Adversarial meta-learning defense method combined with transfer learning

Abstract

Embodiments of the present application relate to the technical field of deep learning, and particularly relate to an adversarial meta-learning defense method combined with transfer learning. The method comprises: obtaining clean sample images, adding random noise to part of the clean sample images, then adding initial perturbations based on a one-hot MSE loss, and finally adding intermediate perturbations based on a cross-entropy loss to obtain adversarial sample images; obtaining a classification model composed of a feature extractor and a classifier; iteratively training the feature extractor based on a cross-entropy loss, a feature clustering regularization loss and an orthogonal projection loss until convergence to obtain a trained feature extractor; iteratively optimizing and training the classifier using a meta-learning algorithm with an explicitly introduced spectral regularization term until convergence to obtain a trained classifier, and finally obtaining a trained classification model. The method achieves a perfect balance between the adversarial robustness and computational efficiency of the model, and improves the generalization ability of the model.

Description

Technical Field

[0001] The embodiments of this application relate to the field of deep learning technology, and in particular to an adversarial meta-learning defense method that combines transfer learning. Background Technology

[0002] Labeled training samples are a scarce and valuable training resource, and deep neural networks rely heavily on them for training. Inspired by the rapid learning ability of humans, few-shot learning techniques train by comparing the features of training samples. This allows them to achieve superior performance compared to classic models even with limited training samples, thus improving the model's generalization and adaptability. Meta-learning is a typical approach to implementing few-shot learning. It targets hierarchical training models, utilizing knowledge accumulated from historical data to provide rapid generalization and adaptability for new tasks, thereby reducing reliance on training samples. Finn et al. proposed an algorithm called Model-Agnostic Meta-Learning (MAML), whose core idea is to obtain optimal initial model weights by learning from multiple similar tasks, thereby quickly learning new tasks with fewer gradient descent steps.

[0003] Besides generalization ability, adversarial robustness is another key aspect of deep learning that has garnered significant attention. Adversarial examples pose a serious security threat to various learning tasks. Research by Yin et al. has confirmed that currently proposed meta-learning algorithms are also susceptible to adversarial example attacks. Traditional adversarial training defense methods typically rely on the availability of large datasets, making them difficult to directly apply to low-sample learning scenarios. Furthermore, MAML and its derivative algorithms, as well as adversarial training itself, have high computational complexity. Simply embedding adversarial training into a double loop within MAML leads to even greater computational resource overhead, making it difficult to achieve a perfect balance between adversarial robustness and computational efficiency. The high training cost also limits deployment scenarios. Additionally, MAML and its derivative algorithms are prone to overfitting to existing tasks during meta-training, resulting in poor generalization on test tasks. Summary of the Invention

[0004] The main objective of the embodiments of this application is to propose an adversarial meta-learning defense method that combines transfer learning, which improves the generation method of adversarial examples, enhances the attack strength of adversarial examples, combines transfer learning and adversarial meta-learning when training the model, achieves a perfect balance between adversarial robustness and computational efficiency, and improves the generalization ability of the model.

[0005] To achieve the above objectives, embodiments of this application provide an adversarial meta-learning defense method combining transfer learning, comprising the following steps: acquiring several clean sample images labeled with tags; adding random noise to some of the clean sample images to obtain a first image; then, through a single-step optimization process, adding an initial perturbation to the first image based on one-hot MSE loss to obtain a second image; finally, adding an intermediate perturbation to the second image based on cross-entropy loss to obtain an adversarial sample image; wherein, the labels are used to characterize the category to which the clean sample images belong; acquiring a classification model to be trained, the classification model to be trained consisting of a feature extractor and a classifier; and based on cross-entropy loss, feature... Clustering regularization loss and orthogonal projection loss are used to iteratively train the feature extractor until convergence, resulting in a trained feature extractor. In one training cycle, the feature extractor is first trained for τ epochs using the clean sample images, and then trained for τ epochs using the adversarial sample images. A meta-learning algorithm with explicitly introduced spectral regularization term is used to iteratively optimize and train the classifier until convergence based on the clean sample images and the adversarial sample images, resulting in a trained classifier. Based on the trained feature extractor and the trained classifier, a trained classification model is obtained.

