Image classification model adversarial training method and related apparatus

Abstract

The application belongs to the field of image processing, and discloses an image classification model adversarial training method and related device, including perturbing each training image to obtain each adversarial training sample, and based on each adversarial training sample, iteratively training the image classification model with the optimization goal of minimizing the loss function value to obtain a pre-trained image classification model; screening the adversarial training samples with incorrect classification results based on the pre-trained image classification model to obtain difficult adversarial training samples; obtaining and based on the threat level of each difficult adversarial training sample, obtaining the training weight value of each difficult adversarial training sample; based on each difficult adversarial training sample, training the image classification model with the optimization goal of minimizing the final loss function value, and iterating the above steps to the maximum iteration round to obtain the trained image classification model. The time and computational efficiency of adversarial training can be greatly improved, and the robustness and fairness of the image classification model can be improved.

Description

Technical Field

[0001] This invention belongs to the field of image processing and relates to an adversarial training method and related apparatus for image classification models. Background Technology

[0002] Deep learning outperforms traditional machine learning in many tasks, such as image classification, object detection, speech recognition, and natural language processing. However, with the widespread application of deep neural networks, their security issues have received increasing attention. Adversarial attacks refer to attackers constructing targeted inputs to cause the model to misclassify. Generally, attackers add imperceptible perturbations to normal samples, causing the model's judgment to differ from the original input; such deceptive samples are called adversarial examples. In image classification, adversarial attacks cause the model to misclassify by slightly altering pixel values. Based on the amount of information available to the attacker, adversarial attacks are divided into two categories. The first category is white-box attacks, where the attacker can obtain all information about the target model, including details such as model structure and parameter weights. White-box attacks can calculate the model's gradient information and construct optimal adversarial perturbations to deceive the model. Typical white-box attack methods include gradient-based adversarial example generation algorithms such as FGSM and PGD. The second category is black-box attacks, where the attacker cannot obtain internal information about the target model and can only extract information about the model through input and output. Black-box attacks mainly generate a large number of candidate adversarial examples and select the final adversarial example that can mislead the model. Typical black-box attack methods include evolutionary optimization strategies such as genetic algorithms and simulated annealing algorithms.

[0003] The threat of adversarial attacks is becoming increasingly serious, and the field of deep learning is actively researching countermeasures. Among them, adversarial training is one of the most successful methods for defending against adversarial attacks. Specifically, adversarial training is a data augmentation method that adds adversarial perturbation samples during model training to enhance the robustness of the model against adversarial samples. Currently, the main technical routes of adversarial training include: (1) Adversarial sample generation. Adversarial samples need to be generated in real time during training. Typical generation algorithms include FGSM, PGD, etc. Adversarial sample generation is a process of solving a minimax problem, with the goal of maximizing the loss function of the model within the allowable perturbation range. (2) Adversarial sample ensemble. Each normal sample needs to generate corresponding adversarial samples to form a new adversarial sample training set to enhance the adversarial robustness of the model. (3) Model training. The model is retrained using the adversarial sample set so that it can still make accurate predictions under adversarial samples. The training process needs to solve the imbalance problem of the adversarial sample set. (4) Evaluation and iteration. The adversarial robustness of the model is tested with a strong adversarial sample set, and the training process is further iterated based on the results.

[0004] However, current adversarial training methods also face several problems that urgently need to be addressed: high computational cost, as multiple rounds of generating adversarial examples and iterating model training require substantial computational resources; poor model generalization, as adversarial training has weak generalization ability and is only effective for the set of adversarial examples used in training; and difficulty in controlling perturbations, as existing methods struggle to keep adversarial perturbations within a barely perceptible range. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide an adversarial training method and related apparatus for image classification models.

[0006] To achieve the above objectives, the present invention employs the following technical solution:

[0007] In a first aspect, the present invention provides an adversarial training method for an image classification model, comprising:

[0008] The image classification model is obtained by perturbing each training image and then iteratively training the image classification model based on each adversarial training image with the goal of minimizing the loss function value.

[0009] By filtering out the adversarial training samples with incorrect classification results based on the pre-trained image classification model from each adversarial training sample, we obtain the difficult adversarial training samples;

[0010] Obtain the threat level of each difficult adversarial training sample, and based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample.

