Picture classification method and device for improving random adversarial robustness, equipment and medium

Abstract

The invention provides a picture classification method and device for improving random adversarial robustness, equipment and a medium, and the method comprises the steps: obtaining the data of a to-be-classified picture, and carrying out the initialization processing of the to-be-classified picture; performing classification processing on the initialized to-be-classified picture data by adopting a picture classification model to obtain a picture classification result; the training process of the picture classification model comprises the following steps: acquiring original image data, and carrying out adversarial training processing of random feature enhancement on an original image by adopting an enhancement strategy to obtain random enhancement features; using a convolutional neural network and a random projection filter to carry out random projection on the random enhancement feature to obtain a projection feature; and carrying out channel adaptive feature repair processing on the projection features to obtain recovery features, and after the recovery features are classified, determining a picture classification model. The method has the beneficial effect that the accuracy of picture classification after attacks is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer image classification, and in particular to an image classification method, device, equipment and medium for improving random adversarial robustness. Background Art

[0002] Deep neural networks (DNNs) are vulnerable to adversarial attacks, which poses a significant obstacle to their deployment in safety-critical scenarios, including image classification and recognition scenarios such as self-driving cars, secure authentication systems, and medical diagnostic equipment. Attackers can carefully design and use various strategies to produce imperceptible perturbations, causing trained models to produce erroneous outputs. Therefore, the vulnerability of DNNs has attracted widespread attention, prompting the deep learning community to develop many defense strategies against adversarial examples. Among various defense methods, adversarial training (AT) has become one of the most effective techniques to improve adversarial robustness. Although adversarial training imparts model robustness, its effectiveness is still limited. In addition, as attack methods continue to evolve, networks trained with AT often find it difficult to obtain comprehensive robustness against every possible attack.

[0003] In addition to traditional adversarial training, existing technologies incorporate randomization into adversarial robust strategies to deal with such attacks. Existing technologies mainly include:

[0004] (1) By introducing Gaussian-distributed noise into the input of the convolutional layer, a randomized classifier can easily surpass the deterministic classifier and defend against adversarial attacks.

[0005] (2) The random projection method commonly used for dimensionality reduction is adopted to avoid the randomness that prevents the white-box attacker from obtaining the exact gradient of the loss with respect to the input. Therefore, they introduced a new technique RPF using the random projection method commonly used for dimensionality reduction. Randomization-based adversarial defense strategies focus too much on adversarial robustness and ignore the decrease in accuracy on benign samples. In addition, introducing too much randomness often has a counterproductive effect on enhancing robustness, thereby limiting the wide applicability of such methods in the real world. Summary of the invention

[0006] The main purpose of the embodiments of the present invention is to propose a method, device, equipment and medium for improving the robustness of random adversarial image classification, thereby improving the accuracy of image classification after being attacked.

[0007] One aspect of the present invention provides a method for image classification with improved random adversarial robustness, comprising:

[0008] Obtain the image data to be classified and perform initialization processing on the image to be classified;

[0009] The image data to be classified after the initialization process is classified using the image classification model to obtain the image classification result;

[0010] The training process of the image classification model includes:

[0011] Acquire original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features;

[0012] Using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features;

[0013] The projection features are subjected to channel adaptive feature restoration processing to obtain restored features, and after the restored features are classified, the image classification model is determined.

[0014] According to the image classification method for improving random adversarial robustness, original image data is obtained, and adversarial training processing of random feature enhancement is performed on the original image using an enhancement strategy to obtain random enhanced features, including:

[0015] The original image data R D As the input image is mapped to the logical space, the adversarial sample obtained by adding perturbations is:

[0016]

[0017] Where X adv is an adversarial sample, X is the input image, Y is the true label of the input image, where X adv =X+δ, δ represents disturbance, and the logical space F θ (X)∈R K , where K represents the total number of categories, F represents the classifier characterized by parameters, L(·) represents the loss function, ∈ represents the maximum perturbation amplitude, and D represents the dimension of the original image data, where the original image data includes clean samples;

[0018] Introducing adversarial samples into the classifier, the minimum-maximum optimization problem is constructed as:

[0019]

[0020] According to the minimum-maximum optimization problem, random data enhancement is used for adversarial training, and the formula is:

[0021]

[0022] Among them, T RA (·) indicates that random data augmentation is performed on the input image to obtain random enhanced features.

[0023] According to the image classification method for improving random adversarial robustness, the adversarial training using random data enhancement also includes:

[0024] According to the type of original image data, random selection and random combination are used to search for the best enhancement strategy from the enhancement suite, where the enhancement suite includes ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Overexposure, Tone Separation, Contrast, Color, Brightness, Sharpness, Shearing, and Sample Pairing.

