A text deep learning adversarial training method and system based on malicious disturbance

Abstract

The application belongs to the technical field of security of deep learning neural network model, and in particular to a text deep learning adversarial training method and system based on malicious disturbance. The method constructs a malicious disturbance sample set based on original samples for training a deep learning neural network model, then randomly selects a malicious disturbance sample from the malicious disturbance sample set as a training input, replaces the original sample, and introduces a tiny benign disturbance sample into an embedding layer of the deep learning neural network model to generate a final adversarial instance containing the malicious disturbance sample and the benign disturbance sample, thereby improving the robustness of the deep learning neural network model, greatly improving the ability of the deep learning neural network model to resist malicious disturbance attacks, and reducing the risk of the model being misled by the adversarial instance. In addition, the method maintains the original task performance of the deep learning neural network model and maintains or even improves the performance of the model on the original task.

Description

Technical Field

[0001] This invention belongs to the field of security technology of deep learning neural network models, specifically involving a text deep learning adversarial training method and system based on malicious perturbation. Background Technology

[0002] In natural language processing (NLP) tasks, deep neural networks (DNNs) are widely used due to their excellent performance, especially in tasks such as text classification and natural language inference. However, these models are highly vulnerable to well-designed adversarial attacks, which can cause the model to make incorrect predictions by adding tiny and imperceptible perturbations to the input data.

[0003] In existing technologies, the construction of decision boundaries in deep neural networks often fails to fully cover all instances on the same semantic manifold as the training samples, resulting in overly compact decision boundaries that cannot adequately consider potential adversarial instances. This makes the model prone to making incorrect predictions when faced with adversarial perturbations. To address these challenges, researchers in this field have proposed various defensive methods, mainly categorized into three types: data augmentation (DA methods), representation learning (RL methods), and adversarial training (AT methods). While these methods are effective to some extent, they each have their limitations. For example, data augmentation methods may lead to increased training time and computational resource requirements, while representation learning methods may overemphasize semantic similarity, causing the neglect of instances of different categories. In particular, adversarial training, although it can maintain the model's performance on the original task to some extent, is usually limited to perturbations within a small sphere of Euclidean distance, often only simulating benign perturbations such as natural noise, and cannot effectively simulate malicious perturbations deliberately added by attackers. Therefore, the adversarial instances generated by existing adversarial training methods cannot effectively expand the decision boundary, limiting their effectiveness in resisting adversarial attacks. Summary of the Invention

[0004] This invention relates to a method and system for adversarial training of deep learning text based on malicious perturbations. This system belongs to the field of deep learning neural network model security technology, focusing on addressing the vulnerability of deep learning neural network models to malicious adversarial attacks. To overcome the shortcomings of existing adversarial training techniques and improve the robustness of deep learning neural network models against malicious adversarial attacks, this method introduces malicious perturbations designed to simulate attacker behavior during training, while maintaining the performance of the deep learning neural network model on the original task, thereby enhancing model security.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A text deep learning adversarial training method based on malicious perturbation is provided, the method comprising:

[0007] A malicious perturbation sample set is constructed based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which are used to simulate the language variation strategies that attackers may use.

[0008] A malicious perturbation sample is randomly selected from the set of malicious perturbation samples as the training input to replace the original sample. A small benign perturbation sample is introduced into the embedding layer of the deep learning neural network model to generate a final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance of malicious and benign perturbation samples.

[0009] Preferably, constructing the malicious perturbation sample set based on the original samples used to train the deep learning neural network model includes:

[0010] First, the original sample is transformed using text parsing technology to generate a maliciously perturbed sample that has undergone text parsing.

[0011] Subsequently, in these malicious perturbation samples that have undergone text interpretation, the diversity of vocabulary is increased by random synonym substitution to simulate the language change strategies that attackers may employ, generating a malicious perturbation sample set that includes both text interpretation perturbation and synonym substitution perturbation.

