Construction method of confrontation sample defense model based on image preprocessing

Abstract

The invention relates to the field of attack and defense confrontation of computer vision, in particular to a method for constructing a confrontation sample defense model based on image preprocessing, and the confrontation sample defense model comprises an auto-encoder for reconstructing a sample and an image classification model for classifying the reconstructed sample; the self-encoder adopts the clean samples to carry out autoregression training, and learns prior distribution of the clean samples; training of an image classification model: firstly, optimizing adversarial samples through an auto-encoder, then training the adversarial samples obtained through optimization, and enabling the adversarial samples to keep distribution closer to that of clean samples in manifold by incorporating distribution information of the clean samples into a training process; the problem caused by neglecting data distribution in the prior art is solved; in the confrontation and defense process, firstly, a sample is reconstructed through an auto-encoder, so that the attack intensity can be greatly weakened, and the robustness can be greatly improved. The method is suitable for various image classification fields, especially high-precision fields such as aerospace and the like.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attack and defense in computer vision, and in particular to a method for constructing an adversarial sample defense model based on image preprocessing. Background Art

[0002] At present, deep neural networks have achieved great success in the field of computer vision and have also shown great application potential in fields such as aerospace, such as satellite image processing, target detection, and autonomous navigation of drones. However, adversarial attacks against deep neural networks pose a major security threat, especially in key missions such as autonomous driving and facial recognition, as well as aerospace. These attacks exploit the weaknesses of deep neural networks and introduce perturbations that are imperceptible to humans, but can greatly change the model's predictions. For example, in satellite image processing systems, such attacks may lead to misjudgment of key terrain or meteorological data, thus affecting the safety and accuracy of aerospace missions.

[0003] Adversarial Training (AT) has emerged as one of the most effective defenses against such attacks. AT incorporates adversarial examples into training data to enhance the robustness of the model. In aerospace missions, such as autonomous navigation systems for drones, AT helps defend against enemy interference or malicious attacks in natural environments. AT was first introduced via the Fast Gradient Sign Method and later enhanced by Projected Gradient Descent Adversarial Training, which uses iteratively generated adversarial examples based on projected gradient descent. Tradeoff-inspired Adversarial Defense via Surrogate-loss Minimization further improves AT by balancing robustness and clean accuracy.

[0004] However, AT is usually used in a discriminative learning manner, focusing on learning the mapping from samples to labels. The main purpose of this approach is to strengthen the mapping from input samples to corresponding labels without considering the underlying distribution of samples. Therefore, AT usually requires high-capacity models, which may face computing resource constraints on edge computing devices in the aerospace field, such as satellite sensors or drone embedded systems.

[0005] To address the limitations of AT, Adversarial Distillation (AD) was proposed. AD extends knowledge distillation (KD) to enhance the robustness of smaller models by transferring knowledge from a larger and more robust teacher model.

[0006] Adversarially Robust Distillation is a technique that combines adversarial training AD with KD, aiming to enhance the performance of the model under adversarial attacks by improving its adversarial robustness. The core idea of ​​Adversarial Robust Distillation is to not only transfer the knowledge of the model but also enhance its adversarial robustness through the distillation process. Robust Soft Label Adversarial Distillation is an improved adversarial robust distillation method. It further enhances the effect of adversarial robust distillation by combining the robust soft labels of the teacher model to generate adversarial examples. Adaptive Adversarial Distillation introduces an adaptive mechanism based on traditional adversarial distillation, making the knowledge transfer in the distillation process more flexible and efficient.

[0007] However, existing AD methods are limited to aligning the predicted outputs of the teacher and student models, while ignoring the underlying data distribution. If there is a significant capability gap between the teacher and student models, or the performance of the teacher model is not optimal, the effectiveness of adversarial distillation may be compromised.

