Attack resisting method through multi-feature competitive mixing and logit boundary expansion

Abstract

The invention discloses an attack resisting method through multi-feature competitive mixing and logit boundary expansion, and belongs to the field of computer vision, and the method comprises the steps: obtaining the local features of a randomly cut image and the features of a target class generated through a diffusion model according to the same batch of images and the cue word of the target class; original image global features, image local features and target features are stored in a deeper level of the substitution model; in the iterative optimization process, the three features and the upper image features are mixed according to a random competition ratio at a certain probability to form image features with rich disturbance and strong mobility; and performing gradient optimization on the new sample according to a directional attack loss function containing a penalty term, and performing repeated iteration to obtain a final adversarial sample. According to the method, the problems of low disturbance diversity and poor mobility in the field of resisting the directional attack of the sample are solved, and the mobility of the directional attack is greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to a confrontation attack method by mixing multiple features competitively and expanding logit boundaries. Background Art

[0002] In today's era of rapid technological development, the security of AI systems is an important issue. In practical applications, AI systems may be exploited by malicious attackers, resulting in incorrect system output or unpredictable behavior. Adversarial sample attacks are a type of attack against AI systems that can deceive the judgment of AI systems and cause them to produce incorrect outputs by making slight modifications to input data. Adversarial sample attacks pose a significant threat to the security of AI systems.

[0003] In order to improve the security of the system, researchers began to explore various adversarial sample attack methods, promote the research of adversarial sample defense methods, and improve the stability and robustness of the system. At present, there are few research methods in the field of adversarial sample targeted attacks, mainly based on features and losses. Feature-based methods use features in different ways to achieve transferability, such as measuring the similarity between feature mappings, maximizing feature differences, etc. Loss-based methods explore new losses to achieve the purpose of improving transferability, such as Po+Trip loss, Logit loss, etc. Although these methods have shown great potential in improving the transferability of adversarial samples, there are still several problems to be solved: First, when generating adversarial samples, the existing methods optimize a single feature and lack perturbation diversity, which limits transferability. Second, in the field of targeted attacks, the logits boundary between the target class and the non-target class has a great impact on transferability. But this information is not fully utilized. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide an adversarial attack method through multi-feature competitive mixing and expanding the logit boundary. By utilizing multi-faceted image feature information, performing random mixing in a deep neural network model, and continuously expanding the logit boundary between the target class and the non-target class during optimization, adversarial samples are gradually iterated to achieve the purpose of improving the directional transferability of adversarial samples.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] A method for adversarial attack by mixing and expanding logit boundaries through multi-feature competition, comprising the following steps:

[0007] Step 1: According to the same batch of images and the prompt words of the target class, the randomly cropped local features of the image and the target class features generated by the generative diffusion model are obtained;

[0008] Step 2: store the original image global features, image local features, and target class features into a deeper level of the alternative model;

[0009] Step 3: During the iterative optimization process, the original image global features, image local features, target class features, and upper-layer image features are mixed at a random competition ratio with a certain probability to form image features with rich disturbance and strong migration.

[0010] Step 4: Perform gradient optimization on the new sample based on the targeted attack loss function including the penalty term.

[0011] Step 5: Repeat the iteration to obtain the final adversarial sample.

[0012] The further improvement of the technical solution of the present invention is that: in step 1, the local features of the image are obtained by randomly cropping the original image; the target class features are obtained by inputting the generative diffusion model according to the prompt word of the target class, and the key part of the target class features is extracted according to the Grad-cam algorithm to pave the way for subsequent disturbance optimization;

[0013] The formula for obtaining target class features based on target class prompt words is as follows:

[0014] f t =CAM(SDM(prompt))

[0015] Among them, CAM(·) is the Grad-cam function, SDM(·) is the generative diffusion model, prompt is the prompt word of the target class, and f t is the generated target class feature information.

[0016] A further improvement of the technical solution of the present invention is that in step 2, only the forward inference process of two alternative models is consumed to store local image features and target class features; when the global features of the original image enter the alternative model and are executed in a multi-feature competitive mixing module in a certain layer, they are fused with the upper layer features, local image features and target class features at a certain mixed competition ratio to form new image features with rich disturbance information.

