Neural network model training method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of machine learning, and discloses a neural network model training method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring an original image sample, wherein the original image sample comprises a plurality of original images; acquiring gradient information corresponding to an original image in the original image sample; inputting an original image in the original image sample and gradient information corresponding to the original image into an initialization generation network to obtain an initialized image, and forming an initialized sample by a plurality of initialized images; inputting an initialized image in the initialized sample into a preset composite adversarial attack module to obtain a composite adversarial sample; and training a to-be-trained target model according to the composite adversarial sample to obtain an enhanced neural network model. An improved adversarial sample is introduced in a training process, so that the robustness of the model in processing image data containing adversarial disturbance such as equipment noise, man-made interference and natural flaws is improved.

Description

Technical Field

[0001] The present application relates to the field of machine learning technology, and in particular to a training method, apparatus, computer equipment and storage medium for a neural network model. Background Art

[0002] Deep neural network models are being widely used in fields such as autonomous driving, public safety, and smart healthcare. In the screening of cardiovascular and cerebrovascular diseases, tumor diseases, and ophthalmic diseases, smart medical devices widely use deep neural network models for image processing to assist doctors and patients in completing tasks such as diagnosis and triage, image analysis, health self-examination, risk prediction, and initial disease screening. Although deep neural network models perform well in the recognition of conventional images, people's understanding of the interpretability of neural networks and model decision-making mechanisms is still very limited. When smart medical devices process images with adversarial disturbances such as noise generated by the device, artificial disturbances, and / or natural defects, even if the difference between these images and conventional images is so small that the human eye cannot distinguish them, the deep neural network used by the device will fail to recognize or recognize errors, resulting in adverse consequences such as misdiagnosis, showing weak robustness.

[0003] Adversarial training is a method to improve the robustness of a model by introducing designed adversarial samples during the model training process. The adversarial training method used by existing deep neural network models mainly targets a single type of adversarial perturbation, which improves the robustness of the model against a specific type of adversarial perturbation, but has limited effect on improving the overall robustness of the model. Summary of the invention

[0004] The present application discloses a training method, apparatus, computer equipment and storage medium for a neural network model, which solves the problem of poor robustness of existing deep neural network models when processing image data containing adversarial disturbances such as equipment noise, human interference, and natural defects.

[0005] In a first aspect, the present application provides a method for training a neural network model, comprising:

[0006] Acquire original image samples, where the original image samples include a plurality of original images;

[0007] Obtaining gradient information corresponding to the original image in the original image sample;

[0008] Inputting the original image in the original image sample and the gradient information corresponding to the original image into the initialization generation network to obtain an initialization image, wherein a plurality of the initialization images constitute an initialization sample;

[0009] Inputting the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample;

[0010] The target model to be trained is trained according to the composite adversarial sample to obtain an enhanced neural network model.

[0011] In a second aspect, the present application provides a training device for a neural network model, comprising:

[0012] An original sample acquisition module, used to acquire original image samples, wherein the original image samples include a plurality of original images;

[0013] A gradient acquisition module, used to acquire gradient information corresponding to the original image in the original image sample;

[0014] An initial sample acquisition module, used for inputting the original image in the original image sample and the gradient information corresponding to the original image into the initialization generation network to obtain an initialization image, wherein a plurality of the initialization images constitute an initialization sample;

[0015] A composite adversarial module, used for inputting the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample;

[0016] The model training module is used to train the target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model.

[0017] In a third aspect, the present application provides a computer device, comprising a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, a training method for a neural network model as provided in any embodiment of the present application is implemented.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the processor implements a training method for a neural network model as provided in any embodiment of the present application.

[0019] The training method, apparatus, computer equipment and storage medium of the above-mentioned neural network model obtain original image samples, wherein the original image samples include multiple original images; obtain gradient information corresponding to the original images in the original image samples; input the original images in the original image samples and the gradient information corresponding to the original images into the initialization generation network to obtain the initialization image, and multiple initialization images constitute the initialization sample; input the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample; train the target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model. On the one hand, the initialized generative network uses the gradient information corresponding to the original image to guide the direction of the attack, such as the gradient ascent direction that increases the model error rate or the gradient descent direction that reduces the model accuracy, so that the generated adversarial samples are more targeted at the model weaknesses, which helps to obtain more effective perturbations; on the other hand, the composite adversarial attack module is used to process the initialized samples, so that the obtained composite adversarial samples have perturbations of various attack types, thereby improving the robustness of the target model against perturbations of various attack types and composite perturbations; in general, by introducing improved adversarial samples in the training process, the robustness of the model in processing image data containing adversarial perturbations such as equipment noise, human interference, and natural defects is improved.

