An adversarial sample defense method and system for image classification tasks

Abstract

The application discloses an adversarial sample defense method and system for an image classification task, constructs an image adversarial sample purifier with a deep convolutional autoencoder with a residual structure, and adopts image training data with added Gaussian noise to train the image adversarial sample purifier, minimizes the training loss of the image adversarial sample purifier, and obtains a pre-trained image adversarial sample purifier; the pre-trained image adversarial sample purifier is used to purify preprocessed image samples, and a low image classification model is used to train the purified image samples, the image training data with added Gaussian noise is used to train the image adversarial sample purifier, the classification accuracy of the purified normal image samples and the image adversarial samples on the pre-trained image classification model is improved, then the difference between the purifiers is maximized, the continuity randomness is used, and the generation of the image adversarial samples by the attacker on the pre-trained image classification model is prevented.

Description

Technical Field

[0001] This invention relates to the field of adversarial example defense for deep learning models, and specifically to an adversarial example defense method and system for image classification tasks. Background Technology

[0002] As deep learning is applied to numerous pattern recognition tasks and continues to push the limits of artificial intelligence, its performance in some tasks has even surpassed that of humans. However, it is susceptible to adversarial examples, which can output incorrect classification results with high confidence. This seriously threatens the normal operation of high-safety-requirement scenarios such as autonomous driving.

[0003] Adversarial sanitization, a type of adversarial example defense, eliminates the negative impact of adversarial perturbations on classification results before samples are input into a deep learning classifier. It typically involves one or two operations: input sample destruction and input sample reconstruction. The first type of adversarial sanitization uses various operations to destroy adversarial perturbations. Buckman et al. proposed a discretization method to preprocess the input samples. Hosseini et al. used random subsampling to preprocess the input samples. Qiu et al. first used quantization based on discrete cosine transform to compress the input samples, then used random elimination and shifting to further distort them. Raff et al. combined many native transformations into a single random operation to preprocess the input samples. These methods are model-independent. Xie et al. and Borkar et al. added a trainable preprocessing module to the intermediate layer of the deep learning classifier to preprocess the features. These methods are model-dependent. Furthermore, all of the above methods destroy the benign information on the surface of the input samples, severely affecting the generalization ability of the deep learning classifier.

[0004] The second type of adversarial sanitization first destroys the adversarial perturbation and then reconstructs the input sample. Song et al. first added random Gaussian noise to the input sample and then used PixelCNN to sanitize it. Liao et al. used the feature reconstruction loss of a deep learning classifier to train Unet and sanitize the input sample. Dai et al. trained Unet and used an adaptive stopping strategy to ensure that the neural network mainly learns robust features. Zhang et al. used the feature reconstruction loss of a deep learning classifier to train an image reconstruction network and added a random operation at the end of the network. These methods are model-dependent. Jia et al. first proposed a compressed convolutional neural network to remove redundant information from the input sample while preserving its structural information. Then, they used a reconstructive convolutional neural network to reconstruct the input sample with high quality. Mustafa et al. sanitized the input sample in the wavelet domain and reconstructed it using an image super-resolution network. These methods are semi-model-dependent. Prakash et al. first randomly replaced some pixel values ​​in the input sample with surrounding pixel values ​​based on the activation map. Then, they smoothed the modified input sample in the wavelet domain. Yang et al. randomly destroyed some pixels in the input sample and used matrix estimation to reconstruct it. These methods are model-independent.

[0005] Among the aforementioned adversarial cleanup methods, model-dependent methods are susceptible to secondary attacks under both white-box and black-box settings. Although semi-model-dependent and model-independent methods contain non-differentiable operations, they still suffer from secondary attacks under both white-box and black-box settings, as exemplified by BPDA adversarial examples and EOT adversarial examples. Summary of the Invention

[0006] The purpose of this invention is to provide an adversarial example defense method and system for image classification tasks, so as to overcome the shortcomings of the prior art.

[0007] An adversarial example defense method for image classification tasks includes the following steps:

[0008] S1. Construct an image adversarial sample cleaner with a deep convolutional autoencoder with residual structure, and train the image adversarial sample cleaner with image training data with added Gaussian noise to minimize the training loss of the image adversarial sample cleaner and obtain a pre-trained image adversarial sample cleaner.

