Image classification method and system for defense and adversarial patch samples

Abstract

The invention relates to an image classification method and system for defending and adversarial patch samples. The method comprises the following steps: constructing a graph neural network model, firstly inputting a sample image and extracting an intermediate layer feature vector; processing the data to form node features; secondly, randomly generating a standard Gaussian distribution matrix as an adjacent matrix, combining the standard Gaussian distribution matrix with the node features to construct a feature subspace, processing the feature subspace through a graph neural network, and substituting an obtained mapping output vector into a loss function for calculation and iterative updating to obtain an optimized graph neural network model; and finally, inputting a to-be-processed image into the optimized graph neural network model to defend the influence of an adversarial patch sample on an image classification process. Compared with the prior art, the method has the advantages that the patch defense effect of the deep learning model is realized, the influence on the clean sample classification accuracy can be avoided, the robustness of the deep learning model is improved, and meanwhile, the method can be effectively generalized among different attack scenes and attack algorithms.

Description

Technical Field

[0001] The present invention relates to the field of computer vision technology, and in particular to an image classification method and system for defending against adversarial patch samples. Background Art

[0002] Adversarial patch sample attacks mainly refer to adding some tiny and imperceptible disturbances to the input image data of the deep learning model locally, causing the model to produce incorrect output judgments on the input image data, thereby destroying the performance and reliability of the model. Similar to traditional adversarial patch sample attacks, the attacker uses optimization methods such as gradient descent to minimize the objective function to generate adversarial patches, and then overlays the patches on the original clean image to induce the deep learning model to misjudge. Since current fields such as autonomous driving, face recognition, and security monitoring mainly use deep learning visual models to make decisions on image data collected by visual sensors, studying deep learning model defense methods that can resist patch sample attacks will help improve the robustness of deep learning models and promote the widespread promotion and application of deep learning models in practical applications.

[0003] At present, the defense methods against adversarial patch samples are mainly divided into three research directions, namely, defense methods based on image preprocessing, defense methods based on gradient regularization, and defense methods for reconstructing robust deep learning models.

[0004] Among the defense methods for image preprocessing, the existing technology uses the amplitude of the saliency map to detect abnormal areas in the input image and mask the abnormal areas in the input image. The defense methods of SAC (Segment and Complete) and MR (Masking and Refining) mainly use the idea of ​​image segmentation, predict the initial irregular patch area through the patch segmenter, and then use mask voting to complete the patch area. However, this method of using a mask to directly cover the adversarial patch area will destroy the semantic integrity of the original image. When using this type of defense method to classify clean images, the incorrect addition of the defense mask will cause the classification accuracy of the deep learning model for the original clean sample to decrease.

[0005] In the defense method of gradient regularization, the existing technology has a method of embedding high-dimensional input images into low-dimensional data space, and applying regularization in the low-dimensional latent data space to push adversarial samples back into the natural image data manifold to reduce the impact of adversarial samples on the characteristics of the latent space, so as to enhance the robustness of the model against adversarial attacks. However, since the high-dimensional input data is directly mapped to the low-dimensional latent space, the low-dimensional latent space cannot capture the details and complexity of the original image, which will lead to a decrease in classification accuracy when the model processes clean samples, and the model performance will be degraded.

[0006] There is also a method of adding a penalty term for slight disturbances to the loss function, training the model through adversarial training to reduce the model's sensitivity to slight disturbances. However, the defense method using gradient regularization will bring huge computational overhead, resulting in increased training time and computing resource costs. At the same time, the model after adversarial training can only have a certain defense effect against a single specific attack algorithm. Once the attacker updates the attack algorithm, the model will have problems such as defense failure. Summary of the invention

[0007] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide an image classification method and system for defending against adversarial patch samples.

[0008] The purpose of the present invention can be achieved by the following technical solutions:

[0009] According to one aspect of the present invention, there is provided an image classification method for defending against adversarial patch samples, the method comprising the following steps:

[0010] S1. Build a graph neural network model and a deep learning feature extractor based on a convolutional neural network, input the sample image into the feature extractor, and extract the intermediate layer feature vector of the sample image;

[0011] S2, downsample the feature vector of the middle layer, and linearly map the downsampled feature vector to a one-dimensional feature vector as a node feature of the feature subspace;

[0012] S3, randomly generate a standard Gaussian distribution adjacency matrix and map it to a binary matrix as the adjacency matrix of the feature subspace;

[0013] S4. Construct a feature subspace based on the adjacency matrix and node features, map it to the spectral domain space through the graph neural network model, and convolve the node features therein to obtain its mapping output vector;

[0014] S5. Bring the mapping output vector into the loss function calculation, and update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction;

[0015] S6. Iterate and repeat steps S2-S6 until the output loss value of the graph neural network model reaches the preset loss value, save the graph neural network model parameters at this time as the optimal model parameters, and obtain the optimized graph neural network model;

[0016] S7. Input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process, and output the image classification result.

[0017] As a preferred technical solution, the downsampling in S2 is completed by a global average pooling layer, and the linear mapping of the downsampled feature vector to a one-dimensional feature vector is completed by a flattening layer.

[0018] As a preferred technical solution, the standard Gaussian distribution adjacency matrix in S3 is a random matrix satisfying the Gaussian distribution, that is, each element in the matrix is ​​randomly sampled from a Gaussian distribution with a mean of 0 and a variance of 1;

[0019] The size of the matrix is ​​determined by the number of points in the feature subspace. The value of each element in the matrix represents the adjacency weight between two nodes. If there is a connection between node i and node j, the position in the i-th row and j-th column and the j-th row and i-th column of the adjacency matrix is ​​a non-zero value representing the connection strength between the two nodes; if there is no direct connection between node i and node j, the corresponding adjacency matrix position is 0.

