A method for constructing an image preprocessing-based adversarial sample defense model

Abstract

The present application relates to the field of computer vision, and particularly relates to a kind of construction method of adversarial sample defense model based on image preprocessing, and the adversarial sample defense model thereof includes autoencoder for reconstructing sample and image classification model for classifying reconstructed sample;Autoencoder is trained by autoregression using clean sample, and learns the prior distribution of clean sample;The training of image classification model, first, optimize adversarial sample by autoencoder, then train using the adversarial sample obtained by optimization, by incorporating the distribution information of clean sample into the training process, make adversarial sample keep closer distribution with clean sample on manifold, overcome the problem caused by ignoring data distribution in prior art;In the process of adversarial defense, first, reconstruct sample by autoencoder, can greatly weaken attack strength, and greatly improve robustness.It is suitable for various image classification fields, especially high-precision fields such as aerospace.

Description

Technical Field

[0001] The present invention relates to the field of adversarial attack and defense in computer vision, and in particular to a method for constructing an adversarial sample defense model based on image preprocessing. Background Art

[0002] Deep neural networks have achieved tremendous success in computer vision and have shown great potential in fields such as aerospace, such as satellite image processing, object detection, and autonomous drone navigation. However, adversarial attacks against deep neural networks pose a significant security threat, particularly in mission-critical areas such as autonomous driving and facial recognition, as well as in aerospace. These attacks exploit weaknesses in deep neural networks, introducing perturbations that are imperceptible to humans but can significantly alter the model's predictions. For example, in satellite image processing systems, such attacks could lead to misinterpretations of critical terrain or meteorological data, compromising the safety and accuracy of aerospace missions.

[0003] Adversarial Training (AT) has become one of the most effective defense methods against such attacks. AT incorporates adversarial examples into training data to enhance the robustness of the model. In aerospace missions, such as autonomous navigation systems for drones, AT helps defend against enemy interference or malicious attacks in natural environments. AT was first introduced by the Fast Gradient Sign Method and later enhanced by Projected Gradient Descent Adversarial Training, which uses iterative adversarial examples generated by Projected Gradient Descent. Tradeoff-inspired Adversarial Defense via Surrogate-loss Minimization further improves AT by balancing robustness and clean accuracy.

[0004] However, AT is typically used in a discriminative learning manner, focusing on learning the mapping from samples to labels. This approach primarily aims to strengthen the mapping from input samples to corresponding labels without considering the underlying distribution of the samples. Consequently, AT typically requires high-capacity models, which can be computationally resource-constrained on edge computing devices in the aerospace sector, such as satellite sensors or drone embedded systems.

[0005] To address the limitations of AT, Adversarial Distillation (AD) was proposed. AD extends knowledge distillation (KD) by enhancing the robustness of smaller models by transferring knowledge from a larger and more robust teacher model.

[0006] Adversarially Robust Distillation (Adversarially Robust Distillation) is a technique that combines adversarial training (AD) with KD, aiming to enhance the model's performance under adversarial attacks by improving its adversarial robustness. The core idea of ​​Adversarial Robust Distillation is to not only transfer the model's knowledge through the distillation process, but also enhance its adversarial robustness. Robust Soft Label Adversarial Distillation (Robust Soft Label Adversarial Distillation) is an improved adversarial robust distillation method. It further enhances the effect of adversarial robust distillation by generating adversarial examples by combining the robust soft labels of the teacher model. Adaptive Adversarial Distillation (Adaptive Adversarial Distillation) introduces an adaptive mechanism based on traditional adversarial distillation, making the knowledge transfer in the distillation process more flexible and efficient.

[0007] However, existing AD methods are limited to aligning the predicted outputs of the teacher and student models, while ignoring the underlying data distribution. If there is a significant ability gap between the teacher and student models, or the performance of the teacher model is not optimal, the effectiveness of adversarial distillation may be compromised.

[0008] In summary, both AT and AD improve the adversarial robustness of the model by strengthening the mapping from samples to labels. However, these methods often ignore the influence of the underlying data distribution. Specifically, AT and AD mainly focus on optimizing the performance of the model on adversarial examples, that is, improving robustness by strengthening the model's classification ability for perturbed samples. However, this approach ignores the overall distribution characteristics of the data, and a typical feature of adversarial examples is that they often deviate from the data distribution of normal samples. This deviation of adversarial examples may cause a series of problems such as the trade-off between adversarial robustness and standard accuracy. And this deviation may be particularly serious in high-precision fields such as aerospace, because the existence of adversarial examples may lead to misjudgment of core modules such as navigation and detection systems, thereby affecting the success and safety of the entire mission. Summary of the Invention

[0009] The technical problem to be solved by the present invention is to propose a method for constructing an adversarial sample defense model based on image preprocessing, which can integrate the distribution information of clean samples into the training process of AT and AD methods, thereby overcoming the problems existing in the existing technology.

