A model adversarial training method and device based on a dynamic low-dimensional subspace

Abstract

The application discloses a kind of model confrontation training method and device based on dynamic low-dimensional subspace, including according to model parameter training track construction dynamic low-dimensional subspace, using deep neural network model and preset minimization loss function according to confrontation image training set, determine model gradient;Second intermediate deep neural network model is updated, determine third intermediate deep neural network model and corresponding third intermediate model parameter, and real-time statistics current subspace update time;If current subspace update time meets preset subspace update condition, then using third intermediate model parameter updates dynamic low-dimensional subspace, determines new dynamic low-dimensional subspace;According to new dynamic low-dimensional subspace, model training is carried out, and target deep neural network model is determined;The technical problem that the robustness of model is poor caused by the model training method based on confrontation sample of existing is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to a model adversarial training method and device based on a dynamic low-dimensional subspace. BACKGROUND

[0002] In recent years, artificial intelligence technology centered on deep learning has achieved very excellent results in computer vision and speech recognition. In particular, in the field of computer vision, deep neural networks represented by convolutional neural networks are widely used in practical scenarios.

[0003] However, researchers have found that although current deep learning models can achieve very high accuracy on image classification tasks, they are very easy to be misled by carefully designed small perturbations, resulting in a sharp decline in model accuracy, achieving the purpose of deceiving deep learning models. Such a small perturbation that the human eye cannot perceive is called an adversarial perturbation. Adding an adversarial perturbation to a clean sample is called an adversarial sample. As can be seen, the existence of adversarial samples poses a great security risk to the actual landing of deep learning models, especially for high-security application scenarios such as face ticket checking, face payment, and autonomous driving.

[0004] Existing model training methods based on adversarial samples mostly limit single-step adversarial training to a specific subspace to control the sharp growth of gradient norms, but the low-dimensional subspace relied on in this process is not adjusted after being set for the first time, showing low temporal relevance and leading to poor robustness of the model. SUMMARY

[0005] The present application provides a model adversarial training method and device based on a dynamic low-dimensional subspace, which solves the technical problem of poor robustness of the model caused by existing model training methods based on adversarial samples.

[0006] The first aspect of the present application provides a model adversarial training method based on a dynamic low-dimensional subspace, comprising:

[0007] Obtain an adversarial image training set and input the adversarial image training set to a pre-set deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model;

[0008] According to the model parameter training trajectory, a dynamic low-dimensional subspace is constructed, and the model parameters of the first intermediate deep neural network model are traced back to determine a second intermediate deep neural network model;

[0009] The second intermediate deep neural network model and a pre-set minimum loss function are used to determine the model gradient according to the adversarial image training set;

[0010] updating the second intermediate deep neural network model using the model gradient and the dynamic low-dimensional subspace, determining a third intermediate deep neural network model and corresponding third intermediate model parameters, and counting a current subspace update time instant in real time;

[0011] determining whether the current subspace update time instant meets a preset subspace update condition;

[0012] if the current subspace update time instant meets the preset subspace update condition, updating the dynamic low-dimensional subspace using the third intermediate model parameters, and determining a new dynamic low-dimensional subspace;

[0013] training the third intermediate deep neural network model using the new dynamic low-dimensional subspace and the adversarial image training set, and determining a target deep neural network model.

[0014] Optionally, the step of inputting the adversarial image training set into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model comprises:

[0015] dividing the adversarial image training set to determine a plurality of adversarial image training subsets;

[0016] inputting each of the adversarial image training subsets into the preset deep neural network model in sequence for model parameter updating based on the preset minimization loss function, and determining a plurality of first model parameters and an initial deep neural network model;

[0017] sampling a plurality of the first model parameters, outputting a plurality of initial model parameters, and counting a first model training number in real time;

[0018] determining whether the first model training number reaches a preset first training number threshold;

[0019] if yes, constructing a model parameter training trajectory using each of the initial model parameters, and taking the initial deep neural network model as the first intermediate deep neural network model.

[0020] Optionally, the step of constructing a dynamic low-dimensional subspace according to the model parameter training trajectory comprises:

[0021] centering the model parameter training trajectory to determine a centered model parameter training trajectory;

[0022] spectrally decomposing the centered model parameter training trajectory to determine a plurality of eigenvalues;

[0023] The characteristic values are respectively substituted into the preset linear equation set to calculate characteristic vectors corresponding to the characteristic values;

[0024] The characteristic values are taken as corresponding singular values, and the characteristic vectors corresponding to the characteristic values are taken as singular value vectors;

[0025] The singular values are sorted in descending order, and the first preset number of singular values are selected as target singular values;

[0026] The target singular values and corresponding singular value vectors are used to construct a dynamic low-dimensional subspace.

[0027] Optionally, the step of determining the model gradient according to the adversarial image training set by using the second intermediate deep neural network model and the preset minimization loss function comprises:

[0028] The adversarial image training set is input into the second intermediate deep neural network model for prediction, and a model prediction result is output;

[0029] The model prediction result is substituted into the preset minimization loss function and is derived to determine the model gradient.

[0030] Optionally, the step of updating the second intermediate deep neural network model by using the model gradient and the dynamic low-dimensional subspace to determine a third intermediate deep neural network model and corresponding third intermediate model parameters comprises:

[0031] The model gradient is projected into the dynamic low-dimensional subspace to determine a subspace gradient;

[0032] The subspace gradient and a preset learning rate are used to optimize the model parameters of the second intermediate deep neural network model to determine the third intermediate deep neural network model and third intermediate model parameters corresponding to the third intermediate deep neural network model.

[0033] Optionally, the step of updating the dynamic low-dimensional subspace by using the third intermediate model parameters to determine a new dynamic low-dimensional subspace comprises:

[0034] The third intermediate model parameters and a set of historical time model parameters are sampled to determine a plurality of subspace model parameters;

[0035] The subspace model parameters are used to construct a subspace model parameter training track;

[0036] The subspace model parameter training track is inserted into the model parameter training track to determine a new model parameter training track;

[0037] A new dynamic low-dimensional subspace is constructed according to the new model parameter training track.

[0038] Optionally, the step of training the third intermediate deep neural network model with the new dynamic low-dimensional subspace and the adversarial image training set to determine a target deep neural network model comprises:

[0039] calculating a target loss value according to the adversarial image training set using the third intermediate deep neural network model and the preset minimization loss function, and counting a second model training number in real time;

[0040] determining whether the target loss value converges or the second model training number reaches a preset second training number threshold;

[0041] if the target loss value converges or the second model training number reaches the preset second training number threshold, the third intermediate deep neural network model is taken as the target deep neural network model;

[0042] if the target loss value does not converge and the second model training number does not reach the preset second training number threshold, a new model gradient is determined according to the adversarial image training set using the third intermediate deep neural network model and the preset minimization loss function;

[0043] optimizing model parameters of the third intermediate deep neural network model using the new model gradient and the new dynamic low-dimensional subspace to determine a new third intermediate deep neural network model;

[0044] calculating a target loss value according to the adversarial image training set using the preset minimization loss function and the new third intermediate deep neural network model, and counting a second model training number in real time until the target loss value converges or the second model training number reaches a preset second training number threshold;

[0045] the new third intermediate deep neural network model determined when the target loss value converges or the second model training number reaches the preset second training number threshold is taken as the target deep neural network model.

