Robust training method based on supervised contrast learning

Abstract

The invention discloses a robust training method based on supervised comparative learning, and the method comprises the steps: carrying out the transformation, including rotation, cutting, color jitter or random gray scale, of an image, obtaining two enhanced samples, storing the two enhanced samples, carrying out the PGD or AutoAttack attack of the enhanced samples, and improving a comparative learning method; moreover, the enhanced sample, the corresponding adversarial sample and the sample with the same label in the data set are used as positive samples, other samples are used as negative samples to carry out model training, and supervised contrast loss is used as a loss function to obtain a model with robustness. Experimental results show that the method not only maintains the classification accuracy of clean samples, but also significantly improves the robustness of the model to adversarial samples. The achievement provides a new perspective for improving the safety and reliability of the deep learning model in practical application.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence security and involves supervised learning, contrastive learning, and adversarial training techniques. Background Art

[0002] In today's era of rapid development of artificial intelligence, deep learning models have achieved remarkable results in many fields, such as image recognition and natural language processing, greatly promoting social progress and technological change. However, the security and reliability of deep learning models in actual application scenarios are facing unprecedented challenges.

[0003] In recent years, contrastive learning has emerged in the field of self-supervised learning and has made great progress. A large number of studies have confirmed that when self-supervised contrastive learning methods are cleverly applied to supervised learning tasks, they can effectively promote the close aggregation of samples within a class, while widening the distance between samples between classes, thereby significantly improving the accuracy of sample classification, and showing stable and consistent advantages on multiple different data sets. For example, some cutting-edge contrastive learning algorithms have greatly improved the classification accuracy of the model on standard data sets by carefully designing a variety of sample enhancement methods, such as random cropping, rotation, color transformation, etc., and optimizing contrast loss functions, which has strongly promoted the development of related fields.

[0004] However, deep learning models are extremely vulnerable to adversarial sample attacks, and their robustness is seriously insufficient. Adversarial samples are generated by applying small but carefully designed perturbations to the original samples. Common adversarial sample generation methods include the fast gradient sign method (FGSM), projected gradient descent (PGD), and the Kalini and Wagner attack (C&W attack). FGSM quickly generates a perturbation that can cause the model to misclassify based on the gradient direction of the model loss function. It has high computational efficiency, but the generated adversarial sample perturbation is relatively large; PGD calculates the gradient through multiple iterations and gradually adjusts the perturbation, which can generate more concealed adversarial samples and pose a greater threat to the model; C&W attacks can generate high-quality adversarial samples by optimizing specific objective functions, and have excellent attack success rates.

[0005] The disturbances in these adversarial samples are almost imperceptible to the human visual system, but can easily mislead deep learning models to make incorrect classification decisions. In many practical application scenarios, such as autonomous driving, medical imaging diagnosis, and financial risk assessment, the existence of adversarial samples is like a hidden bomb that may cause serious consequences at any time. For example, in an autonomous driving system, if the vehicle's image recognition module is interfered with by adversarial samples, it may misidentify traffic lights, road signs, or obstacles, leading to serious traffic accidents and endangering life safety; in medical imaging diagnosis, adversarial samples may cause the model to misdiagnose the disease and delay the best treatment time for patients; in the financial field, adversarial samples may interfere with the judgment of risk assessment models, leading to financial decision-making errors and causing huge economic losses.

[0006] At present, academia and industry have conducted extensive and in-depth research on the problem of model robustness. Adversarial training is a common and effective method. Its core idea is to actively introduce adversarial samples during model training, so that the model can learn the characteristics of adversarial perturbations during training, thereby enhancing its ability to resist adversarial samples. For example, adversarial samples are generated by using the PGD attack algorithm, and are used together with the original samples to train the model, so that the model can gradually adapt to the interference of adversarial samples. However, traditional adversarial training methods often inevitably sacrifice a certain degree of classification accuracy while improving model robustness, resulting in a decrease in the performance of the model when processing normal samples. This is mainly because during the optimization process of adversarial training, it is necessary to balance the model's ability to fit normal samples and its robustness to adversarial samples, and it is difficult to achieve the optimal effect at the same time. Summary of the invention

[0007] The purpose of the present invention is to provide a robust training method based on supervised contrastive learning, which combines supervised contrastive learning with adversarial training, replaces the traditional cross entropy loss with supervised contrast loss, and improves the classification accuracy and robustness of the model.

