Adversarial sample detection method and device based on feature decoupling

Abstract

The invention relates to an adversarial sample detection method and device based on feature decoupling, and the method comprises the steps: inputting a to-be-detected sample into a to-be-defended model, extracting the deep features of the to-be-detected sample, inputting the deep features of the to-be-detected sample into a trained feature decoupler, and obtaining the robust features and non-robust features of the to-be-detected sample; and finally, inputting the non-robust features into a trained adversarial sample detector to obtain a detection result of an adversarial sample. According to the confrontation sample detection method and device based on feature decoupling, non-robust features are focused through feature decoupling, and the sensitivity and accuracy of confrontation sample detection are improved. The adversarial sample is detected and rejected before the adversarial sample affects the model, so that the safety and stability of the to-be-defended model under malicious disturbance are improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning technology, and in particular to an adversarial sample detection method and device based on feature decoupling. Background Art

[0002] Deep neural networks have demonstrated remarkable performance in a variety of tasks such as image classification, image generation, and object detection. However, deep neural networks are vulnerable to adversarial attacks, where attackers can construct adversarial samples by adding malicious perturbations that are difficult for the human eye to detect on the original images, causing the performance of deep neural networks on these samples to drop sharply.

[0003] Adversarial sample detection methods play a vital role in enhancing the security of deep neural networks. By identifying those carefully designed adversarial samples that may cause the network model to misclassify, users can be warned in time or take corresponding security measures, effectively protecting the model from malicious attacks, thereby improving the reliability and trust of the system in practical applications.

[0004] However, existing adversarial sample detection methods usually rely on overall features without clearly distinguishing between robust and non-robust parts of features, while robust features are not sensitive to adversarial perturbations. This mixture makes it impossible for detection methods to specifically analyze changes in non-robust features, weakening the detection effect. Summary of the invention

[0005] Based on this, it is necessary to provide an adversarial sample detection method and device based on feature decoupling to address the above-mentioned technical problems, which can more effectively distinguish clean samples from adversarial samples, predict and reject adversarial samples before the adversarial samples affect the model, thereby significantly improving the accuracy and security of the model to be defended when processing malicious perturbation data.

[0006] In a first aspect, the present invention provides an adversarial sample detection method based on feature decoupling, comprising the following steps:

[0007] Input the sample to be detected into the defense model to extract the deep features of the sample to be detected;

[0008] Input the deep features of the samples to be detected into the trained feature decoupler to obtain the robust features and non-robust features of the samples to be detected;

[0009] Input the non-robust features into the trained adversarial sample detector to obtain the detection results of the adversarial sample;

[0010] The feature decoupler includes a generation module, a conversion module and a Hadamard product module from the input end to the output end;

[0011] A generation module, used for generating a robustness score map of deep features of a sample to be detected by using a multi-layer convolutional unit;

[0012] A conversion module is used to convert the robustness score map into a differentiable soft mask using the Gumbel-Softmax method as a positive mask m of the deep features of the sample to be detected. + ;

[0013] The Hadamard product module is used to combine the deep features of the sample to be detected with the positive mask m + and negative mask 1-m + Perform Hadamard product to obtain the robust features and non-robust features of the sample to be detected.

[0014] In one embodiment, the training process of the feature decoupler includes the following steps:

[0015] Generate an adversarial sample set based on the adversarial attack algorithm for the model to be defended on the clean sample set;

[0016] Input each sample in the clean sample set and the adversarial sample set into the defense model to extract the deep features of each sample;

[0017] The deep features of all samples are input into the feature decoupler to obtain the robust features and non-robust features of each sample;

[0018] The robust features and non-robust features of each sample are input into the auxiliary classifier to obtain the classification results of all samples;

[0019] Based on the classification result of each sample, the robust loss and non-robust loss of each sample are calculated. The total loss of the feature decoupler and the auxiliary classifier is calculated using the robust loss and non-robust loss of all samples. The parameters of the feature decoupler and the auxiliary classifier are updated until the feature decoupler and the auxiliary classifier converge.

