Cooperative confrontation training method and system, terminal equipment, medium and integrated model

Abstract

The invention provides a collaborative confrontation training method and system, terminal equipment, a medium and an integrated model.The method comprises the steps that disturbance is added to a clean sample, and a confrontation sample corresponding to the clean sample is obtained; for any one of a clean sample and an adversarial sample, inputting the clean sample and the adversarial sample into each sub-model, and obtaining the probability that the sub-model outputs the real category of the clean sample and the adversarial sample; for any one sub-model in the three sub-models, calculating a probability difference value of other two sub-models except the sub-model in the integrated model, based on the probability of the sub-model and the probability difference value, constructing a cooperative confrontation training loss of the sub-model, and combining a cross entropy loss and the cooperative confrontation training loss to obtain a cooperative confrontation training result; and performing a back propagation algorithm, and updating parameters of the sub-model until the integrated model meets a preset standard. According to the invention, the robustness of collaborative confrontation training can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning technology, and specifically relates to a collaborative adversarial training method, system, terminal equipment, medium and integrated model. Background Art

[0002] Adversarial examples are carefully designed perturbation attacks on models, involving adding imperceptible perturbations to natural samples. Although these perturbations may not be noticeably different from real samples to the human eye, they can cause the model to make incorrect classifications (such as image recognition errors).

[0003] In recent years, many defense strategies have been developed, among which adversarial training has become one of the most effective and practical methods. Since adversarial training of a single model may not be sufficient to meet the urgent need for robustness, it is extended to collaborative adversarial training of multiple models. However, due to the higher output similarity between sub-models in the integrated model and the strong transferability of attacks, adversarial samples generated by one sub-model can easily deceive other sub-models and eventually mislead the entire integrated model.

[0004] To solve this problem, existing research work mainly focuses on improving the output diversity between sub-models and reducing the transferability of adversarial samples between sub-models. However, experimental results show that the effects of these methods cannot achieve the optimal effect, and the robustness of collaborative adversarial training is poor. The reason is that the collaboration between multiple models is ignored, the collaborative advantages of the integrated model are not fully utilized, the same training weights are still assigned to all samples, and the misclassified samples are not paid attention to, resulting in poor robustness of collaborative adversarial training. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a collaborative adversarial training method, system, terminal device, medium and integrated model to improve the robustness of collaborative adversarial training.

[0006] In a first aspect, the present invention provides a collaborative adversarial training method, which is applied to an integrated model, wherein the integrated model includes three sub-models, all of which are used for image recognition, and the model structures of different sub-models are different from each other. The method includes the following steps:

[0007] Add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; clean samples are autonomous driving images or object recognition images;

[0008] For each clean sample or adversarial sample, input the clean sample into each sub-model to obtain the probability of the sub-model outputting the true category of the clean sample or adversarial sample.

[0009] For each of the three sub-models, the probability difference of the other two sub-models in the integrated model is calculated. Based on the probability and probability difference of the sub-model itself, the collaborative adversarial training loss of the sub-model is constructed. Combined with the cross entropy loss and the collaborative adversarial training loss, the back propagation algorithm is performed to update the parameters of the sub-model until the integrated model meets the preset standards. The collaborative adversarial training loss is used to characterize the size of the training weight assigned to the clean samples of the sub-model during the training process.

[0010] Optionally, add perturbations to the clean samples, including:

[0011] By calculating the formula

[0012]

[0013] f m (x′ i ) = arg max k＝1,...,K p m (x′ i ,k)

[0014] Get the disturbance value δ m ; where α represents the step size, sgn(·) represents the sign function, represents the gradient of the loss function with respect to the input, x′ i represents the i-th clean sample x i The corresponding adversarial example, y i Represents x i The corresponding true category label, f m (x′ i ) indicates adding perturbations based on the gradient information of a single sub-model;

[0015] or

[0016] By calculating the formula

[0017]

[0018] Get the disturbance value δ m ; Among them, f en (x′ i ) represents the integrated model for adversarial sample x′ i The category output probability distribution of k represents the category of clean samples, M represents the number of sub-models in the integrated model, M = 3, p m (x′ i ,k) represents the sub-model’s response to the adversarial sample x′ after applying softmax to the logits of the m-th sub-model i The class output probability distribution, f en (x′i ) represents adding perturbations based on the gradient information of the integrated model.

