Model training methods for defending against adversarial attacks

Abstract

The present application proposes a model training method for defending against adversarial attacks, including: obtaining a set of regular sample images, and obtaining a set of adversarial sample images; in a first training stage, based on the regular sample image set, training a first diffusion classification model, iterating until the difference between the model prediction result and the actual classification result of the regular sample image is less than or equal to a predetermined difference threshold, and obtaining a second diffusion classification model; in a second training stage, based on the adversarial sample image set, training the second diffusion classification model, iterating until the error of each denoising step in the reverse diffusion process is less than or equal to a predetermined error threshold, and obtaining a third diffusion classification model. The technical solution of the present application effectively improves the ability of the image classification model to resist adversarial attacks.

Description

Technical Field

[0001] The present application relates to the field of adversarial training technology, and in particular to a model training method for defending against adversarial attacks. Background Art

[0002] Adversarial attacks are attacks that introduce subtle perturbations into input data to cause deep learning models to misclassify. In recent years, with the application of deep neural networks in image classification tasks, researchers have gradually realized the threat of adversarial attacks to models, especially in areas such as face recognition, healthcare, and remote perception. Common defense strategies include adversarial training and data purification. Adversarial training improves the robustness of the model by introducing adversarial samples into training data.

[0003] How to apply the diffusion model to the defense against adversarial attacks is a current research hotspot. In particular, when dealing with strong adaptive attacks, the diffusion model is more robust than the traditional discriminative model. However, the denoising process of the diffusion model requires a lot of computing resources. Especially when dealing with large-scale image data, the training process takes a long time and the computational overhead is high. When denoising adversarial perturbation data, the data distribution may shift, affecting the classification effect of the model. Accordingly, in the process of training the diffusion model, the denoising process will also cause huge computational overhead, affecting the efficiency of model training.

[0004] Therefore, how to efficiently and conveniently train the diffusion model to improve its defense capabilities against adversarial attacks has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The embodiment of the present application provides a model training method for defending against adversarial attacks, which aims to solve the technical problem of huge computational overhead in training diffusion models to defend against adversarial attacks in related technologies.

[0006] In a first aspect, an embodiment of the present application provides a model training method for defending against adversarial attacks, comprising:

[0007] Obtain a set of regular sample images and a set of adversarial sample images;

[0008] In a first training stage, based on the conventional sample image set, the first diffusion classification model is trained, and it is iterated until the difference between the model prediction result and the actual classification result of the conventional sample image is less than or equal to a predetermined difference threshold, thereby obtaining a second diffusion classification model;

[0009] In the second training stage, the second diffusion classification model is trained based on the adversarial sample image set, and it is iterated until the error of each denoising step in the reverse diffusion process is less than or equal to a predetermined error threshold, so as to obtain a third diffusion classification model.

[0010] In one embodiment of the present application, optionally, before the first training stage, the method further includes:

[0011] Size standardization, normalization and data enhancement are performed on each image in the conventional sample image set and the adversarial sample image set.

[0012] In one embodiment of the present application, optionally, obtaining a set of adversarial sample images includes:

[0013] Acquire a first original sample image;

[0014] The first original sample image is perturbed along the gradient direction of the first diffusion classification model by using the fast gradient sign method to obtain a first adversarial sample image, which is added to the adversarial sample image set, wherein:

[0015] ,

[0016] represents the intensity parameter of the disturbance, is the loss function of the first diffusion classification model, is the gradient operator of the first diffusion classification model.

[0017] In one embodiment of the present application, optionally, obtaining a set of adversarial sample images includes:

[0018] Acquire a second original sample image;

[0019] The second original sample image is perturbed iteratively for a specified number of times by using the projected gradient descent method to obtain a second adversarial sample image, which is added to the adversarial sample image set, wherein:

[0020] In each iteration except the last iteration, perturbation is added to the second original sample image along the gradient direction of the first diffusion classification model, and the perturbed image is projected back to the legal image space, and the projection result is set as the second original sample image of the next iteration.