[0020] In one embodiment, the training process of the adversarial sample detector includes the following steps:

[0021] The deep features of all samples are input into the trained feature decoupler to obtain the robust features and non-robust features of each sample;

[0022] The non-robust features of each sample output by the trained feature decoupler are input into the adversarial sample detector to obtain the detection probability of the adversarial sample;

[0023] Based on the detection probability of the adversarial sample, the adversarial sample detector loss is calculated using the binary cross entropy to update the parameters of the adversarial sample detector until the adversarial sample detector converges.

[0024] In one embodiment, the positive mask m + The calculation formula is

[0025]

[0026] where r represents the robustness score map, σ(·) represents the sigmoid function, g1 and g2 represent samples drawn from the Gumbel distribution to simulate the discrete decision process, and τ represents the temperature parameter that controls the smoothness of the output distribution.

[0027] In one embodiment, the deep features of the sample to be detected are respectively compared with the positive mask m + and negative mask 1-m + The calculation formula for the Hadamard product is:

[0028]

[0029]

[0030] In the formula, represents the Hadamard product, F r represents the robust feature, F nr Represents a non-robust feature.

[0031] In one embodiment, the robust loss and non-robust loss of each sample are calculated based on the classification result of each sample as follows:

[0032]

[0033] In the formula, represents the robust loss, represents the non-robust loss, represents the probability that the auxiliary classifier predicts the Cth class, y c is the category label, is the probability that the defense model predicts the Cth category, N represents the number of categories, and c represents the cth category between 1 and N categories.

[0034] In one embodiment, the total loss of the feature decoupler and the auxiliary classifier is calculated as follows:

[0035]

[0036] In the formula, represents the total loss of the feature decoupler and the auxiliary classifier, λ1 is the robust loss weight, and λ2 is the non-robust loss weight.

[0037] In one embodiment, the formula for calculating the adversarial sample detector loss is:

[0038]

[0039] In the formula, y is a binary classification label, y is 0 or 1, 0 means the classification label is a clean sample, 1 means an adversarial sample, is the detection probability of the adversarial sample output by the adversarial sample detector.

[0040] In one of the embodiments, the auxiliary classifier and the adversarial sample detector are composed of a pooling layer and a single-layer fully connected network.

[0041] In a second aspect, the present invention also provides an adversarial sample detection device based on feature decoupling. The device comprises:

[0042] An extraction module is used to input the sample to be detected into the defense model to extract the deep features of the sample to be detected;

[0043] The feature decoupling module is used to input the deep features of the samples to be detected into the trained feature decoupler to obtain the robust features and non-robust features of the samples to be detected;

[0044] The adversarial sample detection module is used to input non-robust features into the trained adversarial sample detector to obtain the detection results of the adversarial samples.

[0045] The beneficial effect of the present invention is as follows: the present invention decouples the deep features of the sample to be detected into robust features and non-robust features through a feature decoupler, and then obtains the detection results of the adversarial sample in the adversarial sample detector based on the non-robust features. Robust features are insensitive to small disturbances and are difficult to be used to capture the anomalies of adversarial samples, while non-robust features are more easily disturbed by adversarial disturbances, resulting in significant changes in non-robust features when subjected to adversarial attacks, thereby achieving high-precision detection of adversarial samples. The present invention uses non-robust features to effectively distinguish clean samples from adversarial samples, predict and reject adversarial samples before the adversarial samples affect the model, thereby significantly improving the accuracy and security of the model to be defended when processing malicious perturbation data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a flowchart of an adversarial sample detection method based on feature decoupling provided by an embodiment of the present invention;

[0047] Figure 2 is a flowchart of a training process of a feature decoupler provided by an embodiment of the present invention;

[0048] Figure 3 Schematic diagram of the structural relationship between the feature decoupler, auxiliary classifier and adversarial sample detector provided by the embodiment of the present invention

[0049] Figure 4 It is a flowchart of the training process of the adversarial sample detector provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0051] In one embodiment, Figure 1 As shown, Figure 1 : is a flowchart of an adversarial sample detection method based on feature decoupling provided by an embodiment of the present invention. The method is applied to a computer device and includes the following steps:

[0052] S101, input the sample to be detected into the model to be defended to extract the deep features of the sample to be detected.

[0053] S102, inputting the deep features of the sample to be detected into the trained feature decoupler to obtain the robust features and non-robust features of the sample to be detected.