[0008] Based on the first main aspect of the present invention, a robust training method based on supervised contrastive learning is provided, the method comprising: obtaining two enhanced samples by rotating, cropping, color jittering or random grayscale transformation of the image and saving them, then performing PGD or AutoAttack attack on the enhanced samples, improving the contrastive learning method, taking the enhanced samples, the corresponding adversarial samples and the samples with the same labels in the data set as positive samples, and other samples as negative samples for model training, using supervised contrast loss as the loss function, and obtaining a robust model.

[0009] Specifically, the present invention at least comprises the following steps: S1, set the enhanced samples: perform two random enhancement operations on the samples in the dataset to generate two enhanced views. randomly sampled sample / label pairs, By image enhancement, For the enhanced samples, in, The enhanced sample is and , the corresponding label is and ,and ; S2, set the adversarial sample: use the PGD attack algorithm to generate the perturbation corresponding to the enhanced sample; for the enhanced sample and , generating the corresponding perturbation , the adversarial sample pair obtained is and ; S3, pre-training step: ResNet is used as the initial model and pre-trained on the CIFAR-10 and CIFAR-100 training sets; S4, model optimization step: train a classifier on the pre-trained encoder and improve the robustness of the model by performing adversarial full fine-tuning operations, updating the encoder and classifier during fine-tuning.

[0010] As a further preferred solution, the pre-training process described in step S3 includes the following sub-steps: Parameter setting sub-steps: set the training batch size, number of training rounds, default learning rate, learning rate decay rounds, decay rate, momentum, temperature parameters, and save frequency; Data loading sub-step: set the training data set and the mean and standard deviation corresponding to different data sets, and pre-process the image data; Model and loss function construction sub-step: set the initial model and loss function for training; Optimizer setup sub-step: Use stochastic gradient descent SGD optimizer with momentum; Training cycle sub-steps: set the learning rate for each round of training, calculate the loss, update the model parameters, save the relevant data of each round of training and enter the next round of training; Save model sub-step: Save the model according to the set save frequency, and complete the final model save when training is completed.

[0011] As a further preferred solution, the image enhancement methods in step S1 include cropping, color jittering, and conversion to grayscale.

[0012] As a further preferred solution, the method is based on a learning framework and constructs a contrast loss calculation method and a model optimization method, which are described in detail below.

[0013] 1. Learning framework The learning framework includes: data enhancement module Aug (·), encoder network Enc (·) and projection network Proj (·), where: The data augmentation module Aug (·) is used to generate two random augmented samples for the input sample and introduce adversarial attacks based on random data augmentation to generate adversarial samples; The encoder network Enc (·) is used to map the input sample to a feature representation vector and normalize the feature representation vector to the unit hypersphere; The projection network Proj (·) is used to map the feature vector to a new vector space and is discarded after the contrastive training phase.

[0014] The details are described below.

[0015] Data augmentation module Aug(·): For each input sample , generate two random augmentation samples, , expressed as and These augmented samples not only capture a subset of information in the original samples, but also represent different views of the data. The goal of this invention is to introduce adversarial attacks based on random data augmentation to enhance the robustness of the model.

[0016] First, the present invention adopts PGD (Projected Gradient Descent) or AutoAttack attack algorithm to target each enhanced sample. and Generate the corresponding perturbation By applying these perturbations to the enhanced samples, we obtain two pairs of adversarial samples: and , where the perturbed loss function is generated The contrast loss is used to ensure the differences between samples are enhanced.

[0017] The core of the method of the present invention is to generate two views that are forced to be dissimilar in adversarial terms and learn consistency based on this. Through this strategy, contrastive learning is not only performed on enhanced samples, but also extended to corresponding adversarial samples, thereby forcing the model's representation to remain invariant to standard inputs and adversarial inputs. This method effectively improves the robustness of the model in the face of adversarial perturbations while maintaining the generalization ability of the original data.

[0018] In this way, the research of this invention provides a new perspective for the field of contrastive learning, that is, by learning on enhanced samples and adversarial samples, the invariance of the model to input perturbations can be enhanced. This method not only improves the robustness of the model, but also provides new guarantees for the security and stability of deep learning models.

