Collaborative adversarial training method, system, terminal equipment, medium and integrated model

Abstract

The present invention provides a collaborative adversarial training method, system, terminal device, medium, and integrated model, wherein the method includes adding perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; inputting either the clean sample or the adversarial sample into each sub-model to obtain the probability that the sub-model outputs the true category of the clean sample; calculating the probability difference between the other two sub-models in the integrated model except for the sub-model in each of the three sub-models; constructing the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself; and performing a backpropagation algorithm in combination with the cross-entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset standard. The present invention can improve the robustness of collaborative adversarial training.

Description

Technical Field

[0001] The present invention belongs to the field of deep learning technology, and specifically relates to a collaborative adversarial training method, system, terminal equipment, medium and integrated model. Background Art

[0002] Adversarial examples are carefully crafted perturbation attacks on models that involve adding imperceptible perturbations to natural samples. Although these perturbations may not be noticeably different from real samples to the human eye, they can cause the model to make incorrect classifications (such as image recognition errors).

[0003] In recent years, numerous defense strategies have been developed, with adversarial training emerging as one of the most effective and practical. Because adversarial training for a single model may not be sufficient to meet the urgent need for robustness, it has been extended to collaborative adversarial training of multiple models. However, due to the higher output similarity between sub-models in an ensemble model and the strong transferability of attacks, adversarial examples generated by one sub-model can easily deceive other sub-models, ultimately misleading the entire ensemble.

[0004] To address this issue, existing research has primarily focused on improving output diversity between sub-models and reducing the transferability of adversarial examples between sub-models. However, experimental results show that these methods fail to achieve optimal results, and the robustness of collaborative adversarial training is poor. This is due to the neglect of collaboration between multiple models, the failure to fully exploit the synergistic advantages of the ensemble model, the continued allocation of equal training weights to all samples, and the lack of attention to misclassified samples, which leads to poor robustness of collaborative adversarial training. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a collaborative adversarial training method, system, terminal device, medium and integrated model to improve the robustness of collaborative adversarial training.

[0006] In a first aspect, the present invention provides a collaborative adversarial training method applied to an ensemble model, wherein the ensemble model includes three sub-models, each of which is used for image recognition, and the model structures of different sub-models are different from each other. The method comprises the following steps:

[0007] Add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; clean samples are autonomous driving images or object recognition images;

[0008] For each clean sample or adversarial sample, input it into each sub-model and obtain the probability of the sub-model outputting the true category of the clean sample or adversarial sample;

[0009] For each of the three sub-models, the probability difference of the other two sub-models in the integrated model is calculated. Based on the probability and probability difference of the sub-model itself, the collaborative adversarial training loss of the sub-model is constructed. Combined with the cross-entropy loss and the collaborative adversarial training loss, the back propagation algorithm is performed to update the parameters of the sub-model until the integrated model meets the preset standards; wherein, the collaborative adversarial training loss is used to characterize the training weight assigned to the clean sample of the sub-model during the training process.

[0010] Optionally, add perturbations to the clean samples, including:

[0011] By calculating the formula

[0012]

[0013] f m (x′ i )=arg max k＝1,...,K p m (x′ i ,k)

[0014] Get the disturbance value δ m ; where α represents the step size, sgn(·) represents the sign function, represents the gradient of the loss function with respect to the input, x′ i Represents the i-th clean sample x i The corresponding adversarial example, y i Represents x i The corresponding true category label, f m (x′ i ) indicates adding perturbations based on the gradient information of a single sub-model;

[0015] or

[0016] By calculating the formula

[0017]

[0018] Get the disturbance value δ m ; Among them, f en (x′ i ) represents the integrated model’s response to the adversarial sample x′ i The probability distribution of the category output, k represents the category of the clean sample, M represents the number of sub-models in the integrated model, M = 3, p m (x′ i ,k) represents the sub-model’s response to the adversarial sample x′ after applying softmax to the logits of the m-th sub-model i The category output probability distribution, f en (x′i ) represents adding perturbations based on the gradient information of the integrated model.