[0054] Among them, robust features are insensitive to tiny adversarial perturbations and are difficult to use to capture the anomalies of adversarial samples, while non-robust features are more easily disturbed by adversarial perturbations, resulting in obvious changes in non-robust features when subjected to adversarial attacks, thereby achieving high-precision detection of adversarial samples.

[0055] S103: Input the non-robust features into the trained adversarial sample detector to obtain the detection result of the adversarial sample.

[0056] In this embodiment, the detection result of the adversarial sample is the detection probability of whether it is an adversarial sample. The auxiliary classifier and the adversarial sample detector are composed of a pooling layer and a single-layer fully connected network.

[0057] Among them, the feature decoupler includes a generation module, a conversion module and a Hadamard product module from the input end to the output end.

[0058] A generation module, used for generating a robustness score map of deep features of a sample to be detected by using a multi-layer convolutional unit;

[0059] A conversion module is used to convert the robustness score map into a differentiable soft mask using the Gumbel-Softmax method as a positive mask m of the deep features of the sample to be detected. + .

[0060] Specifically, the positive mask m + The calculation formula is

[0061]

[0062] Where r represents the robustness score map, σ(·) represents the sigmoid function, g1 and g2 represent samples drawn from the Gumbel distribution to simulate the discrete decision process, and τ represents the temperature parameter that controls the smoothness of the output distribution.

[0063] The Hadamard product module is used to combine the deep features of the sample to be detected with the positive mask m + and negative mask 1-m + Perform Hadamard product to obtain the robust features and non-robust features of the sample to be detected.

[0064] Specifically, the deep features of the sample to be detected are respectively compared with the positive mask m + and negative mask 1-m + The calculation formula for the Hadamard product is:

[0065]

[0066]

[0067] In the formula, represents the Hadamard product, F r represents the robust feature, F nr Represents a non-robust feature.

[0068] The feature decoupler in this embodiment precisely separates robust and non-robust features. This decoupling helps the model analyze the input data more finely and focus on non-robust features that are more susceptible to adversarial attacks, thereby improving the sensitivity and accuracy of detection.

[0069] In one embodiment, if Figure 2 and Figure 3 As shown, Figure 2 is a flowchart of a training process of a feature decoupler provided by an embodiment of the present invention, Figure 3 Schematic diagram of the structural relationship between the feature decoupler, auxiliary classifier and adversarial sample detector provided by an embodiment of the present invention. In this embodiment, the training process of the feature decoupler includes the following steps:

[0070] S201. Generate an adversarial sample set based on the adversarial attack algorithm for the model to be defended on the clean sample set.

[0071] In this embodiment, the anti-attack algorithm may be but is not limited to the PGD algorithm.

[0072] S202: Input each sample of the clean sample set and the adversarial sample set into the to-be-defended model to extract deep features of each sample.

[0073] S203, input the deep features of all samples into the feature decoupler to obtain the robust features and non-robust features of each sample.

[0074] S204: Input the robust features and non-robust features of each sample into the auxiliary classifier to obtain classification results of all samples.

[0075] S205. Calculate the robust loss and non-robust loss of each sample based on the classification result of each sample, and use the robust loss and non-robust loss of all samples to calculate the total loss of the feature decoupler and the auxiliary classifier, and update the parameters of the feature decoupler and the auxiliary classifier until the feature decoupler and the auxiliary classifier converge.

[0076] In this embodiment, the robust loss and non-robust loss of each sample are calculated based on the classification result of each sample:

[0077]

[0078] In the formula, represents the robust loss, represents the non-robust loss, represents the probability that the auxiliary classifier predicts the Cth class, y c is the category label, is the probability that the defense model predicts the Cth category, N represents the number of categories, and c represents the cth category between 1 and N categories.

[0079] The calculation formula for the total loss of the feature decoupler and the auxiliary classifier is

[0080]

[0081] In the formula, represents the total loss of the feature decoupler and the auxiliary classifier, λ1 is the robust loss weight, and λ2 is the non-robust loss weight.

[0082] For example, in this embodiment, the clean sample set is the AID data set, and the model to be defended is the ResNet50 model. When the PGD algorithm is used, the PGD attack parameters are ∈=8 / 255, α=2 / 255, and T=10.