[0009] S2 uses a pre-trained image adversarial sample cleaner to clean up the pre-processed image samples, and then uses the cleaned image samples to train the low-resolution image classification model.

[0010] Preferably, image training data with added Gaussian noise. Specifically, this includes adding Gaussian noise Z. KNormal image sample X+Z K Image adversarial examples Add Gaussian noise Z K Image adversarial examples

[0011] Preferably, image training data with added Gaussian noise is used. Train N image adversarial example purifiers {Φ1,…,Φ K ,…,Φ N During the process, the initial image adversarial sample cleaner is initialized using initial parameters, and the (K-2)th image adversarial sample cleaner Φ is initialized. K-2 Adversarial sample cleaner Φ for the (K-1)th image K-1 The parameter θ K-1 As an initialization parameter.

[0012] Preferably, each image adversarial sample cleaner Φ K loss function L K Includes: purified image samples Minimum mean square error loss compared to normal image sample X, and cleaned image sample Cross-entropy classification loss on a pre-trained image classification model F.

[0013] Preferably, the N image adversarial example purifiers {Φ1,…,Φ1} obtained through training K ,…,Φ N Each pre-trained image classification model F is combined with one of the image adversarial sample cleaners to form different decision boundaries.

[0014] Preferably, the image adversarial examples used to train the first image adversarial example purifier Φ1 are... The Kth image adversarial example purifier Φ is generated using a pre-trained image classification model F and trained accordingly. K Image adversarial examples These are the adversarial sample cleaners for the K-1 and K-2 images, respectively. K-1 ,Φ K-2 The combination of} and a pre-trained image classification model F is used to generate it.

[0015] Preferably, during the training of the image adversarial example cleaner using image training data with added Gaussian noise, discontinuous optimization parameters are used to minimize the training loss {L1,…,L...}. K ,…,L N}, obtain N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N}

[0016] An adversarial example defense system for image classification tasks includes an image adversarial example cleaner and a defense module;

[0017] Image adversarial sample cleaner: An image adversarial sample cleaner is obtained by constructing a deep convolutional autoencoder with residual structure and training the image adversarial sample cleaner with image training data with added Gaussian noise, so as to minimize the training loss of the image adversarial sample cleaner.

[0018] The defense module purifies pre-processed image samples using a pre-trained image adversarial sample purifier, and then trains a low-resolution image classification model using the purified image samples.

[0019] Preferably, image training data with added Gaussian noise. Specifically, this includes adding Gaussian noise Z. K Normal image sample X+Z K Image adversarial examples Add Gaussian noise Z K Image adversarial examples

[0020] Preferably, image training data with added Gaussian noise is used. Train N image adversarial example purifiers {Φ1,…,Φ K ,…,Φ N During the process, the initial image adversarial sample cleaner is initialized using initial parameters, and the (K-2)th image adversarial sample cleaner Φ is initialized. K-2 Adversarial sample cleaner Φ for the (K-1)th image K-1 The parameter θ K-1 As an initialization parameter.

[0021] Compared with the prior art, the present invention has the following beneficial technical effects:

[0022] This invention provides an adversarial example defense method for image classification tasks. It constructs an image adversarial example purifier using a deep convolutional autoencoder with residual structures and trains it with image training data containing Gaussian noise, minimizing the training loss to obtain a pre-trained image adversarial example purifier. The pre-trained purifier is then used to purify pre-processed image samples. The purified image samples are then used to train the image classification model. This invention uses Gaussian noise-added image training data to train the image adversarial example purifier, improving the classification accuracy of purified normal image samples and adversarial images on the pre-trained image classification model. Then, by maximizing the difference between purifiers and using continuous randomness, it prevents attackers from generating adversarial images on the pre-trained image classification model.

[0023] Preferably, the initial image adversarial sample cleaner is initialized using initial parameters, and the (K-2)th image adversarial sample cleaner Φ is initialized. K-2 Adversarial sample cleaner Φ for the (K-1)th image K-1 The parameter θ K-1 As an initialization parameter, this prevents Φ K Catastrophic forgetting occurs, making it impossible to use adversarial examples of images. Cleaned to a normal image sample. Attached Figure Description

[0024] Figure 1 This is a flowchart of an adversarial example defense method for image classification tasks in an embodiment of the present invention.