[0006] To achieve the above objectives, embodiments of this application also provide an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the adversarial meta-learning defense method combining transfer learning as described above.

[0007] To achieve the above objectives, embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned adversarial meta-learning defense method combining transfer learning.

[0008] The adversarial meta-learning defense method proposed in the embodiments of this application, which combines transfer learning, fully considers the potential of each category and proposes a one-hot MSE loss to improve the adversarial example generation strategy. This improvement significantly enhances the diversity of perturbation directions, thereby effectively increasing the attack strength of the generated adversarial examples. When training the classification model to be trained, the feature extractor and classifier are trained scientifically separately. When training the feature extractor, feature clustering regularization loss and orthogonal projection loss are introduced. Feature clustering regularization loss can constrain feature performance and guide the feature extractor to learn embeddings that facilitate feature clustering. Orthogonal projection loss improves spatial clustering from two dimensions: distance and angle, enabling the feature extractor to produce similar feature representations for a small number of samples from a given category. When training the classifier, a spectral regularization term is added to the meta-learning algorithm. This design forces the classifier's output to diversify, which greatly improves the generalization performance of the model. By generating adversarial examples and training the model by combining transfer learning and adversarial meta-learning, the training time of the model is greatly shortened, the complexity of model training is reduced, and a perfect balance is achieved between the adversarial robustness and computational efficiency of the model. Attached Figure Description

[0009] Figure 1 This is a flowchart of an adversarial meta-learning defense method combining transfer learning, provided in one embodiment of this application;

[0010] Figure 2 This is a schematic diagram of pseudocode for an improved adversarial example generation strategy provided in one embodiment of this application;

[0011] Figure 3 This is a schematic diagram illustrating an improved feature embedding provided in one embodiment of this application;

[0012] Figure 4 This is a schematic diagram of pseudocode illustrating the optimization training process of a classifier provided in one embodiment of this application;

[0013] Figure 5 This is a schematic diagram illustrating the principle of an adversarial meta-learning defense method combining transfer learning, provided in one embodiment of this application.

[0014] Figure 6 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the various embodiments of this application will be described in detail below with reference to the accompanying drawings. However, those skilled in the art will understand that many technical details have been provided in the various embodiments of this application to help readers better understand this application. However, the technical solutions claimed in this application can be implemented even without these technical details and various changes and modifications based on the following embodiments. The division of the various embodiments below is for the convenience of description and should not constitute any limitation on the specific implementation of this application. The various embodiments can be combined with and referenced by each other without contradiction.

[0016] Current adversarial learning algorithms have the following three problems.

[0017] First, the current adversarial learning algorithms use overly simplistic strategies for generating adversarial examples.

[0018] The effectiveness of adversarial training is closely related to the attack strength of the adversarial examples used for training. Unfortunately, current research often directly uses standard methods such as the Fast Gradient Sign Method (FGSM) to generate adversarial examples, neglecting the improvement and optimization of these methods. Therefore, optimizing the adversarial example generation strategy is a key factor in improving the defense effect of adversarial training, as it has a direct and significant impact on the adversarial robustness of the model.

[0019] Second, current adversarial learning algorithms take too long to train classification models.

[0020] Adversarial meta-algorithms follow a training process of "inner task fine-tuning + outer meta-update." Typically, fine-tuning of the inner task requires multiple iterations (z times), meaning the model performs z+1 forward propagations when processing a single task, since the outer meta-update also requires one forward propagation. Furthermore, introducing adversarial training requires an additional ρ iterations (ρ≥1) to generate adversarial sample data. Therefore, as the values ​​of z and ρ increase, the difference in training time between different algorithms will significantly widen.

