A hyperspectral adversarial sample defense method based on invariant feature extraction

Abstract

The application discloses a hyperspectral image anti-attack method based on invariant features, which comprises the following steps: step one, constructing a sample set; step two, pre-training a deep convolutional neural network classification model; step three, building an anti-attack model; step four, constructing a loss function of the anti-attack model; step five, iteratively training the anti-attack model; and step six, testing the trained anti-attack model. The anti-attack method can enhance the robustness of a convolutional neural network and improve the classification accuracy of a hyperspectral classification model against an anti-attack.

Description

Technical Field

[0001] This invention belongs to the field of image processing technology, specifically relating to a hyperspectral adversarial sample defense method based on invariant feature extraction. Background Technology

[0002] Deep neural networks have achieved remarkable success in image classification tasks, but they have been found to be very vulnerable to adversarial examples, causing classification models to misclassify. Adversarial examples involve adding a perturbation that is imperceptible to the human eye to a clean original sample, causing deep neural classification networks to produce incorrect predicted class labels with high confidence.

[0003] Numerous studies have shown that, in addition to deep neural networks in the natural image domain being threatened by adversarial examples, vulnerabilities of deep neural networks to adversarial examples have also been discovered in the remote sensing field. With the successful launch of numerous hyperspectral remote sensing satellites, the amount of hyperspectral remote sensing data has experienced explosive growth. Faced with such massive amounts of hyperspectral remote sensing data, the redundant spectral and texture information in hyperspectral images, coupled with the large number of spectra, makes it easier to hide perturbations and allows for a wider range of perturbations. Therefore, classification networks for hyperspectral images are more vulnerable to attacks than those for natural images.

[0004] In recent years, research has shown that adversarial examples can drastically degrade the classification performance of deep neural networks. To improve the robustness of deep neural network models, existing adversarial defense methods can be divided into four categories: First, adversarial detection, which detects whether an input image is a legitimate image or an adversarial example before it is sent to the classifier. Detected adversarial examples are perturbed and removed or otherwise processed before being re-entered into the classifier. Second, gradient masking, which trains a model with small gradients to make it robust to small changes in the input space. Typical gradient masking methods include adversarial training and defensive distillation. The main purpose of adversarial training is to enhance the robustness of the model by training on datasets containing both clean and adversarial images. However, a drawback is that the model generated by adversarial training is strongly coupled with the attack algorithm used; that is, retraining the model using adversarial training cannot produce a generalized model. Defensive distillation is a proactive defense. In learning distillation, the knowledge gained by a complex model is transferred to a simpler model after training on a defined dataset. The third is preprocessing techniques, which mainly emphasize the preprocessing techniques of adversarial defense. This involves transforming adversarial examples into legitimate examples before classification, such as by performing feature compression or image transformation on the input image. The fourth is changing the target model to weaken the attack capability, such as constructing a classifier set, which is an adversarial measure composed of two or more classification models. Each model compensates for the weaknesses that other models may have when classifying a given input image.

[0005] Current typical preprocessing methods involve reconstructing the input image using generative adversarial networks (GANs). However, the limited training samples in hyperspectral images can lead to training instability in GANs, resulting in low classification accuracy. Furthermore, existing defense methods are generally effective against specific types of attacks but ineffective against unknown types. Therefore, designing a robust defense method for hyperspectral images against unknown adversarial attacks remains a challenging problem. Summary of the Invention

[0006] The purpose of this invention is to provide a hyperspectral image adversarial defense method based on invariant features, which enhances the robustness of convolutional neural networks and improves the classification accuracy of hyperspectral classification models against adversarial attacks.

[0007] This invention employs the following technical solution: a hyperspectral adversarial sample defense method based on invariant feature extraction, the method comprising the following:

[0008] Step 1: Construct the sample set:

[0009] For each category in the sample set of hyperspectral images, multiple samples are randomly selected to form the initial training sample set, and the remaining samples form the test sample set;

[0010] Step 2: Pre-train a deep convolutional neural network classification model:

[0011] Step 3: Build an adversarial defense model:

[0012] The adversarial defense model consists of a perturbation decoupling network and a reconstruction network, with the output of the perturbation decoupling network serving as the input to the reconstruction network.