[0017] A further improvement of the technical solution of the present invention is that in step 3, after the local features of the image and the target class features are stored in the multi-feature competitive hybrid module of the substitution model, adversarial sample optimization and generation can be performed; the specific process is as follows:

[0018] S3.1, firstly, the original image is randomly transformed into an input to improve the input diversity;

[0019] S3.2, performing translation invariance processing on the randomly input transformed image to further improve input diversity;

[0020] S3.3, the image after random input transformation and translation invariance processing is input into the substitution model for optimization.

[0021] A further improvement of the technical solution of the present invention is that in S3.3, the specific optimization process includes the following contents:

[0022] S3.3.1 The process of optimizing adversarial samples with substitution models is carried out in a deep multi-feature competitive hybrid module. During the optimization, a random number between 0 and 1 is first generated. If this random number is less than the pre-set probability value, the multi-feature competitive hybrid module is entered to perform the following optimization operations to prevent excessive interference and reduce the attack performance.

[0023] S3.3.2, the global features of the original images of the same batch and the random local features of the images are shuffled and reorganized to pave the way for the subsequent multi-feature fusion;

[0024] S3.3.3, generate a 0-1 random number again. If this random number is less than or equal to the preset target class feature mixing probability value, the global features of the original images of the same batch, the local features of the images, the target class features, and the input features from the previous network layer are fused; conversely, if this random number is greater than the target class feature mixing probability value, the global features of the original images of the same batch, the local features of the images, and the input features from the previous network layer are fused, that is, the target class features are not fused together to prevent excessive interference; the calculation formula for the competitive hybrid optimization of the four is as follows:

[0025] f si c =S(f i c )

[0026] f si l =S(f i l )

[0027]

[0028] f′ i =α i f i +(1-α i )f i p

[0029] Among them, S(·) is a random shuffle function, i refers to the current level of the replacement model, and the original image feature f i c Disrupted to f si c , similarly, the local feature f il Disrupted to f si l , β i , γ i is the weight parameter of the local image features and the target class features; f i p Yes si c 、f si l With f i t The fusion result, f i is the output feature of the previous layer, α i Yes i With f i p The weight of linear interpolation fusion;

[0030] S3.3.4, in the network layer that meets the optimization conditions, the specific operation is to generate a set of random competitive mixing weight ratios, add and mix three / four features with corresponding weights according to probability, and use them as input features of the next network layer;

[0031] S3.3.5, the current network layer optimization is completed, and the next network layer optimization is started.

[0032] A further improvement of the technical solution of the present invention is that in step 4, after the current iteration is completed, when calculating the optimization gradient, the logit boundary between the target class and the non-target class has a great influence on the result; the specific process is as follows:

[0033] S4.1, first redefine the prediction result logit of the alternative model, the formula is as follows:

[0034]

[0035] Among them, z i is the prediction result of the alternative model, Yes i The top-1 after sorting is the logit value of the target class. Yes i The weighted sum of the first K non-target class logits after sorting;

[0036] S4.2, calculate the boundary penalty loss L based on the redefined logit KMB-P ;

[0037] S4.3, based on the predicted classification results and the original image label, use the Logit loss function to calculate the original class loss L o , so that the predicted category is far away from the true category. The calculation formula is as follows:

[0038] Lo =Logit(y p ,y)

[0039] Among them, Logit(·) is the classification loss function, y p is the prediction result of the alternative model, and y is the true label of the image;

[0040] S4.4, finally the penalty loss L KMB-P With the original class loss L o The total loss of the targeted attack including the penalty term is obtained by adding a certain weight ratio, and the optimization gradient is calculated. The calculation formula is as follows:

[0041] L LMP =L KMB-P +λ×L o

[0042] Where λ is L o The weight parameter of .

