Image classification method, device, equipment and medium for improving random adversarial robustness

Abstract

The present invention provides an image classification method, apparatus, device, and medium for improving robustness to random adversarial attacks. The image classification method for improving robustness to random adversarial attacks comprises: obtaining image data to be classified, performing initialization processing on the image to be classified; classifying the initialized image data using an image classification model to obtain an image classification result; training the image classification model comprises: obtaining original image data, performing adversarial training processing on the original image using an enhancement strategy to enhance random features to obtain random enhanced features; randomly projecting the randomly enhanced features using a convolutional neural network and a random projection filter to obtain projection features; performing channel-adaptive feature restoration processing on the projection features to obtain restored features; and determining an image classification model after classifying the restored features. The present invention has the beneficial effect of improving the accuracy of image classification after being attacked.

Description

Technical Field

[0001] The present invention relates to the technical field of computer image classification, and in particular to an image classification method, device, equipment and medium for improving random adversarial robustness. Background Art

[0002] Deep neural networks (DNNs) are vulnerable to adversarial attacks, posing a significant obstacle to their deployment in safety-critical scenarios, including image classification and recognition applications such as autonomous vehicles, secure authentication systems, and medical diagnostic equipment. Attackers can carefully craft and employ various strategies to generate imperceptible perturbations, causing trained models to produce erroneous outputs. Consequently, the vulnerability of DNNs has garnered widespread attention, prompting the deep learning community to develop numerous defense strategies against adversarial examples. Among these defenses, adversarial training (AT) has emerged as one of the most effective techniques for improving adversarial robustness. While adversarial training imparts robustness to models, its effectiveness remains limited. Furthermore, as attack methods continue to evolve, networks trained with AT often struggle to achieve comprehensive robustness against every possible attack.

[0003] In addition to traditional adversarial training, existing technologies incorporate randomization into adversarial robust strategies to counter such attacks. Existing technologies mainly include:

[0004] (1) By introducing Gaussian-distributed noise into the input of the convolutional layer, a randomized classifier can easily surpass the deterministic classifier and defend against adversarial attacks.

[0005] (2) They adopted a random projection method commonly used for dimensionality reduction to avoid the problem that randomness prevents white-box attackers from obtaining the exact gradient of the loss with respect to the input. Therefore, they introduced a new technique, RPF, using a random projection method commonly used for dimensionality reduction. Randomization-based adversarial defense strategies focus too much on adversarial robustness while ignoring the decrease in accuracy on benign samples. In addition, introducing too much randomness often has a counterproductive effect on enhancing robustness, thus limiting the wide applicability of such methods in the real world. Summary of the Invention

[0006] The main purpose of the embodiments of the present invention is to provide a method, apparatus, device and medium for image classification that improves the robustness against random adversarial attacks, thereby improving the accuracy of image classification after being attacked.

[0007] One aspect of the present invention provides an image classification method for improving random adversarial robustness, comprising:

[0008] Obtain the image data to be classified and perform initialization processing on the image to be classified;

[0009] The initialized image data to be classified is classified using the image classification model to obtain the image classification results;

[0010] The training process of the image classification model includes:

[0011] Obtaining original image data, and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhanced features;

[0012] Using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features;

[0013] The projection features are subjected to channel adaptive feature restoration processing to obtain restored features, and the restored features are classified to determine the image classification model.

[0014] According to the image classification method for improving random adversarial robustness, original image data is obtained, and adversarial training processing of random feature enhancement is performed on the original image using an enhancement strategy to obtain random enhanced features, including:

[0015] The original image data R D As the input image is mapped to the logical space, the adversarial sample obtained by adding perturbations is:

[0016]

[0017] where X adv For adversarial samples, X is the input image, and Y represents the true label of the input image, where X adv =X+δ, δ represents the disturbance, and the logical space F θ (X)∈R K , where K represents the total number of categories, F represents the classifier characterized by parameters, L(·) represents the loss function, ∈ represents the maximum perturbation amplitude, and D represents the dimension of the original image data, where the original image data includes clean samples;

[0018] Introducing adversarial samples into the classifier, the minimum-maximum optimization problem is constructed as follows:

[0019]

[0020] According to the minimum-maximum optimization problem, random data enhancement is used for adversarial training, and its formula is:

[0021]

[0022] Among them, T RA (·) indicates that random data augmentation is performed on the input image to obtain random enhanced features.

[0023] According to the image classification method for improving random adversarial robustness, the adversarial training using random data augmentation further includes:

[0024] According to the type of original image data, random selection and random combination are used to search for the best enhancement strategy from the enhancement suite, where the enhancement suite includes ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Overexposure, Tone Separation, Contrast, Color, Brightness, Sharpness, Crop, and Sample Pairing.

