A defense method against patch attacks

Abstract

The present invention discloses a defense method for adversarial patch attacks. The method utilizes the characteristics of good feature extraction capability of mask reconstruction tasks, and implements a defense method for adversarial patch attacks by designing an adversarial mask generation method and a classification-reconstruction joint training method. The method for adversarial patch attacks divides an image recognition model into a backbone network and a fully connected layer, which are used for feature extraction and classification prediction, respectively. The reconstruction model is connected to the backbone network to receive image features extracted by the backbone network and reconstruct the image. The backbone network, fully connected layer and reconstruction model of the connected image recognition model are collectively referred to as a training model. This connection method does not require modification of the structure of the original image recognition model, but only optimizes the weight parameters of the original model. It is applicable to deep learning visual models of any architecture and models in any training state without forcing training from scratch.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence (AI) security, and specifically, to a defense method for adversarial patch attacks, which can significantly improve the robustness of a model to adversarial patches without compromising the classification accuracy of the model. Background Art

[0002] With the continuous evolution of deep learning technology, image recognition models based on deep learning have been widely used in many fields such as autonomous driving, smart security, and smart retail. However, with the popularity of deep learning image recognition models in actual applications, various attack methods against them have increasingly exposed new security issues. Among them, adversarial patches are an attack method that causes image recognition systems to produce incorrect classification results by adding carefully designed perturbation noise to small patterns (patches) of specific shapes. Adversarial patches can be effectively deployed in the physical world due to their locality and visibility characteristics. For example, studies have shown that placing adversarial patches on traffic signs can lead to misjudgment of traffic signs without blocking the original traffic sign pattern; making adversarial patches in the shape of glasses and wearing them can deceive real face recognition systems. Therefore, mitigating the threat of adversarial patches and improving the robustness of model decisions are key prerequisites for ensuring the safe application of image recognition models in real scenarios.

[0003] The existing anti-patch defense methods have the following technical problems:

[0004] 1. Existing methods generally rely on prior knowledge of adversarial patch attacks, such as the specific shape and size of the patch, which makes the defense measures only able to defend against specific forms of attacks, but cannot effectively deal with those that deviate from expectations or new attack methods, lacking flexibility and universality.

[0005] 2. Existing defense methods often require modification of the reasoning process, which not only increases the system's computational overhead, but also significantly reduces the reasoning speed. In application scenarios with strict real-time requirements, the practicality of this method is severely restricted and it is difficult to meet the demand for rapid response.

[0006] 3. Many existing methods also involve adjustments to the model structure, which means that they cannot be directly applied to already trained image recognition models. They require tedious steps such as retraining and parameter adjustment, which greatly increases the application cost and operational complexity.

[0007] 4. While existing methods improve the robustness of the model to adversarial patches, they will introduce additional noise or cause the model to overfit with the adversarial patches, weakening the model's ability to accurately recognize normal samples and damaging the model's original recognition accuracy. Summary of the invention

[0008] The present invention aims at the problems existing in the existing defense schemes and provides a deep learning model adversarial training method for adversarial patch defense, which improves the robustness of the model against adversarial patch attacks without changing the original model structure or damaging the accuracy of the original model.

[0009] In order to achieve the above object, the present invention is implemented by the following technical solutions:

[0010] The present invention discloses a defense method for countering patch attacks, comprising the following steps:

[0011] 1.1) Initialize the image recognition model and its weight ;

[0012] 1.2) Initialize the reconstruction model and its weight ;

[0013] 1.3) Connection reconstruction model Image recognition model , forming a training model ;

[0014] 1.4) Get a batch of images for training image recognition tasks , the corresponding true label is ;

[0015] 1.5) Apply adversarial mask generation method to image Generate corresponding adversarial examples ;

[0016] 1.6) The adversarial sample Input to the training model At the same time, we obtain the predicted probability vector and reconstructed image ;

[0017] 1.7) Calculate the predicted probability vector through the cross entropy loss function and the true label The classification loss between ;

[0018] 1.8) Calculate the reconstructed image using the mean square error loss function With image The reconstruction loss between ;

[0019] 1.9) Calculate classification loss and reconstruction loss The weighted sum of ;

[0020] 1.10) Based on the overall loss For training model Perform a round of classification-reconstruction joint training and update the weights and ;

[0021] 1.11) Repeat steps 1.4) to 1.10) until the predetermined training round is reached to obtain the final weights and , and the trained model after defense ;

[0022] 1.12) From the training model Reconstructed model after uninstalling defense , get the defended image recognition model .