[0021] Third, the generalization ability of models trained by current adversarial learning algorithms is poor.

[0022] Adversarial meta-learning algorithms, represented by the MAML algorithm and its derivatives, fine-tune and update by extracting multiple tasks from training data with similar data distributions. However, when the model overfits on the training task, its classification performance on test data with new categories drops significantly. Therefore, how to learn initialization parameters that can quickly adapt to new tasks and enhance the generalization ability of the meta-learner is also a problem that needs to be considered when designing training strategies.

[0023] To address the aforementioned technical problems, one embodiment of this application proposes an adversarial meta-learning defense method combining transfer learning, applied to an electronic device. The electronic device can be a terminal or a server. This embodiment and the following embodiments will use a server as an example for illustration. The implementation details of the adversarial meta-learning defense method combining transfer learning proposed in this embodiment will be described in detail below. The following content is only for the convenience of understanding the implementation details and is not necessary for implementing this solution.

[0024] The specific process of the adversarial meta-learning defense method combining transfer learning proposed in this embodiment is as follows: Figure 1 As shown, it includes:

[0025] Step 101: Obtain several clean sample images with labels. Add random noise to some of the clean sample images to obtain the first image. Then, through a single-step optimization process, add an initial perturbation to the first image based on the one-hot MSE loss to obtain the second image. Finally, add an intermediate perturbation to the second image based on the cross-entropy loss to obtain the adversarial sample image.

[0026] In the specific implementation, the server acquires several clean sample images labeled with tags representing the category to which the clean sample image belongs. The server divides the clean sample images into two parts: one part generates a clean sample set, and the other part requires the addition of random noise to obtain the first image. Then, through a single-step optimization process, an initial perturbation is added to the first image based on one-hot MSE loss to obtain the second image. Finally, an intermediate perturbation is added to the second image based on cross-entropy loss to obtain the adversarial example image, thus generating the adversarial example set. It is worth noting that although the adversarial example image has added perturbation compared to the preceding clean sample image, its label remains unchanged.

[0027] In one example, the server first adds random noise of magnitude ∈ to a subset of clean sample images to obtain the first image. Then, through a single-step optimization process, based on a pre-defined mature classifier (i.e., a pre-trained classifier), the labels on the first image, and the one-hot MSE loss, an initial perturbation is added to the first image. Based on a pre-defined perturbation step size ∈, the first image with the initial perturbation is projected onto a ∈ sphere, and the portion projected onto the ∈ sphere is cropped to obtain the second image. Next, based on the mature classifier, the labels on the second image, and the cross-entropy loss, an intermediate perturbation is added to the second image. Finally, based on the perturbation step size ∈, the second image with the intermediate perturbation is projected onto a ∈ sphere, and the portion projected onto the ∈ sphere is cropped to obtain the adversarial example image. The projection onto the ∈ sphere effectively performs the thresholding task, ensuring that the perturbation magnitude is scientifically reasonable.

[0028] In one example, the one-heat MSE loss used when adding the initial perturbation to the first image can be expressed by the following formula:

[0029]

[0030]

[0031] Where x represents a clean sample image, ∈ random Represents random noise on the order of magnitude ∈. The first image represents the total number of categories. Let represent the probability that the first image output by the mature classifier belongs to the i-th class, y represent the label on the clean sample image, i.e., the label on the first image, one_hot(·) indicates one-hot encoding, and softmax(·) indicates normalization. This represents the one-heat MSE loss, which actually calculates the average Euclidean distance between each type of output and the true label vector.

[0032] In one example, the server projects a first image with initial perturbation onto a sphere ∈ based on a preset perturbation step size ∈. The portion of the first image with initial perturbation projected onto the sphere ∈ is then cropped to obtain the second image. This can be achieved using the following formula:

[0033]

[0034] Where ∈ represents the perturbation step size, B ∈ Indicates ∈ sphere, The gradient of a clean sample image is represented by sign(·), which is the sign function. This indicates that the operation of projection onto the ∈ sphere is performed. This represents the second image.