[0025] According to the image classification method for improving random adversarial robustness, a convolutional neural network and a random projection filter are used to randomly project the random enhancement features to obtain projection features, including:

[0026] The branch convolution filter of the convolutional neural network is replaced by a random projection filter, and the enhanced features are processed by the convolutional neural network through a single filter to obtain:

[0027]

[0028] where z(p,q) represents the output of a single filter, p and q represent the row index and column index of the output feature map, respectively, x represents the enhanced feature of the input, and x∈R n×n×d , where n represents the size of the feature map, d is the dimension of the original image data, f is the filter, and f∈R r×r×d , where r represents the kernel size, represents the subregion of x that the convolution operation is performed on, where the subregion spans rows p to p+r-1 and columns q to q+r-1, and i, j, and k represent the row index, column index, and depth index of the filter respectively;

[0029] The N filters f1, f2, ... f of the convolutional layer of the convolutional neural network N , the first filter group f1, f2, ... f rp As a random projection filter, the parameters of the random projection filter are randomly initialized from a zero-mean Gaussian distribution, and the remaining filters f rp+1 , f rp+2 ,...f N For traditional convolution filters with trainable parameters, the output is a combination of random projection filters and traditional convolution filters:

[0030]

[0031] and

[0032] Where [,] represents the feature connection operation, σ 2represents the variance of the selected random projection filter, where the combined output z(p,q) is the random projection feature.

[0033] According to the image classification method for improving random adversarial robustness, the method further includes:

[0034] The random projection features are remodeled and repaired, and the formula is:

[0035]

[0036] s=σ(W2δ(W1h)),

[0037] z rse =S×Z+Z

[0038] where h c is the descriptor of channel c obtained after the random projection feature dimensionality reduction operation, σ and δ represent the Sigmoid and ReLU activation functions respectively, W1 and W2 are the weights of the fully connected layer, s is the learning weight corresponding to each channel of the feature re-learned by the random projection feature z, and z rse It is the feature map after applying the learned adaptive channel weights, and the feature map is embedded with residual connections.

[0039] According to the image classification method for improving random adversarial robustness, remodeling and repairing the random projection features also includes noise filtering of the random projection features.

[0040] According to the image classification method for improving random adversarial robustness, the method includes:

[0041] Optimize the image classification model, including:

[0042]

[0043] Among them F θ+rSE represents the classifier used for feature recovery module enhancement, and α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0044] Another aspect of an embodiment of the present invention provides an image classification device for improving robustness to random adversarial attacks, comprising:

[0045] The first module is used to obtain the image data to be classified and perform initialization processing on the image to be classified;

[0046] The second module is used to classify the initialized image data using the image classification model to obtain the image classification results;

[0047] The training process of the image classification model includes:

[0048] The third module is used to obtain original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhanced features;

[0049] The fourth module is used to randomly project the random enhancement features using a convolutional neural network and a random projection filter to obtain projection features;

[0050] The fifth module is used to perform channel adaptive feature recovery processing on the projection features to obtain restored features, classify the restored features, and then determine the image classification model.

[0051] Another aspect of an embodiment of the present invention provides an electronic device, including a processor and a memory;

[0052] The memory is used to store programs;

[0053] The processor executes the program to implement the method described above.

[0054] Embodiments of the present invention further disclose a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the method described above.

[0055] The beneficial effects of the present invention are as follows: through random enhancement, instead of performing randomness and feature recovery in the classifier, randomness and robustness are added to the original image data at the data level, which can effectively improve the robustness of the image classification model under random adversarial attacks; through randomly selected enhancement kits, more robust features are learned during adversarial learning; through random projection based on feature recovery, the weights of significant channels in the sample feature space are adaptively enhanced, while the importance of irrelevant and negatively correlated channels is scaled, which can effectively restore previously incomplete image features affected by parameter resampling. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments with reference to the following drawings, in which:

[0057] Figure 1 3. This is a schematic diagram of an image classification process for improving random adversarial robustness according to an embodiment of the present invention.

[0058] Figure 2 Schematic diagram comparing the RAPS method with other typical methods, (a) is standard training (no defense), (b) is randomness-based defense (with excessive randomness), and (c) is the RAPS algorithm of an embodiment of the present invention.

[0059] Figure 3 This is a schematic diagram of an overview of the RAPS framework diagram of an embodiment of the present invention.

[0060] Figure 4a , Figure 4b , Figure 4c The following are the random projection ratios of the RAPS algorithm according to an embodiment of the present invention, the random projection positions in the CIFAR-10 and CIFAR-100 datasets, and the dimensionality reduction comparison diagrams of the feature recovery module.

[0061] Figure 5 Schematic diagram of an image classification device for improving random adversarial robustness according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] The following describes embodiments of the present invention in detail. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. In the subsequent description, suffixes such as "module," "component," or "unit" used to represent elements are used solely to facilitate the description of the present invention and have no specific meaning in themselves. Therefore, "module," "component," or "unit" may be used interchangeably. "First," "second," and the like are used solely to distinguish technical features and should not be construed as indicating or implying relative importance or implicitly indicating the number of the indicated technical features or implicitly indicating the order of the indicated technical features. In this subsequent description, the consecutive numbering of method steps is for ease of review and understanding. In conjunction with the overall technical solution of the present invention and the logical relationship between the various steps, adjusting the order of implementation of the steps does not affect the technical effects achieved by the technical solution of the present invention. The embodiments described below with reference to the accompanying drawings are exemplary and are intended only to explain the present invention and should not be construed as limiting the present invention.

