An adversarial sample defense method based on image gradient calculation

Abstract

The application discloses an adversarial sample defense method based on image gradient calculation, detects gradient information after edge gradient of an input sample is calculated to meet the requirement of identifying adversarial samples, reduces the risk of suffering from adversarial attacks, and thus evaluates the robustness of a model. An edge gradient of an input image is extracted, a main task model based on a classifier is trained, and since there is a large difference between gradient information of adversarial samples and normal samples, the adversarial samples can be well identified by the main task model; a main task model is trained to classify images after edge gradient extraction of input samples, and thus the adversarial samples can be better identified, and since the application adopts a shallow neural network, the application has the advantage of fast response speed; and since the application adopts image edge information as a detection standard, the classification accuracy can be greatly improved.

Description

Technical Field

[0001] This invention relates to the fields of AI security, machine learning, and adversarial examples, and in particular to an adversarial example defense method based on image gradient calculation. Background Technology

[0002] With continuous technological breakthroughs in the field of artificial intelligence, AI models have been widely used in various fields, including biometric recognition, autonomous driving, image recognition, and speech recognition, which have greatly promoted many industries such as traditional manufacturing and healthcare.

[0003] Artificial intelligence models have achieved significant performance improvements across various tasks, but they have also exposed vulnerabilities to adversarial attacks. Adversarial attacks are carefully designed attacks that mislead the output of deep learning models through subtle perturbations imperceptible to humans, potentially leading to serious security vulnerabilities and data distortion. For autonomous driving systems, adversarial examples can cause cars to misjudge road conditions, resulting in serious traffic accidents; for facial recognition systems, attackers can construct adversarial facial information to forge their own identity and pass detection by the facial recognition system.

[0004] Therefore, the demand for adversarial example detection technology is growing. Currently, many defense methods against adversarial examples have been proposed, including adversarial training, preprocessing defense, and model-oriented defense. Adversarial training expands the model's decision boundary by adding perturbation-containing images during training, giving the model some resistance to adversarial examples. Preprocessing methods typically involve blurring, distorting, or restoring the input image to neutralize the added noise. Model-oriented defense, such as model distillation, reduces the model's sensitivity to input, increasing the difficulty of generating adversarial examples.

[0005] However, existing adversarial example defense methods have some design flaws:

[0006] Defenders face challenges such as high computational complexity, high cost and long cycle of retraining the entire task, which can lead to a decline in the performance of the defended model.

[0007] First, existing defense methods are computationally complex. Some methods involve extracting high-dimensional representations of the input and then reconstructing them, which leads to significant computational overhead and makes them impractical for deployment in real-world production environments. Second, retraining the entire task is costly. Some methods require retraining or fine-tuning the protected model, but the cost of these methods is directly related to the complexity of the protected model and the protected task. Once the complexity is high, the training cost of such methods becomes extremely high. Finally, once existing defense methods involve retraining the protected model, there is a high probability that the performance of the protected model will be sacrificed to improve robustness. Summary of the Invention

[0008] The purpose of this invention is to address the shortcomings of existing adversarial example detection algorithms by providing an adversarial example defense method based on image gradient calculation. This invention is achieved through the following technical solution:

[0009] This invention discloses an adversarial example defense method based on image gradient calculation, comprising the following steps:

[0010] S1 Obtaining the adversarial dataset: By employing adversarial attack algorithms, adversarial input samples are obtained, thus creating the adversarial dataset;

[0011] S2 constructs the gradient dataset of the input samples: by first compressing the adversarial sample dataset and the normal sample dataset generated in S1, then using the gradient operator to calculate the image gradient, and assigning different labels to the data belonging to these two datasets respectively, the gradient dataset of the input samples is obtained.

[0012] S3 Training the Main Classification Task Model: The main classification task model learns the gradient dataset of the input samples obtained in S2, so that the main classification task model has a good ability to distinguish the input samples, and obtains a model that can distinguish the gradient difference between adversarial samples and normal samples.

[0013] S4 extracts and detects gradient information of test samples: The model trained by S3, which can distinguish the gradient difference between adversarial samples and normal samples, is used to extract the gradient of new input samples and input them into the main classification model. The main classification model's judgment result for this sample is obtained, and the classification accuracy is used to judge the classification effect of the main task model.