[0035] In one example, the server projects a second image with intermediate perturbation onto a sphere ∈ based on the perturbation step size ∈, and extracts the portion of the second image with intermediate perturbation projected onto the sphere ∈ to obtain the adversarial example image, which can be achieved using the following formula:

[0036]

[0037] Where ∈ represents the perturbation step size, B ∈ Indicates ∈ sphere, The gradient of a clean sample image is represented by sign(·), which is the sign function. Let represent the cross-entropy loss, and y represent the labels marked on the second image. This indicates the category of the second image output by the mature classifier. This indicates that the operation of projection onto the ∈ sphere is performed. This represents an adversarial sample image.

[0038] In one example, the pseudocode for the improved adversarial example generation strategy can be as follows: Figure 2 As shown.

[0039] Step 102: Obtain the classification model to be trained, which consists of a feature extractor and a classifier.

[0040] In the specific implementation, after the server obtains the clean sample images and adversarial sample images for training, it can take the classification model to be trained. The classification model to be trained consists of two main parts: a feature extractor and a classifier. Subsequently, the server needs to train the feature extractor and the classifier separately.

[0041] Step 103: Based on cross-entropy loss, feature clustering regularization loss and orthogonal projection loss, the feature extractor is iteratively trained until convergence, and the trained feature extractor is obtained.

[0042] In the specific implementation, for the feature extractor, the server can iteratively train the feature extractor until convergence based on cross-entropy loss, feature clustering regularization loss, and orthogonal projection loss to obtain the trained feature extractor. In one training cycle, the server first uses clean sample images to perform standard training of the feature extractor for τ epochs, and then uses adversarial sample images to perform adversarial training of the feature extractor for τ epochs. When the total number of epochs reaches the preset maximum number of iterations, the training of the feature extractor is completed.

[0043] In one example, the server uses a first loss function when training the feature extractor. The first loss function consists of three loss terms: cross-entropy loss, feature clustering regularization loss, and orthogonal projection loss.

[0044] The cross-entropy loss term is relatively simple; it can be constructed based on the labels annotated on the sample images input to the feature extractor and the class output (class probability) of the classifier based on the input sample images.

[0045] Robustness in few-shot classification can be achieved by explicitly encouraging separation between different classes and tighter intra-class feature embeddings. Feature clustering regularization loss terms and orthogonal projection loss terms are responsible for this task. They primarily train the feature extractor by improving the feature space distribution, replacing the time-consuming meta-training process of learning the overall model weights. The principle can be explained as follows: Figure 3 As shown. The introduction of these two loss terms improves the model's ability to separate different features, ensuring better generalization performance on new tasks, and improves training speed through transfer learning.

[0046] The feature clustering regularization loss term improves model characteristics through distance metrics, thereby enhancing the model's intra-class convergence and inter-class separation performance. The server can construct the feature clustering regularization loss term based on the total number of classes, the total number of data points in the sample images of each class, the feature vectors of each class output by the feature extractor based on the input sample images, the mean of the feature vectors of the same class, and the mean of the feature vectors of different classes.

[0047] The constructed feature clustering regularization loss term can be expressed by the formula:

[0048]

[0049] Among them, L FC The term represents the feature clustering regularization loss, where C represents the total number of categories, and N represents the total number of data points in the sample images of each category. μ represents the feature vector output by the feature extractor based on the input sample image, relating to the k-th category. k Let μ represent the mean of the feature vectors for the k-th category, μ represent the mean of the feature vectors for different categories, and ||·|2 represent taking the L2 norm.

[0050] When the intra-class Euclidean distance is smaller and the inter-class Euclidean distance is larger, L FC The smaller the overall value, the better the features are separated. To reduce the model's dependence on the selected training samples, two classes are randomly sampled in each mini-batch, and two samples are randomly selected from each class for computation to estimate the within-class variance.