[0063] Figure 1 The following is a flow chart of an image classification process for improving random adversarial robustness according to an embodiment of the present invention. The flow chart includes but is not limited to steps S100 to S500, wherein the image classification step includes:

[0064] S100, obtaining the image data to be classified and performing initialization processing on the image to be classified.

[0065] In some embodiments, the image data to be classified may be images generated by self-driving cars or medical diagnosis, and these images may include attacked images or normal images (clean images).

[0066] S200, classifying the initialized image data to be classified using an image classification model to obtain an image classification result.

[0067] The training process of the image classification model includes:

[0068] S300, obtaining original image data, and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhanced features.

[0069] In some embodiments, the anti-training process can be described as follows: Consider a classifier F characterized by parameters θ, which classifies R D The input image X is mapped to the logical space F θ (X)∈R K , where D represents the dimension of the original image and K represents the total number of categories. Then under the perturbation δ, the adversarial sample X adv =X+δ can be expressed as:

[0070]

[0071] Where L(·) represents the loss function, such as cross entropy loss; Y represents the true label of the input image. ∈ represents the maximum perturbation amplitude. In the adversarial training method, adversarial examples are designed and introduced into the classifier to establish a minimum-maximum optimization problem, which is expressed as:

[0072]

[0073] In traditional randomized defense strategies, the focus is often on introducing randomness into the model F, such as by injecting noise, adding random classifiers, and random projections. However, existing research shows that over-reliance on randomization techniques can adversely affect the performance of the model on adversarial samples and clean samples. Therefore, the embodiment of the present invention introduces randomness and robustness from the data level instead of further randomizing F (classifier). The embodiment of the present invention uses random data augmentation for adversarial training, which is formalized as follows:

[0074]

[0075] Where T RA (·) denotes random data augmentation performed on the input image.

[0076] It is understandable that the traditional data enhancement method T A (·) (usually involves random cropping with 4-pixel zero padding and horizontal flipping) does not introduce enough randomness during training. In order to inject additional randomness without changing the model parameters, the present invention uses AutoAugment as the T RA (·) Perform random data augmentation to further diversify the training data without affecting the underlying model architecture.

[0077] In some embodiments, the suite of random data enhancement techniques covers a wide range of operations such as ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Expose, Posterize, Contrast, Color, Brightness, Sharpness, and Clipping, as well as sample pairing.

[0078] In some embodiments, T RA (·) Using reinforcement learning, we find the optimal augmentation strategy for the dataset and task in the predefined set of augmentation operations. This search involves randomly selecting and combining different augmentation operations to explore which combinations of operations are most effective in improving model performance. After determining the optimal augmentation strategy, the specific operations (such as the rotation angle and the degree of color adjustment) are often randomized when applying these strategies to each image. This means that even the same image may encounter different augmentation versions in different training iterations, which can further increase data diversity and model randomness.

[0079] S400: Using a convolutional neural network and a random projection filter to randomly project the random enhancement features to obtain projection features.

[0080] In some embodiments, the input feature x∈R n×n×d , where n represents the size of the feature map and d is the dimension. Given a single convolutional neural network (CNN) filter f∈R r×r×d , r represents the kernel size, and the output z can be described by the following expression:

[0081]

[0082] in Represents the sub-region x targeted by the convolution operation, spanning rows p to p+r-1 and columns q to q+r-1. N In the convolutional layer, the first filter group f1,f2,...f rp is designated as a random projection filter whose parameters are randomly initialized from a zero-mean Gaussian distribution. The remaining filters f rp+1 ,f rp+2 ,...f N is a traditional convolution filter with trainable parameters. The combined output z can be expressed as:

[0083]

[0084] Where [,] represents the feature connection operation, σ 2 represents the variance of the chosen random projection filter.

[0085] S500 , performing channel adaptive feature restoration processing on the projected features to obtain restored features, classifying the restored features, and determining an image classification model.

[0086] Although integrating random projection filters can enhance adversarial robustness and stabilize the optimization of randomization methods, the resampling of parameters in the filters of some convolutional layers in this process will significantly affect the model performance on clean samples, resulting in the model being unusable in non-adversarial scenarios. The embodiment of the present invention believes that the convolutional layer may lose some learned data feature patterns after parameter resampling, resulting in the re-extracted features after the parameter update not conforming to the precise data distribution of the data set. Therefore, the embodiment of the present invention designs a plug-and-play lightweight feature recovery module, which aims to enrich the features after random projection, thereby achieving a more effective balance between adversarial robustness and clean sample accuracy.