[0020] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 It is a schematic flow chart of the steps of a neural network model training method provided in an embodiment of the present application;

[0023] Figure 2 It is a structural diagram of a lightweight generation network provided in an embodiment of the present application;

[0024] Figure 3 It is a schematic flow chart of the steps of a composite adversarial sample generation method provided in an embodiment of the present application;

[0025] Figure 4 It is a structural diagram of a composite adversarial attack module provided in an embodiment of the present application;

[0026] Figure 5 It is a schematic flow chart of the steps of a method for determining an attack sequence provided in an embodiment of the present application;

[0027] Figure 6 It is a structural schematic diagram of a training device for a neural network model provided in an embodiment of the present application;

[0028] Figure 7 It is a schematic block diagram of the structure of a computer device provided in an embodiment of the present application.

[0029] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0031] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0032] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0033] It should be understood that, in order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially identical functions and effects. For example, the first data and the second data are only used to distinguish different data, and their sequence is not limited. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0034] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0035] To facilitate understanding of the embodiments of the present application, some words involved in the embodiments of the present application are briefly explained below.

[0036] 1. Adversarial Training: A method to improve the robustness of deep learning models. The main idea is to use not only normal data samples but also adversarial samples during the model training process. Adversarial samples are carefully designed inputs that can mislead the model to make wrong predictions, but look normal to human observers. In adversarial training, the model will try to learn how to correctly classify these adversarial samples, thereby improving its resistance to potential attacks.

[0037] 2. Perturbation: refers to small changes or modifications added to the original data, which are designed to deceive the machine learning model and make it make wrong decisions. Perturbations are usually invisible or difficult to detect, especially in image data, where perturbations may only be some small pixel-level changes.

[0038] 3. Adversarial Attack: refers to the process in which an attacker deliberately manipulates the input data of a machine learning model in order to cause the model to produce incorrect outputs or predictions. The attack is usually based on the vulnerability of the model and is implemented through a carefully designed strategy.

[0039] Compared with perturbation, the concept of attack is broader, which can include the formulation of attack strategies, the selection of targets, the determination of attack sequence, the selection of attack components and the design of perturbations. Perturbation is an integral part of the attack process and is a specific modification imposed on the data by the attacker.

[0040] 4. Adversarial Perturbation: It is a specific modification of the input data of a machine learning model during an adversarial attack, with the aim of causing the model to produce incorrect outputs or predictions.

[0041] 5. Semantic Perturbation: It is a type of adversarial sample. While keeping the appearance of the resulting image natural and semantically similar, it introduces a certain degree of difference from the norm perspective, such as changes in geometric features, color and / or brightness, etc., causing the model to produce incorrect output.

[0042] 6. Composite Adversarial Perturbation: Also known as composite adversarial attack or composite adversarial perturbation, composite adversarial perturbation is a concept in the field of adversarial attacks. It refers to a method of attacking machine learning models (especially deep learning models) by combining multiple different adversarial attack techniques or strategies.

[0043] 7. Scheduling function: In adversarial learning, the scheduling function used to determine the attack order of compound adversarial perturbations usually refers to an algorithm or a series of rules that defines how to arrange and execute different attack steps to maximize the effect of the attack. The role of the scheduling function in compound adversarial perturbations is to optimize the execution order of attack strategies, which usually involves the combined use of multiple attack techniques.

[0044] 8. Fitness function: In the process of generating composite adversarial samples using scheduling algorithms, fitness functions are often used to evaluate the attack effect of samples.

[0045] 9. Fast Gradient Sign Method (FGSM): An algorithm for generating adversarial samples. The main idea of ​​FGSM is to use the gradient of the loss function with respect to the input data to find the direction that maximizes the loss, and construct input perturbations in this direction to generate adversarial samples.

[0046] 10. Armijo rule: A strategy for determining the appropriate stepsize in an optimization algorithm, especially for situations where inexact line search is required. The main idea of ​​Armijo rule is to gradually reduce the stepsize to ensure that the value of the objective function can be reduced in each iteration, provided that certain "sufficient decrease" conditions are met.

[0047] 11. Projected Gradient Descent (PGD): An optimization algorithm that solves constrained optimization problems by iteratively searching in feasible directions. In deep learning, PGD is often used for adversarial training to enhance the robustness of the model to adversarial samples. The main idea of ​​PGD is that in each iteration, the algorithm first moves a certain step along the negative gradient direction of the objective function, and then maps the result back to the feasible domain through a projection operation.

[0048] In adversarial training, Armijo's rule is usually used to determine the step size of PGD. PGD is flexible and can adapt to various feasible domains such as box constraints and ball constraints, and generate high-quality adversarial samples.

[0049] 12. Composite adversarial attack module: an advanced adversarial attack method that combines multiple attack strategies. This attack method does not rely on a single attack vector, but instead uses a variety of perturbation methods to improve the success rate of the attack and the ability to counter the model's robustness.

[0050] 13. Convolutional Layer: A module that uses convolution operations to extract data features. It can be used to extract local features in an image. For example, the convolution kernel slides on the input image data, calculates the weighted sum of the local area, and obtains feature maps or feature vectors.