[0046] The second aspect of the present application provides a model adversarial training device based on a dynamic low-dimensional subspace, comprising:

[0047] an acquisition module configured to acquire an adversarial image training set and input the adversarial image training set into a preset deep neural network model for regular adversarial training to determine a model parameter training track and a first intermediate deep neural network model;

[0048] a construction module configured to construct a dynamic low-dimensional subspace according to the model parameter training track and backtrack model parameters of the first intermediate deep neural network model to determine a second intermediate deep neural network model;

[0049] a module for determining model gradients from the set of adversarial images using the second intermediate deep neural network model and a preset minimization loss function;

[0050] an updating module for updating the second intermediate deep neural network model using the model gradients and the dynamic low-dimensional subspace, determining a third intermediate deep neural network model and corresponding third intermediate model parameters, and real-time counting a current subspace update time;

[0051] a judging module for judging whether the current subspace update time meets a preset subspace update condition;

[0052] a determining module for updating the dynamic low-dimensional subspace using the third intermediate model parameters if the current subspace update time meets the preset subspace update condition, and determining a new dynamic low-dimensional subspace;

[0053] a target module for model training of the third intermediate deep neural network model using the new dynamic low-dimensional subspace and the set of adversarial images, and determining a target deep neural network model.

[0054] The third aspect of the present application provides a computer device, which comprises a memory and a processor, the memory stores a computer program, and the computer program is executed by the processor to make the processor execute the steps of the model adversarial training method based on the dynamic low-dimensional subspace.

[0055] The fourth aspect of the present application provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to realize the steps of the model adversarial training method based on the dynamic low-dimensional subspace.

[0056] From the above technical solutions, the present application has the following advantages:

[0057] The technical scheme of the present application provides a model adversarial training method based on a dynamic low-dimensional subspace. First, an adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model. Then, a dynamic low-dimensional subspace is constructed according to the model parameter training trajectory, and the model parameters of the first intermediate deep neural network model are traced back to determine a second intermediate deep neural network model. The second intermediate deep neural network model and a preset minimization loss function are used to determine the model gradient based on the adversarial image training set. The model gradient and the dynamic low-dimensional subspace are used to update the second intermediate deep neural network model to determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and the current subspace update time is calculated in real time. It is determined whether the current subspace update time meets the preset subspace update condition. If the current subspace update time meets the preset subspace update condition, the third intermediate model parameters are used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace. Finally, the new dynamic low-dimensional subspace and the adversarial image training set are used to train the third intermediate deep neural network model to determine a target deep neural network model. Based on the above scheme, the second intermediate deep neural network model is updated based on the target loss value and the dynamic low-dimensional subspace, and at the same time, based on the current subspace update time and the preset subspace update condition, the third intermediate model parameters are used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace. This process periodically updates the dynamic low-dimensional subspace during model training, improves the timeliness of the low-dimensional subspace, and further improves the robustness of the model. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0059] Figure 1 A step flowchart of a model adversarial training method based on a dynamic low-dimensional subspace provided by an embodiment of the present application;

[0060] Figure 2 A step flowchart of another model adversarial training method based on a dynamic low-dimensional subspace provided by an embodiment of the present application;

[0061] Figure 3 A flowchart of a model adversarial training method based on a dynamic low-dimensional subspace provided by an embodiment of the present application;

[0062] Figure 4 A flowchart of a gradient-based adversarial attack provided for an embodiment of the present application is shown in FIG. 1.

[0063] Figure 5 A flowchart of adversarial training provided for an embodiment of the present application is shown in FIG. 2.

[0064] Figure 6 A structural block diagram of a model adversarial training device based on a dynamic low-dimensional subspace provided for an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0065] The embodiment of the present application provides a model adversarial training method and device based on a dynamic low-dimensional subspace, and is used for solving the technical problem that the existing model training method based on an adversarial sample leads to poor robustness of a model.

[0066] In order to make the purposes, features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the embodiments described below are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0067] Please refer to Figure 1 , Figure 1 A step flowchart of a model adversarial training method based on a dynamic low-dimensional subspace provided for an embodiment of the present application is shown in FIG. 4.

[0068] The model adversarial training method based on a dynamic low-dimensional subspace provided by the present application comprises the following steps.

[0069] In step 101, an adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine a model parameter training track and a first intermediate deep neural network model.

[0070] The adversarial image training set is training data obtained after an image data set is sequentially subjected to division, data enhancement and adversarial attack processing, wherein the image data set can be a cifar10 (Canadian Institute for Advanced Research 10) / cifar100 (Canadian Institute for Advanced Research 100) image data set.

[0071] Specifically, the adversarial image training set is divided to determine a plurality of adversarial image training subsets; each adversarial image training subset is sequentially input into a preset deep neural network model based on a preset minimization loss function to update the model parameters, determine a plurality of first model parameters and an initial deep neural network model; the plurality of first model parameters are sampled to output a plurality of initial model parameters, and the number of model training is counted in real time; it is judged whether the number of model training reaches a preset training number threshold; if yes, the model parameter training trajectory is constructed by using each initial model parameter and the initial deep neural network model is taken as a first intermediate deep neural network model, wherein is the model parameter under the first sampling, is the model parameter under the second sampling, is the model parameter under the t-th sampling, t is the sampling number, the preset minimization loss function is specifically:

[0072]

[0073] wherein, L is a cross-entropy function; f(x adv , w) is the prediction result output by the deep neural network model; x adv is an adversarial image (adversarial sample); w is the model parameter of the deep neural network model; y is the label corresponding to the clean sample (clean image); f is the deep neural network model; Z is the loss value corresponding to the adversarial image.

[0074] Exemplarily, assuming that the preset training number threshold is 65, the sampling strategy is to sample 2 times for each model training number epoch, and finally when the regular adversarial training of the model is stopped, the model parameter training trajectory

[0075] In this embodiment, the adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine the model parameter training trajectory and the first intermediate deep neural network model.

[0076] Step 102, constructing a dynamic low-dimensional subspace according to the model parameter training trajectory, and backtracking the model parameters of the first intermediate deep neural network model to determine a second intermediate deep neural network model.

[0077] Specifically, the model parameter training trajectory is centralized to determine a centralized model parameter training trajectory wherein, the process of centralization is specifically:

[0078]

[0079] wherein, is the centralized model parameter; t is the sampling number; is the model parameter at the tth sampling.

[0080] Furthermore, the centralized model parameter training trajectory is subjected to spectral decomposition to determine multiple eigenvalues. The spectral decomposition process is specifically as follows:

[0081]

[0082] Among them, det is the matrix calculation function; T is the transpose; is the centralized model parameter training trajectory; λ is the eigenvalue; I is the unit matrix.

[0083] Furthermore, each eigenvalue is substituted into a preset linear equation system to calculate the eigenvector corresponding to each eigenvalue, wherein the preset linear equation system is specifically:

[0084]

[0085] Where T is the transpose; is the centralized model parameter training trajectory; λ is the eigenvalue; I is the unit matrix; v is the eigenvector.