[0008] In summary, both AT and AD improve the adversarial robustness of the model by strengthening the mapping from samples to labels. However, these methods often ignore the impact of the underlying data distribution. Specifically, AT and AD mainly focus on optimizing the performance of the model on adversarial examples, that is, improving robustness by strengthening the model's classification ability for perturbed samples. However, this approach ignores the overall distribution characteristics of the data, and a typical feature of adversarial examples is that they often deviate from the data distribution of normal samples. This deviation of adversarial examples may cause a series of problems such as the trade-off between adversarial robustness and standard accuracy. And this deviation may be particularly serious in high-precision fields such as aerospace, because the existence of adversarial examples may lead to misjudgment of core modules such as navigation and detection systems, thereby affecting the success and safety of the entire mission. Summary of the invention

[0009] The technical problem to be solved by the present invention is to propose a method for constructing an adversarial sample defense model based on image preprocessing, which can integrate the distribution information of clean samples into the training process of AT and AD methods, thereby overcoming the problems existing in the prior art.

[0010] The technical solution adopted by the present invention to solve the above technical problems is:

[0011] A method for constructing an adversarial sample defense model based on image preprocessing, the adversarial sample defense model comprising an autoencoder and an image classification model, the autoencoder being used to reconstruct input samples, and the image classification model being used to classify reconstructed samples obtained by the autoencoder;

[0012] The training of the autoencoder included in the adversarial sample defense model includes the following steps:

[0013] A1. Extract clean samples from the original data set and construct a training set for the autoencoder.

[0014] A2. Extract clean samples x from the training set of the autoencoder, input them into the autoencoder M, and generate reconstructed samples M(x);

[0015] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2;

[0016] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0017] A5, determine whether the preset conditions are met, if so, complete the training of the autoencoder M, otherwise, return to step A2;

[0018] The training of the image classification model included in the adversarial sample defense model includes the following steps:

[0019] B1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0020] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0021] B3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first iteration, the initial adversarial sample obtained in step B2

[0022] B4. Reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; use the classification result to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample

[0023] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after updating in step B4 Return to step B3 as input;

[0024] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0025] B7, using the reconstructed sample M(x) obtained in step B6 * ), conduct adversarial training on image classification models;

[0026] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0027] Furthermore, the reconstruction loss of the autoencoder M is calculated according to the following formula:

[0028]

[0029] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the binary norm.

[0030] Furthermore, in step B4, the perturbation of the adversarial sample is updated using the classification result according to the following formula to obtain the updated adversarial sample:

[0031]

[0032] in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size.

[0033] Furthermore, the autoencoder adopts a simplified U-Net model, and the simplified U-Net model includes a downsampling block and an upsampling block.

[0034] Furthermore, the image classification model is trained using conventional adversarial training;

[0035] In step B4, the hard label of the clean sample x extracted in step B2 is used as the reference classification probability, and the cross entropy loss is constructed using the classification result to characterize the difference between the classification result and the reference classification probability;

[0036] Step B7 includes the following steps:

[0037] B71, using the reconstructed sample M(x) obtained in step B6 * ), input the image classification model and obtain the classification result;

[0038] B72. Construct a cross entropy loss based on the hard label of the clean sample x extracted in step B2 and the classification result obtained in step B71;

[0039] B73. Update the parameters of the image classification model with the goal of minimizing the cross entropy loss.

[0040] Furthermore, an image classification model is introduced as a teacher model, and the image classification model included in the adversarial sample defense model is used as a student model. The image classification model included in the adversarial sample defense model as a student model is trained using the teacher model by using the adversarial distillation method.

[0041] In step B4, the classification result of the teacher model T is As the reference classification probability; using the classification results of the student model S And the classification results of the teacher model T Construct a divergence loss to characterize the difference between the classification result and the reference classification probability;

[0042] Step B7 includes the following steps:

[0043] B71, using the reconstructed sample M(x) obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification result of the student model S And the classification results of the teacher model T

[0044] B72. Classification result of the student model S obtained in step B71 And the classification results of the teacher model T Construct divergence loss;

[0045] B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss.

