A method to improve the adversarial robustness of deep networks based on sample separation

Abstract

The present invention discloses a method for improving the adversarial robustness of a deep network based on sample separation, comprising training a classification neural network on a data set; attacking the neural network with a given method to obtain X fail and X adv ; Based on GLCM, calculate E fail and E adv Then remove outliers based on the box plot; draw E fail and E adv The frequency histogram of ; the sample is divided into two parts, Z fail and Z adv ; Retrain the neural network; for Z fail and Z adv Two loss functions #imgabs0# and #imgabs1# are used respectively and the L1 norm of the weight of the first convolutional layer is introduced; the neural network is trained by minimizing the total loss; the present invention improves the adversarial robustness and sacrifices the prediction accuracy of the network on clean samples as little as possible.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet image data, and in particular to a method for improving adversarial robustness of a deep network based on sample separation. Background Art

[0002] Adversarial samples are samples designed by the attacker to add slight perturbations to the original clean samples so that the model that can be correctly classified will produce incorrect outputs. Given a supervised dataset The following set is used to represent adversarial examples:

[0003] S(x)={x+δ|f θ (x+δ)≠f θ (x),f θ (x)=y,||δ|| p ≤ε}

[0004] Where x is a clean sample, δ represents the L p norm-restricted perturbation, x+δ is an adversarial sample, f θ represents a classifier with parameter θ, y is the true label of x, and ε is the upper bound of the perturbation. Adversarial robustness refers to the ability of the model to resist adversarial samples.

[0005] There are various theoretical explanations for the existence of adversarial examples. [1] demonstrated that the phenomenon of adversarial examples can be attributed to the presence of non-robust features in standard datasets: these features are highly predictive but fragile and difficult for humans to understand. These features help models perform classification in standard settings but may hinder the classification accuracy of models under adversarial attacks. Robust features are defined as those that remain useful under attack. Image classification involves both robust and non-robust features. In standard training, classifiers rely primarily on non-robust features to maximize classification accuracy.

[0006] Regarding adversarial defense, that is, improving the adversarial robustness of neural network models, the most important strategy at present is adversarial training[2]. First, a model is pre-trained with clean samples, adversarial samples are generated using this model, and then the final network is trained based on the generated adversarial samples.

[0007] Wang et al. [3] calculated the gray-level co-occurrence matrix (GLCM) texture features and statistical features of the unnormalized saliency map of the sample and found that these features of adversarial samples and clean samples were significantly different. Therefore, a method for detecting adversarial samples was proposed. At each convolutional layer of the network, the texture features and statistical features of the unnormalized saliency map of the clean sample and the adversarial sample were calculated and used to train the detector.

[0008] Adversarial training first pre-trains a model with clean samples, uses the model to generate adversarial samples, and then trains the final network based on the generated adversarial samples.

[0009] This method has the following defects: adversarial training takes a long time to run, and while improving the adversarial robustness of the neural network, it will sacrifice the network's prediction accuracy on clean samples.

[0010] [1] A.Ilyas, S.Santurkar, D.Tsipras, L.Engstrom, B.Tran, and A.Madry, "Adversarial examples are not bugs, they are features," Advances in neuralinformation processing systems, vol.32, 2019.

[0011] [2]IJGoodfellow, J.Shlens, and C.Szegedy, "Explaining and harnessingadversarial examples," in 3rd International Conference on LearningRepresentations,ICLR 2015, San Diego, CA, USA, 2015.

[0012] [3] S. Wang and Y. Gong, “Adversarial example detection based on saliencymap features,” Applied Intelligence, pp. 1–14, 2022. Summary of the invention

[0013] In order to solve the problems existing in the prior art, the purpose of the present invention is to provide a method for improving the adversarial robustness of deep networks based on sample separation. The present invention improves the adversarial robustness and sacrifices the prediction accuracy of the network on clean samples as little as possible.

[0014] To achieve the above purpose, the technical solution adopted by the present invention is: a method for improving the adversarial robustness of a deep network based on sample separation, comprising: separating samples into two categories, and then designing a new loss function training model: calculating the loss function for the two categories of samples respectively and adjusting the weights, and then introducing the L1 norm of the weights of the first convolutional layer into the loss function; specifically comprising the following steps:

[0015] Step 1: Train a classification neural network on a dataset {(X,y)} containing samples and labels;

[0016] Step 2: Use the given method M to attack the classification neural network and obtain the sample X' where the attack fails fail And the sample X' of successful attack adv , the sample X' where the attack fails fail And the sample X' of successful attack adv The corresponding clean samples are denoted as and X respectively. fail and X adv ;

[0017] Step 3: Take the distance d = 1, the direction θ = 0°, 45°, 90°, 135°, and calculate X based on the gray level co-occurrence matrix GLCM. fail and X adv The entropy of , and then take the mean, and denote it as E fail and E adv ; Remove outliers based on the box plot; Draw E fail and E adv Frequency histogram of ;