[0020] As a preferred technical solution, S3 uses a sign function combined with a bias term to map the standard Gaussian distribution adjacency matrix into a binary matrix. The specific formula of the process is:

[0021]

[0022] Where ε is a binary matrix, sign(·) is the sign function, and adj is the standard Gaussian distribution matrix.

[0023] As a preferred technical solution, in S4, it is mapped to the spectral domain space through the graph neural network model, and the process of convolving the node features therein is: first construct the Laplace matrix L, and perform feature decomposition on it to obtain the eigenvector matrix U; then use the eigenvector matrix U to perform Fourier transform on the node feature x and map it to the spectral domain space; then in the graph neural network model, convolve the node features to obtain its mapping output vector. The specific formula of this process is:

[0024]

[0025] L=U∧U T

[0026] F(x)=U T x,F -1 (x) = Ux

[0027]

[0028] w=w0=-w1

[0029] Where L is the Laplace matrix, I Nis the N×N identity matrix, D is the degree matrix of the graph, A is the adjacency matrix of the graph, U is the eigenvector matrix, F(x) is the feature subspace function in the spectral domain space, g*x is the graph convolution operation, g is the spectral domain space convolution kernel, x is the node feature input to the graph neural network model, is the adjacency matrix in which each node is connected to itself, is the degree matrix of the processed graph, W is the parameter matrix of the graph neural network model, H is the node features of the feature subspace after the convolution operation, X is the feature matrix of the node, and w, w0, and w1 are the parameters of the graph neural network model.

[0030] As a preferred technical solution, the gradient direction in S5 is the label y for the loss function The gradient of , in the i-th round of update, the specific formula of the gradient is:

[0031]

[0032] In the formula, g i is the gradient for updating the i-th round, is the loss function, h θ (x) is the prediction of the model, and y is the label corresponding to the input x.

[0033] As a preferred technical solution, in S5, the optimizer learning rate is adjusted to update the adjacency matrix of the feature subspace and the graph neural network model parameters. The specific process is as follows:

[0034] First, initialize the optimizer learning rate α. When the model accuracy variance is lower than the first preset threshold σ1, the model is judged to be trapped in a local optimal solution. At this time, iteration begins to adjust the learning rate and model parameters until the model accuracy is higher than the second preset threshold σ2, that is, the model optimization is completed. Finally, output the learning rate and model parameters.

[0035] As a preferred technical solution, the specific formula for iteratively adjusting the learning rate is:

[0036]

[0037] In the formula, α i is the current learning rate, α i-1 is the learning rate of the previous round, and i is the epoch number of the model update.

[0038] As a preferred technical solution, the specific formula for iteratively adjusting the model parameters is:

[0039] Θ i =Θ i-1 -α·g i

[0040] In the formula, Θ iis the current model parameter, Θ i-1 is the model parameter of the previous round, α is the optimizer learning rate, g i is the gradient when updating the i-th round.

[0041] According to another aspect of the present invention, there is provided an image classification system for defending against adversarial patch samples, the system being operated by the image classification method for defending against adversarial patch samples as described above.

[0042] The system includes a feature extraction module, a feature subspace construction module, a graph neural network module, a training optimization module and a defense application module;

[0043] The feature extraction module is used to construct a deep learning feature extractor based on a convolutional neural network, input a sample image into it, extract the intermediate layer feature vector of the sample image; and downsample the intermediate layer feature vector, linearly map the downsampled feature vector to a one-dimensional feature vector as a node feature of the feature subspace;

[0044] The feature subspace construction module is used to randomly generate a standard Gaussian distribution adjacency matrix and map it into a binary matrix as the adjacency matrix of the feature subspace; and construct the feature subspace based on the adjacency matrix and node features.

[0045] The graph neural network module is used to perform nonlinear mapping on the feature subspace and convolve the node features therein to obtain the mapped output vector;

[0046] The training optimization module is used to bring the mapping output vector into the loss function calculation, update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction, and iterate until the model output loss value is the lowest, and save the graph neural network model parameters;

[0047] The defense application module is used to input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process.

[0048] Feature subspace building blocks

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. In the method of the present invention, a deep learning feature extractor based on a convolutional neural network is first constructed, and a sample image is input into it to extract the intermediate layer feature vector of the sample image; then it is downsampled and linearly mapped into a one-dimensional feature vector as the node feature of the feature subspace; at the same time, a standard Gaussian distribution adjacency matrix is ​​randomly generated and mapped into a binary matrix as the adjacency matrix of the feature subspace; then the feature subspace is constructed based on the adjacency matrix and the node feature, and its mapping output vector is obtained through the graph neural network model; then the loss function is brought into the calculation, and the adjacency matrix of the feature subspace and the graph neural network model parameters are iteratively updated; until the output loss value of the graph neural network model reaches the preset loss value, the graph neural network model parameters at this time are saved as the optimal model parameters to obtain the optimized graph neural network model; finally, the image to be processed is input into the optimized graph neural network model to defend against the influence of the adversarial patch sample on the image classification process. Compared with the general method, this method can avoid the influence on the classification accuracy of clean samples while realizing the deep learning model's adversarial patch defense effect, and can effectively improve the classification accuracy of clean samples in specific attack scenarios.