[0046] Furthermore, the training of the image classification model as a teacher model includes the following steps:

[0047] C1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0048] C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0049] C3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first round of iteration, the initial adversarial sample obtained in step C2

[0050] C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample

[0051] C5: Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step C4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input;

[0052] C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0053] C7, using the reconstructed sample M(x) obtained in step C6 * ), conduct adversarial training on the teacher model, including:

[0054] C71, using the reconstructed sample M(x) obtained in step C6 * ), input the teacher model and obtain the classification result;

[0055] C72, constructing a cross entropy loss based on the hard label of the clean sample x extracted in step C2 of this step and the classification result obtained in step C71;

[0056] C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss;

[0057] C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

[0058] Furthermore, in step B4, the divergence loss is calculated according to the following formula:

[0059]

[0060] In step B72, the divergence loss is calculated according to the following formula:

[0061] L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x) * )),T(M(x * )))

[0062] Among them, L represents the loss, KL represents the divergence loss function, α is the weight hyperparameter, x represents the clean sample, and x * represents the adversarial sample constructed based on the clean sample x, represents the adversarial sample after t rounds of optimization.

[0063] Furthermore, the teacher model is a residual network WideResNet.

[0064] Furthermore, the image classification model of the adversarial sample defense model is a lightweight convolutional neural network MobileNetV2 or a deep residual network ResNet-18.

[0065] The beneficial effects of the present invention are:

[0066] The method of the present invention performs autoregressive training on the autoencoder on the clean samples to learn the prior distribution of the clean samples; then, the distribution information of the clean samples is incorporated into the training process through the reconstruction of the samples by the autoencoder. Specifically, in the training process of the image classification model, through repeated iterative training of the adversarial samples, the autoencoder can project the adversarial samples back to the learned clean sample manifold, so that the adversarial samples maintain a distribution closer to the clean samples on the manifold. Finally, the adversarial samples optimized by the autoencoder are used to optimize the parameters of the image classification model, and the optimal model parameter configuration is obtained, which ensures the classification accuracy of the model while enhancing its adversarial robustness, and finally obtains a robust deep neural network model combined with popular projection. Secondly, the autoencoder can adaptively pull the adversarial samples closer to the manifold of normal samples, weaken their attack strength, and simplify the mapping learning from adversarial samples to correct labels.

[0067] In the adversarial defense process after training, the input samples are first reconstructed through the autoencoder, while the attacker is unaware of the existence of the autoencoder. In this way, the attacker only uses the gradient of the model to generate adversarial samples for the model, making the attack samples in the defense process far less aggressive than the adversarial samples during the training period. This is because the adversarial samples during training use the common gradient of the autoencoder and the model, which allows the autoencoder to easily pull the attack samples to the manifold of clean samples, thereby greatly weakening their attack strength and ultimately greatly improving the robustness of the model.

[0068] Therefore, the method of the present invention can integrate the distribution information of clean samples into the training process of AT and AD methods, and can adaptively bring adversarial samples closer to the distribution of clean samples, thereby overcoming the problems existing in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 Schematic diagram of the training process of the image classification model included in the adversarial sample defense model of the present invention. DETAILED DESCRIPTION

[0070] The present invention aims to propose a method for constructing an adversarial sample defense model based on image preprocessing, which can integrate the distribution information of clean samples into the training process of AT and AD methods, and can adaptively bring adversarial samples closer to the distribution of clean samples, thereby overcoming the problems existing in the prior art.

[0071] In order to introduce the distribution information of the sample, the present invention introduces an autoencoder trained by autoregression. Therefore, the adversarial sample defense model includes an autoencoder and an image classification model, wherein the autoencoder is used to reconstruct the input sample, and the image classification model is used to classify the reconstructed sample obtained by the autoencoder reconstruction. In accordance with the structure of the adversarial sample defense model, its training is also divided into the training of the autoencoder and the training of the image classification model.

[0072] The training of the autoencoder included in the adversarial sample defense model includes the following steps:

[0073] A1. Extract clean samples from the original data set and construct a training set for the autoencoder.

[0074] A2. Extract clean samples x from the training set of the autoencoder, input them into the autoencoder M, and generate reconstructed samples M(x);

[0075] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2;

[0076] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0077] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0078] By performing autoregressive training on the clean samples, the autoencoder can learn the prior distribution of clean samples. Based on the purpose of the autoencoder, its model structure can adopt any existing model and be determined according to the specific task requirements. Generally, the more complex the data, the more complex the selected autoencoder structure. For example: for the low-resolution dataset EuroSAT (64*64), the autoencoder can choose the structure shown in Table 1; for the high-resolution dataset Aerial_Landscapes (256*256), a simplified U-Net can be used as the autoencoder, and the simplified U-Net model includes a downsampling block and an upsampling block.