[0018] Step 4: The number of intervals of the frequency histogram is recorded as N, E fail The frequency is f i (i=1...N), E adv The frequency is s j (j=1...N); where f i >s i The interval set (i=1...N) is denoted as A M =(a, b); then divide the sample into two parts, and take the entropy value belonging to A M The image is defined as an image Z that is not easy to become an adversarial sample fail , the remaining images are images Z that are easy to be attacked successfully adv ;

[0019] Step 5: Retrain the neural network g: fail and Z adv Use two loss functions respectively and And introduce the L1 norm of the first convolutional layer weights; train the neural network by minimizing the total loss:

[0020]

[0021] Where λ is a hyperparameter and the coefficient α is defined as:

[0022]

[0023] The beneficial effects of the present invention are:

[0024] The purpose of separating samples in the present invention is to help the model learn robust features and improve adversarial robustness by allowing the model to strengthen learning on images that are not easily attacked as adversarial samples, while sacrificing the network's prediction accuracy on clean samples as little as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A framework diagram of an embodiment of the present invention DETAILED DESCRIPTION

[0026] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0027] Example 1

[0028] like Figure 1 As shown in the figure, a method for improving the adversarial robustness of deep networks based on sample separation is presented. First, the samples are separated into two categories, and then a new loss function training model is designed: the loss function is calculated and the weights are adjusted for the two categories of samples respectively, and then the L1 norm of the weights of the first convolutional layer is introduced (compared with the standard model, most of the weights of the first convolutional layer of the model obtained by calculating the loss function and adjusting the weights for the two categories of samples are larger in absolute value. Based on this feature of the model, the norm of the first convolutional layer weights is introduced into the loss function to enhance the effect of the model on improving adversarial robustness).

[0029] The specific steps are as follows:

[0030] (1) Train a classification neural network on a dataset {(X, y)} containing samples and labels.

[0031] (2) Use the given method M to attack the neural network and obtain the sample X′ where the attack fails fail And the sample X′ with successful attack adv , and their corresponding clean samples are recorded as and X respectively. fail and X adv .

[0032] (3) Take distance d = 1, direction θ = 0°, 45°, 90°, 135°, and calculate X based on GLCM respectively fail and X adv The entropy of , and then take the mean, and denote it as E fail and E adv . Remove outliers based on the box plot. Draw E fail and E adv The frequency histogram of .

[0033] (4) The number of intervals in the histogram is denoted by N, E fail The frequency is f i (i=1...N), Eadv The frequency is s j (j=1...N). Where, f i >s i The interval set (i=1...N) is denoted as A M =(a, b). Then the sample is divided into two parts. We take the entropy value belonging to A M The image is defined as an image Z that is not easy to become an adversarial sample fail , the remaining images are images Z that are easy to be attacked successfully adv .

[0034] (5) Retrain the neural network g. fail and Z adv Use two loss functions respectively and And introduce the L1 norm of the first convolutional layer weights. The neural network is trained by minimizing the total loss:

[0035]

[0036] Where λ is a hyperparameter and the coefficient α is defined as:

[0037]

[0038] Table 1 MNIST: Accuracy of the standard model and the model in this embodiment

[0039]

[0040] The samples are divided into Z under four attacks FGSM, BIM, MIM and PGD respectively. fail and Z adv , where A FGSM =(0.43,0.53),(0.83,1.13),(1.23,1.33),A BIM =(0.83,1.18), A MIM =(0.82,1.17), A PGD =(0.88,1.18).

[0041] Table 2 Fashion-MNIST: Accuracy of the standard model and the model of this embodiment

[0042]

[0043] The samples are divided into Z under four attacks FGSM, BIM, MIM and PGD respectively. fail and Z adv , where A FGSM =(1.11,1.56), A BIM=(2.01,2.91),A MIM =(2.16,2.91),A PGD =(2.16,2.76).

[0044] Table 3 CIFAR10: Accuracy of the standard model and the model of this embodiment

[0045]

[0046] The samples are divided into Z under four attacks: FGSM, BIM, MIM and PGD. fail and Z adv , where A FGSM =(2.33,2.58),(3.03,3.28),A BIM =(2.33,2.63),(3.13,3.28),A MIM =(2.32,2.62),(2.67,2.77),(2.87,2.92),(2.97,3.02),(3.12,3.17),(3.22,3.27),A PGD =(2.32,2.42),(2.47,2.52),(2.57,2.62),(2.67,2.77),(2.97,3.02),(3.12,3.17),(3.22,3.27

[0047] As can be seen from Tables 1-3, for the three data sets, under all attack methods, the model of this embodiment has higher classification accuracy than the standard model. In other words, the model of this embodiment achieves stronger adversarial robustness. In addition, the model of this embodiment sacrifices less prediction accuracy on clean samples, especially the MNIST and Fashion-MNIST data sets.