[0051] Orthogonal projection loss improves model characteristics through angular metrics, enhancing intra-class convergence and inter-class separation performance. Typically, during model parameter training, cross-entropy loss implicitly achieves orthogonality between different classes in the output space. However, this is a relatively weak constraint due to its relativity. Orthogonal projection loss, on the other hand, enhances angular discriminability in the output space by calculating the dot product between feature vectors. The server can calculate class-specific discriminability based on feature vectors of the same class, and class-specific discriminability based on feature vectors of different classes. Based on these class-specific and class-specific discriminabilities, the orthogonal projection loss term is constructed.

[0052] The orthogonal projection loss term obtained can be expressed by the formula:

[0053]

[0054]

[0055] Where s represents the distinguishability within the same class, and d represents the distinguishability between different classes. This represents the preset weight hyperparameter, and B represents the preset batch size. and Let represent the feature vectors of the i, j, α, and β categories output by the feature extractor based on the input sample image, respectively, and let <·,·> represent the cosine similarity operator for the two vectors.

[0056] s ensures that samples of the same type form clusters in the feature space, while d aims to ensure orthogonality between samples of different types. The orthogonal projection loss is insensitive to batch size and, due to its plug-and-play nature, can be easily coupled with the feature clustering regularizer.

[0057] After constructing the cross-entropy loss term, feature clustering regularization loss term, and orthogonal projection loss term, the server can construct a first loss function based on these terms, and then iteratively train the feature extractor until convergence based on the first loss function, thus obtaining the trained feature extractor.

[0058] The first loss function can be expressed by the following formula:

[0059] L1 = L CE +λ1·L FC +λ2·L OPL

[0060] Where L1 represents the first loss function, L CE L represents the cross-entropy loss term. FC L represents the feature clustering regularization loss term. OPL This represents the orthogonal projection loss term, where λ1 and θ2 are preset loss weight coefficients.

[0061] Step 104: Using a meta-learning algorithm that explicitly introduces a spectral regularization term, the classifier is iteratively optimized and trained until convergence based on clean sample images and adversarial sample images, resulting in a trained classifier.

[0062] In practical implementations, spectral regularization is typically associated with the weight matrix of a neural network. Spectral regularization reduces model complexity, thereby improving its generalization performance. By controlling the eigenvalues ​​of the weight matrix, it can prevent overfitting of the model to the training data. Therefore, for the classifier, the server can utilize a meta-learning algorithm with explicitly introduced spectral regularization terms to iteratively optimize and train the classifier until convergence, based on clean sample images and adversarial sample images, resulting in a fully trained classifier.

[0063] In one example, the server first randomly initializes the classifier's parameters. Based on clean sample images, it establishes a fine-tuning support set and a fine-tuning query set to obtain a fine-tuning task set. Then, it samples from the fine-tuning task set and iteratively fine-tunes the classifier until convergence, obtaining a fine-tuned classifier. Next, it establishes an adversarial query set based on adversarial sample images. Based on the fine-tuning query set, the adversarial query set, and the weight matrix of the fine-tuned classifier, it establishes an optimization objective function that explicitly incorporates a spectral regularization term. Finally, it updates the outer layers of the fine-tuned classifier based on the optimization objective function, ultimately obtaining a trained classifier. The pseudocode for the classifier optimization training process can be as follows: Figure 4 As shown.

[0064] In one example, the established optimization objective function can be expressed by the following formula:

[0065]

[0066] ψ(W)=σ1(W) / σ v (W)

[0067] Where T represents the total number of samples, t i Let θ represent the i-th fine-tuning task obtained from sampling, and θ′ represent the overall parameters of the classifier after fine-tuning. Represents cross-entropy loss, This represents the fine-tuning query data corresponding to the i-th fine-tuning task. R represents the adversarial query data corresponding to the i-th fine-tuning task. KL (·) indicates the calculation of KL divergence, W represents the weight matrix of the fine-tuned classifier, and λ3 and λ4 are preset optimization coefficients. Let represent the norm, v represent the total number of singular values ​​in the weight matrix of the fine-tuned classifier, σ1(W) represent the first singular value in the weight matrix of the fine-tuned classifier, and σ v (W) represents the v-th singular value in the weight matrix of the fine-tuned classifier, and minimize represents the minimize function.

