Fast adversarial training method based on feature difference balance

Abstract

The application discloses a kind of fast countermeasures training methods based on sample feature difference balance.The method is from the feature difference angle of the sample of the data set in fast countermeasures training, by improving the adverse effect of feature difference on training, realize the performance improvement of fast countermeasures training.Specifically, the application utilizes the feature information of sample in fast countermeasures training, proposes the fast countermeasures training method of adaptive sample feature difference balance, and designs two different schemes to realize version, respectively based on sample category guide scheme and based on sample feature guide scheme.Can according to the respective characteristics of sample dynamically adjust training strategy, to improve the robustness of artificial intelligence model Precision, increase the stability of countermeasures training.The application can be used as a plug-in, as soon as possible for the fast countermeasures training method of current various mainstreams, the application can be used in public safety, information security, image processing and intelligent robot task.

Description

Technical Field

[0001] This invention relates to a fast adversarial training technique based on feature difference balancing, belonging to the field of computer vision and image processing technology. Background Technology

[0002] Deep learning, with its deep neural networks, has made significant progress in fields such as computer vision and natural language processing. However, deep learning exhibits a severe lack of robustness in complex natural or adversarial environments. Research has found that deep learning models that perform well on normal datasets can be fooled by certain situations, leading to a significant drop in model accuracy. These samples that can deceive the model are generally called adversarial examples.

[0003] Related research has shown that, taking image classification tasks as an example, malicious attackers can add tiny, almost imperceptible perturbations to images, causing normally well-performing deep learning models to misclassify adversarial examples into other categories with a high probability, resulting in high-confidence erroneous predictions. Due to these robustness and security issues, coupled with the current lack of interpretability in deep learning, although it continues to develop and innovate in various fields, its reliability is limited in some sensitive areas such as military, medicine, and finance, thus restricting its applications and hindering the further development of artificial intelligence.

[0004] Adversarial training is an effective way to defend against adversarial attacks. It utilizes adversarial examples to train the model. One such method, proposed by Wong et al., is a single-step fast adversarial training algorithm based on the Fast Gradient Sign Method (FGSM) [Wong E, Rice L, Kolter J Z. Fast is better than free: Revisiting adversarial training[C]. International Conference on Learning Representations, 2019.], which can significantly improve model robustness while saving time and resources. However, most mainstream adversarial training algorithms currently employ a uniform training strategy for all data, ignoring the characteristic attributes between samples and failing to comprehensively consider their relationships and differences.

[0005] In summary, studying the robustness of deep learning models is of great practical significance for the development of deep learning and its reliable application in various fields. On the one hand, current research lacks exploration of the differences and connections between different samples at the feature level during adversarial training. On the other hand, how to utilize related phenomena to more effectively improve the robustness of deep learning models without increasing training costs is also a significant research challenge. Therefore, this invention proposes a fast adversarial training algorithm based on feature difference balancing to further enhance the robustness of deep learning models. Summary of the Invention

[0006] To address the aforementioned issues, this invention discloses a fast adversarial training method based on feature difference balancing. By exploring the differences and relationships among samples at the feature level, it improves training stability and model robustness. The designed algorithm includes two specific implementation schemes: sample category-guided and sample feature-guided. This method dynamically adjusts the training strategy based on the feature information of the dataset samples. The sample category-guided scheme aims to achieve a balance of samples within the category range during training. The sample feature-guided scheme, on the other hand, focuses on the feature dimension. By uniformly processing samples with the same features, it dynamically adjusts the training strategy during training, reducing the negative impact of interactions between samples with different features. The method proposed in this invention does not increase the model's parameters or add extra burden to the computational resources and time required for model training.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] Firstly, a fast adversarial training method based on feature differences, with the following sample category guidance scheme:

[0009] Step S1: Since this invention can be used as a plugin to combine with existing mainstream fast adversarial training methods, it is necessary to initialize the perturbation information δ0 according to the method of the plugin target object. Generally, the initialization operation of the perturbation information δ0 requires first uniformly sampling from [-∈, ∈]. In order to satisfy the characteristic that the perturbation information is invisible to the naked eye, the perturbation information needs to satisfy ‖δ‖. ∞ <∈, where ∈ represents the numerical boundary, which is generally set to in adversarial training.