[0019] Optionally, the collaborative adversarial training loss includes adversarial sample loss and clean sample loss;

[0020] The expression of adversarial sample loss is as follows:

[0021]

[0022] L adv =|f a (x′ i )-f a (x i )| 2

[0023] in, represents the adversarial sample loss, e D is the designed index difference, which is used to describe the difference in the category output of the other two sub-models except the current sub-model. a, b, c represent the three sub-models in the integrated model, a represents the current sub-model, and L adv represents distance regularization, h b (x′ i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The class output probability distribution, h c (x′ i ) indicates that after applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution, f a (x′ i ) represents the prediction of sub-model a for adversarial samples, f a (x i ) represents the prediction of model a for clean samples;

[0024] The expression of clean sample loss is as follows:

[0025]

[0026] L nat =|f a (x i )-y i |

[0027] in, represents the clean sample loss, h b (x i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is iThe class output probability distribution, h c (x i ) After applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution of .

[0028] Optional, preset criteria are:

[0029]

[0030] Among them, L EAT represents the training paradigm of the perturbation generated by the integrated model, n represents the total number of samples, represents the model parameters, n represents the total number of samples, L(x i +δ en ,y i ,θ) represents the loss of the perturbation calculation generated by the ensemble model,

[0031]

[0032] α represents the iteration step size, en represents the integrated model, and y i represents the label corresponding to the sample, sgn represents the sign function, δ en represents the perturbation added to the integration.

[0033] Optionally, the total loss value of the back-propagation algorithm is expressed as follows:

[0034]

[0035] Among them, L ce represents the cross entropy loss, λ,μ represent the weight coefficients.

[0036] In a second aspect, the present invention discloses an integrated model, which includes three sub-models. The three sub-models are all used for image recognition, and the model structures of different sub-models are different from each other; the sub-model is a deep neural network model.

[0037] In a third aspect, the present invention discloses a collaborative adversarial training system, which is applied to an integrated model, comprising:

[0038] The perturbation module is used to add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images;

[0039] A probability calculation module is used to input either a clean sample or an adversarial sample into each sub-model to obtain the probability that the sub-model outputs the true category of the clean sample or the adversarial sample;

[0040] The collaborative adversarial training module is used to calculate the probability difference of the other two sub-models in the integrated model for any one of the three sub-models, and construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself, and combine the cross entropy loss and the collaborative adversarial training loss to perform a back propagation algorithm to update the parameters of the sub-model until the integrated model meets the preset standards; wherein the collaborative adversarial training loss is used to characterize the degree of emphasis that the sub-model places on clean samples during the training process.

[0041] In a fourth aspect, the present invention discloses a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the collaborative adversarial training method as described above when executing the computer program.

[0042] In a fifth aspect, the present invention discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned collaborative adversarial training method is implemented.

[0043] The beneficial effects of the present invention are:

[0044] The collaborative adversarial training method provided by the present invention assigns training weights to samples according to the output probability of each sub-model in the integrated model for the true category of clean samples and their adversarial samples, combined with the probability difference between the sub-models. Each sub-model can assign a larger training weight to samples with recognition errors in other sub-models during the model training process, thereby enabling the integrated model to accurately identify the true category of the adversarial samples, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of a collaborative adversarial training method in one embodiment of the present application;

[0046] Figure 2 This is a flowchart of a collaborative adversarial training method in one embodiment of the present application;

[0047] Figure 3 This is a result diagram of an ablation experiment in one embodiment of the present application;

[0048] Figure 4a A schematic diagram of adversarial training using adversarial samples of cars in another embodiment of the present application;