[0023] As a further improvement, in step 1.3), the connection reconstruction model Image recognition model , forming a training model Specifically: the image recognition model Divided into backbone network and fully connected layer, which are used for feature extraction and classification prediction respectively, the reconstructed model After being connected to the backbone network, it is used to receive the image features extracted by the backbone network and reconstruct the image. Image recognition model after connection Backbone network, fully connected layer and reconstruction model The overall training model .

[0024] As a further improvement, in step 1.5), an adversarial mask generation method is applied to the image Generate corresponding adversarial examples , the specific steps are:

[0025] 2.1) Apply the mask generation method to image Generate the corresponding mask ;

[0026] 2.2) Apply adversarial perturbation generation method to optimize mask Adversarial perturbations on ;

[0027] 2.3) According to the mask and counter-perturbations Computing images Corresponding adversarial examples , the calculation formula is as follows:

[0028] ;

[0029] in Represents matrix dot product.

[0030] As a further improvement, in step 2.1), a mask generation method is applied to the image Generate the corresponding mask , specifically: the length and width are Image Split into a series of length and width Block ,in Represents the total number of image blocks, according to the given mask rate , calculate the number of blocks to be perturbed , from the set of all blocks Random selection Blocks make up the mask , is a Matrix, where 1 represents the selected The position of the image block, 0 represents the unselected block.

[0031] As a further improvement, in step 2.2), the adversarial perturbation generation method is applied to optimize the mask Adversarial perturbations on , specifically: Randomly initialize the perturbation , according to the mask The perturbation positions indicated apply the perturbation to the image to obtain a randomly initialized adversarial example:

[0032] ;

[0033] Countering disturbances The optimization goal is to maximize the model's prediction results for adversarial samples. With the true label The distance between them is expressed as:

[0034] ;

[0035] in represents the cross entropy loss function;

[0036] Use projected gradient descent to counteract perturbations For optimization, set the total number of iteration steps to , the perturbation is updated in each step as follows:

[0037] ;

[0038] in, Indicates the optimization The counter-perturbation at step time, represents the step size, that is, the maximum value of the disturbance change in each step, represents the gradient calculated by back propagation, Represents the sign function, which is used to extract the positive and negative sign information of the gradient value. Indicates Step by step according to the mask and disturbance Computational adversarial examples.

[0039] As a further improvement, in step 1.10), the classification-reconstruction joint training involves two training indicators, namely the classification loss and reconstruction loss , the classification loss is calculated by calculating the predicted probability vector and the true label The cross entropy of is obtained:

[0040] ;

[0041] in, Indicates The predicted probability vector of adversarial samples, represents the corresponding true label, Represents the total number of adversarial samples;

[0042] The reconstruction loss is obtained based on the mean square error between the reconstructed image and the original image:

[0043] ;

[0044] in, express norm, Indicates that from An image reconstructed by an adversarial sample. Represents the corresponding clean image and the reconstruction target;

[0045] By calculating the loss and loss The weighted sum of :

[0046] ;

[0047] in, is a weight parameter used to adjust the relative influence of classification loss and reconstruction loss on model updating;

[0048] According to the overall loss For training model Perform back propagation to update the model parameters in the direction of reducing the loss function , completing a round of classification-reconstruction joint training.

[0049] As a further improvement, in step 1.12), the trained model after defense Reconstructed model after splitting into defenses And the defended image recognition model , specifically: train the model Split into backbone network, fully connected layer and reconstruction model , connect the backbone network and the fully connected layer to form a defended image recognition model .

