A data padding type deep neural network image classification model countermeasure training method

Abstract

The present application is directed to the deep neural network robustness optimization problem, and discloses a data filling type deep neural network image classification model adversarial training method, belonging to the field of deep learning and artificial intelligence security. Firstly, the target model is modified, the model output layer is expanded, and the newly added class is defined as a filling class. Secondly, a trap type smoothing loss function is established to optimize the target manifold and improve the detection efficiency of adversarial samples. Then, a basic adversarial training method is selected, and a filling class data generation method is used in the data generation stage to generate filling class data based on adversarial samples. The filling class data and adversarial samples are used for adversarial training, and the trap type smoothing loss function is used to update the model parameters. Finally, the method parameters are optimized according to the combination test results, and the optimized target model is obtained through multiple retraining. The present application simultaneously considers adversarial training and adversarial sample detection, can effectively defend against adversarial samples of different perturbation sizes, and improves the robustness of the model.

Description

Technical Field

[0001] This invention belongs to the field of deep learning and artificial intelligence security, specifically involving the expansion of neural network models and the optimization of the robustness of neural network models. It proposes a data-filled deep neural network image classification model adversarial training method. Background Technology

[0002] As the most widely used sub-discipline in artificial intelligence (AI), deep neural networks (DNNs) have achieved great success in fields such as image classification and segmentation, image detection and tracking, and speech recognition, thanks to further optimization and improvement of computing power, models, and data availability. They have also seen rapid development in fields with extremely high safety requirements, such as autonomous driving and medical diagnosis.

[0003] In the field of AI image classification, with the invention of Convolutional Neural Networks (CNNs), researchers have successively proposed deep neural network models such as VGG, ResNet, and InceptionV3, which have greatly improved the accuracy of image classification in various scenarios. However, research shows that high-precision deep neural network models are highly vulnerable to adversarial examples, leading to misclassifications. Adversarial examples are malicious attack samples generated by attackers adding carefully crafted micro-adversarial perturbations to clean samples; human vision alone cannot distinguish between clean and adversarial samples. Simultaneously, due to the complexity of deep neural network models and insufficient training data, adversarial examples can affect the feature extraction of data by the shallow network parts and the semantic analysis of data by the deep network parts within the DNN, thereby altering the model's final classification judgment and causing classification errors.

[0004] As a crucial component of trustworthy AI, the robustness of deep neural networks (DNNs) in image classification emphasizes that DNN models should remain unaffected by perturbations when faced with processed data samples, maintaining the correct predicted data category. Adversarial examples expose the vulnerability and susceptibility of deep neural networks, representing a significant security flaw that severely compromises their robustness and security.

[0005] To address the security vulnerability of adversarial examples in the DNN field, researchers have proposed various adversarial defense methods to improve the robustness of DNNs. DNN robustness measures the ability of a DNN model to withstand interference from input data with added perturbations and noise. Adversarial defense methods primarily improve DNN robustness from four perspectives: adversarial example detection, sample input preprocessing, directly improving the DNN's own adversarial robustness, and provable robustness defense. Currently, due to the uninterpretability of DNNs and the constant emergence of new adversarial attack methods, adversarial training, which directly improves the DNN's adversarial robustness, is widely recognized as the most powerful DNN adversarial defense method due to its stability and generalizable defense capabilities. Summary of the Invention

[0006] A data-filling-based adversarial training method for deep neural network image classification models is proposed. Firstly, based on adversarial examples generated from the training set data, a padding-class data generation method is used to generate padding-class data. This data, along with the adversarial examples and a certain proportion of padding-class data, is then used to adversarially train the target model M. Simultaneously, to add padding-class output categories to model M, the output layer of model M is expanded, changing the output layer originally having output category k to k+1. The purpose of this step is to define padding-class labels in the feature space of the high-dimensional space of the deep neural network model that is not defined by the low-dimensional training set data manifold (data distribution). Thus, when the model's output category is padding-class, since the padding-class data and the training set do not intersect, the corresponding input can be identified as an abnormal adversarial example input, thereby effectively detecting adversarial examples. Secondly, the loss function used in model training is modified to a trap-smoothing loss function. The aim is to optimize the data distribution of different categories within the training set data manifold and establish an induced relationship between the training set data manifold and the padding-class data manifold, thereby improving the detection efficiency of adversarial examples.