[0010] Step S2: The goal of adversarial training is to improve the robustness of the model by training it with generated high-quality adversarial examples. In generating adversarial examples, the initial perturbation information δ0 is first added to the clean sample x to obtain the initial adversarial sample x. init =x+δ0.

[0011] Step S3: Initialize the adversarial sample x init As input to the target model, according to the definition of the FGSM algorithm, the perturbation information is updated and then added back to the clean samples to obtain the adversarial sample x for this round of training. adv The calculation formula is as follows:

[0012]

[0013] Among them, f θ Let θ be the model, y be the sample label, and L(·,·) be the loss function, typically the cross-entropy function.

[0014] Step S4: After obtaining the updated adversarial example x adv Then, adversarial examples are used as input to the model for adversarial training. Furthermore, the dynamic label balancing smoothing proposed in this invention needs to be combined to further mitigate the negative impact of sample imbalance during training. Its formula is defined as:

[0015]

[0016] in Defined as:

[0017]

[0018] The clean precision of the i-th class sample during the k-th training round, where y represents the one-hot label. To limit the reasonableness of the smoothed label, constraints need to be imposed on it, therefore k min The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. It should be noted that this method balances and smooths sample labels without adding extra hyperparameters, thus avoiding any additional burden on training and ultimately yielding the classification loss L. CE .

[0019] Step S5: The loss function used in the model parameter update stage is a cross-entropy loss function combined with a regularization term. The cross-entropy function is used to meet the basic requirements of the classification task, while the regularization term aims to balance the samples within the class range as much as possible. Therefore, for each class of samples, with the class as the boundary, this method adds a regularization term to the loss function to balance the model's output values ​​for the original samples and adversarial samples. The loss function is defined as follows:

[0020] L OA =L CE +L CWR ,

[0021] LOA L represents the overall loss. CE L represents the standard cross-entropy loss function. CWR The feature difference balance regularization loss (sample class-guided scheme) proposed in this method is defined as follows:

[0022]

[0023] x i Let represent samples belonging to class i, λ be a hyperparameter used to control the weight of the regularization term, balancing the model's weights on adversarial samples and the original image output, m represent the total number of classification classes in the dataset, θ represent the model's parameters, and f θ This represents the overall computational process of the model receiving input.

[0024] Secondly, a fast adversarial training method based on feature differences is proposed, with the following sample feature-guided scheme:

[0025] Step S1: Since this invention can be used as a plugin to combine with existing mainstream fast adversarial training methods, it is necessary to initialize the perturbation information δ0 according to the method of the plugin target object. Generally, the initialization operation of the perturbation information δ0 requires first uniformly sampling from [-∈, ∈]. In order to satisfy the characteristic that the perturbation information is invisible to the naked eye, the perturbation information needs to satisfy ‖δ‖. ∞ <∈, where ∈ represents the numerical boundary, which is generally set to in adversarial training.

[0026] Step S2: The goal of adversarial training is to improve the robustness of the model by training it with generated high-quality adversarial examples. In generating adversarial examples, the initial perturbation information δ0 is first added to the clean sample x to obtain the initial adversarial sample x. init =x+δ0.

[0027] Step S3: Initialize the adversarial sample x init As input to the target model, according to the definition of the FGSM algorithm, the perturbation information is updated and then added back to the clean samples to obtain the adversarial sample x for this round of training. adv The calculation formula is as follows:

[0028]

[0029] Among them, f θ Let θ be the model, y be the sample label, and L(·,·) be the loss function, typically the cross-entropy function.

[0030] Step S4: After obtaining the updated adversarial example x advThen, adversarial examples are used as input to the model for adversarial training. Furthermore, the dynamic label balancing smoothing proposed in this invention needs to be combined to further mitigate the negative impact of sample imbalance during training. Its formula is defined as:

[0031]

[0032] in Defined as:

[0033]

[0034] The clean precision of the i-th class sample during the k-th training round, where y represents the one-hot label. To limit the reasonableness of the smoothed label, constraints need to be imposed on it, therefore k min The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. It's important to note that this method balances and smooths sample labels without adding extra hyperparameters, thus avoiding any additional burden on training. The fast adversarial training method based on feature differences requires the use of previous training information. It uses the cross-entropy function as the loss function to calculate and record relevant metrics, including the clean accuracy c for each class of samples. i Robust accuracy r for each category of samples i The average clean precision c of the dataset and the average robust precision r of the dataset.

