Neural network specific misclassification repair method based on disturbance feature recovery

Abstract

The invention relates to a neural network specific misclassification repair method based on disturbance feature recovery, belongs to the technical field of misclassification repair, and solves the problems that in the prior art, the specific category distinguishing capability is insufficient, and the classification accuracy of an original model for misclassification repair is reduced. The method comprises the following specific steps: performing initial classification on a to-be-classified image data set by using a neural network model obtained by training an original image data set; screening out image sample data classified as a category P from the to-be-classified image data set as a doubt set; based on the doubt set and the trained feature mapping model, performing disturbance feature repair on the potential features extracted by the initial feature extractor; using the trained verifier to verify whether the repaired features correspond to a specific misclassification # imgabs0 #, if yes, repairing the image sample data misclassified as a category P in the suspected set, and obtaining a repaired classification result; according to the method, the accuracy of the original model is not greatly reduced, and meanwhile, the repair of specific misclassification is completed.

Description

Technical Field

[0001] The present invention relates to the technical field of misclassification repair, and in particular to a neural network specific misclassification repair method based on disturbance feature recovery. Background Art

[0002] With the development of deep neural networks, image classification has become the core of many practical applications and has great significance in the field of deep learning. However, misclassification in classification models may lead to wrong decisions, and the potential harm caused by the large-scale application of neural networks has also attracted increasing attention. Misclassification of neural network models refers to the situation where the model's predicted category for a given input image does not match the actual category of the image.

[0003] In misclassification, specific misclassification refers to the situation where the model misclassifies samples belonging to a specific category as another specific category. Specific misclassified instances / samples are all clean samples on the original data set. In medical diagnosis tasks, misdiagnosing "early cancer" patients as "healthy" may cause patients to miss the best time for treatment and worsen the disease. Nevertheless, the harm caused by different types of specific misclassification can vary greatly, some specific misclassifications can cause serious consequences, while others are relatively mild.

[0004] In recent years, researchers have developed a series of repair techniques for DNN (Deep Neural Networks) models, but there are still two major limitations: insufficient ability to distinguish specific categories and significant accuracy drop caused by unconstrained global parameter adjustment. For example, mainly for misclassification caused by clean or adversarial inputs, adversarial training is used to complete the pre-trained model trained on the original training set and train on additional generated adversarial sample datasets to enhance the robustness of the model. However, adversarial training relies heavily on additional synthetic samples, which takes a lot of time and computing resources. It is difficult to improve the generalization ability of the model on the clean dataset (i.e., the original dataset) through retraining based on sample synthesis. Therefore, in the absence of additional data, the general misclassification caused by clean input is effectively solved by learning the overall weight of the reference model. This unconstrained global parameter adjustment has a significant impact on the decision boundary of the model, but it is easy to introduce new misclassifications. Repair is achieved by locating the neurons that cause errors and performing neuron-level fine-tuning, which narrows the adjustment range of model parameters and can effectively control the number of misclassifications introduced in the repair process. However, this method will still affect the original classification performance (i.e., accuracy) of the model during the repair process, resulting in a significant decrease in accuracy. Summary of the invention

[0005] In view of the above analysis, an embodiment of the present invention aims to provide a deep neural network specific misclassification repair method based on perturbation feature recovery, so as to solve the problems in the prior art of insufficient ability to distinguish between specific categories and decreased accuracy of misclassification repair without constrained parameter global adjustment.

[0006] The purpose of the present invention is mainly achieved through the following technical solutions: On the one hand, an embodiment of the present invention provides a neural network specific misclassification repair method based on perturbation feature recovery, comprising the following steps: Using a neural network model trained with the original image data set to perform initial classification on the image data set to be classified, the neural network model includes an initial feature extractor for extracting features of the image to be classified and a classifier for classification using the features; Screening out image sample data classified into category P from the to-be-classified image data set as a suspect set; Based on the suspicion set and the trained feature mapping model, performing perturbation feature repair on the potential features extracted by the initial feature extractor to obtain repaired features; The trained verifier is used to verify whether the repaired features correspond to specific misclassifications. If so, the image sample data that is misclassified as category P in the suspicion set is repaired to obtain the repaired classification results; among which, specific misclassification refers to misclassifying image samples belonging to category T into category P.