[0051] 2. In the method of the present invention, an edge relationship is established for nodes in the feature subspace in an adaptive manner, that is, the size of the standard Gaussian distribution adjacency matrix in S3 is determined by the number of nodes, and the value of each element in the matrix represents the adjacency weight between two nodes. If there is a connection between node i and node j, the position in the i-th row and j-th column of the adjacency matrix is ​​a non-zero value representing the connection strength between the two nodes; if there is no direct connection between node i and node j, the corresponding adjacency matrix position is 0. And by adjusting the optimizer learning rate, the adjacency matrix of the feature subspace and the graph neural network model parameters are updated; this enables the method to screen out robust features closely related to the current task, form a feature subspace, and eliminate features that may be affected by adversarial patch sample attacks, thereby improving the robustness of the deep learning model.

[0052] 3. In the method of the present invention, the feature subspace is mapped to the spectral domain space and convolved through the graph neural network model. First, the Laplace matrix L is constructed, and the feature decomposition is performed on it to obtain the feature vector matrix U; then the feature vector matrix U is used to perform Fourier transform on the node feature x and map it to the spectral domain space; then, in the graph neural network model, the node feature is convolved to obtain its mapping output vector, so that the method can be better generalized in different attack scenarios and attack algorithms, which helps to promote the application and deployment of deep learning models in real environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic diagram of the steps of an image classification method for defending against adversarial patch samples in the present invention;

[0054] Figure 2 It is a flow chart of the method for defending against patch samples based on feature subspace in the present invention;

[0055] Figure 3 Schematic diagram of the process of downsampling the middle layer features by the global average pooling operation in the embodiment;

[0056] Figure 4 Schematic diagram of the process of downsampling the middle layer features by the global maximum pooling operation in the embodiment;

[0057] Figure 5 A schematic diagram of a code for an optimization algorithm used for iteration in an embodiment;

[0058] Figure 6 It is a schematic diagram showing the comparison of the model classification accuracy of the present method, the LGS defense method and the PatchGuard defense method when the patch attack area is 10% of the image area in the embodiment;

[0059] Figure 7 This is a schematic diagram comparing the model classification accuracy of the present method, the LGS defense method, and the PatchGuard defense method when the patch attack area is 10% of the image area in the embodiment. DETAILED DESCRIPTION

[0060] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0061] Adversarial patch sample attacks mainly refer to adding some tiny and imperceptible disturbances to the input image data of the deep learning model locally, causing the model to produce incorrect output judgments on the input image data, thereby destroying the performance and reliability of the model. Similar to traditional adversarial patch sample attacks, the attacker uses optimization methods such as gradient descent to minimize the objective function to generate adversarial patches, and then overlays the patches on the original clean image to induce the deep learning model to misjudge. Since current fields such as autonomous driving, face recognition, and security monitoring mainly use deep learning visual models to make decisions on image data collected by visual sensors, studying deep learning model defense methods against adversarial patch sample attacks will help improve the robustness of deep learning models and promote the widespread promotion and application of deep learning models in practical applications.

[0062] Among them, the image preprocessing defense method refers to the detection and repair of input sample anomalies before the image is input into the deep learning model to achieve the defense goal. The gradient regularization-based defense method refers to adding a gradient regularization term to the loss function to reduce the sensitivity of the model output to input perturbations. This defense method is usually combined with adversarial training, that is, adversarial samples are introduced during the training process, and the adversarial samples are used together with clean samples to train the model, thereby reducing the sensitivity of the model to perturbations of the input samples and improving the robustness of the model. The defense method of reconstructing a robust deep learning model refers to adjusting the structure or redesigning the original deep learning model to make the improved model more robust.

[0063] At present, the defense methods against adversarial patch samples are mainly divided into three research directions, namely, defense methods based on image preprocessing, defense methods based on gradient regularization, and defense methods for reconstructing robust deep learning models.

[0064] Among the defense methods for image preprocessing, the existing technology uses the amplitude of the saliency map to detect abnormal areas in the input image and mask the abnormal areas in the input image. The defense methods of SAC (Segment and Complete) and MR (Masking and Refining) mainly use the idea of ​​image segmentation, predict the initial irregular patch area through the patch segmenter, and then use mask voting to complete the patch area. However, this method of using a mask to directly cover the adversarial patch area will destroy the semantic integrity of the original image. When using this type of defense method to classify clean images, the incorrect addition of the defense mask will cause the classification accuracy of the deep learning model for the original clean sample to decrease.

[0065] In the defense method of gradient regularization, the existing technology has a method of embedding high-dimensional input images into low-dimensional data space, and applying regularization in the low-dimensional latent data space to push adversarial samples back into the natural image data manifold to reduce the impact of adversarial samples on the characteristics of the latent space, so as to enhance the robustness of the model against adversarial attacks. However, since the high-dimensional input data is directly mapped to the low-dimensional latent space, the low-dimensional latent space cannot capture the details and complexity of the original image, which will lead to a decrease in classification accuracy when the model processes clean samples, and the model performance will be degraded.

[0066] There is also a method of adding a penalty term for slight disturbances to the loss function, training the model through adversarial training to reduce the model's sensitivity to slight disturbances. However, the defense method using gradient regularization will bring huge computational overhead, resulting in increased training time and computing resource costs. At the same time, the model after adversarial training can only have a certain defense effect against a single specific attack algorithm. Once the attacker updates the attack algorithm, the model will have problems such as defense failure.

[0067] Therefore, there is an urgent need for a highly efficient defense method that has no impact on the accuracy of clean input classification samples to optimize the deployment of deep learning models in real-world environments.