[0083] The training process of the feature decoupler specifically includes: on the AID dataset D, based on the PGD adversarial attack algorithm, generating the PGD adversarial sample set D′ for the ResNet50 model M; inputting the AID dataset D and the PGD adversarial sample set D′ into the ResNet50 model M respectively, and extracting the features F and F′ of the last convolution layer before the fully connected layer respectively, with the feature dimension of All F and F′ are input into the feature decoupler to decompose and obtain their respective robust features and non-robust features (F r ,F nr )、(F r ′,Fn ' r ); r ,F nr )、(F r ′,F n ' r ) is input into the auxiliary classifier AC to obtain the classification result. Different loss functions are used for robust features and non-robust features. The gradient is calculated through back propagation to update the parameters of the feature decoupler FD and the auxiliary classifier AC.

[0084] It should be noted that during the update process of the feature decoupler FD and the auxiliary classifier AC parameters, if the total loss difference is greater than 0.01, it means that the training has not converged and the parameters need to be updated further.

[0085] Specifically, the auxiliary classifier AC includes a pooling layer and a single-layer full connection, which is used to train the feature decoupler FD. The input of the auxiliary classifier AC is of dimension After the pooling layer and the fully connected layer, the output dimension is 30 dimensions, the same as the number of categories in the dataset.

[0086] In one embodiment, if Figure 4 As shown, Figure 4 : is a flowchart of a training process of an adversarial sample detector provided by an embodiment of the present invention, comprising the following steps:

[0087] S401. The deep features of all samples are input into the trained feature decoupler to obtain the robust features and non-robust features of each sample.

[0088] It should be noted that the feature decoupler used in this step is a trained feature decoupler, while the feature decoupler used in the above step S203 is an untrained or training feature decoupler.

[0089] S402: Input the non-robust features of each sample output by the trained feature decoupler into the adversarial sample detector to obtain the detection probability of the adversarial sample.

[0090] S403, based on the detection probability of the adversarial sample, the adversarial sample detector loss is calculated using the binary cross entropy to update the parameters of the adversarial sample detector until the adversarial sample detector converges. If the difference in the adversarial sample detector loss is greater than 0.01, it means that the training has not converged yet, and the adversarial sample detector needs to continue to update the parameters.

[0091] In this embodiment, the formula for calculating the adversarial sample detector loss is:

[0092]

[0093] In the formula, y is a binary classification label, y is 0 or 1, 0 means the classification label is a clean sample, 1 means an adversarial sample, is the detection probability of the adversarial sample output by the adversarial sample detector.

[0094] Based on the same inventive concept, the embodiment of the present invention also provides an adversarial sample detection device based on feature decoupling for implementing the above-mentioned method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiment of the adversarial sample detection device based on feature decoupling provided below can refer to the limitations of the adversarial sample detection method based on feature decoupling above, and will not be repeated here.

[0095] The adversarial sample detection device based on feature decoupling of this embodiment includes:

[0096] An extraction module is used to input the sample to be detected into the defense model to extract the deep features of the sample to be detected;

[0097] The feature decoupling module is used to input the deep features of the samples to be detected into the trained feature decoupler to obtain the robust features and non-robust features of the samples to be detected;

[0098] The adversarial sample detection module is used to input non-robust features into the trained adversarial sample detector to obtain the detection results of the adversarial samples.

[0099] The adversarial sample detection device based on feature decoupling of this embodiment overcomes the limitation of existing methods that rely on overall features and fail to effectively distinguish between these two types of features by decoupling features into robust features and non-robust features. Robust features are insensitive to tiny adversarial perturbations and are difficult to use to capture anomalies in adversarial samples, which affects the detection effect. The adversarial sample detection device based on feature decoupling of this embodiment focuses on non-robust features that are more susceptible to adversarial attacks to more effectively distinguish clean samples from adversarial samples, improves the security and accuracy of the model when processing adversarial samples, and provides a more efficient adversarial sample detection solution.