[0079] Table 1. Autoencoder structure

[0080]

[0081] The training of the image classification model included in the adversarial sample defense model is as follows: Figure 1 As shown, the following steps are included:

[0082] B1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0083] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0084] B3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first iteration, the initial adversarial sample obtained in step B2

[0085] B4. Reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; use the classification result to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample

[0086] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x *Otherwise, the adversarial sample obtained after updating in step B4 Return to step B3 as input;

[0087] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0088] B7, using the reconstructed sample M(x) obtained in step B6 * ), conduct adversarial training on image classification models;

[0089] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0090] Among them, step B1 is the preparation of the training set; step B2 is to generate adversarial samples based on clean samples, which can be done by any existing method, such as PGD.

[0091] Steps B3 to B5 are the optimization of adversarial samples. The trained autoencoder is used as the manifold projection operator. By capturing the prior distribution of clean samples, the autoencoder can adaptively pull the adversarial samples to the manifold of clean samples and weaken their attack strength. For example, the original adversarial sample perturbation δ = 8 / 255 is reconstructed by the autoencoder to achieve the adversarial perturbation of This simplifies the learning process of mapping from adversarial samples to correct labels, because the larger the adversarial perturbation during training, the more mapping relationships the model needs to learn, so the more difficult this mapping learning process is. Furthermore, the clean sample can be regarded as a data point, and the adversarial sample under adversarial perturbation constitutes a sphere with a radius of δ and the data point as the center. The larger δ is, the larger the sphere is, and the more mappings from adversarial sample points to correct labels need to be learned.

[0092] Steps B6 to B7 are to train the adversarial sample defense model based on the adversarial sample optimized in steps B3 to B5. The adversarial sample is first reconstructed using an autoencoder, and then the reconstructed adversarial sample is used to perform adversarial training on the image classification model included in the adversarial sample defense model. In the adversarial defense process after training, the adversarial sample defense model first reconstructs the input sample through an autoencoder, and the attacker is unaware of the existence of the autoencoder. In this way, the attacker only uses the gradient of the model to generate adversarial samples for the model, making the attack samples in the defense process far less aggressive than the adversarial samples in the training period, because the adversarial samples during training use the common gradient of the autoencoder and the model, which allows the autoencoder to easily pull the attack samples to the manifold of clean samples, thereby greatly weakening its attack strength and finally greatly improving the robustness of the model.

[0093] In summary, the essence of the present invention is an adversarial defense framework that improves the robustness of the model through manifold projection. The core of the present invention is to introduce an autoencoder, which captures the prior distribution of clean samples, so that generative learning is integrated into the adversarial defense framework, which distinguishes it from the existing discriminative learning, but does not change the adversarial training itself. Therefore, the adversarial training of the image classification model can adopt any existing adversarial training mode, such as conventional AT or AD, or various adversarial robust distillation training methods as described in the background technology.

[0094] Similarly, the model structure of the image classification model can adopt any existing model and be determined according to the specific task requirements. For example, for the low-resolution dataset EuroSAT (64*64), the lightweight convolutional neural network MobileNetV2 can be selected. MobileNetV2 is a version of the MobileNet series, which is designed to achieve efficient computing on mobile and embedded devices. The model has approximately 3.4 million parameters; for the high-resolution dataset Aerial_Landscapes (256*256), the deep residual network ResNet-18 can be selected. ResNet-18 is a variant in the ResNet series. The model has approximately 11.7 million parameters.

[0095] For the teacher model in adversarial distillation, an improved residual network WideResNet is generally used. Compared with the standard ResNet, WideResNet uses wider convolutional layers, which means that the number of channels in each convolutional layer increases, thereby improving the expressiveness of the model. According to the complexity of the task, adjust the number of layers of the teacher network and the number of neurons in each layer. For example: for the low-resolution dataset EuroSAT (64*64), the teacher model can select WideResNet-34-10, and for the high-resolution dataset Aerial_Landscapes (256*256), you can select WideResNet-76-16.

[0096] The scheme of the present invention is further described below in conjunction with embodiments.