[0068] Example 1

[0069] In this embodiment, a method for defending against adversarial patch samples based on feature subspace is applied. This method uses global average pooling to downsample the intermediate layer features to reduce the impact of outliers on the features, and constructs a feature subspace using an adaptive adjacency matrix for the downsampled features. During the optimization process, the model selects robust features that are closely related to the current task to form a feature subspace, and removes features that may be affected by adversarial patch sample attacks, thereby improving the robustness of the deep learning model. This method can avoid affecting the classification accuracy of clean samples while improving the robustness of the model, and can achieve generalization between different attack scenarios and algorithms. This method is Figure 1 As shown, the following steps are included:

[0070] S1. Build a graph neural network model and a deep learning feature extractor based on a convolutional neural network, input the sample image into the feature extractor, and extract the intermediate layer feature vector of the sample image;

[0071] S2, downsample the feature vector of the middle layer, and linearly map the downsampled feature vector to a one-dimensional feature vector as a node feature of the feature subspace;

[0072] S3, randomly generate a standard Gaussian distribution adjacency matrix and map it to a binary matrix as the adjacency matrix of the feature subspace;

[0073] S4. Construct a feature subspace based on the adjacency matrix and node features, map it to the spectral domain space through the graph neural network model, and convolve the node features therein to obtain its mapping output vector;

[0074] S5. Bring the mapping output vector into the loss function calculation, and update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction;

[0075] S6. Iterate and repeat steps S2-S6 until the output loss value of the graph neural network model reaches the preset loss value, save the graph neural network model parameters at this time as the optimal model parameters, and obtain the optimized graph neural network model;

[0076] S7. Input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process, and output the image classification result.

[0077] In S2 of this method, downsampling is performed by the global average pooling layer. The global average pooling operation downsamples the intermediate layer features as follows: Figure 3 As shown, the linear mapping of the downsampled feature vector to a one-dimensional feature vector is completed by the flattening layer.

[0078] In this embodiment, the global maximum pooling operation is used as a comparison, and the downsampling process of the intermediate layer is as follows: Figure 4 As shown by Figure 3 and Figure 4 It can be seen that the average pooling operation can reduce the impact of the adversarial patch on the remaining features. In S3 of this method, the standard Gaussian distribution adjacency matrix first generates a random matrix adj that satisfies the Gaussian distribution, that is, each element a in the matrix ij All are from the standard Gaussian distribution The size of the matrix corresponds to the number of nodes. Each element value in the standard Gaussian distribution adjacency matrix represents the adjacency weight between two nodes. If there is a connection between node i and node j, the elements at the (i, j) and (j, i) positions of the matrix represent the strength of the connection between the two nodes. If there is no connection, the element values ​​at these positions are 0.

[0079] In S3 of this method, a sign function is used in combination with a bias term to map a standard Gaussian distribution adjacency matrix into a binary matrix. The formula for mapping a randomly sampled standard Gaussian distribution adjacency matrix into a binary matrix is:

[0080]

[0081] In the formula, ε is a binary matrix, sign(·) is a sign function, and adj is a standard Gaussian distribution matrix. The above formula converts the randomly sampled Gaussian distribution adjacency matrix into a binary matrix without changing the original distribution, which is used as the adjacency matrix representing the edge relationship between nodes in the feature subspace. ε is the binary matrix mapped by the randomly sampled standard Gaussian distribution adjacency matrix.

[0082] In S4 of this method, the feature subspace uses a graph convolutional neural network based on the spectral domain to map the graph structure space to the classification space, effectively retaining the local and global structural features of the feature subspace; the process of mapping the feature subspace to the spectral domain space and convolving it through the graph neural network model is as follows: first construct the Laplace matrix L, and perform feature decomposition on it to obtain the eigenvector matrix U; then use the eigenvector matrix U to perform Fourier transform on the node feature x and map it to the spectral domain space; then in the graph neural network model, convolve the node features to obtain their mapping output vectors.

[0083] Among them, the method of mapping the feature subspace to the spectral domain space is as follows:

[0084] F(x)=U T x,F -1 (x) = Ux

[0085] Where U is the eigenvector matrix of the normalized graph Laplacian matrix L, and F(x) is the characteristic subspace function in the spectral domain space.

[0086] The normalization process can be written as:

[0087]

[0088] In the formula, D represents the degree matrix corresponding to the adjacency matrix A; I N is the identity matrix; L is the normalized graph Laplacian matrix.

[0089] The normalized graph Laplacian matrix is ​​a real symmetric semi-positive matrix, so the eigenvector matrix U can be obtained by decomposition. This process can be written as:

[0090] L=U∧U T

[0091] According to the convolution theorem, the spectral domain convolution process based on graph data can be defined as:

[0092]

[0093] In the formula, g*x is the graph convolution operation, g represents the spectral domain spatial convolution kernel, x represents the node features input to the graph neural network; U is the eigenvector matrix of the normalized graph Laplacian matrix L.

[0094] The convolution process of node features in the feature subspace at each layer in the graph neural network can be expressed as:

[0095]

[0096] In the formula, W represents the parameters in the graph neural network model, H represents the node features of the feature subspace after the convolution operation, and X is the feature matrix of the node. is the adjacency matrix in which each node is connected to itself, is the degree matrix of the corresponding processed graph.

[0097] In order to avoid problems such as gradient explosion during the optimization process, a parameter constraint w=w0=-w1 is added during the optimization process, where w, w0, and w1 are the parameters of the graph neural network model. The model is continuously iterated, and the adjacency matrix in the feature subspace is optimized through supervised learning.

