Counter-defense method based on dynamic gating mixed batch normalization

Abstract

The invention discloses a confrontation and defense method based on dynamic gating mixed batch normalization. The method comprises the following steps: step 1, data acquisition and model initialization; 2, calling an adversarial attack algorithm to generate an adversarial sample; combining the adversarial sample and the clean sample to form a mixed sample; step 3-1, establishing a wide residual network model; the initial convolution layer passes through three network frameworks with the same structure, and the output of the last network framework sequentially passes through a standard batch normalization layer, a ReLU activation function, a global pooling layer and a full connection layer; each network framework comprises four residual blocks; 3-2, learning mixed batch normalization layer statistical distribution by using clean samples and adversarial samples; and 3-3, freezing parameters of the mixed batch normalization layer, and learning parameters of other network layers in the wide residual network model. According to the invention, by introducing a dual-path dynamic normalization and adaptive gating fusion mechanism, the robustness, generalization ability and calculation efficiency of the model are significantly improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security, and particularly to a training method and an implementation system thereof for improving the robustness of a model against adversarial attacks by statistically analyzing the distribution of adversarial samples, using a gating mechanism of a double-branch batch normalization layer, and dynamically adjusting the gating to enter two different batch normalization layers according to the input samples of the model. Background Art

[0002] Deep neural networks have made remarkable progress in the fields of computer vision, natural language processing, etc., but their decision-making processes are vulnerable to the threat of adversarial attacks. Adversarial attacks generate adversarial samples by adding tiny perturbations to input samples, such as noise within the L p = norm constraint, which can then lead to incorrect predictions by the model. For example, the Fast Gradient Sign Method (FGSM) generates adversarial perturbations based on single-step gradient ascent, which is computationally efficient but has limited attack strength; the Projected Gradient Descent (PGD) method generates strong adversarial samples through multi-step iterative optimization and is regarded as the strongest method based on first-order gradient attacks; while optimization-based attacks directly minimize the adversarial loss function, bypassing defense mechanisms such as gradient masking. These attacks reveal the local linearity of neural networks in the high-dimensional feature space - even tiny perturbations superimposed along the gradient direction can significantly change the model output. More seriously, the cross-model transferability of adversarial samples enables black-box attacks, where attackers can carry out attacks without knowing the internal structure of the target model, seriously threatening the security of actual systems.

[0003] To address this challenge, adversarial training has been proposed to improve the robustness of the model. Its core idea is to inject adversarial samples into the training process, forcing the model to learn the features of both clean samples and adversarial samples simultaneously. For example, PGD adversarial training improves robustness by generating PGD adversarial samples and minimizing their losses in each iteration; the TRADES method balances the prediction consistency between clean samples and adversarial samples through KL divergence, alleviating the trade-off between robustness and accuracy. However, traditional adversarial training has significant limitations. The traditional Batch Normalization (BN) layer assumes that the input data follows an independent and identical distribution, and the mixed input of adversarial samples and clean samples violates this assumption, resulting in the deviation of normalization statistics such as the mean and variance, further exacerbating the vulnerability of the model. Summary of the Invention

[0004] The object of the present invention is to overcome the deficiencies of the prior art and provide an adversarial defense method based on dynamic gating hybrid batch normalization, which significantly improves the model robustness, generalization ability and computational efficiency by introducing a dual-path dynamic normalization and adaptive gating fusion mechanism.

[0005] The object of the present invention is achieved by the following technical solutions: An adversarial defense method based on dynamic gating hybrid batch normalization includes the following steps:

[0006] Step 1, data acquisition and model initialization: Use a standard public dataset in the field of image recognition as the training set, which is used as clean samples, and the clean samples in the dataset all come with labels;

[0007] Step 2, call the adversarial attack algorithm to generate adversarial samples: Attack the clean samples through the PGD adversarial attack algorithm to generate adversarial samples, and the labels of the adversarial samples are the same as those of the input samples; Combine the adversarial samples and clean samples to form a mixed sample; In the mixed sample, the first half is clean samples and the second half is adversarial samples;

[0008] Step 3, optimize the parameters of the wide residual network model;