[0051] 14. Normalization module: In deep learning, it refers to a technology used to improve the training speed and stability of deep neural networks.

[0052] Batch Normalization reduces internal covariate shift by normalizing the input of the module to prevent changes in the input distribution of the network layer from adversely affecting the training process.

[0053] 15. Rectified Linear Unit (ReLU): A commonly used activation function that sets all negative values ​​to zero, enhancing nonlinear characteristics. Its advantages are simple calculation, fast convergence speed, and can alleviate the gradient vanishing problem.

[0054] 16. Activation module: An important part of the neural network. It introduces nonlinear characteristics so that the network can learn and perform more complex tasks. You can use activation functions such as ReLU, Sigmoid, Leaky ReLU, Softmax, etc. to introduce nonlinear factors, thereby enhancing the expression ability of deep neural networks. Among them, ReLU is a non-saturated activation function that can alleviate the problem of gradient disappearance caused by the large number of layers in deep neural networks and accelerate the convergence speed.

[0055] 17.Focal Loss loss function: Focal Loss is a loss function designed to solve the problem of class imbalance in classification tasks, especially object detection tasks. The main idea of ​​Focal Loss is to reduce the weight of easy-to-classify samples and increase the weight of difficult-to-classify samples, so that the model pays more attention to samples that are difficult to classify correctly.

[0056] 18. Poly Loss loss function: Poly Loss is a loss function that simulates angle errors in the form of polynomials, allowing the model to focus more on accurate angle estimation during training. This method is particularly useful when dealing with angle estimation problems in target detection, and can significantly improve the accuracy of the model's angle prediction. In applications with high precision requirements such as autonomous driving, Poly Loss can help improve the safety and reliability of the system.

[0057] 19. Conditional Generative Adversarial Networks (CGAN) is a special type of generative adversarial network (GAN) that introduces conditional information in the generation process. This conditional information can be category labels, text descriptions, image features, or any other additional data that can guide the generation process. The core idea of ​​CGAN is to make the generated output dependent on these conditions, thereby generating samples with specific properties. Well-known open source projects include SemanticAdv and CGAN-PyTorch.

[0058] 20. CIELAB color space: Also known as Lab color space, it is a color space defined by the International Commission on Illumination (CIE) in 1976. It aims to create a color model consistent with human visual perception so that the distance in the color space corresponds to the perceived difference between colors.

[0059] 21.HSV color space: Also known as HSB (Hue, Saturation, Brightness) or HSL (Hue, Saturation, Lightness) color space, it is a color model that represents color as three dimensions: hue, saturation, value or lightness. The design of HSV color space is more in line with the natural way humans perceive color, making it more intuitive and convenient when adjusting color.

[0060] 22. RGB color space: A color model that creates various colors based on the combination of red, green, and blue light. It is one of the most widely used color representation methods. The disadvantage is that this color space is designed for digital imaging and display technology and does not conform to the characteristics of human visual perception.

[0061] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0062] In the field of machine learning, especially in medical image analysis technology, existing intelligent medical equipment has widely adopted deep neural network models to perform tasks such as medical image quality optimization, complex editing, lesion location segmentation and annotation, disease identification and prediction, etc. While improving the work efficiency of medical workers, it also improves the patient satisfaction and service quality of grassroots hospitals with its good accuracy, so that patients can enjoy good medical services without having to upgrade referrals or spend high medical expenses.

[0063] However, due to the incomplete understanding of the decision-making process and internal mechanism of deep neural network models and the incomplete training data set, the designed and trained deep neural network models will have an increased error rate in prediction results when processing image data containing adversarial perturbations such as equipment noise, human interference, and natural defects that are difficult for humans to detect, showing weak robustness, which affects the accuracy and safety of key applications such as autonomous driving road condition recognition, medical image analysis, and face recognition. The existing common adversarial training methods are often based on one type of adversarial perturbation, which improves the robustness of the model in the face of a specific type of perturbation. However, samples in the real world are often composite adversarial samples containing multiple types of perturbations. Therefore, the existing common adversarial training methods have relatively limited improvement on the overall robustness of the model. It is necessary to introduce adversarial perturbations of multiple attack types such as semantic perturbations, coloring changes, and texture transfers into the training samples to improve the robustness of the model in the face of composite adversarial samples.

[0064] In addition, if the adversarial sample has a stronger ability to cause model errors during training and a higher attack success rate, it will have a greater impact on the model training process and the model robustness will be improved. Therefore, it is necessary to optimize the attack order of the attack components of the various attack types used by the compound adversarial sample and guide the attack direction of the sample to the weaknesses of the target model to improve the use effect of the compound adversarial sample, thereby better improving the robustness of the model.

[0065] In addition, the adversarial sample generation model used in existing adversarial training methods has the problems of high complexity, poor maintainability and portability, and high consumption of computing power and other resources. It is necessary to design and adopt a lightweight initialization generation network to improve the attack success rate of adversarial samples by guiding the attack direction of samples, and reduce the high training cost caused by the single model architecture design, and the large amount of computing power resources required for deployment and application.