[0007] This invention relates to a defense method against adversarial examples, characterized by comprising the following steps:

[0008] Step 1: To improve the robustness of the target deep neural network image classification model, a pre-trained deep neural network image classification model applied to specific tasks is selected as the target model M. Next, the target model M is modified by expanding the output layer of the target model M with k output categories. The final model M is... plus The number of output layer categories is k+1;

[0009] Step 2: Establish a trap-based smoothing loss function to optimize the target manifold distribution and establish the induced relationship between the target manifold and the filling class distribution, as shown in formula (1), where q is the total number of classes in the model and α is the trap induction factor. and These are the output vectors belonging to the clean and filled categories in the total output vector, respectively. This is the original one-hot type output vector. and Represent The original output vectors that belong to the clean and filled categories, size( ) represents a vector The number of elements, and the final output is the number of elements. and The concatenated output vector y, specifically: the trap-style smoothing loss function uses the default one-hot output vector for the label vectors belonging to the filler category, and applies formula (1) to the label vectors belonging to the original target category. and Process them separately, among which... The target class's smoothed α probability is then assigned to all original classes in a uniform distribution. ,right Assign a probability to each filler class Finally, the smoothed and The concatenated vector is used as the label vector and the model output x is calculated using the cross-entropy loss function;

[0010] (1)

[0011] Step 3: Select a basic adversarial training method, and generate the following for each mini-batch training set: Figure 3 The adversarial example shown on the right uses the padding data generation method shown in formula (2) to generate corresponding padding class data, where x adv For adversarial examples, the `random()` function returns random numbers in the same format as the input data `data` and conform to a normal distribution. The `sign()` function assigns the perturbation a positive or negative value based on the sign of the parameter. This represents the one-dimensional linear interpolation function `interp()`, which dynamically adjusts the size of the perturbation vector based on the cycle number `epoch`, the current cycle number, and the total cycle number `epoch`. It uses the standard deviation of the training data (`std`) as the minimum value of the linear interpolation, and uses the hyperparameter `β` to regularize the initial interpolation value. It also uses the data-standardized upper bound `x`. max As the maximum value of the linear interpolation, and using hyperparameters As a control parameter for generating populated class data;

[0012] (2)

[0013] Step 4: Based on the pixel size of the image dataset and the model size, manually and dynamically select the proportion parameter of padding data used for adversarial training in each mini-batch. Using this proportion, the padding data is concatenated with adversarial examples and participates in the retraining process of adversarial training. Specifically: the larger the image pixel size, the lower the proportion parameter of padding data used for adversarial training in each mini-batch. The data category of the newly generated padding data is k+1.

[0014] Step 5: Use the early stopping mechanism to test model M plus Adversarial training is performed. Specifically, the model's historical best accuracy in adversarial attack testing is updated in each loop. When the current training loop ends, the accuracy of the updated model in the same adversarial attack testing method is compared with the historical best accuracy. If the model accuracy in the current loop is lower than the historical best accuracy and exceeds the threshold, the model training is stopped and the model parameters are saved. Specifically, the default value of the threshold is 0.1.

[0015] Step Six: Test the model parameters saved in Step Five using different adversarial attack methods. Adjust the trap smoothing factor in Step Two and the parameter β in the data generation method for filling in the data in Step Three based on the test results. and the proportional parameters in step four, to Figure 2 The diagram illustrates an adversarial training method for a data-filled deep neural network image classification model, followed by parameter optimization experiments. Specifically, when model M... plus When the accuracy provided by adversarial training cannot be maintained in a low-perturbation adversarial attack environment, reduce the size of the trap-type smoothing factor, increase β in step three to increase the initial distance of the padding class data generation method, and reduce the value in step three. To reduce the intrusion of the filling data on the target manifold and to reduce the splicing ratio parameter in each iteration of the filling data in step four, when model M plus When adversarial sample detection performs poorly in high-perturbation adversarial attack environments, the size of the trap-type smoothing factor should be appropriately increased, β in step three should be decreased to expand the generation search space of the padding data, and the splicing ratio parameter of the padding data in each iteration of step four should be increased. When model M plus When the robustness of model M can maintain the adversarial robustness provided by adversarial training under low-perturbation attack conditions and provide detection and defense against adversarial examples under global perturbation, the robustness improvement of model M achieves the expected effect of the algorithm. Attached Figure Description

[0016] Appendix Figure 1 This is a flowchart of an adversarial training method for a data-filled deep neural network image classification model.

[0017] Appendix Figure 2This is a schematic diagram of an adversarial training method for a data-filled deep neural network image classification model.