[0098] In S5 of this method, the model iteratively updates the model parameters and adjacency matrix in the gradient direction by dynamically adjusting the learning rate of the model optimizer to improve the generalization and optimization efficiency of the deep learning model; where the input x, in the i-th step of the update, the label y for the loss function The gradient of is written as:

[0099]

[0100] In the formula, g i is the gradient for updating the i-th round, is the loss function, h θ (x) is the prediction of the model, and y is the label corresponding to the input x.

[0101] In this embodiment, the specific iterative step algorithm is as follows: Figure 5 As shown, the specific process is as follows:

[0102] For the input sample x and the corresponding label y, the first preset threshold σ1 and the second preset threshold σ2 are set as the state discrimination values ​​in the model optimization process; first, the optimizer learning rate α is initialized. When the model accuracy variance is lower than the first preset threshold σ1, the model is judged to be trapped in a local optimal solution. At this time, iteration begins to adjust the learning rate and model parameters. As the number of model update epochs increases, the learning rate gradually decreases until the model accuracy is higher than the second preset threshold σ2, that is, the model optimization is completed. Finally, the learning rate and model parameters are output.

[0103] Among them, the specific formula for iteratively adjusting the learning rate is:

[0104]

[0105] In the formula, α i is the current learning rate, α i-1 is the learning rate of the previous round, and i is the epoch number of the model update.

[0106] Among them, the specific formula for iteratively adjusting model parameters is:

[0107] Θ i =Θ i-1 -α·gi

[0108] In the formula, Θ i is the current model parameter, Θ i-1 is the model parameter of the previous round, α is the optimizer learning rate, g i is the gradient when updating the i-th round.

[0109] In this embodiment, in order to verify the robustness of the defense method and the feasibility of application in a real environment, two related verification experiments were conducted.

[0110] In this embodiment, relevant evaluation indicators are first proposed, including misleading rate and classification accuracy.

[0111] In this embodiment, the misleading rate is a measure of the impact of adversarial sample attacks on the robustness of deep learning. It refers to the proportion of successful adversarial sample attacks, that is, the proportion of misclassification made by the attacked deep learning model on adversarial samples. In this embodiment, this indicator is used to measure the stability of the defense method under different attack algorithms on three deep learning image backbone networks: Resnet-18, VGG-16, and Inception-v4. The specific expression is:

[0112]

[0113] In the formula, MR is the misleading rate, FP is adversarial is the number of adversarial samples misclassified, TP total is the total number of adversarial examples.

[0114] In this embodiment, the classification accuracy is an indicator for evaluating the performance of a deep learning classification model, that is, the proportion of samples correctly classified by the model on the test data set. This indicator is used to measure the defense performance of the defense method under different patch attack areas on the VGGFace, GTSRB, and Fashion-Mnist data sets. The specific expression is:

[0115]

[0116] Among them, Accuracy is the classification accuracy, TP is the number of samples correctly classified as positive examples, and TN is the number of samples correctly classified as negative examples by the model. FP is the number of negative examples that the model incorrectly classifies as positive examples. FN is the number of positive examples that the model incorrectly classifies as negative examples.

[0117] Table 1 Comparison of accuracy and misleading rate of each method

[0118]

[0119] In this embodiment, a defense generalization experiment was conducted. In this defense generalization experiment, the backbone network of the Resnet-18, VGG-16, and Inception-v4 deep learning models was combined with the defense method in this embodiment as a feature extraction module to demonstrate the model classification accuracy under different attack algorithms. As shown in Table 1, the defense method in this embodiment achieves a high classification accuracy for classifying clean samples on feature extraction modules of different architectures, proving that the defense method does not affect the classification accuracy of clean original samples during the defense process. For the GTSRB dataset, when the backbone network of the Resne-18 model is used as a feature extraction module, the classification accuracy on clean samples is 93.2%. At the same time, the highest classification accuracy of 92.8% was achieved on the VGGFace dataset. When the backbone networks of the VGG-16 and Inception-v4 models are used as feature extraction modules, the classification accuracy of the two deep learning classifiers on clean images is significantly improved by this defense method.

[0120] In this embodiment, a defense robustness experiment was conducted. In the defense robustness experiment, the defense performance of the defense method under different patch size attacks on the VGGFace, GTSRB, and Fashion-Mnist datasets was demonstrated, and compared with the LGS defense method and the PatchGuard defense method. The LGS defense method projects the scaled normalized gradient amplitude map onto the image to directly suppress the high activation area to achieve defense. The PatchGuard defense method uses a convolutional neural network with a smaller receptive field to limit the number of features that are resistant to patch destruction to achieve the defense effect of the model. Figure 6 , Figure 7 As shown in the figure, on the GTSRB dataset, as the patch attack size increases, the classification accuracy of the defense method in this embodiment decreases much slower than that of the LGS defense method and the PatchGuard defense method. On the VGGFace dataset with an image size of 224×224, when the patch size accounts for 10% of the image area, the defense method in this embodiment still maintains a high classification accuracy. In the case of targeted attacks, the average classification accuracy of the defense method in this embodiment on the three datasets is 81.31%, and the average accuracy after the attack only decreases by 6.06%.

[0121] To sum up, the defense method in this embodiment can avoid the reduction of the classification accuracy of the model on the original clean samples while achieving the defense effect of the deep learning model. Compared with the existing adversarial patch sample defense method, as the patch size of the adversarial patch increases as the proportion of the image increases, the defense method in this embodiment can effectively reduce the impact on the deep learning classification model.