[0007] Further, repairing the disturbance feature includes: Using the feature mapping model, the perturbed features in the potential features of the suspicion set extracted by the initial feature extractor are repaired into features extracted by a dedicated feature extractor; wherein the dedicated feature extractor is obtained by training with image samples of specific misclassified related categories; The repaired perturbation features are updated to the potential features of the suspicion set to obtain the repaired features.

[0008] Furthermore, the trained verifier is used to verify whether the repaired features correspond to specific misclassifications, including: Inputting the repaired features into the trained verifier; According to the feature that the image sample data misclassified as category P in the suspicion set has category T, reclassifying the restored features; If the repaired feature corresponds to the specific misclassified category T, the label is positive and repair is performed; otherwise, the label is negative and the result of the initial classification is retained.

[0009] Furthermore, the restored classification result is to restore the image sample data with the trained verifier label as the positive class to category T.

[0010] Further, training the verifier includes: Relabeling the original image data set to obtain two categories of image samples; wherein the two categories of image samples include labeling the image sample data of category T as positive class, and labeling the sample data classified into other categories in the original image data set as negative class; The two types of image samples are used as input data sets, and the verifier is trained based on a binary classifier to obtain classification results including the positive class and the negative class.

[0011] Furthermore, the binary classifier is a classifier structure based on the neural network.

[0012] Further, the dedicated feature extractor obtained by training includes: Extracting image samples of specific misclassification-related categories from the original image data set as a retraining data set; wherein the specific misclassification-related categories include the category T and the category P; The classifier of the neural network is frozen, and the initial feature extractor is retrained based on the retraining data set to obtain the dedicated feature extractor.

[0013] Further, training the feature mapping model includes: Extracting potential features of the retraining data set based on the initial feature extractor, and taking perturbation features in the potential features as an input sample set; Based on the dedicated feature extractor, the dedicated features of the retraining data set are extracted, and the features corresponding to the perturbation dimension in the dedicated features are used as the output sample set; wherein the perturbation dimension is the dimension corresponding to the perturbation feature.

[0014] Furthermore, the feature mapping model is trained based on a multi-layer perceptron and a mean square error loss function.

[0015] Furthermore, the neural network includes a convolutional neural network, and the initial feature extractor includes a convolutional layer and a pooling layer.

[0016] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: 1. The present invention proposes to identify disturbance features based on a specific misclassified suspicion set, restore the disturbance features through a feature mapping model, effectively eliminate redundant information, and repair the misclassified features in combination with a verifier, which not only enables the original model to achieve a better repair effect, but also keeps the accuracy level from decreasing significantly; 2. By performing repair only on the suspected subset (i.e., the suspected set) screened in the original image dataset, the scope of decision boundary adjustment is narrowed, thereby protecting the decision boundaries trained between other categories from interference, and protecting the accuracy of the original model from being severely reduced due to decision boundary adjustment to the greatest extent; 3. The training of the feature mapping model is carried out with the help of a dedicated feature extractor. The initial feature extractor is retrained on a subset containing only specific misclassified related categories to obtain a dedicated feature extractor, which is used to improve the model's ability to distinguish between category T and category P; 4. The model classification performance is enhanced through pluggable feature recovery mapping and validators without directly adjusting the model weights, avoiding additional computational and storage overhead.

[0017] In the present invention, the above-mentioned technical solutions can also be combined with each other to achieve more preferred combination solutions. Other features and advantages of the present invention will be described in the subsequent description, and some advantages can become obvious from the description, or can be understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components; Figure 1 It is a flow chart of a method for repairing specific misclassification of a deep neural network based on perturbation feature recovery according to an embodiment of the present invention; Figure 2 It is a technical solution framework diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0020] A specific embodiment of the present invention discloses a neural network specific misclassification repair method based on perturbation feature recovery, such as Figure 1 As shown, the following steps are included: Step S1, using a neural network model trained with an original image data set to perform initial classification on the image data set to be classified, wherein the neural network model includes an initial feature extractor for extracting features of the image to be classified and a classifier for classification using the features; Step S2, screening out image sample data classified into category P from the image data set to be classified as a suspect set; Step S3, based on the suspected set and the trained feature mapping model, performing perturbation feature repair on the potential features extracted by the initial feature extractor to obtain repaired features; Step S4, using the trained verifier to verify whether the repaired features correspond to specific misclassifications, if so, repair the image sample data in the suspected set that is misclassified as category P to obtain the repaired classification results; wherein, the specific misclassification refers to misclassifying image samples belonging to category T into category P.