[0048] Table 4 MNIST: Comparison of classification accuracy of several defense methods under four attacks

[0049]

[0050] Table 5 Fashion MNIST: Comparison of classification accuracy of several defense methods under four attacks

[0051]

[0052] Table 6 CIFAR10: Comparison of classification accuracy of several defense methods under four attacks

[0053]

[0054] The method of this embodiment is compared with some recently proposed defense methods Min-Max, Randomization, SIGR, and PCL. The method with the highest classification accuracy under most attacks is selected as the representative method of this embodiment. As can be seen from Tables 4-6, for the MNIST and Fasion-MNIST datasets, the accuracy of the method of this embodiment on clean samples is comparable to that of other methods. In the presence of adversarial attacks, the performance of this method is better than other defense methods. For the CIFAR10 dataset, this method is only better than the Min-Max method under all attacks. This result proves that the method of this embodiment is more suitable for relatively simple datasets.

[0055] Example 2

[0056] For example Figure 1 As shown, a method for improving the adversarial robustness of a deep network based on sample separation includes:

[0057] (1) Train a classification neural network on the MNIST dataset.

[0058] (2) Use the PGD method to attack the neural network and obtain the sample X′ where the attack fails fail And the sample X′ with successful attack adv , and their corresponding clean samples are recorded as and X respectively. fail and X adv .

[0059] (3) Take distance d = 1, direction θ = 0°, 45°, 90°, 135°, and calculate X based on GLCM respectively fail and X adv The entropy of , and then take the mean, and denote it as E fail and E adv . Remove outliers based on the box plot. Draw E fail and E adv The frequency histogram of .

[0060] (4) The number of intervals in the histogram is 20, E fail The frequency is f i (i=1...20), E adv The frequency is s j (j=1...20). Where, f i >s i The interval set of (i=1...20) is A M =(0.88, 1.18). Then divide the sample into two parts. Define the image whose entropy value belongs to (0.88, 1.18) as the image Z that is not easy to become an adversarial sample fail , the remaining images are images Z that are easy to be attacked successfully adv .

[0061] (5) Retrain the neural network g. fail and Z adv Use two loss functions respectively and And introduce the L1 norm of the weights of the first convolutional layer. Calculate the coefficient α: α = 1 + 10 × 0.52 = 6.2. Train the neural network by minimizing the total loss:

[0062]

[0063] 10 of them -4 Obtained through parameter adjustment.

[0064] The experimental results are shown in Table 7. Under all attack methods, the model of this embodiment has a higher classification accuracy than the standard model. In other words, the model of this embodiment achieves stronger adversarial robustness. In addition, the model of this embodiment sacrifices less prediction accuracy on clean samples.

[0065] Table 7 MNIST: Accuracy of the standard model and the model of this embodiment

[0066]

[0067] Under PGD attack, the samples are divided into Z fail and Z adv , where A PGD =(0.88,1.18).

[0068] According to the experimental results in Table 7, under all attack methods, the model of this embodiment has a higher classification accuracy than the standard model. In other words, the model of this embodiment achieves stronger adversarial robustness. In addition, the model of this embodiment sacrifices less prediction accuracy on clean samples.

[0069] The above-mentioned embodiments only express the specific implementation of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A method for improving the adversarial robustness of deep networks based on sample separation, characterized in that: include: Separate the samples into two categories, and then design a new loss function training model: calculate the loss function for the two categories of samples and adjust the weights, and then introduce the L1 norm of the first convolutional layer weights into the loss function; specifically, the following steps are included: Step 1: Train a classification neural network on a dataset {(X, y)} containing samples and labels; Step 2: Use the given method M to attack the classification neural network and obtain the sample X′ where the attack fails fail And the sample X′ with successful attack adv , the sample X′ where the attack fails fail And the sample X′ with successful attack adv The corresponding clean samples are denoted as and X respectively. fail and X adv ; Step 3: Take the distance d = 1, the direction θ = 0°, 45°, 90°, 135°, and calculate X based on the gray level co-occurrence matrix GLCM. fail and X adv The entropy of , and then take the mean, and denote it as E fail and E adv ; Remove outliers based on the box plot; Draw E fail and E adv Frequency histogram of ; Step 4: The number of intervals of the frequency histogram is recorded as N, E fail The frequency is f i (i=1…N), E adv The frequency is s j (j=1…N); where f i >s i The interval set (i=1…N) is denoted as A M =(a, b); then divide the sample into two parts, and take the entropy value belonging to A M The image is defined as an image Z that is not easy to become an adversarial sample fail , the remaining images are images Z that are easy to be attacked successfully adv ; Step 5: Retrain the neural network g: fail and Z adv Use two loss functions respectively and And introduce the L1 norm of the first convolutional layer weights; train the neural network by minimizing the total loss: Where λ is a hyperparameter and the coefficient α is defined as:

Images