[0122] Example 2

[0123] In this embodiment, a feature subspace-based adversarial patch sample defense system is applied. The system uses global average pooling to downsample the intermediate layer features to reduce the impact of outliers on the features, and constructs a feature subspace using an adaptive adjacency matrix for the downsampled features. During the optimization process, the model selects robust features that are closely related to the current task to form a feature subspace, and removes features that may be affected by adversarial patch sample attacks, thereby improving the robustness of the deep learning model. While improving the robustness of the model, this system can avoid affecting the classification accuracy of clean samples, and can achieve generalization between different attack scenarios and algorithms. The system can be used for defense processes such as Figure 2 shown.

[0124] The system includes a feature extraction module, a feature subspace construction module, a graph neural network module, a training optimization module and a defense application module;

[0125] In this system, the feature extraction module is used to construct a deep learning feature extractor based on a convolutional neural network, input a sample image into it, extract the intermediate layer feature vector of the sample image; and downsample the intermediate layer feature vector, linearly map the downsampled feature vector to a one-dimensional feature vector as the node feature of the feature subspace;

[0126] In this system, the feature subspace construction module is used to randomly generate a standard Gaussian distribution adjacency matrix and map it into a binary matrix as the adjacency matrix of the feature subspace; and construct the feature subspace based on the adjacency matrix and node features.

[0127] In this system, the graph neural network module is used to perform nonlinear mapping on the feature subspace and convolve the node features therein to obtain the mapped output vector;

[0128] In this system, the training optimization module is used to bring the mapping output vector into the loss function calculation, update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction, and iterate until the model output loss value is the lowest, and save the graph neural network model parameters;

[0129] In this embodiment, downsampling is performed by the global average pooling layer. The global average pooling operation downsamples the features of the intermediate layer. Figure 3 As shown, the linear mapping of the downsampled feature vector to a one-dimensional feature vector is completed by the flattening layer.

[0130] In this embodiment, the global maximum pooling operation is used as a comparison, and the downsampling process of the intermediate layer is as follows: Figure 4 As shown by Figure 3 and Figure 4It can be seen that the average pooling operation can reduce the impact of adversarial patches on other features.

[0131] In this system, the defense application module is used to input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process.

[0132] In this system, the standard Gaussian distribution adjacency matrix first generates a random matrix adj that satisfies the Gaussian distribution, that is, each element a in the matrix ij All are from the standard Gaussian distribution The size of the matrix corresponds to the number of nodes. Each element value in the standard Gaussian distribution adjacency matrix represents the adjacency weight between two nodes. If there is a connection between node i and node j, the elements at the (i, j) and (j, i) positions of the matrix represent the strength of the connection between the two nodes. If there is no connection, the element values ​​at these positions are 0.

[0133] In this system, the standard Gaussian distribution adjacency matrix is ​​mapped into a binary matrix using a sign function combined with a bias term. The specific formula is:

[0134]

[0135] In the formula, ε is a binary matrix, sign(·) is a sign function, and adj is a standard Gaussian distribution matrix. The above formula converts the randomly sampled Gaussian distribution adjacency matrix into a binary matrix without changing the original distribution, which is used as the adjacency matrix representing the edge relationship between nodes in the feature subspace. ε is the binary matrix mapped by the randomly sampled standard Gaussian distribution adjacency matrix.

[0136] In this system, the feature subspace uses a graph convolutional neural network based on the spectral domain to map the graph structure space to the classification space, effectively retaining the local and global structural features of the feature subspace; the process of mapping the feature subspace to the spectral domain space and convolving it through the graph neural network model is as follows: first construct the Laplace matrix L, and perform feature decomposition on it to obtain the eigenvector matrix U; then use the eigenvector matrix U to perform Fourier transform on the node feature x and map it to the spectral domain space; then in the graph neural network model, convolve the node features to obtain their mapping output vectors.

[0137] Among them, the method of mapping the feature subspace to the spectral domain space is as follows:

[0138] F(x)=U T x,F -1 (x) = Ux

[0139] Where U is the eigenvector matrix of the normalized graph Laplacian matrix L, and F(x) is the characteristic subspace function in the spectral domain space.

[0140] The normalization process can be written as:

[0141]

[0142] In the formula, D represents the degree matrix corresponding to the adjacency matrix A; I N is the identity matrix; L is the normalized graph Laplacian matrix.

[0143] The normalized graph Laplacian matrix is ​​a real symmetric semi-positive matrix, so the eigenvector matrix U can be obtained by decomposition. This process can be written as:

[0144] L=U∧U T

[0145] According to the convolution theorem, the spectral domain convolution process based on graph data can be defined as:

[0146]

[0147] In the formula, g*x is the graph convolution operation, g represents the spectral domain spatial convolution kernel, x represents the node features input to the graph neural network; U is the eigenvector matrix of the normalized graph Laplacian matrix L.

[0148] In this system, the convolution process of node features in the feature subspace at each layer in the graph neural network can be expressed as:

[0149]

[0150] In the formula, W represents the parameters in the graph neural network model, H represents the node features of the feature subspace after the convolution operation, and X is the feature matrix of the node. is the adjacency matrix in which each node is connected to itself, is the degree matrix of the corresponding processed graph.

[0151] In this system, in order to avoid problems such as gradient explosion during the optimization process, a parameter constraint w=w0=-w1 is added during the optimization process, where w, w0, and w1 are the parameters of the graph neural network model. The model is continuously iterated, and the adjacency matrix in the feature subspace is optimized through supervised learning. The model iteratively updates the model parameters and adjacency matrix in the gradient direction by dynamically adjusting the learning rate of the model optimizer to improve the generalization and optimization efficiency of the deep learning model; where the input x, in the i-th step of the update, the label y has no effect on the loss function The gradient of is written as:

[0152]

[0153] In the formula, g iis the gradient for updating the i-th round, is the loss function, h θ (x) is the prediction of the model, and y is the label corresponding to the input x.