[0012] Preferably, the step of training the deep learning neural network model by integrating adversarial instances of malicious and benign perturbation samples includes: after the adversarial training is initiated, the deep learning neural network model updates the loss function calculated based on the adversarial instances using gradient descent, and then continuously updates the benign perturbation samples in each iteration. In this way, the deep learning neural network model continuously encounters and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels, effectively promoting the expansion of the decision boundary of the deep learning neural network model to the unexplored adversarial space, and enhancing the robustness of the deep learning neural network model when subjected to malicious attacks.

[0013] Preferably, in the process of constructing the malicious perturbation sample set, in order to ensure the natural fluency and readability of the malicious perturbation sample text, a perplexity constraint is introduced to ensure that the perplexity value of the rewritten malicious perturbation sample does not exceed a preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains malicious perturbation samples that are semantically consistent but have varied forms.

[0014] Preferably, the deep learning neural network model is trained by combining malicious perturbation samples and benign perturbation samples through an adversarial training objective function. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term is used to guide more robust representation learning in the deep learning neural network model, and the manifold loss term is used to ensure that the malicious perturbation samples are on the same semantic manifold as the original samples as much as possible.

[0015] This invention also provides a text deep learning adversarial training system based on malicious perturbation, the system comprising:

[0016] The malicious perturbation sample set construction module constructs a malicious perturbation sample set based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which simulate the language variation strategies that attackers may adopt.

[0017] The adversarial instance generation training module is used to randomly select a malicious perturbation sample from the malicious perturbation sample set as the training input to replace the original sample, and introduce a small benign perturbation sample into the embedding layer of the deep learning neural network model to generate a final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance containing both malicious and benign perturbation samples.

[0018] Preferably, the malicious perturbation sample set construction module includes:

[0019] The text parsing unit is used to transform the original sample through text parsing technology to generate a malicious perturbation sample that has been text-parsed.

[0020] The synonym substitution unit is used to increase the diversity of vocabulary in these malicious perturbation samples that have undergone text interpretation by randomly substituting synonyms, so as to simulate the language change strategies that attackers may adopt, and generate a malicious perturbation sample set containing two levels of perturbation: text interpretation perturbation and synonym substitution perturbation.

[0021] Preferably, the adversarial instance generation training module includes:

[0022] The benign perturbation sample update unit is used to update the loss function calculated by the deep learning neural network model based on the adversarial instances through gradient descent after the adversarial training is started. In each iteration, the benign perturbation samples are continuously updated. In this way, the deep learning neural network model continuously comes into contact with and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels. This effectively promotes the expansion of the decision boundary of the deep learning neural network model into the unexplored adversarial space, enhancing the robustness of the deep learning neural network model when subjected to malicious attacks.

[0023] Preferably, the malicious perturbation sample construction module further includes:

[0024] The perplexity constraint unit is used to ensure the natural fluency and readability of the text of malicious perturbation samples during the construction of the malicious perturbation sample set. It introduces perplexity constraints to ensure that the perplexity value of the rewritten malicious perturbation sample does not exceed a preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains malicious perturbation samples that are semantically consistent but have varied forms.

[0025] Preferably, the adversarial instance generation training module further includes:

[0026] An adversarial training objective function unit is used to train a deep learning neural network model by combining malicious perturbation samples and benign perturbation samples through an adversarial training objective function. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term is used to guide more robust representation learning in the deep learning neural network model, and the manifold loss term is used to ensure that the malicious perturbation samples are on the same semantic manifold as the original samples as possible.

[0027] Compared with existing technologies, the beneficial effects of this invention are as follows: This text deep learning adversarial training method based on malicious perturbation constructs a malicious perturbation sample set based on the original samples used to train the deep learning neural network model. Then, a malicious perturbation sample is randomly selected from the malicious perturbation sample set as the training input to replace the original sample. Small benign perturbation samples are introduced into the embedding layer of the deep learning neural network model, generating a final adversarial instance that simultaneously contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating these adversarial instances. This method improves the robustness of the deep learning neural network model. By introducing malicious perturbation and targeted adversarial training strategies, this method significantly enhances the deep learning neural network model's ability to resist malicious perturbation attacks and reduces the risk of the model being misled by adversarial instances. Furthermore, this method maintains the original task performance of the deep learning neural network model: unlike general adversarial training methods that may sacrifice the model's performance on the original task, this method enhances the defense against adversarial attacks while maintaining or even improving the model's performance on the original task. Attached Figure Description

[0028] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0029] Figure 1 This is a flowchart of an embodiment of the text deep learning adversarial training method based on malicious perturbation according to the present invention.