[0025] According to the image classification method for improving random adversarial robustness, a convolutional neural network and a random projection filter are used to randomly project the random enhancement features to obtain projection features, including:

[0026] The branch convolution filter of the convolutional neural network is replaced with a random projection filter, and the enhanced features are processed by the convolutional neural network through a single filter to obtain:

[0027]

[0028] where z(p,q) represents a single filter output, p and q represent the row index and column index of the output feature map, respectively, x represents the enhanced feature of the input, and x∈R n×n×d , where n represents the size of the feature map, d is the dimension of the original image data, f is the filter, and f∈R r×r×d , where r represents the kernel size, represents the sub-region of x for which the convolution operation is performed, where the sub-region spans rows p to p+r-1 and columns q to q+r-1, and i, j, k represent the row index, column index, and depth index of the filter, respectively;

[0029] Through the N filters f1, f2, ... f of the convolutional layer of the convolutional neural network N , the first filter group f1, f2, ... f rp As a random projection filter, the parameters of the random projection filter are randomly initialized from a zero-mean Gaussian distribution, and the remaining filters f rp+1 , f rp+2 , ...f N For a traditional convolution filter with trainable parameters, the output is combined with the random projection filter and the traditional convolution filter:

[0030]

[0031] and

[0032] Where [,] represents the feature connection operation, σ 2represents the variance of the selected random projection filter, where the combined output z(p, q) is the random projection feature.

[0033] According to the image classification method for improving random adversarial robustness, the method further includes:

[0034] The random projection features are remodeled and repaired, and the formula is:

[0035]

[0036] s=σ(W2δ(W1h)),

[0037] z rse =S×Z+Z

[0038] where h c is the descriptor of channel c obtained after the dimensionality reduction operation of the random projection feature, σ and δ represent the Sigmoid and ReLU activation functions respectively, W1 and W2 are the weights of the fully connected layer, s is the learning weight corresponding to each channel of the feature re-learned by the random projection feature z, and z rse It is the feature map after applying the learned adaptive channel weights, and the feature map is embedded with residual connections.

[0039] According to the image classification method for improving random adversarial robustness, remodeling and repairing the random projection features also includes filtering noise from the random projection features.

[0040] According to the image classification method for improving random adversarial robustness, the method includes:

[0041] Optimize the image classification model, including:

[0042]

[0043] where F θ+rSE represents the classifier used for feature recovery module enhancement, and α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0044] Another aspect of an embodiment of the present invention provides an image classification device for improving random adversarial robustness, including:

[0045] The first module is used to obtain the image data to be classified and perform initialization processing on the image to be classified;

[0046] The second module is used to classify the image data to be classified after the initialization processing using the image classification model to obtain the image classification result;

[0047] The training process of the image classification model includes:

[0048] The third module is used to obtain original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features;

[0049] The fourth module is used to randomly project the random enhancement features using a convolutional neural network and a random projection filter to obtain a projection feature;

[0050] The fifth module is used to perform channel adaptive feature recovery processing on the projection features to obtain restored features, classify the restored features, and then determine the image classification model.

[0051] Another aspect of an embodiment of the present invention provides an electronic device, including a processor and a memory;

[0052] The memory is used to store programs;

[0053] The processor executes the program to implement the method described above.

[0054] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method described above.

[0055] The beneficial effects of the present invention are as follows: by means of random enhancement, instead of performing randomness and feature recovery in the classifier, randomness and robustness are added to the original image data at the data level, which can effectively improve the robustness of the image classification model under random adversarial attacks; by means of randomly selected enhancement kits, more robust features can be learned during adversarial learning; by using random projection based on feature recovery, the weights of significant channels in the sample feature space are adaptively enhanced, while the importance of irrelevant and negatively correlated channels is scaled, which can effectively restore previously incomplete image features affected by parameter resampling. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which:

[0057] Figure 1 It is a schematic diagram of a picture classification process for improving random adversarial robustness according to an embodiment of the present invention.

[0058] Figure 2 Schematic diagram of the comparison between the RAPS method and other typical methods, (a) is standard training (no defense), (b) is randomness-based defense (with excessive randomness), and (c) is the RAPS algorithm of an embodiment of the present invention.

[0059] Figure 3 It is a schematic diagram of an overview of the RAPS framework diagram of an embodiment of the present invention.

[0060] Figure 4a , Figure 4b , Figure 4c The following are the random projection ratios of the RAPS algorithm according to the embodiments of the present invention, the random projection positions in the CIFAR-10 and CIFAR-100 datasets, and the dimensionality reduction comparison diagrams of the feature recovery module.

[0061] Figure 5 Schematic diagram of a picture classification device for improving random adversarial robustness according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The embodiments of the present invention are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. In the subsequent description, the use of suffixes such as "module", "component" or "unit" used to represent elements is only for the purpose of facilitating the description of the present invention, and has no specific meaning in itself. Therefore, "module", "component" or "unit" can be used in a mixed manner. "First", "second" and the like are only used for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features. In this subsequent description, the continuous numbering of the method steps is for the convenience of review and understanding. In combination with the overall technical solution of the present invention and the logical relationship between the various steps, adjusting the implementation order between the steps will not affect the technical effect achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0063] Figure 1 1 is a schematic diagram of a picture classification process for improving random adversarial robustness according to an embodiment of the present invention. It includes but is not limited to steps S100 to S500, wherein the picture classification step includes:

[0064] S100, obtaining the image data to be classified and performing initialization processing on the image to be classified.