[0010] The technical solution adopted by the present invention to solve the above technical problems is:

[0011] A method for constructing an adversarial sample defense model based on image preprocessing, the adversarial sample defense model comprising an autoencoder and an image classification model, the autoencoder being used to reconstruct input samples, and the image classification model being used to classify reconstructed samples obtained by the autoencoder;

[0012] The training of the autoencoder included in the adversarial defense model includes the following steps:

[0013] A1. Extract clean samples from the original dataset and construct a training set for the autoencoder.

[0014] A2. Extract a clean sample x from the autoencoder’s training set, input it into the autoencoder M, and generate a reconstructed sample M(x).

[0015] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2.

[0016] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0017] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0018] The training of the image classification model included in the adversarial example defense model includes the following steps:

[0019] B1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0020] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0021] B3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step B2 in the first iteration

[0022] B4, reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification results; use the classification results to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification results and the reference classification probability to obtain the updated adversarial sample

[0023] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step B4 is updated Return to step B3 as input;

[0024] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0025] B7, using the reconstructed sample M(x * ), conduct adversarial training on image classification models;

[0026] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0027] Furthermore, the reconstruction loss of the autoencoder M is calculated according to the following formula:

[0028]

[0029] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the two-norm.

[0030] Furthermore, in step B4, the perturbation of the adversarial sample is updated using the classification results according to the following formula to obtain the updated adversarial sample

[0031]

[0032] in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size.

[0033] Furthermore, the autoencoder adopts a simplified U-Net model, and the simplified U-Net model includes a downsampling block and an upsampling block.

[0034] Furthermore, the image classification model is trained using conventional adversarial training;

[0035] In step B4, the hard label of the clean sample x extracted in step B2 is used as the reference classification probability, and the cross entropy loss is constructed using the classification result to represent the difference between the classification result and the reference classification probability;

[0036] Step B7 includes the following steps:

[0037] B71, using the reconstructed sample M(x obtained in step B6 * ), input the image classification model and obtain the classification results;

[0038] B72. Construct a cross entropy loss based on the hard labels of the clean samples x extracted in step B2 and the classification results obtained in step B71.

[0039] B73. Update the parameters of the image classification model with the goal of minimizing the cross entropy loss.

[0040] Furthermore, we introduce an image classification model as a teacher model, and use the image classification model included in the adversarial sample defense model as a student model. We use the adversarial distillation method to train the image classification model included in the adversarial sample defense model as a student model using the teacher model.

[0041] In step B4, the classification results of the teacher model T are As the reference classification probability; using the classification results of the student model S And the classification results of the teacher model T Construct a divergence loss to characterize the difference between the classification result and the reference classification probability;

[0042] Step B7 includes the following steps:

[0043] B71, using the reconstructed sample M(x obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification results of the student model S And the classification results of the teacher model T

[0044] B72. Classification results based on the student model S obtained in step B71 And the classification results of the teacher model T Construct divergence loss;

[0045] B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss.

[0046] Furthermore, the training of the image classification model as the teacher model includes the following steps:

[0047] C1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0048] C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0049] C3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step C2 in the first iteration

[0050] C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample

[0051] C5, determine whether the preset conditions are met, if so, end the iteration and update the adversarial sample obtained in step C4 As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input;

[0052] C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0053] C7, using the reconstructed sample M(x * ), conduct adversarial training on the teacher model, including:

[0054] C71, using the reconstructed sample M(x obtained in step C6 * ), input the teacher model and obtain the classification results;

[0055] C72. Based on the hard labels of the clean samples x extracted in step C2 of this step and the classification results obtained in step C71, construct a cross entropy loss;

[0056] C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss;

[0057] C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

[0058] Furthermore, in step B4, the divergence loss is calculated according to the following formula:

[0059]

[0060] In step B72, the divergence loss is calculated according to the following formula:

[0061] L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x) * )),T(M(x * )))

[0062] Among them, L represents loss, KL represents divergence loss function, α is weight hyperparameter, x represents clean sample, x * represents the adversarial sample constructed based on the clean sample x, represents the adversarial sample after t rounds of optimization.