[0087] The feature recovery module designed in this article by the embodiment of the present invention mainly focuses on plug-and-play and lightweight. Therefore, the embodiment of the present invention hopes to utilize more dimensions in the data features to obtain more hidden information to make up for the information loss caused by randomization. Therefore, in addition to the normal spatial dimension, the embodiment of the present invention also utilizes the channel dimension of the feature to recover and complement the feature. Specifically, the embodiment of the present invention adaptively enhances the weight of the significant channels in the sample feature space, while scaling the importance of irrelevant and negatively correlated channels. The advantage of this structure is that it enhances the model's ability to highlight relevant information and reduce the impact of less critical data while introducing minimal additional training parameters. Therefore, this module helps to alleviate the negative impact of parameter resampling on the performance of clean samples. In addition, in order to enhance generalization and reduce the mode collapse problem that may be introduced by adding noise, the embodiment of the present invention utilizes the residual connection structure to enhance the channel adaptive feature repair module (called rSE) proposed in the embodiment of the present invention as the key module of "post-noise feature remodeling and repair" in the RAPS model. The formula of rSE is as follows:

[0088]

[0089] s=σ(W2δ(W1h)),

[0090] z rse =S×Z+Z

[0091] where h c is the descriptor of channel c obtained after the feature dimensionality reduction operation, σ and δ represent the Sigmoid and ReLU activation functions respectively. W1 and W2 are the weights of the fully connected layer. s is the learning weight corresponding to each channel of the feature re-learned after random projection z, z rseis the final feature map after applying the learned adaptive channel weights and embedding additional residual connections. In the ablation study section, the present embodiment studies how different scales of dimensionality reduction in the rSE module affect its performance.

[0092] After processing by the above-mentioned adaptive channel feature recovery module, the previously incomplete image features affected by parameter resampling can be effectively restored. In addition, this module is designed to filter out the noise introduced by the new parameters as much as possible, thereby improving the usability of the recovered features.

[0093] Therefore, the optimization goal of the entire RAPS process can be expressed as:

[0094]

[0095] Among them F θ+rSE represents the classifier enhanced by adding the proposed feature recovery module. α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0096] By implementing the optimization goals outlined above, the RAPS algorithm proposed in this embodiment establishes a novel set of randomized adversarial defense mechanisms. These mechanisms, including randomized data augmentation, randomized projection, and feature recovery post-projection, collectively aim to achieve a better balance between adversarial robustness and clean sample performance.

[0097] refer to Figure 2 ,in Figure 2 Schematic diagram comparing the RAPS (random augmentation, random projection, and feature recovery) method with other typical methods, (a) standard training (no defense), (b) randomness-based defense (with excessive randomness), and (c) the RAPS algorithm of an embodiment of the present invention.

[0098] The embodiments of the present invention enhance the effectiveness of randomized adversarial defense techniques from two different perspectives. First, unlike previous methods that enhance adversarial robustness by changing model parameters or adjusting noise levels during training, the embodiments of the present invention follow the technical route of data enhancement and introduce variability during the training phase, effectively improving the model's ability to resist attacks. Second, in order to mitigate the loss of feature information and performance degradation caused by random projection changing the parameter space, the embodiments of the present invention introduce an innovative lightweight feature recovery module designed to minimize this impact. Inspired by these insights, the embodiments of the present invention propose a new adversarial defense method called RAPS (Random Augmentation, Projection, and Restoration). Figure 2 A comparison between a standard training model, a previous randomness-based model, and RAPS proposed in an embodiment of the present invention is shown.

[0099] Figure 3This is a schematic diagram of the RAPS framework of the embodiment of the present invention. The embodiment of the present invention introduces the RAPS algorithm proposed in the embodiment of the present invention, which is a simple and effective strategy that can improve the performance of adversarial defense based on random projection. Figure 3 This embodiment of the present invention first details the random data augmentation technique employed to improve the randomness of the entire model, focusing on diversifying the input data. It then proposes a feature recovery module following the random projection filter to restore feature information that may have been lost after randomization.

[0100] The typical adversarial training process can be described as follows: Consider a classifier F characterized by parameters θ, which classifies R D The input image X is mapped to the logical space F θ (X)∈R K , where D represents the dimension of the original image and K represents the total number of categories. Then under the perturbation δ, the adversarial sample X adv =X+δ can be expressed as:

[0101]

[0102] Where L(·) represents the loss function, such as cross entropy loss; Y represents the true label of the input image. ε∈ represents the maximum perturbation amplitude. In adversarial training methods, adversarial examples are designed and introduced into the classifier to establish a minimum-maximum optimization problem, which is expressed as:

[0103]

[0104] In traditional randomized defense strategies, the focus is often on introducing randomness into the model F, such as by injecting noise, adding random classifiers, and random projections. However, existing research shows that over-reliance on randomization techniques can adversely affect the model's performance on both adversarial and clean samples. Therefore, the embodiments of the present invention instead introduce randomness and robustness at the data level, rather than further randomizing F. The embodiments of the present invention use random data augmentation for adversarial training, which is formalized as follows:

[0105]

[0106] Where T RA (·) denotes random data augmentation performed on the input image.

[0107] In previous studies on image classification and enhancing adversarial robustness, data augmentation is a commonly used strategy. However, traditional data augmentation methods T A(·) (usually involves random cropping with 4-pixel zero padding and horizontal flipping) does not introduce enough randomness during training. In order to inject additional randomness without changing the model parameters, the present invention uses AutoAugment as the T RA (·) Perform random data augmentation to further diversify the training data without affecting the underlying model architecture.