[0065] In some embodiments, the image data to be classified may be images generated by self-driving cars or medical diagnosis, and these images may include attacked images or normal images (clean images).

[0066] S200, classifying the initialized image data using an image classification model to obtain an image classification result.

[0067] Among them, the training process of the image classification model includes:

[0068] S300, obtaining original image data, and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features.

[0069] In some embodiments, the anti-training process can be described as follows: Consider a classifier F characterized by parameters θ, which classifies R D The input image X is mapped to the logical space F θ (X)∈R K , where D represents the dimension of the original image and K represents the total number of categories. Then under the perturbation δ, the adversarial sample X adv =X+δ can be expressed as:

[0070]

[0071] Where L(·) represents the loss function, such as cross entropy loss; Y represents the true label of the input image. ∈ represents the maximum perturbation amplitude. In the adversarial training method, adversarial samples are designed and introduced into the classifier to establish a minimum-maximum optimization problem, which is expressed as:

[0072]

[0073] In traditional randomized defense strategies, the focus is often on introducing randomness into the model F, such as by injecting noise, adding random classifiers, and random projections. However, existing studies have shown that over-reliance on randomization techniques can have an adverse effect on the performance of the model on adversarial samples and clean samples. Therefore, the embodiment of the present invention turns to introduce randomness and robustness from the data level instead of further randomizing F (classifier). The embodiment of the present invention uses random data augmentation for adversarial training, which is formalized as follows:

[0074]

[0075] Where T RA (·) denotes random data augmentation performed on the input image.

[0076] It is understandable that the traditional data augmentation method T A (·) (usually involving random cropping with 4-pixel zero padding and horizontal flipping) does not introduce enough randomness during training. In order to inject additional randomness without changing the model parameters, the present embodiment uses AutoAugment as the T RA (·) Perform random data augmentation to further diversify the training data without affecting the underlying model architecture.

[0077] In some embodiments, the suite of random data enhancement techniques covers a wide range of operations such as ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Expose, Posterize, Contrast, Color, Brightness, Sharpness, and Clipping, as well as sample pairing.

[0078] In some embodiments, T RA (·) Using reinforcement learning, find the best augmentation strategy for the current dataset and task among the predefined set of augmentation operations mentioned above. This search process involves randomly selecting and combining different augmentation operations to explore which combinations of operations are most effective in improving model performance. After determining the best augmentation strategy, when applying these strategies to each image, the specific operations (such as the angle of rotation, the degree of color adjustment, etc.) are often random. This means that even the same image may encounter different augmentation versions in different training iterations, which can further increase the diversity of the data and the randomness of the model.

[0079] S400, using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features.

[0080] In some embodiments, the input feature x∈R n×n×d , where n represents the size of the feature map and d is the dimension. Given a single convolutional neural network (CNN) filter f∈R r×r×d , r represents the kernel size, and the output z can be described by the following expression:

[0081]

[0082] in represents the sub-region x for which the convolution operation is performed, spanning rows p to p+r-1 and columns q to q+r-1. N In the convolutional layer, the first filter group f1,f2,...f rp is specified as a random projection filter whose parameters are randomly initialized from a zero-mean Gaussian distribution. The remaining filters f rp+1 ,f rp+2 ,...f N is a traditional convolutional filter with trainable parameters. The combined output z can be expressed as:

[0083]

[0084] Where [,] represents the feature connection operation, σ 2 represents the variance of the selected random projection filter.

[0085] S500, performing channel adaptive feature restoration processing on the projection features to obtain restored features, classifying the restored features, and determining an image classification model.

[0086] Although integrating random projection filters can enhance adversarial robustness and stabilize the optimization of randomization methods, the resampling of parameters in filters of some convolutional layers in this process will significantly affect the model performance on clean samples, resulting in the model being unusable in non-adversarial scenarios. The embodiment of the present invention believes that the convolutional layer after parameter resampling may lose some learned data feature patterns, resulting in the re-extracted features after parameter update not conforming to the precise data distribution of the data set. Therefore, the embodiment of the present invention designs a plug-and-play lightweight feature recovery module, which aims to enrich the features after random projection, thereby achieving a more effective balance between adversarial robustness and clean sample accuracy.

[0087] The feature recovery module designed in this article by the embodiment of the present invention mainly focuses on plug-and-play and lightweight. Therefore, the embodiment of the present invention hopes to utilize more dimensions in the data features to obtain more hidden information to make up for the information loss caused by randomization. Therefore, in addition to the normal spatial dimension, the embodiment of the present invention also utilizes the channel dimension of the feature to recover and complement the feature. Specifically, the embodiment of the present invention adaptively enhances the weights of significant channels in the sample feature space, while scaling the importance of irrelevant and negatively correlated channels. The advantage of this structure is that it enhances the model's ability to highlight relevant information and reduce the impact of less critical data while introducing minimal additional training parameters. Therefore, this module helps to mitigate the negative impact of parameter resampling on the performance of clean samples. In addition, in order to enhance generalization and reduce the mode collapse problem that may be introduced by adding noise, the embodiment of the present invention utilizes the structure of residual connection to enhance the channel adaptive feature repair module (referred to as rSE) proposed in the embodiment of the present invention as the key module of "post-noise feature remodeling and repair" in the RAPS model. The formula of rSE is as follows:

[0088]

[0089] s=σ(W2δ(W1h)),

[0090] z rse =S×Z+Z

[0091] where h c is the descriptor of channel c obtained after the feature dimension reduction operation, σ and δ represent the Sigmoid and ReLU activation functions respectively. W1 and W2 are the weights of the fully connected layer. s is the learning weight corresponding to each channel of the feature re-learned after random projection z, z rseis the final feature map after applying the learned adaptive channel weights, and an additional residual connection is embedded. In the ablation study section, the embodiment of the present invention studies how different scales of dimensionality reduction in the rSE module affect its performance.

[0092] After being processed by the above-mentioned adaptive channel feature recovery module, the previously incomplete image features affected by parameter resampling can be effectively restored. In addition, this module aims to filter out the noise introduced by the new parameters as much as possible, thereby improving the usability of the restored features.

[0093] Therefore, the optimization goal of the entire RAPS process can be expressed as:

[0094]

[0095] where F θ+rSE represents the classifier enhanced by adding the proposed feature recovery module. α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0096] Through the optimization goals outlined above, the RAPS algorithm proposed in the embodiment of the present invention establishes a set of novel random adversarial defense mechanisms. These mechanisms include random data enhancement, random projection, and feature recovery post-projection, which together aim to achieve a better balance between adversarial robustness and clean sample performance.

[0097] refer to Figure 2 ,in Figure 2 Schematic diagram of the comparison between the RAPS (random augmentation, random projection and feature recovery) method and other typical methods, (a) standard training (no defense), (b) randomness-based defense (with excessive randomness), and (c) the RAPS algorithm of an embodiment of the present invention.

[0098] The embodiments of the present invention enhance the effectiveness of randomized adversarial defense techniques from two different perspectives. First, unlike previous methods that enhance adversarial robustness by changing model parameters or adjusting noise levels during training, the embodiments of the present invention follow the technical route of data enhancement and introduce variability during the training phase, effectively improving the model's ability to resist attacks. Second, in order to mitigate the loss of feature information and performance degradation caused by random projection changing the parameter space, the embodiments of the present invention introduce an innovative lightweight feature recovery module designed to minimize this impact. Inspired by these insights, the embodiments of the present invention propose a new adversarial defense method called RAPS (Random Augmentation, Projection, and Restoration). Figure 2 A comparison between a standard training model, a previous stochasticity-based model, and the RAPS proposed in an embodiment of the present invention is shown.

[0099] Figure 3is a schematic diagram of the RAPS framework of the embodiment of the present invention. The embodiment of the present invention introduces the RAPS algorithm proposed in the embodiment of the present invention, which is a simple and effective strategy that can improve the performance of adversarial defense based on random projection. Figure 3 As shown. The embodiment of the present invention first introduces in detail the random data enhancement technology adopted by the embodiment of the present invention to improve the randomness of the entire model, with the focus on diversifying the input data. Afterwards, the embodiment of the present invention proposes a feature recovery module after the random projection filter to repair the feature information that may be lost after randomization.

[0100] The typical adversarial training process can be described as follows: Consider a classifier F characterized by parameters θ, which transforms R D The input image X is mapped to the logical space F θ (X)∈R K , where D represents the dimension of the original image and K represents the total number of categories. Then under the perturbation δ, the adversarial sample X adv =X+δ can be expressed as:

[0101]

[0102] Where L(·) represents the loss function, such as cross entropy loss; Y represents the true label of the input image. ε∈ represents the maximum perturbation amplitude. In the adversarial training method, adversarial samples are designed and introduced into the classifier to establish a minimum-maximum optimization problem, which is expressed as:

[0103]

[0104] In traditional randomized defense strategies, the focus is often on introducing randomness into the model F, such as by injecting noise, adding random classifiers, and random projections. However, existing studies have shown that over-reliance on randomization techniques can have an adverse effect on the performance of the model on adversarial samples and clean samples. Therefore, the embodiment of the present invention turns to introduce randomness and robustness from the data level instead of further randomizing F. The embodiment of the present invention uses random data augmentation for adversarial training, which is formalized as follows:

[0105]

[0106] Where T RA (·) denotes random data augmentation performed on the input image.

[0107] In previous studies on image classification and enhancing adversarial robustness, data augmentation is a commonly used strategy. However, traditional data augmentation methods T A(·) (usually involving random cropping with 4-pixel zero padding and horizontal flipping) does not introduce enough randomness during training. In order to inject additional randomness without changing the model parameters, the present embodiment uses AutoAugment as the T RA (·) Perform random data augmentation to further diversify the training data without affecting the underlying model architecture.