[0154] In this embodiment, the specific iterative step algorithm is as follows: Figure 5 As shown, the specific process is as follows:

[0155] For the input sample x and the corresponding label y, the first preset threshold σ1 and the second preset threshold σ2 are set as the state discrimination values ​​in the model optimization process; first, the optimizer learning rate α is initialized. When the model accuracy variance is lower than the first preset threshold σ1, the model is judged to be trapped in a local optimal solution. At this time, iteration begins to adjust the learning rate and model parameters. As the number of model update epochs increases, the learning rate gradually decreases until the model accuracy is higher than the second preset threshold σ2, that is, the model optimization is completed. Finally, the learning rate and model parameters are output.

[0156] Among them, the specific formula for iteratively adjusting the learning rate is:

[0157]

[0158] In the formula, α i is the current learning rate, α i-1 is the learning rate of the previous round, and i is the epoch number of the model update.

[0159] Among them, the specific formula for iteratively adjusting model parameters is:

[0160] Θ i =Θ i-1 -α·g i

[0161] In the formula, Θ i is the current model parameter, Θ i-1 is the model parameter of the previous round, α is the optimizer learning rate, g i is the gradient when updating the i-th round.

[0162] In this embodiment, in order to verify the robustness of the defense system and the feasibility of application in a real environment, two related verification experiments are carried out.

[0163] In this embodiment, relevant evaluation indicators are first proposed, including misleading rate and classification accuracy.

[0164] In this embodiment, the misleading rate is a measure of the impact of adversarial sample attacks on the robustness of deep learning. It refers to the proportion of successful adversarial sample attacks, that is, the proportion of misclassification made by the attacked deep learning model on adversarial samples. In this embodiment, this indicator is used to measure the stability of the defense system under different attack algorithms on three deep learning image backbone networks: Resnet-18, VGG-16, and Inception-v4. The specific expression is:

[0165]

[0166] In the formula, MR is the misleading rate, FP is adversarial is the number of adversarial samples misclassified, TP total is the total number of adversarial examples.

[0167] In this embodiment, the classification accuracy is an indicator for evaluating the performance of a deep learning classification model, that is, the proportion of samples correctly classified by the model on the test data set. This indicator is used to measure the defense performance of the defense system under different patch attack areas on the VGGFace, GTSRB, and Fashion-Mnist data sets. The specific expression is:

[0168]

[0169] Among them, Accuracy is the classification accuracy, TP is the number of samples correctly classified as positive examples, and TN is the number of samples correctly classified as negative examples by the model. FP is the number of negative examples that the model incorrectly classifies as positive examples. FN is the number of positive examples that the model incorrectly classifies as negative examples.

[0170] Table 2 Comparison of accuracy and misleading rate of each method

[0171]

[0172] In this embodiment, a defense generalization experiment was conducted. In this defense generalization experiment, the backbone network of the Resnet-18, VGG-16, and Inception-v4 deep learning models was combined with the defense system in this embodiment as a feature extraction module to demonstrate the model classification accuracy under different attack algorithms. As shown in Table 2, the defense system in this embodiment achieved a high classification accuracy rate for classifying clean samples on feature extraction modules of different architectures, proving that the defense system does not affect the classification accuracy rate of clean original samples during the defense process. For the GTSRB dataset, when the backbone network of the Resne-18 model was used as a feature extraction module, the classification accuracy rate on clean samples was 93.2%. At the same time, the highest classification accuracy rate of 92.8% was achieved on the VGGFace dataset. When the backbone networks of the VGG-16 and Inception-v4 models were used as feature extraction modules, the classification accuracy of the two deep learning classifiers on clean images was significantly improved by the defense system.

[0173] In this embodiment, a defense robustness experiment was conducted, which demonstrated the defense performance of the defense system under attacks of different patch sizes on the VGGFace, GTSRB, and Fashion-Mnist datasets, and compared it with the LGS defense system and the PatchGuard defense system. The LGS defense system projects the scaled normalized gradient amplitude map onto the image to directly suppress the high activation area to achieve defense. The PatchGuard defense system achieves the defense effect of the model by using a convolutional neural network with a smaller receptive field to limit the number of features that are damaged by the adversarial patch. Figure 6 , Figure 7 As shown in the figure, on the GTSRB dataset, as the patch attack size increases, the classification accuracy of the defense system in this embodiment decreases much slower than that of the LGS defense system and the PatchGuard defense system. On the VGGFace dataset with an image size of 224×224, when the patch size accounts for 10% of the image area, the defense system in this embodiment still maintains a high classification accuracy. In the case of targeted attacks, the average classification accuracy of the defense system in this embodiment on the three datasets is 81.31%, and the average accuracy after the attack only decreases by 6.06%.

[0174] To sum up, the defense system in this embodiment can avoid the reduction of the classification accuracy of the model on the original clean samples while achieving the defense effect of the deep learning model. Compared with the existing adversarial patch sample defense system, as the patch size of the adversarial patch increases as the proportion of the image increases, the defense system in this embodiment can effectively reduce the impact on the deep learning classification model.