[0014] As a further improvement, in step S1 of this invention, the adversarial attack algorithm adopts FGSM, PGD, or C&W.

[0015] As a further improvement, in step S2 of this invention, the feature compression processing algorithm adopts the Bit Depth Reduction (BDR) algorithm, with the attenuation degree set to 7 bits: the pixel values ​​of the entire image are reduced by 2 from [0,1]. 7 -1 bit, then rounded down to {0,1} using the round function, and then divided by 2. 7 -1, to obtain the final attenuation value:

[0016] BDR(x) = round(x*(2) i -1) / (2 i -1)).

[0017] As a further improvement, in step S2 of this invention, the gradient operator is the Laplacian of Gaussian (LoG) operator: The LoG operator is based on convolution operations and performs second-order convolution gradient operations on the horizontal and vertical directions of the input sample BFR(x) after bit decay algorithm processing to obtain the image gradient g of the input sample. LoG (BDR(x)), where the LoG convolution kernel is g LoG :

[0018]

[0019] As a further improvement, in step S3 of this invention, the loss function for training the main classification task model is as follows: L(f θ (g) LoG (BDR(x))), y) where x is the input sample, y is the label of the input sample x, and f θ It is the main task model with model weights θ, and L is the cross-entropy function.

[0020] As a further improvement, the evaluation metric 1 – the classification accuracy of the main task – described in this invention is used to measure the main task model's ability to discriminate adversarial examples.

[0021]

[0022] The argmax function is used to select the class with the highest model probability to predict whether the input sample is an adversarial example.

[0023] As a further improvement, the PGD adversarial attack algorithm used in this invention sets the total interference intensity to α and the total number of iterations to n. Then, the perturbation updated at each step... The magnitude of the perturbation is limited and clipped to the range [0, 1].

[0024]

[0025] The beneficial effects of this invention are as follows:

[0026] The method of this invention detects the gradient information after calculating the edge gradient of the input sample to meet the requirements for identifying adversarial examples, reducing the risk of adversarial attacks and thus evaluating the robustness of the model. By extracting the edge gradient of the input image, a classifier-based main task model is trained. Due to the significant difference between the gradient information of adversarial examples and normal samples, adversarial examples can be well identified by the main task model.

[0027] This invention trains a "main task model" to classify images of input samples after edge gradient extraction, thereby enabling better identification of adversarial examples.

[0028] Because this invention uses a design method that does not require retraining, it can train a plug-and-play adversarial example defense model with a relatively low training cost; because this invention uses a shallow neural network, it has the advantage of fast response speed; and because this invention uses image edge information as the detection standard, it can greatly improve the classification accuracy. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the algorithm flow of the method of this invention; Detailed Implementation

[0030] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0031] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0032] The adversarial example defense method based on image gradient calculation provided in this invention has the following process: Figure 1 As shown, it includes the following steps:

[0033] Step 1: Obtain the adversarial dataset

[0034] In this embodiment, the training sets for the main classification task are the MNIST and CIFAR-10 datasets, and the input samples for each test are obtained from the selected datasets through random sampling.

[0035] The corresponding dataset may have the following possibilities:

[0036] a: The training set for the main classification task is MNIST.

[0037] b: The training set for the main classification task is CIFAR-10.

[0038] The original samples are labeled as 0, and the adversarial samples generated by the PGD adversarial attack algorithm are labeled as 1. Let x be the sample input to the model, and y be the label corresponding to the input sample x. In actual deployment, due to different datasets, the number of input channels for a single sample will change, and the selection of the number of input channels for the main task model will also be different;

[0039] When dataset category a is selected, the number of input channels for the main task model is 1.

[0040] When dataset class b is selected, the number of input channels for the main task model is 3;

[0041] Step 2: Construct the gradient dataset for the input samples

[0042] This step is divided into the following sub-steps:

[0043] (1) The original sample and the adversarial sample generated by the adversarial algorithm are processed by the bit decay algorithm (BDR): the decay degree of the bit decay algorithm is set to 7, and then the entire input sample is processed directly to obtain BDR(x).