[0021] Through the above method, by screening the suspicion set in the original data set for repair, adjusting the local decision boundary for the relevant category, and using the feature mapping model to repair the potential features extracted by the initial feature extractor, the ability to distinguish specific categories is enhanced, and the verifier is used to correct the potential specific misclassification in the suspicion set, which realizes the correction of specific misclassification in the multi-classification model. At the same time, the precision loss caused by the repair process is reduced to ensure the accuracy of the repair.

[0022] Specifically, in step S1, the neural network can be a convolutional neural network, and the initial feature extractor is responsible for extracting machine-understandable representations (i.e., latent features) from the original data set, usually including convolutional layers and pooling layers. The classifier is responsible for distinguishing the extracted features and outputting the final predicted category, usually consisting of a fully connected layer. In fact, the output of the feature extractor can be regarded as the input of the classifier. The occurrence of a specific misclassification can be attributed to the failure of the machine learning model to accurately distinguish its true category from its incorrectly predicted category, which is called the related category. The specific misclassification is represented as , where category T and category P represent the true label and wrong prediction label of this specific misclassification, that is, the image sample belonging to category T is misclassified into category P. Obviously, for a given specific misclassification, its occurrence is only related to these two categories.

[0023] Most existing methods only fix specific misclassifications by directly adjusting the parameters of the pre-trained model without improving the model's ability to identify the corresponding categories. In order to ensure the overall classification accuracy, the feature extractor of the multi-classification neural network model needs to extract common features that are applicable to distinguishing all categories. It can be regarded as a redundant feature extractor (RFE), which contains redundant features that describe the difference between other categories, but cannot extract all the differences required to effectively separate two specific categories, thereby constraining the distinction between specific categories; on the other hand, unconstrained global adjustment of the pre-trained model parameters will destroy the precise classification boundaries that have been trained before between other categories. This interference often causes samples that were originally correctly classified (i.e., samples that are predicted correctly but have low prediction confidence) to be misclassified near the decision boundary, resulting in the introduction of new misclassifications.

[0024] Based on the above problems, the present invention proposes an efficient neural network graph specific misclassification repair method (Specific Misclassification Immune Repair, SMiR), such as Figure 2 As shown in the figure, the dotted arrows indicate the framework flow of the repair model construction phase, and the solid arrows indicate the framework flow of the forward reasoning phase. SMiR contains three main mechanisms: perturbation feature location and recovery, suspicion set screening, and verifier construction.

[0025] Specifically, in step S2, in order to solve the problem of global adjustment of model parameters, SMiR limits the adjustment of decision boundaries, divides the original dataset according to the original prediction output of the model, and adjusts the object of the repair operation to a small local subset containing target-specific misclassifications.

[0026] For example, for a specific misclassification case , the samples predicted by the original model as P are identified as potential misclassified samples that need to be repaired. The image instance samples include the parts that are actually labeled as P and the parts that are misclassified as P. Therefore, the set consisting of these samples is called the suspicion set, and The remaining samples are regarded as credible sets and are represented by express.

[0027] Assume that the dataset D to be classified is class-balanced and the target misclassification to be repaired is , then the suspected set after screening The true category of most samples in , which can be approximately considered as the suspicion set Only about (C is the total number of categories in the data set). In other words, by filtering the suspect set, The possibility of introducing misclassification into samples is reduced (for example, for the CIFAR-10 dataset, the ratio is 90%). In addition, the number of samples required for feature recovery is greatly reduced, which significantly reduces the computational cost.

[0028] Specific misclassifications that require explanation This is caused by the model decision boundary mistakenly being more inclined to the wrong category P rather than the correct category T. Repairing it is essentially a compensatory adjustment to the decision boundary. However, unconstrained adjustment of the entire decision boundary will inevitably damage the originally good classification boundaries between other categories. Since the credible set does not contain specific misclassified instance samples, no additional operations are performed on it. By applying the repair operation only to the suspected set, the degradation of the model's classification performance for other categories is avoided.

[0029] Specifically, in step S3, the located disturbance features are restored through the trained feature mapping model to reduce the adverse effects of redundant information. Performing disturbance feature repair on the extracted potential features includes: S311. Using the feature mapping model, the perturbation features in the potential features of the suspicion set extracted by the initial feature extractor are repaired into features extracted by a dedicated feature extractor (DFE); wherein the features seriously affected by redundant information are regarded as perturbation features.

