6: Project the current adversarial sample based on the current boundary to the current range and crop the adversarial sample according to the image constraints; Step 4-7, repeat steps 4-2 to 4-6 Second-rate; is a hyperparameter representing the number of steps to reduce the norm of the adversarial sample.

5. The Frank-Wolfe-based image adversarial sample defense method according to claim 4, characterized in that: Step 5 includes: The adversarial samples generated in steps 3 and 4 are used as input images to train the model trained in step 2. The trained model has the characteristics of high robustness. The optimization problem of the training process is: in To minimize the function, the loss function is the cross entropy loss function, is the true label of the image, is the adversarial sample obtained through steps 3 and 4.

6. A system for implementing the Frank-Wolfe-based image adversarial sample defense method according to claim 1, characterized in that Contains: data collection module, model building module, adversarial sample generation module; among them, A data collection module is used to collect sample data for visual image classification and recognition, where the sample data includes an input image and label data corresponding to the input image; Model building module, used to build neural network models for adversarial sample generation; train and select models with high robustness; The adversarial sample generation module is used to generate adversarial samples for sample data. By combining the Frank-Wolfe algorithm with binary search, the process of reducing the norm of the adversarial sample can be performed on a suitable, smaller initial adversarial sample; then, precise searches are conducted for adversarial samples with a smaller norm to test the robustness of the corresponding model.

Images