[0019] Encoder network Enc(·): Its function is to convert the input sample Mapped to a feature representation vector Specifically, for each pair of samples obtained after data augmentation, they are fed into the same encoder network to produce a corresponding pair of representation vectors. These representation vectors are normalized in subsequent processing to lie on the unit hypersphere.

[0020] Experiments show that by normalizing the feature representation vector to the unit hypersphere, the top-1 accuracy of the model can be significantly improved. This normalization strategy not only enhances the model's ability to represent input data, but also improves its performance in classification tasks.

[0021] Through normalization, the present invention further optimizes the feature space, so that the model can more robustly identify and distinguish different input samples. This improvement is not only reflected in the improvement of accuracy, but also helps to improve the generalization ability of the model when facing complex and changing data distribution.

[0022] Projection network Proj(·): Its function is to transform the feature vector Mapped to a new vector space. In specific implementation, Proj(·) is constructed as a multi-layer perceptron (MLP) with a hidden layer of size 2048 and an output vector with a predetermined dimension.

[0023] In order to further optimize the feature representation, the present invention normalizes the output vector of Proj(·) to the unit hypersphere. This step not only simplifies the calculation of the distance metric (which can be achieved by the inner product), but also is consistent with the practice in self-supervised contrastive learning.

[0024] After the comparison training phase is completed, the present invention chooses to discard Proj(·). The advantage of this is that in the inference phase, the number of model parameters of the present invention is consistent with the cross entropy model using only the encoder network Enc(·), thereby ensuring the efficiency and practicality of the model.

[0025] In this way, the present invention not only improves the distinguishing ability of the model in the feature space, but also maintains the simplicity of the model parameters, which facilitates deployment in practical applications.

[0026] 2. Contrastive Loss In the research field of contrastive loss function, this paper explores its applicability in supervised learning from the perspective of self-supervised learning. The present invention generates a batch of samples, each of which contains a corresponding label, by using image enhancement technology. For the enhanced samples, For each original sample , the present invention obtains two enhanced samples and , the corresponding label is and ,and In addition, the present invention also generates corresponding adversarial sample pairs, which are and .

[0027] In the subsequent part of the present invention, the present invention will be the original The sample set is referred to as a "batch", and the expanded A collection of augmented samples is called a “multi-view batch”. In the context of multi-view batches, the loss function in self-supervised contrastive learning is defined as follows: (1) Formula (1) uses the dot product operation to measure the similarity between vectors, and introduces a temperature parameter τ to adjust the sensitivity of the similarity. In this framework, each index Considered an anchor point, represents the set of all samples, For sample Through this setting, the model can enhance the similarity of positive samples and reduce the similarity with negative samples, thereby improving the classification performance of the model.

[0028] In the context of supervised learning, the traditional contrast loss function, as shown in equation (1), faces a challenge: it fails to fully utilize label information to process multiple samples belonging to the same category. It only takes the two samples after anchor enhancement as positive samples, while ignoring the samples of the same category with the same label in the dataset. This limitation prompted the present invention to explore how to expand the contrastive learning framework to adapt to the situation of multiple samples of the same category in supervised learning. The difference between the classification results of self-supervised contrastive learning and supervised contrastive learning is shown in the figure of the specification. Figure 1 A more intuitive introduction.

[0029] In order to incorporate the labels of supervised learning into the contrastive loss function, the method used in the present invention is shown in equation (2). This method can handle the problem of multiple samples of the same type in supervised learning, thereby improving the model's ability to learn the consistency of samples within a category. In this way, the present invention not only retains the advantages of contrastive learning, but also enhances the performance and generalization ability of the model in supervised learning tasks.

[0030] (2) in, Representation sample The positive sample set size.

[0031] 3. Model Optimization Standard Linear Fine-tuning (SLF). In order to evaluate the learned feature representation, it is often used in the pre-trained encoder Train a linear classifier on In the dataset Using the true label Calculate supervised cross-entropy (CE) loss : (3) In order to further evaluate the robustness of the learned feature representation, this paper We measure its accuracy in the face of PGD or AutoAttack attacks. We show that standard linear fine-tuning cannot generate a robust model.