[0066] To solve the above problems, the present application embodiment proposes a training method for a neural network model. Figure 1 , Figure 1 It is a schematic flowchart of the steps of a neural network model training method provided in an embodiment of the present application.

[0067] like Figure 1 As shown, the training method of the neural network model specifically includes steps S101 to S105.

[0068] S101. Acquire original image samples, where the original image samples include multiple original images.

[0069] Among them, the original image samples are related to the application scenarios of the target model to be trained.

[0070] For example, when the target model is an application scenario for medical image analysis in the field of tumors, the original image samples may include image data and their annotations of different lesion sites, different tumor types, and different health conditions. By differentiating the image data used for training, the migration and applicability of the target model in the real world can be improved.

[0071] For example, when the target model is suitable for an application scenario of road condition recognition for autonomous driving, the original image samples may include road condition image data and their annotations for different vehicle models, different cities, and different road conditions.

[0072] For example, when the target model is suitable for the application scenario of text information recognition, the original image samples may include image data of different fonts, different resolutions, and different light intensities. By differentiating the image data used for training, the migration and applicability of the target model in the real world is improved.

[0073] S102: Obtain gradient information corresponding to the original image in the original image sample.

[0074] Specifically, the gradient information may be the gradient of the loss function with respect to the original image, wherein in the classification task, the usable loss function includes the cross entropy loss; in the regression task, the usable loss function includes the mean square error loss.

[0075] In some embodiments, the original image in the original image sample is input into the target model to be trained to obtain the predicted output of the original image sample; according to the real annotation and the predicted output of the original image sample, the gradient of the loss function with respect to the original image is calculated to obtain the gradient information corresponding to the image. The loss function may include cross entropy loss and FocalLoss loss.

[0076] Exemplarily, the loss value is calculated according to the real annotation of the original image sample and the predicted output of the target model, so as to calculate the gradient of the loss function with respect to the original image by using the back propagation algorithm, and obtain the gradient information corresponding to the original image in the original image sample. The specific steps of calculating include:

[0077] The original image in the original image sample is subjected to preprocessing operations such as cropping, rotation, and pixel normalization to adapt to the input requirements of the target model to be trained, and a preprocessed image is obtained. A plurality of preprocessed images constitute a preprocessed image sample. The preprocessed images in the preprocessed image sample are input into the target model to be trained to obtain the predicted output of the target model for each preprocessed image.

[0078] According to the real annotation of the original image sample and the predicted output of the target model, the loss is calculated using the loss function. Specifically, the back propagation algorithm is used to start from the output layer and trace back to the input layer layer by layer to calculate the gradient of each layer until the gradient of the loss relative to the input image is obtained, and the gradient information corresponding to the original image in the original image sample is obtained. The expression of the gradient information can be:

[0079]

[0080] Where t is the gradient information of the sample, x represents the original image in the original image sample, y represents the true annotation corresponding to x, and f(x) represents the predicted output of the target model corresponding to x. Represents the loss function, which can be a cross entropy loss.

[0081] S103, inputting the original image in the original image sample and the gradient information corresponding to the original image into the initialization generation network to obtain an initialization image, and a plurality of initialization images constitute an initialization sample.

[0082] Exemplarily, the initialization generation network can be a lightweight generation network, and the gradient information corresponding to the original image is input into the lightweight generation network as a conditional vector, so that the initialization generation network can generate an initialization perturbation according to the gradient information corresponding to the original image and / or the guidance of other conditions, and perform weighted summation of the initialization perturbation and the original image to obtain an initialization image, and multiple initialization images constitute an initialization sample. The expression of the initialization sample can be:

[0083] b=∈I(x,t)

[0084] x b =x+b

[0085] Where b can represent the generated initialization perturbation, t can represent the gradient information and / or other conditional information of the sample, I(x, t) represents the perturbation obtained by inputting the gradient information corresponding to the original image and the original image into the initialization generation network, and x b represents the initialization image, x represents the original image, and ∈ represents the scaling factor that maps the value to [-∈,∈].

[0086] Exemplarily, the initialization generation network can be another lightweight generation network, the original image and its corresponding gradient information are spliced ​​or fused, input into the input layer of the lightweight generation network, obtain the first feature expression, input the first feature expression into the residual layer, obtain the second feature expression, input the second feature expression into the output layer, obtain the initialization image, and multiple initialization images constitute the initialization sample. The method of fusing the original image and its corresponding gradient information may include weighted summing the original image and its corresponding gradient information.

[0087] For example, Figure 2 As shown, Figure 2 It is a structural diagram of a lightweight generation network provided in an embodiment of the present application. The lightweight generation network can be used to implement the above step S103. The initialized generation network can be a lightweight generation network. The lightweight generation network includes an input layer, a residual layer and an output layer; wherein the input layer includes at least a convolution module, a normalization module and an activation module, the residual layer includes at least one residual block, and the output layer includes at least a convolution layer and a normalization layer.