[0063] Furthermore, the teacher model is a residual network WideResNet.

[0064] Furthermore, the image classification model of the adversarial sample defense model is a lightweight convolutional neural network MobileNetV2 or a deep residual network ResNet-18.

[0065] The beneficial effects of the present invention are:

[0066] The method of the present invention performs autoregressive training on an autoencoder on clean samples to learn the prior distribution of clean samples. Then, through the reconstruction of the samples by the autoencoder, the distribution information of the clean samples is incorporated into the training process. Specifically, during the training process of the image classification model, through repeated iterative training of adversarial samples, the autoencoder can project the adversarial samples back onto the learned clean sample manifold, so that the adversarial samples maintain a distribution on the manifold closer to that of the clean samples. Finally, the adversarial samples optimized by the autoencoder are used to optimize the parameters of the image classification model, obtaining the optimal model parameter configuration. While ensuring the classification accuracy of the model, its adversarial robustness is enhanced, ultimately resulting in a robust deep neural network model combined with popular projection. Secondly, the autoencoder can adaptively bring the adversarial samples closer to the manifold of normal samples, weakening their attack strength and simplifying the mapping learning from adversarial samples to correct labels.

[0067] During the adversarial defense process after training, the input samples are first reconstructed through the autoencoder. The attacker is unaware of the existence of the autoencoder. In this way, the attacker only uses the model's gradient to generate adversarial samples targeting the model, making the attack samples in the defense process far less aggressive than the adversarial samples during the training period. This is because the adversarial samples during training use the common gradient of the autoencoder and the model. This allows the autoencoder to easily pull the attack samples to the manifold of clean samples, thereby greatly weakening their attack strength and ultimately significantly improving the robustness of the model.

[0068] Therefore, the method of the present invention can integrate the distribution information of clean samples into the training process of AT and AD methods, and can adaptively bring the adversarial samples closer to the distribution of clean samples, thereby overcoming the problems existing in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 Schematic diagram of the training process of the image classification model included in the adversarial sample defense model of the present invention. DETAILED DESCRIPTION

[0070] The present invention aims to propose a method for constructing an adversarial sample defense model based on image preprocessing, which can integrate the distribution information of clean samples into the training process of AT and AD methods, and can adaptively bring adversarial samples closer to the distribution of clean samples, thereby overcoming the problems existing in the existing technology.

[0071] To incorporate sample distribution information, the present invention incorporates an autoencoder trained via autoregression. Therefore, the adversarial sample defense model includes an autoencoder and an image classification model. The autoencoder is used to reconstruct input samples, and the image classification model is used to classify the reconstructed samples obtained by the autoencoder. Consistent with the structure of the adversarial sample defense model, its training is also divided into training of the autoencoder and training of the image classification model.

[0072] The training of the autoencoder included in the adversarial sample defense model includes the following steps:

[0073] A1. Extract clean samples from the original dataset and construct a training set for the autoencoder.

[0074] A2. Extract a clean sample x from the autoencoder’s training set, input it into the autoencoder M, and generate a reconstructed sample M(x).

[0075] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2.

[0076] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0077] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0078] By training the autoencoder through autoregression on clean samples, the autoencoder can learn the prior distribution of clean samples. Based on the purpose of the autoencoder, its model structure can adopt any existing model and be determined according to the specific task requirements. Generally, the more complex the data, the more complex the selected autoencoder structure. For example, for the low-resolution EuroSAT dataset (64*64), the autoencoder can choose the structure shown in Table 1; for the high-resolution Aerial_Landscapes dataset (256*256), a simplified U-Net model can be used as the autoencoder. The simplified U-Net model consists of a downsampling block and an upsampling block.

[0079] Table 1. Autoencoder structure

[0080]

[0081] The training of the image classification model included in the adversarial sample defense model is as follows: Figure 1 As shown, the following steps are included:

[0082] B1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0083] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0084] B3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step B2 in the first iteration

[0085] B4, reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification results; use the classification results to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification results and the reference classification probability to obtain the updated adversarial sample

[0086] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x *Otherwise, the adversarial sample obtained after step B4 is updated Return to step B3 as input;

[0087] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0088] B7, using the reconstructed sample M(x * ), conduct adversarial training on image classification models;

[0089] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0090] Among them, step B1 is the preparation of the training set; step B2 is to generate adversarial samples based on clean samples, which can be done using any existing method, such as PGD.