[0013] Step 4: Construct the loss function for the adversarial defense model:

[0014] The loss function of the adversarial defense model is: L = L pixel +βL attention +γL AIAF +κL HSIC (F);

[0015] Where: β, γ and κ are adjustment parameters, α and β are both set to 0.01, and k is 0.0001;

[0016] L pixel For pixel-guided reconstruction network loss; L attention For attention-guided reconstruction network loss; L AIAF Similarity loss for invariant features; L HSIC The independence between common features and specific perturbation features;

[0017] Step 5: Iteratively train the adversarial defense model:

[0018] The initial training sample set in step one is attacked using two different types of adversarial attack methods to obtain adversarial samples, forming a new training sample set. The adversarial samples from this new training sample set are simultaneously input into the perturbation decoupling network in step three, where they are decomposed into attack-invariant features x. AIAF and specific perturbation characteristics x SPF The two parts will yield the attack-invariant feature x. AIAF The input is fed into the decoding network of the reconstruction network to generate reconstructed samples of the same size as the input of the adversarial defense model. The adversarial defense model is trained iteratively until the set number of iterations is reached, and the trained adversarial defense model is obtained.

[0019] Step Six: Test the trained adversarial defense model:

[0020] The adversarial sample test set generated by the adversarial attack is input into the adversarial defense model trained in step five to generate reconstructed samples; the reconstructed samples are input into the pre-trained deep convolutional neural network classification model obtained in step two, and forward calculation is performed to obtain the predicted classification result of each sample in the test sample set.

[0021] Furthermore, the perturbation decoupling network includes an invariant feature extraction branch and two specific perturbation extraction branches, and the three extraction branches have the same convolutional neural network structure;

[0022] Furthermore, the reconstruction network includes a decoding network and a discriminator network. The decoding network is a deconvolutional structure of a perturbation decoupling network sub-branch, and the discriminator network consists of four convolutional layers and two fully connected layers.

[0023] Furthermore, in step five, the three sub-branches of the perturbation decoupling network operate as follows: one invariant feature extraction branch learns attack-invariant features in the input space of two different types of adversarial examples through a parameter sharing strategy, and two specific perturbation extraction branches learn specific perturbation features in the input space of two different types of adversarial examples that are independent of the attack-invariant features.

[0024] Furthermore, the loss function of the perturbation decoupling network is constructed: the similarity loss L, which is an invariant feature loss, is achieved using a similarity metric loss. AIAF The similarity measurement loss uses the mean squared error, as shown in formula (A):

[0025]

[0026] Assess the independence between common features and specific perturbation features, as shown in Equation (B):

[0027] L HSIC=(HSIC(F SPF1 F AIF1 ) +HSIC(F SPF2 F AIAF2 )) / 2 (B);

[0028] The pixel-guided reconstruction network loss is shown in Equation (C):

[0029]

[0030] The discriminator loss function is shown in equation (D):

[0031]

[0032] The attention-guided reconstruction network loss is shown in Equation (E):

[0033]

[0034] Wherein: F AIAF1 and F AIAF2 F refers to the output after two different types of adversarial sample inputs have passed through the invariant feature extraction branch. AIAF1 T and F T AIAF2 It is its corresponding transpose vector;

[0035] HSIC(F SPF1 ,F AIAF1 )=(n-1) -2 tr(RK SPF1 RK AIAF1 ), K SPF1 It is a Gram matrix. And R = I - (1 / n)ee T Let e ​​represent a column vector consisting entirely of 1s, and K... AIAF1 K AIAF2 K SPF2 With K SPF1 They have similar representations;

[0036] x′ Re is the reconstructed sample after the reconstruction network, x is a clean sample, which is a sample in the initial training sample set; the first term in equation (C) is the root mean square error constraint; the second term is the discriminator constraint, and D(·) is the discriminator with a binary classifier;

[0037] h is the attention extraction function. Where y c Output the probability of the true class in the probability of the target model; A k For the k-th feature map, choose A kThe features of the last convolutional layer in the pre-trained deep convolutional neural network classification model; g is a global average pooling function.