[0049] Figure 4b A schematic diagram of adversarial training using adversarial samples of dogs in one embodiment of the present application;

[0050] Figure 4cA schematic diagram of adversarial training using adversarial samples of Chinese dogs in another embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the structure of a collaborative adversarial training system in one embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of the structure of a terminal device in one embodiment of the present application. DETAILED DESCRIPTION

[0053] In view of the problem that the traditional collaborative adversarial training method has poor robustness, the present invention provides a collaborative adversarial training method, system, terminal device, medium and integrated model. Among them, the method assigns training weights to samples according to the output probability of each sub-model in the integrated model for the true category of clean samples and their adversarial samples, combined with the probability difference between the sub-models. Each sub-model can assign a larger training weight to samples with recognition errors in other sub-models during the model training process, so that the integrated model can accurately identify the true category of adversarial samples, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model.

[0054] To facilitate understanding, the principle of the above scheme is first explained.

[0055] like Figure 1 As shown in the figure, there are three sub-models in the integrated model. For samples between the decision boundaries of model b and model c, it means that one sub-model is classified correctly and one sub-model is classified incorrectly. Whether the integrated model can correctly classify depends on the other sub-model a. During the training process of model a, these samples will be given greater weights to pull them back to the correct side of the decision boundary. More than half of the sub-models will classify these samples correctly, so the classification result of the ensemble model changes from wrong to correct. For samples that are consistently identified by model b and model c and far away from the decision boundary, the integrated classification remains unchanged regardless of whether the classification of model a is correct. Therefore, these samples are assigned smaller weights. Among them, lines a, b, and c are the decision boundaries of the three sub-models respectively. The green color of the figure indicates correct classification and the red color indicates incorrect classification. Images with larger sizes indicate that larger weights are assigned. 1, 2, 3, 4, 5, and 6 represent different samples.

[0056] The collaborative adversarial training method provided by the present invention is described below.

[0057] It should be noted that the collaborative adversarial training method provided by the present invention is particularly suitable for an integrated model, which includes three sub-models, all of which are used for image recognition, and the model structures of different sub-models are different. In an embodiment of the present invention, the above-mentioned sub-models are deep neural network models. Exemplarily, in one embodiment of the present invention, the above-mentioned deep neural network models are respectively a Vision Transformer (ViT, Vision Transformers) model, VGGNet and DenseNet.

[0058] like Figure 2 As shown, the collaborative adversarial training method includes the following steps:

[0059] Step 21, add perturbations to the clean samples to obtain adversarial samples corresponding to the clean samples.

[0060] In an embodiment of the present invention, the clean sample is an autonomous driving image or an object recognition image. Exemplarily, the clean sample is an image of an animal.

[0061] The process of adding disturbance to the clean sample in the present invention is described below.

[0062] Specifically, by calculating the formula

[0063]

[0064] f m (x′ i ) = arg max k＝1,...,K p m (x′ i ,k)

[0065] Get the disturbance value δ m ; where α represents the step size, sgn(·) represents the sign function, represents the gradient of the loss function with respect to the input, x′ i represents the i-th clean sample x i The corresponding adversarial example, y i Represents x i The corresponding true category label, f m (x′ i ) indicates adding perturbations based on the gradient information of a single sub-model;

[0066] or

[0067] By calculating the formula

[0068]

[0069] Get the disturbance value δ m ; Among them, f en (x′i ) represents the integrated model for adversarial sample x′ i The category output probability distribution of k represents the category of clean samples, M represents the number of sub-models in the integrated model, M = 3, p m (x′ i ,k) represents the sub-model’s response to the adversarial sample x′ after applying softmax to the logits of the m-th sub-model i The class output probability distribution, f en (x′ i ) represents adding perturbations based on the gradient information of the integrated model.

