A low-cost adversarial sample defense method and system based on sample preprocessing

Abstract

The present invention belongs to the field of adversarial machine learning technology, and discloses a low-cost adversarial sample defense method and system based on sample preprocessing, including: receiving input samples, adjusting sample size; cutting samples, and removing some interference areas; using an image scaling module to process samples processed by the cutting module; performing pixel value unification operations on the scaled samples; performing image scaling operations on the processed samples, scaling the size to the sample size of the best sample accuracy that can be obtained when the model recognizes clean samples; inputting the processed samples into the target model, and evaluating the algorithm defense capability through evaluation indicators. The core of the present invention is the three modules of cutting non-important information in the image, unifying some pixel values, and image scaling, all of which are simple image processing operations that meet the requirements of low cost. The combined use of these three modules can achieve the dynamic defense effect required to meet different defense needs.

Description

Technical Field

[0001] The present invention belongs to the technical field of adversarial machine learning, and in particular, relates to a low-cost adversarial sample defense method and system based on sample preprocessing. Background Art

[0002] At present, various fields of artificial intelligence, especially artificial neural networks, are booming, and many achievements have been made, such as autonomous driving and target detection. However, behind the booming development, the security issues of artificial neural networks themselves are becoming increasingly serious and prominent. Especially since Szegedy et al. proposed the concept of adversarial samples in 2013, various attack algorithms specifically targeting neural networks have emerged, misleading the results predicted by neural networks to the direction envisioned by the attacker, resulting in more serious consequences. Therefore, studying how to resist these attacks is of great significance to ensuring the normal operation of neural networks.

[0003] In order to effectively resist adversarial attacks, many defense methods for neural networks have emerged, such as the defense distillation proposed in 2016. Liao et al. proposed a high-level representation guided denoiser (HGD) algorithm to solve the problem of residual noise amplification. Xie et al. added a feature denoising module to the deep neural network model to denoise the data at the image feature level, thereby better eliminating adversarial noise. Tramèr et al. proposed an ensemble adversarial training (EAT) method, which has a good defense effect against black-box attacks based on transferability. Fu et al. proposed a Double-Win-Quant method to ensure the robustness of neural networks. Croce et al. proposed a method to regularize the Rectified Linear Unit (ReLU) function in the model, so that the model using the ReLU function is more robust and better resists attacks. Xu et al. proposed a feature compression mechanism to detect whether a sample is an attack sample. Kiritani et al. proposed a model based on cyclic attention and a method of log-polar coordinate mapping to improve the robustness of the model. Song et al. proposed the PixelDefend algorithm, which destroys the attack sample by randomly perturbing the pixels of the input sample, thereby completing the defense. Yan et al. proposed a channel-based important feature selection method, which improves the robustness of the model by grafting auxiliary devices in the middle layer of the model to improve the ability to resist adversarial attacks. Wang et al. designed a defense method through Gaussian enhancement and iterative attack to help the model resist attacks. Although these algorithms propose different and effective defense strategies, their common points and shortcomings are that they need to consume additional computing resources and time costs to improve the robustness of the model before they can resist adversarial attacks. However, in practical applications, many scenarios often lack additional computing resources and time costs. Therefore, based on practical needs, the present invention needs to study a low-cost defense method to protect the model.

[0004] Through the above analysis, the problems and defects of the prior art are as follows:

[0005] Existing algorithms all need to consume additional computing resources and time costs to improve the robustness of the model before they can resist adversarial attacks. However, in practical applications, many scenarios often lack additional computing resources and time costs.

[0006] Closest Existing Technology: Adversarial Training

[0007] Adversarial training is a common adversarial sample defense strategy that aims to enhance the robustness of machine learning models against adversarial attacks. This method introduces adversarial samples during the training phase and teaches the model how to correctly identify these deliberately perturbed samples.

[0008] Technical problems existing in existing technologies:

[0009] 1) Generalization problem:

[0010] Adversarial training mainly targets known attack types during training. For new or unknown attack methods, the model's defense effect is greatly reduced. This limits the model's ability to defend against future attacks.

[0011] 2) Training cost and time:

[0012] Adversarial training requires additional time and resources to generate adversarial examples and to continuously adjust the model to adapt to these examples during training. This makes the training process more complex and time-consuming.

[0013] 3) Accuracy decreases:

[0014] In some cases, adversarial training sacrifices the accuracy of the model on clean samples in order to enhance the robustness of the model. In other words, while the model defends against adversarial samples, it reduces its ability to recognize normal samples.