[0091] Steps B3 to B5 are to optimize the adversarial samples. The trained autoencoder is used as the manifold projection operator. By capturing the prior distribution of clean samples, the autoencoder can adaptively pull the adversarial samples toward the manifold of clean samples, thus weakening their attack strength. For example, the original adversarial sample perturbation δ = 8 / 255 is reconstructed by the autoencoder to achieve the adversarial perturbation. This simplifies the learning process of mapping from adversarial examples to correct labels. The larger the adversarial perturbation during training, the more mapping relationships the model must learn, making this learning process more difficult. Furthermore, a clean example can be considered a data point, while the adversarial examples under adversarial perturbation form a sphere with a radius of δ centered at that data point. A larger δ results in a larger sphere, and the more mappings from adversarial example points to correct labels must be learned.

[0092] Steps B6-B7 train the adversarial defense model based on the adversarial examples optimized in steps B3-B5. They first reconstruct the adversarial examples using an autoencoder. The reconstructed adversarial examples are then used to perform adversarial training on the image classification model included in the adversarial defense model. During the post-training adversarial defense process, the adversarial defense model first reconstructs the input examples using an autoencoder. The attacker is unaware of the autoencoder's existence, so they simply use the model's gradients to generate adversarial examples targeting the model. This makes the attack examples during the defense process far less potent than those during training. This is because adversarial examples during training utilize the shared gradients of the autoencoder and the model, allowing the autoencoder to easily pull the attack examples onto the manifold of clean examples, significantly weakening their attack strength and ultimately significantly improving the model's robustness.

[0093] In summary, the essence of this invention is an adversarial defense framework that improves model robustness through manifold projection. Its core lies in the introduction of an autoencoder, which captures the prior distribution of clean samples. This allows generative learning to be integrated into the adversarial defense framework, distinguishing it from existing discriminative learning without changing the adversarial training itself. Therefore, adversarial training for image classification models can adopt any existing adversarial training mode, such as conventional AT or AD, or various adversarial robust distillation training methods described in the background.

[0094] Similarly, the model structure of the image classification model can adopt any existing model and be determined according to the specific task requirements. For example, for the low-resolution EuroSAT dataset (64*64), the lightweight convolutional neural network MobileNetV2 can be selected. MobileNetV2 is a version of the MobileNet series designed to achieve efficient computing on mobile and embedded devices. The model has approximately 3.4 million parameters; for the high-resolution Aerial_Landscapes dataset (256*256), the deep residual network ResNet-18 can be selected. ResNet-18 is a variant of the ResNet series. The model has approximately 11.7 million parameters.

[0095] The teacher model used in adversarial distillation generally uses a modified residual network, WideResNet. Compared to the standard ResNet, WideResNet uses wider convolutional layers, which means that the number of channels in each convolutional layer is increased, thereby improving the model's expressiveness. The number of layers in the teacher network and the number of neurons in each layer are adjusted according to the complexity of the task. For example, for the low-resolution EuroSAT dataset (64*64), the teacher model can be WideResNet-34-10, while for the high-resolution Aerial_Landscapes dataset (256*256), WideResNet-76-16 can be selected.

[0096] The solution of the present invention is further described below with reference to the embodiments.

[0097] Example 1

[0098] This embodiment describes a method for constructing an adversarial defense model based on image preprocessing. The model includes an autoencoder and an image classification model. The autoencoder is used to reconstruct input samples, and the image classification model is used to classify the reconstructed samples obtained by the autoencoder. The training dataset used is the low-resolution EuroSAT (64x64) dataset. The autoencoder model results are shown in Table 1. The image classification model uses the lightweight convolutional neural network MobileNetV2.

[0099] The training of the autoencoder included in the adversarial defense model includes the following steps:

[0100] A1. Extract clean samples from the original dataset and construct a training set for the autoencoder.

[0101] A2. Extract a clean sample x from the autoencoder’s training set, input it into the autoencoder M, and generate a reconstructed sample M(x).

[0102] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2.

[0103] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0104] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0105] The reconstruction loss of the autoencoder M included in the adversarial sample defense model is calculated as follows:

[0106]

[0107] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the two-norm.