[0070] It should be noted that the difference between the two types of perturbations is that one uses the gradient information of a single model, while the other uses the gradient information of an integrated model. Specifically, the loss calculated in the first iteration is the loss of the clean sample, and the subsequent iterations calculate the loss of adding perturbations to the clean sample. The above input is a clean sample in the first iteration calculation, and the subsequent ones are samples with perturbations added.

[0071] Step 22, for each clean sample or adversarial sample, input the clean sample into each sub-model, and obtain the probability of the sub-model outputting the true category of the clean sample or adversarial sample.

[0072] The probability of the above adversarial samples can reflect the robustness of the sub-model to adversarial attacks. For example, the lower the probability that the sub-model outputs the true category of the adversarial sample, the worse the robustness of the sub-model to adversarial attacks.

[0073] The probability of the above clean samples can reflect the quality of the image recognition effect of the sub-model itself. For example, the lower the probability of the true category of the clean sample output by the sub-model, the worse the image recognition effect of the sub-model itself.

[0074] Step 23, for each of the three sub-models, calculate the probability difference of the other two sub-models in the integrated model except the sub-model, construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself, and combine the cross entropy loss and the collaborative adversarial training loss to perform a back propagation algorithm to update the parameters of the sub-model until the integrated model meets the preset criteria.

[0075] Among them, the collaborative adversarial training loss is used to characterize the size of the training weight assigned to the clean sample by this sub-model during the training process.

[0076] In an embodiment of the present invention, the collaborative adversarial training loss includes adversarial sample loss and clean sample loss.

[0077] Among them, the expression of adversarial sample loss is as follows:

[0078]

[0079] L adv =|f a (x′ i )-f a (x i )| 2

[0080] in, represents the adversarial sample loss, e D is the designed index difference, which is used to describe the difference in the category output of the other two sub-models except the current sub-model. a, b, c represent the three sub-models in the integrated model, a represents the current sub-model, and L adv represents distance regularization, h b (x′ i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The class output probability distribution, h c (x′ i ) indicates that after applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution, f a (x′ i ) represents the prediction of sub-model a for adversarial samples, f a (x i ) represents the prediction of model a for clean samples.

[0081] It is worth mentioning that the designed exponential difference can amplify the difference in recognition results between different sub-models. If both sub-models can recognize correctly or incorrectly, the prediction difference will be very small and its value will be close to the constant 1. Otherwise, when one sub-model recognizes correctly and the other sub-model recognizes incorrectly, the prediction difference will be larger and the exponential difference value will be amplified, which can provide more accurate evaluation and recognition.

[0082] It should be understood that adversarial training improves robustness, but inevitably reduces accuracy. In order to achieve a trade-off between accuracy and robustness, the present invention also selects clean samples with prediction differences between sub-models and assigns them a greater weight, i.e., clean sample loss.

[0083] Specifically, the expression of clean sample loss is as follows:

[0084]

[0085] L nat =|f a (x i)-y i |

[0086] in, represents the clean sample loss, h b (x i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The class output probability distribution, h c (x i ) After applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution of .

[0087] It should be noted that, in the embodiment of the present invention, the back propagation algorithm combines the cross entropy loss and the collaborative adversarial training loss, and its expression is as follows:

[0088]

[0089] Among them, L ce represents the cross entropy loss, λ,μ represent the weight coefficients.

[0090] The basic idea of ​​adversarial training is to input adversarial samples to train the model so that it is robust to adversarial attacks. Therefore, in an embodiment of the present invention, the preset standard is set to:

[0091]

[0092] Among them, L EAT represents the training paradigm of the perturbation generated by the integrated model, n represents the total number of samples, represents the model parameters, n represents the total number of samples, L(x i +δ en ,y i ,θ) represents the loss of the perturbation calculation generated by the ensemble model,

[0093]

[0094] α represents the iteration step size, en represents the integrated model, and y i represents the label corresponding to the sample, sgn represents the sign function, δ en represents the perturbation added to the integration.