[0021] In one embodiment of the present application, optionally, training the first diffusion classification model based on the conventional sample image set includes:

[0022] For any regular sample image in the regular sample image set, in a forward diffusion process, gradually adding first noise to the regular sample image according to a first specified number of steps until a first intermediate image is obtained;

[0023] In the back diffusion process, the first intermediate image is denoised step by step according to the first specified number of steps, wherein:

[0024] In each step of the first specified number of steps, predicting a second noise to be removed;

[0025] Determining a difference between a real first noise corresponding to the second noise and the second noise;

[0026] Based on the real first noise corresponding to the second noise and the difference, determining the expected value of the current step, and calculating the first intermediate parameter value after the expected value is negatively exponentially calculated;

[0027] Determining the posterior probability of the regular sample image in each classification result based on the first intermediate parameter value;

[0028] Determining the maximum posterior probability of the regular sample image among the posterior probabilities of each classification result of the regular sample image;

[0029] The first diffusion classification model is iteratively trained until a difference between a model prediction result corresponding to a maximum a posteriori probability of the regular sample image and a true classification result of the regular sample image is less than or equal to a predetermined difference threshold.

[0030] In one embodiment of the present application, optionally, the calculation formula of the posterior probability is:

[0031] ,

[0032] in, Represents the conventional sample image In the model parameters The case belongs to the i-th classification result The posterior probability of is the second noise to be removed in the t-th step prediction in the first specified number of steps, represents the real first noise corresponding to the t-th step in the forward diffusion process, used to reflect the difference between the real first noise corresponding to the second noise and the second noise, represents the expected value of the tth step, The first intermediate parameter value is the expected value with a negative exponent.

[0033] In one embodiment of the present application, optionally, training the second diffusion classification model based on the adversarial sample image set includes:

[0034] For any adversarial sample image in the adversarial sample image set, in a forward diffusion process, gradually adding a third noise to the adversarial sample image according to a second specified number of steps until a second intermediate image is obtained;

[0035] In the back diffusion process, the second intermediate image is denoised step by step according to the second specified number of steps, wherein:

[0036] In each of the second specified number of steps, predicting fourth noise to be removed;

[0037] Determine an average difference between a real third noise corresponding to the fourth noise and the fourth noise on a plurality of noise samples;

[0038] Based on the real third noise corresponding to the fourth noise and the average difference, determining the expected value of the current step, and calculating the second intermediate parameter value after the expected value is negatively exponentially calculated;

[0039] Determining, based on the second intermediate parameter value, a posterior probability of the adversarial sample image in each classification result;

[0040] Determining a maximum posterior probability of the adversarial sample image among the posterior probabilities of each classification result of the adversarial sample image;

[0041] The second diffusion classification model is iteratively trained until the truth maximization loss function is minimized, wherein the truth maximization loss function is:

[0042] ,

[0043] Among them, the represents the error between the fourth noise predicted in each step of the second specified number of steps and the third noise corresponding to the fourth noise, Specify the number of steps for the second is the fourth noise corresponding to the t-th step in the second specified number of steps, Represents the third noise corresponding to the tth step in the second specified number of steps.

[0044] In one embodiment of the present application, optionally, in the process of training the first diffusion classification model and the process of training the second diffusion classification model, the process further includes:

[0045] The weight matrix of the current training model is decomposed into a first low-rank matrix and a second low-rank matrix, where:

[0046] ,

[0047] in, represents the weight matrix of the current training model, An original weight matrix of a pre-trained model representing the current training model, wherein A and B are the first low-rank matrix and the second low-rank matrix respectively;

[0048] During the process of training the current training model, the original weight matrix is ​​frozen, and the first low-rank matrix and the second low-rank matrix are updated.

[0049] In a second aspect, an embodiment of the present application provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method described in the first aspect above.

[0050] In a third aspect, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the method described in the first aspect above.

