Model training method and device for reducing adversarial sample transferability

Abstract

The application provides a model training method and device for reducing the adversarial sample migration, and relates to the technical field of data processing. The training optimization process of the model is divided into two steps of standard classification optimization and heterogeneous optimization. The classification optimization process is the same as the standard convolutional neural network training process. In order to ensure the adversarial defense ability and the classification ability of the model at the same time, the two training optimization processes are alternately carried out, and the target model finally obtained by optimization can obviously reduce the adversarial migration. The heterogeneous optimization process is the innovation point of the training method of the application. In view of the problem that the approximate loss of the first-order Taylor expansion cannot be ignored, the application divides the adversarial disturbance epsilon into a combination of T small values; and solves the problem of the first-order Taylor approximation error caused by the fact that the adversarial sample is not in the clean sample neighborhood. In the similarity optimization process, the parameters of the agent model are fixed, and the adversarial defense meeting the actual attack scene is realized.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a model training method and apparatus for reducing adversarial sample transferability. Background Technology

[0002] Current research suggests that the transferability of adversarial examples stems from the similarity of the interfaces learned by black-box deep models. To reduce this transferability, existing work focuses on maximizing the gradient similarity of the loss functions of the source and target models, aiming to make the interfaces of the two models orthogonal, thereby reducing transferability and achieving adversarial defense.

[0003] However, existing methods are not very effective at reducing the transferability of adversarial examples and do not fit the actual adversarial attack scenarios.

[0004] Therefore, there is an urgent need for a mobility reduction technology that meets the requirements of actual adversarial attack scenarios, and to improve the performance of existing methods in reducing adversarial mobility, thereby achieving the purpose of adversarial defense. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides a model training method and apparatus for reducing adversarial sample transferability, thus solving the problem of low performance in reducing adversarial transferability in existing methods.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] Firstly, a model training method for reducing adversarial example transferability is provided, the method comprising:

[0010] S1. Obtain the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function;

[0011] S2. Calculate the cross-entropy loss of the surrogate model and the target model based on the training set, and use the stochastic gradient descent algorithm to update the parameters of the surrogate model in the nth model iteration and the parameters of the target model in the nth model iteration.

[0012] S3. Generate the input image for the nth model iteration based on the surrogate model and the target model from the nth model iteration; the input image is an image with adversarial perturbations added.

[0013] S4. Obtain the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, respectively. Fix the parameters of the surrogate model and update the parameters of the target model using stochastic gradient descent.

[0014] S5. Let n = n + 1. If n = N, output the target model; otherwise, return to S2.

[0015] Furthermore, the training parameters also include: the number of iterations T required to generate the adversarial perturbation and the maximum amplitude ε of the adversarial perturbation;

[0016] Furthermore, the network structure of the proxy model is the same as that of the source model, but it has not been trained.

[0017] Furthermore, the surrogate model and target model based on the nth model iteration generate the input image for the nth model iteration; the input image is an image with added adversarial perturbations, including:

[0018] S3.1 Obtain the loss function gradient grad1 of the surrogate model on the input image of the perturbation iteration t and the loss function gradient grad2 of the target model on the input image of the perturbation iteration t, respectively;

[0019] S3.2. Based on the similarity sim between the gradient grad1 of the loss function of the surrogate model on the input image of the t-th perturbation iteration and the gradient grad2 of the loss function of the target model on the input image of the t-th perturbation iteration, calculate the cosine loss function L. cos ;

[0020] S3.3 Obtain the cosine loss function L cos The gradient of the input image is added to the input image of the t-th time with an amplitude of 8 / T and a direction in the same direction as the gradient of the cosine function, so as to obtain the input image of the (t+1)-th time.

[0021] S3.4. Let t = t + 1. If t > T, obtain the current input image and execute S4; otherwise, return to S3.1.

[0022] Furthermore, the gradient grad1 of the loss function of the input image in the t-th perturbation iteration of the surrogate model is:

[0023]

[0024] The gradient grad2 of the loss function of the target model on the input image in the t-th perturbation iteration is:

[0025]

[0026] Where, x tLet represent the input image in the t-th perturbation iteration, and y represent the corresponding label;

[0027] f represents the proxy model; g represents the target model.