[0025] Figure 2 This is a flowchart illustrating the training process of an image adversarial sample cleaner using image training data with added Gaussian noise in an embodiment of the present invention.

[0026] Figure 3 This is a training image for a low-resolution image classification model using purified image samples in an embodiment of the present invention.

[0027] Figure 4 In this embodiment of the invention, N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N Network structure diagram of}.

[0028] Figure 5 In this embodiment of the invention, N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N In the context of training data dependencies, parameter dependencies are related to training data dependencies.

[0029] Figure 6 In this embodiment of the invention, N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N The decision boundary formed by}.

[0030] Figure 7 This is a graph showing the change in the attacker's success rate as the number of purifiers increases in the PGD adversarial sample in an embodiment of the present invention.

[0031] Figure 8 This is a graph showing the change in the attacker's success rate as the number of iterations increases in the PGD adversarial sample in this embodiment of the invention.

[0032] Figure 9 This is a graph showing the change in the attacker's success rate as the adversarial perturbation increases in the PGD adversarial sample in an embodiment of the present invention.

[0033] Figure 10 This is a graph showing the change in the attacker's success rate as the number of iterations increases in the C&W adversarial sample in this embodiment of the invention.

[0034] Figure 11 This is a graph showing the change in the attacker's success rate as the number of queries increases in the Square adversarial sample in this embodiment of the invention.

[0035] In the picture, Detailed Implementation

[0036] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0038] like Figure 1 As shown, this invention provides an adversarial example defense method for image classification tasks, specifically including the following steps:

[0039] S1. Construct an image adversarial sample cleaner with a deep convolutional autoencoder having a residual structure, and train the image adversarial sample cleaner using image training data with added Gaussian noise to minimize the training loss of the image adversarial sample cleaner, thus obtaining a pre-trained image adversarial sample cleaner, such as... Figure 2 As shown;

[0040] S2 uses a pre-trained image adversarial example cleaner to clean the pre-processed image samples, and then uses the cleaned image samples to train a low-level image classification model, such as... Figure 3As shown, this invention uses image training data with added Gaussian noise to train an image adversarial example cleaner, improving the classification accuracy of the cleaned normal image samples and image adversarial examples on the pre-trained image classification model. Then, it maximizes the difference between the cleaners and uses continuous randomness to prevent attackers from generating image adversarial examples on the pre-trained image classification model.

[0041] Specifically, in this application, Gaussian noise is added to the image training data. Specifically, this includes adding Gaussian noise Z. K Normal image sample X+Z K Image adversarial examples Add Gaussian noise Z K Image adversarial examples

[0042] Image training data with added Gaussian noise Train N image adversarial example purifiers {Φ1,…,Φ K ,…,Φ N Each image adversarial sample cleaner Φ K The network structures are all deep convolutional autoencoders with residual structures.

[0043] Image training data with added Gaussian noise Train N image adversarial example purifiers {Φ1,…,Φ K ,…,Φ N During the process, the initial image adversarial sample cleaner is initialized using initial parameters, and the (K-2)th image adversarial sample cleaner Φ is initialized. K-2 Adversarial sample cleaner Φ for the (K-1)th image K-1 The parameter θ K-1 As an initialization parameter, this prevents Φ K Catastrophic forgetting occurs, making it impossible to use adversarial examples of images. Cleaned to a normal image sample X.

[0044] Each image adversarial sample purifier Φ K loss function L K Includes: purified image samples Minimum mean square error loss compared to normal image sample X, and cleaned image sample Cross-entropy classification loss on a pre-trained image classification model F.

[0045]

[0046] Where c is the number of channels in the image sample, h is the height of the image sample, w is the width of the image sample, and i represents the index.

[0047] In this application, N image adversarial example purifiers {Φ1,…,Φ are obtained through training. K ,...,Φ N Each pre-trained image classification model F is combined with one of the image adversarial sample cleaners to form different decision boundaries. The newly formed decision boundaries do not affect the classification accuracy of normal image samples X.

[0048] N image adversarial sample cleaners {Φ1,...,Φ} obtained through training K ,…,Φ N The adversarial examples generated on the Kth combination are each combined with a pre-trained image classification model F. The first to K-1 and K+1 to N combinations are invalid.