[0019] Optionally, the collaborative adversarial training loss includes adversarial sample loss and clean sample loss;

[0020] The expression of adversarial sample loss is as follows:

[0021]

[0022] L adv =|f a (x′ i )-f a (x i )| 2

[0023] in, represents the adversarial sample loss, e D The exponential difference is designed to describe the difference in category output between the other two sub-models except the current sub-model. a, b, c represent the three sub-models in the integrated model, a represents the current sub-model, L adv represents distance regularization, h b (x′ i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The category output probability distribution, h c (x′ i ) indicates that after applying softmax to the logits of the sub-model c, the sub-model is i The category output probability distribution, f a (x′ i ) represents the prediction of sub-model a for adversarial samples, f a (x i ) represents the prediction of model a for clean samples;

[0024] The expression of clean sample loss is as follows:

[0025]

[0026] L nat =|f a (x i )-y i |

[0027] in, represents the clean sample loss, h b (x i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is iThe category output probability distribution, h c (x i ) After applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution of .

[0028] Optional, preset standards are:

[0029]

[0030] Among them, L EAT represents the training paradigm of the perturbation generated by the ensemble model, n represents the total number of samples, represents the model parameters, n represents the total number of samples, L(x i +δ en ,y i ,θ) represents the loss of computing the perturbations generated by the ensemble model,

[0031]

[0032] α represents the iteration step size, en represents the integrated model, y i Indicates the label corresponding to the sample, sgn represents the sign function, δ en represents the perturbation added to the integration.

[0033] Optionally, the total loss value of the backpropagation algorithm is expressed as follows:

[0034]

[0035] Among them, L ce represents the cross entropy loss, λ,μ represent the weight coefficients.

[0036] In a second aspect, the present invention discloses an integrated model, which includes three sub-models. The three sub-models are all used for image recognition, and the model structures of different sub-models are different; the sub-models are deep neural network models.

[0037] In a third aspect, the present invention discloses a collaborative adversarial training system, which is applied to an integrated model and includes:

[0038] The perturbation module is used to add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images;

[0039] A probability calculation module is used to input either a clean sample or an adversarial sample into each sub-model and obtain the probability that the sub-model outputs the true category of the sample;

[0040] The collaborative adversarial training module is used to calculate the probability difference of the other two sub-models in the integrated model for any one of the three sub-models, and construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself. The backpropagation algorithm is combined with the cross-entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset standards. The collaborative adversarial training loss is used to characterize the degree of emphasis of the sub-model on clean samples during the training process.

[0041] In a fourth aspect, the present invention discloses a terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the collaborative adversarial training method as described above when executing the computer program.

[0042] In a fifth aspect, the present invention discloses a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned collaborative adversarial training method is implemented.

[0043] The beneficial effects of the present invention are:

[0044] The collaborative adversarial training method provided by the present invention assigns training weights to samples based on the output probability of each sub-model in the integrated model for the true category of clean samples and their adversarial samples, combined with the probability difference between the sub-models. During the model training process, each sub-model can assign a larger training weight to samples with recognition errors in other sub-models, thereby enabling the integrated model to accurately identify the true category of adversarial samples, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of a collaborative adversarial training method in one embodiment of the present application;

[0046] Figure 2 This is a flowchart of a collaborative adversarial training method in one embodiment of the present application;

[0047] Figure 3 This is a result diagram of an ablation experiment in one embodiment of the present application;

[0048] Figure 4a A schematic diagram of adversarial training using adversarial examples of cars in another embodiment of the present application;

[0049] Figure 4b A schematic diagram of adversarial training using dog adversarial samples in one embodiment of the present application;

[0050] Figure 4cA schematic diagram of adversarial training using adversarial samples of Chinese dogs in another embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of the structure of a collaborative adversarial training system in one embodiment of the present application;