[0108] The suite of random data enhancement techniques implemented in embodiments of the present invention covers a wide range of operations, such as ShearX / Y, Translate X / Y, Rotate, Auto Contrast, Invert, Equalize, Expose, Tone Separation, Contrast, Color, Brightness, Sharpness, and Shear, as well as Sample Pairing. RA (·) Using reinforcement learning, find the best enhancement strategy for the current dataset and task among the predefined set of enhancement operations mentioned above. This search process involves randomly selecting and combining different enhancement operations to explore which combinations of operations are most effective in improving model performance. After determining the best enhancement strategy, when applying these strategies to each image, the specific operations (such as the angle of rotation, the degree of color adjustment, etc.) are often random. This means that even the same image may encounter different enhancement versions in different training iterations, which can further increase the diversity of the data and the randomness of the model. In short, T RA (·) helps the model learn more robust features.

[0109] In some embodiments, based on random projection of feature recovery, in order to prevent white-box attackers from obtaining accurate gradient information and generating strong adversarial samples, Dong et al. proposed the RPF method, which incorporates random projection into the CNN layer to achieve a better balance between adversarial robustness and optimization difficulty. In the RPF method, a branch of convolutional filters in the CNN layer is replaced by random projection. Formally, consider the input feature x∈R n×n×d , where n represents the size of the feature map and d is the dimension. Given a single convolutional neural network (CNN) filter f∈R r×r×d , r represents the kernel size, and the output z can be described by the following expression:

[0110]

[0111] in represents the sub-region x for which the convolution operation is performed, spanning rows p to p+r-1 and columns q to q+r-1. N In the convolutional layer, the first filter group f1,f2,...f rp is specified as a random projection filter whose parameters are randomly initialized from a zero-mean Gaussian distribution. The remaining filters frp+1 ,f rp+2 ,...f N is a traditional convolutional filter with trainable parameters. The combined output z can be expressed as:

[0112]

[0113] Where [,] represents the feature connection operation, σ 2 represents the variance of the selected random projection filter.

[0114] Although integrating random projection filters can enhance adversarial robustness and stabilize the optimization of randomization methods, the resampling of parameters in filters of some convolutional layers in this process will significantly affect the model performance on clean samples, resulting in the model being unusable in non-adversarial scenarios. The embodiment of the present invention believes that the convolutional layer after parameter resampling may lose some learned data feature patterns, resulting in the re-extracted features after parameter update not conforming to the precise data distribution of the data set. Therefore, the embodiment of the present invention designs a plug-and-play lightweight feature recovery module, which aims to enrich the features after random projection, thereby achieving a more effective balance between adversarial robustness and clean sample accuracy.

[0115] The feature recovery module designed in this article by the embodiment of the present invention mainly focuses on plug-and-play and lightweight. Therefore, the embodiment of the present invention hopes to utilize more dimensions in the data features to obtain more hidden information to make up for the information loss caused by randomization. Therefore, in addition to the normal spatial dimension, the embodiment of the present invention also utilizes the channel dimension of the feature to recover and complement the feature. Specifically, the embodiment of the present invention adaptively enhances the weights of significant channels in the sample feature space, while scaling the importance of irrelevant and negatively correlated channels. The advantage of this structure is that it enhances the model's ability to highlight relevant information and reduce the impact of less critical data while introducing minimal additional training parameters. Therefore, this module helps to mitigate the negative impact of parameter resampling on the performance of clean samples. In addition, in order to enhance generalization and reduce the mode collapse problem that may be introduced by adding noise, the embodiment of the present invention utilizes the structure of residual connection to enhance the channel adaptive feature repair module (referred to as rSE) proposed in the embodiment of the present invention as the key module of "post-noise feature remodeling and repair" in the RAPS model. The formula of rSE is as follows:

[0116]

[0117] s=σ(W2δ(W1h)),

[0118] z rse =s×Z+Z.

[0119] where hc is the descriptor of channel c obtained after the feature dimension reduction operation, σ and δ represent the Sigmoid and ReLU activation functions respectively. W1 and W2 are the weights of the fully connected layer. s is the learning weight corresponding to each channel of the feature re-learned after random projection z, z rse It is the final feature map after applying the learned adaptive channel weights and embedding additional residual connections. In the ablation study part, the embodiment of the present invention studies how different scales of dimensionality reduction in the rSE module affect its performance.

[0120] After being processed by the above-mentioned adaptive channel feature recovery module, the previously incomplete image features affected by parameter resampling can be effectively restored. In addition, this module aims to filter out the noise introduced by the new parameters as much as possible, thereby improving the usability of the restored features.

[0121] Therefore, the optimization goal of the entire RAPS process can be expressed as:

[0122]

[0123] where F θ+rSE represents the classifier enhanced by adding the proposed feature recovery module. α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0124] Through the optimization goals outlined above, the RAPS algorithm proposed in the embodiment of the present invention establishes a set of novel random adversarial defense mechanisms. These mechanisms include random data enhancement, random projection, and feature recovery post-projection, which together aim to achieve a better balance between adversarial robustness and clean sample performance.