[0011] Based on each challenging adversarial training sample, the image classification model is trained with the goal of minimizing the final loss function value. The above steps are iterated to the maximum number of iterations to obtain the trained image classification model. The final loss function value is obtained by obtaining the loss function value of each challenging adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each challenging adversarial training sample to obtain the average value.

[0012] Optionally, the perturbation of each training image to obtain each adversarial training sample includes:

[0013] Obtain class-balanced training images for the image classification model;

[0014] Gaussian noise is randomly generated based on a set perturbation size, and then superimposed on each training image to obtain each superimposed training image.

[0015] The pixel values ​​of each superimposed training image are cropped using the grayscale / RGB range limit to obtain each adversarial training sample.

[0016] Optionally, when obtaining the class-balanced training images of the image classification model, the training images include initial training images and processed training images, wherein the processed training images are obtained by processing the initial training images through random cropping, random flipping, or random rotation.

[0017] Optionally, obtaining the threat level of each difficult adversarial training sample includes:

[0018] Based on each challenging adversarial training sample, the pre-trained image classification model is iteratively trained with the goal of minimizing the loss function value. The maximum adversarial step size of each challenging adversarial training sample based on the pre-trained image classification model is obtained during the iterative training of the pre-trained image classification model.

[0019] The threat level of each difficult adversarial training sample is obtained by adding a preset hyperparameter to the maximum adversarial step size of the pre-trained image classification model and passing it through an activation function.

[0020] Optionally, obtaining the training weight values ​​for each difficult adversarial training sample based on its threat level includes:

[0021] The selection ratio is obtained by dividing the number of difficult adversarial training samples in the current iteration round by the number of adversarial training samples in the current iteration round.

[0022] The threat level of each difficult adversarial training sample is normalized to obtain the normalized threat level of each difficult adversarial training sample.

[0023] The training weight value of each difficult adversarial training sample is obtained by dividing the normalized threat level of each sample by the screening ratio.

[0024] Optionally, the step of training an image classification model based on each challenging adversarial training sample with the goal of minimizing the final loss function value, and iterating the above steps to the maximum number of iterations to obtain the trained image classification model includes:

[0025] Obtain the final loss function value under the current iteration, perform backpropagation based on the final loss function value under the current iteration, and complete the optimization of the image classification model under the current iteration using gradient descent.

[0026] When the current iteration reaches the maximum iteration count, the current image classification model is taken as the trained image classification model.

[0027] Optionally, the number of difficult adversarial training samples in each category is balanced.

[0028] A second aspect of the present invention provides an adversarial training system for an image classification model, comprising:

[0029] The pre-training module is used to perturb each training image to obtain each adversarial training sample, and based on each adversarial training sample, to iteratively train the image classification model with the optimization objective of minimizing the loss function value, thus obtaining the pre-trained image classification model.

[0030] The sample filtering module is used to filter adversarial training samples with incorrect classification results based on the pre-trained image classification model from each adversarial training sample to obtain difficult adversarial training samples.

[0031] The weight determination module is used to obtain the threat level of each difficult adversarial training sample and, based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample.

[0032] The retraining module is used to train the image classification model based on each difficult adversarial training sample with the goal of minimizing the final loss function value, and to iteratively trigger the above module to the maximum number of iterations to obtain the trained image classification model. The final loss function value is obtained by obtaining the loss function value of each difficult adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each difficult adversarial training sample to obtain the average value.

[0033] In a third aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described image classification model adversarial training method.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described image classification model adversarial training method.

