An adversarial training method based on classification result difference

Abstract

The application belongs to the field of adversarial learning visual representation, and discloses an adversarial training method based on classification result difference, wherein each image in a training set is input into a deep neural network, the gradient direction of an original image sample is calculated, and a perturbation is added along the gradient direction to generate an adversarial sample; meanwhile, the original sample and the generated adversarial sample are input into the deep neural network for training; all original samples are classified into two categories according to the classification results of the original sample and the adversarial sample by the deep neural network; the loss value of the original sample in one category and the loss value of the adversarial sample in the other category are calculated; and the parameters of the deep neural network are updated in gradient through minimizing the loss value; the application classifies samples according to classification results on the basis of a classical adversarial training method, adopts a more suitable loss function for samples in different categories, and achieves a better training effect.

Description

Technical Field

[0001] This invention belongs to the field of adversarial learning visual representation, specifically relating to an adversarial training method based on the differences in classification results. Background Technology

[0002] In recent years, with the rapid development of the internet and the increasing maturity of multimedia technologies, the level of digitalization and informatization in society is constantly improving. In particular, the arrival of the big data era has led to an explosive growth in digital information resources. With the widespread use of smartphones, tablets, and other smart mobile terminals, digital images have become an indispensable part of people's daily lives, playing a vital role in social interaction, shopping, and learning. Currently, a massive amount of digital images are uploaded and shared on the internet every day, and image data resources are showing an explosive growth trend. How to classify and retrieve these massive image resources in a timely and effective manner has become an important research topic.

[0003] Since the AlexNet method won the ImageNet image recognition competition in 2012 with a 10-percentage-point advantage over the second-place finisher, deep learning has entered a period of explosive development, finding increasingly widespread and important applications in computer vision, especially in image classification. While deep learning methods have achieved excellent results in computer vision tasks, their rapid development has also brought security challenges. Carefully crafted adversarial perturbations can easily fool standard-trained deep models by adding imperceptible noise to the original samples, leading to security issues in applications such as healthcare, finance, and autonomous driving. To mitigate this problem, many adversarial training methods use adversarial samples that maximize the loss to update the current model, such as standard adversarial training (AT), tradeoff-inspired adversarial defense via surrogate-loss minimization (TRADES), robust self-training (RST), and misclassification-aware adversarial training (MART). The goal of adversarial training is to obtain a robust deep neural network model whose predictions are locally invariant to small neighborhoods of the input. By smoothing small neighborhoods using perturbated data, adversarial training achieves robustness against adversarial examples; however, this operation often leads to a decrease in the model's accuracy on natural data. Existing research indicates that robust models consistently perform poorly on natural data, reflecting a potential trade-off between robustness and accuracy.

[0004] To address the aforementioned balance issue, several emerging adversarial training methods have been proposed. For example, Friendly Adversarial Training (FAT) uses friendly adversarial examples (i.e., adversarial examples that are amplified by perturbation but are close to the decision boundary, yet still correctly classified), minimizing loss even when some incorrectly predicted adversarial examples are found. Dropout is introduced into existing AT, RST, and TRADES methods. Both of these methods can improve accuracy while maintaining robustness. While exploring adversarial training methods, fully utilizing model capacity is crucial.

[0005] However, experiments reveal that over-parameterized deep networks may still suffer from insufficient model capacity due to the overwhelming smoothing effect of adversarial training. Fitting adversarial examples requires enormous model capacity, demanding a large number of trainable parameters or a sufficiently long training time to bring the adversarial examples close to zero error. An over-parameterized model that perfectly fits the original samples in standard training is still far from adequate for fitting adversarial examples. Compared to standard training that fits the original samples, adversarial training smooths the neighborhood of the original samples, consuming significantly more model capacity than the original samples. Adversarial training methods should cautiously utilize limited model capacity to fit neighborhoods of important data that help fine-tune decision boundaries. Therefore, treating all adversarial examples the same is unwise. Secondly, the original samples and their adversarial examples are not equally important. On the one hand, some relatively conservative original samples are geometrically far from class boundaries, making their adversarial examples difficult to misclassify. On the other hand, some relatively attackable original samples are geometrically close to class boundaries, making their adversarial examples easily misclassified. As adversarial training progresses, the model generates more and more protected training data and less and less attackable training data. Given the limited model capacity, treating all data equally could lead to a large number of adversarial examples from the protected data overwhelming the model, resulting in robust overfitting. Therefore, treating both the original samples and their adversarial examples equally during adversarial training is not advisable. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides an adversarial training method based on the differences in classification results. This method considers the classification results of image samples, determines whether a sample is close to or far from the decision boundary based on the classification results, selects appropriate loss functions for training and parameter updates for different categories of samples, and not only improves the classification accuracy of original samples but also enhances the classification accuracy of adversarial samples. This alleviates the phenomenon in existing methods where the classification accuracy of adversarial samples is improved by reducing the classification accuracy of original samples.

