An Adversarial Training Method Based on Visual Transformation and Feature Robustness

Abstract

The present invention discloses an adversarial training method based on visual transformation and feature robustness, and constructs a visual image adversarial training framework VTFR, which mainly includes two parts: a visual transformation module (VT) and a feature robustness (FR) loss function; the visual transformation module (VT) strengthens the main information in the image by preprocessing the image, and weakens the background information and eliminates disturbance noise. The feature robustness (FR) loss function enhances the anti-disturbance ability of the network feature extraction part by constraining the feature similarity of the network on similar images. The visual image adversarial training framework can greatly improve the performance of the model on adversarial samples, and improve its adversarial robustness and generalization ability.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning technology, and specifically relates to an adversarial training method based on visual transformation and feature robustness. Background Art

[0002] Deep neural networks (DNNs) have demonstrated remarkable achievements in a range of fields, with increasingly diverse applications, such as computer vision, speech recognition, and natural language processing. However, neural networks face a security concern: they are easily fooled by adversarial examples. Adversarial examples are special inputs designed to trick a neural network into producing incorrect outputs. This attack can be achieved by making subtle modifications to the original data that are barely noticeable to humans but have a significant impact on the neural network. Adversarial attacks can cause neural networks to make incorrect decisions in the real world, posing serious risks to humans. The vulnerability of DNNs has led to concerns about the security of artificial intelligence. Improving the robustness of DNNs to adversarial examples has become increasingly important, posing new challenges to the application of deep learning.

[0003] Numerous defense techniques have emerged to enhance the adversarial robustness of DNNs. Adversarial training is widely considered by the academic community to be the most powerful defense strategy against adversarial attacks. The main concept of adversarial training is to expose the DNN to adversarial examples during training in order to gain immunity to adversarial examples. However, over-utilizing examples from the training set in adversarial training can cause the DNN to be overfitted. This means that the DNN performs particularly well when faced with adversarial examples from the training set, but when encountering adversarial examples from the test set that the DNN has never seen before, the performance will degrade significantly. This shows that adversarial training cannot completely solve the vulnerability of DNNs, and adversarial attacks still represent a serious threat to DNNs.

[0004] The process of deep learning adversarial training includes the following steps:

[0005] 1. Generate adversarial samples: During the training process, researchers generate adversarial samples that are generated by making slight modifications to the original data. These modifications are usually targeted at specific neural networks to make them produce incorrect outputs.

[0006] 2. Adding adversarial examples to training data: Generated adversarial examples are added to the training data and used together with the original data to train the neural network. This allows the neural network to better learn how to identify and classify adversarial examples, thereby improving its robustness.

[0007] 3. Retraining the neural network: After adding adversarial samples, researchers will retrain the neural network to make it better able to resist adversarial attacks.

[0008] This process may require multiple iterations to achieve the best results.

[0009] Improvements to existing adversarial training algorithms primarily focus on steps one and three. Step one involves using different adversarial attack algorithms to generate adversarial examples, and using the same algorithm to generate adversarial examples of varying strengths for adversarial training. Step three involves designing more effective loss functions to train the network.

[0010] To improve the robustness and generalization of DNNs, recent work has refined adversarial training methods from various perspectives, such as terminating training early, optimizing loss functions, improving adversarial example generation models, and optimizing parameter update strategies. While existing methods have made significant progress in enhancing robustness and generalization, these improvements have not focused on the network's regions of interest. It is well known that the foreground and background in an image should contribute differently to classification tasks, yet the network assigns equal importance to every pixel in the image. This, to a certain extent, limits the robustness and generalization capabilities of DNNs.

[0011] Research has shown that DNNs can learn both stable and unstable features during training, with unstable features leading to poor robustness. In contrast, small perturbations of visual stimuli appear to have little impact on the robustness of human vision. This may be attributed to the sampling mechanism of the human visual system. The uneven distribution of cones in the retina leads to uneven spatial sampling of visual stimuli. The sampling density is highest at the fixation point in the image and decreases with distance from the fixation point. This non-uniform sampling enables the human visual system to achieve greater robustness, focusing attention on key areas, thereby improving focus on the target and reducing background influence. In contrast, in DNN networks, the same convolution kernel is used to indiscriminately convolve all pixels in a sample. This mechanism means that DNNs assign equal importance to every pixel in a sample, which may lead them to learn unstable features, resulting in poor robustness and generalization.

[0012] In summary, the shortcomings of the prior art are:

[0013] (1) During adversarial training, the model may overfit due to excessive use of training set samples.

[0014] (2) There are few methods that attempt to improve adversarial training by enhancing key areas of samples. Summary of the Invention

[0015] In order to overcome the shortcomings of the prior art, the present invention provides an adversarial training method based on visual transformation and feature robustness, and constructs a visual image adversarial training framework VTFR, which mainly includes two parts: a visual transformation module (VT) and a feature robustness (FR) loss function; the visual transformation module (VT) preprocesses the image to enhance the main information in the image, weaken the background information and eliminate disturbance noise. The feature robustness (FR) loss function enhances the anti-disturbance ability of the network feature extraction part by constraining the feature similarity of the network on similar images. The visual image adversarial training framework can greatly improve the performance of the model on adversarial samples, and improve its adversarial robustness and generalization ability.