[0035] Compared with the prior art, the present invention has the following beneficial effects:

[0036] This invention presents an adversarial training method for image classification models. It obtains adversarial training samples by perturbing each training image, and iteratively trains the image classification model based on these samples, minimizing the loss function as the optimization objective. Introducing random initialization perturbations and iterating allows for maximizing the model's loss function while maintaining a limited perturbation range, thus finding more effective adversarial training samples. Subsequently, by filtering adversarial training samples that have incorrect classification results based on the pre-trained image classification model, difficult adversarial training samples are obtained. By identifying easy and difficult adversarial samples, and selectively utilizing these difficult adversarial samples that have a significant impact on the model, the overfitting problem caused by excessive reliance on easy adversarial samples in standard adversarial training can be significantly improved. This makes the model more robust to truly difficult adversarial samples as well, thereby comprehensively improving the model's adversarial robustness and fairness. Furthermore, the mechanism of preemptively discarding non-difficult adversarial samples avoids these samples with less impact on the model consuming large amounts of computational resources, greatly shortening the adversarial training time. Experimental results demonstrate that this can reduce the standard adversarial training time by approximately 46%, significantly improving the speed and computational efficiency of adversarial training while maintaining the model's adversarial robustness. Meanwhile, by obtaining the threat level of each difficult adversarial training sample and obtaining the training weight value of each difficult adversarial training sample based on the threat level, the attack effect of the difficult samples is used to adaptively weight them, so that the adversarial training pays more attention to the samples that pose a greater threat to the model. This avoids the overfitting problem that may be caused by simply weighting based on the prediction results, and also makes the adversarial training more comprehensively consider samples of different difficulties. Attached Figure Description

[0037] Figure 1 This is a flowchart of the adversarial training method for an image classification model according to an embodiment of the present invention.

[0038] Figure 2 This is a schematic diagram illustrating the principle of the adversarial training method for image classification models according to an embodiment of the present invention.

[0039] Figure 3 This is a block diagram of the adversarial training system for the image classification model according to an embodiment of the present invention. Detailed Implementation

[0040] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0042] The present invention will now be described in further detail with reference to the accompanying drawings:

[0043] See Figure 1 In one embodiment of the present invention, an adversarial training method for an image classification model is provided, which can further optimize the adversarial training method for the image classification model and solve the shortcomings of existing adversarial training methods, such as low robustness, low fairness, and low training efficiency.

[0044] Specifically, the adversarial training method for the image classification model of the present invention includes the following steps:

[0045] S1: Perturb each training image to obtain each adversarial training sample, and based on each adversarial training sample, iteratively train the image classification model with the goal of minimizing the loss function value to obtain the pre-trained image classification model.

[0046] S2: Filter the adversarial training samples with incorrect classification results based on the pre-trained image classification model from each adversarial training sample to obtain difficult adversarial training samples.

[0047] S3: Obtain the threat level of each difficult adversarial training sample, and based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample.

[0048] S4: Based on each challenging adversarial training sample, train the image classification model with the goal of minimizing the final loss function value, and iterate the above steps to the maximum number of iterations to obtain the trained image classification model; wherein, the final loss function value is obtained by obtaining the loss function value of each challenging adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each challenging adversarial training sample to obtain the average value.

[0049] This invention presents an adversarial training method for image classification models. It obtains adversarial training samples by perturbing each training image, and iteratively trains the image classification model based on these samples, with the optimization objective of minimizing the loss function. Introducing random initialization perturbations and iterating allows for maximizing the model's loss function while maintaining a limited perturbation range, thus finding more effective adversarial training samples. Subsequently, by filtering adversarial training samples that have incorrect classification results based on the pre-trained image classification model, difficult adversarial training samples are obtained. By identifying easy and difficult adversarial samples, and selectively using these difficult adversarial samples that have a significant impact on the model, the overfitting problem caused by excessive reliance on easy adversarial samples in standard adversarial training can be significantly improved. This makes the model more robust to truly difficult adversarial samples as well, thereby comprehensively improving the model's adversarial robustness and fairness. Furthermore, the mechanism of discarding non-difficult adversarial samples in advance avoids these samples with less impact on the model consuming large amounts of computational resources, greatly shortening the adversarial training time. Experiments have shown that this can reduce the standard adversarial training time by approximately 46%, significantly improving the time and computational efficiency of adversarial training while maintaining the model's adversarial robustness. Meanwhile, by obtaining the threat level of each difficult adversarial training sample and obtaining the training weight value of each difficult adversarial training sample based on the threat level, the attack effect of the difficult samples is used to adaptively weight them, so that the adversarial training pays more attention to the samples that pose a greater threat to the model. This avoids the overfitting problem that may be caused by simply weighting based on the prediction results, and also makes the adversarial training more comprehensively consider samples of different difficulties.