[0028] Furthermore, the similarity sim is:

[0029]

[0030] And the cosine loss function L cos for:

[0031]

[0032] Secondly, a model training apparatus for reducing adversarial sample transferability is provided, the apparatus comprising:

[0033] The data acquisition module is used to execute S1, which includes: acquiring the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function.

[0034] A standard optimization module is used to execute S2, wherein S2 includes: calculating the cross-entropy loss of the surrogate model and the target model based on the training set, and updating the parameters of the surrogate model and the parameters of the target model in the nth model iteration using the stochastic gradient descent algorithm;

[0035] The input image generation module is used to execute S3 after executing S2; and S3 includes: generating the input image for the nth model iteration based on the surrogate model and the target model of the nth model iteration; the input image is an image with added adversarial perturbation;

[0036] The heterogeneous optimization module is used to execute S4 after executing S3; and S4 includes: obtaining the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, fixing the parameters of the surrogate model and updating the parameters of the target model using the stochastic gradient descent method.

[0037] The model output module is used to execute S5 after executing S4, and S5 includes: setting n = n + 1, if n = N, outputting the target model; otherwise, returning to S2.

[0038] Furthermore, the training parameters also include: the number of iterations T required to generate the adversarial perturbation and the maximum amplitude ε of the adversarial perturbation;

[0039] Furthermore, the network structure of the proxy model is the same as that of the source model, but it has not been trained.

[0040] Furthermore, the surrogate model and target model based on the nth model iteration generate the input image for the nth model iteration; the input image is an image with added adversarial perturbations, including:

[0041] S3.1 Obtain the loss function gradient grad1 of the surrogate model on the input image of the perturbation iteration t and the loss function gradient grad2 of the target model on the input image of the perturbation iteration t, respectively;

[0042] S3.2. Based on the similarity sim between the gradient grad1 of the loss function of the surrogate model on the input image of the t-th perturbation iteration and the gradient grad2 of the loss function of the target model on the input image of the t-th perturbation iteration, calculate the cosine loss function L. cos ;

[0043] S3.3 Obtain the cosine loss function L cos The gradient of the input image is added to the input image of the t-th time with an amplitude of ε / T and a direction in the same direction as the gradient of the cosine function, so as to obtain the input image of the (t+1)-th time.

[0044] S3.4. Let t = t + 1. If t > T, obtain the current input image and execute S4; otherwise, return to S3.1.

[0045] Furthermore, the gradient grad1 of the loss function of the input image in the t-th perturbation iteration of the surrogate model is:

[0046]

[0047] The gradient grad2 of the loss function of the target model on the input image in the t-th perturbation iteration is:

[0048]

[0049] Where, x t Let represent the input image in the t-th perturbation iteration, and y represent the corresponding label;

[0050] f represents the proxy model; g represents the target model.

[0051] Furthermore, the similarity sim is:

[0052]

[0053] And the cosine loss function L cos for:

[0054]

[0055] (III) Beneficial Effects

[0056] This invention provides a model training method and apparatus for reducing adversarial sample transferability. Compared with existing technologies, it has the following advantages:

[0057] This invention divides the model training and optimization process into two steps: standard classification optimization and heterogeneous optimization. The classification optimization process is identical to the standard convolutional neural network training process. To simultaneously ensure the model's adversarial defense capability and classification ability, the two training and optimization processes are performed alternately. The final optimized target model can significantly reduce adversarial transferability.

[0058] The heterogeneous optimization process is the innovation of the training method proposed in this application. To address the problem that the approximate loss of the first-order Taylor expansion cannot be ignored, this application divides the adversarial perturbation ε into a combination of several small values ​​in T steps; thus solving the problem of the first-order Taylor approximation error caused by the adversarial sample not being in the neighborhood of the clean sample.

[0059] Furthermore, by fixing the parameters of the proxy model during the similarity optimization process, adversarial defenses that meet the requirements of actual attack scenarios are achieved. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart of an embodiment of the present invention;

[0062] Figure 2 This is a flowchart illustrating the generation of the input image in an embodiment of the present invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0065] Adversarial attacks refer to attacks where the attacker generates adversarial perturbations that are not visible to the naked eye based on a deep neural network model, causing the deep neural network model to malfunction.