[0068] The optimization objective function can be viewed as a measure of the diversity among the source tasks. In a few-shot classification setting, all source data contribute to good learning and complement each other, thus providing a useful representation for the new target task. By imposing this constraint, the classifier's matrix can be encouraged to cover as many directions as possible. The norm setting encourages linear classifiers to maintain a certain classification margin, thereby avoiding over-specialization or under-specialization of known tasks.

[0069] In one example, the working principle of the adversarial meta-learning defense method combining transfer learning proposed in this application can be as follows: Figure 5As shown, the improved adversarial example generation strategy and the model training that combines transfer learning and adversarial meta-learning work together to achieve a perfect balance between the model's adversarial robustness and computational efficiency.

[0070] Step 105: Based on the trained feature extractor and trained classifier, obtain the trained classification model.

[0071] In practice, after the server obtains the trained feature extractor and the trained classifier, it can concatenate the two to obtain the trained classification model. After the trained classification model is deployed, the server can input the image to be processed into the model to obtain the category of the image output by the model.

[0072] This embodiment fully considers the potential of each category and proposes a one-hot MSE loss to improve the adversarial example generation strategy, significantly enhancing the diversity of perturbation directions and thus effectively increasing the attack strength of the generated adversarial examples. During the training of the classification model, both the feature extractor and classifier are trained scientifically. When training the feature extractor, feature clustering regularization loss and orthogonal projection loss are introduced. Feature clustering regularization loss constrains feature representation, guiding the feature extractor to learn embeddings that facilitate feature clustering. Orthogonal projection loss improves spatial clustering from both distance and angle dimensions, enabling the feature extractor to generate similar feature representations from a small number of samples from a given category. When training the classifier, a spectral regularization term is added to the meta-learning algorithm. This design forces the classifier's output to diversify, significantly improving the model's generalization performance. Through the generation of adversarial examples and the model training combining transfer learning and adversarial meta-learning, the training time is greatly shortened, the complexity of model training is reduced, and a perfect balance is achieved between the model's adversarial robustness and computational efficiency.

[0073] Another embodiment of this application provides an electronic device, such as Figure 4 As shown, the electronic device includes: at least one processor 201; and a memory 202 communicatively connected to the at least one processor 201; wherein the memory 202 stores instructions executable by the at least one processor 201, the instructions being executed by the at least one processor 201 to enable the at least one processor 201 to execute the adversarial meta-learning defense method combining transfer learning as described in the above method embodiments.

[0074] The memory and processor are connected via a bus, which can include any number of interconnecting buses and bridges, connecting various circuits of one or more processors and memories. The bus can also connect various other circuits, such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and will not be described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor is transmitted over the wireless medium via an antenna, which further receives data and transmits it to the processor.

[0075] The processor manages the bus and general processing, and also provides various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. Memory is used to store data used by the processor during operation.

[0076] Another embodiment of this application relates to a computer-readable storage medium storing a computer program that, when executed by a processor, implements the adversarial meta-learning defense method combining transfer learning as described in the above-described method embodiments.

[0077] That is, those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. This program is stored in a storage medium and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, ROM (Read-Only Memory), RAM (Random Access Memory), a magnetic disk, or an optical disk.

[0078] Those skilled in the art will understand that the above embodiments are specific embodiments for implementing this application, and in practical applications, various changes can be made to them in form and detail without departing from the spirit and scope of this application.