[0052] Figure 6 This is a schematic diagram of the structure of a terminal device in one embodiment of the present application. DETAILED DESCRIPTION

[0053] To address the poor robustness of traditional collaborative adversarial training methods, the present invention provides a collaborative adversarial training method, system, terminal device, medium, and integrated model. This method assigns training weights to samples based on the output probabilities of each sub-model in the integrated model for the true categories of clean samples and their adversarial samples, combined with the probability differences between the sub-models. During model training, each sub-model can assign a greater training weight to samples that have recognition errors in other sub-models, thereby enabling the integrated model to accurately identify the true category of adversarial samples, enhancing the integrated model's anti-interference ability and improving its robustness.

[0054] To facilitate understanding, the principle of the above solution is first explained.

[0055] like Figure 1 As shown in the figure, the ensemble model has three sub-models. For samples between the decision boundaries of models b and c, this means one sub-model correctly classified them and one incorrectly classified them. Whether the ensemble model correctly classifies them depends on sub-model a. During the training of model a, these samples are assigned greater weights, pulling them back to the correct side of the decision boundary. More than half of the sub-models will correctly classify these samples, and the ensemble model's classification results change from incorrect to correct. For samples that are consistently classified by models b and c and are far from the decision boundary, the ensemble's classification remains unchanged regardless of whether model a correctly classified them. Therefore, these samples are assigned smaller weights. Lines a, b, and c represent the decision boundaries of the three sub-models, respectively. Green in the figure indicates a correct classification, and red indicates an incorrect classification. Larger images indicate larger weights. 1, 2, 3, 4, 5, and 6 represent different samples.

[0056] The collaborative adversarial training method provided by the present invention is described below.

[0057] It should be noted that the collaborative adversarial training method provided by the present invention is particularly suitable for an integrated model, which includes three sub-models, all of which are used for image recognition, and the model structures of different sub-models are different. In an embodiment of the present invention, the above-mentioned sub-models are deep neural network models. Exemplarily, in one embodiment of the present invention, the above-mentioned deep neural network models are respectively a Vision Transformer (ViT, Vision Transformers) model, VGGNet and DenseNet.

[0058] like Figure 2 As shown, the collaborative adversarial training method includes the following steps:

[0059] Step 21: Add perturbations to the clean samples to obtain adversarial samples corresponding to the clean samples.

[0060] In an embodiment of the present invention, the clean sample is an autonomous driving image or an object recognition image. For example, the clean sample is an image of an animal.

[0061] The process of adding disturbance to the clean sample in the present invention is described below.

[0062] Specifically, by calculating the formula

[0063]

[0064] f m (x′ i )=arg max k＝1,...,K p m (x′ i ,k)

[0065] Get the disturbance value δ m ; where α represents the step size, sgn(·) represents the sign function, represents the gradient of the loss function with respect to the input, x′ i Represents the i-th clean sample x i The corresponding adversarial example, y i Represents x i The corresponding true category label, f m (x′ i ) indicates adding perturbations based on the gradient information of a single sub-model;

[0066] or

[0067] By calculating the formula

[0068]

[0069] Get the disturbance value δ m ; Among them, f en (x′i ) represents the integrated model’s response to the adversarial sample x′ i The probability distribution of the category output, k represents the category of the clean sample, M represents the number of sub-models in the integrated model, M = 3, p m (x′ i ,k) represents the sub-model’s response to the adversarial sample x′ after applying softmax to the logits of the m-th sub-model i The category output probability distribution, f en (x′ i ) represents adding perturbations based on the gradient information of the integrated model.

[0070] It should be noted that the difference between these two types of perturbations is that one uses the gradient information of a single model, while the other uses the gradient information of an ensemble model. Specifically, the loss calculated in the first iteration is the loss of the clean sample, while subsequent iterations calculate the loss of the perturbation added to the clean sample. The above input is the clean sample in the first iteration, and the perturbation sample in subsequent iterations.