[0108] The training of the image classification model adopts conventional adversarial training, which includes the following steps:

[0109] B1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0110] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0111] B3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step B2 in the first iteration

[0112] B4, reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification result; use the hard label of the clean sample x extracted in step B2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and maximize the difference between the classification result and the reference classification probability. Update the perturbation of the adversarial sample according to the following formula to obtain the updated adversarial sample

[0113]

[0114] in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size; in this embodiment, η = v / 4, ∈ is the maximum perturbation allowed by the adversarial sample;

[0115] In this embodiment, the loss L is the cross entropy loss, and its formula is as follows:

[0116]

[0117] The goal is to maximize the difference between the classification result and the reference classification probability. Its formula is:

[0118]

[0119] Among them, F represents the image classification model, l represents the cross entropy loss function, and p d (y|x) represents the probability that the clean sample x belongs to category y, which comes from the hard label of the clean sample x; δ is the perturbation contained in the adversarial sample, ∈ is the maximum perturbation allowed by the adversarial sample, ∥·∥ p represents the p-norm;

[0120] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step B4 is updated Return to step B3 as input; in this embodiment, the preset condition is 10 iterations;

[0121] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x* );

[0122] B7, using the reconstructed sample M(x * ), conduct adversarial training on the image classification model, including the following steps:

[0123] B71, using the reconstructed sample M(x obtained in step B6 * ), input the image classification model and obtain the classification results;

[0124] B72. Construct a cross entropy loss based on the hard labels of the clean samples x extracted in step B2 and the classification results obtained in step B71.

[0125] B73. Update the parameters of the image classification model with the goal of minimizing cross entropy loss;

[0126] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0127] Example 2

[0128] This embodiment provides a method for constructing an adversarial sample defense model based on image preprocessing. The adversarial sample defense model includes an autoencoder and an image classification model. The autoencoder is used to reconstruct the input samples, and the image classification model is used to classify the reconstructed samples obtained by the autoencoder reconstruction.

[0129] The training dataset used was the high-resolution Aerial_Landscapes dataset (256*256). An image classification model was introduced as the teacher model, and the image classification model included in the adversarial example defense model was used as the student model. The student model was trained using adversarial distillation. The autoencoder used a simplified U-Net model consisting of a downsampling block and an upsampling block. The student model used a deep residual network, ResNet-18, and the teacher model used a WideResNet-76-16.

[0130] The training of the autoencoder included in the adversarial defense model includes the following steps:

[0131] A1. Extract clean samples from the original dataset and construct a training set for the autoencoder.

[0132] A2. Extract a clean sample x from the autoencoder’s training set, input it into the autoencoder M, and generate a reconstructed sample M(x).

[0133] A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2.

[0134] A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss;

[0135] A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2.

[0136] The reconstruction loss of the autoencoder M is calculated according to the following formula:

[0137]

[0138] in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the two-norm.

[0139] The image classification model used as the teacher model can be trained using existing training methods. In this embodiment, the training method of the image classification model in Example 1 is used for training, specifically including the following steps:

[0140] C1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0141] C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0142] C3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step C2 in the first iteration

[0143] C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and maximize the difference between the classification result and the reference classification probability. According to the following formula, the perturbation of the adversarial sample is updated to obtain the updated adversarial sample

[0144]

[0145] in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size; in this embodiment, η = ∈ / 4, ∈ is the maximum perturbation allowed by the adversarial sample;

[0146] C5, determine whether the preset conditions are met, if so, end the iteration and update the adversarial sample obtained in step C4 As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input; in this embodiment, the preset condition is 10 iterations;

[0147] C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0148] C7, using the reconstructed sample M(x * ), conduct adversarial training on the teacher model, including:

[0149] C71, using the reconstructed sample M(x obtained in step C6 * ), input the teacher model and obtain the classification results;

[0150] C72. Based on the hard labels of the clean samples x extracted in step C2 of this step and the classification results obtained in step C71, construct a cross entropy loss;

[0151] C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss;

[0152] C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

[0153] The image classification model used as the student model in the adversarial defense model is trained in the following steps:

[0154] B1. Extract clean samples from the original dataset and construct a training set for the image classification model;

[0155] B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples

[0156] B3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step B2 in the first iteration

[0157] B4, reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification results; the classification results of the teacher model T As the reference classification probability; using the classification results of the student model S And the classification results of the teacher model T According to the following formula, the divergence loss is constructed to represent the difference between the classification result and the reference classification probability:

[0158]

[0159] Among them, L represents loss, KL represents divergence loss function, represents the adversarial sample after t rounds of optimization;

[0160] With the goal of maximizing the difference between the classification result and the reference classification probability, the perturbation of the adversarial sample is updated according to the following formula to obtain the updated adversarial sample

[0161]

[0162] in, Represents adversarial examples The gradient of , L represents the classification loss, and η represents the step size; in this embodiment, η = ∈ / 4, ∈ is the maximum perturbation allowed by the adversarial sample;

[0163] The goal is to maximize the difference between the classification result and the reference classification probability. Its formula is:

[0164]

[0165] Among them, δ is the perturbation part contained in the adversarial sample, ∈ is the maximum perturbation allowed by the adversarial sample, ∥·∥ p represents the p-norm;

[0166] B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step B4 is updated Return to step B3 as input; in this embodiment, the preset condition is 10 iterations;

[0167] B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * );

[0168] B7, using the reconstructed sample M(x* ), conduct adversarial training on the image classification model, including the following steps:

[0169] B71, using the reconstructed sample M(x obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification results of the student model S And the classification results of the teacher model T

[0170] B72. Classification results based on the student model S obtained in step B71 And the classification results of the teacher model T Construct the divergence loss according to the following formula:

[0171] L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x) * )),T(M(x * )))

[0172] Among them, L represents loss, KL represents divergence loss function, α is weight hyperparameter, x represents clean sample, x * represents the adversarial sample constructed based on the clean sample x;

[0173] B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss;

[0174] B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

[0175] In the above embodiment, the optimal model parameter configuration is determined after multiple rounds of iterative optimization. The final model should maintain high classification accuracy on the standard test set and exhibit strong adversarial robustness on the adversarial test set. Furthermore, additional fine-tuning phases can be used to further optimize the model's accuracy and robustness, for example by reducing the learning rate and continuing training for several rounds, to ensure that the model's final performance is more stable and reliable.

[0176] Finally, it should be noted that the above embodiments are merely preferred implementations and are not intended to limit the present invention. It should be noted that those skilled in the art will be able to make modifications, equivalent substitutions, and improvements without departing from the spirit and scope of the present invention and the claims, all of which should be included within the scope of protection of the present invention.

Claims

1. A method for constructing an adversarial sample defense model based on image preprocessing, characterized in that: The adversarial sample defense model includes an autoencoder and an image classification model, wherein the autoencoder is used to reconstruct the input sample, and the image classification model is used to classify the reconstructed sample obtained by the autoencoder; The training of the autoencoder included in the adversarial defense model includes the following steps: A1. Extract clean samples from the original dataset and construct a training set for the autoencoder. A2. Extract a clean sample x from the autoencoder’s training set, input it into the autoencoder M, and generate a reconstructed sample M(x). A3. Calculate the reconstruction loss of the autoencoder M based on the extracted clean sample x and the reconstructed sample M(x) obtained in step A2. A4. Based on the reconstruction loss, update the autoencoder M with the goal of minimizing the reconstruction loss; A5. Determine whether the preset conditions are met. If so, complete the training of the autoencoder M. Otherwise, return to step A2. The training of the image classification model included in the adversarial example defense model includes the following steps: B1. Extract clean samples from the original dataset and construct a training set for the image classification model; B2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples B3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step B2 in the first iteration B4, reconstruct the sample obtained in step B3 Input the image classification model to obtain the classification results; use the classification results to update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification results and the reference classification probability to obtain the updated adversarial sample B5. Determine whether the preset conditions are met. If so, end the iteration and update the adversarial sample obtained in step B4. As the final adversarial sample x * Otherwise, the adversarial sample obtained after step B4 update Return to step B3 as input; B6. The final adversarial sample x obtained in step B5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * ); B7, using the reconstructed sample M(x * ), conduct adversarial training on image classification models; B8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step B2.

2. The method for defending against adversarial samples based on image preprocessing according to claim 1, wherein: The reconstruction loss of the autoencoder M is calculated according to the following formula: in, represents the set of clean samples input for this round of training, |·| represents the count, and ∥·∥2 represents the two-norm.

3. The adversarial sample defense method based on image preprocessing according to claim 1, characterized in that: In step B4, the perturbation of the adversarial sample is updated using the classification results according to the following formula to obtain the updated adversarial sample in, Represents adversarial examples The gradient of , L represents the loss, and η represents the step size.

4. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: The autoencoder adopts a simplified U-Net model, which includes a downsampling block and an upsampling block.

5. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: The image classification model is trained using conventional adversarial training; In step B4, the hard label of the clean sample x extracted in step B2 is used as the reference classification probability, and the cross entropy loss is constructed using the classification result to represent the difference between the classification result and the reference classification probability; Step B7 includes the following steps: B71, using the reconstructed sample M(x obtained in step B6 * ), input the image classification model and obtain the classification results; B72. Construct a cross entropy loss based on the hard labels of the clean samples x extracted in step B2 and the classification results obtained in step B71. B73. Update the parameters of the image classification model with the goal of minimizing the cross entropy loss.

6. The adversarial sample defense method based on image preprocessing according to any one of claims 1 to 3, characterized in that: An image classification model is introduced as a teacher model, and the image classification model included in the adversarial example defense model is used as a student model. The image classification model included in the adversarial example defense model is trained using the teacher model using adversarial distillation. In step B4, the classification results of the teacher model T are as reference classification probability; Classification results using student model S And the classification results of the teacher model T Construct a divergence loss to characterize the difference between the classification result and the reference classification probability; Step B7 includes the following steps: B71, using the reconstructed sample M(x obtained in step B6 * ), input the teacher model T and the student model S respectively, and obtain the classification results of the student model S And the classification results of the teacher model T B72. Classification results based on the student model S obtained in step B71 And the classification results of the teacher model T Construct divergence loss; B73. Update the parameters of the image classification model with the goal of minimizing the divergence loss.

7. The method for defending against adversarial samples based on image preprocessing according to claim 6, wherein: The training of the image classification model as the teacher model includes the following steps: C1. Extract clean samples from the original dataset and construct a training set for the image classification model; C2. Extract clean samples x from the training set of the image classification model, add attack perturbation δ0 to the extracted clean samples x, and obtain the initial adversarial samples C3. Use the trained autoencoder M to input the adversarial sample of this step. Reconstruct and obtain its reconstructed sample Wherein, the subscript t represents the iteration round; the adversarial sample The initial adversarial sample obtained in step C2 in the first iteration C4, reconstruct the sample obtained in step C3 Input the teacher model to obtain the classification result; take the hard label of the clean sample x extracted in step C2 as the reference classification probability, use the classification result to construct the cross entropy loss, characterize the difference between the classification result and the reference classification probability, and update the perturbation of the adversarial sample with the goal of maximizing the difference between the classification result and the reference classification probability to obtain the updated adversarial sample C5, determine whether the preset conditions are met, if so, end the iteration and update the adversarial sample obtained in step C4 As the final adversarial sample x * Otherwise, the adversarial sample obtained after step C4 update Return to step C3 as input; C6, the final adversarial sample x obtained in step C5 * , using the trained autoencoder M, reconstruct and obtain its reconstructed sample M(x * ); C7, using the reconstructed sample M(x * ), conduct adversarial training on the teacher model, including: C71, using the reconstructed sample M(x obtained in step C6) * ), input the teacher model and obtain the classification results; C72. Based on the hard labels of the clean samples x extracted in step C2 of this step and the classification results obtained in step C71, construct a cross entropy loss; C73, update the parameters of the teacher model with the goal of minimizing the cross entropy loss; C8. Determine whether the preset conditions are met. If so, complete the training of the image classification model. Otherwise, return to step C2.

8. The method for defending against adversarial samples based on image preprocessing according to claim 6, wherein: In step B4, the divergence loss is calculated according to the following formula: In step B72, the divergence loss is calculated according to the following formula: L=(1-α)KL(S(M(x)),T(M(x)))+αKL(S(M(x * )),T(M(x * ))) Among them, L represents loss, KL represents divergence loss function, α is weight hyperparameter, x represents clean sample, x * represents the adversarial sample constructed based on the clean sample x, represents the adversarial sample after t rounds of optimization.

9. The method for defending against adversarial samples based on image preprocessing according to claim 6, wherein: The teacher model is the residual network WideResNet.

10. The method for defending against adversarial samples based on image preprocessing according to claim 1, wherein: The image classification model of the adversarial sample defense model is a lightweight convolutional neural network MobileNetV2 or a deep residual network ResNet-18.

Images