[0044] (2) Construct a gradient convolution kernel based on the selected image edge operator, and perform a convolution operation with the sample processed by BDR in the previous step to obtain the gradient information g of the input sample. LoG (BDR(x)).

[0045] Step 3: Train the main classification task model;

[0046] The main task model is trained using stochastic gradient descent. The output of the main model is then f. θ (g LoG (BDR(x))), using L(f) θ (g LOG (BDR(x))) and y) are used as the loss function. Where f θ The model is a main task model with weights θ and L is the cross-entropy function. In the early stages of training, a larger initial step size of 0.01 can be chosen to enable the model to converge quickly. In the later stages, a smaller step size can be obtained through step decay, allowing the model to achieve higher accuracy through fine-tuning.

[0047] Step 4: Extract gradient information from test samples and perform detection.

[0048] After the main task model is trained, for any input sample to be tested, it can be processed by bit decay and gradient before being fed back to the main task model for computation. The model's computation result fθ (g LoG (BDR(x))) selects the label with the highest probability based on argmax as the predicted label, thereby determining whether the input sample is a malicious adversarial sample. To evaluate the main task model's performance in identifying malicious samples, we use accuracy to represent the main task model's ability to identify both malicious and normal samples.

[0049] The above description is merely a preferred embodiment of the present invention. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make many possible variations and modifications to the technical solutions of the present invention using the methods and techniques disclosed above, or modify them into equivalent embodiments with equivalent changes, without departing from the scope of the technical solutions of the present invention. Therefore, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solutions of the present invention shall still fall within the protection scope of the technical solutions of the present invention.

Claims

1. An adversarial example defense method based on image gradient calculation, characterized in that, Includes the following steps: S1 Obtaining the adversarial dataset: By employing adversarial attack algorithms, adversarial input samples are obtained, thus creating the adversarial dataset; S2 constructs the gradient dataset of the input samples: by first compressing the adversarial sample dataset and the normal sample dataset generated in S1, then using the gradient operator to calculate the image gradient, and assigning different labels to the data belonging to these two datasets respectively, the gradient dataset of the input samples is obtained. S3 Training the Main Classification Task Model: The main classification task model learns the gradient dataset of the input samples obtained in S2, so that the main classification task model has a good ability to distinguish the input samples, and obtains a model that can distinguish the gradient difference between adversarial samples and normal samples. S4 extracts and detects gradient information of test samples: The model trained by S3, which can distinguish the gradient difference between adversarial samples and normal samples, is used to extract the gradient of new input samples and input them into the main classification model. The main classification model's judgment result for this sample is obtained, and the classification accuracy is used to judge the classification effect of the main task model. In step S2, the feature compression processing algorithm uses a bit depth reduction (BDR) algorithm with a reduction degree of 7 bits: the pixel values ​​of the entire image are subtracted from [0,1]. Bits, then through The function is rounded down to {0, 1} and then divided by . The final attenuation value is obtained: ； In step S2, the gradient operator is the Laplacian of Gaussian (LoG) operator: the LoG operator is based on convolution operations and applies the gradient to the input sample after bit decay algorithm processing. Second-order convolution gradient operations are performed in the horizontal and vertical directions to obtain the image gradient of the input sample. The LoG convolution kernel is : 。 2. The adversarial example defense method based on image gradient calculation according to claim 1, characterized in that, In step S1, the adversarial attack algorithm uses FGSM, PGD, or C&W.

3. The adversarial example defense method based on image gradient calculation according to claim 1 or 2, characterized in that, In step S3, the loss function for training the main classification task model is as follows: ； in, It is the input sample. Input sample The tag, The model weights are The main task model, where L is the cross-entropy function.

4. The adversarial example defense method based on image gradient calculation according to claim 3, characterized in that, The aforementioned evaluation metric 1 – classification accuracy of the main task – is used to measure the main task model's ability to distinguish adversarial examples. ； The argmax function is used to select the class with the highest model probability to predict whether the input sample is an adversarial example.

5. The adversarial example defense method based on image gradient calculation according to claim 4, characterized in that, The PGD adversarial attack algorithm used is set to a total interference intensity of [value missing]. And setting the total number of iterations to n, then the perturbation updated at each step size... And limit the size of the disturbance, cropping it to... between, 。

Images