[0097] Embodiment 1

[0098] This embodiment provides a method for constructing an adversarial sample defense model based on image preprocessing, wherein the adversarial sample defense model includes an autoencoder and an image classification model, wherein the autoencoder is used to reconstruct the input sample, and the image classification model is used to classify the reconstructed sample obtained by the autoencoder. The training data set uses the low-resolution data set EuroSAT (64*64), and the model results of the autoencoder are shown in Table 1; the image classification model selects the lightweight convolutional neural network MobileNetV2.

[0099] The training of the autoencoder included in the adversarial sample defense model includes the following steps:

[0100] A1. Extract clean samples from the original data set and construct a training set for the autoencoder.

[0101] A2. Extract clean samples x from the training set of the autoencoder, input them into the autoencoder M, and generate reconstructed samples M(x);

[0102] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2;

[0103] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0104] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0105] The reconstruction loss of the autoencoder M included in the adversarial sample defense model is calculated according to the following formula:

[0106]

[0107] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the binary norm.

[0108] The training of the image classification model adopts conventional adversarial training, which includes the following steps:

[0109] B1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0110] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0111] B3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first iteration, the initial adversarial sample obtained in step B2

[0112] B4. Reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; take the hard label of the clean sample x extracted in step B2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and maximize the difference between the classification result and the reference classification probability. According to the following formula, update the perturbation of the adversarial sample to obtain the updated adversarial sample

[0113]

[0114] in, Represents adversarial examples The gradient of , L represents the loss, η represents the step size; in this embodiment, η = v / 4, ∈ is the maximum perturbation allowed by the adversarial sample;

[0115] In this embodiment, the loss L is the cross entropy loss, and its formula is as follows:

[0116]

[0117] The goal is to maximize the difference between the classification result and the reference classification probability, which is formulated as:

[0118]

[0119] Among them, F represents the image classification model, l represents the cross entropy loss function, and p d (y|x) represents the probability that the clean sample x belongs to category y, which comes from the hard label of the clean sample x; δ is the perturbation contained in the adversarial sample, ∈ is the maximum perturbation allowed by the adversarial sample, ∥·∥ p represents the p-norm;

[0120] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after updating in step B4 Return to step B3 as input; in this embodiment, the preset condition is 10 iterations;

[0121] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x* );

[0122] B7, using the reconstructed sample M(x) obtained in step B6 * ), conduct adversarial training on the image classification model, including the following steps:

[0123] B71, using the reconstructed sample M(x) obtained in step B6 * ), input the image classification model and obtain the classification result;

[0124] B72. Construct a cross entropy loss based on the hard label of the clean sample x extracted in step B2 and the classification result obtained in step B71;

[0125] B73. Update the parameters of the image classification model with the goal of minimizing the cross entropy loss.

[0126] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0127] Embodiment 2

[0128] The present embodiment provides a method for constructing an adversarial sample defense model based on image preprocessing, wherein the adversarial sample defense model includes an autoencoder and an image classification model. The autoencoder is used to reconstruct input samples, and the image classification model is used to classify reconstructed samples obtained by the autoencoder.

[0129] The training data set uses the high-resolution data set Aerial_Landscapes (256*256), introduces an image classification model as a teacher model, and uses the image classification model included in the adversarial sample defense model as a student model. The adversarial distillation method is used to train the student model using the teacher model. The autoencoder uses a simplified U-Net model, which includes a downsampling block and an upsampling block. The student model uses the deep residual network ResNet-18, and the teacher model uses WideResNet-76-16.

[0130] The training of the autoencoder included in the adversarial sample defense model includes the following steps:

[0131] A1. Extract clean samples from the original data set and construct a training set for the autoencoder.

[0132] A2. Extract clean samples x from the training set of the autoencoder, input them into the autoencoder M, and generate reconstructed samples M(x);

[0133] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2;

[0134] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0135] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0136] The reconstruction loss of the autoencoder M is calculated according to the following formula:

[0137]

[0138] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the binary norm.