[0051] The above technical solution aims at the technical problem that the training diffusion model to resist adversarial attacks in the related technology faces huge computational overhead. The diffusion model is combined with Bayes' theorem to construct a diffusion classifier for adversarial defense in image classification tasks. At the same time, the forward diffusion and reverse denoising process of the diffusion model is used to train the model parameters by minimizing the lower bound of evidence, laying the foundation for subsequent classification. At the same time, a truth maximization strategy is proposed as the key to improving the adversarial robustness of the model. On this basis, when facing adversarial attacks, the application enables the model to adjust the reverse denoising inference value according to the real label to enhance the accuracy of perturbed image classification. In the first training stage, a clean data set is first used to calculate the class conditional estimate based on the diffusion classifier, and the probability that the image belongs to each category is obtained by means of Bayes' theorem. The model parameters are adjusted by the loss function and AdamW optimizer to initially build the classification capability. In the second training stage, a perturbed data set is introduced, and the truth maximization strategy is used to calculate the loss of predicted noise and real noise, and the model parameters are optimized again. The final model can more accurately classify images when facing adversarial attacks, effectively improving the performance of the image classification model in an adversarial environment and the ability to resist adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A flow chart of a model training method for defending against adversarial attacks according to an embodiment of the present application is shown;

[0054] Figure 2 A block diagram of a computer device according to an embodiment of the present application is shown;

[0055] Figure 3 A block diagram of a computer device according to another embodiment of the present application is shown. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Figure 1 A flowchart of a model training method for defending against adversarial attacks according to an embodiment of the present application is shown.

[0058] like Figure 1 As shown, a model training method for defending against adversarial attacks according to an embodiment of the present application includes:

[0059] Step 102, obtaining a set of regular sample images and a set of adversarial sample images.

[0060] Among them, the regular sample image set includes normal samples without perturbations, while the adversarial sample image set includes adversarial samples with perturbations.

[0061] Among them, the adversarial sample image set can be obtained by adding perturbations to the original sample images, including adversarial samples generated by specific adversarial attack algorithms. These adversarial samples are obtained by carefully designed small perturbations on the original sample images, and their purpose is to cause the model to misclassify. Specific adversarial attack algorithms include the fast gradient sign method and the projected gradient descent method.

[0062] In a possible design, first, a first original sample image is obtained, and then a disturbance is added to the first original sample image along the gradient direction of the first diffusion classification model by using the fast gradient sign method to obtain a first adversarial sample image, which is added to the adversarial sample image set, wherein:

[0063] ,

[0064] represents the intensity parameter of the disturbance, is the loss function of the first diffusion classification model, is the gradient operator of the first diffusion classification model.

[0065] Specifically, the fast gradient sign method adds a small perturbation along the direction of the model gradient to maximize the model's loss function, which leads to model misjudgment. The adversarial samples obtained by the fast gradient sign method may be almost indistinguishable from the original sample images to the human eye, but they can deceive the model.

[0066] In another possible design, first, a second original sample image is obtained, and then the second original sample image is perturbed for a specified number of times through a projected gradient descent method to obtain a second adversarial sample image, which is added to the adversarial sample image set, wherein, in each iteration except the last iteration, a perturbation is added to the second original sample image along the gradient direction of the first diffusion classification model, and the perturbed image is projected back to the legal image space, and the projection result is set as the second original sample image of the next iteration.

[0067] The projected gradient descent method is based on the fast gradient sign method and performs multiple iterations to further optimize the adversarial sample to make it more effective in attacking the model. Assume that the number of iterations is n and the step size is , then the process of generating adversarial samples by projected gradient descent is: starting from the original image x, in each iteration i, calculate , and Projecting back to the legal image space, the final adversarial sample is obtained after n iterations.

[0068] In addition, after obtaining the conventional sample image set and the adversarial sample image set, these images can also be preprocessed to make them more suitable for model requirements. Specifically, each image in the conventional sample image set and the adversarial sample image set can be subjected to size standardization, normalization, and data enhancement.

[0069] Step 104, in the first training phase, based on the conventional sample image set, the first diffusion classification model is trained, and iteratively trained until the difference between the model prediction result and the actual classification result of the conventional sample image is less than or equal to a predetermined difference threshold, thereby obtaining a second diffusion classification model.

[0070] Step 106, in the second training phase, based on the adversarial sample image set, the second diffusion classification model is trained, and iteratively until the denoising error of each step in the reverse diffusion process is less than or equal to a predetermined error threshold, so as to obtain a third diffusion classification model.