[0095] It is worth mentioning that the integrated model takes advantage of the complementary advantages between sub-models, so that adversarial attacks cannot accurately attack the vulnerabilities of each sub-model. Adding adversarial samples generated by perturbations to the integrated model prompts the sub-models to focus on the vulnerabilities of the integrated model (samples with sub-model recognition errors) for optimization.

[0096] It should be noted that, in the embodiment of the present invention, each sub-model has an independent optimizer, which updates parameters according to its own loss.

[0097] In order to verify the effectiveness of the collaborative adversarial training method provided by the present invention, in another embodiment of the present invention, the collaborative adversarial training method provided by the present invention is compared with the existing method, and the specific process is as follows:

[0098] Training settings: For ADP, GAL, and TRS methods, the sub-models shared the Adam optimizer and ran for 150 epochs. The initial learning rate was set to 0.001 and decayed by a factor of 10 at the 90th and 120th iterations. The settings for DVERGE, LAFED, FASTEN, and the methods of the present invention were the same. The sub-models used separate SGD optimizers and ran for 120 epochs with momentum set to 0.9 and initial learning rates set to 0.01, decayed by a factor of 10 at the 75th and 95th iterations.

[0099] White-box robustness evaluation: The following adversarial attacks are considered to measure the white-box robustness: 20 steps of projected gradient descent (PGD), ε is 0.031, and the step size is 0.007; 20 steps of momentum iteration method (MIM), ε is 0.031, and the step size is 0.007; Carlini & Wanger attack (CW) with 20 steps of PGD optimization, ε is 0.031, and the step size is 0.007; Auto-Attack (AA) consists of FAB, Square Attack and two variants of PGD, which is a combination of multiple attack methods.

[0100] The experimental results are shown in Table 1. ADP, GAL and TRS use L EAT In the optimization paradigm, the sub-models share an optimizer, and each sub-model cannot update parameters according to independent losses. When different sub-models have different training requirements, sharing an optimizer will lead to conflicts. Therefore, the three methods under this training paradigm are generally less robust. The optimization paradigm adopted by DVERGE, LAFED, and FASTEN uses independent optimizers to optimize their own losses. However, adversarial samples in this paradigm can accurately attack the vulnerabilities of each sub-model, resulting in the sub-models only being able to enhance their defense against their own specific attacks, but not achieving optimal defense against collective attacks. Using L EAT Optimization, where sub-models can learn more different adversarial features. Each sub-model has an independent optimizer that updates parameters based on its own loss. This paper adds reweighted distance regularization to Vallina AT, which improves robustness without reducing accuracy.

[0101] Table 1

[0102]

[0103] ADP is the abbreviation of adaptive diversity promoting, which is a method proposed in the paper Improving Adversarial Robustness via Promoting Ensemble Diversity.

[0104] GAL is the abbreviation of Gradient Alignment Loss, which is a method proposed in the paper Improving Adversarial Robustness of Ensembles with Diversity Training;

[0105] TRS is the abbreviation of Transferability Reduced Smooth, which is the method proposed in the paper TRS: Transferability Reduced Ensemble via Promoting Gradient Diversity and Model Smoothness;

[0106] DVERGE is the abbreviation of Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles, which is the method proposed in the paper DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles;

[0107] LAFED is the abbreviation of Latent Feature Diversification, which is a method proposed in the paper LAFED: Towards robust ensemble models via Latent Feature Diversification;

[0108] FASTEN is the abbreviation of FAST ENsemble learning method, which is the method proposed in the paper FASTEN: Fast Ensemble Learning for Improved Adversarial Robustness;

[0109] Promoting Gradient Diversity and Model Smoothness;

[0110] Vallina AT presented adversarial training using only cross entropy loss for adversarial examples.

[0111] In another embodiment of the present invention, the above-mentioned reweighted distance regularization based on the recognition difference of each sub-model Can be used as a standalone loss and can be combined with different training paradigms.

[0112] The application results are shown in Table 2:

[0113] Table 2

[0114]

[0115] Among them, NAT refers to clean samples, and the data in the table refers to the accuracy of identifying clean samples. PGD20, MIM, CW, and AA are adversarial samples with added disturbances, which measure the robustness of the model when facing four different attacks.