[0066] Source model: refers to the model used by attackers to generate adversarial examples;

[0067] Proxy model: refers to a model with the same network structure as the source model, but which has not been trained.

[0068] Target model: refers to the deep neural network model that is being attacked;

[0069] Transferability: refers to the ability of an adversarial example generated based on a deep model to successfully attack a deep model that the attacker has never seen before.

[0070] The present invention aims to create a new training method for deep neural network models, which enables the trained model to cut off the transferability of adversarial examples generated by the attacker's source model (heterogeneous to the source model in terms of adversarial attacks), thereby achieving the purpose of adversarial defense.

[0071] To ensure the attacked target model correctly classifies the adversarial examples, a first-order Taylor approximation expansion is used, yielding:

[0072]

[0073] To reduce the transferability of adversarial examples, existing work aims to maximize the gradient similarity of the loss functions of the source model used by the attacker and the target model used by the attacker, attempting to make the interface between the two models orthogonal, i.e., satisfying the condition ▽f(x) in the above formula derivation. ori )·▽g(x ori =0, thereby achieving the goal of reducing adversarial mobility and adversarial defense.

[0074] After research, the inventors discovered that existing methods, when performing first-order Taylor approximation expansions, assume that adversarial examples are in the neighborhood of clean samples. However, in actual attack scenarios, the value of ε often takes the form of 8 or even 16, which is not a negligible small value for image data with pixel values ​​ranging from [0, 255]. Therefore, directly performing first-order Taylor approximation expansions introduces significant approximation errors, greatly weakening the ability of existing methods to reduce adversarial transferability.

[0075] Furthermore, existing methods, in the process of maximizing similarity, simultaneously change the parameters of both the proxy model and the target model. This alters the standard training trajectory of the proxy model, resulting in the boundary of the target model being orthogonal to the proxy model rather than the source model actually used by the attacker. This does not meet the requirements of real-world adversarial attack scenarios.

[0076] To address the aforementioned issues, this invention differs from existing methods that optimize gradient similarity between two models only in the clean sample domain. Instead, it optimizes gradient similarity across the entire adversarial path. To save computational costs, it first identifies the adversarial path where the proxy model and the target model are most similar, and then optimizes to maximize similarity among the adversarial samples along this path. The inventors believe that maximizing similarity on the adversarial samples of the most similar path is approximately equivalent to maximizing similarity across all adversarial paths. Furthermore, the parameters of the proxy model are fixed during the optimization process, ensuring that the interface between the proxy model and the source model used by the attacker is as consistent as possible.

[0077] Example 1:

[0078] like Figure 1 As shown, this invention provides a model training method for reducing adversarial sample transferability. This method is executed by a computer and includes:

[0079] S1. Obtain the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function;

[0080] S2. Calculate the cross-entropy loss of the surrogate model and the target model based on the training set, and use the stochastic gradient descent algorithm to update the parameters of the surrogate model in the nth model iteration and the parameters of the target model in the nth model iteration.

[0081] S3. Generate the input image for the nth model iteration based on the surrogate model and the target model from the nth model iteration; the input image is an image with adversarial perturbations added.

[0082] S4. Obtain the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, respectively. Fix the parameters of the surrogate model and update the parameters of the target model using stochastic gradient descent.

[0083] S5. Let n = n + 1. If n = N, output the target model; otherwise, return to S2.

[0084] Compared with the prior art, the beneficial effects of the embodiments of the present invention are as follows:

[0085] This invention divides the model training and optimization process into two steps: standard classification optimization and heterogeneous optimization. The classification optimization process is identical to the standard convolutional neural network training process. To simultaneously ensure the model's adversarial defense capability and classification ability, the two training and optimization processes are performed alternately. The final optimized target model can significantly reduce adversarial transferability.

[0086] The heterogeneous optimization process is the innovation of the training method proposed in this application. To address the problem that the approximate loss of the first-order Taylor expansion cannot be ignored, this application divides the adversarial perturbation ε into a combination of several small values ​​in T steps; thus solving the problem of the first-order Taylor approximation error caused by the adversarial sample not being in the neighborhood of the clean sample.

[0087] Furthermore, by fixing the parameters of the proxy model during the similarity optimization process, adversarial defenses that meet the requirements of actual attack scenarios are achieved.