[0071] In step 22, for each clean sample or adversarial sample, input the clean sample into each sub-model to obtain the probability of the sub-model outputting the true category of the clean sample or adversarial sample.

[0072] The probability of the above adversarial samples can reflect the robustness of the sub-model to adversarial attacks. For example, the lower the probability that the sub-model outputs the true category of the adversarial sample, the worse the robustness of the sub-model to adversarial attacks.

[0073] The probability of the above clean samples can reflect the quality of the sub-model's own image recognition effect. For example, the lower the probability of the sub-model outputting the true category of the clean sample, the worse the sub-model's own image recognition effect.

[0074] Step 23, for each of the three sub-models, calculate the probability difference of the other two sub-models in the integrated model except the sub-model, construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself, and combine the cross entropy loss and the collaborative adversarial training loss to perform the back propagation algorithm to update the parameters of the sub-model until the integrated model meets the preset criteria.

[0075] Among them, the collaborative adversarial training loss is used to characterize the training weight assigned to the clean sample of a sub-model during the training process.

[0076] In an embodiment of the present invention, the collaborative adversarial training loss includes adversarial sample loss and clean sample loss.

[0077] Among them, the expression of adversarial sample loss is as follows:

[0078]

[0079] L adv =|f a (x′ i )-f a (x i )| 2

[0080] in, represents the adversarial sample loss, e D The exponential difference is designed to describe the difference in category output between the other two sub-models except the current sub-model. a, b, c represent the three sub-models in the integrated model, a represents the current sub-model, L adv represents distance regularization, h b (x′ i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The category output probability distribution, h c (x′ i ) indicates that after applying softmax to the logits of the sub-model c, the sub-model is i The category output probability distribution, f a (x′ i ) represents the prediction of sub-model a for adversarial samples, f a (x i ) represents the prediction of model a for clean samples.

[0081] It is worth mentioning that the designed exponential difference can amplify the difference in recognition results between different sub-models. If both sub-models can correctly or incorrectly identify, the prediction difference will be very small, and its value will be close to the constant 1. Otherwise, when one sub-model correctly identifies and the other incorrectly identifies, the prediction difference will be larger, and the exponential difference value will be amplified, providing more accurate evaluation and recognition.

[0082] It should be understood that adversarial training improves robustness but inevitably reduces accuracy. To achieve a trade-off between accuracy and robustness, the present invention also selects clean samples with prediction differences between sub-models and assigns them greater weight, namely, clean sample loss.

[0083] Specifically, the expression of clean sample loss is as follows:

[0084]

[0085] L nat =|f a (x i)-y i |

[0086] in, represents the clean sample loss, h b (x i ) indicates that after applying softmax to the logits of sub-model b, the sub-model is i The category output probability distribution, h c (x i ) After applying softmax to the logits of sub-model c, the sub-model is i The class output probability distribution of .

[0087] It should be noted that, in the embodiment of the present invention, the back propagation algorithm combines the cross entropy loss and the collaborative adversarial training loss, and its expression is as follows:

[0088]

[0089] Among them, L ce represents the cross entropy loss, λ,μ represent the weight coefficients.

[0090] The basic idea of ​​adversarial training is to input adversarial samples to train the model so that it is robust to adversarial attacks. Therefore, in the embodiment of the present invention, the preset standard is set to:

[0091]

[0092] Among them, L EAT represents the training paradigm of the perturbation generated by the ensemble model, n represents the total number of samples, represents the model parameters, n represents the total number of samples, L(x i +δ en ,y i ,θ) represents the loss of computing the perturbations generated by the ensemble model,

[0093]

[0094] α represents the iteration step size, en represents the integrated model, y i Indicates the label corresponding to the sample, sgn represents the sign function, δ en represents the perturbation added to the integration.