[0071] Any diffusion classification model described in the context of this application is a diffusion classification model obtained by introducing a Bayesian classifier on the basis of the diffusion model. In the first training stage, the first diffusion classification model is first trained into a second diffusion classification model with a preliminary image classification function through conventional sample images, and then the second training stage is entered to train and improve the second diffusion classification model's ability to understand adversarial samples.

[0072] Specifically, the diffusion model itself is a type of discrete-time generative model based on Markov chains, which includes forward denoising and backward denoising. , the model performs T rounds of noise addition, and each round of noise addition Following the Gaussian distribution, we finally get During the denoising process, the model learns the noise added in each round to restore the image back to , and can use the low-dimensional text embedding y as a guide, the denoising process is expressed as The whole process can be expressed as:

[0073] ,

[0074] Due to direct maximization There are difficulties, and the goal is transformed into minimizing the evidence lower bound (ELBO) of the log-likelihood value, that is:

[0075] ,

[0076] in, is the diffusion loss, Obeys the standard normal distribution N(0,1). Optionally, let , by parameterizing the Gaussian noise added at each step, the neural network can predict the noise in the reverse denoising process.

[0077] On this basis, the diffusion model needs to use Bayes' theorem when used as a generative model for classification. The formula for calculating the posterior probability is:

[0078] ,

[0079] Since the posterior probability of each class label is calculated during classification, , C is the total number of classification categories, then the above formula can be simplified to:

[0080] ,

[0081] At this time, you can Replace with , reducing the difficulty of calculation, that is, using the diffusion model to add noise in the forward diffusion process and learn the noise in the reverse denoising process to calculate .

[0082] Specifically, step 104 includes: for any regular sample image in the regular sample image set, in the forward diffusion process, gradually adding the first noise to the regular sample image according to the first specified number of steps until a first intermediate image is obtained; in the backward diffusion process, gradually denoising the first intermediate image according to the first specified number of steps, wherein in each step of the first specified number of steps, predicting the second noise to be removed; determining the difference between the real first noise corresponding to the second noise and the second noise; determining the expected value of the current step based on the real first noise corresponding to the second noise and the difference, and calculating the first intermediate parameter value after the expected value is negatively exponentialized; determining the posterior probability of the regular sample image in each classification result based on the first intermediate parameter value; determining the maximum posterior probability of the regular sample image in the posterior probability of each classification result of the regular sample image; iteratively training the first diffusion classification model until the difference between the model prediction result corresponding to the maximum posterior probability of the regular sample image and the real classification result of the regular sample image is less than or equal to a predetermined difference threshold.

[0083] The calculation formula of the posterior probability is:

[0084] ,

[0085] Represents the model parameters of the conventional sample image X The case belongs to the i-th classification result The posterior probability of is the second noise to be removed in the t-th step prediction in the first specified number of steps, represents the real first noise corresponding to the t-th step in the forward diffusion process, used to reflect the difference between the real first noise corresponding to the second noise and the second noise, represents the expected value of the tth step, The first intermediate parameter value is the expected value with a negative exponent.

[0086] In this calculation process, the diffusion model is used to predict the noise added at each step. , and then calculate it and the real noise The difference between ). For this difference at different time steps t and noise The expected calculation is performed on the sampling, that is, , and then taking the negative exponent to get , this result is close to .

[0087] Therefore, combining the above diffusion model principle part ELBO (evidence lower bound) to derive the posterior probability formula of each class:

[0088] ,

[0089] On this basis, the diffusion model is used to calculate each (default )of , and obtain the unbiased Monte Carlo estimation value, thereby constructing a diffusion classification model, that is, a generative classification model. Next, the adversarial sample image is input into the diffusion classification model for forward denoising and reverse denoising, and the guiding text prompt is input at the same time. The diffusion classification model calculates the posterior probability of each class label according to the Bayesian theorem. The maximum posterior probability corresponds to the inference result of the classifier. The inference goal can be converted into selecting the class that minimizes the average error between the noise and the true value inferred by the diffusion model at each sampling point.

[0090] In the calculation process, different class labels are involved, but different class labels are not simply used as text prompts to calculate the loss of predicted noise and real noise. , the diffusion model predicts the noise added at each step in the reverse denoising process , here It plays the role of guiding the model to make noise predictions under different category assumptions.