[0049] Training the first image adversarial sample purifier Φ1 for image adversarial samples The Kth image adversarial example purifier Φ is generated using a pre-trained image classification model F and trained accordingly. K Image adversarial examples These are the adversarial sample cleaners for the K-1 and K-2 images, respectively. K-1 ,Φ K-2 The combination of} and a pre-trained image classification model F is used for generation; the purpose of this is to prevent Φ K Catastrophic forgetting occurs, making it impossible to use adversarial examples of images. Cleaned to a normal image sample X.

[0050] During the training of the image adversarial example cleaner using image training data with added Gaussian noise, discontinuous optimization parameters are used to minimize the training loss {L1,...,L...}. K ,…,L N}, obtain N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N}

[0051] This invention not only has no impact on the classification accuracy of normal image samples X on the pre-trained image classification model F, but also effectively prevents attackers from generating adversarial image samples X on the pre-trained image classification model F. adv .

[0052] The image adversarial sample cleaner with a residual structure constructed in this application can be applied to fields such as medical image segmentation, image denoising, image super-resolution reconstruction, and diffusion generation models.

[0053] In one embodiment of this application, whenever an image adversarial example cleaner Φ is trained... KReinitialize the parameters of the next image adversarial sample cleaner; using successive optimization parameters will make the parameters determined by Φ K-1 With Φ K The resulting decision boundaries are locally similar.

[0054] This invention improves the classification accuracy of cleaned adversarial examples Φ(X) by adding random Gaussian noise Z to the training data without affecting the classification accuracy of normal image samples X on the pre-trained image classification model F. adv The classification accuracy of θ) on the pre-trained image classification model F. This invention uses N different purifiers {Φ1,…,Φ}. K ,…,Φ N By performing continuous random operations, attackers can directly prevent the pre-trained image classification model F from generating adversarial image examples X. adv .

[0055] The training data contains high, medium, and low density regions. In the high-density region, sample X or Xb... adv It is insensitive to Gaussian noise Z and exhibits high robustness. In the medium-density region, sample X or X0 adv It is moderately sensitive to Gaussian noise Z and exhibits moderate robustness. In low-density regions, sample X or X0 adv It is sensitive to Gaussian noise Z and has low robustness. This invention addresses this by providing adversarial examples X. adv Adding random Gaussian noise Z can expand the adversarial region in the training data, making the purifier Φ pay more attention to the low robustness data region; by adding random Gaussian noise Z to the normal sample X, the purifier Φ can establish a manifold mapping between the normal sample X+Z containing random Gaussian noise Z and the normal sample X more easily than establishing a manifold mapping between normal samples X and normal samples X.

[0056] This invention Φ K-1 The training data includes: image adversarial examples and Φ K-1 Capable of using adversarial examples in images and Cleaned to a normal image sample X. Φ K The initialization parameter is θ K-1 The training data includes: image adversarial examples. and Φ K pass Repair by Φ K-1 The decision boundary of the formed adversarial zone, through Maintain by Φ K-1 The decision boundary of the formed normal region. Therefore, Φ K Capable of using adversarial examples in images Cleaned to a normal image sample X. Φ K-1 Capable of using adversarial examples in images Cleaned to a normal image sample X. Φ K Maintained by Φ K-1 The decision boundary of the formed normal region. Φ K Capable of using adversarial examples in images The image is purified to a normal image sample X. And so on, Φ K Capable of using adversarial examples in images Cleaned to a normal image sample X.

[0057] Φ K+1 The training data includes: image adversarial examples and The disturbance was caused by Φ K The decision boundary of the formed normal region forms a new adversarial region, generating new image adversarial examples. Located at Φ K The decision boundary of the formed normal region. Φ K+2 The training data includes: image adversarial examples and The disturbance was caused by Φ K+1 The decision boundary of the formed normal region forms a new adversarial region, generating new image adversarial examples. Located at Φ K+1 The decision boundary of the formed normal region is located at Φ K The decision boundary of the formed normal region. Therefore, by analogy, Φ K Capable of using adversarial examples in images Cleaned to a normal image sample X.

[0058] In summary, Φ K Capable of using adversarial examples in images Cleaned to a normal image sample X. Φ K-1 Capable of using adversarial examples in images Cleaned to a normal image sample X. Φ K+1 Capable of using adversarial examples in images The image sample X is purified to a normal image sample. This process continues, generating adversarial examples of images on the Kth combination. The first to K-1 and K+1 to N combinations are invalid.