[0050] The beneficial effects of the present invention are as follows:

[0051] The present invention utilizes the good feature extraction capability of the mask reconstruction task, and implements a defense method against adversarial patch attacks by designing an adversarial mask generation method and a classification-reconstruction joint training method. The innovative points of the present invention are as follows:

[0052] 1. The defense method against patch attacks proposed in the present invention divides the image recognition model into a backbone network and a fully connected layer, which are used for feature extraction and classification prediction respectively. The reconstruction model is connected to the backbone network to receive the image features extracted by the backbone network and reconstruct the image. The backbone network, fully connected layer and reconstruction model of the connected image recognition model are collectively referred to as a training model. This connection method does not require modifying the structure of the original image recognition model, but only optimizes the weight parameters of the original model. It is applicable to deep learning visual models of any architecture, such as various types of convolutional neural networks and visual transformer networks, and to models in any training state without the need for forced training from scratch.

[0053] 2. The defense method against adversarial patch attacks proposed in the present invention divides the image into a series of blocks of equal size, calculates the total number of blocks to be perturbed according to a given mask rate, and randomly extracts the mask from the set of all blocks. The image mask generated in this way has the characteristics of random position, diverse shapes, and high mask rate, avoiding the fixed and single form of adversarial patches, thereby promoting the model to learn more diverse adversarial patch features;

[0054] 3. The defense method against adversarial patch attacks proposed in the present invention optimizes and generates corresponding adversarial perturbations for each image, and applies the mask and adversarial perturbations to form adversarial patches and applies them to the image to generate adversarial samples, which are then used for model training to improve its robustness. The adversarial patches generated in this way have the characteristics of strong perturbation ability and irregular shapes, providing a rich form of adversarial patches for model training and increasing the difficulty of training. The image recognition model trained with such adversarial samples can learn a rich set of adversarial patch features, so it does not need to know the prior knowledge about adversarial patches, and can show good defense effects against adversarial patch attacks of various shapes, sizes, and styles;

[0055] 4. The defense method for adversarial patch attacks proposed in the present invention uses an overall loss that combines classification loss and reconstruction loss to perform classification-reconstruction joint training on the training model. During the training process, the classification task and the reconstruction task simultaneously guide the optimization of the feature extraction capability of the backbone network of the image recognition model, and promote the model to learn from adversarial samples that can restore clean images and are suitable for classification. Features, that is, promote the model to capture robust and semantically rich features, not only significantly improve the image recognition model's ability to resist adversarial patch attacks, but also ensure that the model can maintain high accuracy when processing normal images;

[0056] 5. The defense method against adversarial patch attacks proposed in the present invention splits the training model into a defended reconstruction model and a defended image recognition model after the defense is completed. The defended image recognition model obtains more robust weights and improves intrinsic robustness, while the model architecture and reasoning process remain unchanged. Therefore, adversarial patch defense can be implemented in deployment without adding any additional computing overhead, and has good scenario applicability. For example, it can be applied to image recognition task scenarios such as autonomous driving that have high requirements on reasoning speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a framework diagram of the defense method against patch attacks;

[0058] Figure 2 It is a flowchart of using adversarial masks to generate adversarial samples in the defense method against adversarial patch attacks;

[0059] Figure 3 This is a flowchart of the classification-reconstruction joint training in the defense method against adversarial patch attacks. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical method and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0061] The technical solution of the present invention is further described below by combining the accompanying drawings of the specification through specific embodiments:

[0062] The purpose of the present invention is to propose a method for defending against patch attacks. Figure 1 This is an overall framework diagram of the defense method against patch attacks proposed by the present invention.

[0063] The specific implementation method of the defense method against patch attacks is as follows:

[0064] 1) Initialize a deep learning image recognition model , its weight Perform random initialization and initialize an image recognition model The shallow network corresponding to the structure is used as the reconstruction model , its weight Random initialization is performed, and the size of the input data is similar to the image recognition model The output data dimension of the backbone network is consistent, and the output data size is the image recognition model After the reconstruction model is connected to the backbone network, the backbone network, reconstruction model, and fully connected layer form a training model In this implementation, the image recognition model uses four convolutional neural networks with different architectures, including ResNet-18 network, WideResNet-50 network, VGG-19 network and DenseNet-121 network, and the reconstruction model uses a 6-layer convolutional neural network with a residual structure.

[0065] 2) Get a batch of images from the training dataset , whose length and width are First, the image Split into a series of length and width Block ,in Indicates the total number of image blocks. Mask rate Indicates the ratio of the mask to the total number of pixels in the image, according to the given mask rate , calculate the number of blocks to be perturbed , from the set of all blocks Select Blocks make up the mask . is a Matrix, 1 represents the selected The position of the image block is where the disturbance will be added, and 0 represents the unselected block, that is, the position where no disturbance will be generated;

[0066] The training dataset can be an image classification dataset, a traffic sign recognition dataset, or a face recognition dataset, because these data and the corresponding tasks are consistent.