[0095] It's worth noting that the ensemble model leverages the complementary strengths of its sub-models, preventing adversarial attacks from precisely targeting the vulnerabilities of each sub-model. Adding perturbations to the ensemble model generates adversarial examples that force the sub-models to focus on the ensemble's vulnerabilities (examples with sub-model recognition errors) and optimize for them.

[0096] It should be noted that, in the embodiment of the present invention, each sub-model has an independent optimizer, which updates parameters according to its own loss.

[0097] In order to verify the effectiveness of the collaborative adversarial training method provided by the present invention, in another embodiment of the present invention, the collaborative adversarial training method provided by the present invention is compared with the existing method. The specific process is as follows:

[0098] Training settings: For the ADP, GAL, and TRS methods, the sub-models shared the Adam optimizer and ran for 150 epochs. The initial learning rate was set to 0.001 and decayed by a factor of 10 at the 90th and 120th iterations. The same settings were used for DVERGE, LAFED, FASTEN, and our methods. The sub-models used separate SGD optimizers for 120 epochs with momentum set to 0.9 and an initial learning rate set to 0.01, decayed by a factor of 10 at the 75th and 95th iterations.

[0099] White-box robustness evaluation: The following adversarial attacks are considered to measure the white-box robustness: 20-step projected gradient descent (PGD), ε is 0.031, and the step size is 0.007; 20-step momentum iteration method (MIM), ε is 0.031, and the step size is 0.007; Carlini & Wanger attack (CW) with 20-step PGD optimization, ε is 0.031, and the step size is 0.007; Auto-Attack (AA) consists of FAB, Square Attack and two variants of PGD, which is a combination of multiple attack methods.

[0100] The experimental results are shown in Table 1. ADP, GAL and TRS use L EAT In the optimization paradigm, the sub-models share an optimizer, and each sub-model cannot update parameters according to independent losses. When different sub-models have different training requirements, sharing an optimizer will lead to conflicts. Therefore, the three methods under this training paradigm are generally less robust. The optimization paradigm adopted by DVERGE, LAFED, and FASTEN uses independent optimizers to optimize their own losses. However, the adversarial samples in this paradigm can accurately attack the vulnerabilities of each sub-model, resulting in the sub-models only being able to enhance their defense against their own specific attacks, but not to achieve the best defense against collective attacks. Using L EAT Optimization, where sub-models can learn more diverse adversarial features. Each sub-model has an independent optimizer that updates its parameters based on its own loss. This paper incorporates reweighted distance regularization into Vallina AT, improving robustness without compromising accuracy.

[0101] Table 1

[0102]

[0103] ADP is the abbreviation of adaptive diversity promoting, which is the method proposed in the paper Improving Adversarial Robustness via Promoting Ensemble Diversity.

[0104] GAL is the abbreviation of Gradient Alignment Loss, which is a method proposed in the paper Improving Adversarial Robustness of Ensembles with Diversity Training;

[0105] TRS is the abbreviation of Transferability Reduced Smooth, which is the method proposed in the paper TRS: Transferability Reduced Ensemble via Promoting Gradient Diversity and Model Smoothness;

[0106] DVERGE is the abbreviation of Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles, which is the method proposed in the paper DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles;

[0107] LAFED is the abbreviation of Latent Feature Diversification, which is the method proposed in the paper LAFED: Towards robust ensemble models via Latent Feature Diversification;

[0108] FASTEN is the abbreviation of FAST ENsemble learning method, which is the method proposed in the paper FASTEN: Fast Ensemble Learning for Improved Adversarial Robustness;

[0109] Promoting Gradient Diversity and Model Smoothness;

[0110] Vallina AT presents adversarial training using only cross-entropy loss for adversarial examples.

[0111] In another embodiment of the present invention, the above-mentioned reweighted distance regularization based on the recognition difference of each sub-model Can be used as a standalone loss and can be combined with different training paradigms.