[0059] Example

[0060] Taking the generation process of PGD adversarial examples as an example, this invention prevents attackers from generating image adversarial examples X using a pre-trained image classification model F.adv Suppose that the adversarial sample of the image is generated on the Kth combination. Ineffective for combinations 1 to K-1 and K+1 to N. In iteratively generating image adversarial examples X... adv During the process, the first round of generated adversarial image examples It can be Φ U The purified image is a normal image sample X. Where J ≠ U.

[0061]

[0062] F(Φ J (X+Z1,θ J ))≈F(X)

[0063]

[0064]

[0065] The second round of generated adversarial image examples It can be Φ V The purified image is a normal image sample X. Where J≠U≠V.

[0066]

[0067]

[0068]

[0069]

[0070] And so on, the adversarial examples generated in round T. It can be Φ O The purified image is a normal image sample X. Where J≠U≠V≠…≠P≠O.

[0071]

[0072]

[0073]

[0074]

[0075] As long as J≠U≠V≠…≠P≠O, the attacker will be unable to generate an image adversarial sample X. adv If O∈{J,U,V,...},Φ O It is not necessarily possible to adversarial examples in images The image is purified to a normal image sample X. Because, in rounds 1 to T-1, the attacker targets Φ. OCombined with a pre-trained image classification model F, it generates adversarial examples X. adv In subsequent rounds, the generated image adversarial sample X adv The above still includes counter-disturbance. And may still be effective for Φ O The combination with the pre-trained image classification model F is effective. Finally, when NT|>δ, where δ is a positive integer and the larger δ is, the better, and J≠U≠V≠...≠P≠O, it is difficult for an attacker to generate adversarial examples X. adv .

[0076] In one embodiment of this application, the training environment includes: Ubuntu 22.04LTS system, PyTorch version 1.11, 4x 3090 GPUs, etc. The normal image samples X in the training data come from the ImageNet dataset, including: fish, panda, with a size of 3x256x256 and a value range of [0.0, 1.0].

[0077] The pre-trained image classification model F uses the ConvNeXt network architecture, initialized with PyTorch pre-trained parameters, and the feature extraction layer and fully connected layers are frozen and modified. The optimizer in PyTorch is stochastic gradient descent with momentum and weight decay, with parameters set to: lr = 0.0001, momentum = 0.9, and weight_decay = 5e-4. On the aforementioned dataset, minimizing the cross-entropy classification loss and fine-tuning the ConvNeXt parameters resulted in 100% classification accuracy on the test data.

[0078] Train N distinct image adversarial example purifiers {Φ1,...,Φ K ,...,Φ N Each of these is combined with a pre-trained image classification model F to form different decision boundaries.

[0079] Each image adversarial sample cleaner Φ K The network structures are all deep convolutional autoencoders with residual structures. The network structures are defined from scratch using PyTorch, such as... Figure 4 As shown.

[0080] Each image adversarial sample cleaner Φ K Training data Includes: Adding Gaussian noise Z K Normal image sample X, adversarial image sample Add Gaussian noise Z K Image adversarial examples Image adversarial examples X advThe projective gradient descent method was used to generate perturbations on normal image samples X, with perturbation sizes set to 8 / 255, 16 / 255, 24 / 255, and 32 / 255, a step size of 10, and learning rates of (2*8 / 255) / 10, (2*16 / 255) / 10, (2*24 / 255) / 10, and (2*32 / 255) / 10, respectively. Random Gaussian noise Z was obtained from scikit-image with a mean of 0.0 and a variance of 0.01.

[0081] Training the first image adversarial sample purifier Φ1 for image adversarial samples It generates and trains the Kth image adversarial example purifier Φ on a pre-trained image classification model F. K Image adversarial examples These are the adversarial sample cleaners for the K-1 and K-2 images, respectively. K-1 ,Φ K-2 Generates a combination of} and a pre-trained image classification model F, such as Figure 5 As shown. The purpose of this is to prevent Φ K Catastrophic forgetting occurs, making it impossible to use adversarial examples of images. Cleaned to a normal image sample X.

[0082] The K-2th image adversarial sample cleaner Φ K-2 Adversarial sample cleaner Φ for the (K-1)th image K-1 The parameter θ K-1 As initialization, such as Figure 5 As shown. The purpose of doing this is also to prevent Φ K Catastrophic forgetting occurs, making it impossible to use adversarial examples of images. Cleaned to a normal image sample X.