[0108] The suite of random data enhancement techniques implemented in embodiments of the present invention covers a wide range of operations such as ShearX / Y, Translate X / Y, Rotate, Auto Contrast, Invert, Equalize, Expose, Tone Separation, Contrast, Color, Brightness, Sharpness, and Shear, as well as Sample Pairing. RA (·) Using reinforcement learning, find the best enhancement strategy for the current dataset and task among the predefined set of enhancement operations mentioned above. This search process involves randomly selecting and combining different enhancement operations to explore which combination of operations is most effective in improving model performance. After determining the best enhancement strategy, when applying these strategies to each image, the specific operations (such as the angle of rotation, the degree of color adjustment, etc.) are often random. This means that even the same image may encounter different enhancement versions in different training iterations, which can further increase the diversity of the data and the randomness of the model. In short, T RA (·) helps the model learn more robust features.

[0109] In some embodiments, based on random projection for feature recovery, in order to prevent white-box attackers from obtaining accurate gradient information and generating strong adversarial samples, Dong et al. proposed the RPF method, which incorporates random projection into the CNN layer to achieve a better balance between adversarial robustness and optimization difficulty. In the RPF method, a branch of convolutional filters in the CNN layer is replaced by random projection. Formally, consider the input feature x∈R n×n×d , where n represents the size of the feature map and d is the dimension. Given a single convolutional neural network (CNN) filter f∈R r×r×d , r represents the kernel size, and the output z can be described by the following expression:

[0110]

[0111] in Represents the sub-region x targeted by the convolution operation, spanning rows p to p+r-1 and columns q to q+r-1. N In the convolutional layer, the first filter group f1,f2,...f rp is designated as a random projection filter whose parameters are randomly initialized from a zero-mean Gaussian distribution. The remaining filters frp+1 ,f rp+2 ,...f N is a traditional convolution filter with trainable parameters. The combined output z can be expressed as:

[0112]

[0113] Where [,] represents the feature connection operation, σ 2 represents the variance of the chosen random projection filter.

[0114] Although integrating random projection filters can enhance adversarial robustness and stabilize the optimization of randomization methods, the resampling of parameters in the filters of some convolutional layers in this process will significantly affect the model performance on clean samples, resulting in the model being unusable in non-adversarial scenarios. The embodiment of the present invention believes that the convolutional layer may lose some learned data feature patterns after parameter resampling, resulting in the re-extracted features after the parameter update not conforming to the precise data distribution of the data set. Therefore, the embodiment of the present invention designs a plug-and-play lightweight feature recovery module, which aims to enrich the features after random projection, thereby achieving a more effective balance between adversarial robustness and clean sample accuracy.

[0115] The feature recovery module designed in this article by the embodiment of the present invention mainly focuses on plug-and-play and lightweight. Therefore, the embodiment of the present invention hopes to utilize more dimensions in the data features to obtain more hidden information to make up for the information loss caused by randomization. Therefore, in addition to the normal spatial dimension, the embodiment of the present invention also utilizes the channel dimension of the feature to recover and complement the feature. Specifically, the embodiment of the present invention adaptively enhances the weight of the significant channels in the sample feature space, while scaling the importance of irrelevant and negatively correlated channels. The advantage of this structure is that it enhances the model's ability to highlight relevant information and reduce the impact of less critical data while introducing minimal additional training parameters. Therefore, this module helps to alleviate the negative impact of parameter resampling on the performance of clean samples. In addition, in order to enhance generalization and reduce the mode collapse problem that may be introduced by adding noise, the embodiment of the present invention utilizes the residual connection structure to enhance the channel adaptive feature repair module (called rSE) proposed in the embodiment of the present invention as the key module of "post-noise feature remodeling and repair" in the RAPS model. The formula of rSE is as follows:

[0116]

[0117] s=σ(W2δ(W1h)),

[0118] z rse =s×Z+Z.

[0119] where hc is the descriptor of channel c obtained after the feature dimensionality reduction operation, σ and δ represent the Sigmoid and ReLU activation functions respectively. W1 and W2 are the weights of the fully connected layer. s is the learning weight corresponding to each channel of the feature re-learned after random projection z, z rse It is the final feature map after applying the learned adaptive channel weights and embedding additional residual connections. In the ablation study part, the embodiment of the present invention studies how different scales of dimensionality reduction in the rSE module affect its performance.

[0120] After processing by the above-mentioned adaptive channel feature recovery module, the previously incomplete image features affected by parameter resampling can be effectively restored. In addition, this module is designed to filter out the noise introduced by the new parameters as much as possible, thereby improving the usability of the recovered features.

[0121] Therefore, the optimization goal of the entire RAPS process can be expressed as:

[0122]

[0123] Among them F θ+rSE represents the classifier enhanced by adding the proposed feature recovery module. α represents the weight decay hyperparameter of the remaining traditional convolutional filters.

[0124] By optimizing the above-mentioned objectives, the RAPS algorithm proposed in this embodiment establishes a novel set of randomized adversarial defense mechanisms. These mechanisms include randomized data augmentation, randomized projection, and feature recovery post-projection, which together aim to achieve a better balance between adversarial robustness and clean sample performance.

[0125] Experimental setup: Based on previous studies, the present invention evaluates the RAPS of the present invention on two adversarial robustness transfer benchmark datasets, namely CIFAR-10 and CIFAR-100. The present invention evaluates the effectiveness of RAPS on several widely compared models in the field of adversarial robustness, including ResNet-18 and WideResNet-34-10. In order to evaluate the effectiveness of the proposed RAPS, the experiments of the present invention involve comparison with seven adversarial training-based methods (AT, GAT, FGSM-MEP, UIAT, LGBAT, IBD and GeodesicAT) and four other competitive random adversarial defense methods (Additive, RandomBit, Multiplicate and RPF).