[0030] Figure 2 This is a schematic diagram of the training process of an embodiment of the text deep learning adversarial training method based on malicious perturbation of the present invention.

[0031] Figure 3 This is a schematic diagram illustrating the training process of adversarial instances generated by an embodiment of the text deep learning adversarial training method based on malicious perturbation of the present invention.

[0032] Figure 4 This diagram illustrates the decision boundary of a deep learning neural network model trained according to an embodiment of the text deep learning adversarial training method based on malicious perturbation of the present invention, and the decision boundaries of deep learning neural network models trained using several other methods.

[0033] Figure 5 This is an architecture diagram of an embodiment of the text deep learning adversarial training system based on malicious perturbation according to the present invention. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] In one embodiment, a text deep learning adversarial training method based on malicious perturbation is provided, such as... Figure 1 and Figure 2 As shown, this text deep learning adversarial training method based on malicious perturbation includes the following steps:

[0036] Step S100: Construct a malicious perturbation sample set based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which simulate the language change strategies that attackers may adopt.

[0037] Step S200: Randomly select a malicious perturbation sample from the malicious perturbation sample set as the training input to replace the original sample, and introduce a small benign perturbation sample into the embedding layer of the deep learning neural network model to generate the final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance of malicious and benign perturbation samples.

[0038] The aforementioned construction of a malicious perturbation sample set based on the original samples used to train the deep learning neural network model includes: first, transforming the original samples using text parsing technology to generate text-parsed malicious perturbation samples; then, increasing the diversity of vocabulary in these text-parsed malicious perturbation samples by random synonym substitution to simulate the language change strategies that attackers may adopt, thereby generating a malicious perturbation sample set containing both text parsing perturbation and synonym substitution perturbation.

[0039] The aforementioned training of a deep learning neural network model using adversarial instances that integrate malicious and benign perturbation samples includes the following steps: After adversarial training is initiated, the deep learning neural network model updates the loss function calculated based on the adversarial instances using gradient descent. In each iteration, benign perturbation samples are continuously updated. In this way, the deep learning neural network model continuously encounters and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels. This effectively pushes the decision boundary of the deep learning neural network model to expand into the unexplored adversarial space, enhancing the robustness of the deep learning neural network model when subjected to malicious attacks.

[0040] Based on the above, it can be seen that the text deep learning adversarial training method based on malicious perturbation (hereinafter referred to as the MPAT method) covers two key stages, such as... Figure 3 As shown, the first stage of this method provides a series of text interpretation and synonym replacement methods, generating malicious perturbation sample sets P at the sentence level and word level, respectively. m (x). In a specific embodiment, the original sample is first transformed by text paraphrasing technology to generate a paraphrased set of instances. Then, in these instances, the diversity of vocabulary is increased by random synonym replacement to simulate the language variation strategies that attackers may employ.

[0041] The second stage of this method trains the model by integrating malicious and benign perturbations, starting from the malicious perturbation sample set P. m A malicious perturbation sample x′ is randomly selected from (x) as the training input, replacing the original sample x. A small benign perturbation sample δ is introduced into the embedding layer of the deep learning neural network model, generating a final adversarial instance x′+δ that contains both malicious and benign perturbations. At this point, adversarial training begins. The deep learning neural network model updates its loss function calculated based on the adversarial instance x′+δ using gradient descent, and continuously updates the benign perturbation sample δ in each iteration. In this way, the model continuously encounters and learns from previously unexplored adversarial samples, thus more accurately identifying their true labels. This adversarial training strategy effectively pushes the decision boundary towards the unexplored adversarial space, enhancing the model's robustness against malicious attacks.