[0083] Define the loss function using PyTorch, and for each image adversarial sample cleanup Φ... K loss function L K Includes: purified image samples Minimum mean square error loss compared to normal image sample X, and cleaned image sample The cross-entropy classification loss on the pre-trained image classification model F is as follows:

[0084]

[0085] Where c is the number of channels in the image sample, h is the height of the image sample, w is the width of the image sample, and i represents the index.

[0086] Using an optimizer in PyTorch, employing stochastic gradient descent with momentum and weight decay, and with learning rate decay, and using discontinuous optimization parameters, minimize the training loss {L1,...,L} of the image adversarial example cleanup tool. K ,...,L N}, obtain N image adversarial sample cleaners {Φ1,…,Φ K ,…,Φ N Each time an image adversarial example purifier is trained, Φ K Reinitialize the optimizer parameters. Using consecutive optimization parameters will result in Φ K-1 With Φ K The resulting decision boundaries are locally similar. The optimizer parameters are: lr = 0.001, momentum = 0.9, weight_decay = 5e-4. The learning rate decay method is cosine annealing, with the parameter: T_max = 20.

[0087] Randomly select an image adversarial sample cleaner Φ that is different from the previous selection, and preprocess image sample X or Xi. adv The purified image sample Φ(X+Z,θ) or Φ(X adv +Z,θ) are input to the pre-trained image classification model F, and the output is the classification label. This invention not only has no impact on the classification accuracy of normal image samples X on the pre-trained image classification model F, but also effectively prevents attackers from generating adversarial image samples X on the pre-trained image classification model F. adv .

[0088] Combination Figure 5 and Figure 6 Analyze the changes in the decision boundary: The training data for Φ1 consists of adversarial examples of images generated for the pre-trained image classification model F. Φ1 can provide adversarial examples for images. The image sample X is purified to a normal image sample. Adversarial examples of images generated from the combination of Φ1 and the pre-trained image classification model F. Located within the normal region of the image classification model F. Φ2 is initialized with θ1, and the training data consists of image adversarial examples. and Maintain the decision boundary of the normal region formed by Φ1. Repair the decision boundary of the adversarial region formed by Φ1, while perturbing the decision boundary of the normal region to form a new adversarial region. Φ2 can handle adversarial examples in the image. and The image sample X is cleaned up to resemble a normal image. Adversarial examples of images generated using the combination of Φ2 and a pre-trained image classification model F. The region located within the normal region formed by Φ2 is the same as the normal region of image classification model F. And so on, Φ K With θ K-1 As initialization, the training data consists of image adversarial examples. and Maintain by Φ K-1 The decision boundary of the formed normal region, Repair by Φ K-1 The decision boundary of the formed adversarial region simultaneously disturbs the decision boundary of the normal region, forming a new adversarial region. Φ K Adversarial examples of images and Cleanse to a normal image sample X. For Φ K Image adversarial examples generated by combining with a pre-trained image classification model F Located in {Φ1,…,Φ K The normal region formed by} is the same as the normal region of the image classification model F. Therefore, the adversarial example generated on the Kth combination is... The first to K-1 and K+1 to N combinations are invalid.

[0089] The following analysis of the effects will be based on specific experiments:

[0090] Taking a 10-step PGD adversarial example as an example, the change in the attacker's success rate as the number of purifiers increases is as follows: Figure 7 As shown in the figure, it becomes increasingly difficult for attackers to generate adversarial examples as the number of purifiers increases. In a white-box scenario, for gradient-based adversarial examples, taking PGD adversarial examples as an example, with 10 purifiers selected, the change in the attacker's success rate as the number of iterations increases is shown below. Figure 8 As shown in the figure, it becomes clear that as the number of steps increases, attackers find it easier to generate adversarial examples, requiring more purifiers to prevent this. Taking PGD adversarial examples as an example, with 10 purifiers selected, the change in the attacker's success rate as adversarial perturbation increases is illustrated below. Figure 9 As shown in the figure, it is evident that the more adversarial perturbations there are, the easier it is for attackers to generate adversarial examples. For constraint-based adversarial examples, taking the C&W adversarial example as an example, with 10 purifiers selected, the change in the attacker's success rate as the number of iterations increases is shown below. Figure 10 As shown in the figure, it is very difficult for attackers to generate adversarial examples. In a black-box scenario, taking the Square adversarial example as an example, selecting 10 purifiers, the change in the attacker's success rate as the number of queries increases is shown below. Figure 11As shown in the figure, it is difficult for attackers to generate adversarial examples. Table 1 shows that more purifiers are needed to prevent attackers from generating SI-NI-FGSM, VMI-FGSM, VNI-FGSM, and PGD-EOT adversarial examples.