[0139] The image classification model used as the teacher model can be trained using an existing training method. In this embodiment, the training method of the image classification model in Embodiment 1 is used for training, which specifically includes the following steps:

[0140] C1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0141] C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0142] C3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first round of iteration, the initial adversarial sample obtained in step C2

[0143] C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and maximize the difference between the classification result and the reference classification probability. According to the following formula, update the perturbation of the adversarial sample to obtain the updated adversarial sample

[0144]

[0145] in, Represents adversarial examples The gradient of L represents the loss, and η represents the step size. In this embodiment, η = ∈ / 4, where ∈ is the maximum perturbation allowed by the adversarial sample.

[0146] C5: Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step C4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input; in this embodiment, the preset condition is 10 iterations;

[0147] C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0148] C7, using the reconstructed sample M(x) obtained in step C6 * ), conduct adversarial training on the teacher model, including:

[0149] C71, using the reconstructed sample M(x) obtained in step C6 * ), input the teacher model and obtain the classification result;

[0150] C72, constructing a cross entropy loss based on the hard label of the clean sample x extracted in step C2 of this step and the classification result obtained in step C71;

[0151] C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss;

[0152] C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

[0153] The training of the image classification model as a student model included in the adversarial example defense model includes the following steps:

[0154] B1. Extract clean samples from the original data set and construct a training set for the image classification model;

[0155] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0156] B3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first iteration, the initial adversarial sample obtained in step B2

[0157] B4. Reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; the classification result of the teacher model T As the reference classification probability; using the classification results of the student model S And the classification results of the teacher model T According to the following formula, the divergence loss is constructed to characterize the difference between the classification result and the reference classification probability:

[0158]

[0159] Among them, L represents loss, KL represents divergence loss function, represents the adversarial sample after t rounds of optimization;

[0160] With the goal of maximizing the difference between the classification result and the reference classification probability, the perturbation of the adversarial sample is updated according to the following formula to obtain the updated adversarial sample

[0161]

[0162] in, Represents adversarial examples The gradient of L represents the classification loss, and η represents the step size. In this embodiment, η = ∈ / 4, where ∈ is the maximum perturbation allowed by the adversarial sample.

[0163] The goal is to maximize the difference between the classification result and the reference classification probability, which is formulated as:

[0164]

[0165] Among them, δ is the perturbation part contained in the adversarial sample, ∈ is the maximum perturbation allowed by the adversarial sample, ∥·∥ p represents the p-norm;

[0166] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after updating in step B4 Return to step B3 as input; in this embodiment, the preset condition is 10 iterations;

[0167] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0168] B7, using the reconstructed sample M(x) obtained in step B6* ), conduct adversarial training on the image classification model, including the following steps:

[0169] B71, using the reconstructed sample M(x) obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification result of the student model S And the classification results of the teacher model T

[0170] B72. Classification result of the student model S obtained in step B71 And the classification results of the teacher model T Construct the divergence loss according to the following formula:

[0171] L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x) * )),T(M(x * )))

[0172] Among them, L represents the loss, KL represents the divergence loss function, α is the weight hyperparameter, x represents the clean sample, and x * represents the adversarial sample constructed based on the clean sample x;

[0173] B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss.

[0174] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0175] In the above embodiment, after multiple rounds of iterative optimization, the optimal model parameter configuration is determined. The final model should maintain a high classification accuracy on the standard test set, while showing strong adversarial robustness on the adversarial test set. In addition, the accuracy and robustness of the model can be further optimized through additional fine-tuning stages, for example, by reducing the learning rate and continuing training for several rounds to ensure that the final performance of the model is more stable and reliable.

[0176] Finally, it should be noted that the above embodiments are only preferred implementations and are not intended to limit the present invention. It should be pointed out that for those skilled in the art, several modifications, equivalent replacements, improvements, etc. can be made without departing from the scope of the present invention and the scope of protection of the claims, and all of these should be included in the protection scope of the present invention.