[0007] The adversarial training method based on the difference in classification results described in this invention includes the following steps:

[0008] Step 1: Collect image data, divide it into training set and test set, and input the image x in the training set as the original sample into the convolutional neural network;

[0009] Step 2: Fix the regularization layer of the convolutional neural network, calculate the gradient direction of the original sample x, and add perturbation in the opposite direction of the gradient to generate adversarial sample x′;

[0010] Step 3: Simultaneously input the original samples and the generated adversarial samples into the convolutional neural network for training, and calculate the network classification result based on the output vector of the convolutional neural network;

[0011] Step 4: Based on the network classification results, divide the original samples from Step 1 into two categories: samples whose original sample classification results are the same as their adversarial sample classification results, and samples whose original sample classification results are different from their adversarial sample classification results.

[0012] Step 5: Use different training methods for samples of different categories, and calculate the loss value of the original samples of one category and the loss value of the adversarial samples of another category.

[0013] Step 6: Calculate the total loss function based on the loss value obtained in Step 5, and update the parameters of the convolutional neural network by minimizing the loss value.

[0014] The convolutional neural network is a convolutional neural network that uses CIFAR10, CIFAR100 and SVHN datasets as inputs into the ResNet-18 convolutional neural network. The parameters of the BN layer and Dropout layer in the convolutional neural network are fixed to prevent prediction bias, and the gradient direction is calculated through backpropagation of the convolutional neural network.

[0015] Furthermore, in step 3, the network classification result is divided into four types for each sample: original sample correctly classified, original sample incorrectly classified, adversarial sample correctly classified, and adversarial sample incorrectly classified.

[0016] Suppose that the classification result of the original sample x input into the convolutional neural network f is f(x), then the classification result of the adversarial sample is f(x′), and its true label is y;

[0017] If the original sample is correctly classified, then f(x) = y; if it is incorrectly classified, then f(x) ≠ y.

[0018] If the adversarial sample is correctly classified, then f(x′) = y; if it is incorrectly classified, then f(x′) ≠ y.

[0019] Furthermore, in step 4, the original samples are divided into two categories based on the network classification results, specifically:

[0020] The set of samples whose classification results are the same as those of the original sample and its adversarial sample is defined as S, which includes: samples whose original sample and its adversarial sample are both correctly classified, and samples whose original sample and its adversarial sample are both incorrectly classified.

[0021] The set of samples whose classification results differ from those of the original sample and its adversarial sample is defined as D, including: samples whose original sample is correctly classified but whose adversarial sample is incorrectly classified, and samples whose original sample is incorrectly classified but whose adversarial sample is correctly classified.

[0022] Suppose the batch size of the training images is M, and the number of samples in the sample set S is m, which is represented as the set of the original samples x (f(x)=y, f(x′)=y) and (f(x)≠y, f(x′)≠y); let the number of samples in the sample set D be Mm, which is represented as the set of the original samples x (f(x)=y, f(x′)≠y) and (f(x)≠y, f(x′)=y).

[0023] Furthermore, in step 5, the loss calculation is divided into natural loss and robust loss. The natural loss is calculated by taking the loss value of the original samples in the sample set S, while the robust loss is calculated by taking the loss value of the adversarial samples in the sample set D. The total loss function is then calculated using both the natural and robust loss values. :

[0024]

[0025] Where θ represents the parameters of the network model, and B(x) is defined as {x′: ||x′-x||}. p ≤∈} is the adversarial region centered at x with radius ∈>0, representing the limited range for generating adversarial examples, where p is the norm type. Here, is the cross-entropy loss function, and max represents taking the maximum value of the loss function.

