Method and system for defense against deep neural network adversarial attacks based on adversarial networks

Abstract

Disclosed are a method and system for defense against deep neural network adversarial attack based on an adversarial network, comprising: building a deep neural network random adversarial attack module, the deep neural network random adversarial attack module comprising a plurality of parallel adversarial attack algorithms, and randomly performing adversarial attack noise on input images; building a differentiable frequency domain regularizer, the differentiable frequency domain regularizer performing regularizing processing on model output based on frequency domain information; building an adversarial defense network architecture, the adversarial defense network taking a generative adversarial network based on an encoding-decoding structure as a backbone network, and introducing the deep neural network random adversarial attack module and the differentiable frequency domain regularizer; collecting images in a natural scene, forming a training set and a verification set in proportion, and using the training set to train the adversarial defense network until loss convergence. The present application can significantly improve the defense capability of deep neural networks against adversarial attacks, and has good generalization performance for various adversarial attack methods.

Description

Technical Field

[0001] This invention relates to the technical field of deep neural network adversarial attack defense, and in particular to methods and systems for deep neural network adversarial attack defense based on adversarial networks. Background Technology

[0002] An adversarial attack refers to adding subtle perturbations to an input sample, causing a model that correctly judges the original sample to make an incorrect judgment. The added perturbation is called an adversarial perturbation, and the resulting sample is called an adversarial example. Adversarial attacks can be categorized by their attack method into white-box attacks, black-box attacks, targeted attacks, and non-targeted attacks. Because adversarial examples are often imperceptible to the human eye, yet can produce completely different results for deep neural networks, this greatly challenges the reliability of deep neural networks.

[0003] Adversarial attack defense methods can be mainly divided into three types: data modification, model modification, and the introduction of auxiliary tools. Data modification refers to improving the robustness of the network model during training through various methods such as data augmentation and data compression. Model modification refers to improving the model's ability to resist adversarial attacks through methods such as regularization and model distillation. Introducing auxiliary tools refers to using additional modules or tools to remove adversarial interference by guiding adversarial examples, thereby avoiding model misjudgments.

[0004] Existing adversarial attack defense technologies, primarily based on data correction and model modification, can only achieve defense under specific adversarial environment requirements and cannot be robust against all adversarial attacks. Introducing auxiliary tools to guide the removal of adversarial interference is prone to the loss of original sample information, and its defense success rate is often low.

[0005] As deep neural networks have achieved state-of-the-art performance in multiple fields, more and more applications and platforms are adopting deep neural network models. However, the lack of robustness of deep neural network models against adversarial attacks prevents their widespread deployment in various security domains. Summary of the Invention

[0006] To address the shortcomings of existing adversarial attack defense technologies, which primarily rely on data correction and model modification and can only defend against specific adversarial environments without being robust against all adversarial attacks, and the problem that introducing auxiliary tools to guide the removal of adversarial interference can easily lead to the loss of original sample information and has a low success rate, this invention proposes a deep neural network-based adversarial attack defense method and system to solve these technical problems.

[0007] According to a first aspect of the present invention, a deep neural network adversarial attack defense method based on adversarial networks is proposed, comprising:

[0008] S1: Build a deep neural network random adversarial attack module. The deep neural network random adversarial attack module includes multiple parallel adversarial attack algorithms that randomly add noise to the input image through adversarial attacks.

[0009] S2: Construct a differentiable frequency domain regularizer. The differentiable frequency domain regularizer performs regularization processing on the model output using frequency domain information.

[0010] S3: Build an adversarial defense network architecture. The adversarial defense network uses a generative adversarial network based on an encoding and decoding structure as the backbone network, and introduces a deep neural network random adversarial attack module and a differentiable frequency domain regularizer.

[0011] S4: Collect images from natural scenes, form training and validation sets according to proportions, and use the training set to train the adversarial defense network until the loss converges.

[0012] In some specific embodiments, adversarial attack algorithms include Fast Gradient Streaming (FGSM), AdverGAN, Deepfool, and Proximal Gradient Difference (PGD).