[0088] Furthermore, the activation function that can be adopted by the activation module includes ReLU, and the residual block can be composed of a stack of five modules, namely a convolution module, a normalization module, an activation module, a convolution module and a normalization module, and a jump connection that can skip the stack, thereby ensuring that the gradient can be directly transmitted by skipping the stack of the above five modules under preset conditions. The preset conditions can be set or dynamically adjusted based on the learning rate, the performance indicators of the neural network model, whether the gradient disappearance or gradient explosion is detected, and / or the activation value of any activation module in the lightweight generation network.

[0089] The lightweight generative network can provide a flexible and effective structure, which enables the initialized generative network to generate initialization samples with lower computing power and hardware resource consumption while maintaining gradient stability and alleviating the gradient vanishing problem.

[0090] S104: Input the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample.

[0091] Specifically, the initialization image in the initialization sample is input into a preset composite adversarial attack module to obtain a composite adversarial image, and a plurality of composite adversarial images constitute a composite adversarial sample.

[0092] Among them, the composite adversarial attack module may include multiple attack components and a disturbance interval corresponding to each attack component. The composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to the multiple attack components.

[0093] Exemplarily, according to the attack order corresponding to multiple attack components, the initialization image in the initialization sample can be processed one by one using the attack components to obtain a composite adversarial sample; wherein the attack strength of the attack component is within the disturbance range corresponding to each attack component.

[0094] It should be noted that the initialization image in the initialization sample can be represented based on the original pixel space. Therefore, when the initialization image in the initialization sample is processed one by one using the attack components to obtain the composite adversarial sample, the initialization image in the initialization sample can be first converted to the perceptual space using the transformation function, and then a variety of attack components are used to introduce perturbations in the perceptual space to obtain feature adversarial samples, and finally the feature adversarial samples are converted to the original pixel space using the inverse transformation function to obtain the composite adversarial sample. The original pixel space may include the RGB color space, and the perceptual space may include the CIELAB color space, the HSV color space and / or the texture feature space, etc., which are more in line with human visual perception than the original pixel space.

[0095] Exemplarily, a conversion function and an inverse conversion function between the original pixel space and the CIELAB color space are obtained, and the conversion function is used to convert the initialization image in the initialization sample to the CIELAB color space to obtain the feature expression of the perceptual space; the attack components are used to process the feature expression of the perceptual space one by one to obtain a feature adversarial sample; and the inverse conversion function is used to convert the feature adversarial sample back to the original pixel space to obtain the composite adversarial sample.

[0096] It should be noted that by using the attack component to introduce perturbations to the initialized samples in the perceptual space, thereby guiding, controlling and generating composite perturbations from the perspective of human perception, compared to simply introducing perturbations in the original pixel space, it is possible to obtain composite adversarial samples that are more difficult for humans to distinguish, thereby achieving better attack success rate and attack concealment in adversarial training, and further significantly improving the robustness of the target model.

[0097] S105. Train the target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model.

[0098] The composite adversarial sample is input into the target model to be trained for training, and the neural network model is enhanced. Thus, the target model is robust to the composite perturbation in the perturbation boundary. Among them, the maximum and minimum training loss can be used for optimization, and its expression can be:

[0099]

[0100] Among them, x c-adv represents a composite adversarial sample, represents the loss function, F(x c-adv ) represents the predicted output of the target model inputting the composite adversarial sample, y represents the true annotation, (x, y)~D represents the sample pairs extracted from the total data distribution D, F represents the target model, θ F represents the target model parameters to be found, B(x; Ω; E) represents the perturbation set, where x represents the original image, Ω represents the set of perturbation types, and E represents the set of perturbation boundaries.

[0101] Exemplarily, the target model to be trained may be a pre-trained lesion site labeling neural network model, and the lesion site labeling neural network model is trained according to the composite adversarial sample to obtain an enhanced lesion site labeling neural network model.

[0102] Exemplarily, the target model to be trained may be a pre-trained autonomous driving road target detection neural network model, and the autonomous driving road target detection neural network model is trained according to the composite adversarial sample to obtain an enhanced autonomous driving road target detection neural network model.

[0103] It should be noted that methods for training the target model to be trained may include transfer learning, multi-task learning, model fine-tuning and model pre-training.

[0104] In some embodiments, see Figure 3 , Figure 3 1 is a schematic flow chart of the steps of a composite adversarial sample generation method provided in an embodiment of the present application. Figure 3 As shown, the composite adversarial sample generation method specifically includes steps S201 to S204.

[0105] S201. Inputting the initialization image in the initialization sample into the attack component corresponding to the attack sequence.

[0106] S202: The attack component introduces disturbance to the initialization image to obtain a first adversarial sample.

[0107] S203, using the projected gradient descent algorithm to maximize the loss value or error rate of the target model, optimize the image in the first adversarial sample to obtain a second adversarial sample.