[0016] The technical solution adopted by the present invention to solve the technical problem includes the following steps:

[0017] Step 1: Build a neural network model f1 and train it on the training dataset Conduct training on

[0018] Step 2: Build the neural network model f2 and perform random initialization;

[0019] Step 3: Training dataset for neural network model Generate an adversarial sample dataset on the neural network model f2 using the PGD adversarial attack algorithm

[0020] Step 4: Train the dataset and adversarial sample datasets Perform visual transformation to obtain a dataset for training and

[0021] Step 5: and Paired input neural network model f2 is used for training, and the classification loss of adversarial samples and the feature loss between adversarial samples and clean samples are calculated respectively. The parameters of the neural network model f2 are updated using these two parts of loss and calculated gradients.

[0022] Step 6: Determine whether the neural network converges. If not, jump back to step 3. Otherwise, output the neural network to obtain a neural network model f2 that is robust to adversarial training.

[0023] Preferably, the PGD anti-attack algorithm is specifically expressed as:

[0024]

[0025] Among them, α represents the single-step attack strength, sign() represents the sign function, projx,∈ () represents the projection function.

[0026] Preferably, the step 4 is specifically as follows:

[0027] Step 4-1: Training data set The Grad-CAM algorithm is used on the neural network model f1 to obtain the attention map of the image. The value of each pixel on the heat map is regarded as the weight of the position. The weighted sum of the positions of the entire image is used to obtain the center position of the object in the image.

[0028]

[0029]

[0030]

[0031] Among them, Z is the number of pixels in the feature map, y is the score of the label category, is the value of point (i, j) in the kth feature map, is the weight of the kth feature map, (x, y) is the center position of the object in the image;

[0032] Step 4-2: For the dataset and Non-uniform sampling is performed in a polar coordinate system with the center position as the coordinate origin;

[0033]

[0034] r k+1 =r k +d k

[0035] Among them, r 0 =0, c is the given sampling curvature, k=0,1,…,s-1, s is the input image size, m is the sampling density, that is, limiting the sampling boundary to the image boundary of the given sampling curvature, and h is the image height;

[0036] Step 4-3: For the dataset and Gaussian blur is performed around the obtained non-uniform sampling image to obtain the final image used for training;

[0037]

[0038]

[0039] Among them, d x ,d yRepresents the distance from (x, y) to the blurred pixel point, w(x, y) represents the pixel value weight, I represents the image after non-uniform sampling, I VT Represents the image after Gaussian blur; σ is a hyperparameter, and the degree of blur is controlled by controlling σ. When Gaussian blur is performed, the closer to the center of the object, the smaller σ.

[0040] Preferably, the classification loss and feature loss are respectively:

[0041]

[0042] L fea =L′(F(θ,x),F(θ,x))

[0043] L=L cla +L fea

[0044] Where CE is the cross entropy loss function, KL is the KL divergence loss function, x′ represents the adversarial sample, y and y′ represent the sample label and the prediction results of the adversarial sample, respectively, and F and F′ represent the high-dimensional features of the clean sample and adversarial sample extracted from the model, respectively.

[0045] The beneficial effects of the present invention are as follows:

[0046] The method of the present invention can greatly improve the network's recognition accuracy for adversarial samples and enhance the network's robustness and generalization ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is the overall framework diagram of the method of the present invention. DETAILED DESCRIPTION

[0048] The present invention will be further described below with reference to the accompanying drawings and examples.

[0049] Although the adversarial training algorithm enhances the resistance of neural networks to adversarial samples, it also causes serious overfitting problems in the model. In order to solve the problem of model overfitting caused by adversarial training, the present invention is inspired by the human visual system and proposes a visual image adversarial training framework to improve adversarial training with visual transformation and feature robustness, named VTFR. The framework mainly includes two parts: one is a visual transformation (VT) module for images, which strengthens the important areas of the sample through non-uniform sampling, weakens the background information, and destroys the interference information through Gaussian blur. The other module is the feature robustness (FR) loss function, which is used to enhance the generalization ability of the network. This module enables the deep network to extract similar high-dimensional features from similar samples by constraining the feature differences between adversarial samples and clean samples.