[0013] In some specific embodiments, a differentiable frequency domain regularizer is used to suppress high-frequency information and amplify low-frequency information.

[0014] In some specific embodiments, during the training process of the adversarial defense network architecture, the input image x is processed by the deep neural network random adversarial attack module to generate an adversarial attack image s. The adversarial attack image s is then fed into the generator G in the adversarial network. The encoder output in the generator G is regularized using a differentiable frequency domain regularizer to generate image G(s). The multi-scale discriminator D... k The image G(s) is compared with the input image x, and a pre-trained feature extractor F is used to further narrow the distance between the image G(s) and the input image x.

[0015] In some specific implementations, the ratio between the training set and the validation set is 10:1.

[0016] In some specific embodiments, the total loss function Where λ1, λ2, λ3, and λ4 are adjustable parameters that generate adversarial loss. Feature matching loss Perceived loss F represents the feature output of the i-th layer of the k-th discriminator. (i) M represents the i-th layer of the classifier i Each feature outputs a classification loss L. class (G, F) = -∑ i＝1 σ(F(x)) i log(σ(F(G(s))) i ), σ(.) i This represents the output label for the i-th class.

[0017] In some specific embodiments, the differentiable frequency domain regularization term is: in, Indicates Fourier transform, It is a low-pass filter. is a high-pass filter, and f represents the central region of the two-dimensional Fourier spectrum.

[0018] In some specific embodiments, a verification step is also included: collecting the adversarial attack image s′ and its original image x′, feeding them into the trained generator G to obtain the generated image G(s′); obtaining the discrimination results of the attacked network for s′, x′, and G(s′), respectively, where the attacked network misclassifies s′ but correctly classifies x′ and G(s′).

[0019] According to a second aspect of the invention, a computer-readable storage medium is provided on which one or more computer programs are stored, which, when executed by a computer processor, implement the method described above.

[0020] According to a third aspect of the present invention, a deep neural network adversarial attack defense system based on adversarial networks is proposed, comprising:

[0021] The deep neural network random adversarial attack module includes multiple parallel adversarial attack algorithms that randomly add noise to the input image through adversarial attacks.

[0022] Differentiable frequency domain regularizer, configured to regularize the model output using frequency domain information;

[0023] The adversarial defense network architecture uses a generative adversarial network based on an encoder-decoder structure as the backbone network, and introduces a deep neural network random adversarial attack module and a differentiable frequency domain regularizer. It collects images from natural scenes and forms training and validation sets in proportion. The adversarial defense network is trained on the training set until the loss converges.

[0024] In some specific embodiments, during the training process of the adversarial defense network architecture, the input image x is processed by the deep neural network random adversarial attack module to generate an adversarial attack image s. The adversarial attack image s is then fed into the generator G in the adversarial network. The encoder output in the generator G is regularized using a differentiable frequency domain regularizer to generate image G(s). The multi-scale discriminator D... k The image G(s) is compared with the input image x, and a pre-trained feature extractor F is used to further narrow the distance between the image G(s) and the input image x.

[0025] In some specific embodiments, the total loss function Where λ1, λ2, λ3, and λ4 are adjustable parameters that generate adversarial loss. Feature matching loss Perceived loss F represents the feature output of the i-th layer of the k-th discriminator. (i) M represents the i-th layer of the classifier i Each feature outputs a classification loss L. class (G, F) = -∑ i＝1 σ(F(x)) i log(σ(F(G(s))) i ), σ(.) i This represents the output label for the i-th class.

[0026] In some specific embodiments, the differentiable frequency domain regularization term is: in, Indicates Fourier transform, It is a low-pass filter. is a high-pass filter, and f represents the central region of the two-dimensional Fourier spectrum.

[0027] In some specific embodiments, a verification module is also included: collecting the adversarial attack image s′ and its original image x′, feeding them into the trained generator G to obtain the generated image G(s′); obtaining the discrimination results of the attacked network for s′, x′, and G(s′), respectively, where the attacked network misclassifies s′ but correctly classifies x′ and G(s′).