[0030] S312: Replace the features of the corresponding dimensions in the latent features of the suspicion set with the repaired disturbance features, and keep the features of other dimensions unchanged, to obtain the updated latent features, which are the repaired features.

[0031] The dedicated feature extractor obtained by training with image samples of specific misclassified related categories includes: S321, extracting image sample data of a specific misclassified related category from the original image data set of the neural network model as a retraining data set ( That is, the original image dataset only contains a subset of image sample data of category T and category P); S322, freezing the classifier component in the neural network model, copying the initial feature extractor in the neural network model, and retraining the dataset based on the , retrain the RFE component to obtain DFE.

[0032] Furthermore, the feature mapping model is trained, including: Extracting potential features of the retraining data set based on the initial feature extractor, and taking perturbation features in the potential features as an input sample set; Based on the dedicated feature extractor, the dedicated features of the retraining data set are extracted, and the features corresponding to the perturbation dimension in the dedicated features are used as the output sample set; wherein the perturbation dimension is the dimension corresponding to the perturbation feature.

[0033] Exemplarily, a lightweight feature mapping model is trained based on a multi-layer perceptron and a mean square error loss function. In the forward inference phase, the trained lightweight feature mapping model is used to individually restore the localization dimension of the perturbed feature.

[0034] It should be noted that a dedicated feature extractor is used to extract features of relevant categories in a given misclassification to solve the problem of constraining the distinction between two specific categories due to the presence of redundant features in the features extracted by the feature extractor. The features extracted by DFE are not directly applied to the model, but are combined with the features extracted by RFE to identify and restore those feature dimensions that are severely perturbed. DFE is only used to locate and restore perturbed features during the repair process, thus avoiding additional computational and storage overhead during forward reasoning.

[0035] Furthermore, the model interpretability technology (Deep Learning Important Features, DeepLift) is used to quantify the contribution of each dimensional feature to the correct classification of samples of a specific category; the contribution values ​​of each dimensional feature extracted by the two feature extractors for categories T and P before and after denoising are compared; according to the characteristic that the higher the contribution value of each dimensional feature extracted by DFE is compared with that of RFE, the more this feature dimension can contribute to the correct identification of the corresponding category after denoising, and the features with large contribution increase after denoising are positioned as perturbation features; among which, DFE can be regarded as the result of RFE after denoising for categories T and P.

[0036] Specifically, in step S4, in order to correct a specific misclassification, using a verifier to verify whether the restored sample features correspond to the specific misclassification to be corrected includes: S41, inputting the repaired features into the trained verifier; S42, reclassifying the restored features according to whether the image sample data in the suspicion set that is misclassified as category P has features of category T; S43. If the repaired feature corresponds to a specific misclassified category T, the label is positive and repair is performed; otherwise, the label is negative and the initial classification result is retained.

[0037] It should be noted that since all suspected samples input to the verifier are predicted to be of category P, the verifier only needs to check whether the true label of the input sample is T, that is, whether it is a specific misclassification to be repaired; if so, repair it. The repair behavior is to repair the image sample data labeled as positive by the verifier to category T, and the obtained classification result is the classification result after repair.

[0038] Further, training the verifier includes: Relabel the original image data set, relabel the samples with the original label T as positive class (label 1), and relabel the non-T samples as negative class (label 0), to obtain two types of image samples; Take two types of image samples as input data sets and train the verifier based on the binary classifier , and obtain classification results corresponding to the two categories; wherein the architecture of the binary classifier is determined based on the classifier structure of the neural network.

[0039] For example, the m-dimensional features recovered from the suspicion set are used as the input of the verifier. For any data pair (x,y), the output of the verifier is as follows: , Among them, samples with an output of 1 will be rejected by the verifier, indicating that the corresponding samples are identified as specific misclassifications. The predicted labels of these rejected inputs are corrected to T. For samples that are not rejected (the verifier output is 0), the model's original prediction results are not affected. The repaired model is recorded as , then for any sample pair (x, y) from the original dataset D, the final predicted label is as follows: , By taking the multi-classification suspicion set Convert to a binary classification dataset of One-Vs-Rest (OVR) . Original Model Misclassification in Equivalent to a validator Misclassification in . With the help of the validator, The repair is converted into Repair.

[0040] It should be noted that most of SMiR's computational overhead is spent on the construction phase of the repair model. The only additional operation required in the forward reasoning phase is to restore the perturbed features in the suspicion set and verify and repair the restored features using the verifier.