[0116] L D It is a distance regularization term based on the prediction differences between sub-models. It can be combined with previous methods as a plug-and-play module to further improve robustness.

[0117] The experimental results in Table 2 show that the robustness of the integration can be further enhanced based on the previous method, which verifies the applicability of the collaborative adversarial training method provided by the present invention.

[0118] In order to further verify the effectiveness of the collaborative adversarial training method provided by the present invention, in another embodiment of the present invention, an ablation experiment is also conducted. The details are as follows:

[0119] The experiment will be completed on the CIFAR-10 dataset using three resnet-20 models. The present invention fixes the value of and takes the values ​​of 1, 2, 3, 4, 5, and 6. Figure 3 As shown in the figure, the accuracy and robustness of the collaborative adversarial training method provided by the present invention are relatively stable under different coefficients, without significant changes, indicating that it is not particularly sensitive to the coefficients. Figure 3 As shown in Figure 2, as the coefficient increases, the robustness to weak attacks increases, while the robustness to strong attacks decreases slightly. Considering the trade-off between accuracy and robustness, we choose μ = 5 for further ablation analysis while keeping the accuracy unchanged and the robustness increased.

[0120] Ablation experiments were conducted to study the role of each part in the loss function. As shown in Table 3, the first item indicates that only the standard cross entropy loss is used for adversarial samples, and the second item adds the distance regularization loss of adversarial samples. The robustness is improved by more than three points, but the accuracy is reduced by more than two points. In order to maintain accuracy, the fourth item adds the processing of divergent clean samples, but the robustness improvement is smaller than that of the second item. The difference amplification of the exponential term is added, and the robustness is greatly improved compared with the second item in the third item and the fourth item in the fifth item. The fifth item takes into account the difference amplification of the exponential term and the trade-off between accuracy and robustness. Compared with the first item, it achieves the maintenance of accuracy without loss, and the robustness is greatly improved.

[0121] Table 3

[0122]

[0123] In another embodiment of the present invention, a collaborative adversarial training method is provided by the present invention to perform adversarial training of an integrated model, which is used for image recognition. In this embodiment, three data sets are used to verify the universality of the method. In order to better understand the problem solved by the proposed method, an example analysis of a specific application is made below. Figure 4a In the adversarial training of adversarial samples of car pictures, models a and b have low confidence and make mistakes in recognition, while model c has high confidence and makes correct recognition, but cannot be correctly recognized in the integrated model. When training model a, a greater weight is given to the sample according to the confidence difference between models b and c. If the confidence difference between models b and c is greater, the weight given to the sample when training model a is greater, and model a pays more attention to the sample, changing from wrong recognition to correct recognition. In this way, the adversarial sample of the integrated model is correctly recognized, and the classification result of the integrated model will also change from wrong to correct.

[0124] Figure 4b In the example above, the adversarial sample of a dog is only recognized correctly by model b during normal adversarial training, and the ensemble model cannot correctly identify it. When training model c, a greater weight is given to the sample based on the confidence difference between models a and b. Model c pays special attention to such samples during training, and pulls samples that are close to the decision boundary but are incorrectly identified back to the correct direction. In this way, both models b and c in the ensemble can correctly identify the adversarial sample of the dog, and the classification result of the ensemble changes from an error to a correct one.

[0125] Figure 4cIn the example above, the adversarial sample of a dog is only recognized correctly by model c during normal adversarial training, and the ensemble cannot correctly identify it. When training model b, a greater weight is given to the sample based on the confidence difference between models a and c. Model b pays special attention to such samples during training, and pulls samples that are close to the decision boundary but are incorrectly identified back to the correct direction. In this way, both models a and c in the ensemble can correctly identify the adversarial sample of the dog, and the classification result of the ensemble changes from an error to a correct one.