[0038] Furthermore, the sample set of the hyperspectral image is obtained as follows: the original hyperspectral image is reduced in dimensionality using PCA principal component analysis; a spatial window is defined with each labeled pixel in the dimensionality-reduced hyperspectral image as the center; all pixels within each spatial window are combined into a data cube; and all data cubes constitute the sample set of the hyperspectral image.

[0039] Furthermore, in step one, 900 samples are randomly selected from each category in the dataset to form the initial training sample set, and the remaining samples form the test sample set. If the number of samples in a category is less than 900, 50% of the total number of samples in that category is selected as the initial training sample set. For the Houston 2018 dataset, 400 samples are randomly selected from each category to form the initial training sample set, and the remaining samples form the test sample set. If the number of samples in a category is less than 400, 50% of the total number of samples in that category is selected.

[0040] The beneficial effects of this invention are: 1. By decomposing invariant and perturbation features in adversarial examples through a perturbation decoupling network, perturbation information in adversarial examples is eliminated. An attention-guided optimization strategy is designed to reduce attention shifts caused by perturbations, further improving the classification accuracy of reconstructed samples. 2. Invariant features are extracted from adversarial examples to resist attacks of known and unknown types, enhancing the robustness of convolutional neural networks and improving the classification accuracy of hyperspectral classification models against adversarial attacks. Attached Figure Description

[0041] Figure 1 Here is a flowchart of a hyperspectral image adversarial defense method based on invariant features;

[0042] Figure 2 The dataset and its real-world land cover classification map used in the examples are shown below:

[0043] 2a is the PaviaU dataset; 2b is the Houston 2018 dataset; 2c is the Salinas dataset;

[0044] Figure 3 The diagram shows the defense accuracy of the PaviaU dataset on the defense method in this invention using different attack methods, where:

[0045] 3a represents an FGSM attack; 3b represents a PGD attack; 3c represents a C&W attack; 3d represents an FGSM attack defended against by the method of this invention; 3e represents a PGD attack defended against by the method of this invention; 3f represents a C&W attack defended against by the method of this invention; 3g represents a real-world feature classification map; 3h represents a target model classification map.

[0046] Figure 4 The graph shows the defense accuracy of the Houston 2018 dataset on the defense method in this invention using different attack methods, where:

[0047] 4a is an FGSM attack; 4b is a PGD attack; 4c is a C&W attack; 4d is an FGSM attack defended against by the method of this invention; 4e is a PGD attack defended against by the method of this invention; 4f is a C&W attack defended against by the method of this invention; 4g is a real-world feature classification map; 4h is a target model classification map.

[0048] Figure 5 This is a defense accuracy map of the Salinas dataset on the defense method in this invention using different attack methods, wherein:

[0049] 5a represents an FGSM attack; 5b represents a PGD attack; 5c represents a C&W attack; 5d represents an FGSM attack defended against by the method of this invention; 5e represents a PGD attack defended against by the method of this invention; 5f represents a C&W attack defended against by the method of this invention; 5g represents a real-world feature classification map; and 5h represents a target model classification map. Detailed Implementation

[0050] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0051] This invention discloses a hyperspectral adversarial sample defense method based on invariant feature extraction, which can be applied to healthcare, meteorological monitoring, urban planning, and disaster prevention and mitigation, and includes the following steps:

[0052] Step 1: Construct the sample set:

[0053] The original hyperspectral image was reduced to 3 dimensionality using PCA principal component analysis. A 26×26 pixel spatial window was defined centered on each labeled pixel in the dimensionality-reduced hyperspectral image; all pixels within each spatial window were combined into a data cube; all data cubes were combined into a sample set of the hyperspectral image; multiple samples were randomly selected from each category in the sample set to form the initial training sample set, and the remaining samples formed the test sample set.