[0028] This invention proposes a deep neural network adversarial attack defense method and system based on adversarial networks. It introduces a random adversarial attack module into the deep neural network, enabling self-supervised training. Simultaneously, a differentiable frequency domain regularizer is used to regularize the encoder of the generative model, making the frequency domain information in the generated image freely controllable and maximizing the suppression of attack noise in the frequency domain. In the discrimination part, a classification loss is added as a higher-order loss function to the pre-trained feature extractor, guiding the generated image to further approximate the feature distribution of the original image, weakening the amplification error effect of adversarial attack noise. This method does not introduce additional parameters during inference, effectively improving the success rate of deep neural network adversarial attack defense while fully preserving the details of the original sample. Attached Figure Description

[0029] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Other features, objects, and advantages of this application will become more apparent from reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0030] Figure 1 This is a flowchart of a deep neural network adversarial attack defense method based on an embodiment of this application;

[0031] Figure 2 This is an overall network architecture diagram of a deep neural network adversarial attack defense system based on an embodiment of this application;

[0032] Figure 3 A schematic diagram of the structure of a computer system suitable for implementing the electronic devices of the present application. Detailed Implementation

[0033] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0034] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0035] Figure 1 A flowchart illustrating a deep neural network adversarial attack defense method based on adversarial networks according to an embodiment of this application is shown. Figure 1 As shown, the method includes the following steps:

[0036] S101: Construct a deep neural network random adversarial attack module. This module includes multiple parallel adversarial attack algorithms that randomly add noise to the input image using adversarial attacks. The adversarial attack algorithms include Fast Gradient Stream Model (FGSM), AdverGAN, Deepfool, Proximal Gradient Difference (PGD), L-BFGS, UAN, and UAP.

[0037] S102: Construct a differentiable frequency domain regularizer. This regularizer regularizes the model output by applying frequency domain information, making the frequency domain components of the model controllable. Since the main difference between the adversarial attack image and the original image lies in the high-frequency information, this regularizer aims to suppress high-frequency information and amplify low-frequency information.

[0038] S103: Build an adversarial defense network architecture. The adversarial defense network uses a generative adversarial network based on an encoding and decoding structure as the backbone network, and introduces a deep neural network random adversarial attack module and a differentiable frequency domain regularizer.

[0039] In a specific embodiment, during the training process of the adversarial defense network architecture, the input image x is processed by the deep neural network random adversarial attack module to generate an adversarial attack image s. The adversarial attack image s is then fed into the generator G in the adversarial network. The encoder output in the generator G is regularized using a differentiable frequency domain regularizer to generate image G(s). The multi-scale discriminator D... k The image G(s) is compared with the input image x, and a pre-trained feature extractor F is used to further narrow the distance between the image G(s) and the input image x.

[0040] In a specific embodiment, the ratio between the training set and the validation set is 10:1. In other embodiments, the ratio between the training set and the validation set can be set to other ratios.

[0041] S104: Collect images from natural scenes, form training and validation sets according to proportions, and use the training set to train the adversarial defense network until the loss converges.

[0042] In a specific implementation, the generative adversarial loss, feature matching loss, and perceptual loss are respectively:

[0043]

[0044]

[0045]

[0046] in F represents the feature output of the i-th layer of the k-th discriminator. (i) M represents the i-th layer of the classifier i Each feature outputs.

[0047] The differentiable frequency domain regularization term is:

[0048] in Indicates Fourier transform, It is a low-pass filter. is a high-pass filter, and f represents the central region of the two-dimensional Fourier spectrum.

[0049] To further guide the generative model to generate images that closely approximate the information distribution of the original image, this invention also introduces a classification loss to further constrain the model: L class (G, F) = -∑ i＝1 σ(F(x)) i log(σ(F(G(s))) i ), where σ(.) i This represents the output label for the i-th class.

[0050] The total loss function is: Where λ1, λ2, λ3, and λ4 are adjustable parameters.