[0091] Table 1. Success rate of attackers generating adversarial examples with high transferability.

[0092]

[0093] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for adversarial example defense in image classification tasks, characterized in that, Includes the following steps: S1. Construct an image adversarial sample cleaner with a deep convolutional autoencoder and residual structure, and train the image adversarial sample cleaner with image training data with added Gaussian noise to minimize the training loss of the image adversarial sample cleaner and obtain a pre-trained image adversarial sample cleaner. Image training data with added Gaussian noise train Image adversarial sample cleaner During the process, initial parameters are used to initialize the initial image adversarial sample cleaner, and the first... Image adversarial sample cleaner With the first Image adversarial sample cleaner parameters As initialization parameters; Each image adversarial sample purifier loss function Includes: purified image samples Compared with normal image samples Minimum mean square error loss, cleaned image samples In pre-trained image classification models Cross-entropy classification loss; Training the first image adversarial sample cleaner Image adversarial examples Through a pre-trained image classification model Generate, train the first Image adversarial sample cleaner Image adversarial examples They are respectively in the and Image adversarial sample cleaner and pre-trained image classification models Generate from combinations of; S2 uses a pre-trained image adversarial sample cleaner to clean up the pre-processed image samples, and then uses the cleaned image samples to train the low-resolution image classification model.

2. The adversarial example defense method for image classification tasks according to claim 1, characterized in that, Image training data with added Gaussian noise Specifically, this includes adding Gaussian noise. Normal image samples Image adversarial examples Add Gaussian noise Image adversarial examples .

3. The adversarial example defense method for image classification tasks according to claim 1, characterized in that, Training Image adversarial sample cleaner Each one is different; each pre-trained image classification model Combined with one of the adversarial sample purifiers, different decision boundaries are formed.

4. The adversarial example defense method for image classification tasks according to claim 1, characterized in that, During the training of the image adversarial example cleaner using image training data with added Gaussian noise, discontinuous optimization parameters are used to minimize the training loss. ,get Image adversarial sample cleaner .

5. An adversarial example defense system for image classification tasks, characterized in that, Includes image adversarial example purifier and defense module; Image adversarial sample cleaner: An image adversarial sample cleaner is obtained by constructing a deep convolutional autoencoder with residual structure and training the image adversarial sample cleaner with image training data with added Gaussian noise, so as to minimize the training loss of the image adversarial sample cleaner. Image training data with added Gaussian noise train Image adversarial sample cleaner During the process, initial parameters are used to initialize the initial image adversarial sample cleaner, and the first... Image adversarial sample cleaner With the first Image adversarial sample cleaner parameters As initialization parameters; Each image adversarial sample purifier loss function Includes: purified image samples Compared with normal image samples Minimum mean square error loss, cleaned image samples In pre-trained image classification models Cross-entropy classification loss; Training the first image adversarial sample cleaner Image adversarial examples Through a pre-trained image classification model Generate, train the first Image adversarial sample cleaner Image adversarial examples They are respectively in the and Image adversarial sample cleaner and pre-trained image classification models Generate from combinations of; The defense module purifies pre-processed image samples using a pre-trained image adversarial sample purifier, and then trains a low-resolution image classification model using the purified image samples.

6. The adversarial example defense system for image classification tasks according to claim 5, characterized in that, Image training data with added Gaussian noise Specifically, this includes adding Gaussian noise. Normal image samples Image adversarial examples Add Gaussian noise Image adversarial examples .

7. The adversarial example defense system for image classification tasks according to claim 5, characterized in that, Image training data with added Gaussian noise train Image adversarial sample cleaner During the process, initial parameters are used to initialize the initial image adversarial sample cleaner, and the first... Image adversarial sample cleaner With the first Image adversarial sample cleaner parameters As an initialization parameter.

Images