[0015] 4) Adaptability of attack methods:

[0016] Adversarial training causes attackers to adapt and develop new attack strategies to bypass defenses. This "arms race" cycle makes continuous security defense more difficult.

[0017] In general, although adversarial training has achieved certain results in improving the robustness of models to existing adversarial examples, it still faces challenges in terms of generalization ability, training cost and time, accuracy balance, and coping with new attack methods. In contrast, the Tengpai algorithm provides a different defense mechanism by preprocessing input samples rather than modifying the model or training process, which is more efficient and flexible in some aspects. Summary of the invention

[0018] In view of the problems existing in the prior art, the present invention provides a low-cost adversarial sample defense method and system based on sample preprocessing.

[0019] Since the effect of the defense method proposed in the present invention on the image sample is similar to the appearance of the cold weapon rattan shield, and there is no similar algorithm at present, it is named rattan shield algorithm. The core idea of ​​the rattan shield algorithm is to regard both clean samples and perturbed samples as perturbed samples, and generate new input samples by destroying the original input samples. Destroy the original uncontrollable adversarial disturbance in the sample, and then the defender will generate a controllable new disturbance again. By turning the disturbance factor into a factor that the defender can control, adversarial attacks can be effectively dealt with. For example, a better defense effect can be achieved, so that the sample accuracy rate of the model when identifying the perturbed sample becomes higher, or deliberately achieve a poor defense effect, thereby confusing the attacker and ultimately achieving other purposes of the defender.

[0020] The present invention is implemented as follows: a low-cost adversarial sample defense method based on sample preprocessing - the Tengpai algorithm, the low-cost adversarial sample defense method based on sample preprocessing includes:

[0021] Step 1: receiving input samples and adjusting sample size;

[0022] Step 2: Cut the sample to remove some interference areas;

[0023] Step 3, use the image scaling module to process the samples processed by the cutting module;

[0024] Step 4: performing pixel value unification operation on the scaled samples;

[0025] Step 5: Scaling the processed samples to a size that provides the best sample accuracy when the model recognizes clean samples.

[0026] Step six: Input the processed samples into the target model and evaluate the algorithm's defense capabilities through evaluation indicators.

[0027] Furthermore, in step one, the original input sample size is adjusted. Assuming that the original input size is 64×64, after using the Tengpai algorithm as a defense measure, it needs to be adjusted to a size larger than 64×64 so that it can be used as an input sample of the Tengpai algorithm.

[0028] Furthermore, in step 2, the retained area is determined by calculating the difference in pixel values ​​of adjacent pixels. After the retained area is selected, the size of the retained area is enlarged to the size B before the cutting process. px ×B px .

[0029] Furthermore, in step 4, the defender needs to provide an ordered list containing some pixel values, and then uniformly change the values ​​of the pixels in the sample whose pixel values ​​are within the range of any two adjacent pixel values ​​in this list to the average of the two adjacent pixel values. For example, if the pixel values ​​of pixels between C and D meet the requirements, then the pixel values ​​of these pixels are uniformly changed to

[0030] Further, in step 5, the sample size is scaled to A px ×A px .

[0031] Furthermore, the low-cost adversarial sample defense method based on sample preprocessing can be used for simulation experiments through a software platform. The software platform can choose to use Google Colab or anaconda, install and call library functions required by various programs on this platform, and adopt an open source cross-platform Python library. The cleverhans library is used to implement adversarial sample attacks, and the adversarial sample defense method of the present invention is used to implement adversarial sample defense in adversarial scenarios.

[0032] Another object of the present invention is to provide a low-cost adversarial sample defense system based on sample preprocessing, the low-cost adversarial sample defense system based on sample preprocessing comprising:

[0033] An image scaling module, used to process samples by using a zoom-in operation or a zoom-out operation according to the modules used before and after;

[0034] The image redundant information cutting module is used to cut the sample and remove some interference areas;

[0035] The pixel value unification module is used to perform pixel value unification operations.

[0036] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the low-cost adversarial sample defense method based on sample preprocessing.

[0037] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the low-cost adversarial sample defense method based on sample preprocessing.

[0038] Another object of the present invention is to provide an information data processing terminal, which is used to implement the low-cost adversarial sample defense system based on sample preprocessing.