[0054] For the Houston 2018 dataset, 900 samples are randomly selected from each category to form the initial training sample set, and the remaining samples form the test sample set. If a category has fewer than 900 samples, 50% of the total number of samples in that category is selected as the training sample set.

[0055] Step 2: Pre-train a deep convolutional neural network classification model:

[0056] The deep convolutional neural network classification model consists of three convolutional layers and one fully connected layer. The parameters of each layer are determined according to the size of the input data. The first convolutional layer has a size of 3×3×32, the second has a size of 3×3×64, and the third has a size of 3×3×128. The first and second convolutional layers both use 2×2 max pooling operations with a stride of 1 and a padding of 1. Each convolutional layer uses the ReLU activation function and is normalized. The batch size is set to 128, the loss function is cross-entropy loss, the learning rate is set to 0.005, and the total number of iterations is set to 300.

[0057] Step 3: Build an adversarial defense model:

[0058] The adversarial defense model consists of a perturbation decoupling network and a reconstruction network, with the output of the perturbation decoupling network serving as the input of the reconstruction network.

[0059] The output x of the perturbation decoupling network AIAF As input to the reconstruction network, the input and output sizes of the reconstruction network are the same. Perturbations are removed by introducing pixel-level loss constraints and attention-guided loss constraints to recover the hyperspectral image. The reconstruction network is divided into pixel-level guided reconstruction and attention-guided reconstruction. Pixel-level guided reconstruction includes a decoding network and a discriminator network. Attention-guided reconstruction utilizes Grad-CAM to correct the attention shift problem in adversarial examples, constraining the similarity between clean samples and reconstructed samples on the attention map. The decoding network is a deconvolutional structure of the encoding network.

[0060] The perturbation decoupling network comprises one invariant feature extraction branch and two specific perturbation extraction branches. These three branches share the same convolutional neural network structure, consisting of four 2D convolutional layers and one fully connected layer. The kernel size is k = 3*3, the stride is s = 1, and the padding is p = 1. The reconstruction network includes a decoding network and a discriminator network. The decoding network is a deconvolutional structure of the perturbation decoupling network sub-branch. The discriminator network consists of four convolutional layers and two fully connected layers. The parameters of the first convolutional layer are: kernel size k = 4*4, stride s = 2, padding p = 2; the parameters of the second convolutional layer are: kernel size k = 2*2, stride s = 2, padding p = 1; and the parameters of the third and fourth convolutional layers are: kernel size k = 4*4, stride s = 2, padding p = 1.

[0061] Constructing the loss function for the adversarial defense model:

[0062] The loss function of the adversarial defense model is: L = L pixel +βL attention +γL AIAF +κLHSIC (F);

[0063] Where: β, γ and κ are adjustment parameters, α and β are both set to 0.01, and k is 0.0001;

[0064] L pixel For pixel-guided reconstruction network loss; L attention For attention-guided reconstruction network loss; L AIAF Similarity loss for invariant features; L HSIC The independence between common features and specific perturbation features;

[0065] To obtain the common AIAF features among different types of adversarial examples, the generalized AIAF features are obtained by averaging the output matrix of the CNN invariant feature extraction branch. As the number of network training iterations increases, F... AIAF1 and F AIAF2 The characteristics tend to be similar, resulting in AIAF with stronger denoising ability. The loss function of the perturbation decoupling network is constructed as follows: A similarity loss L is achieved using a similarity metric loss to realize invariant features. AIAF The similarity measurement loss uses the mean squared error, as shown in formula (A):

[0066]

[0067] Wherein: F AIAF1 and F AIAF2 F refers to the output after two different types of adversarial sample inputs have passed through the invariant feature extraction branch. AIAF1 T and F T AIAF2 It is its corresponding transpose vector;