[0125] Experimental setup: Based on previous studies, the present embodiment evaluates the RAPS of the present embodiment on two adversarial robustness transfer benchmark datasets, namely CIFAR-10 and CIFAR-100. The present embodiment evaluates the effectiveness of RAPS on several widely compared models in the field of adversarial robustness, including ResNet-18 and WideResNet-34-10. In order to evaluate the effectiveness of the proposed RAPS, the experiments of the present embodiment involve comparisons with seven adversarial training-based methods (AT, GAT, FGSM-MEP, UIAT, LGBAT, IBD, and GeodesicAT) and four other competitive random adversarial defense methods (Additive, RandomBit, Multiplicate, and RPF).

[0126] Implementation details, the embodiment of the present invention uses the PyTorch framework to implement the model of the embodiment of the present invention on the NVIDIA RTX4090 GPU. The embodiment of the present invention uses the most advanced adversarial training strategy and RPF protocol when conducting experiments on CIFAR-10 / 100. The network is trained for 200 epochs, using a batch size of 128 and SGD with a momentum of 0.9. The initial learning rate is set to 0.1, and the weight decay factor α is configured to 5×10-4. A piecewise learning rate decay strategy is applied, reducing the rate by 0.1 times in the 100th and 150th epochs. For the generation of adversarial examples, the embodiment of the present invention uses PGD-10, with a maximum perturbation limit of ε=8 / 255, and a PGD step size of 2 / 255. For the weight decay of the random projection layer, on CIFAR-10, ResNet-18 is set to 1×10-2 and WideResNet-34-10 is set to 5×10-1. On CIFAR-100, this parameter is kept at 1×10-2. The placement and other parameter settings of the random projection layer are consistent with RPF.

[0127] Attacks: In order to evaluate the adversarial robustness of RAPS proposed in the embodiments of the present invention, various attacks were comprehensively tested in the embodiments of the present invention, including fast gradient sign method (FGSM), projected gradient descent (PGD), CW attack (CW), momentum-based iterative fast gradient sign method (MIFGSM) and automatic attack (AA). The embodiments of the present invention follow the established protocol to configure these attacks. For FGSM, PGD, MIGFSM and AA, the maximum perturbation size ε is uniformly set to 8 / 255. For PGD and MIGFSM, the step size is 2 / 255, and the number of steps is 20 and 5, respectively. For CW attack, the learning rate is 0.01 in 1000 steps.

[0128] Performance comparison with state-of-the-art methods Tables 1-3 show the performance comparison of RAPS proposed in the embodiment of the present invention with ten other methods. In terms of clean accuracy and adversarial robustness against five adversarial attacks, the model proposed in the embodiment of the present invention is significantly better than the comparison method. It is worth noting that it can be observed in the embodiment of the present invention that most defense methods using randomization have higher robustness than pure adversarial training methods. However, the clean accuracy of the randomized method is generally lower than that of the AT-based method. The RAPS method of the embodiment of the present invention is different from the previous randomized defense method, which indiscriminately adds randomness at the model level. Instead, RAPS innovatively applies randomness through data enhancement and introduces additional randomness after the random projection layer through the feature recovery module. This approach mitigates the performance degradation of clean samples that is usually associated with excessive randomization. Therefore, the model of the embodiment of the present invention achieves a better balance between accuracy and robustness. Specifically, compared with the leading randomized adversarial defense method RPF, the RAPS of the embodiment of the present invention improves the accuracy of clean samples by 1%-7% and the adversarial robustness by about 0.8%-5% (as described in detail in AA below), which undoubtedly demonstrates the superiority of the RAPS algorithm.

[0129] Table 1 White-box experimental results of clean accuracy and robust accuracy on the CIFAR-10 dataset under the network architecture ResNet-18, - indicates that there is no corresponding result in the comparative literature.

[0130]

[0131] Table 2 White-box experimental results of clean accuracy and robust accuracy on the CIFAR-100 dataset under the network architecture ResNet-18.

[0132]

[0133]

[0134] Table 3 White-box experimental results of clean accuracy and robust accuracy on the CIFAR-10 dataset under the network architecture WideResNet-34-10.

[0135]

[0136] The key factors for the effectiveness of the RAPS method of the embodiment of the present invention include:

[0137] (1) Analyze the different contributions of the random data enhancement module and the feature recovery module to the overall performance;

[0138] (2) evaluate how changes in random projection ratio affect RAPS effectiveness;

[0139] (3) Evaluate the impact of dimensionality reduction within the feature recovery module on RAPS performance.

[0140] The embodiment of the present invention performs ablation analysis to distinguish the different effects of the random data enhancement module and the feature recovery module in RAPS. The results are shown in Table 4. It can be observed that compared with the baseline model, the feature recovery module (FS) mainly improves the accuracy of clean samples, while the random data enhancement module (RA) enhances the adversarial robustness of the model. It is worth noting that using both FS and RA modules (the full version of RAPS) can achieve higher clean accuracy and adversarial robustness than using either module alone. This reflects the effectiveness of the model proposed in the embodiment of the present invention from a quantitative perspective. In addition, it shows that feature recovery and random data enhancement play complementary roles in random adversarial defense strategies, and are effective and innovative methods to enhance the effectiveness of such defense mechanisms.