[0088] The implementation process of the embodiments of the present invention will be described in detail below:

[0089] S1. Obtain the training set, training parameters, and model parameters;

[0090] In practice, the training set is denoted as (X, y); where X represents a sample and y represents a label.

[0091] The training parameters include:

[0092] The number of iterations required to produce a product that counters the disturbance is denoted as T;

[0093] The number of iterations required to train the network is denoted as N;

[0094] The maximum magnitude of the counter-disturbance is denoted as ε;

[0095] The model parameters include:

[0096] The surrogate model and the target model; including the structure and loss function of the surrogate model and the target model, specifically the cross-entropy loss function;

[0097] S2. Calculate the cross-entropy loss of the surrogate model and the target model based on the training set, and update the parameters of the surrogate model and the target model in the nth model iteration using the stochastic gradient descent algorithm.

[0098] In this step, the training process represents a classification optimization process, which is the same as the standard convolutional neural network training process.

[0099] S3. Generate the input image for the nth model iteration based on the surrogate model and the target model from the nth model iteration;

[0100] In specific implementation, such as Figure 2 As shown, the specific steps include the following:

[0101] S3.1 Obtain the gradient of the loss function of the surrogate model on the input image of the t-th perturbation iteration and the gradient of the loss function of the target model on the input image of the t-th perturbation iteration, respectively.

[0102] The gradient grad1 of the loss function of the input image of the surrogate model in the t-th perturbation iteration can be expressed as:

[0103]

[0104] The gradient grad2 of the loss function of the target model on the input image in the t-th perturbation iteration can be expressed as:

[0105]

[0106] Where, x t Let represent the input image in the t-th perturbation iteration, and y represent the corresponding label;

[0107] f represents the proxy model;

[0108] g represents the target model;

[0109] S3.2 Calculate the cosine loss function based on the similarity between the gradient of the loss function of the input image of the surrogate model in the tth perturbation iteration and the gradient of the loss function of the target model in the tth perturbation iteration;

[0110] The similarity, sim, between the gradient of the loss function of the surrogate model on the input image of the t-th perturbation iteration and the gradient of the loss function of the target model on the input image of the t-th perturbation iteration can be expressed as:

[0111]

[0112] Cosine loss function L cos It can be represented as:

[0113]

[0114] S3.3 Obtain the gradient of the cosine loss function, add a perturbation with an amplitude of ε / T and a direction in the same direction as the gradient of the cosine function to the input image of the tth time, and obtain the input image of the (t+1)th time.

[0115] This step aims to find the adversarial path that is most similar to the proxy model and the target model, and to generate adversarial samples along this path. These adversarial samples are then used as the worst samples in the adversarial path for subsequent optimization.

[0116] S3.4. Let t = t + 1. If t > T, obtain the current input image and execute S4; otherwise, return to S3.1.

[0117] S4. Obtain the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, respectively. Fix the parameters of the surrogate model and update the parameters of the target model using stochastic gradient descent.

[0118] In steps S3 and S4, the training process represents a heterogeneous optimization process. In conjunction with other steps, the two training optimization processes are carried out alternately, which can simultaneously ensure the model's adversarial defense capability and classification capability. In addition, the parameters of the proxy model are fixed in this step, realizing adversarial defense that meets the actual attack scenario.

[0119] S5. Let n = n + 1. If n = N, output the target model; otherwise, return to S2.

[0120] Effect verification:

[0121] Case 1: Using the standard-trained VGG19 as a surrogate model, the GoogLeNet network was trained on the CIFAR10 classification task using the method of this application.

[0122] When attackers used the standard-trained VGG19 as the source model to attack both the standard-trained GoogLeNet and the GoogLeNet trained using the method of this application, the attack success rate decreased from 33.7% to 11.2%.

[0123] When attackers use the standard-trained ResNet50 as the source model to attack both the standard-trained GoogLeNet and the GoogLeNet trained using the method of this application, the attack success rate decreases from 72.6% to 22.8%.

[0124] When attackers use the standard-trained GoogLeNet as the source model to attack both the standard-trained GoogLeNet (white-box attack) and the GoogLeNet trained using the method of this application, the attack success rate decreases from 99.8% to 18.5%.