[0175] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. An image classification method for defending against adversarial patch samples, characterized in that: The method comprises the following steps: S1. Build a graph neural network model and a deep learning feature extractor based on a convolutional neural network, input the sample image into the feature extractor, and extract the intermediate layer feature vector of the sample image; S2, downsample the feature vector of the middle layer, and linearly map the downsampled feature vector to a one-dimensional feature vector as a node feature of the feature subspace; S3, randomly generate a standard Gaussian distribution adjacency matrix and map it to a binary matrix as the adjacency matrix of the feature subspace; S4. Construct a feature subspace based on the adjacency matrix and node features, map it to the spectral domain space through the graph neural network model, and convolve the node features therein to obtain its mapping output vector; S5. Bring the mapping output vector into the loss function calculation, and update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction; S6. Iterate and repeat steps S2-S6 until the output loss value of the graph neural network model reaches the preset loss value, save the graph neural network model parameters at this time as the optimal model parameters, and obtain the optimized graph neural network model; S7. Input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process, and output the image classification result.

2. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: The downsampling in S2 is completed by the global average pooling layer, and the linear mapping of the downsampled feature vector to a one-dimensional feature vector is completed by the flattening layer.

3. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: The standard Gaussian distribution adjacency matrix in S3 is a random matrix that satisfies the Gaussian distribution, that is, each element in the matrix is ​​randomly sampled from a Gaussian distribution with a mean of 0 and a variance of 1; The size of the matrix is ​​determined by the number of points in the feature subspace. The value of each element in the matrix represents the adjacency weight between two nodes. If there is a connection between node i and node j, then the position at the i-th row and j-th column and the j-th row and i-th column of the adjacency matrix is ​​a non-zero value representing the connection strength between the two nodes. If there is no direct connection between node i and node j, the corresponding adjacency matrix position is 0.

4. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: In S3, a sign function is combined with a bias term to map the standard Gaussian distribution adjacency matrix into a binary matrix. The specific formula of the process is: Where ε is a binary matrix, sign(·) is the sign function, and adj is the standard Gaussian distribution matrix.

5. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: In S4, the graph neural network model is used to map the node features to the spectral domain space, and the process of convolving the node features is as follows: first, the Laplace matrix L is constructed, and the feature decomposition is performed to obtain the feature vector matrix U; then the feature vector matrix U is used to perform Fourier transform on the node feature x to map it to the spectral domain space; then, in the graph neural network model, the node features are convolved to obtain their mapping output vectors. The specific formula of this process is: L=U∧U T F(x)=U T x,F -1 (x)=Ux w=w0=-w1 Where L is the Laplace matrix, I N is the N×N identity matrix, D is the degree matrix of the graph, A is the adjacency matrix of the graph, U is the eigenvector matrix, F(x) is the feature subspace function in the spectral domain space, g★x is the graph convolution operation, g is the spectral domain space convolution kernel, x is the node feature input to the graph neural network model, is the adjacency matrix in which each node is connected to itself, is the degree matrix of the processed graph, W is the parameter matrix of the graph neural network model, H is the node features of the feature subspace after the convolution operation, X is the feature matrix of the node, and w, w0, and w1 are the parameters of the graph neural network model.

6. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: The gradient direction in S5 is the label y for the loss function The gradient of , in the i-th round of update, the specific formula of the gradient is: In the formula, g i is the gradient for updating the i-th round, is the loss function, h θ (x) is the prediction of the model, and y is the label corresponding to the input x.

7. The image classification method for defending against adversarial patch samples according to claim 1, characterized in that: In S5, the optimizer learning rate is adjusted to update the adjacency matrix of the feature subspace and the graph neural network model parameters. The specific process is as follows: First, initialize the optimizer learning rate α. When the model accuracy variance is lower than the first preset threshold σ1, the model is judged to be trapped in a local optimal solution. At this time, iteration begins to adjust the learning rate and model parameters until the model accuracy is higher than the second preset threshold σ2, that is, the model optimization is completed. Finally, output the learning rate and model parameters.

8. The image classification method for defending against adversarial patch samples according to claim 7, characterized in that: The specific formula for iteratively adjusting the learning rate is: In the formula, α i is the current learning rate, α i-1 is the learning rate of the previous round, and i is the epoch number of the model update.

9. The image classification method for defending against adversarial patch samples according to claim 7, characterized in that: The specific formula for iteratively adjusting the model parameters is: I i =Θ i-1 -a·g i In the formula, Θ i is the current model parameter, Θ i-1 is the model parameter of the previous round, α is the optimizer learning rate, g i is the gradient when updating the i-th round.

10. An image classification system for defending against adversarial patch samples, characterized in that: The system works as an image classification method for defending against adversarial patch samples as described in any one of claims 1 to 9, the system comprising a feature extraction module, a feature subspace construction module, a graph neural network module, a training optimization module and a defense application module; The feature extraction module is used to construct a deep learning feature extractor based on a convolutional neural network, input a sample image into it, extract the intermediate layer feature vector of the sample image; and downsample the intermediate layer feature vector, linearly map the downsampled feature vector to a one-dimensional feature vector as a node feature of the feature subspace; The feature subspace construction module is used to randomly generate a standard Gaussian distribution adjacency matrix and map it into a binary matrix to serve as the adjacency matrix of the feature subspace; and construct the feature subspace based on the adjacency matrix and node features; The graph neural network module is used to perform nonlinear mapping on the feature subspace and convolve the node features therein to obtain the output vector after mapping; The training optimization module is used to bring the mapping output vector into the loss function calculation, update the adjacency matrix of the feature subspace and the graph neural network model parameters in the gradient direction; and iterate until the model output loss value is the lowest, and save the graph neural network model parameters; The defense application module is used to input the image to be processed into the optimized graph neural network model to defend against the influence of adversarial patch samples on the image classification process.

Images