[0067] In this implementation, two image sizes, 224 pixels and 32 pixels, are used according to the original resolution of the dataset. The image blocks are set to be squares with sides of 40 pixels and 8 pixels, respectively. The mask rate The values ​​range from 0.25 to 0.5 depending on the dataset. Taking 0.25 as an example, a single image can be divided into 36 image blocks. For the part of the image that does not meet the image block size after image segmentation, the method of rounding up is used to regard it as an image block. The number of blocks to be disturbed is , will be from the collection 9 image patches are randomly selected for perturbation.

[0068] 3) Randomly initialize noise , apply the noise to the image according to the noise position represented by the mask to calculate the initial adversarial sample:

[0069] ;

[0070] in Represents matrix dot product.

[0071] 4) The goal of the adversarial mask is to trick the model into outputting incorrect classification results, that is, by optimizing the noise , so that the adversarial sample Misleading image recognition models The output is wrong, so the optimization against noise can be expressed as:

[0072] ;

[0073] in represents the cross entropy loss function, Represented by image Generated adversarial examples, Representing images True label.

[0074] The projected gradient descent method is used to deduce the disturbance noise For optimization, set the total number of iteration steps to , the updating method of the disturbance noise in each step is:

[0075] ;

[0076] in, Indicates the optimization The disturbance noise during the step, represents the step size, i.e. the maximum value of the disturbance change in each step, represents the gradient calculated by back propagation, Represents the sign function, which is used to extract the positive and negative sign information of the gradient value. Indicates Step by step according to the mask and noise Calculated adversarial examples. In this implementation, the step size is set to 0.05 and the total number of steps is 20.

[0077] This adversarial mask generation method will generate adversarial patches with random positions and irregular shapes, providing rich adversarial patch forms for model training, thereby promoting the model's defense capabilities against various adversarial patches.

[0078] 5) Input the final optimized adversarial sample into the training model In the above example, we obtain the predicted probability vector and reconstructed image ;

[0079] 6) Calculate the predicted probability vector and the true label The cross entropy of , obtains the classification loss :

[0080] ;

[0081] in, Indicates The predicted labels of adversarial examples, represents the corresponding true label, Represents the total number of adversarial samples;

[0082] 7) Calculate the reconstructed image and the original image The mean square error is obtained to obtain the reconstruction loss :

[0083] ;

[0084] in, express norm, Indicates that from An image reconstructed by an adversarial sample. represents the corresponding clean image, i.e., the reconstruction target;

[0085] 8) Calculate the overall loss based on the classification loss and reconstruction loss:

[0086] ;

[0087] in, is the weight parameter. In this implementation, in order to show the general results, All are set to 0.5;

[0088] 9) Based on the overall loss For training model Perform back propagation to update the model parameters in the direction of reducing the loss function , that is, a round of classification-reconstruction joint training is completed.

[0089] 10) Repeat steps 2) to 9) to iteratively generate adversarial samples and update the model until the predetermined training round is reached and the trained weights are obtained. and , and the trained model after defense In this dynamic training setting, adversarial samples are generated for the latest model parameters each time, so the robustness of the model will continue to improve during the training process.

[0090] 11) After the model training is completed, the model will be reconstructed after training with the proposed defense method From the overall training model Uninstall and restore the protected image recognition model ;

[0091] Since the reconstruction model is used to reconstruct the image based on the image features extracted by the backbone network, the reconstruction model will not affect the classification results of the model and does not need to participate in the reasoning process of the deployed image recognition model. The model structure of the image recognition model does not change before and after the application of this defense method, so the storage space and computing overhead of the image recognition model will not be increased.

[0092] Figure 2 This is a flowchart of using adversarial masks to generate adversarial samples in the defense method against adversarial patch attacks, corresponding to steps 2) to 4); Figure 3 This is a flowchart of the classification-reconstruction joint training in the defense method against patch attacks, corresponding to steps 5) to 9).