[0041] In addition, SMiR can be applied to software defect prediction for misclassification repair. Existing software defect prediction proposes to classify CWE (common weakness enumeration) defects into five categories: input validation and data integrity issues, calculation and code injection issues, authentication and authorization issues, security configuration and management issues, and buffer issues.

[0042] According to the above theory, the above five types of software defect labels are divided according to the severity, and the defect type ranking can be obtained as follows: Computing and code injection issues: The most serious, because code injection can allow attackers to remotely execute malicious code, directly threatening system security and data integrity.

[0043] Authentication and authorization issues: The next most serious issue is that these issues can lead to unauthorized access and pose a direct threat to data and system functionality.

[0044] Input validation and data integrity issues: These issues allow malicious data to be entered into the system, which may cause the system to behave erratically or data to become corrupted.

[0045] Security configuration and management issues: While they may not be directly exploitable to execute code, improper configuration and management can be used to bypass security measures.

[0046] Buffer issues: Usually related to system stability and data security, they may cause system crashes or be used to execute code. However, compared with the previous issues, they are more complex and have more restricted conditions for exploitation, and are the least severe.

[0047] According to the above ranking, each type of software defect is labeled in order of severity and the classification of software defects is predicted, including labeling the most serious calculation and code injection problems as 4 and the mildest buffer problems as 0, so that the label order is exactly consistent with the increasing order of severity. This means that any category with a larger label value is misclassified as a category with a smaller label value, that is, misclassifying a category with a higher severity as a category with a lower severity is a safety-critical misclassification. Misclassifying "calculation and code injection problems" as "buffer problems" is a safety-critical misclassification because calculation and code injection problems allow attackers to directly run malicious code and cause serious damage to the system. If misclassified as a buffer problem, these serious security threats may not be identified and prevented in a timely manner, thereby bringing higher security risks.

[0048] For the misclassification of "Calculation and Code Injection Issue" as "Buffer Issue", the fix for this specific misclassification using SMiR includes: Consider "computation and code injection problems" as category T, and "buffer problems" as category P; use the software function dataset as the training set of the neural network model, and complete the repair of specific misclassifications according to the method described in SMiR. Among them, the software function dataset mainly comes from open source projects with sufficient activity on the GitHub website. For example, Apache JMeter is a load testing tool with 123,000 lines of code. When predicting multi-label software defects, all Java functions in the software code of the open source project can be statically analyzed, and the static code metrics can be extracted as function features. For defective functions, they are labeled according to the CWE defect category, and for non-defective functions, they are uniformly labeled as 0. Through the above process, a multi-label defect prediction dataset of open source projects is established, in which each function corresponds to a piece of data. The static code metrics of the function evaluate the complexity of the function, the number of lines of code, and other features as data input, and the defect information corresponding to the function is output. The neural network is trained on the constructed dataset to realize the classification of software defect categories.

[0049] It should be noted that the above severity ranking is not strictly valid, but is based on the historical experience of software testers and developers. In order to verify the superiority and effectiveness of the present invention in repairing specific misclassifications, the following experiments were conducted: Three widely used datasets are used to evaluate the repair of specific misclassifications. In the experiment, the training dataset is used to guide the model repair, and the test dataset is used to evaluate the repair effect.

[0050] Fashion-MNIST (FM): FM is an image dataset containing ten categories of clothing. It has 60,000 training samples and 10,000 test samples, each of which is a 32×32 grayscale image.

[0051] CIFAR10 (C10): C10 is an image dataset containing ten categories, including vehicles and common animals. It contains 50,000 training samples and 10,000 test samples, and each image is a 32×32 pixel RGB three-channel color picture.

[0052] SVHN: SVHN is an image dataset consisting of house number images, where each image depicts a number from 0 to 9, and each image is a 32×32 pixel RGB three-channel color image. The dataset contains 73,257 training samples and 26,032 test samples.

[0053] Based on 5 different pre-trained DNN models, FM-SimpleNet (fully connected model) is used for the FM dataset, and C10-SimpleNet and C10-CNN (both are convolutional neural network CNN models) are used for the C10 dataset. Specifically, the SVHN and C10 datasets have the same image resolution and data structure, so two convolutional neural network (CNN) models (SVHN-SimpleNet and SVHN-CNN) are trained, and their architectures are the same as the model architectures applied to C10.