[0051] In some specific embodiments, a verification step is also included to verify network performance: collect the adversarial attack image s′ and its original image x′, and feed them into the trained generator G to obtain the generated image G(s′); obtain the discrimination results of the attacked network for s′, x′, and G(s′), respectively, where the attacked network misclassifies s′ but correctly classifies x′ and G(s′).

[0052] This application presents a deep neural network adversarial attack defense method based on adversarial networks. Using an adversarial network as the backbone and a self-supervised architecture for training, it minimizes the algorithm's strong dependence on samples. Simultaneously, it innovatively introduces a differentiable frequency domain regularizer and a higher-order loss function, significantly improving the model's ability to remove adversarial perturbations. Experiments show that this method significantly enhances the deep neural network's adversarial attack defense capability and exhibits good generalization performance against various adversarial attack methods.

[0053] Figure 2 The diagram illustrates the overall network architecture of a deep neural network adversarial attack defense system based on adversarial networks, according to one embodiment of this application. Figure 2As shown, the overall network architecture of the system includes a random adversarial attack module, a generator, a differentiable frequency domain regularizer, a discriminator, and a pre-trained feature extractor. The deep neural network random adversarial attack module includes multiple parallel adversarial attack algorithms that randomly add noise to the input image. The differentiable frequency domain regularizer is configured to regularize the model output using frequency domain information. The specific training process is as follows: the input image x passes through the random adversarial attack module described in step one to generate an adversarial attack image s. s is fed into the generator G in the generative adversarial network, and the encoder output in G is regularized using the differentiable frequency domain regularizer to generate the image G(s). A multi-scale discriminator D... k We distinguish between G(s) and image x, and use a pre-trained feature extractor F to further narrow the distance between G(s) and x.

[0054] In some specific embodiments, a verification module is also included: configured to collect adversarial attack images s′ and their original images x′, and feed them into a trained generator G to obtain a generated image G(s′); the judgment results of the attacked network on S′, x′, and G(s′) are obtained respectively, and the attacked network judges s′ incorrectly but judges x′ and G(s′) correctly.

[0055] The following is for reference. Figure 3 It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Figure 3 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0056] like Figure 3 As shown, the computer system includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 302 or programs loaded from storage section 308 into random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the system 300. The CPU 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0057] The following components are connected to I / O interface 305: an input section 306 including a keyboard, mouse, etc.; an output section 307 including a liquid crystal display (LCD) and speakers, etc.; a storage section 308 including a hard disk, etc.; and a communication section 309 including a network interface card such as a LAN card and a modem, etc. The communication section 309 performs communication processing via a network such as the Internet. A drive 310 is also connected to I / O interface 305 as needed. A removable medium 311, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 310 as needed so that computer programs read from it can be installed into storage section 308 as needed.

[0058] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 309, and / or installed from removable medium 311. When the computer program is executed by central processing unit (CPU) 301, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0059] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0060] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0061] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0062] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: construct a deep neural network random adversarial attack module, the deep neural network random adversarial attack module including multiple parallel adversarial attack algorithms, randomly adding noise to the input image through adversarial attacks; construct a differentiable frequency domain regularizer, the differentiable frequency domain regularizer regularizing the model output with frequency domain information; construct an adversarial defense network architecture, the adversarial defense network using a generative adversarial network based on an encoder-decoder structure as the backbone network, and introducing the deep neural network random adversarial attack module and the differentiable frequency domain regularizer; collect images from natural scenes, form training and validation sets proportionally, and use the training set to train the adversarial defense network until the loss converges.