[0032] Adversarial Full Fine-tuning (AFF). AFF introduces adversarial perturbations δ, which enables the model to learn how to defend against these attacks during training. The key to this approach is that it allows the model to further optimize its robustness to adversarial examples while maintaining the useful features learned by the pre-trained encoder.

[0033] AFF provides an effective way to improve the robustness of deep learning models by updating both the encoder and the classifier during the fine-tuning phase. This approach not only improves the performance of the model on standard classification tasks, but more importantly, it enhances the stability and reliability of the model in the face of complex adversarial environments.

[0034] (4) in, It is adversarial perturbation. It is worth emphasizing that the present invention adopts the weight initialization strategy of robust self-supervised learning (Robust Self-Supervised Learning, Robust SSL), which not only accelerates the convergence speed of supervised adversarial training (Supervised Adversarial Training, SAT), but also significantly improves the overall performance of the model. The present invention adopts adversarial complete fine-tuning.

[0035] Advantages and beneficial effects of the present invention: This paper proposes an innovative robust strategy based on supervised contrastive learning. This strategy uses enhanced samples, corresponding adversarial samples and samples with the same label in the dataset as positive samples, and other samples as negative samples, and uses supervised contrast loss instead of traditional cross entropy loss. Experimental results show that the method of the present invention not only maintains the classification accuracy of clean samples, but also significantly improves the robustness of the model to adversarial samples. This achievement provides a new perspective for improving the security and reliability of deep learning models in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 The figure shows the classification difference between self-supervised contrastive learning and supervised contrastive learning in one embodiment of the present invention. Self-supervised contrastive learning only regards the enhanced samples of the original samples as positive samples, and all other samples in the data set are negative samples; supervised contrastive learning regards the enhanced samples and samples with the same label in the data set as positive samples, and the rest of the samples are negative samples.

[0037] Figure 2 The flowchart of a robust supervised contrastive learning method in one embodiment of the present invention is shown. DETAILED DESCRIPTION

[0038] The preferred embodiments of the present invention will be described in detail below so that the purpose, features and advantages of the present invention can be more clearly understood. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are only intended to illustrate the essential spirit of the technical solution of the present invention.

[0039] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the relevant art will recognize that the embodiments may be practiced without one or more of these specific details. In other cases, well-known techniques associated with the present application may not be shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0040] References throughout the specification to "one embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of "in one embodiment" or "in an embodiment" in various places throughout the specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any manner in one or more embodiments.

[0041] The specific steps of the present invention are as follows: Step 1: Set up enhanced samples and adversarial samples Enhanced samples: The samples in the dataset are randomly enhanced twice, including cropping, color jittering, and conversion to grayscale, to generate two enhanced views. randomly sampled sample / label pairs, By image enhancement, For the enhanced samples, in, The enhanced sample is and , the corresponding label is and ,and .

[0042] Adversarial samples: Use the PGD attack algorithm to generate perturbations corresponding to enhanced samples. and , generating the corresponding perturbation , the adversarial sample pair obtained is and , that is, two adversarial samples are obtained. The contrastive learning of the present invention is trained on two enhanced views plus two adversarial samples, that is, four enhanced views.

[0043] Step 2: Pre-training phase ResNet is used as the initial model and trained on the CIFAR-10 and CIFAR-100 training sets. Pre-training is completed through six stages: parameter setting, data loading, model and loss function construction, optimizer setting, training loop, and model saving.

[0044] Parameter settings: set the training batch size, number of training rounds, default learning rate, learning rate decay rounds, decay rate, momentum, temperature parameters, saving frequency, etc.

[0045] Data loading: Set the training data set and the mean and standard deviation corresponding to different data sets, and preprocess the image data to make the model training process more stable and accelerate convergence.

[0046] Model and loss function construction: Set the initial model and loss function for training.

[0047] Optimizer settings: Stochastic Gradient Descent (SGD) optimizer with momentum is used.

[0048] Training cycle: set the learning rate for each round of training, calculate the loss and update the model parameters, save the relevant data of each round of training, and enter the next round of training.

[0049] Save model: Save the model according to the set save frequency and save the model when training is completed.

[0050] Step 3: Model optimization By using the pre-trained encoder (denoted as ) to train a classifier (denoted as ), the constraints can be relaxed during the fine-tuning phase to perform adversarial full fine-tuning, which improves the robustness of the model by updating the encoder and classifier during fine-tuning.