[0093] The present invention uses robust accuracy to evaluate the defense effect of the defense method. Robust accuracy indicates the percentage of images accurately classified by the model when the input image is an adversarial sample. Table 1 shows the comparison of the robust accuracy of the present invention with other adversarial patch defense methods on the Imagenette and GTSRB datasets, on the four model architectures of ResNet-18, WideResNet-50, VGG-19, and DenseNet-121. The present invention shows good defense capabilities against 7 adversarial patch attack defense methods of different shapes, sizes, and methods, which is significantly better than the existing defense schemes. Table 2 shows the comparison of the robust accuracy of the present invention with other adversarial patch defense methods on the VGGFace2 face recognition dataset, on the ResNet-18 model. The results show that the present invention can significantly improve the robustness of the model against adversarial glasses (AdvGlass) attacks in face recognition tasks.

[0094] Table 1. Defense performance of adversarial patch defense methods on Imagenette and GTSRB datasets

[0095]

[0096] Table 2 Defense performance of adversarial patch defense methods on the VGGFace2 dataset

[0097]

[0098] The present invention uses clean accuracy to evaluate the impact of the defense method on the accuracy of the model without adversarial sample input. Clean accuracy indicates the percentage of images accurately classified by the model when the input image is a clean image without disturbance. Table 3 shows the comparison of clean accuracy of the image recognition model on the Imagenette, GTSRB and VGGFace2 datasets, on various model architectures, when no defense measures are applied, other existing adversarial patch defense methods are used, and the defense method proposed by the present invention is used. It can be seen that the present invention does not affect the original clean accuracy of the model, and the resulting clean accuracy decrease is less than 1%. On datasets with higher resolution, such as the Imagenette dataset and the VGGFace2 dataset, the present invention can improve the clean accuracy of the image recognition model by more than 1%. This shows that the defense method for adversarial patch attacks proposed by the present invention not only has excellent defense capabilities against various adversarial patch attack methods, but also does not damage or even improves the clean accuracy of the model.

[0099] Table 3 Impact of adversarial patch defense methods on model clean accuracy

[0100]

[0101] The present invention evaluates the impact of the defense method on the model reasoning efficiency by calculating the reasoning time of a single image. Table 4 shows the average reasoning time of the model for one image when the model does not use defense measures, uses other existing defense measures, and uses the defense method proposed by the present invention. The results show that the present invention does not increase the additional reasoning calculation overhead, and the difference in the reasoning time of a single image is less than 0.3ms compared with the model without using defense. It can be determined that the reasoning speed is consistent with the model before defense. Therefore, the present invention can be applied to tasks that require higher reasoning speed.

[0102] Table 4 Impact of adversarial patch defense methods on inference speed

[0103]

[0104] It should be understood that the above description of the preferred embodiment is relatively detailed and cannot be regarded as limiting the scope of patent protection of the present invention. Under the enlightenment of the present invention, ordinary technicians in this field can also make substitutions or modifications without departing from the scope of protection of the claims of the present invention, which all fall within the scope of protection of the present invention. The scope of protection requested for the present invention shall be based on the attached claims.

Claims

1. A defense method for countering patch attacks, characterized in that: The following steps are included: 1) Initialize the image recognition model F θ (·) and its weight θ; 2) Initialize the reconstruction model R ξ (·) and its weight ξ; 3) Connect and reconstruct model R ξ (·) and image recognition model F θ (·), forming the training model G θ，ξ (·); 4) Obtain a batch of images x for training image recognition tasks, and the corresponding true labels are y; 5) Apply the adversarial mask generation method to generate the corresponding adversarial sample x′ for image x; 6) Input the adversarial sample x′ into the training model G θ，ξ (·) and obtain the predicted probability vector y pred and the reconstructed image x r ; 7) Calculate the predicted probability vector y through the cross entropy loss function pred and the classification loss L between the true label y c ; 8) Calculate the reconstructed image x through the mean square error loss function r The reconstruction loss L between the image x r ; 9) Calculate the classification loss L c and the reconstruction loss L r The weighted sum of is taken as the overall loss L; 10) According to the overall loss L, the training model G θ，ξ (·) Perform one round of joint classification-reconstruction training and update weights θ and ξ; 11) Repeat steps 4) to 10) until the predetermined training round is reached to obtain the final weight θ * and * , and the trained model after defense 12) The trained model after defense Reconstructed model after splitting into defenses And the defended image recognition model In step 5), the adversarial mask generation method is applied to generate a corresponding adversarial sample x′ for the image x. The specific steps are: 1) Apply the mask generation method to generate the corresponding mask M for the image x; 2) Apply the adversarial perturbation generation method to optimize the adversarial perturbation δ on the mask M; 3) Calculate the adversarial sample x′ corresponding to the image x according to the mask M and the adversarial perturbation δ. The calculation formula is as follows: x′=x⊙(1-M)+δ⊙M; where ⊙ represents matrix dot product.