[0039] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0040] First, the present invention solves the problem that in practical applications, the previous algorithms require additional computing resources and time costs to improve the robustness of the model, and then can resist adversarial attacks. A low-cost defense method based on sample preprocessing, the rattan pai algorithm, is proposed. The core of the rattan pai algorithm is the three modules of cutting non-important information in the image, unifying partial pixel values, and image scaling. The combined use of these three modules can achieve the dynamic defense effect required to meet different defense needs. These three modules are all simple image processing operations, and do not require the training of additional models to meet the low-cost requirements. At the same time, these three modules are used in combination to resist attacks together, so that the defense effects of the three modules are superimposed, meeting the requirements of maintaining effective defense. Among them, by cutting the non-important information part of the image, some information that is useless for correct identification can be removed, and a sample that still retains the main information but is relatively simple can be obtained, thereby improving the accuracy of the final successful identification.

[0041] Second, the present invention has a more efficient adversarial sample detection: compared with the traditional adversarial sample detection method, the present invention does not require the training of additional models, reduces the time complexity of the detection algorithm, and can more efficiently defend against adversarial samples.

[0042] The present invention has more robust adversarial sample detection: since the three modules of the present application are used in combination to jointly resist attacks, the defense effects of the three modules are superimposed, meeting the requirement of maintaining effective defense.

[0043] The low-cost adversarial sample defense method based on sample preprocessing of the present invention has the advantages of being more efficient and more robust, and can have broad application prospects in adversarial sample defense.

[0044] Third, the expected benefits and commercial value of the technical solution of the present invention after transformation are:

[0045] 1) Improve the efficiency of detecting adversarial samples: Previous adversarial attack defense methods require additional computing resources and time costs, while the method of the present invention does not require training additional models, reduces time complexity, meets low-cost requirements, and thus improves the defense efficiency against adversarial samples.

[0046] 2) Enhance the robustness of the machine learning system: Using the method of the present invention, it is possible to effectively defend against adversarial sample attacks, thereby improving the robustness of the machine learning system.

[0047] 3) Protect brand reputation: Adversarial sample attacks cause model output errors, thus affecting the brand reputation of the enterprise. By deploying the method of the present invention, enterprises can improve the credibility of their machine learning systems and reduce the negative impact caused by model errors.

[0048] 4) Compliance requirements: In some industries, especially in finance and healthcare, compliance requirements are very high. The method of the present invention can help ensure that machine learning models can still meet the requirements of regulations and industry standards when facing potential attacks, thereby reducing the legal liability faced by enterprises.

[0049] Fourth, the low-cost adversarial sample defense method based on sample preprocessing proposed in this invention has made significant technical progress in the field of adversarial sample attack defense. The following is a detailed analysis of the specific technical progress achieved by the algorithm:

[0050] 1) Effective counter-attack strategy

[0051] Controlling disturbance factors: By treating all input samples as disturbance samples and actively introducing controllable disturbances, the Tengpai algorithm effectively destroys the original uncontrollable adversarial disturbances. This active control strategy enables the defender to deal with adversarial attacks more effectively.

[0052] Enhance model robustness: Through preprocessing methods (such as cutting, scaling, and pixel value unification operations), the Tengpai algorithm enhances the robustness of the target model against bad input samples and improves the accuracy of the model in identifying perturbed samples.

[0053] 2) Low-cost implementation

[0054] No need to modify the model structure: As a preprocessing method, the Vengpai algorithm does not require any modification to the existing model structure. Therefore, it provides a low-cost solution for protecting existing models from adversarial attacks.

[0055] Wide applicability: Since the algorithm is based on sample preprocessing, it can be widely applied to different types of models and data sets, increasing its scope of applicability.

[0056] 3) Improve algorithm transparency and explainability

[0057] Clear operation steps: The Vinepai algorithm improves the transparency and explainability of the defense method through specific and explainable image processing steps (such as cutting, scaling, and pixel value normalization).

[0058] Flexible adjustment mechanism: The algorithm allows defenders to flexibly adjust the preprocessing steps according to different defense requirements (such as improving accuracy or confusing attackers), providing a more flexible and adaptable defense strategy.

[0059] 4) Easy to implement and test

[0060] Software platform implementation: The Tengpai algorithm can be implemented through common software platforms (such as Google Colab or Anaconda), which is easy to deploy and test in existing computing environments.

[0061] Compatibility with open source libraries: The algorithm can use open source Python libraries (such as cleverhans) to implement adversarial sample attacks and defenses, making testing and verification more convenient.