[0126] In summary, the collaborative adversarial training method provided by the present invention assigns training weights to samples according to the output probability of each sub-model in the integrated model for the true category of clean samples and their adversarial samples, combined with the probability difference between the sub-models. Each sub-model can assign a larger training weight to samples with recognition errors in other sub-models during the model training process, so that the integrated model can accurately identify the true category of the adversarial samples, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model.

[0127] The collaborative adversarial training system provided by the present invention is described below.

[0128] like Figure 5 As shown, the collaborative adversarial training system includes:

[0129] The perturbation module 501 is used to add perturbations to the clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images;

[0130] A probability calculation module 502 is used to input either a clean sample or an adversarial sample into each sub-model to obtain the probability that the sub-model outputs the true category of the clean sample or the adversarial sample;

[0131] The collaborative adversarial training module 503 is used to calculate the probability difference of the other two sub-models in the integrated model for each of the three sub-models, and construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself, and perform a back propagation algorithm in combination with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset standards; wherein the collaborative adversarial training loss is used to characterize the degree of emphasis that the sub-model places on clean samples during the training process.

[0132] It should be noted that the information interaction and execution process between the above modules / units are not related to the implementation of the present application method.

[0133] The examples are based on the same concept, and their specific functions and technical effects can be specifically referred to in the method embodiment section, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit, and the above-mentioned integrated units can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0134] like Figure 6 As shown, an embodiment of the present invention provides a terminal device, such as Figure 6 As shown, the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 6 Only one processor is shown in the figure), a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 implements the steps of any of the above-mentioned method embodiments when executing the computer program D102.

[0135] Specifically, when the processor D100 executes the computer program D102, a disturbance is added to the clean sample to obtain an adversarial sample corresponding to the clean sample; the clean sample is an autonomous driving image or an object recognition image; for each of the clean sample and the adversarial sample, the one is input into each sub-model to obtain the probability of the sub-model outputting the true category of the one; for each of the three sub-models, the probability difference of the other two sub-models in the integrated model except the one sub-model is calculated, and based on the probability and probability difference of the one sub-model itself, the collaborative adversarial training loss of the one sub-model is constructed, and the back propagation algorithm is performed in combination with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the one sub-model until the integrated model meets the preset standard. Among them, according to the output probability of each sub-model in the integrated model for the true category of the clean sample and its adversarial sample, combined with the probability difference between the sub-models, the training weight is assigned to the sample, and each sub-model can assign a larger training weight to the sample with recognition error in other sub-models during the model training process, so that the integrated model can accurately identify the true category of the adversarial sample, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model.

[0136] The processor D100 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0137] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may also be an external storage device of the terminal device D10, such as a plug-in hard disk, a smart memory card (SMC, SmartMedia Card), a secure digital (SD, Secure Digital) card, a flash card (Flash Card), etc. equipped on the terminal device D10. Further, the memory D101 may also include both an internal storage unit of the terminal device D10 and an external storage device. The memory D101 is used to store an operating system, an application program, a boot loader (BootLoader), data and other programs, such as the program code of the computer program, etc. The memory D101 may also be used to temporarily store data that has been output or is to be output.

[0138] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0139] An embodiment of the present application provides a computer program product. When the computer program product runs on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0140] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0141] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the present application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the protection scope of the present application.

Claims

1. A collaborative adversarial training method is applied to an integrated model, wherein the integrated model includes three sub-models, each of which is used for image recognition, and the model structures of different sub-models are different from each other, characterized in that: The method comprises: Add disturbance to a clean sample to obtain an adversarial sample corresponding to the clean sample; the clean sample is an autonomous driving image or an object recognition image; For each of the clean sample and the adversarial sample, input the clean sample into each of the sub-models to obtain the probability that the sub-model outputs the true category of the clean sample and the adversarial sample; For each of the three sub-models, the probability difference between the other two sub-models in the integrated model except the sub-model is calculated, and the collaborative adversarial training loss of the sub-model is constructed based on the probability of the sub-model itself and the probability difference. In combination with the cross entropy loss and the collaborative adversarial training loss, a back propagation algorithm is performed to update the parameters of the sub-model until the integrated model meets the preset criteria; wherein the collaborative adversarial training loss is used to characterize the size of the training weight assigned to the clean sample by the sub-model during the training process.