[0086] Furthermore, the eigenvalue is taken as the singular value, that is, let λ = σ 2 , take the eigenvector corresponding to each eigenvalue as the singular value vector, sort each singular value in descending order, and select the singular value of the first preset number d as the target singular value Get the singular value vector [v1,v2,…,v d ], using each target singular value and the corresponding singular value vector to construct a dynamic low-dimensional subspace. Specifically, each target singular value and the corresponding singular value vector are substituted into the low-dimensional subspace orthogonal basis operation formula to obtain multiple low-dimensional subspace orthogonal bases. The low-dimensional subspace P = [u1, u2, ..., u d ]; Among them, the low-dimensional subspace orthogonal basis operation formula is specifically:

[0087]

[0088] Among them, u i is the orthogonal basis of the i-th low-dimensional subspace; σ i is the i-th target singular value; is the centralized model parameter training trajectory; v i is the singular value vector corresponding to the i-th target singular value.

[0089] Further, the model parameters of the first intermediate deep neural network model are traced back to determine a second intermediate deep neural network model. Specifically, the model parameters obtained by the first sampling in the model parameter training trajectory are used to replace the model parameters of the first intermediate deep neural network model, so as to update the model parameters of the first intermediate deep neural network model and obtain the second intermediate deep neural network model, that is, where w0 is the model parameter of the second intermediate deep neural network model, is the model parameter obtained by the first sampling in the model parameter training trajectory.

[0090] In this embodiment, a dynamic low-dimensional subspace is constructed according to the model parameter training trajectory, and the model parameters of the first intermediate deep neural network model are traced back to determine the second intermediate deep neural network model.

[0091] Step 103, the second intermediate deep neural network model and the preset minimization loss function are used to determine the model gradient according to the adversarial image training set.

[0092] Specifically, the adversarial image training set is input into the second intermediate deep neural network model for prediction, and the model prediction result is output. The model prediction result is substituted into the preset minimization loss function and is derived to determine the model gradient. The processing process of the model gradient is specifically:

[0093]

[0094] where, is the model gradient when the training number is k; n is the number of adversarial image data in the adversarial image training subset, that is, the size of the batch; L is the cross-entropy function; is the prediction result output by the deep neural network model when the training number is k; is the i-th adversarial image data (adversarial sample) in the adversarial image training subset; w k is the model parameter of the deep neural network model when the training number is k; y is the label corresponding to the clean sample; f is the deep neural network model.

[0095] In this embodiment, the second intermediate deep neural network model and the preset minimization loss function are used to determine the model gradient according to the adversarial image training set.

[0096] Step 104, the model gradient and the dynamic low-dimensional subspace are used to update the second intermediate deep neural network model to determine the third intermediate deep neural network model and the corresponding third intermediate model parameter, and the current subspace update moment is counted in real time.

[0097] It should be noted that the model gradient projecting to a dynamic low-dimensional subspace, determining a subspace gradient using the subspace gradient and a preset learning rate α to optimize the model parameters of the second intermediate deep neural network model, to determine a third intermediate deep neural network model and third intermediate model parameters corresponding to the third intermediate deep neural network model, wherein the optimization process of the model parameters of the deep neural network model according to the subspace gradient and a preset learning rate α to optimize the model parameters of the deep neural network model, specifically:

[0098]

[0099] wherein w k+1 is the model parameters of the deep neural network model at the training time k+1, i.e., the model parameters optimized based on the subspace gradient and the preset learning rate; w k is the model parameters of the deep neural network model at the training time k; α is the preset learning rate, which is set according to needs, for example, it can be set to 0.1, but the present application is not limited thereto; P is a dynamic low-dimensional subspace; is the subspace gradient.

[0100] In this embodiment, the model gradient and the dynamic low-dimensional subspace are used to update the second intermediate deep neural network model, to determine the third intermediate deep neural network model and the corresponding third intermediate model parameters, and to real-time statistics of the current subspace update time.

[0101] Step 105, judging whether the current subspace update time meets the preset subspace update condition.

[0102] It should be noted that the preset subspace update condition is that if the time interval between the current subspace update time and the time when the last current subspace update time meets the preset subspace update condition reaches the preset time interval, it means that the current subspace update time meets the preset subspace update condition; if the time interval between the current subspace update time and the time when the last current subspace update time meets the preset subspace update condition does not reach the preset time interval, it means that the current subspace update time does not meet the preset subspace update condition; wherein if the time when the current subspace update time meets the preset subspace update condition is the first time, the time when the last current subspace update time meets the preset subspace update condition is the time when the model parameter training trajectory is obtained based on the conventional adversarial training and the dynamic low-dimensional subspace is constructed.

[0103] In this embodiment, it is judged whether the current subspace update time meets the preset subspace update condition.

[0104] Step 106, if the current subspace update time meets the preset subspace update condition, the third intermediate model parameter is used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace.

[0105] Specifically, the third intermediate model parameter and a historical time model parameter set are sampled to determine a plurality of subspace model parameters, wherein the historical time model parameter set includes a plurality of historical time model parameters, and the historical time model parameter is a model parameter updated based on the dynamic low-dimensional subspace and reserved at a time between a time when the last current subspace update time meets the preset subspace update condition and a time when the current subspace update time meets the preset subspace update condition; if the time when the current subspace update time meets the preset subspace update condition is the first time when the preset subspace update condition is met, the time when the model parameter training trajectory obtained based on the conventional adversarial training and the dynamic low-dimensional subspace are constructed is taken as the time when the last current subspace update time meets the preset subspace update condition.

[0106] Further, each subspace model parameter is used to construct a subspace model parameter training trajectory; the subspace model parameter training trajectory is inserted into the model parameter training trajectory, that is, the sampled model parameter trajectory is added to the original model parameter trajectory of the conventional adversarial training to obtain a new model parameter training trajectory; and a new dynamic low-dimensional subspace is constructed according to the new model parameter training trajectory; wherein the construction principle of the new dynamic low-dimensional subspace constructed according to the new model parameter training trajectory is consistent with the construction principle of step 102, and will not be described in detail here.

[0107] In this embodiment, if the current subspace update time meets the preset subspace update condition, the third intermediate model parameter is used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace.

[0108] Step 107, the third intermediate deep neural network model is trained using the new dynamic low-dimensional subspace and the adversarial image training set to determine a target deep neural network model.

[0109] Specifically, a third intermediate deep neural network model and a preset minimization loss function are used to calculate the target loss value according to the adversarial image training set, and the number of second model training times is counted in real time to determine whether the target loss value converges or whether the second model training times reaches the preset second training times threshold; if the target loss value reaches convergence or the second model training times reaches the preset second training times threshold, the third intermediate deep neural network model is used as the target deep neural network model; if the target loss value does not reach convergence and the second model training times does not reach the preset second training times threshold, the third intermediate deep neural network model and the preset minimization loss function are used to train the adversarial image set. The method comprises the following steps: first, optimizing the model parameters of the third intermediate deep neural network model using the new model gradient and the new dynamic low-dimensional subspace; second, optimizing the model parameters of the third intermediate deep neural network model using the preset minimization loss function and the new third intermediate deep neural network model according to the adversarial image training set, calculating the target loss value, and counting the number of second model training times in real time; until the target loss value converges or the number of second model training times reaches the preset second training times threshold; and taking the new third intermediate deep neural network model determined when the target loss value converges or the number of second model training times reaches the preset second training times threshold as the target deep neural network model.