[0062] Overall, the Tengpai algorithm has achieved important technical progress in the field of defense against adversarial sample attacks, especially in improving defense efficiency and reducing implementation costs. Through intelligent preprocessing of input samples, this method provides an effective way to improve the robustness and security of machine learning models. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is a flow chart of a method provided by an embodiment of the present invention;

[0064] Figure 2 It is the experimental result of adjusting the initial input size of CIFAR10 samples using other defense methods and the present defense method provided by the embodiment of the present invention;

[0065] Figure 3 It is the experimental result of adjusting the initial input size of MNIST samples using other defense methods and the present defense method provided by the embodiment of the present invention;

[0066] Figure 4 The example provided by the present invention uses the FGSM attack sample and the sample modification result of the defense method on the CIFAR10 data set;

[0067] Figure 5 The embodiment of the present invention provides the modification results of the samples using FGSM attack and the defense method on the MNIST data set. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0069] Based on the principle of the rattan-pai algorithm, we can conceive of the following two specific embodiments and their specific implementation schemes:

[0070] Example 1: Protecting the face recognition system

[0071] 1) Receive and adjust face images:

[0072] Collect raw image samples for face recognition.

[0073] Resize the image to make it larger than the original input size (e.g. from 64×64 to 128×128).

[0074] 2) Image preprocessing:

[0075] The image is cut to remove the areas containing adversarial perturbations.

[0076] Use the image scaling module to process the cut samples.

[0077] 3) Unification of pixel values:

[0078] The pixel values ​​of the image are unified according to the preset pixel value range.

[0079] 4) Zoom in again:

[0080] Scale the processed images to the size that gives the best sample accuracy.

[0081] 5) Input face recognition model:

[0082] Input the processed image samples into the face recognition model.

[0083] Evaluate the recognition accuracy of the model to verify the defensive effect of the Tengpai algorithm.

[0084] #Application value:

[0085] Improve the defense capability of face recognition systems against adversarial attacks.

[0086] Ensure that the system can still accurately recognize faces even in the face of malicious perturbations.

[0087] Example 2: Protecting Traffic Sign Recognition System

[0088] 1) Receive and adjust traffic sign images:

[0089] Collect raw image samples for traffic sign recognition.

[0090] Resize the image to fit the input requirements of the Tengpai algorithm.

[0091] 2) Image preprocessing:

[0092] Perform a cropping process on the image to remove regions containing adversarial perturbations.

[0093] Apply the image scaling module to process the cropped samples.

[0094] 3) Unification of pixel values:

[0095] The pixel values ​​of the image are normalized to reduce the impact of adversarial perturbations.

[0096] 4) Zoom in again:

[0097] Scale the processed images to the size that gives the model the best recognition accuracy.

[0098] 5) Input traffic sign recognition model:

[0099] The processed image is input into the traffic sign recognition model.

[0100] Evaluate the recognition performance of the model and verify the defensive effect of the rattan pai algorithm.

[0101] #Application value:

[0102] Improving the robustness of traffic sign recognition in autonomous driving systems.

[0103] Prevent traffic safety hazards caused by adversarial attacks.

[0104] These two examples demonstrate the wide applicability of the Tengpai algorithm in different application fields. Through intelligent preprocessing of input samples, this method can effectively defend against adversarial attacks and enhance the security and reliability of key systems.

[0105] The low-cost adversarial sample defense method based on sample preprocessing provided by the embodiment of the present invention, namely, the rattan pai algorithm, uses A to D to represent pure numerical values, px to represent pixels, and dpi to represent pixel values, such as Figure 1 As shown, the specific steps include:

[0106] S101, receiving input samples and adjusting sample size;

[0107] S102, cutting the sample to remove some interference areas;

[0108] S103, using the image scaling module to process the sample processed by the cutting module;

[0109] S104, performing a pixel value unification operation on the scaled samples;

[0110] S105, performing an image scaling operation on the processed samples, scaling the size to a sample size with the best sample accuracy that can be obtained when the model recognizes clean samples;

[0111] S106, input the processed samples into the target model, and evaluate the algorithm defense capability through evaluation indicators.

[0112] Step 1 provided in the embodiment of the present invention requires adjusting the original input sample size. Assuming that the original input size is 64×64, after using the Rattan Pai algorithm as a defense measure, it needs to be adjusted to a size larger than 64×64 so that it can be used as the input sample of the Rattan Pai algorithm.