[0091] Then, the noise is predicted by calculating With real noise The difference between ), and sample at different time steps t and noise Expected calculation is performed on ), and finally obtain the relevant value for calculating the posterior probability. In this process, the class label is a conditional factor involved in the entire framework of noise prediction and posterior probability calculation, rather than directly used as a text prompt to calculate the loss. The loss is calculated mainly during the model training process in order to optimize the model parameters so that the model can more accurately predict noise, thereby better calculating the posterior probability and improving the accuracy and robustness of classification.

[0092] On this basis, step 106 specifically includes: for any adversarial sample image in the adversarial sample image set, in the forward diffusion process, gradually adding the third noise to the adversarial sample image according to the second specified number of steps until a second intermediate image is obtained; in the backward diffusion process, gradually denoising the second intermediate image according to the second specified number of steps, wherein in each step of the second specified number of steps, predicting the fourth noise to be removed; determining the average difference between the real third noise corresponding to the fourth noise and the fourth noise on multiple noise samples; determining the expected value of the current step based on the real third noise corresponding to the fourth noise and the average difference, and calculating the second intermediate parameter value after the expected value is negatively exponentially calculated; determining the posterior probability of the adversarial sample image in each classification result based on the second intermediate parameter value; determining the maximum posterior probability of the adversarial sample image in the posterior probability of each classification result of the adversarial sample image; iteratively training the second diffusion classification model until the truth maximization loss function is minimized, wherein the truth maximization loss function is: , wherein the represents the error between the fourth noise predicted in each step of the second specified number of steps and the third noise corresponding to the fourth noise, T is the second specified number of steps, is the fourth noise corresponding to the t-th step in the second specified number of steps, Represents the third noise corresponding to the tth step in the second specified number of steps.

[0093] In this process, in order to improve the accuracy and robustness of the diffusion classifier, a truth maximization strategy is proposed, inspired by traditional adversarial training. The model is trained by inputting adversarial samples with true labels and minimizing the diffusion loss, so that the model can shift the reverse denoising inference value towards the true value under the guidance of the true label. It is related to the noise added during the forward diffusion process and the learning of the noise during the reverse denoising process. pass ( Obeying the standard normal distribution) gradually adding noise to obtain In the reverse denoising process, the model predicts the noise at each step . At this point, the training loss is defined as: .

[0094] Since using the pre-trained StableDiffusion2.0 (about 354 million parameters) for full parameter training will bring high memory and time overhead, the Lora fine-tuning technology can also be used to approximate the high-dimensional parameter matrix with a low-dimensional matrix to reduce the training memory requirements. The trained Lora module is merged with the pre-trained parameters to maintain the original modeling capability of the model. During the training process, the enhanced samples x and their correct labels y in the training set are input into StableDiffusion, and noise is injected using the pre-trained scheduler. The model predicts the noise at each step and calculates the loss. Minimizing the loss obtains the truth maximization diffusion classifier (TMDC).

[0095] The specific method of introducing the Lora fine-tuning technology includes: decomposing the weight matrix of the current training model into a first low-rank matrix and a second low-rank matrix, where: , W represents the weight matrix of the current training model, The original weight matrix of the pre-trained model of the current training model is represented, A and B are the first low-rank matrix and the second low-rank matrix respectively. So far, in the process of training the current training model, the original weight matrix is ​​frozen, and the first low-rank matrix and the second low-rank matrix are updated. Wherein, ,in . is the original weight matrix in the pre-trained model, which remains frozen and does not participate in fine-tuning. A and B are the weight matrices added by low-rank decomposition, which are initialized to smaller random matrices and updated during fine-tuning.

[0096] The above technical scheme combines the diffusion model with Bayesian theorem to construct a diffusion classifier for adversarial defense in image classification tasks. At the same time, the forward diffusion and reverse denoising process of the diffusion model is used to train the model parameters by minimizing the lower bound of evidence, laying the foundation for subsequent classification. At the same time, a truth maximization strategy is proposed as the key to improving the adversarial robustness of the model. On this basis, when facing adversarial attacks, this application enables the model to adjust the reverse denoising inference value according to the true label to enhance the accuracy of perturbed image classification. In the first training stage, a clean data set is first used to calculate the class conditional estimate based on the diffusion classifier, and the probability that the image belongs to each category is obtained by means of Bayesian theorem. The model parameters are adjusted through the loss function and AdamW optimizer to initially build the classification capability. In the second training stage, a perturbed data set is introduced, and the truth maximization strategy is used to calculate the loss of predicted noise and real noise, and the model parameters are optimized again. The final model can classify images more accurately when facing adversarial attacks, effectively improving the performance of the image classification model in adversarial environments.