[0108] S204. Using an iterative gradient sign algorithm, according to the perturbation interval corresponding to the attack component, the image in the second adversarial sample is optimized to obtain an intermediate output sample, and output it to the next attack component corresponding to the attack sequence, until the last attack component, and output a composite adversarial sample.

[0109] For example, let Ω = {A1, ..., A n} represents a dataset containing n types of attacks. For each attack A k , define the corresponding perturbation boundary ∈ k =[α k ,β k ] to control A k The attack intensity. Correspondingly, the perturbation interval of Ω is expressed as E = {∈ k |k∈{1,…,n}}. Consider Using the allocation function π i :I n →I n To determine the attack sequence to be used under the i-th schedule. At this time, the generated composite adversarial sample x c-adv It can be expressed as:

[0110]

[0111] Among them, x b Denotes the initialization image in the initialization sample, for each attack A in Ω k , the input x b will be converted into a perturbation with a specific level δ k The first adversarial example A k (x; δ k ). Using the projected gradient descent algorithm, the image in the first adversarial sample is optimized with the goal of maximizing the loss value or error rate of the target model. The expression can be:

[0112]

[0113] Where y represents the true label of the initialization sample, and the second adversarial sample is obtained. The perturbation of the second adversarial sample is optimized using iterative gradient sign to obtain the perturbation of the intermediate output sample, which can be expressed as:

[0114]

[0115] Among them, t represents the number of iterations, α represents the iteration step size, Represents the loss function Relative to the disturbance The gradient of . Given the perturbation boundary ∈ k =[α k ,β k ], the clipping operation clip can be performed on each element or pixel z of the intermediate output sample perturbation, and its expression can be:

[0116]

[0117] For further information, see Figure 4 , Figure 4 Schematic diagram of the structure of a composite adversarial attack module provided in an embodiment of the present application. Figure 4 As shown, the composite adversarial attack module can be used to implement the above steps S201 to S204. The composite adversarial attack module can include N attack components, N is a positive integer, the attack components can be arranged in a preset attack order, and each attack component can include a perturbation module, a PGD module and an IGSM module.

[0118] Furthermore, the perturbation module can be used to introduce perturbations to the initialization image to obtain a first adversarial sample; the PGD module can be used to optimize the image in the first adversarial sample using the projected gradient descent algorithm to maximize the loss value or error rate of the target model to obtain a second adversarial sample; the IGSM module can be used to optimize the image in the second adversarial sample using the iterative gradient sign algorithm according to the perturbation interval corresponding to the attack component to obtain an intermediate output sample, and output it to the next attack component corresponding to the attack order until the last attack component to output a composite adversarial sample.

[0119] It should be noted that, in some embodiments, the composite adversarial attack module includes multiple attack components and a disturbance interval corresponding to each attack component, and the composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to the multiple attack components. Each attack component in the composite adversarial attack module may include a disturbance module, and may not include a PGD module and an IGSM module. The composite adversarial attack module can be used to implement: according to the attack order corresponding to the multiple attack components, the initialization image in the initialization sample is processed one by one using the attack components to obtain a composite adversarial sample; wherein the attack strength of the attack component is within the disturbance interval corresponding to each attack component.

[0120] In some embodiments, the specific method by which the composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to multiple attack components is also described in detail. Figure 5 , Figure 51 is a schematic flow chart of the steps of a method for determining an attack sequence provided by an embodiment of the present application. Figure 5 As shown, the attack sequence determination method specifically includes steps S301 to S303.

[0121] S301. Obtain a fitness function and a plurality of random attack sequences, wherein the fitness function is used to evaluate the effectiveness of the attack sequence through attack success rate, time consumption and / or attack intensity.

[0122] Exemplarily, the fitness function can be expressed as:

[0123] f(s i )=w1Success(s i )+w2Time(s i )+w3(1-Intensity(s i ))

[0124] Among them, s i represents the i-th attack order, f(s i ) represents the fitness of the attack sequence in the ith order, Success(s i ) represents the attack success rate of the ith attack sequence, Time(s i ) represents the time consumption of the i-th attack sequence, Intensity(s i ) represents the attack intensity of the ith attack sequence, and w represents the weights of different evaluation indicators, which can be adjusted according to the requirements of specific tasks.

[0125] S302: According to the fitness function, a genetic algorithm is used to iteratively optimize multiple random attack sequences, where the iterative optimization includes selection, crossover and / or mutation operations.

[0126] Among them, the selection operation is used to select the attack order with a fitness higher than a preset threshold from the current attack order, and discard the attack order with low fitness. The specific method may also include roulette selection and tournament selection. The crossover operation is used to mix two attack orders to generate a new attack order. For example, single-point crossover, multi-point crossover or uniform crossover methods can be used. The crossover operation helps to explore new attack orders and increase the diversity of attack orders. The mutation operation introduces new genetic mutations by randomly changing certain attack orders. The mutation operation helps to maintain the diversity of attack orders and prevent the algorithm from converging to a local optimal solution too early.