[0009] Step 3-1, establish a wide residual network model; The mixed sample first passes through an initial convolutional layer to extract the preliminary features of the data, then passes through 3 network frameworks with the same structure, and the output of the last network framework passes through a standard batch normalization layer, a ReLU activation function, a global pooling layer and a fully connected layer in sequence;

[0010] Each network framework contains four residual blocks; In each residual block, there are successively a hybrid batch normalization layer 1, a gating module 1, an activation function 1, a convolutional layer 1, a hybrid batch normalization layer 2, a gating module 2, an activation function 2, and a convolutional layer 2;

[0011] The hybrid batch normalization layer includes a main batch normalization layer and an auxiliary batch normalization layer arranged in parallel; Both the main batch normalization layer and the auxiliary batch normalization layer are standard batch normalization layers BatchNorm;

[0012] The gating module includes a standard batch normalization layer, an activation function, a convolutional layer, a global pooling layer and a fully connected layer connected in sequence;

[0013] Step 3-2, use clean samples and adversarial samples to learn the statistical distribution of the hybrid batch normalization layer; In this step, the gating module does not participate in the decision-making process, and the parameters of the gating module are fixed and not updated; Input the mixed sample into the wide residual network model. In this step, the hybrid batch normalization layer will divide the mixed sample into clean samples and adversarial samples. The clean samples are input into the main batch normalization layer, and the adversarial samples are input into the auxiliary batch normalization layer;

[0014] Calculate the loss function of the wide residual network model, and update the parameters of other network layers except the gating module through backpropagation; specifically, calculate the cross-entropy loss between the prediction result obtained by the wide residual network model and the combined label.

[0015] Step 3-3: Freeze the parameters of the hybrid batch normalization layer and learn the parameters of the remaining network layers in the wide residual network model; including the following steps;

[0016] Step 3-3-1: Calculate the total loss function of the wide residual network model: The total loss function of the wide residual network model includes the classification loss and the gating loss

[0017] Step 3-3-2: Perform backpropagation to update the parameters of other network layers in the wide residual network model except the hybrid batch normalization layer.

[0018] The beneficial effects of the present invention are: By introducing the dual-path dynamic normalization and adaptive gating fusion mechanism, the present invention has achieved significant improvements in model robustness, generalization ability, and computational efficiency.

[0019] Through the collaborative training of two types of batch normalization for clean samples and adversarial samples, and combined with the adversarial sample dynamic generation technology, the model's defense ability against various adversarial attacks has been significantly improved. Among them, for the PGD attack method, the accuracy rate and robust accuracy rate can reach 91% and 53% respectively, far higher than traditional adversarial training methods. Based on the dynamic fusion mechanism of gating weights, it can automatically adjust the contribution ratio of the two types of batch normalization layers according to the noise intensity and distribution characteristics of the input data,

[0020] optimize the feature expression, and the generalization performance in complex adversarial attack scenarios has been significantly improved. Adopt an independent parameter update strategy for the two types of batch normalization layers of clean samples and adversarial samples to avoid mutual interference between paths. At the same time, constrain the consistency of the weight distribution through the gating loss to ensure that the training stability of the model is significantly improved while maintaining high capacity. The present invention significantly improves adversarial robustness, cross-domain adaptability, and computational efficiency on the premise of ensuring the normal data accuracy of the model, providing a highly reliable solution for safety-sensitive scenarios such as autonomous driving and medical imaging. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is the overall flowchart of the present invention;

[0022] Figure 2 is the forward propagation flowchart in Mix mode. DETAILED DESCRIPTION OF THE INVENTION