[0097] The model training process of the present application is described in detail below through another embodiment.

[0098] In the first training phase, the model mainly learns the basic feature representation of the image to build a model that can perform preliminary classification. This phase usually uses a clean dataset, that is, the original image data that has not been processed by adversarial perturbations. The model is based on the principle of the diffusion model and learns the features of the image through forward diffusion and reverse denoising processes.

[0099] In this process, the diffusion classifier calculation method is used in combination with Bayesian theorem to calculate the class conditional estimation of the image, thereby obtaining the model's preliminary judgment ability on the image category. According to the formula of the diffusion model

[0100] ,

[0101] By minimizing the evidence lower bound (ELBO), the model parameters are optimized so that the model can learn the intrinsic feature representation of the image. At the same time, when calculating the class conditional estimate, , substitute into the optimized loss function, at this time, the goal is to minimize the difference between the predicted results and the true labels, thereby continuously adjusting the model parameters to improve the accuracy of classification.

[0102] In the second training phase, which uses the truth maximization optimization strategy, the model parameters are adjusted by minimizing a specific loss function to enhance the adversarial robustness of the model. This phase uses a set of adversarial sample images, which are obtained by adding adversarial perturbations to the original sample images, and the original sample images have true labels.

[0103] In the forward diffusion process of the second training stage, for the input adversarial sample image, according to the forward diffusion mechanism, Gaussian noise is added at each time step t (from 0 to T-1, T is the total number of diffusion time steps), where , is the noise sampled from the standard normal distribution N(0,1), is a parameter related to time step t, which is calculated or obtained according to the model settings during the training process. Through this process, the adversarial sample image is gradually converted into a noise image , and save these noisy images at each time step for subsequent reverse denoising and loss calculation.

[0104] In the reverse denoising process, the diffusion classifier is based on the noisy image and the corresponding true label y predicts the noise added at each step , calculate the prediction noise The actual noise added The difference between To measure. Among them, the noise The noise added during forward diffusion is known when computing the loss. This difference is sampled at different time steps t and the noise Expected calculation is performed on In actual calculations, this step may approximate the expectation by multiple sampling and averaging. Specifically, it can be calculated on multiple noise samples. , and then take the average as the expected estimate.

[0105] The loss is calculated based on the loss function of the truth maximization strategy. This loss function measures the average difference between the model's predicted noise and the actual noise. By minimizing this loss function, the model can learn how to more accurately adjust the reverse denoising inference value in the presence of adversarial samples to make it closer to the true value, thereby improving the model's robustness to adversarial attacks. Minimize a specific loss function. The loss function of the model is diffusion loss, which is used to optimize the model's robustness in the face of adversarial perturbations. The goal of this loss function is to minimize the model's error in each step of the denoising process. The specific formula is as follows:

[0106] ,

[0107] Through this loss function, the model adjusts its own parameters during training to better predict the noise during the recovery from noise at each time step, ultimately enhancing the robustness under adversarial attacks.

[0108] As shown in Table 1 below, a training data set is used on CIFAR10, and then a robustness test is performed on the test data with adversarial perturbations. The third diffusion classification model trained in this application has superior adversarial robustness compared to ResNet50, VitB / 16, and WideResNet50.

[0109] Table 1

[0110]

[0111] As shown in Table 2 below, after adversarial training, the accuracy of ResNet50 under PGD attack increased from the original 0.0% to 45.39%, while VitB / 16 increased to 39.72%, and WideResNet50 increased to 45.77%. This shows that adversarial training can effectively enhance the adversarial robustness of widely used discriminant classifiers. At the same time, the third diffusion classification model trained in this application achieved an accuracy of 70.02% under the same conditions, which is significantly better than the commonly used adversarial training method and has advantages in enhancing model robustness. This shows that the diffusion classifier given in this application can effectively improve robustness through adversarial training.