[0063] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A deep neural network adversarial attack defense method based on adversarial networks, characterized in that, include: S1: Construct a deep neural network random adversarial attack module, which includes multiple parallel adversarial attack algorithms that randomly add noise to the input image through adversarial attacks. S2: Construct a differentiable frequency domain regularizer, which performs regularization processing on the model output using frequency domain information; S3: Build an adversarial defense network architecture, wherein the adversarial defense network uses a generative adversarial network based on an encoding and decoding structure as the backbone network, and introduces the deep neural network random adversarial attack module and the differentiable frequency domain regularizer; S4: Collect images from natural scenes, form training and validation sets according to proportions, and use the training set to train the adversarial defense network until the loss converges; During the training process of the adversarial defense network architecture, the input image The adversarial attack image is generated by the deep neural network random adversarial attack module. The adversarial attack image Generator fed into the adversarial network The generator is subjected to the differentiable frequency domain regularizer. The encoder output is regularized to generate an image. Multiscale discriminator For the image With the input image Discrimination is performed, and a pre-trained feature extractor is used. Zoom in further on the image With the input image The distance between them; Total loss function ,in, , , , To generate adversarial loss for adjustable parameters. Feature matching loss Perceived loss , This represents the feature output of the i-th layer of the k-th discriminator. Represents the i-th layer of the classifier Each feature outputs a classification loss. , This represents the output label for the i-th class; The differentiable frequency domain regularization term is: in, Indicates Fourier transform, It is a low-pass filter. For high-pass filters, This represents the central region of a two-dimensional Fourier spectrum.

2. The deep neural network adversarial attack defense method based on adversarial networks according to claim 1, characterized in that, Adversarial attack algorithms include Fast Gradient Streaming (FGSM), AdvVGAN, Deepfool, and Proximal Gradient Difference (PGD).

3. The deep neural network adversarial attack defense method based on adversarial networks according to claim 1, characterized in that, The differentiable frequency domain regularizer is used to suppress high-frequency information and amplify low-frequency information.

4. The deep neural network adversarial attack defense method based on adversarial networks according to claim 1, characterized in that, The ratio between the training set and the validation set is 10:

1.

5. The deep neural network adversarial attack defense method based on adversarial networks according to claim 1, characterized in that, It also includes a verification step: collecting adversarial attack images. Compared to the original image The generated image is fed into the trained generator G. ; respectively obtain the attacked network pairs , , The judgment result shows that the attacked network... Error in judgment and at the same time , The judgment is correct.

6. A computer-readable storage medium having one or more computer programs stored thereon, characterized in that, When the one or more computer programs are executed by a computer processor, they perform the method according to any one of claims 1-5.

7. A deep neural network adversarial attack defense system based on adversarial networks, characterized in that, include: The deep neural network random adversarial attack module includes multiple parallel adversarial attack algorithms that randomly add noise to the input image through adversarial attacks. Differentiable frequency domain regularizer, configured to regularize the model output using frequency domain information; The adversarial defense network architecture uses a generative adversarial network based on an encoder-decoder structure as the backbone network, and introduces the deep neural network random adversarial attack module and the differentiable frequency domain regularizer. It collects images in natural scenes, forms training and validation sets in proportion, and uses the training set to train the adversarial defense network until the loss converges. During the training process of the adversarial defense network architecture, the input image The adversarial attack image is generated by the deep neural network random adversarial attack module. The adversarial attack image Generator fed into the adversarial network The generator is subjected to the differentiable frequency domain regularizer. The encoder output is regularized to generate an image. Multiscale discriminator For the image With the input image Discrimination is performed, and a pre-trained feature extractor is used. Zoom in further on the image With the input image The distance between them; Total loss function ,in, , , , To generate adversarial loss for adjustable parameters. Feature matching loss Perceived loss , This represents the feature output of the i-th layer of the k-th discriminator. Represents the i-th layer of the classifier Each feature outputs a classification loss. , This represents the output label for the i-th class; The differentiable frequency domain regularization term is: in, Indicates Fourier transform, It is a low-pass filter. For high-pass filters, This represents the central region of a two-dimensional Fourier spectrum.

8. The deep neural network adversarial attack defense system based on adversarial networks according to claim 7, characterized in that, It also includes a verification module: collecting adversarial attack images. Compared to the original image The generated image is fed into the trained generator G. ; respectively obtain the attacked network pairs , , The judgment result shows that the attacked network... Error in judgment and at the same time , The judgment is correct.

Images