2. The method for defending against patch attacks according to claim 1, characterized in that: In step 3), the connection reconstruction model R ξ (·) and image recognition model F θ (·), forming the training model G θ，ξ (·) Specifically: the image recognition model F θ (·) is divided into a backbone network and a fully connected layer, which are used for feature extraction and classification prediction respectively. The reconstructed model R ξ (·) is connected to the backbone network and is used to receive the image features extracted by the backbone network and reconstruct the image. The connected image recognition model F θ (·) Backbone network, fully connected layer and reconstruction model R ξ (·) The overall model is called training model G θ，ξ (·).

3. The method for defending against patch attacks as claimed in claim 1, characterized in that: In the step 1), a mask generation method is applied to generate a corresponding mask M for the image x, specifically: the image x with a length and width of (H, W) is divided into a series of blocks with a length and width of (h, w) Where n represents the total number of image blocks. According to the given mask rate γ, the number of blocks to be perturbed k = round(γ×n) is calculated from the set of all blocks. K blocks are randomly selected from the image to form a mask M, where M is a 0-1 matrix, where 1 represents the location of the selected k image blocks and 0 represents the unselected blocks.

4. The method for defending against patch attacks according to claim 1, characterized in that: In the step 2), the adversarial perturbation generation method is applied to optimize the adversarial perturbation δ on the mask M, specifically: randomly initialize the perturbation δ0, apply the perturbation to the image according to the perturbation position represented by the mask M to obtain a randomly initialized adversarial sample: x0′=x⊙(1-M)+δ0⊙M; The optimization goal of the adversarial perturbation δ is to maximize the model's prediction result F for the adversarial sample. θ The distance between (x′) and the true label y is expressed as: Where l(·) represents the cross entropy loss function; The projected gradient descent method is used to optimize the adversarial perturbation δ. The total number of iteration steps is set to S, and the perturbation is updated in each step as follows: Among them, δ s represents the adversarial disturbance when optimizing the sth step, μ represents the step length, that is, the maximum value of the disturbance change in each step, represents the gradient calculated by back propagation, sgn(·) represents the sign function, which is used to extract the positive and negative sign information of the gradient value, and x s ′ represents the mask M and perturbation δ at the sth step s Computational adversarial examples.

5. The method for defending against patch attacks as claimed in claim 1, characterized in that: In step 10), the classification-reconstruction joint training involves two training indicators, namely, the classification loss L c and the reconstruction loss L r , the classification loss is calculated by predicting the probability vector y pred The cross entropy of the true label y is obtained: in, Represents the predicted probability vector for the i-th adversarial sample, y (i) represents the corresponding true label, and N represents the total number of adversarial samples; The reconstruction loss is obtained based on the mean square error between the reconstructed image and the original image: Among them, ||·||2 represents the L-2 norm, represents the image reconstructed from the i-th adversarial sample, x (i) Represents the corresponding clean image and the reconstruction target; By calculating the loss L c and loss L r The weighted sum of Calculate the overall loss L: L=α·L c +β·L r ; Among them, α and β are weight parameters, which are used to adjust the relative influence of classification loss and reconstruction loss on model update; according to the overall loss L, the training model G θ，ξ (·) Perform back propagation to update the model parameters θ, ξ in the direction of reducing the loss function, completing a round of classification-reconstruction joint training.

6. The method for defending against patch attacks according to claim 1, characterized in that: In the step 12), the trained model after defense Reconstructed model after splitting into defenses And the defended image recognition model Specifically: the training model Split into backbone network, fully connected layer and reconstruction model Connect the backbone network and the fully connected layer to form a defended image recognition model

Images