[0026] Furthermore, in step 6, gradient update involves calculating the weight gradient based on backpropagation of the loss value and updating the weight parameters using stochastic gradient descent; the loss value is minimized as follows:

[0027]

[0028] Where n is the total number of samples; the convolutional neural network parameter update is as follows:

[0029]

[0030] Where η is the learning rate, which represents the step size for each parameter update; Represented as loss value The value obtained by differentiating the parameter θ.

[0031] The beneficial effects of this invention are as follows: Considering that using a uniform training method for too many original samples and adversarial samples can negatively impact model prediction in terms of model capacity, and that numerous negative samples in the sample distribution can affect model performance, this invention proposes an adversarial training method based on the differences in classification results. This method improves the model's robustness to adversarial samples through standard adversarial training. Furthermore, based on the model's classification results, the original image samples are divided into two categories. Different loss functions and training methods are used for the two categories to update the model's parameters, thus specifically improving accuracy against original samples and robustness against adversarial samples. This effectively alleviates the negative impact of model capacity and sample distribution on model performance, breaking the balance between accuracy and robustness. It improves both robustness and accuracy simultaneously, mitigating the imbalance between accuracy and robustness and addressing the problem of overfitting. This invention can effectively improve the performance of adversarial training models, and the trained network can be widely applied to various computer vision tasks, such as image classification and object detection. Attached Figure Description

[0032] Figure 1 This is a flowchart of the method described in this invention;

[0033] Figure 2 This is a schematic diagram of the algorithm framework of the present invention;

[0034] Figure 3 This diagram illustrates the balance between accuracy and robustness of the method described in this invention on the CIFAR10 dataset compared to different algorithms in image classification. Detailed Implementation

[0035] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0036] like Figure 1 As shown, the adversarial training method based on the difference in classification results described in this invention uses CIFAR10, CIFAR100, and SVHN as training sets and ResNet-18 as the convolutional neural network, and includes the following steps:

[0037] Step 1: Collect image data, divide it into training set and test set, and input the image x in the training set as the original sample into the convolutional neural network;

[0038] Step 2: Fix the regularization layer of the convolutional neural network, calculate the gradient direction of the original sample, and add perturbation in the opposite direction of the gradient direction to generate adversarial sample x′;

[0039] Step 3: Simultaneously input the original samples and the generated adversarial samples into the convolutional neural network for training, and calculate the network classification result based on the output vector of the convolutional neural network;

[0040] Step 4: Based on the network classification results, divide the original samples from Step 1 into two categories: samples whose original sample classification results are the same as their adversarial sample classification results, and samples whose original sample classification results are different from their adversarial sample classification results.

[0041] Step 5: Use different training methods for samples of different categories, and calculate the loss value of the original samples of one category and the loss value of the adversarial samples of another category.

[0042] Step 6: Calculate the total loss function based on the loss value obtained in Step 5, and update the parameters of the convolutional neural network by minimizing the loss value.

[0043] like Figure 2 As shown in the diagram, the algorithm framework of the adversarial training method based on the difference in classification results described in this invention includes the following parts:

[0044] Data processing section: Acquire image data, divide it into training and test sets, and input the image x in the training set as the raw sample into the convolutional neural network. Fix the regularization layer of the convolutional neural network, calculate the gradient direction of the raw sample, and add perturbation in the opposite direction of the gradient to generate adversarial sample x′;

[0045] The classification result acquisition part: The original samples and generated adversarial samples are input into the convolutional neural network for training, and the network classification results f(x) and f(x′) are calculated based on the output vector of the convolutional neural network;

[0046] Sample classification section: Based on the network classification results, the original samples are divided into two sets S and D. S is the set of samples whose original sample classification results are the same as their adversarial sample classification results, denoted as (f(x)=y, f(x′)=y) and (f(x)≠y, f(x′)≠y). D is the set of samples whose original sample classification results are different from their adversarial sample classification results, denoted as (f(x)=y, f(x′)≠y) and (f(x)≠y, f(x′)=y).

[0047] The training part of the convolutional neural network: different training methods are used for samples of different categories. The loss value of the original samples of one category and the loss value of the adversarial samples of another category are calculated. Finally, the total loss function is calculated based on the loss values ​​of the two categories of samples, and the parameters of the convolutional neural network are updated by minimizing the loss value.