[0110] Among them, the adversarial image training set will be divided into multiple adversarial image training subsets and input into the third intermediate deep neural network model in sequence for prediction. One adversarial image training subset corresponds to one model prediction result. If the calculated target loss value converges according to the model prediction result corresponding to the current adversarial image training subset, it indicates that the deep neural network model has been trained and the input of the adversarial image training subset is stopped.

[0111] In this embodiment, a new dynamic low-dimensional subspace and an adversarial image training set are used to perform model training on the third intermediate deep neural network model to determine the target deep neural network model.

[0112] In the embodiment of the present application, the present application provides a model adversarial training method based on a dynamic low-dimensional subspace. First, an adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model. Then, a dynamic low-dimensional subspace is constructed according to the model parameter training trajectory, and the model parameters of the first intermediate deep neural network model are traced back to determine a second intermediate deep neural network model. The second intermediate deep neural network model and a preset minimization loss function are used to determine the model gradient according to the adversarial image training set. The model gradient and the dynamic low-dimensional subspace are used to update the second intermediate deep neural network model to determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and the current subspace update time is statistically determined in real time. It is judged whether the current subspace update time meets the preset subspace update condition. If the current subspace update time meets the preset subspace update condition, the third intermediate model parameters are used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace. Finally, the new dynamic low-dimensional subspace and the adversarial image training set are used to train the third intermediate deep neural network model to determine a target deep neural network model. Based on the above scheme, while the second intermediate deep neural network model is updated based on the target loss value and the dynamic low-dimensional subspace, the third intermediate model parameters are also used to update the dynamic low-dimensional subspace based on the current subspace update time and the preset subspace update condition to determine a new dynamic low-dimensional subspace. This process will periodically update the dynamic low-dimensional subspace during the model training, improve the timeliness of the low-dimensional subspace, and further improve the robustness of the model.

[0113] Please refer to Figure 2 , Figure 2 The step flow chart of another model adversarial training method based on a dynamic low-dimensional subspace provided by the embodiment of the present application is shown in the following figure.

[0114] The model adversarial training method based on a dynamic low-dimensional subspace provided by the present application comprises:

[0115] Step 201, an adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model.

[0116] It should be noted that the adversarial image training set is training data obtained after the image dataset is sequentially subjected to division, data enhancement, and adversarial attack processing. Specifically, after the image dataset is divided, an image training set, an image validation set, and an image test set are obtained. The image training set is subjected to data enhancement to obtain an enhanced image training set. Based on a deep neural network model, adversarial attacks are performed on samples to obtain adversarial samples. That is, the enhanced image training set and the image validation set are subjected to adversarial attacks by using the fast gradient sign method to obtain an adversarial image training set and an adversarial image validation set. The image test set is attacked by using the projection gradient method to obtain an adversarial image test set. The adversarial image training set is used for subsequent conventional adversarial training and training based on a dynamic low-dimensional subspace (low-dimensional subspace adversarial training) of a model. The adversarial image test set and the adversarial image validation set are used to test and verify the model performance of the trained target deep neural network model. The process of performing adversarial attacks based on the fast gradient sign method can be represented as:

[0117]

[0118] wherein x adv is an adversarial image; x is a clean sample; sgn is a sign function; ∈ is a perturbation size, when an L2 norm is used, ∈ is usually taken as 128 / 255, when an L ∞ norm is used, ∈ is usually taken as 8 / 255; w is a model parameter of the deep neural network model; and y is a label corresponding to the clean sample.

[0119] Further, the process of attacking the image test set by using the projection gradient method to obtain the adversarial image test set can be represented as:

[0120]

[0121] wherein x t+1 is an adversarial image test set; x t is an image test set; α is a perturbation step size, when an L2 norm is used, α is usually taken as 15 / 255, when an L ∞ norm is used, α is usually taken as 2 / 255; t is an iteration number, which can be set to 10; ∏ is a projection operation, that is, the adversarial image test set finally needs to be within the range from x t - ∈ to x t + ∈; ∈ is a perturbation size, when an L2 norm is used, ∈ is usually taken as 128 / 255, when an L ∞ norm is used, ∈ is usually taken as 8 / 255; w is a model parameter of the deep neural network model; and y is a label corresponding to the clean sample.

[0122] Further, step 201 can include the following sub-steps:

[0123] S11, divide the adversarial image training set to determine a plurality of adversarial image training subsets;

[0124] S12, based on the preset minimization loss function, sequentially input each adversarial image training subset to the preset deep neural network model to update the model parameters, determine a plurality of first model parameters and an initial deep neural network model;

[0125] S13, sample the plurality of first model parameters, output a plurality of initial model parameters, and real-time statistics of the first model training times;

[0126] S14, determine whether the first model training times reaches the preset first training times threshold;

[0127] S15, if yes, construct a model parameter training trajectory using each initial model parameter, and take the initial deep neural network model as a first intermediate deep neural network model.

[0128] It should be noted that, based on the preset minimization loss function, the adversarial image training set is divided into a plurality of adversarial image training subsets, and then sequentially input into the preset deep neural network model for regular adversarial training. Before the model training occurs catastrophic overfitting, if catastrophic overfitting occurs at epoch = 65, the preset first training times threshold of the regular adversarial training can be set to 65, and the training is stopped when the first model training times reaches 65. During the training, the model parameters are sampled to obtain the model parameter training trajectory; wherein the preset first training times threshold can be set as needed, and the present application is not limited thereto.

[0129] In the present embodiment, the adversarial image training set is obtained, and the adversarial image training set is input into the preset deep neural network model for regular adversarial training to determine the model parameter training trajectory and the first intermediate deep neural network model.

[0130] Step 202, construct a dynamic low-dimensional subspace according to the model parameter training trajectory, and backtrack the model parameters of the first intermediate deep neural network model to determine a second intermediate deep neural network model.

[0131] It should be noted that, based on the dynamic low-dimensional subspace, the low-dimensional subspace adversarial training of the deep neural network model is performed, which is realized by limiting the gradient descent of the adversarial training of the deep neural network model in the subspace P = [u1, u2, …, u d ]。

[0132] Further, step 202 can include the following substeps:

[0133] S21, center the model parameter training trajectory to determine a centered model parameter training trajectory;

[0134] S22, perform spectral decomposition on the centering model parameter training trajectory to determine a plurality of eigenvalues;

[0135] S23, substitute each eigenvalue into a preset linear equation set respectively to calculate an eigenvector corresponding to each eigenvalue;

[0136] S24, take each eigenvalue as a corresponding singular value, and take the eigenvector corresponding to each eigenvalue as a singular value vector;

[0137] S25, sort each singular value in descending order, and select a preset number of singular values as target singular values;

[0138] S26, use each target singular value and the corresponding singular value vector to construct a dynamic low-dimensional subspace.