[0112] The application results are shown in Table 2:

[0113] Table 2

[0114]

[0115] NAT refers to clean samples, and the data in the table refers to the accuracy of recognizing clean samples. PGD20, MIM, CW, and AA are adversarial samples with added perturbations, which measure the robustness of the model in the face of four different attacks.

[0116] L D It is a distance regularization term based on the prediction differences between sub-models. It can be combined with previous methods as a plug-and-play module to further improve robustness.

[0117] The experimental results in Table 2 show that the robustness of the ensemble can be further enhanced based on the previous method, verifying the applicability of the collaborative adversarial training method provided by the present invention.

[0118] In order to further verify the effectiveness of the collaborative adversarial training method provided by the present invention, an ablation experiment was conducted in another embodiment of the present invention. The details are as follows:

[0119] The experiment will be completed on the CIFAR-10 dataset using three ResNet-20 models. The present invention fixes the value of and takes the values ​​of 1, 2, 3, 4, 5, and 6. Figure 3 As shown in Figure 2, the accuracy and robustness of the collaborative adversarial training method provided by the present invention are relatively stable under different coefficients, without significant changes, indicating that it is not particularly sensitive to the coefficients. Figure 3 As shown in Figure 2, as the coefficient increases, the robustness to weak attacks increases, while the robustness to strong attacks decreases slightly. Considering the trade-off between accuracy and robustness, we choose μ = 5 for further ablation analysis to keep the accuracy unchanged and the robustness increased.

[0120] Ablation experiments were conducted to investigate the role of each component in the loss function. As shown in Table 3, the first term uses only the standard cross-entropy loss for adversarial examples, while the second term adds a distance regularization loss for adversarial examples. This improves robustness by over three points, but decreases accuracy by over two points. To maintain accuracy, the fourth term incorporates processing for divergent clean samples, but the robustness improvement is smaller than that of the second term. The addition of the exponential term for difference amplification yields a greater improvement in robustness compared to the second term, and in the fifth term compared to the fourth term. The fifth term, which also takes into account the exponential term's difference amplification and the trade-off between accuracy and robustness, maintains accuracy while significantly improving robustness compared to the first term.

[0121] Table 3

[0122]

[0123] In another embodiment of the present invention, a collaborative adversarial training method is provided to perform adversarial training on an ensemble model used for image recognition. In this embodiment, three datasets are used to verify the versatility of the method. To better understand the problem addressed by the proposed method, a specific application example is analyzed below. Figure 4a In adversarial training using an adversarial example representing a car image, models a and b have lower confidence scores and make incorrect recognition errors, while model c has higher confidence scores and makes correct recognition errors. However, the ensemble model cannot correctly recognize the example. When training model a, the sample is given a higher weight based on the confidence difference between models b and c. The greater the difference in confidence between models b and c, the greater the weight assigned to the sample during model a training, and model a pays more attention to the sample, turning the incorrect recognition error into a correct one. This allows the ensemble model to correctly recognize the adversarial example, and the ensemble's classification results also change from incorrect to correct.

[0124] Figure 4b In the example above, an adversarial example of a dog is correctly identified during normal adversarial training by only model B, while the ensemble model cannot correctly distinguish the dog. When training model C, the confidence difference between models A and B is given greater weight. Model C pays special attention to such examples during training, pulling incorrectly identified examples close to the decision boundary back into the correct direction. This allows both models B and C in the ensemble to correctly identify the dog adversarial example, and the ensemble's classification result changes from an incorrect one to a correct one.

[0125] Figure 4cIn the example above, an adversarial example of a dog is correctly identified during normal adversarial training, only model C correctly identifies it; the ensemble is unable to correctly distinguish it. When training model B, the confidence difference between models A and C assigns greater weight to these examples. Model B pays special attention to these examples during training, pulling incorrectly identified examples close to the decision boundary back into the correct direction. This allows both models A and C in the ensemble to correctly identify the adversarial example of a dog, and the ensemble's classification result changes from an incorrect one to a correct one.