[0048] The method described in this invention comprises the following parts:

[0049] (1) Generation of adversarial attacks and adversarial examples

[0050] 1. Backbone Network: Given a batch of images x = [x1, x2, ..., x...], ... N (Batch size is N), input image x into the backbone network f. θ In ResNet (for example), θ represents the parameters of the network model. The output vector f(x) is calculated through forward propagation, and the cross-entropy loss function is used. Calculate the loss value:

[0051]

[0052] The gradient is obtained by taking the partial derivative of the calculated loss value with respect to θ. The model parameters θ are updated using backpropagation with a learning rate η, where t is the number of iterations:

[0053] θ t+1 =θ t -η·g (2)

[0054] 2. Adversarial Attack: The magnitude of the perturbation is denoted as α. The gradient direction is obtained by differentiating the loss value of the original image sample. The perturbation is added in the opposite direction of the gradient to achieve an adversarial attack on the sample.

[0055]

[0056] in Representation function The partial derivative with respect to x is given by sign(), which is the sign function. It returns 1 for positive numbers, -1 for negative numbers, and 0 for 0.

[0057] 3. Adversarial Example Generation: Define B(x) = {x′: ||x′-x|| p ≤∈} is the adversarial region centered at x with radius ∈>0, representing the limited range for generating adversarial examples. p is the norm class. A data point is randomly selected from B(x) for initialization, and the adversarial examples are iteratively updated.

[0058]

[0059] Where ∏(·) is the projection operator, α is the step size, and t is the number of iterations.

[0060] (2) Loss Function

[0061] 1. Sample Classification: The original sample x and the adversarial sample x′ are input into the convolutional neural network model to obtain the original sample classification result f(x) and the adversarial sample classification result f(x′). Based on the classification results, the original sample x is divided into two subsets, one subset is S, and the other subset is D.

[0062] S={i:i∈[N],f(x i )=f(x i ′)} (5)

[0063] D = {i: i ∈ [N], f(x)} i )≠f(x i ′)} (6)

[0064] There are a total of N samples, x i Let x be the i-th original sample. i Let ' denote the adversarial sample of the i-th original sample. The subset S contains the classification results f(x) of the original samples. i ) and its adversarial sample classification result f(x) i The same samples, i.e.: f(x) i ) and f(x i All values ​​f(x) are either the same as or different from the true label y. Another subset, D, contains the classification results f(x) for natural samples. i ) and its adversarial sample classification result f(x) i Different samples, i.e.: f(x) i ) or f(x i In the given condition, one item is the same as the real label y, while the other item is different.

[0065] 2. Loss Calculation: Samples in S are those far from the decision boundary, while samples in D are those near the decision boundary. Different training methods are used for different categories of samples.

[0066]

[0067] For samples far from the decision boundary, we use their original samples to improve the model's accuracy, while for samples near the decision boundary, we use their adversarial examples to improve the model's robustness.

[0068] 3. Calculate the total loss function using the method described above. And the parameters of the convolutional neural network are updated by minimizing the loss value:

[0069]

[0070] Table 1 describes the datasets involved in this invention, including dataset name, number of categories, image size, and number of samples in the training and test sets.

[0071] Table 1

[0072] CIFAR10 10 32x32 50000 10000 CIFAR100 100 32x32 50000 10000 SVHN 10 32x32 73257 26032

[0073] Table 2 shows a comparison of the image classification accuracy of this invention with different algorithms on the CIFAR10 dataset.

[0074] Table 2

[0075]

[0076] Here, "Natural" represents accuracy. Compared to standard adversarial training (AT), the proposed method ATDCR significantly improves both robustness and accuracy, breaking the balance between accuracy and robustness that is common in previous adversarial training. While the accuracy is comparable to FAT, the robustness of the proposed ATDCR is significantly higher by 12%. Compared to GAIRAT, although the robustness is slightly lower, the accuracy of the proposed ATDCR is nearly 5% higher. GAIRAT performs best in terms of robustness; therefore, combined with the method proposed in this invention, it is denoted as GAIR-ATDCR. GAIR-ATDCR adds weight information to the distance from samples in D to the decision boundary, increasing the generalization performance of adversarial examples. Compared to ATDCR, GAIR-ATDCR improves robustness.