[0141] Table 4 Ablation experiment results on CIFAR-10 and CIFAR-100 based on ResNet-18

[0142]

[0143] Table 4 shows the ablation experiment results on CIFAR-10 and CIFAR-100 based on ResNet-18 using the two components proposed in RAPS according to an embodiment of the present invention. FS and RA are the abbreviations of feature recovery module and random data augmentation module, respectively.

[0144] Random projection ratio in RAPS. The embodiment of the present invention also explores the impact of the ratio of random projection filters on the performance of RAPS. According to the RPF protocol, the embodiment of the present invention tested the results of inserting five different ratios of random projection layers in the first layer of the network. The results are shown in Figure 4(a), which can achieve a clean accuracy of 86.28% while maintaining 69.26% adversarial robustness (under AA), which is also the result reported by the embodiment of the present invention in the main experiment. When the ratio of random projection increases to 100%, the embodiment of the present invention finds that the clean accuracy performance of the model is greatly affected (dropped to 77.70%), and when the ratio is only 10%, the adversarial robustness of the model drops to the lowest point (only 61.90% under PGD). This also shows that there is an upper limit to the randomness added to the model. Therefore, the embodiment of the present invention also adopts a random projection ratio of 75%.

[0145] In some embodiments, the dimensionality reduction in feature recovery includes the impact of the scale of feature dimensionality reduction in the proposed feature recovery module on the final RAPS performance. Since the feature recovery module used in the embodiment of the present invention is calculated by adaptive channel reweighting with an additional residual connection, the different scales of the dimension reduction performed on the channel dimension of the feature will change the performance of the final model. The embodiment of the present invention tested three different dimensionality reduction ratios, namely 16, 32 and 64. The results on CIFAR-10 and CIFAR-100 are shown in Figures 4(b) and (c). It can be observed that when the dimensionality reduction ratio is too high (reaching 64), the performance of the model will decrease in terms of clean accuracy and adversarial robustness. The embodiment of the present invention believes that the excessive reduction of the number of channels in the feature recovery module will lose too much inherent information, thereby further reducing the normal performance of the model. Therefore, the embodiment of the present invention uses 16 and 32 as the dimensionality reduction scale of the channel feature in CIFAR-10 and CIFAR-100, respectively.

[0146] Figure 5 Schematic diagram of a device for image classification for improving random adversarial robustness according to an embodiment of the present invention. The device includes a first module 510 , a second module 520 , a third module 530 , a fourth module 550 and a fifth module 550 .

[0147] Among them, the first module is used to obtain the image data to be classified and initialize the image to be classified; the second module is used to classify the image data to be classified after the initialization processing using the image classification model to obtain the image classification result; the training process of the image classification model includes: the third module is used to obtain the original image data, and the original image is subjected to adversarial training processing of random feature enhancement using an enhancement strategy to obtain random enhanced features; the fourth module is used to randomly project the random enhanced features using a convolutional neural network and a random projection filter to obtain projection features; the fifth module is used to perform channel adaptive feature recovery processing on the projection features to obtain restored features, and after classifying the restored features, determine the image classification model.

[0148] Exemplarily, with the cooperation of the first to fifth modules in the device, the embodiment device can implement any of the aforementioned image classification methods for improving random adversarial robustness, that is, obtaining image data to be classified and initializing the image to be classified; classifying the initialized image data to be classified using an image classification model to obtain image classification results; the training process of the image classification model includes: obtaining original image data, performing adversarial training on the original image using an enhancement strategy to enhance random features, and obtaining random enhanced features; using a convolutional neural network and a random projection filter to randomly project the random enhanced features to obtain projection features; performing channel adaptive feature repair on the projection features to obtain restored features, and after classifying the restored features, determining the image classification model. The beneficial effects of the present invention are as follows: by means of random enhancement, instead of performing randomness and feature recovery in the classifier, randomness and robustness are added to the original image data at the data level, which can effectively improve the robustness of the image classification model under random adversarial attacks; by means of randomly selected enhancement kits, more robust features can be learned during adversarial learning; by using random projection based on feature recovery, the weights of significant channels in the sample feature space are adaptively enhanced, while the importance of irrelevant and negatively correlated channels is scaled, which can effectively restore previously incomplete image features affected by parameter resampling.

[0149] An embodiment of the present invention further provides an electronic device, the electronic device comprising a processor and a memory;

[0150] The memory stores a program;

[0151] The processor executes a program to execute the aforementioned method for image classification for improving random adversarial robustness; the electronic device has the function of carrying and running the software system for image classification for improving random adversarial robustness provided by an embodiment of the present invention, for example, a personal computer, a minicomputer, a main frame, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or communicating with a charged particle tool or other imaging device, etc.

[0152] An embodiment of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the image classification method for improving random adversarial robustness as described above.

[0153] In some selectable embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided by way of example, for the purpose of providing a more comprehensive understanding of technology. The disclosed method is not limited to the operation and logic flow presented herein. Selectable embodiments are expected, wherein the order of various operations is changed and the sub-operation of a part for which is described as a larger operation is performed independently.