[0113] Step 2 provided by the embodiment of the present invention is to determine the reserved area by calculating the difference in pixel values ​​of adjacent pixels. After selecting the reserved area, the size of the reserved area is enlarged to the size B before the cutting process. px ×B px .

[0114] In step 4 provided by the embodiment of the present invention, the defender needs to provide an ordered list containing some pixel values, and then uniformly change the values ​​of the pixel points in the sample whose pixel values ​​are within the range of any two adjacent pixel values ​​in the list to the average value of the two adjacent pixel values. For example, the pixel points whose pixel values ​​are between C and D meet the requirements, then the pixel values ​​of these pixel points are uniformly changed to

[0115] Step 5 provided in the embodiment of the present invention is to scale the sample size to A. px ×A px .

[0116] The embodiments of the present invention can conduct simulation experiments through a software platform. The software platform can choose to use Google Colab or anaconda. Library functions required by various programs are installed and called on this platform. An open source cross-platform Python library is used, and the cleverhans library is used to implement adversarial sample attacks, thereby realizing adversarial sample defense using the adversarial sample defense method of the present invention in an adversarial scenario.

[0117] The low-cost adversarial sample defense system based on sample preprocessing provided by the embodiment of the present invention includes:

[0118] An image scaling module, used to process samples by using a zoom-in operation or a zoom-out operation according to the modules used before and after;

[0119] The image redundant information cutting module is used to cut the sample and remove some interference areas;

[0120] The pixel value unification module is used to perform pixel value unification operations.

[0121] The low-cost adversarial sample defense method based on sample preprocessing provided in the application embodiment of the present invention is applied to a computer device, wherein the computer device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the low-cost adversarial sample defense method based on sample preprocessing.

[0122] The low-cost adversarial sample defense method based on sample preprocessing provided in the application embodiment of the present invention is applied to an information data processing terminal, and the information data processing terminal is used to implement the low-cost adversarial sample defense system based on sample preprocessing.

[0123] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0124] The technical solution of the present invention is applied to an image classifier based on a deep neural network, which can accurately classify data sets such as the handwritten data set MNIST and the image data set CIFAR10. In order to protect the target model based on the image classifier of the deep neural network from the attack of adversarial samples, the present application uses the rattan pai algorithm to treat both clean samples and perturbed samples as perturbed samples, and generates new input samples by destroying the original input samples. The original uncontrollable adversarial disturbance in the sample is destroyed, and then the defender generates a new controllable disturbance again. By changing the disturbance factor into a factor that the defender can control, adversarial attacks can be effectively dealt with. For example, a better defense effect can be achieved, so that the sample accuracy rate of the model when identifying the perturbed sample becomes higher, or a bad defense effect is deliberately achieved, thereby confusing the attacker and ultimately achieving other purposes of the defender.

[0125] In order to verify the feasibility and effectiveness of the low-cost adversarial sample defense method based on sample preprocessing, two datasets, CIFAR10 (1024-dimensional attribute values) and handwriting dataset MNIST (784-dimensional attribute values), were used for algorithm verification. Three models, squeezenet1_1, mnasnet1_3 and mobilenet_v3_large, were selected as target models, and the adversarial attack algorithms were FGSM, PGD, DeepFool and MIM. The sample size when training the model using the MNIST dataset was 28, and the sample size when training the model using the CIAFR10 dataset was 64.

[0126] Sample input size: 256×256 for attack and defense experiments, and 28, 32, 64, 128, and 256 for parameter selection experiments. The selection range of CIAFR10 dataset does not include 28.

[0127] The scaled size is 95 for both the MNIST and CIFAR10 datasets.

[0128] The sample size for the best sample accuracy when identifying clean samples is 28 for MNIST and 64 for CIFAR10.

[0129] Defense is performed on normal samples and on attacked samples. The samples required for the experiment are clean samples that have not been modified, clean samples that have been modified by the Tengpai algorithm, attack samples, and attack samples that have been modified by the Tengpai algorithm. The clean samples that have not been modified are the control group of the experiment, and the sample accuracy of the control group is 100%. We use these samples as test samples to test two data sets and four attack algorithms. The tested data is shown in Table 1, where Clean represents the clean samples modified by the Tengpai algorithm.

[0130] The experimental results of using other defense methods and the present defense method in adjusting the initial input size of CIFAR10 and MNIST samples provided by the embodiments of the present invention are as follows: Figure 2 , Figure 3 shown.