[0018] Appendix Figure 3 This is a diagram illustrating adversarial examples. Detailed Implementation

[0019] Taking the ResNet-18 deep neural network model as an example, this paper describes the specific implementation of a data-filling-based adversarial training method for deep neural network image classification models proposed in this invention.

[0020] Step 1: Select ResNet-18 as the base target model M, and choose 50,000 training data points from the MNIST dataset as the original dataset D. At this point, M has 10 output classes. Increment the number of output layers of M by 1, so that M now has 11 output layers, including 10 target data classes and 1 padding data class.

[0021] Step 2: Modify the cross-entropy loss function according to formula (1). Perform trap-style label smoothing on the label vector of the target data category as shown in formula (1). Use the default one-hot vector for the label vector of the filled data category. Finally, concatenate the smoothed label vector of the target data category with the label vector of the filled data category in the default one-hot representation, and calculate the cross-entropy loss with the model output. Specifically: Set the trap-style smoothing factor to 0.35.

[0022] Step 3: Select the Fast Gradient Sign Method (FGSM) adversarial training method. In the process of generating adversarial sample data in each mini-batch, the adversarial samples generated by the FGSM adversarial attack method based on the mini-batch training data in this cycle are first generated, and then the padding data generation method of formula (2) is used to generate padding data based on the adversarial samples generated in this cycle. Specifically: the FGSM perturbation parameter is set to 0.3.

[0023] Step 4: Concatenate the generated padding data with the adversarial examples generated in this loop at a ratio of 10% to 50%, correctly label the adversarial examples and label the padding data as category 11, calculate the model loss using the trap loss function defined in Step 2, and finally perform backpropagation on the model and update the model parameters.

[0024] Step 5: Use Projected Gradient Descent (PGD) as the attack method for model robustness testing. Set a variable, historical best accuracy, to record the robustness (accuracy) of model M after parameter updates at the end of each major loop when facing PGD attacks. If the model accuracy obtained in the current loop is lower than the historical best accuracy and less than the threshold of 0.1, then prematurely end the adversarial training and save model M. plus Specifically: The PGD adversarial perturbation interval was set to [0.1, 0.2, 0.3, 0.35, 0.4, 0.45, 0.5] to test the robustness of the updated model M against adversarial attacks with different perturbation sizes. The single PGD perturbation size was set to 0.01, and the attack iteration count was set to 50.

[0025] Step 6: Perform FGSM adversarial training on the same training dataset using the same parameters using the original model M, and save the comparison model M. compare .

[0026] Step 7: Use PGD, C&W, and the adaptive attack method AA (Auto-Attack) to test the model M obtained in Step 5. plus and M compare Perform the final combined test of the model. When model M... plus The accuracy in the low-perturbation space (anti-perturbation setting less than 0.3) is compared to the model M obtained in step six. compare It did not decrease, and M plus The accuracy of the model after detection can reach 80%~100% in a high-perturbation space (adversarial perturbation setting greater than 0.3), then the final model M is output. plus When model M plus The accuracy in the low-perturbation space (anti-perturbation setting less than 0.3) is compared to the model M obtained in step six. compare If there is a significant reduction, the following parameter tuning methods should be selected: 1. Reduce the value of the trap smoothing factor in step two; 2. Increase the initial interpolation value of the data generation function in step three; 3. Reduce the data splicing ratio in step four. When model M plus When the adversarial example detection capability is poor in a high-perturbation space (adversarial perturbation setting greater than 0.3), the following parameter tuning scheme is selected: 1. Increase the value of the trap smoothing factor in step two; 2. Increase the proportion of padding data splicing in step four. After adjusting the parameters, repeat steps two to seven until the model can maintain the same performance as M in a low-perturbation adversarial attack environment during combined tests. compare Similar adversarial training provides robustness, while also exhibiting high adversarial sample detection capability under perturbation, especially in highly perturbation adversarial environments.

[0027] The above process enables a data-filling-based adversarial training method for deep neural network image classification models, as shown in the flowchart below. Figure 1 As shown in the figure, this method mainly includes a padding data generation method to augment adversarial training data, using the newly generated padding data as the basis for adversarial example detection; simultaneously, it proposes a trap-based smoothing loss function, which can optimize the data manifold within the original data while establishing an induced relationship between the target data manifold and the distribution of padding data, thereby improving the detection strength of adversarial examples. After optimization, the target model can maintain the defense provided by adversarial training in a low-perturbation space, while enjoying additional adversarial example detection defense in a global perturbation space.