[0139] In this embodiment, a dynamic low-dimensional subspace is constructed according to the model parameter training trajectory, and the model parameters of the first intermediate deep neural network model are traced back to determine the second intermediate deep neural network model.

[0140] Step 203, input the adversarial image training set into the second intermediate deep neural network model for prediction, and output a model prediction result.

[0141] In this embodiment, the adversarial image training set is input into the second intermediate deep neural network model for prediction, and a model prediction result is output.

[0142] Step 204, substitute the model prediction result into a preset minimization loss function and derive to determine a model gradient.

[0143] In this embodiment, the model prediction result is substituted into a preset minimization loss function and derived to determine a model gradient.

[0144] Step 205, update the second intermediate deep neural network model using the model gradient and the dynamic low-dimensional subspace to determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and real-time statistics of the current subspace update time.

[0145] Further, step 205 can include the following sub-steps:

[0146] S51, project the model gradient to the dynamic low-dimensional subspace to determine a subspace gradient;

[0147] S52, optimize the model parameters of the second intermediate deep neural network model using the subspace gradient and a preset learning rate to determine the third intermediate deep neural network model and the third intermediate model parameters corresponding to the third intermediate deep neural network model.

[0148] In this embodiment, the model gradient and dynamic low-dimensional subspace are used to update the second intermediate deep neural network model, determine the third intermediate deep neural network model and the corresponding third intermediate model parameters, and count the current subspace update time in real time.

[0149] Step 206: Determine whether the current subspace update time meets the preset subspace update condition.

[0150] It should be noted that if the current subspace update moment does not meet the preset subspace update conditions, the dynamic low-dimensional subspace will not be updated, and the model parameters corresponding to the current subspace update moment based on the subspace gradient and the preset learning rate will be retained for subsequent updates to the dynamic low-dimensional subspace. The third intermediate deep neural network model will then be used as the new second intermediate deep neural network model, and the process will jump to step 203 until the target loss value converges. The new third intermediate deep neural network model determined when the target loss value converges will be used as the target deep neural network model.

[0151] In this embodiment, it is determined whether the current subspace update moment meets the preset subspace update condition.

[0152] Step 207: If the current subspace update time meets the preset subspace update condition, the third intermediate model parameter is used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace.

[0153] It should be noted that when conducting low-dimensional subspace adversarial training, the model parameters of the deep neural network model can also be sampled during low-dimensional subspace adversarial training according to the same sampling strategy as when conducting conventional adversarial training, and the sampled model parameter training trajectory is added to the original model parameter training trajectory and centralized when the preset subspace update condition is met at the previous subspace update moment; repeat the above steps to limit the adversarial training to the dynamic low-dimensional subspace, and train the model until the target loss value converges or the second model training times reaches the preset second training times threshold, where the preset second training times threshold can be set as needed, and the present invention is not limited to this.

[0154] Furthermore, step 207 may include the following sub-steps:

[0155] S71. Sampling the third intermediate model parameter and the historical moment model parameter set to determine a plurality of subspace model parameters;

[0156] S72, constructing a subspace model parameter training trajectory using each subspace model parameter;

[0157] S73, inserting the subspace model parameter training trajectory into the model parameter training trajectory to determine a new model parameter training trajectory;

[0158] S74, constructing a new dynamic low-dimensional subspace according to the new model parameters.

[0159] In this embodiment, if the current subspace update moment meets the preset subspace update condition, the third intermediate model parameters are used to update the dynamic low-dimensional subspace, and a new dynamic low-dimensional subspace is determined.

[0160] Step 208, training the third intermediate deep neural network model using the new dynamic low-dimensional subspace and the adversarial image training set to determine the target deep neural network model.

[0161] Further, step 208 can include the following sub-steps:

[0162] S81, calculating a target loss value according to the adversarial image training set using the third intermediate deep neural network model and the preset minimization loss function, and counting the second model training number in real time;

[0163] S82, determining whether the target loss value converges or the second model training number reaches the preset second training number threshold;

[0164] S83, if the target loss value converges or the second model training number reaches the preset second training number threshold, the third intermediate deep neural network model is used as the target deep neural network model;

[0165] S84, if the target loss value does not converge and the second model training number does not reach the preset second training number threshold, a new model gradient is determined according to the adversarial image training set using the third intermediate deep neural network model and the preset minimization loss function;

[0166] S85, optimizing the model parameters of the third intermediate deep neural network model using the new model gradient and the new dynamic low-dimensional subspace to determine a new third intermediate deep neural network model;

[0167] S86, calculating a target loss value according to the adversarial image training set using the preset minimization loss function and the new third intermediate deep neural network model, and counting the second model training number in real time; until the target loss value converges or the second model training number reaches the preset second training number threshold;

[0168] S87, the new third intermediate deep neural network model determined when the target loss value converges or the second model training number reaches the preset second training number threshold is used as the target deep neural network model.

[0169] In this embodiment, the third intermediate deep neural network model is trained using the new dynamic low-dimensional subspace and the adversarial image training set to determine the target deep neural network model.

[0170] Exemplarily, please refer to Figure 3 , first, a clean sample, i.e. an image dataset, is obtained, and after data preprocessing of the image dataset, an adversarial attack is performed to obtain an adversarial sample, i.e. an adversarial image training set, and according to the adversarial image training set and the deep neural network, an initial dynamic low-dimensional subspace is constructed; the deep neural network is subjected to low-dimensional subspace adversarial training according to the dynamic low-dimensional subspace and the adversarial image training set, and in the low-dimensional subspace adversarial training process, the updated model parameters are sampled, and the low-dimensional subspace is updated at certain time intervals. Specifically, the dynamic low-dimensional subspace is periodically updated, i.e. when the low-dimensional subspace adversarial training is performed, the model parameters are also sampled, and the sampled model parameter trajectory is added to the original conventional adversarial training model parameter trajectory, and the current model parameter trajectory is subjected to spectral decomposition every certain time to obtain a dynamic low-dimensional subspace more suitable for current adversarial training; the adversarial training is limited in the dynamic low-dimensional subspace until the model training converges or reaches a preset condition.

[0171] As a comparison of technical effects, reference can be made to the prior art, and the existing process of generating an adversarial sample is an adversarial attack. Since researchers found that deep learning models are very vulnerable to adversarial samples, many adversarial attack methods have been proposed. Generally, existing adversarial attack methods can be divided into white-box attacks and black-box attacks according to the degree of understanding of the model by the attacker. The present application relates to white-box attacks. Please refer to Figure 4 In white-box attacks, the attacker can access all information of the attacked model, including the network structure of the model, the model weight, the gradient information, etc. The classic white-box attack is a model gradient-based attack, which includes the single-step gradient-based fast gradient sign method (Fast Gradient Sign Method, FGSM) and the multi-step gradient-based projected gradient descent method (Projected Gradient Descent, PGD). This kind of method mainly uses the back propagation gradient of the loss function on the input image to modify the input image, so as to increase the loss function value, thereby causing the model classification error, and the specific process is shown in Figure 4 On the contrary, in black-box attacks, the attacker cannot obtain the internal information of the attacked model, and can only query the output of the model through input data.