[0042] Optionally, in the process of constructing the malicious perturbation sample set, in order to ensure the natural fluency and readability of the malicious perturbation sample text, a perplexity constraint is introduced to ensure that the perplexity value of the rewritten malicious perturbation sample does not exceed a preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains malicious perturbation samples that are semantically consistent but have varied forms.

[0043] To ensure the natural flow and readability of the text, this method introduces a perplexity (PPL) constraint to ensure that the PPL value of the rewritten instance does not exceed a preset upper limit threshold.

[0044] Optionally, in this text deep learning adversarial training method based on malicious perturbation, the deep learning neural network model is trained by combining malicious perturbation samples and benign perturbation samples through an adversarial training objective function. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term is used to guide more robust representation learning in the deep learning neural network model, and the manifold loss term is used to ensure that the malicious perturbation samples are on the same semantic manifold as the original samples as much as possible.

[0045] The following is a detailed explanation of the two steps of this method using a specific example:

[0046] 1. Malicious perturbation sample set P m Generation of (x)

[0047] Let x = [w0, w1, ..., w n-1 [x] is a sentence consisting of n words. To introduce sentence-level perturbations while preserving its semantics, MPAT performs paraphrasing on x. To enhance the diversity of generated examples, this method rewrites not only the entire sentence but also each component of the sentence. P is described in detail below. m (x) Steps involved in the generation process:

[0048] Step 1: Text Semantics. First, perform syntactic analysis on the input text x (original sample) to construct its constituent syntactic tree, which consists of nested phrase constituents. Each constituent c(i, j, q) represents a series of words w to w j The text is then used to define a grammatical category q. For each non-single-word component c(i, j, q), a text paraphrasing model is employed to rewrite it paraphrased, resulting in a paraphrased component c′(i, j, q) = Para(c(i, j, q)), where Para represents the text paraphrasing model. This method yields paraphrased instances x. r It consists of the interpreted components c′(i, j, q) and the unmodified part x in the original text. rest It is made up of splicing:

[0049]

[0050] To ensure fluency, this method filters out paraphrased instances whose perplexity exceeds a predetermined threshold, which is set to the PPL value of the original text x. Through these steps, a series of paraphrased instances are generated and compiled into a set.

[0051] Step 2: Synonym replacement. For P m Each of (x) First, synonyms are sampled to select a suitable replacement candidate set, which includes all possible synonyms of the target word. Then, a synonym is randomly selected from these synonyms to replace the original word. This method generates a malicious perturbation sample set P containing two levels of perturbation (text interpretation and synonym replacement). m (x), thereby constructing a more diverse set of adversarial instances, which will be used to replace the original input x and used during model training. One of the maliciously perturbated instances will be removed from P. m (x) is selected as the new input to the model. To preserve the undisturbed state, the original instance x is also included in P. m The set (x) is used to ensure that the deep learning neural network model can take into account the possibility of no malicious perturbation.

[0052] 2. Integrate benign and malicious disturbances to conduct adversarial training.

[0053] Unlike adversarial training that only includes benign perturbations, this method involves training on x′∈P. m Adversarial training is implemented on (x), instead of the original input x. Furthermore, to ensure that x′ is distributed as close as possible to a semantic manifold as possible to x, an additional manifold loss term is introduced into the adversarial loss function. Assuming a DNN with L+1 layers, where the last layer is a SOFTMAX layer, we represent the activation of the Lth layer as a... (L) It approximates the low-dimensional embedding of text on the manifold. Then, the training process of MPAT on N data points can be abstracted into the following adversarial training objective function:

[0054]

[0055]