[0127] S303, repeatedly using a genetic algorithm to iteratively optimize multiple random attack sequences until a repetition number threshold is reached or an attack sequence that can meet a preset fitness function value threshold is obtained, thereby obtaining attack sequences corresponding to multiple attack components.

[0128] like Figure 6 As shown, Figure 6 1 is a schematic diagram of a structure of a training device for a neural network model provided in an embodiment of the present application, wherein the training device for the neural network model is used to execute the aforementioned training method for the neural network model, wherein the training device for the neural network model can be configured in a terminal or a server.

[0129] like Figure 6 As shown, the training device 100 of the neural network model includes an original sample acquisition module 101, a gradient acquisition module 102, an initial sample acquisition module 103, a composite adversarial module 104, and a model training module 105.

[0130] The original sample acquisition module 101 is used to acquire original image samples, where the original image samples include multiple original images;

[0131] A gradient acquisition module 102 is used to acquire gradient information corresponding to the original image in the original image sample;

[0132] The initial sample acquisition module 103 is used to input the original image and the gradient information corresponding to the original image in the original image sample into the initialization generation network to obtain the initialization image. Multiple initialization images constitute the initialization sample;

[0133] The composite adversarial module 104 is used to input the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample;

[0134] The model training module 105 is used to train the target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model.

[0135] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0136] The above-mentioned device can be implemented in the form of a computer program. Figure 7 Runs on the computer device shown.

[0137] See also Figure 7 , Figure 7 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server. Figure 7 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0138] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any training method of a neural network model.

[0139] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0140] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any training method of the neural network model.

[0141] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0142] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0143] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0144] Obtain original image samples, wherein the original image samples include multiple original images; obtain gradient information corresponding to the original images in the original image samples; input the original images in the original image samples and the gradient information corresponding to the original images into an initialization generation network to obtain an initialization image, wherein multiple initialization images constitute an initialization sample; input the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample; train a target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model.

[0145] In some embodiments, the composite adversarial attack module includes multiple attack components and a disturbance interval corresponding to each of the attack components. The composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to the multiple attack components. When the processor implements the input of the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample, it is specifically used to implement: according to the attack order corresponding to the multiple attack components, the initialization image in the initialization sample is processed one by one using the attack component to obtain a composite adversarial sample; wherein the attack intensity of the attack component is within the disturbance interval corresponding to each of the attack components.

[0146] In some embodiments, when the processor is used to process the initialization image in the initialization sample one by one using the attack component, it is specifically used to implement: inputting the initialization image in the initialization sample to the attack component corresponding to the attack sequence; the attack component introduces perturbations to the initialization image to obtain a first adversarial sample; using a projected gradient descent algorithm, with the goal of maximizing the loss value or error rate of the target model, optimizing the image in the first adversarial sample to obtain a second adversarial sample; using an iterative gradient sign algorithm, according to the perturbation interval corresponding to the attack component, optimizing the image in the second adversarial sample to obtain the intermediate output sample, and outputting it to the next attack component corresponding to the attack sequence, until the last attack component, outputting a composite adversarial sample.

[0147] In some embodiments, when the processor is used to obtain the gradient information corresponding to the original image in the original image sample, it is specifically used to implement:

[0148] The original image in the original image sample is input into the target model to be trained to obtain the predicted output of the original image sample; based on the real annotation of the original image sample and the predicted output, the gradient of the loss function with respect to the original image is calculated to obtain the gradient information corresponding to the image.

[0149] In some embodiments, when the processor is used to process the initialization images in the initialization samples one by one using the attack components to obtain the composite adversarial samples, it is specifically used to implement:

[0150] A conversion function and an inverse conversion function between the original pixel space and the preset perceptual space are obtained, and the initialization image in the initialization sample is converted to the preset perceptual space by using the conversion function to obtain a feature expression of the perceptual space, wherein the perceptual space includes a color space or a texture space; the feature expression of the perceptual space is processed one by one by using the attack components to obtain a feature adversarial sample; and the feature adversarial sample is converted back to the original pixel space by using the inverse conversion function to obtain the composite adversarial sample.

[0151] In some embodiments, the processor is used to implement: the initialized generation network is a lightweight generation network, and the lightweight generation network includes an input layer, a residual layer and an output layer; wherein the input layer includes at least a convolution module, a normalization module and an activation module, the residual layer includes at least one residual block, and the output layer includes at least a convolution layer and a normalization layer.

[0152] In some embodiments, when the processor is used for the composite adversarial attack module to determine the attack order corresponding to the plurality of attack components using a scheduling algorithm, it is further used to implement:

[0153] Obtain a fitness function and multiple random attack sequences, wherein the fitness function is used to evaluate the effectiveness of the attack sequence by attack success rate, time consumption and / or attack intensity; according to the fitness function, use a genetic algorithm to iteratively optimize the multiple random attack sequences, and the iterative optimization includes selection, crossover and / or mutation operations; repeat the step of iteratively optimizing the multiple random attack sequences by using a genetic algorithm until a repetition number threshold is reached or an attack sequence that can meet a preset fitness function value threshold is obtained, thereby obtaining the attack sequence corresponding to the multiple attack components.