[0100] The above-mentioned embodiments only express several implementation methods of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A method for detecting adversarial samples based on feature decoupling, characterized in that: The following steps are involved: Inputting the sample to be detected into the model to be defended to extract the deep features of the sample to be detected; Inputting the deep features of the sample to be detected into a trained feature decoupler to obtain the robust features and non-robust features of the sample to be detected; Inputting the non-robust features into a trained adversarial sample detector to obtain a detection result of the adversarial sample; Wherein, the characteristic decoupler includes a generation module, a conversion module and a Hadamard product module in sequence from the input end to the output end; The generating module is used to generate a robustness score map of the deep features of the sample to be detected by using a multi-layer convolution unit; The conversion module is used to convert the robustness score map into a differentiable soft mask using the Gumbel-Softmax method as a positive mask m of the deep features of the sample to be detected + ; The Hadamard product module is used to respectively combine the deep features of the sample to be detected with the positive mask m + and negative mask 1-m + Performing Hadamard product to obtain the robust features and non-robust features of the sample to be detected.

2. The adversarial sample detection method based on feature decoupling according to claim 1, characterized in that: The training process of the feature decoupler includes the following steps: Generate an adversarial sample set based on the adversarial attack algorithm for the model to be defended on the clean sample set; Input each sample of the clean sample set and the adversarial sample set into the to-be-defended model to extract the deep features of each sample; The deep features of all samples are input into the feature decoupler to obtain the robust features and non-robust features of each sample; The robust features and non-robust features of each sample are input into the auxiliary classifier to obtain the classification results of all samples; The robust loss and non-robust loss of each sample are calculated based on the classification result of each sample. The total loss of the feature decoupler and the auxiliary classifier is calculated using the robust loss and non-robust loss of all samples. The parameters of the feature decoupler and the auxiliary classifier are updated until the feature decoupler and the auxiliary classifier converge.

3. The adversarial sample detection method based on feature decoupling according to claim 2 is characterized in that: The training process of the adversarial sample detector includes the following steps: The deep features of all samples are input into the trained feature decoupler to obtain the robust features and non-robust features of each sample; The non-robust features of each sample output by the trained feature decoupler are input into the adversarial sample detector to obtain the detection probability of the adversarial sample; Based on the detection probability of the adversarial sample, the adversarial sample detector loss is calculated using binary cross entropy to update the parameters of the adversarial sample detector until the adversarial sample detector converges.

4. The adversarial sample detection method based on feature decoupling according to claim 1, characterized in that: The positive mask m + The calculation formula is where r represents the robustness score map, σ(·) represents the sigmoid function, g1 and g2 represent samples drawn from the Gumbel distribution to simulate the discrete decision process, and τ represents the temperature parameter that controls the smoothness of the output distribution.

5. The adversarial sample detection method based on feature decoupling according to claim 1, characterized in that: The deep features of the sample to be detected are respectively combined with the positive mask m + and negative mask 1-m + The calculation formula for the Hadamard product is: In the formula, represents the Hadamard product, F r represents the robust feature, F nr Represents a non-robust feature.

6. The adversarial sample detection method based on feature decoupling according to claim 2, characterized in that: The calculation formula for calculating the robust loss and non-robust loss of each sample based on the classification result of each sample is: In the formula, represents the robust loss, represents the non-robust loss, represents the probability that the auxiliary classifier predicts the Cth class, y c is the category label, is the probability that the defense model predicts the Cth category, N represents the number of categories, and c represents the cth category between 1 and N categories.

7. The adversarial sample detection method based on feature decoupling according to claim 2, characterized in that: The calculation formula for the total loss of the feature decoupler and the auxiliary classifier is: In the formula, represents the total loss of the feature decoupler and the auxiliary classifier, λ1 is the robust loss weight, and λ2 is the non-robust loss weight.

8. The adversarial sample detection method based on feature decoupling according to claim 3, characterized in that: The calculation formula for calculating the adversarial sample detector loss is: In the formula, y is a binary classification label, y is 0 or 1, 0 means the classification label is a clean sample, 1 means an adversarial sample, is the detection probability of the adversarial sample output by the adversarial sample detector.

9. The adversarial sample detection method based on feature decoupling according to claim 1, characterized in that: The auxiliary classifier and adversarial sample detector are composed of a pooling layer and a single-layer fully connected network.

10. An adversarial sample detection device based on feature decoupling, characterized in that: include: An extraction module, used for inputting the sample to be detected into the model to be defended to extract the deep features of the sample to be detected; A feature decoupling module, used for inputting the deep features of the sample to be detected into a trained feature decoupler to obtain the robust features and non-robust features of the sample to be detected; The adversarial sample detection module is used to input the non-robust features into a trained adversarial sample detector to obtain the adversarial sample detection result.

Images