[0125] Case 2: Using the standard-trained ResNet50 as a surrogate model, the GoogLeNet network was trained on the CIFAR10 classification task using the method of this application.

[0126] When attackers used the standard-trained VGG19 as the source model to attack both the standard-trained GoogLeNet and the GoogLeNet trained using the method of this application, the attack success rate decreased from 34.2% to 7.9%.

[0127] When an attacker uses a standard-trained ResNet50 as the source model to attack both a standard-trained GoogLeNet and a GoogLeNet trained using the method described in this application, the attack success rate decreases from 73.3% to 15.0%.

[0128] When an attacker uses a standard-trained GoogLeNet as the source model to attack both the standard-trained GoogLeNet (white-box attack) and the GoogLeNet trained using the method described in this application, the attack success rate decreases from 99.8% to 13.5%.

[0129] Example 2:

[0130] A model training apparatus for reducing adversarial sample transferability, the apparatus comprising:

[0131] The data acquisition module is used to execute S1, which includes: acquiring the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function.

[0132] A standard optimization module is used to execute S2, wherein S2 includes: calculating the cross-entropy loss of the surrogate model and the target model based on the training set, and updating the parameters of the surrogate model and the parameters of the target model in the nth model iteration using the stochastic gradient descent algorithm;

[0133] The input image generation module is used to execute S3 after executing S2; and S3 includes: generating the input image for the nth model iteration based on the surrogate model and the target model of the nth model iteration; the input image is an image with added adversarial perturbation;

[0134] The heterogeneous optimization module is used to execute S4 after executing S3; and S4 includes: obtaining the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, fixing the parameters of the surrogate model and updating the parameters of the target model using the stochastic gradient descent method.

[0135] The model output module is used to execute S5 after executing S4, and S5 includes: setting n = n + 1, if n = N, outputting the target model; otherwise, returning to S2.

[0136] It is understood that the model training apparatus for reducing adversarial sample transferability provided in the embodiments of the present invention corresponds to the model training method for reducing adversarial sample transferability described above. The explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding content in the model training method for reducing adversarial sample transferability, and will not be repeated here.

[0137] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0138] 1. Through effect verification experiments, it can be shown that the present invention can significantly reduce adversarial migration, wherein the degree of migration is characterized by the success rate of black-box attacks.

[0139] 2. The target model obtained by using this invention can not only reduce the transferability of adversarial samples generated by the source model of the same network architecture, but also successfully defend against attacks by attackers using source models of different network architectures.

[0140] 3. The target model obtained using this invention can also defend against adversarial attacks on source models trained by different optimizers, which satisfies the assumption that the defender does not know the source model selected by the attacker in actual attack and defense scenarios.

[0141] 4. The target model obtained by using this invention solves the defect that the defensive capability and classification capability of the adversarial training defense method cannot be obtained at the same time. It achieves strong defensive capability without sacrificing the model's ability to classify clean samples.

[0142] It should be noted that, through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the prior art, can be embodied in the form of software products. These computer software products can be stored in computer-readable storage media, such as ROM / RAM, magnetic disks, optical disks, etc., and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or certain portions of the embodiments. In this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. In the absence of further restrictions, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0143] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A model training method for reducing adversarial sample transferability, characterized in that, The method includes: S1. Obtain the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function; S2. Calculate the cross-entropy loss of the surrogate model and the target model based on the training set, and use the stochastic gradient descent algorithm to update the parameters of the surrogate model in the nth model iteration and the parameters of the target model in the nth model iteration. S3. Generate the input image for the nth model iteration based on the surrogate model and the target model from the nth model iteration; the input image is an image with adversarial perturbations added. S4. Obtain the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, respectively. Fix the parameters of the surrogate model and update the parameters of the target model using stochastic gradient descent. S5. Let n = n + 1. If n = N, output the target model; otherwise, return to S2. The training parameters also include: the number of iterations T required to generate the adversarial disturbance and the maximum amplitude ε of the adversarial disturbance; Furthermore, the network structure of the proxy model is the same as that of the source model, but it has not been trained. The surrogate model and target model based on the nth model iteration generate the input image for the nth model iteration; the input image is an image with added adversarial perturbations, including: S3.1 Obtain the gradient of the loss function of the input image of the surrogate model in the t-th perturbation iteration. The gradient of the loss function of the target model on the input image during the t-th perturbation iteration ; S3.2, The gradient of the loss function of the input image based on the surrogate model in the t-th perturbation iteration. The gradient of the loss function of the target model on the input image during the t-th perturbation iteration similarity Calculate the cosine loss function ; S3.3 Obtaining the cosine loss function The gradient of the input image is added to the input image of the t-th time with an amplitude of ε / T and a direction in the same direction as the gradient of the cosine function, so as to obtain the input image of the (t+1)-th time. S3.