Claims

1. An adversarial meta-learning defense method combining transfer learning, characterized in that, include: A number of clean sample images labeled with tags are obtained. Random noise is added to some of the clean sample images to obtain a first image. Then, through a single-step optimization process, an initial perturbation is added to the first image based on one-hot MSE loss to obtain a second image. Finally, an intermediate perturbation is added to the second image based on cross-entropy loss to obtain an adversarial sample image. The tags are used to characterize the category to which the clean sample images belong. Obtain a classification model to be trained, which consists of a feature extractor and a classifier; Based on cross-entropy loss, feature clustering regularization loss, and orthogonal projection loss, the feature extractor is iteratively trained until convergence to obtain a trained feature extractor; wherein, in one training cycle, the feature extractor is first trained for τ epochs using the clean sample images, and then trained for τ epochs using the adversarial sample images. A meta-learning algorithm with an explicitly introduced spectral regularization term is used to iteratively optimize and train the classifier until convergence based on the clean sample image and the adversarial sample image, thus obtaining the trained classifier. Based on the trained feature extractor and trained classifier, a trained classification model is obtained.

2. The adversarial meta-learning defense method combining transfer learning according to claim 1, characterized in that, The process involves adding random noise to a partially clean sample image to obtain a first image, then adding an initial perturbation to the first image based on one-hot MSE loss through a single-step optimization process to obtain a second image, and finally adding an intermediate perturbation to the second image based on cross-entropy loss to obtain an adversarial example image. This includes: Random noise of magnitude ∈ is added to a portion of clean sample images to obtain the first image; Through a single-step optimization process, an initial perturbation is added to the first image based on a preset mature classifier, the labels marked on the first image, and the one-hot MSE loss. Based on the preset perturbation step size ∈, the first image with the initial perturbation is projected onto the ∈ sphere, and the portion of the first image with the initial perturbation projected onto the ∈ sphere is extracted to obtain the second image; Based on the mature classifier, the labels annotated on the second image, and the cross-entropy loss, an intermediate perturbation is added to the second image; Based on the perturbation step size ∈, the second image with added intermediate perturbation is projected onto the ∈ sphere, and the portion of the second image with added intermediate perturbation projected onto the ∈ sphere is extracted to obtain the adversarial sample image.

3. The adversarial meta-learning defense method combining transfer learning according to claim 2, characterized in that, The independent heat MSE loss is expressed by the following formula: Where x represents a clean sample image, ∈ random Represents random noise on the order of magnitude ∈. The first image represents the total number of categories. Let represent the probability that the first image output by the mature classifier belongs to the i-th class, y represent the label on the clean sample image, i.e., the label on the first image, one_hot(·) indicates one-hot encoding, and softmax(·) indicates normalization. This indicates the loss of MSE due to isolated heat. The first image, with initial perturbation added, is projected onto the sphere ∈ based on a preset perturbation step size ∈. The portion of the first image with initial perturbation projected onto the sphere ∈ is then extracted to obtain the second image, which is achieved through the following formula: Where ∈ represents the perturbation step size, B ∈ Indicates ∈ sphere, The gradient of a clean sample image is represented by sign(·), which is the sign function. This indicates that the operation of projection onto the ∈ sphere is performed. This represents the second image.

4. The adversarial meta-learning defense method combining transfer learning according to claim 3, characterized in that, Based on the perturbation step size ∈, the second image with added intermediate perturbation is projected onto the ∈ sphere, and the portion of the second image with added intermediate perturbation projected onto the ∈ sphere is extracted to obtain the adversarial example image, which is achieved through the following formula: Where ∈ represents the perturbation step size, B ∈ Indicates ∈ sphere, The gradient of a clean sample image is represented by sign(·), which is the sign function. Let represent the cross-entropy loss, and y represent the labels marked on the second image. This indicates the category of the second image output by the mature classifier. This indicates that the operation of projection onto the ∈ sphere is performed. This represents an adversarial sample image.