[0035] Step S5: This step takes effect every second round of training. It requires using the metrics from the previous round of training to calculate the feature correlation coefficient using the following formula.

[0036]

[0037] Based on the correlation coefficient, all samples in the dataset can be divided into four categories at the feature level: Good Clean and Robust (GCGR) feature classes. Their correlation coefficients should meet certain criteria. This means that both clean precision and robust precision exceed the average level of the dataset; define Good Clean Bad Robust (GCBR) feature classes, and their correlation coefficients should meet the following criteria. Samples with this characteristic exhibit good cleanliness accuracy but not good robustness accuracy; define the bad clean good robust (BCGR) feature classes, whose correlation coefficients should meet the following criteria. Samples with this feature exhibit the opposite behavior to GCBR feature classes; their robust accuracy is good, but their clean accuracy is unsatisfactory. Additionally, the correlation coefficients of poorly clean and badly robust (BCBR) feature classes should meet certain criteria. Samples with this characteristic have clean accuracy and robust accuracy that are far below average.

[0038] Step S6: Based on the feature correlation coefficient All samples in the original dataset are clustered into four feature classes. For each feature class, a corresponding regularization term is set in the loss function. The loss function of the fast adversarial training method based on feature differences and the sample feature-guided scheme is defined as follows:

[0039] L OA =L CE +L FWR ,

[0040] L OA L represents the overall loss. CE L represents the standard cross-entropy loss function. FWR The feature difference balance regularization loss (sample feature-guided scheme) proposed in this method is defined as follows:

[0041]

[0042] Where j represents the four feature classes guided by sample features, and this scheme will divide all samples in the dataset into four feature classes; x i Let f represent a feature sample belonging to the i-th class, λ be a hyperparameter used to control the weight of the regularization term, θ represent the model parameters, and f θ This represents the overall computational process of the model receiving input. This regularization method can be seamlessly extended to any existing fast adversarial training method, improving performance, training stability, and model robustness as the number of classes increases without introducing additional training time consumption.

[0043] This invention provides a fast adversarial training algorithm based on feature difference balancing, along with two related schemes, which improves training stability and enhances the robustness of AI models against adversarial attacks. This invention can be applied to image processing, information security, autonomous driving, and intelligent robots. Currently, most mainstream adversarial training methods apply a uniform strategy to all samples in the dataset, ignoring the inherent feature differences between samples. This invention discovers that while samples of different categories exhibit significant differences in features, the categories also show a consistent trend, indicating the existence of potential deeper patterns derived from the features of the sample data. Based on a feature-centric perspective, this invention analyzes the changes in example features during training from a macroscopic and dynamic angle, effectively improving the robustness of deep learning and mitigating the inherent security problems caused by the vulnerability of algorithms in deep learning for artificial intelligence. Attached Figure Description

[0044] Figure 1 This is a fast adversarial training method based on feature differences, with a flowchart of the sample category-guided scheme;

[0045] Figure 2 This is a fast adversarial training method based on feature differences, with a flowchart of the sample feature-guided scheme;

[0046] Figure 3 Training time and robust accuracy based on sample category schemes;

[0047] Figure 4 Training time and robust accuracy based on sample feature schemes. Detailed Implementation

[0048] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. It should be noted that the terms "front," "rear," "left," "right," "up," and "down" used in the following description refer to directions in the accompanying drawings, and the terms "inner" and "outer" refer to directions toward or away from the geometric center of a specific component, respectively.

[0049] The datasets used in the experiments cover all commonly used datasets in adversarial training experiments, including CIFAR10, CIFAR100 [Krizhevsky A, Hinton G. Learning multiple layers of features from tinyimages.(2009)[J].2009.], Tiny ImageNet, and ImageNet100 [Deng J, Dong W, Socher R, et al. Imagenet: A large-scale hierarchical image database[C] / / 2009IEEEconference on computer vision and pattern recognition. IEEE, 2009:248-255.]. The model used in the adversarial training process is ResNet18 [He K, Zhang X, Ren S, et al. Deep residual learning for image recognition[C] / / Proceedings of the IEEE conference on computer vision and pattern recognition. 2016:770-778.]. The evaluation metrics are clean accuracy, robust accuracy against different attacks, and training time. Higher clean accuracy and robust accuracy indicate better training results; shorter training time indicates lower training costs and greater practical value.