[0126] In summary, the collaborative adversarial training method provided by the present invention assigns training weights to samples based on the output probability of each sub-model in the integrated model for the true categories of clean samples and their adversarial samples, combined with the probability difference between the sub-models. Each sub-model can assign a larger training weight to samples with recognition errors of other sub-models during the model training process, thereby enabling the integrated model to accurately identify the true category of the adversarial samples, enhance the anti-interference ability of the integrated model, and improve the robustness of the integrated model.

[0127] The collaborative adversarial training system provided by the present invention is described below.

[0128] like Figure 5 As shown, the collaborative adversarial training system includes:

[0129] The perturbation module 501 is used to add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images;

[0130] A probability calculation module 502 is configured to input either a clean sample or an adversarial sample into each sub-model and obtain the probability that the sub-model outputs the true category of the clean sample or the adversarial sample;

[0131] The collaborative adversarial training module 503 is used to calculate the probability difference of the other two sub-models in the integrated model for any one of the three sub-models, and construct the collaborative adversarial training loss of the sub-model based on the probability and probability difference of the sub-model itself. In addition, the back propagation algorithm is combined with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset standards; wherein the collaborative adversarial training loss is used to characterize the degree of emphasis of the sub-model on clean samples during the training process.

[0132] It should be noted that the information interaction and execution process between the above modules / units are not related to the implementation of the present invention.

[0133] The embodiments are based on the same concept, and their specific functions and the technical effects brought about can be specifically referred to the method embodiment section, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0134] like Figure 6 As shown, an embodiment of the present invention provides a terminal device, such as Figure 6 As shown, the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 6 Only one processor is shown in the figure), a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 implements the steps of any of the above method embodiments when executing the computer program D102.

[0135] Specifically, when the processor D100 executes the computer program D102, it adds perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images; for each clean sample or adversarial sample, the clean sample is input into each sub-model to obtain the probability of the sub-model outputting the true category of the clean sample; for each of the three sub-models, the probability difference of the other two sub-models in the integrated model is calculated, and based on the probability and probability difference of the sub-model itself, the collaborative adversarial training loss of the sub-model is constructed, and the backpropagation algorithm is performed in combination with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset standard. In this case, training weights are assigned to the samples based on the output probabilities of the true categories of the clean samples and their adversarial samples by each sub-model in the integrated model, combined with the probability differences between the sub-models. Each sub-model can assign a larger training weight to samples that have recognition errors by other sub-models during the model training process, thereby enabling the integrated model to accurately identify the true category of the adversarial samples, enhancing the anti-interference ability of the integrated model, and improving the robustness of the integrated model.

[0136] The processor D100 may be a central processing unit (CPU), or may be another general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. A general-purpose processor may be a microprocessor or any conventional processor.

[0137] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may also be an external storage device of the terminal device D10, such as a plug-in hard disk, a smart memory card (SMC, SmartMedia Card), a secure digital (SD, Secure Digital) card, a flash card, etc. equipped on the terminal device D10. Furthermore, the memory D101 may also include both an internal storage unit of the terminal device D10 and an external storage device. The memory D101 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory D101 may also be used to temporarily store data that has been output or is to be output.

[0138] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned various method embodiments can be implemented.

[0139] An embodiment of the present application provides a computer program product. When the computer program product is run on a terminal device, the terminal device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0140] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of protection of the present application is limited to these examples. In line with the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0141] The one or more embodiments of this application are intended to encompass all such substitutions, modifications, and variations that fall within the broad scope of this application. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of this application should be included in the scope of protection of this application.