[0028] In experiments based on the MNIST dataset, convolutional neural networks (CNNs) were used. 1 Experiments and analyses were conducted. The network structure was: Conv(16,4,4)+ReLU, Conv(32,4,4)+ReLU, FC(100), FC. Conv represents convolutional layers, and FC represents fully connected layers. The experimental results were then transferred to the ResNet-18 model to further analyze its patterns and verify its effectiveness. In the specific experiments, an upper limit was set for the perturbation of adversarial training. The perturbation size of the adversarial example is increased by 0.1 steps. In the PGD adversarial attack, the attack iteration count is set to 40, and the perturbation size is set to 0.01 in each iteration (selected). -norm instead -norm is used to generate PGD adversarial examples because it is known during the experiment. The PGD adversarial examples generated by -norm are significantly more aggressive than -Adversarial examples generated by norm. In the C&W adversarial attack, the constant term c is initialized to 1, and its upper limit is set to 1e10 for dynamic transformation of the binary search. The number of binary search steps is set to 5, and the maximum number of iterations is 1000.

[0029]

[0030] Table 1 presents the complete white-box test results. This includes nine different adversarial attack methods: , , , (This represents PGD attacks with different perturbation sizes and a cycle count of 40. T indicates a targeted attack, the default attack label is 2, and U indicates an untargeted attack.) , , , (This represents a C&W counterattack with 5 restarts and 1000 loops, where the default upper limit of the constant term 'c' is 1e10, CW) padding This is a powerful adversarial attack method comprised of multiple adversarial attack techniques, including APGD-CE, APGD-DLR, FAB, and the black-box attack method Square, designed for adaptive and automatic attacks (AA) in padding-based adversarial training. The default perturbation size for adversarial training is 0.3. Unlike other adversarial training methods, padding-based adversarial training demonstrates accuracy before and after detection.

[0031] Table 1 shows that padding adversarial training results in minimal loss or maintains the robustness provided by standard adversarial training under low perturbation conditions (default ε=0.3, set by the adversarial training phase). However, it provides an extremely high adversarial sample detection rate under high perturbation conditions (ε=0.6). Correspondingly, in targeted attack scenarios, almost all adversarial training methods exhibit good adversarial robustness under low perturbation conditions, while under high perturbation conditions, all adversarial training defense methods, including padding adversarial training, are very vulnerable. To investigate the reasons for this experimental phenomenon, a comparative experiment was conducted using a targeted FGSM attack under high perturbation conditions.

[0032]

[0033] To further validate the effectiveness and generalization of padding adversarial training, the experimental results obtained from the MNIST experiments were transferred to the CIFAR-10 and Tiny-ImageNet datasets, as well as to network models with different architectures. As shown in Table 2, the experimental results on CIFAR-10 significantly improve the model's adversarial robustness across various perturbation ranges, especially in the high-perturbation range. Furthermore, padding adversarial training provides additional protection against adversarial example detection. The detection rate of padding adversarial training peaks when the perturbation is sufficiently large. For example, in CIFAR-10, when ε=64 / 255, the accuracy of GoogLeNet before adversarial example detection approaches 0, while the adversarial example detection rate reaches 92.4%.

[0034]

[0035] Table 3 shows the robustness of standard PGD adversarial training and the padding adversarial training method based on PGD adversarial training when facing PGD adversarial training with 40 iterations using the Tiny-ImageNet dataset. As shown in Table 3, the model exhibits similar adversarial defense performance to MNIST and CIFAR-10 under both low-perturbation (ε=8 / 255) and high-perturbation (ε=16 / 255) conditions.

[0036] Table 4 shows the defensive performance of this method against black-box attacks. Where M... native Indicates a CNN under normal training 1 Network model, M FGSM-AT and M PGD-AT This indicates the CNN after undergoing FGSM adversarial training and PGD adversarial training. 1 Network model, M P-AT(FGSM) This indicates a CNN trained using padding adversarial training based on FGSM. 1 Network model, M native and M res_pgd The images show the ResNet-18 network model trained normally and the ResNet-18 network model trained using PGD adversarial methods. Padded adversarial training maintains adversarial robustness similar to standard adversarial training under low perturbation conditions and exhibits extremely high adversarial example detection efficiency under high perturbation conditions. Furthermore, under the same experimental conditions, the pre-detection accuracy of padded adversarial training is lower than that of standard adversarial training across all categories. This phenomenon indicates that, with the help of trap smoothing, the data distribution of each target category becomes more cohesive. The resulting empty feature space is then occupied by the padded class data. This phenomenon is particularly pronounced under high perturbation conditions.