[0068] To further eliminate the perturbation of the input adversarial examples, the two specific perturbation extraction branches are decoupled by adding independence loss. In order to ensure that the two branches can capture different feature information, HSIC (Hilbert-Schmidt independence criterion, an independence test criterion) is used to evaluate the independence between common features and specific perturbation features, as shown in Equation (B):

[0069] L HSIC =(HSIC(F SPF1 F AIAF1 ) +HSIC(F SPF2 F AIAF2 )) / 2 (B);

[0070] Among them, HSIC(F SPF1 ,F AIAF1 )=(n-1) -2 tr(RKSPF1 RK AIAF1 ), K SPF1 It is a Gram matrix. And R = I - (1 / n)ee T Let e ​​represent a column vector consisting entirely of 1s, and K... AIAF1 K AIAF2 K SPF2 With K SPF1 They have similar representations;

[0071] The pixel-guided reconstruction network loss is shown in Equation (C):

[0072]

[0073] Where: x′ Re is the reconstructed sample after the reconstruction network, x is the clean sample, which is a sample in the initial training sample set; the first term in equation (C) is the root mean square error (MSE) constraint, which eliminates the main perturbation information in the adversarial input to recover the original image; the second term is the discriminator constraint, D(·) is the discriminator with a binary classifier, which is designed to encourage the discriminator to distinguish the reconstructed sample as a "true" sample.

[0074] The discriminator loss function is shown in equation (D):

[0075]

[0076] The attention-guided reconstruction network loss is shown in Equation (E):

[0077]

[0078] Where h is the attention extraction function, Where y c Output the probability of the true class in the probability of the target model; A k For the k-th feature mapping, this invention selects A. k The features of the last convolutional layer in the pre-trained deep convolutional neural network classification model; g is a global average pooling function.

[0079] Step 5: Iteratively train the adversarial defense model:

[0080] The initial training sample set in step one is attacked using two different types of adversarial attack methods, FGSM and PGD, respectively, to obtain adversarial samples and form a new training sample set. The adversarial samples in this new training sample set are then simultaneously input into the perturbation decoupling network in step three, where they are decomposed into attack-invariant features x. AIAF and specific perturbation characteristics x SPF The two parts will yield the attack-invariant feature x. AIAFThe decoding network, input to the reconstruction network, generates reconstructed samples of the same size as the input to the adversarial defense model. The adversarial defense model is then iteratively trained until a set number of iterations is reached, resulting in a well-trained adversarial defense model. Specifically: first, the perturbation decoupling network loss L is calculated forward. AIAF and L HSIC Then, the network reconstruction loss L is calculated forward. pixel L Attention The entire defense network is trained iteratively until the preset number of iterations is reached, at which point the model converges and training stops.

[0081] Step Six: Test the trained adversarial defense model:

[0082] The adversarial sample test set generated by the adversarial attack is input into the adversarial defense model trained in step five to generate reconstructed samples; the reconstructed samples are input into the pre-trained deep convolutional neural network classification model obtained in step two, and forward calculation is performed to obtain the predicted classification result of each sample in the test sample set, thus completing the classification.

[0083] The following simulation experiments were conducted to further illustrate the effectiveness of the present invention: The hardware conditions for the simulation were: Windows XP, SPI, CPU Pentium(R)4, with a base frequency of 2.4GHz; the software platform was: Matlab R2016a, PyTorch.

[0084] The images used in the simulation were from the Pavia University hyperspectral image dataset, the Houston 2018 image dataset, and the Salinas hyperspectral dataset. The Pavia University image dataset contains nine land cover classes, such as... Figure 2 As shown in Figure 2a, the Houston 2018 dataset contains 20 types of land features, such as... Figure 2 As shown in Figure 2b, the Salinas dataset contains 16 land cover classes, such as... Figure 2 As shown in Figure 2b.

[0085] Simulation 1: Using the present invention and three other methods to... Figure 2 The three datasets shown were subjected to classification simulations, and the results are as follows: Figure 3 ,in:

[0086] Figure 3 Figures 3a to 3c show the classification results of the three attack methods, FGSM, PGD, and C&W, on the Pavia University image dataset. Figures 3d to 3f show the defense results of the proposed defense method against the above attack methods.