[0056] x′ n =RandomSample(P m (x n )),

[0057] Where, x n and y nx′ represents the samples and their corresponding labels in the original dataset. n It is a sample from a maliciously perturbed sample set, where θ represents the model parameters, and δ n This represents a benign perturbation added to the embedding layer, where ∈ is a clipping parameter used to limit the perturbation δ. n The magnitude of G is given by λ, where G is the manifold loss function and λ is a hyperparameter controlling the importance of the manifold loss term. and Representing the original sample x respectively n and adversarial sample x′ n The activation status at layer L. Then, K gradient descent operations are needed on the model parameters θ, while simultaneously applying benign perturbations δ. n Perform K gradient ascent iterations. Specifically, the method takes the following steps in K iterations:

[0058] δ (t+1) =δ (t) +∈·sign(g adv ),

[0059] θ (t+1) =θ (t) -τ·g θ ,

[0060] Where ∈ is the upper bound of the perturbation, τ is the learning rate, and sign(·) represents the indicator function. adv It is the loss gradient relative to the input x, while g θ It is the loss gradient with respect to the parameter θ:

[0061]

[0062]

[0063] Furthermore, this method uses the Frobenius norm to normalize the perturbation δ, thereby limiting its magnitude and avoiding excessive deviation of the model parameters.

[0064] δ (t) =clip(δ (t) ,-∈,∈),t=1,...,K,

[0065] Here, clip(·) refers to clipping δ in each iteration. (t) The process of projecting onto a sphere with radius ∈.

[0066] The method was evaluated on several real-world datasets, and the experimental results were promising compared to previous methods. For example, Figure 4As shown, the decision boundary of the deep learning neural network model after the above training method exhibits different adjustment modes. For simplicity, assume that the dashed line represents the semantic manifold where the original instance x is located, and that instances inside the manifold are semantically similar to x. Figure 4 (a) shows that in practice, the boundaries of deep learning neural network (DNN) models often fluctuate greatly and are overly sensitive to perturbations. Figure 4 (b) revealed that the decision boundary after representation learning was overstretched, even including instances of other categories. Figure 4 (c) shows a slight change in the decision boundary after adversarial training. Figure 4 (d) It is shown that after adopting the method of the present invention, the decision boundary of the deep learning neural network model is effectively expanded. This demonstrates that the method not only simulates known adversarial perturbations but also comprehensively ensures the model's security and robustness. Therefore, the new training method provided by the present invention can enhance the deep learning neural network model's ability to resist malicious adversarial attacks without sacrificing its original task performance.

[0067] In one embodiment, a text deep learning adversarial training system based on malicious perturbation is provided. The system includes a malicious perturbation sample set construction module 10 and an adversarial instance generation training module 20. The malicious perturbation sample set construction module 10 constructs a malicious perturbation sample set based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which simulate the language variation strategies that attackers may adopt. The adversarial instance generation training module 20 randomly selects a malicious perturbation sample from the malicious perturbation sample set as a training input to replace the original sample, and introduces a small benign perturbation sample into the embedding layer of the deep learning neural network model to generate a final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance containing both malicious and benign perturbation samples.

[0068] The malicious perturbation sample set construction module 10 in this system includes a text interpretation unit 11 and a synonym substitution unit 12. The text interpretation unit 11 transforms the original samples using text interpretation technology to generate text-interpreted malicious perturbation samples. The synonym substitution unit 12 increases the vocabulary diversity of these text-interpreted malicious perturbation samples through random synonym substitution to simulate the language variation strategies that attackers might employ, generating a malicious perturbation sample set containing both text interpretation perturbation and synonym substitution perturbation. Additionally, the malicious perturbation sample construction module 10 also includes a perplexity constraint unit 13. During the construction of the malicious perturbation sample set, the perplexity constraint unit 13 introduces perplexity constraints to ensure the natural fluency and readability of the malicious perturbation sample text. This ensures that the perplexity value of the rewritten malicious perturbation samples does not exceed a preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains semantically consistent but formally varied malicious perturbation samples.