[0050] In one possible implementation, see Figure 2 The adversarial training method for the image classification model includes the following detailed steps:

[0051] S11: Obtain the image classification model to be trained and a class-balanced adversarial training sample set. Class balance means that the number of adversarial training samples for each class in the adversarial training sample set is roughly equal.

[0052] Specifically, the first step is to determine the deep neural network model structure of the image classification model to be trained. This can be a convolutional neural network, a recurrent neural network, or other commonly used model structures. The number of network layers, neuron connections, and other structural details are designed according to the task requirements. The network parameters are then randomly initialized based on the model structure, ensuring they conform to a specific distribution, such as a uniform or Gaussian distribution. After parameter initialization, a sufficient number of original training images are collected as the training set. The training images for each category in the training set should be roughly balanced to avoid overfitting the model to any particular category due to an excessive number of images for that category. Simultaneously, the order of the training images is randomly shuffled. The training set is then divided into batches according to a pre-defined batch size, and data augmentation techniques, such as random cropping, random flipping, and random rotation, are used to introduce and process the training images during the sample preprocessing stage, increasing sample diversity.

[0053] For all training images in the training set, a perturbation size is set, and Gaussian noise is randomly generated based on the perturbation size. The Gaussian noise is then superimposed on the training images, and the pixel values ​​of the superimposed training images with Gaussian noise are cropped at the maximum and minimum values ​​within the range [0, 255] to ensure that the processed image does not exceed the image limit and still retains its semantic meaning. Specifically, first, the noise parameters are determined: mainly the mean and standard deviation of the Gaussian noise. The mean is usually set to 0, and the standard deviation σ determines the noise intensity. Next, Gaussian random numbers are generated. For each pixel in the image, a random number generator function is used to randomly generate a Gaussian distribution that conforms to the parameter settings as its noise value. Then, noise is added directly to the grayscale value of each pixel in the image. Finally, the range is limited: since the pixel values ​​may exceed the grayscale range [0, 255] after directly adding noise, it is necessary to limit the pixel values ​​to ensure they remain within the normal range. Through the above steps, Gaussian noise with specified parameters can be added to the input image, enhancing the diversity of the image dataset. Adjusting the noise parameter σ controls the noise intensity. Furthermore, since Gaussian noise needs to be generated in batches for the image dataset, the seed of the random number generator should be fixed; otherwise, the noise added to each image will be different, making it impossible to uniformly enhance the dataset.

[0054] S12: For the image classification model to be trained and the adversarial training sample set, several rounds of adversarial attacks are carried out with the goal of maximizing the loss function value.

[0055] Specifically, first, the training image x is obtained. i Predicted label y i The adversarial perturbation η, initialized with Gaussian noise in S11, is compared with the training image x. i Input the superimposed values ​​into the model. Calculate (x) i Predicted label of +η) if Not equal to y i This indicates that a successful adversarial perturbation has been found, and the attack has been completed. Otherwise, the loss function of the model is used to calculate f. θ (x i +η) and the real label y i The difference is determined by gradient descent along the direction of η to maximize the loss function value. Finally, adversarial training samples are returned. The main idea of ​​the adversarial training sample generation method used in this invention is to introduce random initialization perturbations and iteratively update the perturbations, maximizing the model loss function while ensuring that the perturbation range is limited, thereby finding stronger and more effective adversarial samples. The attack is paused after performing the above process M times.

[0056] S13: Based on the results of several rounds of adversarial attacks, the adversarial training samples are screened. The screened adversarial training samples continue to undergo the remaining attack iterations, while those that fail the screening are discarded.

[0057] Specifically, after attacking all adversarial training samples with a preset number of iterations M, the accuracy of the image classification model's classification is assessed. Samples whose output class with the highest probability matches the true label are considered simple samples and discarded. Samples that the image classification model cannot classify correctly are considered difficult adversarial training samples and require further attack to generate stronger samples. The loss function value is maximized on these difficult adversarial training samples, forcing the image classification model to make incorrect predictions. Each iteration generates a perturbation near the sample based on a preset infinity norm, with the perturbation direction maximizing the loss function. After several such iterations, even more difficult adversarial training samples that are harder to classify correctly are obtained.