[0050] A robust adversarial training method based on visual transformation and feature robustness includes the following steps:

[0051] Step 1: Build a neural network model f1 and use it in the training data set Train on it and get a model f1 with good performance;

[0052] Step 2: Build the neural network model f2 and perform random initialization;

[0053] Step 3: Training data set for neural network model Generate an adversarial sample dataset on the network model f2 using the PGD adversarial attack algorithm

[0054] Step 4: Train the dataset and adversarial sample datasets Perform visual transformation to obtain a dataset for training and

[0055] Step 5: and Paired input network model f2 is used for training, and the classification loss of the adversarial sample and the feature loss between the adversarial sample and the clean sample are calculated respectively; these two parts of loss and the calculated gradient are used to update the parameters of the neural network model f2;

[0056] Step 6: Check whether the neural network converges. If not, jump back to step 2. Otherwise, output the neural network to obtain the neural network model f2 that is robust to adversarial training.

[0057] The PGD algorithm for generating adversarial samples in step 3 is specifically expressed as:

[0058]

[0059] Step 4 is broken down into:

[0060] 4-1. Clean samples The Grad-CAM algorithm is used on the neural network model f1 to obtain the attention map of the image. The value of each pixel on the heat map is regarded as the weight of the position. The weighted sum of the positions of the entire image is used to obtain the center position of the object in the image.

[0061]

[0062]

[0063]

[0064] 4-2. For the data set and Non-uniform sampling is performed in a polar coordinate system with the center position as the coordinate origin;

[0065]

[0066] r k+1 =r k +d k

[0067] 4-3. For the data set and Gaussian blur is performed around the obtained non-uniform sampling image to obtain the final image used for training;

[0068]

[0069]

[0070] The classification loss and feature loss mentioned in step 5 are:

[0071]

[0072] L fea =L′(F(θ,x),F(θ,x))

[0073] L=L cla +L fea Specific embodiment:

[0075] The method of the present invention is described by taking the application of the method of the present invention on the CIFAR-10 dataset as an example:

[0076] Step 1: Build a neural network model f1 and use it in the training data set Train on it and get a model f1 with good performance;

[0077] Step 2: Build the neural network model f2 and perform random initialization;

[0078] Step 3: Training data set for neural network model Generate an adversarial sample dataset on the network model f2 using the PGD adversarial attack algorithm The PGD attack parameters are ∈ = 8 / 255, α = 2 / 255, T = 10;

[0079] Step 4: and Paired input network model f2 is used for training, and the classification loss of the adversarial sample and the feature loss between the adversarial sample and the clean sample are calculated respectively; these two parts of loss and the calculated gradient are used to update the parameters of the neural network model f2;

[0080] Step 5: Check whether the neural network converges. If not, jump back to step 2. Otherwise, output the neural network to obtain a neural network model f2 that is robust to adversarial training.

Claims

1. A visual image adversarial training method based on visual transformation and feature robustness, characterized in that: The steps include: Step 1: Build a neural network model , and in the training dataset Conduct training on Step 2: Build a neural network model , and initialize randomly; Step 3: Training dataset for neural network model , through the PGD anti-attack algorithm, in the neural network model Generate adversarial sample datasets ; Step 4: Train the dataset and adversarial sample datasets Perform visual transformation to obtain a dataset for training and ; Step 4-1: Training data set In the neural network model The Grad-CAM algorithm is used to obtain the attention map of the image. The value of each pixel on the heat map is regarded as the weight of the position. The weighted sum of the positions of the entire image is used to obtain the center position of the object in the image. in, is the number of pixels in the feature map, y is the score of the label category, For the feature map points The value of For the The weight of the feature map, is the center position of the object in the image; Step 4-2: For the dataset and , non-uniform sampling is performed in a polar coordinate system with the center position as the coordinate origin; in, , For a given sampling curvature, is the input image size, is the sampling density, i.e. limiting the sampling boundary to the image boundary of a given sampling curvature, is the image height; Step 4-3: For the dataset and , Gaussian blur is performed around the obtained non-uniform sampling image to obtain the final image used for training; in, , Indicates from The distance to the blurred pixel, represents the pixel value weight, represents the image after non-uniform sampling, Represents the image after Gaussian blur; is a hyperparameter, which is controlled by To control the degree of blur, when Gaussian blur is performed, the closer to the center of the object, The smaller; Step 5: and Paired Input Neural Network Model For training, the classification loss of adversarial samples and the feature loss between adversarial samples and clean samples are calculated respectively; these two parts of loss and gradient are used to calculate the neural network model. Update the parameters of Step 6: Determine whether the neural network converges. If not, jump back to step 3. Otherwise, output the neural network to obtain a neural network model with adversarial robustness after training. .

2. A visual image adversarial training method based on visual transformation and feature robustness according to claim 1, characterized in that: The PGD anti-attack algorithm is specifically expressed as follows: in, Indicates the single-step attack strength. represents the symbolic function, Represents a projection function.

3. The visual image adversarial training method based on visual transformation and feature robustness according to claim 1, characterized in that: The classification loss and feature loss are: in, is the cross entropy loss function, is the KL divergence loss function, represents adversarial samples, y and Represent the sample labels and the prediction results of the adversarial samples, respectively. Represent the high-dimensional features of clean samples and adversarial samples extracted from the model, respectively.

Images