Claims

1. A collaborative adversarial training method is applied to an ensemble model, wherein the ensemble model includes three sub-models, each of which is used for image recognition and has different model structures. The sub-models are deep neural network models, characterized in that: The method comprises: Adding perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; the clean samples are autonomous driving images or object recognition images; For each of the clean sample and the adversarial sample, input the clean sample into each of the sub-models to obtain the probability that the sub-model outputs the true category of the clean sample and the adversarial sample; For each of the three sub-models, the probability difference of the other two sub-models in the integrated model except the sub-model is calculated respectively, and the collaborative adversarial training loss of the sub-model is constructed based on the probability of the sub-model itself and the probability difference. In combination with the cross entropy loss and the collaborative adversarial training loss, a back propagation algorithm is performed to update the parameters of the sub-model until the integrated model meets the preset criteria; wherein the collaborative adversarial training loss is used to characterize the training weight assigned to the clean sample by the sub-model during the training process.

2. The collaborative adversarial training method according to claim 1, wherein: Adding disturbance to the clean sample includes: By calculating the formula Get the disturbance value ;in, represents the step length, represents the symbolic function, represents the gradient of the loss function with respect to the input, Indicates the clean samples The corresponding adversarial examples, express The corresponding true category label, Indicates that perturbations are added based on the gradient information of a single sub-model; or By calculating the formula Get the disturbance value ;in, Indicates that the integrated model responds to adversarial samples The category output probability distribution of represents the category of the clean sample, represents the number of sub-models in the integrated model, , Indicates the After applying softmax to the logits of the sub-model, the sub-model is The category output probability distribution of Indicates adding perturbations based on the gradient information of the integrated model.

3. The collaborative adversarial training method according to claim 2, wherein: The collaborative adversarial training loss includes adversarial sample loss and clean sample loss; The expression of the adversarial sample loss is as follows: in, represents the adversarial sample loss, is the designed index difference, which is used to describe the difference in category output of the other two sub-models except the current sub-model. Represents the three sub-models in the integrated model, Represents the current sub-model, represents distance regularization, Represents a pair model After applying softmax to the logits, the sub-model is The category output probability distribution of Represents a pair model After applying softmax to the logits, the sub-model is The category output probability distribution of represents the prediction of sub-model a for the adversarial sample, Represents the prediction of model a for clean samples; The expression of the clean sample loss is as follows: in, represents the clean sample loss, Represents a pair model After applying softmax to the logits, the sub-model is used for clean samples The category output probability distribution of Pair Model After applying softmax to the logits, the sub-model is used for clean samples The class output probability distribution of .

4. The collaborative adversarial training method according to claim 3, wherein: The total loss value of the back-propagation algorithm is expressed as follows: in, represents the cross entropy loss, Represents the weight coefficient.

5. The collaborative adversarial training method according to claim 4, characterized in that: The preset standards are: in, represents the training paradigm of the perturbations produced by the ensemble model, represents the total number of samples, represents the model parameters, represents the total number of samples, represents the loss of computing the perturbations produced by the ensemble model, represents the iteration step size, represents the integrated model, Indicates the label corresponding to the sample, represents the symbolic function, represents the perturbation added to the integration.

6. A collaborative adversarial training system, applied to an integrated model, wherein the integrated model includes three sub-models, each of which is used for image recognition, and the model structures of different sub-models are different. The sub-models are deep neural network models, characterized in that: include: A perturbation module is used to add perturbations to clean samples to obtain adversarial samples corresponding to the clean samples; The clean samples are autonomous driving images or object recognition images; A probability calculation module is used to input either the clean sample or the adversarial sample into each of the sub-models, and obtain the probability that the sub-model outputs the true category of the clean sample or the adversarial sample; The collaborative adversarial training module is used to calculate the probability difference of the other two sub-models in the integrated model for each sub-model of the three sub-models, and construct the collaborative adversarial training loss of the sub-model based on the probability of the sub-model itself and the probability difference. The back propagation algorithm is combined with the cross entropy loss and the collaborative adversarial training loss to update the parameters of the sub-model until the integrated model meets the preset criteria; wherein the collaborative adversarial training loss is used to characterize the degree of importance that the sub-model attaches to the clean samples during the training process.

7. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images