[0112] Table 2

[0113]

[0114] In addition, in one embodiment, the present application provides a computer device, which may be a server, and its internal structure diagram may be as follows: Figure 2 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external client via a network connection. When the computer program is executed by the processor, the method described in any of the above embodiments can be implemented.

[0115] In one embodiment, the present application further provides a computer device, which may be a client, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external server via a network connection. When the computer program is executed by the processor, the method described in any of the above embodiments can be implemented.

[0116] Any of the above-mentioned computer devices in the embodiments of the present application may exist in various forms, including but not limited to:

[0117] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0118] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0119] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys, wearable devices, and portable car navigation devices.

[0120] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0121] (5) Other electronic devices with data interaction functions.

[0122] In addition, an embodiment of the present application provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to perform the following steps:

[0123] Obtain a set of regular sample images and a set of adversarial sample images;

[0124] In a first training stage, based on the conventional sample image set, the first diffusion classification model is trained, and it is iterated until the difference between the model prediction result and the actual classification result of the conventional sample image is less than or equal to a predetermined difference threshold, thereby obtaining a second diffusion classification model;

[0125] In the second training stage, the second diffusion classification model is trained based on the adversarial sample image set, and it is iterated until the error of each denoising step in the reverse diffusion process is less than or equal to a predetermined error threshold, so as to obtain a third diffusion classification model.

[0126] It should be noted that the above functions or steps that can be implemented by the computer-readable storage medium or computer device can refer to the relevant description in the aforementioned method embodiment. In order to avoid repetition, they will not be described one by one here.

[0127] The technical solution of the present application is described in detail above in conjunction with the accompanying drawings. Through the technical solution of the present application, the diffusion model is combined with the Bayesian theorem to construct a diffusion classifier for adversarial defense in image classification tasks. At the same time, the forward diffusion and reverse denoising process of the diffusion model is used to train the model parameters by minimizing the lower bound of evidence, laying the foundation for subsequent classification. At the same time, a truth maximization strategy is also proposed as the key to improving the adversarial robustness of the model. On this basis, when facing adversarial attacks, the present application enables the model to adjust the reverse denoising inference value according to the true label to enhance the accuracy of perturbed image classification. In the first training stage, a clean data set is first used to calculate the class conditional estimate based on the diffusion classifier, and the probability that the image belongs to each category is obtained by means of the Bayesian theorem. The model parameters are adjusted through the loss function and the AdamW optimizer to initially build the classification capability. In the second training stage, a perturbed data set is introduced, and the truth maximization strategy is used to calculate the loss of predicted noise and real noise, and the model parameters are optimized again. The final model can more accurately classify images when facing adversarial attacks, effectively improving the performance of the image classification model in an adversarial environment and the ability to resist adversarial attacks.

[0128] It should be understood that although the terms first, second, etc. may be used to describe the training phases in the embodiments of the present application, these training phases should not be limited to these terms. These terms are only used to distinguish the training phases from each other. For example, without departing from the scope of the embodiments of the present application, the first training phase may also be referred to as the second training phase, and similarly, the second training phase may also be referred to as the first training phase.