[0054] This experiment uses weight decay in training. The initial value of the learning rate is , in a total of 200 training rounds, the decay is 0.1 times every 50 rounds (epochs), and the batch size (batchsize) is 256. After the training is completed, the model slice of the training round with the highest test accuracy is selected as the final training result among the 200 rounds. As shown in Table 1, the detailed information of each model (K in the parameter quantity represents thousands of levels, and M represents millions of levels): Table 1

[0055] In a given specific misclassification Under , the repair rate (RR) and introduced misclassification (IM) are used to evaluate the repair, which is the ratio of the number of repaired specific misclassified samples to the number of original specific misclassified samples. Indicates the misclassification The original misclassified sample set. Then RR is expressed as: , IM is defined as the increase in overall misclassification after model repair. This indicator is used to evaluate the degree of damage to the model classification performance caused by the repair process. The calculation formula is: , in, Represent the misclassified sample sets of the original model and the repaired model respectively.

[0056] In order to verify the effectiveness of the proposed method, a comparative experiment between SMiR and the baseline method was designed. Arachne, a heuristic neural network repair method, was used as the baseline method. SMiR and the baseline method were applied to repair the three most common (i.e., the most frequent) specific misclassifications in each model (for example, top1 in Table 1 represents the most common misclassifications), aiming to minimize the deviations caused by potential random factors and obtain more stable results.

[0057] It should be noted that the repair process of a specific misclassification will inevitably damage the overall accuracy of the model. Therefore, simply comparing the repair rate RR or the number of introduced misclassifications IM cannot fully reflect the performance of the repair method. For the sake of rigor, it is believed that a repair method is superior to other methods only when it can achieve a higher repair rate and reduce the introduction of misclassifications. However, it is difficult to directly compare these two indicators that are negatively correlated. For example, it is difficult to determine whether a method that achieves a higher repair rate but introduces significantly more misclassifications is better than a method that achieves a lower repair rate but introduces very few misclassifications.

[0058] In order to be able to make a comprehensive comparison between the two metrics, the results of the baseline method Arachne (the only existing technique specifically designed to eliminate specific misclassifications) are used as a benchmark. Then, the parameters of the present invention are adjusted to achieve similar repair rates. Each experimental setting is repeated five times with different random seeds and the average results are reported. The specific experimental settings are as follows: SMiR: The SMiR validator is trained using the stochastic gradient descent (SGD) optimizer with a batch size of 1024, a cosine learning rate scheduler, and different initial learning rates according to the complexity of the model: , for C10 - SimpleNet is , for C10-CNN is , for SVHN-SimpleNet is , for SVHN-CNN is After 100 training rounds, the learning rate is uniformly reduced to .

[0059] Arachne: The same data partitioning strategy as in this experiment is used to perform specific misclassification repair. As shown in Table 2, the experimental results are compared: Table 2

[0060] Among them, RR represents the repair rate (presented as a percentage), and IM represents the misclassification introduced during the repair process. Table cells with light gray backgrounds indicate that the corresponding method has achieved the best performance in both RR and IM. The results displayed in bold mean that the corresponding method has improved at least one of the indicators RR or IM.

[0061] As can be seen from Table 2, SMiR achieves the best average performance on all five models. For example, in the C10-SimpleNet model, SMiR outperforms Arachne, with an 8.4% improvement in repair rate while introducing 37.4% fewer misclassifications. However, on the two SVHN-based models, Arachne only corrects 8.9% and 5.1% of the errors, which is significantly lower than the 30.3% and 22.5% achieved by SMiR. This is mainly due to the fact that the evaluation in the search process relies on a sufficient number of specific misclassified instances. However, the high training accuracy of these two models leads to the scarcity of such instances in the training set, resulting in inaccurate guidance of the patch search process. However, SMiR is able to improve the model's recognition ability for specific categories by restoring perturbed features, thereby improving the misclassification repair effect in the absence of specific misclassified samples.

[0062] SMiR achieved the best performance in 13 of the 15 specific misclassification cases investigated. Even in two exceptional cases, SMiR showed excellent performance. When repairing the 3rd most frequent error of the SVHN-CNN model, Arachne achieved the lowest number of introduced misclassifications (3.8), but only corrected 0.6% of the misclassifications. In contrast, SMiR corrected 37 times more misclassifications at the cost of only 179% more introduced misclassifications. For the 2nd most frequent error of the C10-CNN model, Arachne introduced the fewest misclassifications (-7.0), but only achieved a 28.0% repair rate.