4. Let t = t + 1. If t > T, obtain the current input image and execute S4; otherwise, return to S3.

1.

2. The model training method for reducing adversarial sample transferability as described in claim 1, characterized in that, The gradient of the loss function of the surrogate model on the input image in the t-th perturbation iteration. for: The gradient of the loss function of the target model on the input image during the t-th perturbation iteration for: in, This represents the input image in the t-th perturbation iteration. y Indicates the corresponding label; Represents the proxy model; Represents the target model.

3. The model training method for reducing adversarial sample transferability as described in claim 2, characterized in that, The similarity for: And the cosine loss function for: 。 4. An apparatus for performing the model training method for reducing adversarial sample transfer as described in claim 1, characterized in that, The device includes: The data acquisition module is used to execute S1, which includes: acquiring the training set, training parameters, and model parameters; the training parameters include: the number of iterations N required to train the network; the model parameters include: the network structure of the surrogate model and the target model, and the cross-entropy loss function. A standard optimization module is used to execute S2, wherein S2 includes: calculating the cross-entropy loss of the surrogate model and the target model based on the training set, and updating the parameters of the surrogate model and the parameters of the target model in the nth model iteration using the stochastic gradient descent algorithm; The input image generation module is used to execute S3 after executing S2; and S3 includes: generating the input image for the nth model iteration based on the surrogate model and the target model of the nth model iteration; the input image is an image with added adversarial perturbation; The heterogeneous optimization module is used to execute S4 after executing S3; and S4 includes: obtaining the cosine loss function of the surrogate model on the input image of the nth model iteration and the cosine loss function of the target model on the input image of the nth model iteration, fixing the parameters of the surrogate model and updating the parameters of the target model using the stochastic gradient descent method. The model output module is used to execute S5 after executing S4, and S5 includes: setting n=n+1, if n=N, outputting the target model; otherwise, returning to S2.

5. A model training apparatus for reducing adversarial sample transfer as described in claim 4, characterized in that, The training parameters also include: the number of iterations T required to generate the adversarial disturbance and the maximum amplitude ε of the adversarial disturbance; Furthermore, the network structure of the proxy model is the same as that of the source model, but it has not been trained.

6. A model training apparatus for reducing adversarial sample transfer as described in claim 5, characterized in that, The proxy model and target model based on the nth model iteration generate the input image for the nth model iteration; The input image is an image with added adversarial perturbations, including: S3.1 Obtain the gradient of the loss function of the input image of the surrogate model in the t-th perturbation iteration. The gradient of the loss function of the target model on the input image during the t-th perturbation iteration ; S3.2, The gradient of the loss function of the input image based on the surrogate model in the t-th perturbation iteration. The gradient of the loss function of the target model on the input image during the t-th perturbation iteration similarity Calculate the cosine loss function ; S3.3 Obtaining the cosine loss function The gradient of the input image is added to the input image of the t-th time with an amplitude of ε / T and a direction in the same direction as the gradient of the cosine function, so as to obtain the input image of the (t+1)-th time. S3.

4. Let t = t + 1. If t > T, obtain the current input image and execute S4; otherwise, return to S3.

1.

7. A model training apparatus for reducing adversarial sample transfer as described in claim 6, characterized in that, The gradient of the loss function of the surrogate model on the input image in the t-th perturbation iteration. for: The gradient of the loss function of the target model on the input image during the t-th perturbation iteration for: in, This represents the input image in the t-th perturbation iteration. y Indicates the corresponding label; Represents the proxy model; Represents the target model.

8. A model training apparatus for reducing adversarial sample transferability as described in claim 7, characterized in that, The similarity for: And the cosine loss function for: 。

Images