[0058] By fully utilizing the difference between image classification models classifying simple samples and difficult adversarial training samples, difficult adversarial training samples can be generated in a targeted manner, so that the image classification model can adapt to both simple samples and difficult adversarial training samples after training.

[0059] S14: For each adversarial training sample that has been screened, i.e. a difficult adversarial training sample, calculate the threat level of its attack image classification model, and use the maximum adversarial step size to represent the threat level.

[0060] S15: Dynamically assign weights to each difficult adversarial training sample based on its threat level. The higher the threat level, the higher the weight assigned.

[0061] Specifically, the maximum adversarial step size represents the change between two adjacent adversarial attack steps. Hard adversarial training samples with larger maximum adversarial step sizes are given greater weight, and vice versa. The maximum adversarial step size refers to the maximum change in the output of the image classification model for a hard adversarial training sample over multiple iterations of adversarial attacks. This reweighting strategy is adopted because adversarial samples with different maximum step sizes pose different threat levels to the model. For example, even when facing single-step attacks like FGSM, adversarial samples with larger maximum adversarial step sizes are more likely to break the model. Therefore, they should receive more attention during training. Furthermore, the predicted score or cross-entropy loss is not directly used for reweighting because a high-scoring sample that is harder to classify already has a large loss value. Giving it higher weight would make the image classification model more prone to overfitting that sample.

[0062] In this embodiment, based on each difficult adversarial training sample, the pre-trained image classification model is iteratively trained with the optimization objective of minimizing the loss function value. The maximum adversarial step size of each difficult adversarial training sample based on the pre-trained image classification model is obtained during the iterative training process. The maximum adversarial step size of each difficult adversarial training sample based on the pre-trained image classification model is added to a preset hyperparameter and passed through an activation function to obtain the threat level of each difficult adversarial training sample. Then, the number of difficult adversarial training samples in the current iteration is divided by the number of adversarial training samples in the current iteration to obtain the selection ratio. The threat level of each difficult adversarial training sample is normalized to obtain the normalized threat level of each difficult adversarial training sample. Finally, the normalized threat level of each difficult adversarial training sample is divided by the selection ratio to obtain the training weight value of each difficult adversarial training sample.

[0063] The maximum adversarial step size is determined by recording the model's output for each sample during the attack process corresponding to the number of pre-screening iterations, and calculating the L1 distance between the current output and the output corresponding to the previous attack round. After completing the attack for the pre-screening iterations, the maximum value is selected from the recorded L1 distances for each sample.

[0064] Specifically, the reweighting method in the following formula is used to prevent overfitting:

[0065]

[0066]

[0067] ω(z)=sigmoid(z+λ)

[0068] in, Let f be the i-th sample after j attack iterations, sigmoid be the activation function, λ be the hyperparameter, z be the maximum adversarial step size, and f be the maximum adversarial step size.θ This represents the image classification model to be trained, where ω is the threat level function. Let K be the i-th training sample that has undergone M adversarial attack iterations, and K be the maximum number of adversarial attack iterations.

[0069] S16: Iteratively train the image classification model using weighted, class-balanced, difficult adversarial training samples, with the optimization objective being to minimize the loss function value. The contribution of each difficult adversarial training sample in the loss function is proportional to its weight.

[0070] Specifically, for each hard adversarial training sample retained after screening, it is processed by an image classification model to obtain the output. The cross-entropy loss function value is then calculated using this output and the corresponding sample label. This loss function value is then multiplied and summed one by one with the weight values ​​calculated in S15. Finally, the average of the sums is taken as the final loss function value of the image classification model for this round. This process can be expressed by the following formula:

[0071]

[0072] in, For the i-th difficult adversarial training sample after K iterations of attack, y i f represents the label of the i-th difficult adversarial training sample. θ This represents the image classification model to be trained, where N is the number of samples in the current batch training set.

[0073] S17: When the current iteration reaches the maximum value, adversarial training ends and training stops; otherwise, return to S11.

[0074] Backpropagation is performed on the final loss function value obtained in S16, and gradient descent is used to optimize the image classification model, updating the parameter values ​​of the image classification model. A counter is used to record the current iteration. Each time the image classification model is trained, the counter value is incremented by 1. When the counter value reaches the preset maximum value, the model training ends; otherwise, return to S11.