[0051] The matters not described in detail in the present invention are all known technologies to those skilled in the art.

[0052] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A robust training method based on supervised contrastive learning, characterized in that: The method includes: The image is transformed by rotation, cropping, color jitter or random grayscale to obtain two enhanced samples and save them, and then the enhanced samples are attacked by PGD or AutoAttack to improve the contrastive learning method; In addition, the enhanced samples, the corresponding adversarial samples and the samples with the same label in the dataset are used as positive samples, and the other samples are used as negative samples for model training. The supervised contrast loss is used as the loss function to obtain a robust model. The following steps are involved: S1, set the enhanced samples: perform two random enhancement operations on the samples in the dataset to generate two enhanced views. randomly sampled sample / label pairs, By image enhancement, For the enhanced samples, in, The enhanced sample is and , the corresponding label is and ,and ; S2, set the adversarial sample: use the PGD attack algorithm to generate the perturbation corresponding to the enhanced sample; for the enhanced sample and , generating the corresponding perturbation , the adversarial sample pair obtained is and ; S3, pre-training step: using ResNet as the initial model, pre-training is performed on the CIFAR-10 and CIFAR-100 training sets; S4, model optimization step: train a classifier on the pre-trained encoder and improve the robustness of the model by performing adversarial full fine-tuning operations, updating the encoder and classifier during fine-tuning.

2. The robust training method based on supervised contrastive learning according to claim 1, characterized in that: The pre-training process described in step S3 includes the following sub-steps: Parameter setting sub-steps: set the training batch size, number of training rounds, default learning rate, learning rate decay rounds, decay rate, momentum, temperature parameters, and save frequency; Data loading sub-step: set the training data set and the mean and standard deviation corresponding to different data sets, and pre-process the image data; Model and loss function construction sub-step: set the initial model and loss function for training; Optimizer setup sub-step: Use stochastic gradient descent SGD optimizer with momentum; Training cycle sub-steps: set the learning rate for each round of training, calculate the loss, update the model parameters, save the relevant data of each round of training and enter the next round of training; Save model sub-step: Save the model according to the set save frequency, and complete the final model save when training is completed.

3. The robust training method based on supervised contrastive learning according to claim 1, characterized in that: The method is based on a learning framework, which includes: a data enhancement module Aug (·), an encoder network Enc (·) and a projection network Proj (·), where: The data augmentation module Aug (·) is used to generate two random augmented samples for the input sample and introduce adversarial attacks based on random data augmentation to generate adversarial samples; The encoder network Enc (·) is used to map the input sample to a feature representation vector and normalize the feature representation vector to the unit hypersphere; The projection network Proj (·) is used to map the feature vector to a new vector space and is discarded after the contrastive training phase.

4. The robust training method based on supervised contrastive learning according to claim 1, characterized in that: This method uses supervised contrast loss as the loss function, which is calculated as: ； in, Representation sample The positive sample set The size of represents the set of all samples, is the set of negative samples of the sample, Represents the similarity calculation between vectors, is the temperature parameter.

5. The robust training method based on supervised contrastive learning according to claim 1, characterized in that: The optimization goal of the adversarial full fine-tuning operation in step S4 is: ； in, is an adversarial perturbation.

6. The robust training method based on supervised contrastive learning according to claim 4, characterized in that: During contrastive learning training, supervised contrast loss is used as the loss function for model training in the context of multi-view batches to enhance the similarity of positive samples and reduce the similarity of negative samples, thereby improving the model classification performance. Specifically: For each original sample, a multi-view batch is constructed through data augmentation and adversarial sample generation, which contains two augmented samples of the original sample and its corresponding adversarial sample; During the training process, according to the contrast loss function, the model learns the similarity representation between positive samples and increases the distance between positive samples and negative samples; By adjusting the temperature parameters, the sensitivity of the model to sample similarity is controlled, and the classification performance of the model is further optimized.

7. An electronic device, characterized in that: include: at least one processor; a memory communicatively coupled to the at least one processor; The memory stores a computer program, which, when executed by the at least one processor, enables the at least one processor to implement the robust training method based on supervised contrastive learning as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed, the robust training method based on supervised contrastive learning as described in any one of claims 1 to 6 is implemented.

Images