[0129] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0130] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the present application. The singular forms "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0131] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0132] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0133] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0134] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A model training method for defending against adversarial attacks, characterized in that: include: Obtain a set of regular sample images and a set of adversarial sample images; In a first training stage, based on the conventional sample image set, the first diffusion classification model is trained, and it is iterated until the difference between the model prediction result and the actual classification result of the conventional sample image is less than or equal to a predetermined difference threshold, thereby obtaining a second diffusion classification model; In a second training stage, the second diffusion classification model is trained based on the adversarial sample image set, and it is iterated until the error of denoising at each step in the reverse diffusion process is less than or equal to a predetermined error threshold, so as to obtain a third diffusion classification model; The step of training a first diffusion classification model based on the conventional sample image set includes: For any regular sample image in the regular sample image set, in a forward diffusion process, gradually adding first noise to the regular sample image according to a first specified number of steps until a first intermediate image is obtained; In the back diffusion process, the first intermediate image is denoised step by step according to the first specified number of steps, wherein: In each step of the first specified number of steps, predicting a second noise to be removed; Determining a difference between a real first noise corresponding to the second noise and the second noise; Based on the real first noise corresponding to the second noise and the difference, determining the expected value of the current step, and calculating the first intermediate parameter value after the expected value is negatively exponentially calculated; Determining the posterior probability of the regular sample image in each classification result based on the first intermediate parameter value; Determining the maximum posterior probability of the regular sample image among the posterior probabilities of each classification result of the regular sample image; Iteratively training the first diffusion classification model until the difference between the model prediction result corresponding to the maximum a posteriori probability of the regular sample image and the actual classification result of the regular sample image is less than or equal to a predetermined difference threshold; The step of training the second diffusion classification model based on the adversarial sample image set includes: For any adversarial sample image in the adversarial sample image set, in a forward diffusion process, gradually adding a third noise to the adversarial sample image according to a second specified number of steps until a second intermediate image is obtained; In the back diffusion process, the second intermediate image is denoised step by step according to the second specified number of steps, wherein: In each of the second specified number of steps, predicting fourth noise to be removed; Determine an average difference between a real third noise corresponding to the fourth noise and the fourth noise on a plurality of noise samples; Determine an expected value of the current step based on the real third noise corresponding to the fourth noise and the average difference, and calculate a second intermediate parameter value after the expected value is negatively exponentially calculated; Determining, based on the second intermediate parameter value, a posterior probability of the adversarial sample image in each classification result; Determining a maximum posterior probability of the adversarial sample image among the posterior probabilities of each classification result of the adversarial sample image; The second diffusion classification model is iteratively trained until the truth maximization loss function is minimized, wherein the truth maximization loss function is: ， Among them, the represents the error between the fourth noise predicted in each step of the second specified number of steps and the third noise corresponding to the fourth noise, Specify the number of steps for the second is the fourth noise corresponding to the t-th step in the second specified number of steps, Represents the third noise corresponding to the tth step in the second specified number of steps.

2. The method according to claim 1, characterized in that: Before the first training stage, the method further includes: Size standardization, normalization and data enhancement are performed on each image in the conventional sample image set and the adversarial sample image set.

3. The method according to claim 1, characterized in that The obtaining of the adversarial sample image set comprises: Acquire a first original sample image; The first original sample image is perturbed along the gradient direction of the first diffusion classification model by using the fast gradient sign method to obtain a first adversarial sample image, which is added to the adversarial sample image set, wherein: ， represents the intensity parameter of the disturbance, is the loss function of the first diffusion classification model, is the gradient operator of the first diffusion classification model.

4. The method according to claim 1, characterized in that The obtaining of the adversarial sample image set comprises: Acquire a second original sample image; The second original sample image is perturbed iteratively for a specified number of times by using the projected gradient descent method to obtain a second adversarial sample image, which is added to the adversarial sample image set, wherein: In each iteration except the last iteration, perturbation is added to the second original sample image along the gradient direction of the first diffusion classification model, and the perturbed image is projected back to the legal image space, and the projection result is set as the second original sample image of the next iteration.

5. The method according to claim 1, characterized in that The calculation formula of the posterior probability is: ， in, Represents the conventional sample image In the model parameters In the case of Classification results The posterior probability of The first specified number of steps The second step is to predict the noise to be removed. Indicates the The actual first noise corresponding to the forward diffusion process, used to reflect the difference between the real first noise corresponding to the second noise and the second noise, Indicates The expected value of the step, The first intermediate parameter value is the expected value with a negative exponent.

6. The method according to claim 1, characterized in that The process of training the first diffusion classification model and the process of training the second diffusion classification model further includes: The weight matrix of the current training model is decomposed into a first low-rank matrix and a second low-rank matrix, where: ， in, represents the weight matrix of the current training model, represents the original weight matrix of the pre-trained model of the current training model, are the first low-rank matrix and the second low-rank matrix respectively; During the process of training the current training model, the original weight matrix is ​​frozen, and the first low-rank matrix and the second low-rank matrix are updated.

7. A computer device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are configured to enable the processor to execute the method according to any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are configured to execute the method according to any one of claims 1 to 6.

Images