[0043] A further improvement of the technical solution of the present invention is that in step 4.2, the following steps are specifically included:

[0044] S4.2.1, sort the redefined logits and calculate the proportion of the first K non-target classes to the first K+1 classes. The calculation formula is as follows:

[0045]

[0046] in, Yes i The top-1 value after sorting;

[0047] S4.2.2, calculate the top K non-target class logits after sorting, and multiply them with θ as the penalty term L of the loss function KMB , the calculation formula is as follows:

[0048]

[0049] Among them, CE(·) represents the Cross-Entropy loss function;

[0050] S4.2.3, calculate L with penalty term and expanded logit boundary KMB-P The loss is calculated as follows:

[0051]

[0052] Among them, μ is the weight parameter of the penalty term, It is the weighted sum of the first K non-target class logits after sorting.

[0053] Due to the adoption of the above technical solution, the technical progress achieved by the present invention is:

[0054] 1. Based on the idea of ​​deep learning, the present invention constructs a multi-feature competitive hybrid module and inserts it into a deeper level of the substitution model, so as to perturb the image features at a high level and enrich the perturbation diversity.

[0055] 2. The present invention redefines the output result logit of the substitution model, continuously expands the distance between the non-target class and the target class logits, and provides a precise direction for targeted attack optimization.

[0056] 3. The present invention takes into account the negative impact of non-target classes during iteration in targeted attacks, and uses the weighted sum of the first K non-target class logits as a penalty term, which greatly improves the attack success rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 This is a process of a counterattack method provided in an embodiment of the present invention by mixing multiple features competitively and expanding the logit boundary. Figure 1 ;

[0059] Figure 2 This is a process of a method for countering an attack by mixing multiple features and expanding the logit boundary provided in an embodiment of the present invention. Figure 2 ;

[0060] Figure 3 is a flow chart of using prompt words to enable a diffusion model to generate target class features in an embodiment of the present invention;

[0061] Figure 4 It is a schematic diagram of a multi-feature competition mixing module in an embodiment of the present invention. DETAILED DESCRIPTION

[0062] It should be noted that the terms "including" and "having" and any variations thereof in the specification and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or apparatus.

[0063] The present invention is further described in detail below with reference to the accompanying drawings and embodiments:

[0064] like Figure 1 , 2 As shown in FIG. 1 , a method for adversarial attack by mixing and expanding the logit boundary through multi-feature competition is provided. The targeted attack method used is mainly based on two aspects: a multi-feature competition mixing module and a targeted attack loss with a penalty term. Specifically, the following steps are included:

[0065] Step 1, obtain features: According to the original image features, obtain the randomly cropped local features. In addition, according to the target class prompt word input into the generative diffusion model (SDM), obtain the target class features, and extract the key parts of the target class features according to the Grad-cam algorithm, paving the way for subsequent perturbation optimization;

[0066] The formula for obtaining features based on the target class prompt word is as follows:

[0067] f t =CAM(SDM(prompt))

[0068] Among them, CAM(·) is the Grad-cam function, SDM(·) is the Stable Diffusion Model diffusion model, prompt is the prompt word of the target class, and f t is the generated target class feature information.

[0069] Combine the following Figure 3 The process of sampling and acquiring key features from the generative diffusion model using target class prompt words in the present invention is described as follows:

[0070] like Figure 3 As shown in the figure, the prompt word of the target class is first input into the text encoder for encoding to form a text vector, which is continuously iterated in the input generative diffusion model. Then, the image features are generated by the decoder. Finally, the key part of the features is extracted by the Grad-cam algorithm as the final target class features and stored in the multi-feature competitive hybrid module of the substitution model, paving the way for subsequent feature fusion and perturbation optimization.

[0071] Step 2, store features: store local image features and target class features in different layers deeper than the alternative model. This is because compared to perturbing low-level features, perturbing high-level features is more conducive to changing the areas of the original image that have a greater impact on the classification results, achieving higher transferability.

[0072] The above process only consumes the forward inference process of two alternative models to store local features and target class features. When the global features of the original image enter the alternative model and execute the multi-feature competition mixing module in a certain layer, they are fused with the upper layer features, local image features and target class features at a certain mixed competition ratio to form a new image feature with rich perturbation information.

[0073] Combine the following Figure 4 The multi-feature competition hybrid module and optimization process used in the present invention are explained.