[0126] Implementation details: The present embodiment uses the PyTorch framework to implement the model of the present embodiment on the NVIDIA RTX4090 GPU. The present embodiment adopts the most advanced adversarial training strategy and RPF protocol when conducting experiments on CIFAR-10 / 100. The network is trained for 200 epochs, using a batch size of 128 and SGD with a momentum of 0.9. The initial learning rate is set to 0.1, and the weight decay factor α is configured to 5×10-4. A piecewise learning rate decay strategy is applied, reducing the rate by 0.1 times at the 100th and 150th epochs. For the generation of adversarial examples, the present embodiment uses PGD-10, with a maximum perturbation limit of ε=8 / 255 and a PGD step size of 2 / 255. For the weight decay of the random projection layer on CIFAR-10, ResNet-18 is set to 1×10-2 and WideResNet-34-10 is set to 5×10-1. On CIFAR-100, this parameter is kept at 1×10−2. The placement of the random projection layer and other parameter settings are consistent with RPF.

[0127] Attacks: In order to evaluate the adversarial robustness of the RAPS proposed in the embodiment of the present invention, the embodiment of the present invention comprehensively tests various attacks, including the fast gradient sign method (FGSM), projected gradient descent (PGD), CW attack (CW), momentum-based iterative fast gradient sign method (MIFGSM) and automatic attack (AA). The embodiment of the present invention follows the established protocol to configure these attacks. For FGSM, PGD, MIGFSM and AA, the maximum perturbation size ε is uniformly set to 8 / 255. For PGD and MIGFSM, the step size is 2 / 255, and the number of steps is 20 and 5, respectively. For the CW attack, the learning rate is 0.01 in 1000 steps.

[0128] Tables 1-3 show the performance comparison of RAPS, proposed in this embodiment of the present invention, against ten other methods. The model proposed in this embodiment of the present invention significantly outperforms the comparison methods in terms of clean accuracy and adversarial robustness against five adversarial attacks. Notably, the present embodiment of the present invention observed that most defense methods utilizing randomization are more robust than pure adversarial training methods. However, the clean accuracy of randomized methods is generally lower than that of AT-based methods. The RAPS method in this embodiment of the present invention differs from previous randomized defense methods, which indiscriminately incorporate randomization at the model level. Instead, RAPS innovatively applies randomization through data augmentation and introduces additional randomization after the random projection layer via a feature recovery module. This approach mitigates the performance degradation on clean samples typically associated with excessive randomization. As a result, the model in this embodiment of the present invention achieves a better balance between accuracy and robustness. Specifically, compared to the leading randomized adversarial defense method, RPF, RAPS in this embodiment of the present invention achieves a 1%-7% improvement in accuracy on clean samples and an approximately 0.8%-5% improvement in adversarial robustness (as detailed in Sections AA below), unequivocally demonstrating the superiority of the RAPS algorithm.

[0129] Table 1 White-box experimental results of clean accuracy and robust accuracy on the CIFAR-10 dataset under the network architecture ResNet-18. - indicates that there is no corresponding result in the comparative literature.

[0130]

[0131] Table 2 White-box experiment results of clean accuracy and robust accuracy on the CIFAR-100 dataset under the network architecture ResNet-18.

[0132]

[0133]

[0134] Table 3 White-box experimental results of clean accuracy and robust accuracy on the CIFAR-10 dataset under the network architecture WideResNet-34-10.

[0135]

[0136] The key factors for the effectiveness of the RAPS method of the embodiment of the present invention include:

[0137] (1) Analyze the different contributions of the random data enhancement module and the feature recovery module to the overall performance;

[0138] (2) evaluate how changes in random projection ratio affect RAPS effectiveness;

[0139] (3) Evaluate the impact of dimensionality reduction within the feature recovery module on RAPS performance.

[0140] The embodiment of the present invention performs an ablation analysis to identify the different effects of the random data augmentation module and the feature recovery module in RAPS. The results are shown in Table 4. It can be observed that compared with the baseline model, the feature recovery module (FS) mainly improves the accuracy of clean samples, while the random data augmentation module (RA) enhances the adversarial robustness of the model. It is worth noting that using both the FS and RA modules (the full version of RAPS) simultaneously can achieve higher clean accuracy and adversarial robustness than using either module alone. This reflects the effectiveness of the model proposed in the embodiment of the present invention from a quantitative perspective. In addition, it shows that feature recovery and random data augmentation play complementary roles in the random adversarial defense strategy, and are an effective and innovative method to enhance the effectiveness of such defense mechanisms.

[0141] Table 4 Ablation experiment results on CIFAR-10 and CIFAR-100 based on ResNet-18

[0142]

[0143] Table 4 shows the results of ablation experiments on CIFAR-10 and CIFAR-100 based on ResNet-18 using the two components proposed in RAPS according to an embodiment of the present invention. FS and RA are the abbreviations for the feature recovery module and the random data augmentation module, respectively.