Claims

1. A method for constructing an adversarial sample defense model based on image preprocessing, characterized in that: The adversarial sample defense model includes an autoencoder and an image classification model, wherein the autoencoder is used to reconstruct the input sample, and the image classification model is used to classify the reconstructed sample obtained by the autoencoder reconstruction; The training of the autoencoder included in the adversarial sample defense model includes the following steps: A1. Extract clean samples from the original data set and construct a training set for the autoencoder. A2. Extract clean samples x from the training set of the autoencoder, input them into the autoencoder M, and generate reconstructed samples M(x); A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2; A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss; A5, determine whether the preset conditions are met, if so, complete the training of the autoencoder M, otherwise, return to step A2; The training of the image classification model included in the adversarial sample defense model includes the following steps: B1. Extract clean samples from the original data set and construct a training set for the image classification model; B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples B3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstruction sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first iteration, the initial adversarial sample obtained in step B2 B4. Reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; use the classification result to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after updating in step B4 Return to step B3 as input; B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * ); B7, using the reconstructed sample M(x) obtained in step B6 * ), conduct adversarial training on image classification models; B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

2. The adversarial sample defense method based on image preprocessing according to claim 1, characterized in that: The reconstruction loss of the autoencoder M is calculated according to the following formula: in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the binary norm.

3. The adversarial sample defense method based on image preprocessing according to claim 1, characterized in that: In step B4, the perturbation of the adversarial sample is updated using the classification result according to the following formula to obtain the updated adversarial sample: in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size.

4. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: The autoencoder adopts a simplified U-Net model, and the simplified U-Net model includes a downsampling block and an upsampling block.

5. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: The image classification model is trained using conventional adversarial training; In step B4, the hard label of the clean sample x extracted in step B2 is used as the reference classification probability, and the cross entropy loss is constructed using the classification result to characterize the difference between the classification result and the reference classification probability; Step B7 includes the following steps: B71, using the reconstructed sample M(x) obtained in step B6 * ), input the image classification model and obtain the classification result; B72. Construct a cross entropy loss based on the hard label of the clean sample x extracted in step B2 and the classification result obtained in step B71; B73. Update the parameters of the image classification model with the goal of minimizing the cross entropy loss.

6. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: An image classification model is introduced as a teacher model, and the image classification model included in the adversarial sample defense model is used as a student model. The image classification model included in the adversarial sample defense model as a student model is trained using the teacher model by using the adversarial distillation method. In step B4, the classification result of the teacher model T is As reference classification probability; Classification results using student model S And the classification results of the teacher model T Construct a divergence loss to characterize the difference between the classification result and the reference classification probability; Step B7 includes the following steps: B71, using the reconstructed sample M(x) obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification result of the student model S And the classification results of the teacher model T B72. Classification result of the student model S obtained in step B71 And the classification results of the teacher model T Construct divergence loss; B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss.

7. The adversarial sample defense method based on image preprocessing according to claim 6, characterized in that: The training of the image classification model as the teacher model includes the following steps: C1. Extract clean samples from the original data set and construct a training set for the image classification model; C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples C3. Use the trained autoencoder M to input the adversarial sample of this step Reconstruct and obtain its reconstruction sample Wherein, the subscript t represents the iteration round; the adversarial sample In the first round of iteration, the initial adversarial sample obtained in step C2 C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample C5: Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step C4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input; C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * ); C7, using the reconstructed sample M(x) obtained in step C6 * ), conduct adversarial training on the teacher model, including: C71, using the reconstructed sample M(x) obtained in step C6 * ), input the teacher model and obtain the classification result; C72, constructing a cross entropy loss based on the hard label of the clean sample x extracted in step C2 of this step and the classification result obtained in step C71; C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss; C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

8. The adversarial sample defense method based on image preprocessing as claimed in claim 6, characterized in that: In step B4, the divergence loss is calculated according to the following formula: In step B72, the divergence loss is calculated according to the following formula: L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x * )),T(M(x * ))) Among them, L represents the loss, KL represents the divergence loss function, α is the weight hyperparameter, x represents the clean sample, and x * represents the adversarial sample constructed based on the clean sample x, represents the adversarial sample after t rounds of optimization.

9. The adversarial sample defense method based on image preprocessing according to claim 6, characterized in that: The teacher model is the residual network WideResNet.

10. The adversarial sample defense method based on image preprocessing according to claim 1, characterized in that: The image classification model of the adversarial sample defense model is a lightweight convolutional neural network MobileNetV2 or a deep residual network ResNet-18.

Images