[0087] Figure 4Figures 4a to 4c show the classification results of the three attack methods, FGSM, PGD, and C&W, on the Houston 2018 image dataset. Figures 4d to 4f show the defense results of the proposed defense method against the above attack methods.

[0088] Figure 5 Figures 5a to 5c show the classification results of the three attack methods FGSM, PGD, and C&W on the Salinas image dataset, while figures 5d to 5f show the defense results of the proposed defense method against the above attack methods.

[0089] from Figures 3 to 5 The attack classification maps of the three adversarial examples were compared with the most realistic label classification map. Almost all adversarial examples were misclassified by the deep neural network classification model. However, the defense method proposed in this invention, compared with the realistic label classification map, correctly classified almost all land cover categories. The comparison of the results before and after defense shows that the defense method of this invention, as a preprocessing model, significantly improves the accuracy of the hyperspectral classification model without changing the parameters of the target model. Table 2 compares the defense method of this invention with three other defense methods. "No" indicates no defense strategy to resist adversarial attacks. The classification accuracy of adversarial examples generated by FGSM, C&W, and PGD is almost zero, indicating that adversarial examples pose a strong threat to the deep neural network classification model. In experiments using FGSM and PGD as known attacks and C&W as an unknown attack to generate adversarial examples, the defense method proposed in this invention achieved defense accuracies of 0.9517 and 0.7194 against adversarial examples generated by FGSM on the PaviaU and Houston 2018 datasets, respectively, achieving the best or second-best defense accuracy compared to the other three defense methods. The defense method proposed in this invention improves the defense accuracy against adversarial samples generated by C&W by 32.41%, 29.10%, and 22.55% on three datasets, respectively, demonstrating that the present invention significantly improves the defense accuracy against unknown types of attacks.

[0090] Table 1 Parameters of Convolutional Neural Networks

[0091]

[0092] Table 2. Numerical comparison of classification results between the method of this invention and existing methods.

[0093]

[0094]

[0095] Existing methods include adversarial training (AT), APE, and ARN.

[0096] The experimental results above show that, compared with existing technologies, this invention, based on hyperspectral image adversarial defense, can enhance the robustness of deep neural networks and improve the defense accuracy of hyperspectral classification models against known and unknown types of attacks.