[0069] As can be seen, the malicious perturbation sample set construction module 10 in this system generates a series of adversarial instances with malicious perturbation by generating multi-layer malicious perturbation instances. In order to realize the function of this module, the following steps need to be completed step by step: (1) Design text interpretation rules at the sentence level: By utilizing the ability of natural language understanding, an algorithm is designed to identify the key structures in the text and to make structural adjustments to the sentences without changing the original intent. (2) Design synonym replacement rules at the word level: After the sentence structure of the text is interpreted and adjusted, synonym replacement is performed on each instance to further increase the diversity of the text. (3) Input strategy for model training: Unlike traditional adversarial training, the generated malicious adversarial instances will replace the original input for model training.

[0070] The adversarial instance generation training module 20 in this system includes a benign perturbation sample update unit 21. After adversarial training begins, the benign perturbation sample update unit 21 updates the loss function calculated based on the adversarial instances using gradient descent. In each iteration, the benign perturbation samples are continuously updated. In this way, the deep learning neural network model continuously encounters and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels. This effectively pushes the decision boundary of the deep learning neural network model to expand into the unexplored adversarial space, enhancing the robustness of the deep learning neural network model against malicious attacks. The adversarial instance generation training module 20 also includes an adversarial training objective function unit 22. This unit 22 trains the deep learning neural network model using an adversarial training objective function that combines malicious and benign perturbation samples. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term guides more robust representation learning in the deep learning neural network model, while the manifold loss term ensures that malicious perturbation samples are on the same semantic manifold as the original samples.

[0071] As can be seen, the adversarial instance generation training module 20 in this system aims to train a deep neural network that remains highly robust under adversarial perturbations by designing a composite objective function for adversarial training. This objective function consists of the following two core parts: (1) adversarial loss term: the main function of this term is to guide the deep neural network to learn more robust feature representations when faced with adversarial instances that have been maliciously perturbed; (2) manifold loss term: this part aims to help the model recognize and maintain the semantic consistency between the perturbed instance and the original instance.

[0072] The following examples will illustrate the two modules of this method in detail:

[0073] 1. Malicious Perturbation Sample Set P in Module 10 m Generation of (x)

[0074] Let x = [w0, w1, ..., w n-1 [x] is a sentence consisting of n words. To introduce sentence-level perturbations while preserving its semantics, MPAT performs paraphrasing on x. To enhance the diversity of generated examples, this method rewrites not only the entire sentence but also each component of the sentence. P is described in detail below. m (x) Steps involved in the generation process:

[0075] Step 1: Text Semantics. First, perform syntactic analysis on the input text x (original sample) to construct its constituent syntactic tree, which consists of nested phrase constituents. Each constituent c(i, j, q) represents a series of words w to w j The text is then used to define a grammatical category q. For each non-single-word component c(i, j, q), a text paraphrasing model is employed to rewrite it paraphrased, resulting in a paraphrased component c′(i, j, q) = Para(c(i, j, q)), where Para represents the text paraphrasing model. This method yields paraphrased instances x. r It consists of the interpreted components c′(i, j, q) and the unmodified part x in the original text. rest It is made up of splicing:

[0076]

[0077] To ensure fluency, this method filters out paraphrased instances whose perplexity exceeds a predetermined threshold, which is set to the PPL value of the original text x. Through these steps, a series of paraphrased instances are generated and compiled into a set.

[0078] Step 2: Synonym replacement. For P m Each of (x) First, synonyms are sampled to select a suitable replacement candidate set, which includes all possible synonyms of the target word. Then, a synonym is randomly selected from these synonyms to replace the original word. This method generates a malicious perturbation sample set P containing two levels of perturbation (text interpretation and synonym replacement). m (x), thereby constructing a more diverse set of adversarial instances, which will be used to replace the original input x and used during model training. One of the maliciously perturbated instances will be removed from P. m (x) is selected as the new input to the model. To preserve the undisturbed state, the original instance x is also included in P. m The set (x) is used to ensure that the model can take into account the possibility of no malicious perturbation.

[0079] 2. Generate training module 20 through adversarial instances, incorporating both benign and malicious perturbations, to perform adversarial training.