[0172] Further, the fast gradient sign method is based on maximizing the model loss function, and a small perturbation is added to the original clean sample to make the model produce an erroneous classification on the perturbed sample. The formula is as follows:

[0173]

[0174] where x is the clean sample, sgn is the sign function, ∈ is the perturbation size, L is the loss function, which can be cross-entropy or squared error function, f is the deep neural network, w is the deep neural network parameter, and y is the label corresponding to the clean sample. Therefore, the fast gradient sign method is to add a perturbation of size ε in the direction of gradient ascent in the clean sample (clean image) x.

[0175] Further, the defense method based on adversarial training is one of the most effective methods to improve the adversarial robustness of the model, which aims to minimize the risk of the model under the worst-case perturbation. This method uses adversarial samples as the training set to train the model, that is, to involve adversarial samples in the model training to improve the adversarial robustness of the model. Please refer to Figure 5 , the internal maximization is the process of generating adversarial samples, the external minimization is the process of inputting adversarial samples as the training set to the model for parameter update, and the gradient descent process, as shown in Figure 5 ; adversarial training is a maximization-minimization problem, and the optimization goal is as follows:

[0176]

[0177] where B(x, ∈) is a norm ball with a perturbation radius of ∈; δ is the perturbation added to the clean sample; L is the loss function; and f is the deep neural network.

[0178] Further, according to the type of attack method used in the internal maximization, that is, the generation of adversarial samples, the adversarial training can be divided into single-step adversarial training and multi-step adversarial training. For example, using the fast gradient sign method to generate adversarial samples is single-step adversarial training, and using the projected gradient descent method to generate adversarial samples is multi-step adversarial training. Multi-step adversarial training uses adversarial samples generated by multiple iterations to train the model, so its defense capability is usually stronger and the robustness of the model is higher. However, it has large computational overhead and long training time, and is not practical for large-scale deep neural networks and large data sets. Therefore, single-step adversarial training is simple and efficient, maintains a low computational complexity, and can improve the robustness of the model. Therefore, based on the consideration of the cost of calculation and training time, single-step adversarial training based on the fast gradient sign method is more suitable for actual scenarios.

[0179] Although single-step adversarial training can efficiently improve the robustness of the model, it encounters a very tricky problem during training: catastrophic overfitting. During single-step adversarial training, adversarial samples generated by the projected gradient descent method are usually used as the test set to test the robustness of the model. However, during training, it is found that catastrophic overfitting occurs: the robustness accuracy of the model to the projected gradient descent attack suddenly drops to 0%.

[0180] Furthermore, the existing solution most similar to the present invention for addressing catastrophic overfitting is subspace adversarial training. This solution exploits the close relationship between the rapid growth of the gradient norm of each sample and catastrophic overfitting. By restricting single-step adversarial training to a subspace, it limits the rapid growth of the gradient norm, thereby addressing catastrophic overfitting and improving model robustness.

[0181] During training, each sample is input into the model and has a corresponding gradient after back propagation. The formula for the average gradient norm of the sample is as follows:

[0182]

[0183] Where n is the number of adversarial samples, that is, the batch size; L is the cross entropy function; is the prediction result output by the deep neural network model when the number of training times is k; is the i-th adversarial sample; w k is the model parameter of the deep neural network model when the number of training times is k; y is the label corresponding to the clean sample; f is the deep neural network model.

[0184] The rapid growth of the gradient norm of each sample is closely related to catastrophic overfitting: before catastrophic overfitting occurs in single-step adversarial training, the gradient norm of each sample remains at a small value, but when catastrophic overfitting occurs, the gradient norm suddenly increases sharply and remains at a large value thereafter.

[0185] Therefore, based on the above connection, this scheme aims to limit the gradient norm of each sample to prevent catastrophic overfitting. By restricting adversarial training to a low-dimensional subspace rather than the entire parameter space, this method effectively prevents catastrophic overfitting and improves the robustness of the model. The key steps of this scheme are obtaining a low-dimensional subspace of the model parameter trajectory and restricting adversarial training to this subspace.

[0186] Furthermore, the specific steps of the existing low-dimensional subspace of the model parameter trajectory are as follows: ① In the process of model adversarial training, the model parameters are sampled according to a certain strategy as the model discrete parameter training trajectory {w1, w2, ..., w t}, where t is the number of sampling times, vector w t The length of is the number of model parameters n. ② Align the sampled model parameter vectors into a parameter matrix W and center it; ③ Find a matrix consisting of P = [e1, e2, ..., e dW. Among them, in the deep neural network, the number of model parameters n is usually significantly greater than t and d. Regarding step ③, it aims to find a subspace with the minimum projection distance. Using the norm, it can be expressed as the variance maximization of the projection as shown in the following formula:

[0187]

[0188] where tr is the trace function; I is the unit matrix.

[0189] Further, it is a standard principal component analysis problem, which can be solved by the spectral decomposition of WW T . The eigenvectors corresponding to the first d (arranged in descending order) eigenvalues are the orthogonal basis of the required low-dimensional subspace. However, WW T is an n x n matrix, which is not only very difficult to store, but also has a very high cost of spectral decomposition. It can be noted that because n is much larger than t, WW T is low-rank. Therefore, it can be considered to perform singular value decomposition on W as shown in the following formula:

[0190] W = UΣV T ;

[0191] where Σ is a singular value diagonal matrix, ∑ = diag(σ1, σ2,..., σ t ), U = [u1, u2,..., u n ], the first d columns of U are the orthogonal basis of the required low-dimensional subspace, and V = [v1, v2,..., v t ].

[0192] Since W and W T have basically the same singular value decomposition, v i , i = 1,..., d can be calculated first, which is obtained by the spectral decomposition of W T W, and W T W is a t x t matrix, t is the number of samples, t is much smaller than n, the number of model parameters, so the storage and calculation cost of W T W is very low. Finally, the vector

[0193] In summary, step ③ can be implemented by the following method: performing spectral decomposition on W T W to obtain the first d (arranged in descending order) singular values corresponding singular value vectors [v1, v2,..., v d ], and according to the orthogonal basis P = [u1, u2,..., u d ] of the d-dimensional subspace is obtained.

[0194] Further, the gradient of model back propagation in the adversarial training is extracted and the gradient is projected into a subspace to obtain Therefore, the process of subspace adversarial training is: first, a regular adversarial training is performed to obtain a subspace, and then the model parameters are traced back to the original starting point, and the adversarial training is performed again and limited in the subspace; However, the subspace used in this scheme is obtained from the beginning and never updated, and the subspace has low time sequence, and as time goes on, it may not be able to adapt to the change of data distribution or the gradual optimization of the model in the training process, thereby affecting the subsequent adversarial training to some extent.