Claims

1. A hyperspectral adversarial sample defense method based on invariant feature extraction, characterized in that, The method includes the following: Step 1: Construct the sample set: For each category in the sample set of hyperspectral images, multiple samples are randomly selected to form the initial training sample set, and the remaining samples form the test sample set; Step 2: Pre-train a deep convolutional neural network classification model: Step 3: Build an adversarial defense model: The adversarial defense model consists of a perturbation decoupling network and a reconstruction network, with the output of the perturbation decoupling network serving as the input of the reconstruction network. Step 4: Construct the loss function for the adversarial defense model: The loss function of the adversarial defense model is: L = L pixel +βL attention +γL AIAF +κL HSIC (F); Where: β, γ and κ are adjustment parameters, α and β are both set to 0.01, and k is 0.0001; L pixel For pixel-guided reconstruction network loss; L attention For attention-guided reconstruction network loss; L AIAF Similarity loss for invariant features; L HSIC The independence between common features and specific perturbation features; Step 5: Iteratively train the adversarial defense model: The initial training sample set in step one is attacked using two different types of adversarial attack methods to obtain adversarial samples, forming a new training sample set. The adversarial samples in this new training sample set are simultaneously input into the perturbation decoupling network in step three, where they are decomposed into attack-invariant features x. AIAF and specific perturbation characteristics x SPF The two parts will yield the attack-invariant feature x. AIAF The decoding network input to the reconstruction network generates reconstructed samples of the same size as the input to the adversarial defense model. The adversarial defense model is trained iteratively until the set number of iterations is reached, and the trained adversarial defense model is obtained. Step Six: Test the trained adversarial defense model: The adversarial sample test set generated by the adversarial attack is input into the adversarial defense model trained in step five to generate reconstructed samples; the reconstructed samples are input into the pre-trained deep convolutional neural network classification model obtained in step two, and forward calculation is performed to obtain the predicted classification result of each sample in the test sample set; Construct the loss function of the perturbation decoupling network: Utilize a similarity metric loss to achieve a similarity loss L for invariant features. AIAF The similarity measurement loss uses the mean squared error, as shown in formula (A): Assess the independence between common features and specific perturbation features, as shown in Equation (B): L HSIC =(HSIC(F SPF1 ,F AIAF1 )+HSIC(F SPF2 ,F AIAF2 )) / 2 (B); The pixel-guided reconstruction network loss is shown in Equation (C): The discriminator loss function is shown in equation (D): The attention-guided reconstruction network loss is shown in Equation (E): Wherein: F AIAF1 and F AIAF2 F refers to the output after two different types of adversarial sample inputs have passed through the invariant feature extraction branch. AIAF1 T and F T AIAF2 It is its corresponding transpose vector; HSIC(F SPF1 ,F AIAF1 )=(n-1) -2 tr(RK SPF1 RK AIAF1 ), K SPF1 It is a Gram matrix. And R = I - (1 / n)ee T Let e ​​represent a column vector consisting entirely of 1s, and K... AIAF1 K AIAF2 K SPF2 With K SPF1 They have similar representations; x′ Re is the reconstructed sample after the reconstruction network, x is a clean sample, which is a sample in the initial training sample set; the first term in equation (C) is the root mean square error constraint; the second term is the discriminator constraint, and D(·) is the discriminator with a binary classifier; h is the attention extraction function. Where y c Output the probability of the true class in the probability of the target model; A k For the k-th feature map, choose A k The features of the last convolutional layer in the pre-trained deep convolutional neural network classification model; g is a global average pooling function.

2. The hyperspectral adversarial sample defense method based on invariant feature extraction as described in claim 1, characterized in that, The perturbation decoupling network includes an invariant feature extraction branch and two specific perturbation extraction branches, and the three extraction branches have the same convolutional neural network structure.

3. A hyperspectral adversarial sample defense method based on invariant feature extraction as described in claim 1 or 2, characterized in that, The reconstruction network includes a decoding network and a discriminator network. The decoding network is a deconvolutional structure of a perturbation decoupling network sub-branch, and the discriminator network consists of four convolutional layers and two fully connected layers.

4. The hyperspectral adversarial sample defense method based on invariant feature extraction as described in claim 3, characterized in that, In step five, the three sub-branches of the perturbation decoupling network operate as follows: one invariant feature extraction branch learns attack-invariant features in the input space of two different types of adversarial examples through a parameter sharing strategy; and two specific perturbation extraction branches learn specific perturbation features in the input space of two different types of adversarial examples that are independent of the attack-invariant features.

5. The hyperspectral adversarial sample defense method based on invariant feature extraction as described in claim 4, characterized in that, The sample set of the hyperspectral image is obtained as follows: the original hyperspectral image is reduced in dimensionality using PCA principal component analysis, and a spatial window is defined with each labeled pixel in the dimensionality-reduced hyperspectral image as the center. All pixels in each spatial window are combined into a data cube, and all data cubes are combined into the sample set of the hyperspectral image.

6. The hyperspectral adversarial sample defense method based on invariant feature extraction as described in claim 5, characterized in that, In step one, 900 samples are randomly selected from each category in the dataset to form the initial training sample set, and the remaining samples form the test sample set. If a category has fewer than 900 samples, 50% of the total number of samples in that category is selected as the initial training sample set. For the Houston 2018 dataset, 400 samples are randomly selected from each category to form the initial training sample set, and the remaining samples form the test sample set. If a category has fewer than 400 samples, 50% of the total number of samples in that category is selected.

Images