[0074] Step 3, optimization iteration: Figure 4 As shown in FIG. 1 , the multi-feature competition hybrid module receives the original image global features, image local features and target class features. When the upper layer image features enter the multi-feature competition hybrid module, they are fused with the original image global features, image local features and target class features.

[0075] In the iterative optimization process, the same batch of images are first transformed, and then the global features of the original images are randomly shuffled and reorganized in the deep neural network model, which is conducive to improving the confusion of adversarial samples and the success rate of attacks. The three features are mixed with a certain probability according to the random competition ratio to form image features with rich perturbations and strong migration, and enter the lower layer for further optimization;

[0076] It should be noted that since the target class features generated by the generative diffusion model are different from the global feature distribution of the original image, in order to prevent excessive disturbance, the target class features are also fused with the other features with a certain probability.

[0077] After storing the local features of the image and the target class features in the multi-feature competitive hybrid module of the substitution model, adversarial sample optimization and generation can be performed. The specific process is as follows:

[0078] S3.1, firstly, the original image is subjected to random input transformation (RDI) to improve input diversity.

[0079] S3.2, performs translation invariance (TI) processing on the randomly input transformed image to further improve the input diversity.

[0080] S3.3, the image after random input transformation and translation invariance processing is input into the substitution model for optimization.

[0081] The specific process is as follows:

[0082] S3.3.1 The process of optimizing adversarial samples with substitution models is carried out in a deep multi-feature competitive hybrid module. During optimization, a random number between 0 and 1 is first generated. If this random number is less than the pre-set probability value, the multi-feature competitive hybrid module is entered to perform the following optimization operations. This is done to prevent excessive interference and reduce attack performance.

[0083] S3.3.2, shuffle and reorganize the global features of the original images of the same batch and the random local features of the images, paving the way for the subsequent multi-feature fusion.

[0084] S3.3.3, generate a 0-1 random number again. If this random number is less than or equal to the preset target class feature mixing probability value, the global features of the original images of the same batch, the random local features of the image, the target class features, and the input features from the previous network layer are fused. On the contrary, if this random number is greater than the target class feature mixing probability value, the global features of the original images of the same batch, the random local features of the image, and the input features from the previous network layer are fused, that is, the target class features are not fused together to prevent excessive interference.

[0085] The calculation formula of the four-competitive hybrid optimization is as follows:

[0086] f si c =S(f i c )

[0087] f si l =S(f i l )

[0088]

[0089] f′ i =α i f i +(1-α i )f i p

[0090] Among them, S(·) is a random shuffle function, i refers to the current level of the replacement model, and the original image feature f i c Disrupted to f si c , similarly, the local feature f i l Disrupted to f si l , β i , γ i is the weight parameter of local features and target class features.i p Yes si c 、f si l With f i t The fusion result, f i is the output feature of the previous layer, α i Yes i With f i p Weights for linear interpolation blending.

[0091] S3.3.4, in the network layer that meets the optimization conditions, the specific operation is to generate a set of random competitive mixing weight ratios, and add and mix three / four features with corresponding weights according to probability as the input features of the next network layer.

[0092] S3.3.5, the current network layer optimization is completed, and the next network layer optimization is started.

[0093] Step 4, gradient optimization: Figure 2 As shown in the lower part, the boundary penalty loss is added to the original class loss weight and used as the total loss to serve the subsequent gradient optimization operation.

[0094] The new sample is gradient optimized according to the loss function containing the logit boundary to form the next iteration sample. In this process, the first K non-target class logits are penalized to continuously expand the logit boundary between the target class and the non-target class. At the same time, the loss between the predicted label of the alternative model and the true label is calculated. When optimizing, the gap between the true value and the predicted value is maximized, which is conducive to improving the transferability of the directed attack of the adversarial sample.

[0095] After the current iteration is completed, when calculating the optimization gradient, the logit boundary between the target class and the non-target class has a great influence on the result. The specific process is as follows:

[0096] S4.1, first redefine the prediction result logit of the alternative model, the formula is as follows:

[0097]

[0098] Among them, z i is the prediction result of the alternative model, Yes i The top-1 after sorting is the logit value of the target class. Yes i The weighted sum of the first K sorted non-target class logits.