[0050] Firstly, a fast adversarial training method based on feature differences, with the following sample category guidance scheme:

[0051] Step S1: Since this invention can be used as a plugin to combine with existing mainstream fast adversarial training methods, it is necessary to initialize the perturbation information δ0 according to the method of the plugin target object. Generally, the initialization operation of the perturbation information δ0 requires first uniformly sampling from [-∈, ∈]. In order to satisfy the characteristic that the perturbation information is invisible to the naked eye, the perturbation information needs to satisfy ‖δ‖. ∞ <∈, where ∈ represents the numerical boundary, which is generally set to in adversarial training.

[0052] Step S2: The goal of adversarial training is to improve the robustness of the model by training it with generated high-quality adversarial examples. In generating adversarial examples, the initial perturbation information δ0 is first added to the clean sample x to obtain the initial adversarial sample x. init =x+δ0.

[0053] Step S3: Initialize the adversarial sample x init As input to the target model, according to the definition of the FGSM algorithm, the perturbation information is updated and then added back to the clean samples to obtain the adversarial sample x for this round of training. adv The calculation formula is as follows:

[0054]

[0055] Among them, f θ Let θ be the model, y be the sample label, and L(·,·) be the loss function, typically the cross-entropy function.

[0056] Step S4: After obtaining the updated adversarial example x adv Then, adversarial examples are used as input to the model for adversarial training. Furthermore, the dynamic label balancing smoothing proposed in this invention needs to be combined to further mitigate the negative impact of sample imbalance during training. Its formula is defined as:

[0057]

[0058] in Defined as:

[0059]

[0060] The clean precision of the i-th class sample during the k-th training round, where y represents the one-hot label. To limit the reasonableness of the smoothed label, constraints need to be imposed on it, therefore k min The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. It should be noted that this method balances and smooths sample labels without adding extra hyperparameters, thus avoiding any additional burden on training and ultimately yielding the classification loss L. CE .

[0061] Step S5: The loss function used in the model parameter update stage is a cross-entropy loss function combined with a regularization term. The cross-entropy function is used to meet the basic requirements of the classification task, while the regularization term aims to balance the samples within the class range as much as possible. Therefore, for each class of samples, with the class as the boundary, this method adds a regularization term to the loss function to balance the model's output values ​​for the original samples and adversarial samples. The loss function is defined as follows:

[0062] L OA =L CE +L CER ,

[0063] L OA L represents the overall loss. CE L represents the standard cross-entropy loss function. CWR The feature difference balance regularization loss (sample class-guided scheme) proposed in this method is defined as follows:

[0064]

[0065] x i Let represent samples belonging to class i, λ be a hyperparameter used to control the weight of the regularization term, balancing the model's weights on adversarial samples and the original image output, m represent the total number of classification classes in the dataset, θ represent the model's parameters, and f θ This represents the overall computational process of the model receiving input.

[0066] Secondly, a fast adversarial training method based on feature differences is proposed, with the following sample feature-guided scheme:

[0067] Step S1: Since this invention can be used as a plugin to combine with existing mainstream fast adversarial training methods, it is necessary to initialize the perturbation information δ0 according to the method of the plugin target object. Generally, the initialization operation of the perturbation information δ0 requires first uniformly sampling from [-∈, ∈]. In order to satisfy the characteristic that the perturbation information is invisible to the naked eye, the perturbation information needs to satisfy ‖δ‖. ∞ <∈, where ∈ represents the numerical boundary, which is generally set to in adversarial training.

[0068] Step S2: The goal of adversarial training is to improve the robustness of the model by training it with generated high-quality adversarial examples. In generating adversarial examples, the initial perturbation information δ0 is first added to the clean sample x to obtain the initial adversarial sample x. init =x+δ0.

[0069] Step S3: Initialize the adversarial sample x init As input to the target model, according to the definition of the FGSM algorithm, the perturbation information is updated and then added back to the clean samples to obtain the adversarial sample x for this round of training. adv The calculation formula is as follows:

[0070]

[0071] Among them, f θ Let θ be the model, y be the sample label, and L(·,·) be the loss function, typically the cross-entropy function.