[0144] Random projection ratio in RAPS. The embodiment of the present invention also explores the impact of the ratio of random projection filters on the performance of RAPS. According to the RPF protocol, the embodiment of the present invention tested the results of inserting five different ratios of random projection layers in the first layer of the network. The results are shown in Figure 4(a), which shows that a clean accuracy of 86.28% can be achieved while maintaining 69.26% adversarial robustness (under AA), which is also the result reported by the embodiment of the present invention in the main experiment. When the ratio of random projection increases to 100%, the embodiment of the present invention finds that the clean accuracy performance of the model is greatly affected (dropped to 77.70%), and when the ratio is only 10%, the adversarial robustness of the model drops to the lowest point (only 61.90% under PGD). This also shows that there is an upper limit to the randomness added to the model. Therefore, the embodiment of the present invention also adopts a random projection ratio of 75%.

[0145] In some embodiments, the dimensionality reduction in feature recovery includes the impact of the scale of feature dimensionality reduction in the proposed feature recovery module on the final RAPS performance. Since the feature recovery module used in the embodiment of the present invention is calculated through adaptive channel reweighting with an additional residual connection, different scales of dimensionality reduction in the channel dimension of the feature will change the performance of the final model. The embodiment of the present invention tested three different dimensionality reduction ratios, namely 16, 32 and 64. The results on CIFAR-10 and CIFAR-100 are shown in Figures 4(b) and (c). It can be observed that when the dimensionality reduction ratio is too high (reaching 64), the performance of the model will decrease in terms of clean accuracy and adversarial robustness. The embodiment of the present invention believes that excessive reduction of the number of channels in the feature recovery module will lose too much inherent information, thereby further reducing the normal performance of the model. Therefore, the embodiment of the present invention uses 16 and 32 as the dimensionality reduction scale of channel features in CIFAR-10 and CIFAR-100, respectively.

[0146] Figure 5 Schematic diagram of an image classification device for improving random adversarial robustness according to an embodiment of the present invention. The device includes a first module 510, a second module 520, a third module 530, a fourth module 550, and a fifth module 550.

[0147] Among them, the first module is used to obtain the image data to be classified and initialize the image to be classified; the second module is used to classify the initialized image data to be classified using the image classification model to obtain the image classification result; the training process of the image classification model includes: the third module is used to obtain the original image data, and use the enhancement strategy to perform adversarial training on the original image to enhance the random features to obtain random enhanced features; the fourth module is used to use a convolutional neural network and a random projection filter to randomly project the random enhanced features to obtain projection features; the fifth module is used to perform channel adaptive feature recovery on the projection features to obtain restored features, and after classifying the restored features, determine the image classification model.

[0148] Exemplarily, with the cooperation of the first to fifth modules in the device, the embodiment device can implement any of the aforementioned image classification methods for improving random adversarial robustness, that is, obtaining image data to be classified and performing initialization processing on the image to be classified; classifying the initialized image data to be classified using an image classification model to obtain image classification results; the training process of the image classification model includes: obtaining original image data, performing adversarial training processing on the original image with random feature enhancement using an enhancement strategy to obtain random enhanced features; using a convolutional neural network and a random projection filter to randomly project the random enhanced features to obtain projection features; performing channel adaptive feature repair processing on the projection features to obtain restored features, and after classifying the restored features, determining the image classification model. The beneficial effects of the present invention are as follows: through random enhancement, instead of performing randomness and feature recovery in the classifier, randomness and robustness are added to the original image data at the data level, which can effectively improve the robustness of the image classification model under random adversarial attacks; through randomly selected enhancement kits, more robust features are learned during adversarial learning; through random projection based on feature recovery, the weights of significant channels in the sample feature space are adaptively enhanced, while the importance of irrelevant and negatively correlated channels is scaled, which can effectively restore previously incomplete image features affected by parameter resampling.

[0149] An embodiment of the present invention further provides an electronic device, the electronic device including a processor and a memory;

[0150] The memory stores a program;

[0151] The processor executes a program to perform the aforementioned image classification method for improving random adversarial robustness; the electronic device has the function of carrying and running the software system for image classification for improving random adversarial robustness provided by an embodiment of the present invention, such as a personal computer, a minicomputer, a main frame, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or communicating with a charged particle tool or other imaging device, etc.

[0152] An embodiment of the present invention further provides a computer-readable storage medium storing a program, wherein the program is executed by a processor to implement the image classification method for improving random adversarial robustness as described above.

[0153] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided in an exemplary manner for the purpose of providing a more comprehensive understanding of the technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are contemplated in which the order of the various operations is changed and the sub-operations described as a part of a larger operation are performed independently.

[0154] Embodiments of the present invention further disclose a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned image classification method for improving robustness to randomized adversarial attacks.