[0099] S4.2, calculate the boundary penalty loss L based on the redefined logit KMB-P ; The specific process is as follows:

[0100] S4.2.1, sort the redefined logits and calculate the proportion θ of the first K non-target classes to the first K+1 classes. The calculation formula is as follows:

[0101]

[0102] in, Yes i Top-1 value after sorting.

[0103] S4.2.2, calculate the top K non-target class logits after sorting, and multiply them with θ as the penalty term L of the loss function KMB , the calculation formula is as follows:

[0104]

[0105] Among them, CE(·) represents the Cross-Entropy loss function.

[0106] S4.2.3, the above steps calculate L with penalty term and expanded logit boundary KMB-P The loss is calculated as follows:

[0107]

[0108] Among them, μ is the weight parameter of the penalty term, It is the weighted sum of the first K non-target class logits after sorting.

[0109] S4.3, based on the predicted classification results and the original image label, use the Logit loss function to calculate the original class loss L o , so that the predicted category is far away from the true category. The calculation formula is as follows:

[0110] L o =Logit(y p ,y)

[0111] Among them, Logit(·) is the classification loss function, y p is the prediction result of the alternative model, and y is the true label of the image.

[0112] S4.4, finally the boundary penalty loss L KMB-P With the original class loss L o The total loss of the targeted attack including the penalty term is obtained by adding a certain weight ratio, and the optimization gradient is calculated. The calculation formula is as follows:

[0113] L LMP=L KMB-P +λ×L o

[0114] Where λ is L o The weight parameter of .

[0115] Step 5: Iterate repeatedly to obtain the final adversarial sample.

[0116] In summary, the present invention aims at the existing problem of single perturbation of targeted attacks and failure to consider non-target logits, and proposes an adversarial attack method by mixing multiple features and expanding the logit boundary through competitive mixing. By acquiring and storing multiple features and reasonably fusing them with a certain competitive weight ratio during model inference optimization, image features with rich perturbations are formed; based on the above-mentioned image features, the gradient is updated using boundary penalty loss, and the optimization is continuously iterated to finally generate adversarial samples with the characteristics of perturbation diversity and strong migration; through the above key operations, the problem of single perturbation of targeted attacks and failure to consider non-target logits is solved, and on this basis, the migrationability of targeted attacks is greatly improved.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for adversarial attack by mixing and expanding logit boundaries through multi-feature competition, characterized in that: The following steps are involved: Step 1: According to the same batch of images and the prompt words of the target class, the randomly cropped local features of the image and the target class features generated by the generative diffusion model are obtained; Step 2: store the original image global features, image local features, and target class features into a deeper level of the alternative model; Step 3: During the iterative optimization process, the original image global features, image local features, target class features, and upper-layer image features are mixed at a random competition ratio with a certain probability to form image features with rich disturbance and strong migration. Step 4: Perform gradient optimization on the new sample based on the targeted attack loss function including the penalty term. Step 5: Repeat the iteration to obtain the final adversarial sample.

2. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 1, characterized in that: In step 1, the local features of the image are obtained by randomly cropping the original image; the target class features are obtained by inputting the generative diffusion model according to the prompt word of the target class, and the key parts of the target class features are extracted according to the Grad-cam algorithm to pave the way for subsequent perturbation optimization; The formula for obtaining target class features based on target class prompt words is as follows: f t =CAM(SDM(prompt)) Among them, CAM(·) is the Grad-cam function, SDM(·) is the generative diffusion model, prompt is the prompt word of the target class, and f t is the generated target class feature information.

3. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 1, characterized in that: In step 2, only the forward inference process of the two alternative models is consumed to store the local features of the image and the target class features; when the global features of the original image enter the alternative model and are executed in a multi-feature competitive mixing module in a certain layer, they are fused with the upper-layer features, the local features of the image and the target class features at a certain mixed competition ratio to form new image features with rich disturbance information.

4. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 1, characterized in that: In step 3, after the local features of the image and the target class features are stored in the multi-feature competitive hybrid module of the substitution model, adversarial sample optimization and generation can be performed; the specific process is as follows: S3.1, firstly, the original image is randomly transformed into an input to improve the input diversity; S3.2, performing translation invariance processing on the randomly input transformed image to further improve input diversity; S3.3, the image after random input transformation and translation invariance processing is input into the substitution model for optimization.

5. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 4, characterized in that: In S3.3, the specific optimization process includes the following: S3.3.1 The process of optimizing adversarial samples with substitution models is carried out in a deep multi-feature competitive hybrid module. During the optimization, a random number between 0 and 1 is first generated. If this random number is less than the pre-set probability value, the multi-feature competitive hybrid module is entered to perform the following optimization operations to prevent excessive interference and reduce the attack performance. S3.3.2, the global features of the original images of the same batch and the random local features of the images are shuffled and reorganized to pave the way for the subsequent multi-feature fusion; S3.3.3, generate a 0-1 random number again. If this random number is less than or equal to the preset target class feature mixing probability value, the global features of the original images of the same batch, the local features of the images, the target class features, and the input features from the previous network layer are fused; conversely, if this random number is greater than the target class feature mixing probability value, the global features of the original images of the same batch, the local features of the images, and the input features from the previous network layer are fused, that is, the target class features are not fused together to prevent excessive interference; the calculation formula for the competitive hybrid optimization of the four is as follows: f si c =S(f i c ) f si l =S(f i l ) f i '=a i f i +(1-a i )f i p Among them, S(·) is a random shuffle function, i refers to the current level of the replacement model, and the original image feature f i c Disrupted to f si c , similarly, the local feature f i l Disrupted to f si l , β i , γ i is the weight parameter of the local image features and the target class features; f i p Yes si c 、f si l With f i t The fusion result, f i is the output feature of the previous layer, α i Yes i With f i p The weight of linear interpolation fusion; S3.3.4, in the network layer that meets the optimization conditions, the specific operation is to generate a set of random competitive mixing weight ratios, add and mix three / four features with corresponding weights according to probability, and use them as input features of the next network layer; S3.3.5, the current network layer optimization is completed, and the next network layer optimization is started.

6. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 1, characterized in that: In step 4, after the current iteration is completed, when calculating the optimization gradient, the logit boundary between the target class and the non-target class has a great influence on the result; the specific process is as follows: S4.1, first redefine the prediction result logit of the alternative model, the formula is as follows: Among them, z i is the prediction result of the alternative model, Yes i The top-1 after sorting is the logit value of the target class. Yes i The weighted sum of the first K non-target class logits after sorting; S4.2, calculate the boundary penalty loss L based on the redefined logit KMB-P ; S4.3, based on the predicted classification results and the original image label, use the Logit loss function to calculate the original class loss L o , so that the predicted category is far away from the true category. The calculation formula is as follows: L o =Logit(y p ,y) Among them, Logit(·) is the classification loss function, y p is the prediction result of the alternative model, and y is the true label of the image; S4.4, finally the penalty loss L KMB-P With the original class loss L o The total loss of the targeted attack including the penalty term is obtained by adding a certain weight ratio, and the optimization gradient is calculated. The calculation formula is as follows: L LMP =L KMB-P +λ×L o Where λ is L o The weight parameter of .

7. The method for adversarial attack by multi-feature competitive mixing and logit boundary expansion according to claim 6, characterized in that: In step 4.2, the following steps are specifically included: S4.2.1, sort the redefined logits and calculate the proportion θ of the first K non-target classes to the first K+1 classes. The calculation formula is as follows: in, Yes i The top-1 value after sorting; S4.2.2, calculate the top K non-target class logits after sorting, and multiply them with θ as the penalty term L of the loss function KMB , the calculation formula is as follows: Among them, CE(·) represents the Cross-Entropy loss function; S4.2.3, calculate L with penalty term and expanded logit boundary KMB-P The loss is calculated as follows: Among them, μ is the weight parameter of the penalty term, It is the weighted sum of the first K non-target class logits after sorting.

Images