[0195] To solve the above problems, the present application provides a model adversarial training method based on a dynamic low-dimensional subspace, which limits single-step adversarial training in a dynamic low-dimensional subspace. The dynamic low-dimensional subspace is dynamically updated during training, has higher time sequence, and is more conducive to model adversarial training. Moreover, there is no significant difference in training time and computational cost, maintaining high efficiency. Because although the low-dimensional subspace is updated multiple times during training, its computational complexity is very low, mainly involving the spectral decomposition of a t x t matrix and the multiplication of two matrices, and the total time complexity is O(t 3 +t 2 n+t 2 n), and the gpu can greatly speed up the matrix operations involved. Compared with the training of deep neural networks, the time consumption can be ignored, and at the same time, the training effect of the present application does not depend on the selection of the learning rate, and there is no additional regular term coefficient that needs to be set, simplifying the parameter adjustment process of the model. More importantly, the present application has better effect on improving the robustness of the model. It alleviates the problem of poor robust generalization of adversarial training, and improves the robustness of unknown attacks (CW attack, AA attack), so the present application also improves the robust generalization performance of the model, so that the model can maintain higher stability and reliability when facing various potential threats.

[0196] Therefore, the present application can efficiently prevent the catastrophic overfitting problem of single-step adversarial training, and further improve the model robustness, accuracy and robust generalization performance.

[0197] In the embodiment of the present application, the present application provides a model adversarial training method based on a dynamic low-dimensional subspace. First, an adversarial image training set is obtained, and the adversarial image training set is input into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model. Then, a dynamic low-dimensional subspace is constructed according to the model parameter training trajectory, and the model parameters of the first intermediate deep neural network model are traced back to determine a second intermediate deep neural network model. The second intermediate deep neural network model and a preset minimization loss function are used to determine the model gradient according to the adversarial image training set. The model gradient and the dynamic low-dimensional subspace are used to update the second intermediate deep neural network model to determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and the current subspace update time is statistically determined in real time. It is judged whether the current subspace update time meets the preset subspace update condition. If the current subspace update time meets the preset subspace update condition, the third intermediate model parameters are used to update the dynamic low-dimensional subspace to determine a new dynamic low-dimensional subspace. Finally, the new dynamic low-dimensional subspace and the adversarial image training set are used to train the third intermediate deep neural network model to determine a target deep neural network model. Based on the above scheme, while the second intermediate deep neural network model is updated based on the target loss value and the dynamic low-dimensional subspace, the third intermediate model parameters are also used to update the dynamic low-dimensional subspace based on the current subspace update time and the preset subspace update condition to determine a new dynamic low-dimensional subspace. The process periodically updates the dynamic low-dimensional subspace during the model training, improves the timeliness of the low-dimensional subspace, and further improves the robustness of the model.

[0198] Please refer to Figure 6 , Figure 6 The structural block diagram of a model adversarial training device based on a dynamic low-dimensional subspace provided by the embodiment of the present application is provided.

[0199] The model adversarial training device based on a dynamic low-dimensional subspace provided by the present application comprises:

[0200] The acquisition module 601 is configured to acquire an adversarial image training set, and input the adversarial image training set into a preset deep neural network model for regular adversarial training to determine a model parameter training trajectory and a first intermediate deep neural network model.

[0201] The according to the module 602 is configured to construct a dynamic low-dimensional subspace according to the model parameter training trajectory, and trace back the model parameters of the first intermediate deep neural network model to determine a second intermediate deep neural network model.

[0202] The using module 603 is configured to use the second intermediate deep neural network model and a preset minimization loss function to determine the model gradient according to the adversarial image training set.

[0203] The updating module 604 is configured to update the second intermediate deep neural network model by using the model gradient and the dynamic low-dimensional subspace, determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and count a current subspace updating time in real time.

[0204] The judging module 605 is configured to judge whether the current subspace updating time meets a preset subspace updating condition.

[0205] The determining module 606 is configured to, if the current subspace updating time meets the preset subspace updating condition, update the dynamic low-dimensional subspace by using the third intermediate model parameters, and determine a new dynamic low-dimensional subspace.

[0206] The target module 607 is configured to train the third intermediate deep neural network model by using the new dynamic low-dimensional subspace and the adversarial image training set, and determine a target deep neural network model.

[0207] Further, the acquiring module 601 is specifically configured to:

[0208] divide the adversarial image training set to determine a plurality of adversarial image training subsets;

[0209] input each adversarial image training subset into a preset deep neural network model in turn based on a preset minimization loss function to update model parameters, determine a plurality of first model parameters and an initial deep neural network model;

[0210] sample the plurality of first model parameters, output a plurality of initial model parameters, and count a first model training number in real time;

[0211] judge whether the first model training number reaches a preset first training number threshold;

[0212] if yes, construct a model parameter training trajectory by using each initial model parameter, and take the initial deep neural network model as a first intermediate deep neural network model.

[0213] Further, the according to the module 602 is specifically configured to:

[0214] centralize the model parameter training trajectory to determine a centralized model parameter training trajectory;

[0215] perform spectral decomposition on the centralized model parameter training trajectory to determine a plurality of eigenvalues;

[0216] substitute each eigenvalue into a preset linear equation set to calculate a feature vector corresponding to each eigenvalue;

[0217] each eigenvalue is taken as a corresponding singular value, and each eigenvector corresponding to the eigenvalue is taken as a singular vector;

[0218] each singular value is sorted in descending order, and a preset number of singular values in the front are selected as target singular values;

[0219] each target singular value and a corresponding singular vector are used to construct a dynamic low-dimensional subspace.

[0220] Further, the module 603 is specifically configured to:

[0221] input the adversarial image training set into the second intermediate deep neural network model for prediction, and output a model prediction result;

[0222] substitute the model prediction result into a preset minimization loss function and derive to determine a model gradient.

[0223] Further, the updating module 604 is specifically configured to:

[0224] project the model gradient to the dynamic low-dimensional subspace to determine a subspace gradient;

[0225] use the subspace gradient and a preset learning rate to optimize the model parameters of the second intermediate deep neural network model, and determine a third intermediate deep neural network model and third intermediate model parameters corresponding to the third intermediate deep neural network model.

[0226] Further, the determining module 606 is specifically configured to:

[0227] sample the third intermediate model parameters and the historical time model parameter set to determine a plurality of subspace model parameters;

[0228] use each subspace model parameter to construct a subspace model parameter training trajectory;

[0229] insert the subspace model parameter training trajectory into the model parameter training trajectory to determine a new model parameter training trajectory;

[0230] construct a new dynamic low-dimensional subspace according to the new model parameter training trajectory.

[0231] Further, the target module 607 is specifically configured to:

[0232] use the third intermediate deep neural network model and the preset minimization loss function to calculate a target loss value according to the adversarial image training set, and real-time count the second model training times;

[0233] determine whether the target loss value converges or the second model training times reaches a preset second training times threshold;

[0234] If the target loss value reaches convergence or the second model training number reaches the preset second training number threshold, the third intermediate deep neural network model is taken as the target deep neural network model.

[0235] If the target loss value does not reach convergence and the second model training number does not reach the preset second training number threshold, a new model gradient is determined according to the adversarial image training set by using the third intermediate deep neural network model and the preset minimum loss function.

[0236] The model parameters of the third intermediate deep neural network model are optimized by using the new model gradient and the new dynamic low-dimensional subspace, and a new third intermediate deep neural network model is determined.

[0237] The target loss value is calculated according to the adversarial image training set by using the preset minimum loss function and the new third intermediate deep neural network model, and the second model training number is counted in real time until the target loss value converges or the second model training number reaches the preset second training number threshold.