[0080] Unlike adversarial training that only includes benign perturbations, this method involves training on x′∈P. mAdversarial training is implemented on (x), instead of the original input x. Furthermore, to ensure that x′ is distributed as close as possible to a semantic manifold as possible to x, an additional manifold loss term is introduced into the adversarial loss function. Assuming a DNN with L+1 layers, where the last layer is a SOFTMAX layer, we represent the activation of the Lth layer as a... (L) It approximates the low-dimensional embedding of text on the manifold. Then, the training process of MPAT on N data points can be abstracted into the following adversarial training objective function:

[0081]

[0082]

[0083] x′ n =RandomSample(P m (x n )),

[0084] Where, x n and y n x′ represents the samples and their corresponding labels in the original dataset. n It is a sample from a maliciously perturbed sample set, where θ represents the model parameters, and δ n This represents a benign perturbation added to the embedding layer, where ∈ is a clipping parameter used to limit the perturbation δ. n The magnitude of G is given by λ, where G is the manifold loss function and λ is a hyperparameter controlling the importance of the manifold loss term. and Representing the original sample x respectively n and adversarial sample x′ n The activation status at layer L. Then, K gradient descent operations are needed on the model parameters θ, while simultaneously applying benign perturbations δ. n Perform K gradient ascent iterations. Specifically, the method takes the following steps in K iterations:

[0085] δ (t+1) =δ (t) +∈·sign(g adv ),

[0086] θ (t+1) =θ (t) -τ·g θ ,

[0087] Where ∈ is the upper bound of the perturbation, τ is the learning rate, and sign(·) represents the indicator function. adv It is the loss gradient relative to the input x, while g θ It is the loss gradient with respect to the parameter θ:

[0088]

[0089]

[0090] Furthermore, this method uses the Frobenius norm to normalize the perturbation δ, thereby limiting its magnitude and avoiding excessive deviation of the model parameters.

[0091] δ (t) =clip(δ (t) , -∈,∈), t=1,…………,K,

[0092] Here, clip(·) refers to clipping δ in each iteration. (t) The process of projecting onto a sphere with radius ∈.

[0093] Currently, deep learning neural network models are widely used in various tasks, including but not limited to text classification and text entailment tasks. However, these models are often highly sensitive to adversarial attacks, and even minor perturbations can lead to erroneous outputs. To address this challenge, this system constructs a multi-layered malicious adversarial instance generation module to generate adversarial instances with malicious perturbations to replace the original input for model training. Furthermore, the system designs an adversarial training objective function that includes additional manifold regularization terms, aiming to enhance the model's adversarial defense capabilities without compromising its performance on the original task. This means that even when facing adversarial attacks, the model can maintain the accuracy and efficiency of the original task, thereby significantly improving the security and reliability of deep learning neural network models in practical applications.

[0094] It should be noted that the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0095] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A text deep learning adversarial training method based on malicious perturbation, characterized in that, The method includes: A malicious perturbation sample set is constructed based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which are used to simulate the language variation strategies that attackers may use. A malicious perturbation sample is randomly selected from the set of malicious perturbation samples as the training input to replace the original sample. A small benign perturbation sample is introduced into the embedding layer of the deep learning neural network model to generate the final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance of malicious and benign perturbation samples. The construction of the malicious perturbation sample set based on the original samples used to train the deep learning neural network model includes: First, the original sample is transformed using text parsing technology to generate a maliciously perturbed sample that has undergone text parsing. Subsequently, in these malicious perturbation samples that have undergone text interpretation, the diversity of vocabulary is increased by random synonym substitution in order to simulate the language change strategies that attackers may adopt, and a malicious perturbation sample set containing two levels of perturbation: text interpretation perturbation and synonym substitution perturbation is generated. The method of training a deep learning neural network model by integrating adversarial instances of malicious and benign perturbation samples includes: after adversarial training is initiated, the deep learning neural network model updates the loss function calculated based on the adversarial instances using gradient descent, and then continuously updates the benign perturbation samples in each iteration. In this way, the deep learning neural network model continuously encounters and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels, effectively promoting the expansion of the decision boundary of the deep learning neural network model to the unexplored adversarial space, and enhancing the robustness of the deep learning neural network model when subjected to malicious attacks. In the process of constructing the malicious perturbation sample set, in order to ensure the natural fluency and readability of the malicious perturbation sample text, a perplexity constraint was introduced to ensure that the perplexity value of the rewritten malicious perturbation sample does not exceed the preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains malicious perturbation samples that are semantically consistent but have varied forms. The deep learning neural network model is trained by combining malicious perturbation samples and benign perturbation samples through an adversarial training objective function. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term is used to guide more robust representation learning in the deep learning neural network model, and the manifold loss term is used to ensure that the malicious perturbation samples are on the same semantic manifold as the original samples as possible. The anti-training objective function includes: ； in, and This represents the samples in the original dataset and their corresponding labels. It is a sample from a malicious perturbation sample set. Indicates model parameters, This indicates a benign perturbation added to the embedding layer. It is a clipping parameter used to limit perturbations. The size of G is the manifold loss function. It is a hyperparameter that controls the importance of the manifold loss term. and Representing the original samples respectively and adversarial examples Activation status at layer L.