[0072] Step S4: After obtaining the updated adversarial example x advThen, adversarial examples are used as input to the model for adversarial training. Furthermore, the dynamic label balancing smoothing proposed in this invention needs to be combined to further mitigate the negative impact of sample imbalance during training. Its formula is defined as:

[0073]

[0074] in Defined as:

[0075]

[0076] The clean precision of the i-th class sample during the k-th training round, where y represents the one-hot label. To limit the reasonableness of the smoothed label, constraints need to be imposed on it, therefore k min The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. It's important to note that this method balances and smooths sample labels without adding extra hyperparameters, thus avoiding any additional burden on training. The fast adversarial training method based on feature differences requires the use of previous training information. It uses the cross-entropy function as the loss function to calculate and record relevant metrics, including the clean accuracy c for each class of samples. i Robust accuracy r for each category of samples i The average clean precision c of the dataset and the average robust precision r of the dataset.

[0077] Step S5: This step takes effect every second round of training. It requires using the metrics from the previous round of training to calculate the feature correlation coefficient using the following formula.

[0078]

[0079] Based on the correlation coefficient, all samples in the dataset can be divided into four categories at the feature level: Good Clean and Robust (GCGR) feature classes. Their correlation coefficients should meet certain criteria. This means that both clean precision and robust precision exceed the average level of the dataset; define Good Clean Bad Robust (GCBR) feature classes, and their correlation coefficients should meet the following criteria. Samples with this characteristic exhibit good cleanliness accuracy but not good robustness accuracy; define the bad clean good robust (BCGR) feature classes, whose correlation coefficients should meet the following criteria. Samples with this feature exhibit the opposite behavior to GCBR feature classes; their robust accuracy is good, but their clean accuracy is unsatisfactory. Additionally, the correlation coefficients of poorly clean and badly robust (BCBR) feature classes should meet certain criteria. Samples with this characteristic have clean accuracy and robust accuracy that are far below average.

[0080] Step S6: Based on the feature correlation coefficient All samples in the original dataset are clustered into four feature classes. For each feature class, a corresponding regularization term is set in the loss function. The loss function of the fast adversarial training method based on feature differences and the sample feature-guided scheme is defined as follows:

[0081] L OA =L CE +L FWR ,

[0082] L OA L represents the overall loss. CE L represents the standard cross-entropy loss function. FWR The feature difference balance regularization loss (sample feature-guided scheme) proposed in this method is defined as follows:

[0083]

[0084] Where j represents the four feature classes guided by sample features, and this scheme will divide all samples in the dataset into four feature classes; x i Let f represent a feature sample belonging to the i-th class, λ be a hyperparameter used to control the weight of the regularization term, θ represent the model parameters, and f θ This represents the overall computational process of the model receiving input. This regularization method can be seamlessly extended to any existing fast adversarial training method, improving performance, training stability, and model robustness as the number of classes increases without introducing additional training time consumption.

[0085] After completing the above steps, relevant metrics were compiled. Tables 1, 2, and 3 respectively show the clean accuracy and robust accuracy of this method on different datasets and under different attacks, as well as a comparison with some mainstream adversarial training methods, including fast adversarial training methods and normal multi-step adversarial training methods.

[0086] Table 1: Experimental results obtained on the CIFAR10 dataset

[0087]

[0088] Table 2: Experimental results obtained on the CIFAR100 dataset

[0089]

[0090] Table 3: Experimental results obtained on the TinyImageNet dataset

[0091]

[0092] Table 4: Experimental results obtained on the ImageNet100 dataset

[0093]

[0094] It should be noted that in the table above, MI represents the MIFGSM attack method [Dong Y, Liao F, Pang T, et al. Boosting adversarial attacks with momentum[C] / / Proceedings of the IEEE conference on computer vision and pattern recognition.2018:9185-9193.], PGD-10 / 50 was proposed by Madry et al. [Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J].arXiv preprint arXiv:1706.06083,2017.], CW represents the C&W algorithm proposed by Carlini and Wagner [Carlini N, Wagner D. Toward sevaluating the robustness of neural networks[C] / / 2017ieee symposium on security and privacy(sp).IEEE,2017:39-57.], and APGD represents Croce and AutoPGD proposed by Hein[Croce F,Hein M.Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks[C] / / International conference onmachine learning.PMLR,2020:2206-2216.], AA represents AutoAttack[Croce F,HeinM.Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks[C] / / International conference on machine learning. PMLR, 2020:2206-2216.].