[0154] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement any one of the training methods for the neural network model provided in the embodiments of the present application.

[0155] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0156] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A training method for a neural network model, characterized in that: include: Acquire original image samples, where the original image samples include a plurality of original images; Obtaining gradient information corresponding to the original image in the original image sample; Inputting the original image in the original image sample and the gradient information corresponding to the original image into the initialization generation network to obtain an initialization image, wherein a plurality of the initialization images constitute an initialization sample; Inputting the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample; The target model to be trained is trained according to the composite adversarial sample to obtain an enhanced neural network model.

2. The method according to claim 1, characterized in that The composite adversarial attack module includes a plurality of attack components and a disturbance interval corresponding to each of the attack components, and the composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to the plurality of attack components; The step of inputting the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample includes: According to the attack order corresponding to the multiple attack components, the initialization images in the initialization samples are processed one by one using the attack components to obtain a composite adversarial sample; wherein the attack strength of the attack component is within the disturbance interval corresponding to each of the attack components.

3. The method according to claim 2, characterized in that The step of processing the initialization images in the initialization samples one by one using the attack components to obtain a composite adversarial sample includes: Obtaining a conversion function and an inverse conversion function between the original pixel space and the preset perceptual space, and using the conversion function to convert the initialization image in the initialization sample to the preset perceptual space to obtain a feature expression of the perceptual space, wherein the perceptual space includes a CIELAB color space or an HSV color space; Using the attack components one by one to process the feature expression of the perception space to obtain feature adversarial samples; The feature adversarial sample is converted back to the original pixel space using the inverse conversion function to obtain the composite adversarial sample.

4. The method according to claim 2, characterized in that: The step of processing the initialization images in the initialization samples one by one using the attack components includes: The initialization image in the initialization sample is input to the attack component corresponding to the attack sequence; the attack component introduces perturbations to the initialization image to obtain a first adversarial sample; the image in the first adversarial sample is optimized by using a projected gradient descent algorithm with the goal of maximizing the loss value or error rate of the target model to obtain a second adversarial sample; the image in the second adversarial sample is optimized by using an iterative gradient sign algorithm according to the perturbation interval corresponding to the attack component to obtain the intermediate output sample, and outputted to the next attack component corresponding to the attack sequence until the last attack component, and a composite adversarial sample is output.

5. The method according to any one of claims 1 to 4, characterized in that: The obtaining of gradient information corresponding to the original image in the original image sample includes: Inputting the original image in the original image sample into the target model to be trained to obtain the predicted output of the original image sample; According to the real annotation of the original image sample and the predicted output, the gradient of the loss function with respect to the original image is calculated to obtain the gradient information corresponding to the image.

6. The method according to any one of claims 1 to 4, characterized in that: The initialized generative network is a lightweight generative network, which includes an input layer, a residual layer and an output layer; wherein the input layer includes at least a convolution module, a normalization module and an activation module, the residual layer includes at least one residual block, and the output layer includes at least a convolution layer and a normalization layer.

7. The method according to any one of claims 2 to 4, characterized in that: The composite adversarial attack module uses a scheduling algorithm to determine the attack order corresponding to the plurality of attack components, including: Obtaining a fitness function and a plurality of random attack sequences, wherein the fitness function is used to evaluate the effectiveness of the attack sequence through attack success rate, time consumption and / or attack intensity; According to the fitness function, using a genetic algorithm to iteratively optimize the multiple random attack sequences, the iterative optimization comprising selection, crossover and / or mutation operations; Repeat the step of iteratively optimizing the multiple random attack sequences using a genetic algorithm until a repetition number threshold is reached or an attack sequence that can meet a preset fitness function value threshold is obtained, thereby obtaining the attack sequence corresponding to the multiple attack components.

8. A training device for a neural network model, characterized in that: include: An original sample acquisition module, used to acquire original image samples, wherein the original image samples include a plurality of original images; A gradient acquisition module, used to acquire gradient information corresponding to the original image in the original image sample; An initial sample acquisition module, used for inputting the original image in the original image sample and the gradient information corresponding to the original image into the initialization generation network to obtain an initialization image, wherein a plurality of the initialization images constitute an initialization sample; A composite adversarial module, used for inputting the initialization image in the initialization sample into a preset composite adversarial attack module to obtain a composite adversarial sample; The model training module is used to train the target model to be trained according to the composite adversarial sample to obtain an enhanced neural network model.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a computer program stored in the memory and executable by the processor, wherein when the computer program is executed by the processor, the training method of the neural network model as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, enables the processor to implement the training method for a neural network model as described in any one of claims 1 to 7.

Images