[0131] Figure 4 This is a modification result of using the FGSM attack sample and the sample of the defense method on the CIFAR10 data set provided by an embodiment of the present invention. Figure 5 This is the modification result of using the FGSM attack sample and the sample of the defense method on the MNIST data set provided by the embodiment of the present invention.

[0132] Embodiment 1:

[0133]

[0134] From the sample accuracy of the Tengpai algorithm in Table 1, it can be seen that the Tengpai algorithm can currently defend against several different models and data sets, and can effectively defend against several different types of attacks: gradient sign-based (FGSM), iteration-based (PGD), hyperplane-based (DeepFool) and momentum-based (MIM) attacks. From the test data of the PGD and MIM attack algorithms, it can be seen that the Tengpai algorithm can help the model recover the sample accuracy from 0.00% to 81.66% to 95.50% when it is attacked. For the unattacked case, the sample accuracy of the clean samples modified by the Tengpai algorithm can reach a minimum of 88.50%, and most of them remain above 91.00%, and can even reach 99.32%, which is approximately equal to the sample accuracy of the unmodified clean samples. For these clean samples, the overall difference in sample accuracy before and after modification is within an acceptable range.

[0135] Therefore, through this experiment, we can conclude that the current Tengpai algorithm can effectively resist the four attacks on the data set and model combination listed in Table 1, and is not easily affected by external factors (models, data sets and attack algorithms), and has good defense effect and good robustness.

[0136] The above simulation experiments verified and applied the proposed algorithm, proving the availability and effectiveness of the algorithm. In addition, the core of the algorithm is the three modules of cutting non-important information in the image, unifying some pixel values, and scaling the image. The combined use of these three modules can achieve the dynamic defense effect required to meet different defense needs. These three modules are simple image processing operations, do not require training of additional models, and meet the low-cost requirements. At the same time, these three modules are used in combination to resist attacks together, so that the defense effects of the three modules are superimposed, meeting the requirements of maintaining effective defense. Among them, by cutting the non-important information part of the image, some information that is useless for correct identification can be removed, and a relatively simple sample that still retains the main information can be obtained, thereby improving the accuracy of the final successful identification.

[0137] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

[0138] In this application, all actions to obtain signals, information or data are carried out in compliance with the relevant data protection laws and policies of the country where they are located and with the authorization given by the owner of the corresponding device.

Claims

1. A low-cost adversarial sample defense method based on sample preprocessing, characterized in that: include: Step 1: receiving input samples and adjusting sample size; Step 2: Use the cutting image redundant information module to cut the sample and remove some interference areas; Step 3, use the image scaling module to process the samples processed by the cutting module; Step 4: Use a pixel value unification module to perform pixel value unification operation on the scaled samples; Step 5: Scaling the sample processed in step 4 to a sample size that can achieve the best sample accuracy when the model recognizes clean samples; Step 6: Input the processed samples into the target model and evaluate the algorithm's defense capability through evaluation indicators; In the step 1, the original input sample size is adjusted. Assuming that the original input size is 64×64, after using the low-cost adversarial sample defense method based on sample preprocessing as a defense means, it needs to be adjusted to a size larger than 64×64 so that it can be used as an input sample of the low-cost adversarial sample defense method based on sample preprocessing; In the second step, the reserved area is determined by calculating the difference in pixel values ​​of adjacent pixels, and after the reserved area is selected, the size of the reserved area is enlarged to the size before the cutting process; In step 4, the defender needs to provide an ordered list containing some pixel values, and then uniformly change the values ​​of the pixel points in the sample whose pixel values ​​are within the range of any two adjacent pixel values ​​in this list to the average value of the two adjacent pixel values.

2. The low-cost adversarial sample defense method based on sample preprocessing according to claim 1 is characterized in that: The low-cost adversarial sample defense method based on sample preprocessing can be used for simulation experiments through a software platform. The software platform can choose to use Google Colab or anaconda, install and call library functions required by various programs on this platform, and adopt an open source cross-platform Python library. The cleverhans library is used to implement adversarial sample attacks, and the adversarial sample defense method is used to implement adversarial sample defense in adversarial scenarios.

3. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the low-cost adversarial sample defense method based on sample preprocessing as described in any one of claims 1-2.

4. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the low-cost adversarial sample defense method based on sample preprocessing as described in any one of claims 1-2.

Images