5. The adversarial meta-learning defense method combining transfer learning according to claim 1, characterized in that, The feature extractor is iteratively trained until convergence using cross-entropy loss, feature clustering regularization loss, and orthogonal projection loss to obtain the trained feature extractor, including: Based on the labels annotated on the sample images input to the feature extractor and the class probabilities output by the classifier based on the input sample images, a cross-entropy loss term is constructed; Based on the total number of categories, the total number of data points in the sample images of each category, the feature vectors output by the feature extractor based on the input sample images for each category, the mean of the feature vectors for the same category, and the mean of the feature vectors for different categories, a feature clustering regularization loss term is constructed. The class-specific discriminability is calculated based on feature vectors of the same class, the class-specific discriminability is calculated based on feature vectors of different classes, and an orthogonal projection loss term is constructed based on the class-specific discriminability and the class-specific discriminability. Based on the cross-entropy loss term, the feature clustering regularization loss term, and the orthogonal projection loss term, a first loss function is constructed. Based on the first loss function, the feature extractor is iteratively trained until convergence, resulting in a trained feature extractor.

6. The adversarial meta-learning defense method combining transfer learning according to claim 5, characterized in that, The first loss function is expressed by the following formula: L1=L CE +λ1·L FC +λ2·L OPL L OPL =(1-s)+θ·|d| Where L1 represents the first loss function, L CE L represents the cross-entropy loss term. FC L represents the feature clustering regularization loss term. OPL λ1 and λ2 represent the orthogonal projection loss term, λ1 and λ2 are preset loss weight coefficients, C represents the total number of categories, and N represents the total number of data points in the sample images of each category. μ represents the feature vector output by the feature extractor based on the input sample image, relating to the k-th category. k Let μ represent the mean of the feature vectors for the k-th class, μ represent the mean of the feature vectors for different classes, ||·||2 represents taking the L2 norm, s represents class-specific discriminability, d represents class-specific discriminability, θ represents the preset weight hyperparameter, B represents the preset batch size, and <·,·> represents the cosine similarity operator for two vectors.

7. The adversarial meta-learning defense method combining transfer learning according to claim 1, characterized in that, The meta-learning algorithm, which explicitly incorporates a spectral regularization term, iteratively optimizes and trains the classifier until convergence based on the clean sample images and the adversarial sample images, resulting in a trained classifier, including: Randomly initialize the parameters of the classifier, and establish a fine-tuning support set and a fine-tuning query set based on the clean sample images to obtain a fine-tuning task set; Samples are taken from the fine-tuning task set, and the classifier is iteratively fine-tuned and trained until convergence based on the sampled fine-tuning tasks to obtain the fine-tuned classifier. An adversarial query set is established based on the adversarial sample images. An optimization objective function with explicit spectral regularization term is established based on the fine-tuned query set, the adversarial query set, and the weight matrix of the fine-tuned classifier. The outer layer of the fine-tuned classifier is updated based on the optimized objective function to obtain the finally trained classifier.

8. The adversarial meta-learning defense method combining transfer learning according to claim 7, characterized in that, The optimization objective function is expressed by the following formula: ψ(W)=σ1(W) / σ v (W) Where T represents the total number of samples, t i Let θ represent the i-th fine-tuning task obtained from sampling. ′ This represents the overall parameters of the classifier after fine-tuning. Represents cross-entropy loss, This represents the fine-tuning query data corresponding to the i-th fine-tuning task. R represents the adversarial query data corresponding to the i-th fine-tuning task. KL (·) indicates the calculation of KL divergence, W represents the weight matrix of the fine-tuned classifier, and λ3 and λ4 are preset optimization coefficients. Let represent the norm, v represent the total number of singular values ​​in the weight matrix of the fine-tuned classifier, σ1(W) represent the first singular value in the weight matrix of the fine-tuned classifier, and σ v (W) represents the v-th singular value in the weight matrix of the fine-tuned classifier, and minimize represents the minimize function.

9. An electronic device, characterized in that, include: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the adversarial meta-learning defense method combining transfer learning as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the adversarial meta-learning defense method combining transfer learning as described in any one of claims 1 to 8.

Images