[0075] This invention presents an adversarial training method for image classification models, proposing a method for mining difficult adversarial training samples. By identifying samples that are easy and difficult to adversarially train during model training, and selectively utilizing difficult adversarial training samples, the overconfidence problem in standard adversarial training can be significantly alleviated. The idea of ​​judging easy and difficult adversarial samples based on whether they cross the decision boundary allows adversarial training to focus more on samples that truly pose a challenge to the model, avoiding the problem of over-optimizing easy adversarial samples, thereby comprehensively improving the model's adversarial robustness and fairness. An early discard mechanism is designed, which identifies easy adversarial samples through a small number of attack iterations and discards them early to avoid these samples consuming a large amount of subsequent computational resources. This mechanism can reduce the standard adversarial training time by approximately 46%, greatly improving the time and computational efficiency of adversarial training while maintaining the model's adversarial robustness. Adaptive weighting can be applied to difficult adversarial samples based on the maximum change step size of the attack, allowing adversarial training to focus more on samples that pose a greater threat to the model. This step-driven reweighting method avoids the overfitting problem that may result from simple weighting based solely on prediction results and allows adversarial training to more comprehensively consider samples of different difficulties. Among them, the idea of ​​mining difficult adversarial examples can be used as a general framework to combine with other adversarial training methods. While improving adversarial robustness, it can also improve the adversarial robustness and fairness of the model, and has good scalability and compatibility.

[0076] In one possible implementation, experimental results demonstrate that the adversarial training method for image classification models of the present invention achieves better adversarial robustness than the original algorithm even when using different reference models, such as ResNet18 or WideResNet34, and requires less than 70% of the training time. This indicates that the sample selection mechanism and pre-selection strategy of the adversarial training method for image classification models of the present invention have been significantly improved compared with existing methods.

[0077] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0078] See Figure 3 In another embodiment of the present invention, an image classification model adversarial training system is provided, which can be used to implement the above-mentioned image classification model adversarial training method. Specifically, the image classification model adversarial training system includes a pre-training module, a sample selection module, a weight determination module, and a retraining module.

[0079] The pre-training module is used to perturb each training image to obtain each adversarial training sample, and based on each adversarial training sample, iteratively trains the image classification model with the optimization objective of minimizing the loss function value, thus obtaining the pre-trained image classification model. The sample selection module is used to select adversarial training samples from each adversarial training sample that have incorrect classification results based on the pre-trained image classification model, thus obtaining difficult adversarial training samples. The weight determination module is used to obtain the threat level of each difficult adversarial training sample, and based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample. The retraining module is used to train the image classification model with the optimization objective of minimizing the final loss function value based on each difficult adversarial training sample, and iteratively triggers the above modules to the maximum number of iterations, thus obtaining the trained image classification model. The final loss function value is obtained by obtaining the loss function value of each difficult adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each difficult adversarial training sample to obtain the average value.

[0080] All relevant content of each step involved in the aforementioned embodiments of the image classification model adversarial training method can be referenced from the functional description of the corresponding functional module of the image classification model adversarial training system in the embodiments of the present invention, and will not be repeated here.

[0081] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0082] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of an adversarial training method for image classification models.

[0083] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the image classification model adversarial training method in the above embodiments.