[0063] In summary, SMiR achieves a higher repair rate in most cases with minimal loss of standard accuracy. Even when the training set lacks enough specific misclassified instances to be repaired, SMiR can always maintain a high repair rate.

[0064] Compared with the prior art, the present embodiment provides a neural network specific misclassification repair method based on perturbation feature recovery, which improves the repair accuracy in specific misclassification situations by screening a specific misclassification suspicion set based on the original image data set, using the trained feature mapping model to complete the feature repair, and using the verifier to perform the final repair on the feature-repaired samples. On the one hand, the method uses a dedicated extractor to locate the perturbation features and uses the located perturbation features to train the feature mapping model, thereby improving the model's ability to distinguish between category T and category P; on the other hand, by only screening a subset in the original data set for repair, the scope of decision boundary adjustment is narrowed, and the accuracy of the original model is protected to the greatest extent.

[0065] Those skilled in the art will appreciate that all or part of the processes of the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, wherein the computer-readable storage medium is a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0066] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A neural network specific misclassification repair method based on perturbation feature recovery, characterized in that: The steps include: Using a neural network model trained with the original image data set to perform initial classification on the image data set to be classified, the neural network model includes an initial feature extractor for extracting features of the image to be classified and a classifier for classification using the features; Screening out image sample data classified into category P from the to-be-classified image data set as a suspect set; Based on the suspicion set and the trained feature mapping model, performing perturbation feature repair on the potential features extracted by the initial feature extractor to obtain repaired features; The trained verifier is used to verify whether the repaired features correspond to specific misclassifications. If so, the image sample data that is misclassified as category P in the suspicion set is repaired to obtain the repaired classification results; among which, specific misclassification refers to misclassifying image samples belonging to category T into category P.

2. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 1, characterized in that: Performing the disturbance feature repair includes: Using the feature mapping model, the perturbed features in the potential features of the suspicion set extracted by the initial feature extractor are repaired into features extracted by a dedicated feature extractor; wherein the dedicated feature extractor is obtained by training with image samples of specific misclassified related categories; The repaired perturbation features are updated to the potential features of the suspicion set to obtain the repaired features.

3. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 2, characterized in that: Use the trained validator to verify whether the repaired features correspond to specific misclassifications, including: Inputting the repaired features into the trained verifier; Reclassifying the restored features according to whether the image sample data misclassified as category P in the suspicion set has features of category T; If the repaired feature corresponds to the specific misclassified category T, the label is positive and repair is performed; otherwise, the label is negative and the result of the initial classification is retained.

4. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 3, characterized in that: The repaired classification result is to repair the image sample data whose label of the trained verifier is positive class to category T.

5. A neural network specific misclassification repair method based on perturbation feature recovery according to any one of claims 1 to 4, characterized in that: Training the validator includes: Relabeling the original image data set to obtain two categories of image samples; wherein the two categories of image samples include labeling the image sample data of category T as positive class, and labeling the sample data classified into other categories in the original image data set as negative class; The two types of image samples are used as input data sets, and the verifier is trained based on a binary classifier to obtain classification results including the positive class and the negative class.

6. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 5, characterized in that: The binary classifier is a classifier structure based on the neural network.

7. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 2, characterized in that: The dedicated feature extractor obtained by training includes: Extracting image samples of specific misclassification-related categories from the original image data set as a retraining data set; wherein the specific misclassification-related categories include the category T and the category P; The classifier of the neural network is frozen, and the initial feature extractor is retrained based on the retraining data set to obtain the dedicated feature extractor.

8. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 7, characterized in that: Training the feature mapping model includes: Extracting potential features of the retraining data set based on the initial feature extractor, and taking perturbation features in the potential features as an input sample set; Based on the dedicated feature extractor, the dedicated features of the retraining data set are extracted, and the features corresponding to the perturbation dimension in the dedicated features are used as the output sample set; wherein the perturbation dimension is the dimension corresponding to the perturbation feature.

9. A neural network specific misclassification repair method based on perturbation feature recovery according to claim 8, characterized in that: The feature mapping model is trained based on a multi-layer perceptron and a mean square error loss function.

10. The neural network specific misclassification repair method based on perturbation feature recovery according to claim 1, characterized in that: The neural network includes a convolutional neural network, and the initial feature extractor includes a convolutional layer and a pooling layer.

Images