[0095] In the process of experimental comparison, the fast adversarial training methods selected in the present invention include FGSM-RS[Wong E, Rice L, Kolter J Z. Fast is better than free: Revisiting adversarial training[J]. arXiv preprint arXiv:2001.03994, 2020.], GAT[Sriramanan G, Addepalli S, Baburaj A. Guided adversarial attack for evaluating and enhancing adversarial defenses[J]. Advances in Neural Information Processing Systems, 2020, 33: 20297-20308.], NuAT[Sriramanan G, Addepalli S, Baburaj A. Towards efficient and effective adversarial training[J]. Advances in Neural Information Processing Systems, 2021, 34: 11821-11833.], FGSM-SDI[Jia X, Zhang Y, Wu B, et al. Boosting fast adversarial training with learnable adversarial initialization[J]. IEEE Transactions on Image Processing, 2022, 31: 4417-4430.], GradAlign[Andriushchenko M, Flammarion N. Understanding and improving fast adversarial training[J]. Advances in Neural Information Processing Systems, 2020, 33: 16048-16059.], N-FGSM[de Jorge Aranda P, Bibi A, Volpi R, et al. Make some noise: Reliable and efficient single-step adversarial training[J].Advances in Neural InformationProcessing Systems, 2022, 35: 12881-12893.], FGSM-PGI (PGI-BP and PGI-MEP) [Jia X, Zhang Y, Wei X, et al. Prior-guided adversarial initialization for fast adversarial training [C] / / European Conference on Computer Vision. Cham: SpringerNature Switzerland,2022:567-584.], and using the FGSM-MEP version of FGSM-SC[Zhao M, ZhangL, Kong Y, et al. Fast Adversarial Training with Smooth Convergence[C] / / Proceedings of the IEEE / CVF International Conference on Computer Vision.2023:4720-4729.]. To ensure the comprehensiveness of the adversarial experiments, two other normal multi-step adversarial training methods were selected for comparison: LAS-AWP [Jia X, Zhang Y, Wu B, et al. LAS-AT: adversarial training with learnable attack strategy [C] / / Proceedings of the IEEE / CVF Conference on Computer Vision and Pattern Recognition. 2022:13398-13408.] and MART [Wang Y, Zou D, Yi J, et al. Improving adversarial robustness requires revisiting misclassified examples [C] / / International conference on learning representations. 2019.].

[0096] Figure 3 and Figure 4 The time difference between this invention and other adversarial training methods was compared.

[0097] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features.

Claims

1. A fast adversarial training method based on feature difference balancing, characterized in that, The sample category-guided approach includes the following steps: Step 1: Uniformly sample the initial perturbation information from [-ϵ,ϵ]. , where ϵ represents the perturbation budget to satisfy the characteristic that perturbation information is invisible; Step 2: Transfer the initial disturbance information generated in Step 1 Add to original image Initial adversarial samples were obtained. Using the initial adversarial examples as models The input, where The parameters representing the model; Step 3: The goal of generating adversarial examples is to reduce the accuracy of the original model as much as possible. Therefore, the model is updated based on the gradient information of the perturbation. Obtain the final perturbation information for this round of training. The final disturbance information Add to original image Obtain adversarial examples ; Step 4: Update the adversarial examples The adversarial training is performed using the input of the adversarial examples. For the labels of the inputs corresponding to the adversarial examples, dynamic label smoothing is combined to further reduce the negative impact of sample imbalance during the training process. Step 5: The goal of feature difference balancing guided by sample class is to achieve as much balance as possible among samples within the class range. Therefore, for each class of samples, this method adds a regularization term to the loss function to balance the model's output values ​​for each class of original samples and adversarial samples. The final loss function is in the form of This loss function is used to update the model gradient, and a more robust deep learning model is obtained by balancing intra-class sample differences. Cross-entropy is used for classification loss; The dynamic label smoothing method proposed in step 4 addresses the dynamic nature of training due to variations in clean accuracy and robust accuracy. A balanced label smoothing method is proposed, defined by the following formula: in Defined as: No. Class of samples in the first Clean precision during round training. Tags representing one-hot encoding need to be constrained to limit the validity of smoothed tags. The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. This indicates the total number of categories in the dataset.