[0037]

[0038] In summary, this method can provide the model with additional protection against adversarial sample detection in both white-box and black-box attack scenarios without compromising or even enhancing the robustness provided by traditional adversarial training.

Claims

1. A data-filling-based adversarial training method for deep neural network image classification models, characterized by the following steps: Step 1: To improve the robustness of the target deep neural network image classification model, a pre-trained deep neural network image classification model applied to specific tasks is selected as the target model M. Next, the target model M is modified by expanding the output layer of the target model M with k output categories. The final model M is... plus The number of output layer categories is k+1; Step 2: Establish a trap-based smoothing loss function to optimize the target manifold distribution and establish the induced relationship between the target manifold and the filling class distribution, as shown in formula (1), where q is the total number of classes in the model and α is the trap induction factor. and These are the output vectors belonging to the clean and filled categories in the total output vector, respectively. This is the original one-hot type output vector. and Represent The original output vectors that belong to the clean and filled categories, size( ) represents a vector The number of elements, and the final output is the number of elements. and The concatenated output vector y, specifically: the trap-style smoothing loss function uses the default one-hot output vector for the label vectors belonging to the filler category, and applies formula (1) to the label vectors belonging to the original target category. and Process them separately, among which... The target class's smoothed α probability is then assigned to all original classes in a uniform distribution. ,right Assign a probability to each filler class Finally, the smoothed and The concatenated vector is used as the label vector and the model output x is calculated using the cross-entropy loss function; （1） Step 3: Select a basic adversarial training method. For each mini-batch training set, generate corresponding padding data using the padding data generation method shown in formula (2), where x adv For adversarial examples, the `random()` function returns random numbers in the same format as the input data `data` and conform to a normal distribution. The `sign()` function assigns the perturbation a positive or negative value based on the sign of the parameter. This represents the one-dimensional linear interpolation function `interp()`, which dynamically adjusts the size of the perturbation vector based on the cycle number `epoch`, the current cycle number, and the total cycle number `epoch`. It uses the standard deviation of the training data (`std`) as the minimum value of the linear interpolation, and uses the hyperparameter `β` to regularize the initial interpolation value. It also uses the data-standardized upper bound `x`. max As the maximum value of the linear interpolation, and using hyperparameters As a control parameter for generating populated class data; （2） Step 4: Based on the pixel size of the image dataset and the model size, manually and dynamically select the proportion parameter of padding data used for adversarial training in each mini-batch. Using this proportion, the padding data is concatenated with adversarial examples and participates in the retraining process of adversarial training. Specifically: the larger the image pixel size, the lower the proportion parameter of padding data used for adversarial training in each mini-batch. The data category of the newly generated padding data is k+1. Step 5: Use the early stopping mechanism to test model M plus Adversarial training is performed. Specifically, the model's historical best accuracy in adversarial attack testing is updated in each loop. When the current training loop ends, the accuracy of the updated model in the same adversarial attack testing method is compared with the historical best accuracy. If the model accuracy in the current loop is lower than the historical best accuracy and exceeds the threshold, the model training is stopped and the model parameters are saved. Specifically, the default value of the threshold is 0.

1. Step Six: Test the model parameters saved in Step Five using different adversarial attack methods. Adjust the trap smoothing factor in Step Two and the parameter β in the data generation method for filling in the data in Step Three based on the test results. And conduct parameter optimization experiments on the proportional parameters in step four, specifically: when model M plus When the accuracy provided by adversarial training cannot be maintained in a low-perturbation adversarial attack environment, reduce the size of the trap-type smoothing factor, increase β in step three to increase the initial distance of the padding class data generation method, and reduce the value in step three. To reduce the intrusion of the filling data on the target manifold and to reduce the splicing ratio parameter in each iteration of the filling data in step four, when model M plus When adversarial sample detection performs poorly in high-perturbation adversarial attack environments, the size of the trap-type smoothing factor should be appropriately increased, β in step three should be decreased to expand the generation search space of the padding data, and the splicing ratio parameter of the padding data in each iteration of step four should be increased. When model M plus When the robustness of model M can maintain the adversarial robustness provided by adversarial training under low-perturbation attack conditions and provide detection and defense against adversarial examples under global perturbation, the robustness improvement of model M achieves the expected effect of the algorithm.

Images