2. A text deep learning adversarial training system based on malicious perturbation, characterized in that, The system includes: The malicious perturbation sample set construction module constructs a malicious perturbation sample set based on the original samples used to train the deep learning neural network model. The malicious perturbation sample set includes a series of malicious perturbation samples, which simulate the language variation strategies that attackers may adopt. The adversarial instance generation training module is used to randomly select a malicious perturbation sample from the malicious perturbation sample set as the training input to replace the original sample, and introduce a small benign perturbation sample into the embedding layer of the deep learning neural network model to generate the final adversarial instance that contains both malicious and benign perturbation samples. The deep learning neural network model is trained by integrating the adversarial instance of malicious and benign perturbation samples. The malicious perturbation sample set construction module includes: The text parsing unit is used to transform the original sample through text parsing technology to generate a malicious perturbation sample that has been text-parsed. The synonym substitution unit is used to increase the diversity of vocabulary in these malicious perturbation samples that have undergone text interpretation by randomly substituting synonyms, so as to simulate the language change strategies that attackers may adopt, and generate a malicious perturbation sample set containing two levels of perturbation: text interpretation perturbation and synonym substitution perturbation. The adversarial instance generation training module includes: The benign perturbation sample update unit is used to update the loss function calculated by the deep learning neural network model based on the adversarial instance through gradient descent after the resistance training is started. In each iteration, the benign perturbation sample is continuously updated. In this way, the deep learning neural network model continuously comes into contact with and learns from previously unexposed adversarial instances, thereby more accurately identifying their true labels. This effectively promotes the expansion of the decision boundary of the deep learning neural network model to the unexplored adversarial space and enhances the robustness of the deep learning neural network model when it suffers malicious attacks. The malicious perturbation sample construction module also includes: The perplexity constraint unit is used to ensure the natural fluency and readability of the text of the malicious perturbation sample during the construction of the malicious perturbation sample set. It introduces perplexity constraint to ensure that the perplexity value of the rewritten malicious perturbation sample does not exceed the preset upper limit threshold. Through this process, the generated malicious perturbation sample set contains malicious perturbation samples that are semantically consistent but have varied forms. The adversarial instance generation training module also includes: An adversarial training objective function unit is used to train a deep learning neural network model by combining malicious perturbation samples and benign perturbation samples through an adversarial training objective function. The adversarial training objective function includes an adversarial loss term and a manifold loss term. The adversarial loss term is used to guide more robust representation learning in the deep learning neural network model, and the manifold loss term is used to ensure that the malicious perturbation samples are on the same semantic manifold as the original samples as possible. The anti-training objective function includes: ； in, and This represents the samples in the original dataset and their corresponding labels. It is a sample from a malicious perturbation sample set. Indicates model parameters, This indicates a benign perturbation added to the embedding layer. It is a clipping parameter used to limit perturbations. The size of G is the manifold loss function. It is a hyperparameter that controls the importance of the manifold loss term. and Representing the original samples respectively and adversarial examples Activation status at layer L.

Images