[0077] Figure 3 The graph shows the test results on the CIFAR-10 dataset. The x-axis represents accuracy, and the y-axis represents robustness. The closer to the top right corner of the graph, the better the balance between accuracy and robustness. We can see that AT performs the worst in both accuracy and robustness. Other improved methods often focus on improving either accuracy or robustness, such as improving robustness at the expense of accuracy (MLCAT-S, MLCAT-WP), or improving accuracy at the expense of robustness (FAT). Methods that improve both accuracy and robustness include GAIRAT, ATDCR, and GAIR-ATDCR. Among these, the method proposed in this invention performs the best, significantly improving robustness while also maintaining accuracy, thus keeping the model training in a more balanced state and reducing the conflict between accuracy and robustness.

[0078] The above description is merely a preferred embodiment of the present invention and is not intended to further limit the present invention. All equivalent changes made based on the description and drawings of the present invention are within the protection scope of the present invention.

Claims

1. A method for adversarial training based on classification result difference, characterized in that, Includes the following steps: Step 1, collect image data, divide training set, test set, divide the image in the training set into 224x224 patches as the original sample input into the convolutional neural network; Step 2: Fix the regularization layer of the convolutional neural network and calculate the original samples. The gradient direction is determined, and perturbations are added in the opposite direction to the gradient direction to generate adversarial examples. ; Step 3: Simultaneously input the original samples and the generated adversarial samples into the convolutional neural network for training, and calculate the network classification result based on the output vector of the convolutional neural network; Step 4: Based on the network classification results, divide the original samples from Step 1 into two categories: samples whose original sample classification results are the same as their adversarial sample classification results, and samples whose original sample classification results are different from their adversarial sample classification results. Step 5: Use different training methods for samples of different categories, and calculate the loss value of the original samples of one category and the loss value of the adversarial samples of another category. Step 6: Calculate the total loss function based on the loss value obtained in Step 5, and update the parameters of the convolutional neural network by minimizing the loss value. In step 5, the loss calculation is divided into natural loss and robust loss; the natural loss is calculated from the sample set. The loss value of the original sample, and the robust loss value is calculated by the sample set. The loss value of the adversarial examples is calculated using the natural loss value and the robust loss value to calculate the total loss function. : ； in, Let these be the parameters of the network model, defined as follows: Therefore Centered on, radius The adversarial region is defined as the defined range for generating adversarial examples. For norm types, Let cross-entropy be the loss function. This indicates that the loss function is maximized; D represents the set of samples whose original samples and their adversarial samples have the same classification results; D represents the set of samples whose original samples and their adversarial samples have different classification results. This is the original sample; To determine the true labels of the adversarial sample classification results; In step 6, gradient update involves calculating the weight gradient based on backpropagation of the loss value and updating the weight parameters using stochastic gradient descent. The loss value is minimized as follows: ， in The total number of samples; the convolutional neural network parameters are updated as follows: ， in, Let be the learning rate, and let represent the step size for each parameter update. Represented as loss value For parameters The value obtained by differentiation.

2. The adversarial training method based on the difference in classification results according to claim 1, characterized in that, In step 3, the network classification result is divided into four types for each sample: original sample correctly classified, original sample incorrectly classified, adversarial sample correctly classified, and adversarial sample incorrectly classified. Assuming the original sample Input into convolutional neural network The classification result is The classification result of the adversarial sample is: Its real label is ; If the original sample is correctly classified, then If the classification is incorrect, then ; If the adversarial example is correctly classified, then If the classification is incorrect, then .

3. The adversarial training method based on the difference in classification results according to claim 2, characterized in that, In step 4, the original samples are divided into two categories based on the network classification results, specifically: The sample set whose classification results are the same as those of the original sample and its adversarial sample is defined as follows: This includes: samples in which both the original sample and its adversarial sample are correctly classified, and samples in which both the original sample and its adversarial sample are incorrectly classified. The sample set whose classification results differ from those of the original sample and its adversarial sample is defined as follows: This includes: samples that are correctly classified in the original sample but incorrectly classified in the adversarial sample, and samples that are incorrectly classified in the original sample but correctly classified in the adversarial sample. Assume the batch size of the original training image samples is Let the sample set be... The number of samples is m, denoted as , and The original sample The set; let the sample set be... The number of samples is , represents , and The original sample A set of.

Images