[0084] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0085] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0086] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0087] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for adversarial training of an image classification model, characterized in that, include: The image classification model is obtained by perturbing each training image and then iteratively training the image classification model based on each adversarial training image with the goal of minimizing the loss function value. By filtering out the adversarial training samples with incorrect classification results based on the pre-trained image classification model from each adversarial training sample, we obtain the difficult adversarial training samples; Obtain the threat level of each difficult adversarial training sample, and based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample. Based on each challenging adversarial training sample, the image classification model is trained with the goal of minimizing the final loss function value. The above steps are iterated to the maximum number of iterations to obtain the trained image classification model. The final loss function value is obtained by obtaining the loss function value of each challenging adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each challenging adversarial training sample to obtain the average value. The threat levels for obtaining each challenging adversarial training sample include: Based on each challenging adversarial training sample, the pre-trained image classification model is iteratively trained with the goal of minimizing the loss function value. The maximum adversarial step size of each challenging adversarial training sample based on the pre-trained image classification model is obtained during the iterative training of the pre-trained image classification model. The threat level of each difficult adversarial training sample is obtained by adding a pre-set hyperparameter to the maximum adversarial step size of the pre-trained image classification model and passing it through an activation function. The training weight values ​​for each difficult adversarial training sample, based on the threat level of each sample, include: The selection ratio is obtained by dividing the number of difficult adversarial training samples in the current iteration round by the number of adversarial training samples in the current iteration round. The threat level of each difficult adversarial training sample is normalized to obtain the normalized threat level of each difficult adversarial training sample. The training weight value of each difficult adversarial training sample is obtained by dividing the normalized threat level of each sample by the screening ratio.

2. The image classification model adversarial training method according to claim 1, characterized in that, The perturbation of each training image yields adversarial training samples, including: Obtain class-balanced training images for the image classification model; Gaussian noise is randomly generated based on a set perturbation size, and then superimposed on each training image to obtain each superimposed training image. The pixel values ​​of each superimposed training image are cropped using the grayscale / RGB range limit to obtain each adversarial training sample.

3. The image classification model adversarial training method according to claim 2, characterized in that, When obtaining the class-balanced training images of the image classification model, the training images include initial training images and processed training images, wherein the processed training images are obtained by processing the initial training images through random cropping, random flipping, or random rotation.

4. The adversarial training method for image classification models according to claim 1, characterized in that, The process of training an image classification model based on each challenging adversarial training sample, optimizing the model by minimizing the final loss function value, and iterating the above steps to the maximum number of iterations to obtain the trained image classification model includes: Obtain the final loss function value under the current iteration, perform backpropagation based on the final loss function value under the current iteration, and complete the optimization of the image classification model under the current iteration using gradient descent. When the current iteration reaches the maximum iteration count, the current image classification model is taken as the trained image classification model.

5. The image classification model adversarial training method according to claim 1, characterized in that, The number of difficult adversarial training samples in each category is balanced.

6. An adversarial training system for an image classification model, characterized in that, include: The pre-training module is used to perturb each training image to obtain each adversarial training sample, and based on each adversarial training sample, to iteratively train the image classification model with the optimization objective of minimizing the loss function value, thus obtaining the pre-trained image classification model. The sample filtering module is used to filter adversarial training samples with incorrect classification results based on the pre-trained image classification model from each adversarial training sample to obtain difficult adversarial training samples. The weight determination module is used to obtain the threat level of each difficult adversarial training sample and, based on the threat level of each difficult adversarial training sample, obtain the training weight value of each difficult adversarial training sample. The retraining module is used to train the image classification model based on each difficult adversarial training sample with the optimization objective of minimizing the final loss function value, and to iterate to the maximum number of iterations to obtain the trained image classification model. The final loss function value is obtained by obtaining the loss function value of each difficult adversarial training sample based on the image classification model, and by weighting and summing the training weight values ​​of each difficult adversarial training sample to obtain the average value. The threat levels for obtaining each challenging adversarial training sample include: Based on each challenging adversarial training sample, the pre-trained image classification model is iteratively trained with the goal of minimizing the loss function value. The maximum adversarial step size of each challenging adversarial training sample based on the pre-trained image classification model is obtained during the iterative training of the pre-trained image classification model. The threat level of each difficult adversarial training sample is obtained by adding a pre-set hyperparameter to the maximum adversarial step size of the pre-trained image classification model and passing it through an activation function. The training weight values ​​for each difficult adversarial training sample, based on the threat level of each sample, include: The selection ratio is obtained by dividing the number of difficult adversarial training samples in the current iteration round by the number of adversarial training samples in the current iteration round. The threat level of each difficult adversarial training sample is normalized to obtain the normalized threat level of each difficult adversarial training sample. The training weight value of each difficult adversarial training sample is obtained by dividing the normalized threat level of each sample by the screening ratio.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the image classification model adversarial training method as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the image classification model adversarial training method as described in any one of claims 1 to 5.

Images