2. The collaborative adversarial training method according to claim 1, characterized in that: The adding disturbance to the clean sample comprises: By calculating the formula f m (x′ i )=arg max k＝1,...,K p m (x′ i ,k) Get the disturbance value δ m ; where α represents the step size, sgn(·) represents the sign function, represents the gradient of the loss function with respect to the input, x′ i represents the i-th clean sample x i The corresponding adversarial example, y i Represents x i The corresponding true category label, f m (x′ i ) indicates that perturbations are added based on the gradient information of a single sub-model; or By calculating the formula Get the disturbance value δ m ; Among them, f en (x′ i ) represents the integrated model for adversarial sample x′ i The category output probability distribution of k represents the category of the clean sample, M represents the number of sub-models in the integrated model, M = 3, p m (x′ i ,k) represents the sub-model’s response to the adversarial sample x′ after applying softmax to the logits of the m-th sub-model i The class output probability distribution, f en (x′ i ) represents adding perturbations based on the gradient information of the integrated model.

3. The collaborative adversarial training method according to claim 2, characterized in that: The collaborative adversarial training loss includes adversarial sample loss and clean sample loss; The expression of the adversarial sample loss is as follows: L adv =|f a (x′ i )-f a (x i )| 2 in, represents the adversarial sample loss, e D is the designed index difference, which is used to describe the difference in category output of the other two sub-models except the current sub-model. a, b, c represent the three sub-models in the integrated model, a represents the current sub-model, and L adv represents distance regularization, h b (x′ i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The class output probability distribution, h c (x′ i ) indicates that after applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution, f a (x′ i ) represents the prediction of sub-model a for adversarial samples, f a (x i ) represents the prediction of model a for clean samples; The expression of the clean sample loss is as follows: L nat =|f a (x i )-y i | in, represents the clean sample loss, h b (x i ) means that after applying softmax to the logits of sub-model b, the sub-model is i The class output probability distribution, h c (x i ) After applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution of .

4. The collaborative adversarial training method according to claim 3, characterized in that: The total loss value of the back-propagation algorithm is expressed as follows: Among them, L ce represents the cross entropy loss, λ,μ represent weight coefficients.

5. The collaborative adversarial training method according to claim 4, characterized in that: The preset standards are: Among them, L EAT represents the training paradigm of the perturbation generated by the integrated model, n represents the total number of samples, θ represents the model parameters, n represents the total number of samples, L(x i +δ en ,y i ,θ) represents the loss of the perturbation calculation generated by the ensemble model, -ε≤δ en ≤ε α represents the iteration step size, en represents the integrated model, and y i represents the label corresponding to the sample, sgn represents the sign function, δ en represents the perturbation added to the integration.

6. An integrated model, characterized in that The integrated model includes three sub-models, all of which are used for image recognition, and the model structures of different sub-models are different from each other; the sub-models are deep neural network models.

7. A collaborative adversarial training system, applied to an integrated model, wherein the integrated model includes three sub-models, each of which is used for image recognition, and the model structures of different sub-models are different from each other, characterized in that: include: A perturbation module, used to add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; The clean sample is an autonomous driving image or an object recognition image; A probability calculation module, for inputting one of the clean sample and the adversarial sample into each of the sub-models, respectively, to obtain the probability that the sub-model outputs the true category of the one; A collaborative adversarial training module is used to calculate the probability difference of the other two sub-models in the integrated model for each of the three sub-models, and to construct the collaborative adversarial training loss of the sub-model based on the probability of the sub-model itself and the probability difference. In addition, a back propagation algorithm is performed in combination with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset criteria. The collaborative adversarial training loss is used to characterize the degree of importance that the sub-model attaches to the clean samples during the training process.

8. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images