[0155] Furthermore, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise indicated, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It will also be understood that a detailed discussion of the actual implementation of each module is not necessary for understanding the present invention. More specifically, given the properties, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the module will be understood within the ordinary skill of an engineer. Therefore, a person skilled in the art using ordinary skill will be able to implement the present invention set forth in the claims without undue experimentation. It will also be understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0156] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0157] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0158] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0159] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0160] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0161] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

[0162] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for image classification to improve robustness to random adversarial attacks, characterized in that: include: Obtain the image data to be classified and perform initialization processing on the image to be classified; The initialized image data to be classified is classified using the image classification model to obtain the image classification results; The training process of the image classification model includes: Obtaining original image data, and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhanced features; The random enhancement features are randomly projected using a convolutional neural network and a random projection filter to obtain projection features, including: The branch convolution filter of the convolutional neural network is replaced by a random projection filter, and the enhanced features are processed by the convolutional neural network through a single filter to obtain: It indicates Single filter output, and Represent the row index and column index of the output feature map respectively, represents the enhanced features of the input, and ,in represents the size of the feature map, is the dimension of the original image data, is a filter, and ,in represents the kernel size, Indicates the convolution operation for Subregions of arrive and column arrive , Represent the row index number, column index number and depth index number of the filter respectively; Through the convolutional layer of the convolutional neural network Filters , the first filter bank As a random projection filter, the parameters of the random projection filter are randomly initialized from a zero-mean Gaussian distribution, and the remaining filters For traditional convolution filters with trainable parameters, the output is a combination of random projection filters and traditional convolution filters: in represents the feature connection operation, represents the variance of the selected random projection filters, where the combined output That is the random projection feature; Channel adaptive feature restoration processing is performed on the projection features to obtain restored features, and after classifying the restored features, the image classification model is determined.

2. The image classification method for improving random adversarial robustness according to claim 1, characterized in that: The obtaining of original image data and performing adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhancement features include: The original image data As the input image is mapped to the logical space, the adversarial sample obtained by adding perturbations is: in For adversarial samples, is the input image, Represents the true label of the input image, which is , represents disturbance, and the logical space ,in represents the total number of categories, represents a classifier characterized by parameters, represents the loss function, represents the maximum disturbance amplitude, represents the dimension of the original image data, where the original image data includes clean samples; Introducing adversarial samples into the classifier, the minimum-maximum optimization problem is constructed as follows: According to the minimum-maximum optimization problem, random data enhancement is used for adversarial training, and its formula is: in, Indicates that random data augmentation is performed on the input image to obtain random enhanced features.

3. The image classification method for improving random adversarial robustness according to claim 2, characterized in that: The adversarial training using random data enhancement also includes: According to the type of original image data, random selection and random combination are used to search for the best enhancement strategy from the enhancement suite, where the enhancement suite includes ShearX / Y, TranslateX / Y, Rotate, Auto Contrast, Invert, Equalize, Overexposure, Tone Separation, Contrast, Color, Brightness, Sharpness, Crop, and Sample Pairing.

4. The image classification method for improving random adversarial robustness according to claim 2, characterized in that: The method further comprises: The random projection features are remodeled and repaired, and the formula is: in is the channel obtained after random projection feature dimensionality reduction operation The descriptor of and Represents Sigmoid and ReLU activation functions respectively, and is the weight of the fully connected layer, is the random projection feature The learning weights corresponding to each channel of the re-learned features, It is the feature map after applying the learned adaptive channel weights, and the feature map is embedded with residual connections.

5. The image classification method for improving random adversarial robustness according to claim 4, characterized in that: The remodeling and repairing of the random projection features also includes filtering out noise from the random projection features.

6. The image classification method for improving random adversarial robustness according to claim 2, characterized in that: The method comprises: Optimize the image classification model, including: in represents the classifier used for feature recovery module enhancement, represents the weight decay hyperparameter of the remaining traditional convolutional filters.

7. An image classification device for improving random adversarial robustness, characterized in that: include: The first module is used to obtain the image data to be classified and perform initialization processing on the image to be classified; The second module is used to classify the initialized image data using the image classification model to obtain the image classification results; The training process of the image classification model includes: The third module is used to obtain original image data, and perform adversarial training processing of random feature enhancement on the original image using an enhancement strategy to obtain random enhanced features; The fourth module is used to randomly project the random enhancement features using a convolutional neural network and a random projection filter to obtain projection features, including: The branch convolution filter of the convolutional neural network is replaced by a random projection filter, and the enhanced features are processed by the convolutional neural network through a single filter to obtain: It indicates Single filter output, and Represent the row index and column index of the output feature map respectively, represents the enhanced features of the input, and ,in represents the size of the feature map, is the dimension of the original image data, is a filter, and ,in represents the kernel size, Indicates the convolution operation for Subregions of arrive and column arrive , Represent the row index number, column index number and depth index number of the filter respectively; Through the convolutional layer of the convolutional neural network Filters , the first filter bank As a random projection filter, the parameters of the random projection filter are randomly initialized from a zero-mean Gaussian distribution, and the remaining filters For traditional convolution filters with trainable parameters, the output is a combination of random projection filters and traditional convolution filters: in represents the feature connection operation, represents the variance of the selected random projection filters, where the combined output That is the random projection feature; The fifth module is used to perform channel adaptive feature recovery processing on the projection features to obtain restored features, classify the restored features, and then determine the image classification model.

8. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the image classification method for improving random adversarial robustness according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the image classification method for improving random adversarial robustness according to any one of claims 1 to 6.

Images