[0238] The new third intermediate deep neural network model determined when the target loss value converges or the second model training number reaches the preset second training number threshold is taken as the target deep neural network model.

[0239] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and module can refer to the corresponding process in the foregoing method embodiments, and will not be described here.

[0240] The embodiment of the application further provides a computer device, including a memory and a processor, the memory stores a computer program; the computer program is executed by the processor, so that the processor executes the steps of the model adversarial training method based on the dynamic low-dimensional subspace according to any one of the foregoing embodiments.

[0241] The embodiment of the application further provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by a processor to implement the steps of the model adversarial training method based on the dynamic low-dimensional subspace according to any one of the foregoing embodiments.

[0242] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other manners. For example, the division of the units is only a logical function division, and there can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0243] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0244] The above description and the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A model adversarial training method based on dynamic low-dimensional subspace, characterized in that: include: Obtain an adversarial image training set, and input the adversarial image training set into a preset deep neural network model for conventional adversarial training, to determine a model parameter training trajectory and a first intermediate deep neural network model; Constructing a dynamic low-dimensional subspace according to the model parameter training trajectory, and backtracking the model parameters of the first intermediate deep neural network model to determine a second intermediate deep neural network model; Determining a model gradient based on the adversarial image training set using the second intermediate deep neural network model and a preset minimization loss function; Using the model gradient and the dynamic low-dimensional subspace to update the second intermediate deep neural network model, determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and count the current subspace update time in real time; Determining whether the current subspace update moment meets a preset subspace update condition; If the current subspace update time meets the preset subspace update condition, the dynamic low-dimensional subspace is updated using the third intermediate model parameter to determine a new dynamic low-dimensional subspace; The third intermediate deep neural network model is trained using the new dynamic low-dimensional subspace and the adversarial image training set to determine a target deep neural network model.

2. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of inputting the adversarial image training set into a preset deep neural network model for conventional adversarial training and determining a model parameter training trajectory and a first intermediate deep neural network model includes: Dividing the adversarial image training set to determine a plurality of adversarial image training subsets; Based on the preset minimization loss function, each of the adversarial image training subsets is sequentially input into the preset deep neural network model to update model parameters, and determine a plurality of first model parameters and an initial deep neural network model; Sampling a plurality of the first model parameters, outputting a plurality of initial model parameters, and counting the number of first model training times in real time; Determine whether the first model training times reaches a preset first training times threshold; If so, each of the initial model parameters is used to construct a model parameter training trajectory, and the initial deep neural network model is used as the first intermediate deep neural network model.

3. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of constructing a dynamic low-dimensional subspace according to the model parameter training trajectory includes: Centralizing the model parameter training trajectory to determine a centralized model parameter training trajectory; Performing spectral decomposition on the centralized model parameter training trajectory to determine a plurality of eigenvalues; Substituting each of the eigenvalues ​​into a preset linear equation system, and calculating the eigenvector corresponding to each of the eigenvalues; Taking each eigenvalue as a corresponding singular value and taking an eigenvector corresponding to each eigenvalue as a singular value vector; Sorting the singular values ​​in descending order and selecting the singular values ​​of the first preset number of digits as target singular values; A dynamic low-dimensional subspace is constructed using each of the target singular values ​​and the corresponding singular value vectors.

4. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of using the second intermediate deep neural network model and the preset minimization loss function to determine the model gradient according to the adversarial image training set includes: Inputting the adversarial image training set into the second intermediate deep neural network model for prediction, and outputting the model prediction result; Substitute the model prediction result into the preset minimization loss function and derive it to determine the model gradient.

5. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of updating the second intermediate deep neural network model using the model gradient and the dynamic low-dimensional subspace to determine a third intermediate deep neural network model and corresponding third intermediate model parameters includes: Projecting the model gradient into the dynamic low-dimensional subspace to determine the subspace gradient; The subspace gradient and the preset learning rate are used to optimize the model parameters of the second intermediate deep neural network model, and a third intermediate deep neural network model and third intermediate model parameters corresponding to the third intermediate deep neural network model are determined.

6. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of updating the dynamic low-dimensional subspace by using the third intermediate model parameter to determine a new dynamic low-dimensional subspace includes: Sampling the third intermediate model parameter and the historical moment model parameter set to determine a plurality of subspace model parameters; constructing a subspace model parameter training trajectory using each of the subspace model parameters; Inserting the subspace model parameter training trajectory into the model parameter training trajectory to determine a new model parameter training trajectory; A new dynamic low-dimensional subspace is constructed according to the new model parameter training trajectory.

7. The model adversarial training method based on dynamic low-dimensional subspace according to claim 1, characterized in that: The step of using the new dynamic low-dimensional subspace and the adversarial image training set to perform model training on the third intermediate deep neural network model to determine the target deep neural network model includes: Calculating a target loss value based on the adversarial image training set using the third intermediate deep neural network model and the preset minimization loss function, and counting the number of second model training times in real time; Determine whether the target loss value converges or whether the second model training times reaches a preset second training times threshold; If the target loss value reaches convergence or the second model training times reaches a preset second training times threshold, the third intermediate deep neural network model is used as the target deep neural network model; If the target loss value does not reach convergence and the number of second model training times does not reach the preset second training times threshold, then using the third intermediate deep neural network model and the preset minimization loss function to determine a new model gradient based on the adversarial image training set; Optimizing model parameters of the third intermediate deep neural network model using the new model gradient and the new dynamic low-dimensional subspace to determine a new third intermediate deep neural network model; Using the preset minimization loss function and the new third intermediate deep neural network model to calculate the target loss value based on the adversarial image training set, and counting the number of second model training times in real time; until the target loss value converges or the number of second model training times reaches a preset second training time threshold; The new third intermediate deep neural network model determined when the target loss value converges or the second model training times reaches a preset second training times threshold is used as the target deep neural network model.

8. A model adversarial training device based on dynamic low-dimensional subspace, characterized in that: include: An acquisition module is configured to acquire an adversarial image training set, and input the adversarial image training set into a preset deep neural network model for conventional adversarial training, thereby determining a model parameter training trajectory and a first intermediate deep neural network model; According to the module, it is used to construct a dynamic low-dimensional subspace according to the model parameter training trajectory, and backtrack the model parameters of the first intermediate deep neural network model to determine the second intermediate deep neural network model; An adopting module, configured to determine a model gradient based on the adversarial image training set using the second intermediate deep neural network model and a preset minimization loss function; An updating module, configured to update the second intermediate deep neural network model using the model gradient and the dynamic low-dimensional subspace, determine a third intermediate deep neural network model and corresponding third intermediate model parameters, and count the current subspace update time in real time; A judgment module, configured to judge whether the current subspace update moment meets a preset subspace update condition; a determination module configured to update the dynamic low-dimensional subspace using the third intermediate model parameter to determine a new dynamic low-dimensional subspace if the current subspace update moment meets the preset subspace update condition; A target module is used to use the new dynamic low-dimensional subspace and the adversarial image training set to perform model training on the third intermediate deep neural network model to determine a target deep neural network model.

9. A computer device, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the processor performs the steps of the model adversarial training method based on dynamic low-dimensional subspace as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the model adversarial training method based on dynamic low-dimensional subspace are implemented.

Images