[0154] The embodiment of the present invention also discloses a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. A processor of a computer device can read the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the aforementioned image classification method for improving random adversarial robustness.

[0155] In addition, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise specified, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the present invention. More specifically, in view of the properties, functions, and internal relationships of the various functional modules in the device disclosed herein, the actual implementation of the module will be understood within the conventional skills of the engineer. Therefore, those skilled in the art can implement the present invention set forth in the claims without excessive experimentation using ordinary techniques. It is also understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0156] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0157] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0158] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0159] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0160] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0161] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

[0162] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the described embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for image classification to improve random adversarial robustness, characterized in that: include: Obtain the image data to be classified and perform initialization processing on the image to be classified; The image data to be classified after the initialization process is classified using the image classification model to obtain the image classification result; The training process of the image classification model includes: Acquire original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features; Using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features; The projection features are subjected to channel adaptive feature restoration processing to obtain restored features, and after the restored features are classified, the image classification model is determined.

2. The image classification method for improving random adversarial robustness according to claim 1, characterized in that: The obtaining of original image data, and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features, include: The original image data R D As the input image is mapped to the logical space, the adversarial sample obtained by adding perturbations is: Where X adv is an adversarial sample, X is the input image, Y is the true label of the input image, where X adv =X+δ, δ represents disturbance, and the logical space F θ (X)∈R K , where K represents the total number of categories, F represents the classifier characterized by parameters, L(·) represents the loss function, ∈ represents the maximum perturbation amplitude, and D represents the dimension of the original image data, where the original image data includes clean samples; Introducing adversarial samples into the classifier, the minimum-maximum optimization problem is constructed as: According to the minimum-maximum optimization problem, random data enhancement is used for adversarial training, and the formula is: Among them, T RA (·) indicates that random data augmentation is performed on the input image to obtain random enhanced features.

3. The image classification method for improving random adversarial robustness according to claim 2, characterized in that: The adversarial training using random data enhancement also includes: According to the type of original image data, random selection and random combination are used to search for the best enhancement strategy from the enhancement suite, where the enhancement suite includes ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Overexposure, Tone Separation, Contrast, Color, Brightness, Sharpness, Shearing, and Sample Pairing.

4. The image classification method for improving random adversarial robustness according to claim 2, characterized in that: The method of using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features includes: The branch convolution filter of the convolutional neural network is replaced with a random projection filter, and the enhanced features are processed by the convolutional neural network through a single filter to obtain: where z(p,q) represents a single filter output, p and q represent the row index and column index of the output feature map, respectively, x represents the enhanced feature of the input, and x∈R n×n×d , where n represents the size of the feature map, d is the dimension of the original image data, f is the filter, and f∈R r×r×d , where r represents the kernel size, represents the sub-region of x for which the convolution operation is performed, where the sub-region spans rows p to p+r-1 and columns q to q+r-1, and i, j, k represent the row index, column index, and depth index of the filter, respectively; Through the N filters f1,f of the convolutional layer of the convolutional neural network y ,...f2, the first filter group f1,f2,...f rp As a random projection filter, the parameters of the random projection filter are randomly initialized from a zero-mean Gaussian distribution, and the remaining filters f rp+1 ,f rp+2 ,...f N For a traditional convolution filter with trainable parameters, the output is combined with the random projection filter and the traditional convolution filter: Where [,] represents the feature connection operation, σ 2 represents the variance of the selected random projection filter, where the combined output z(p,q) is the random projection feature.

5. The image classification method for improving random adversarial robustness according to claim 4, characterized in that: The method further comprises: The random projection features are remodeled and repaired, and the formula is: s=σ(W2δ(W1h)), With rse =s×z+z where h c is the descriptor of channel c obtained after the dimensionality reduction operation of the random projection feature, σ and δ represent the Sigmoid and ReLU activation functions respectively, W1 and W2 are the weights of the fully connected layer, s is the learning weight corresponding to each channel of the feature re-learned by the random projection feature z, and z rse It is the feature map after applying the learned adaptive channel weights, and the feature map is embedded with residual connections.

6. The image classification method for improving random adversarial robustness according to claim 5, characterized in that: The remodeling and repairing of the random projection features also includes filtering out noise from the random projection features.

7. The image classification method for improving random adversarial robustness according to claim 4, characterized in that: The method comprises: Optimize the image classification model, including: Among them, F θ+rSE represents the classifier used for feature recovery module enhancement, and α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

8. An image classification device for improving random adversarial robustness, characterized in that: include: The first module is used to obtain the image data to be classified and perform initialization processing on the image to be classified; The second module is used to classify the initialized image data using the image classification model to obtain the image classification result; The training process of the image classification model includes: The third module is used to obtain original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features; The fourth module is used to randomly project the random enhancement features using a convolutional neural network and a random projection filter to obtain a projection feature; The fifth module is used to perform channel adaptive feature recovery processing on the projection features to obtain restored features, classify the restored features, and then determine the image classification model.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the image classification method for improving random adversarial robustness as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The storage medium stores a program, and the program is executed by a processor to implement the image classification method for improving random adversarial robustness according to any one of claims 1 to 7.

Images