2. The fast adversarial training method based on feature difference balancing according to claim 1, characterized in that, In step 5: This method aims to minimize the difference between the model's predicted output for each class of clean samples and its predicted output for adversarial samples, effectively preventing inter-class interference caused by differences in class features. The definition is as follows: Representative belongs to the first Samples of the class, These are hyperparameters used to control the weights of the regularization term. The parameters representing the model, This represents the overall computational process of the model receiving input. This indicates the total number of categories in the dataset.

3. A fast adversarial training method based on feature difference balancing, characterized in that, The sample feature-guided approach includes the following steps: Step 1: Uniformly sample the initial perturbation information from [-ϵ,ϵ]. , where ϵ represents the perturbation budget to satisfy the characteristic that perturbation information is invisible; Step 2: Transfer the initial disturbance information generated in Step 1 Add to original image Initial adversarial samples were obtained. Using the initial adversarial examples as models The input, where The parameters representing the model; Step 3: The goal of generating adversarial examples is to reduce the accuracy of the original model as much as possible. Therefore, the model is updated based on the gradient information of the perturbation. Obtain the final perturbation information for this round of training. The final disturbance information Add to original image Obtain adversarial examples ; Step 4: Update the adversarial examples Use it as input for adversarial training; additionally, record the clean accuracy after this round of training. Robust accuracy of each type of sample Average clean precision of dataset and the average robustness accuracy of the dataset For each class of samples, the corresponding input label for the adversarial sample is combined with the proposed dynamic label smoothing to further reduce the negative impact of sample imbalance during training. Step 5: This step takes effect starting from the second round of training, based on the four metrics recorded in the previous round: , , , Calculate the correlation coefficient of features , , in The clean precision correlation coefficient represents class X. Representing the The robustness-accuracy correlation coefficient of the classes is used to classify the samples in the dataset into four major classes at the feature level. Step 6: The goal of feature difference balancing guided by sample category is to achieve as much balance as possible among samples at the feature level. A regularization term is added to the loss function to balance the model's output values ​​for the original samples and adversarial samples. The final loss function is in the form of This loss function is used to update the model gradient, and by balancing the differences in features among samples, a more robust deep learning model is obtained. Cross-entropy is used for classification loss; The dynamic label smoothing method proposed in step 4 addresses the dynamic nature of training due to variations in clean accuracy and robust accuracy. A balanced label smoothing method is proposed, defined by the following formula: in Defined as: No. Class of samples in the first Clean precision during round training. Tags representing one-hot encoding need to be constrained to limit the validity of smoothed tags. The range is defined as Label balancing and smoothing dynamically adjusts labels based on training state and class features, effectively mitigating the imbalance between internal and external optimization. This indicates the total number of categories in the dataset; In step 6: The definition is as follows: in, These represent four feature classes based on sample features, which will divide all samples in the dataset into four feature classes. Representative belongs to the first Class feature samples, These are hyperparameters used to control the weights of the regularization term. The parameters representing the model, This regularization represents the overall computational process of the model receiving input. It can be extended to other existing fast adversarial training methods, improving performance and increasing the robustness of the model without introducing additional training time as the number of categories increases.

4. The fast adversarial training method based on feature difference balancing according to claim 3, characterized in that, In Scheme 2, which is based on sample feature guidance, step 5 involves: feature correlation coefficient. , The calculation formula is defined as follows: Based on the correlation coefficient, all samples in the dataset are divided into four categories at the feature level, defined as well-clean and robust feature classes, respectively. Their correlation coefficients should meet the following criteria. This means that both clean precision and robust precision exceed the average level of the dataset; well-defined clean and poorly robust feature classes should have correlation coefficients that meet the criteria. Define poorly clean and well robust feature classes, whose correlation coefficients should meet the following criteria. Define poorly clean and robust feature classes, whose correlation coefficients should meet the following criteria. .

Images