[0023] The present invention proposes Dynamic Gated Hybrid Batch Normalization (DGH-BN), aiming to solve the distribution shift problem in adversarial training by adaptively fusing the statistics of multiple normalization branches. The core innovation of this method lies in introducing a learnable gating network to dynamically adjust the weights of different normalization branches. Specifically, first, independent batch normalization branches are trained for clean samples and adversarial samples respectively to statistically characterize the specific statistical features of the two distributions; second, a lightweight gating network is designed to automatically generate branch weights according to the input features without explicitly dividing the data domain; finally, the means and variances of each branch are weighted and aggregated with the gating weights to suppress the interference of adversarial perturbations on the normalization process. Compared with existing methods, DGH-BN has significant advantages: first, by end-to-end learning the weights of the mixed distribution, it avoids manual design of thresholds or data domain division, improving the model's adaptability; second, it can be seamlessly integrated into adversarial training frameworks such as PGD and TRADES to enhance robustness without increasing the inference overhead; third, the multi-branch statistic fusion mechanism can capture the feature differences of different attack types, thereby improving the model's generalization and defense ability against unknown attacks. This technology provides a new paradigm for the design of normalization layers in adversarial training and lays a foundation for constructing efficient and generalized robust models.

[0024] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0025] As Figure 1 shown, an adversarial defense method based on dynamic gated hybrid batch normalization of the present invention includes the following steps:

[0026] Step 1, data acquisition and model initialization: To ensure the repeatability and generality of the experiment, the present invention uses a standard publicly available dataset in the field of image recognition as the training set. Specifically, CIFAR10, MNIST, SVHN, TinyImageNet, etc. can be selected. These datasets are widely used in the field of image recognition, have different characteristics and scales, and can comprehensively evaluate the performance of the model in different scenarios. In this embodiment, CIFAR10 is selected as the clean sample, and the clean samples in the dataset all come with labels.

[0027] After obtaining the data, randomly shuffle the data order, and then divide it into a training set and a validation set according to a ratio of 7:3. And batch process the data sets in the training set and the validation set respectively, and set the batch size. In this embodiment, the batch size is set to 512. Selecting an appropriate batch size is crucial for model training. A smaller batch size will cause the model to update parameters frequently during training, which may lead to unstable training, but can adapt to the local features of the data faster; while a larger batch size can enable the model to estimate gradients more accurately when updating parameters, reduce the randomness of gradients, and improve the stability of training. Setting the batch size to 512 is a balance between stability and training efficiency, which can not only ensure that the model estimates gradients accurately during each parameter update, but also avoid problems such as excessive memory occupation and too long training time caused by too large a batch size.

[0028] Step 2: Invoke the adversarial attack algorithm to generate adversarial examples: Use the Projected Gradient Descent (PGD) adversarial attack algorithm to attack the clean examples and generate adversarial examples with the same labels as the input examples. As an iterative attack algorithm, PGD calculates the gradient of the loss function with respect to the input examples through multiple iterations, perturbs the input normal examples slightly along the gradient direction, and projects the perturbed examples into a region centered on the original examples and bounded by a specified perturbation range. It can efficiently find adversarial examples that can mislead the target model within an acceptable perturbation range, having more advantages than other simple attack algorithms. Regarding the parameter configuration of the PGD adversarial attack algorithm, set the maximum perturbation range to 8 / 255. In image data, pixel values are generally normalized to the range of 0 to 1. This setting can make the generated adversarial examples visually similar to the original examples, being neither easily detectable nor having insufficient perturbation to mislead the model. Set the step size to 2 / 225. This step size achieves a good balance between the attack effect and computational efficiency. A smaller step size can make the attack more refined but increase the computational time, while a larger step size may skip the optimal solution. Determine the number of iterations to be 10 times. Multiple iterations can make the attack gradually approach the optimal adversarial perturbation, improving the attack success rate. And through a large number of experiments, it is verified that this number of iterations can achieve good results in most cases and avoid wasting computational resources. For the initialization of the attack starting point, adopt a random initialization method and start the attack from the clean data with a 20% probability. Random initialization can increase the diversity of the attack and avoid falling into local optimal solutions, while starting the attack from the clean data with a certain probability simulates the scenario where an attacker may directly start the attack from the original data in practice, making the generated adversarial examples more realistic. Combine the adversarial examples [B, C, H, W] and the clean examples [B, C, H, W] to form a mixed example with the shape of [B*2, C, H, W]. In the mixed example, the first half is the clean example, and the second half is the adversarial example; where B represents the batch size, C represents the number of channels, and H and W are the height and width of the feature map respectively. At the same time, combine the labels corresponding to the two types of examples to ensure the same format as the combined examples.

[0029] Step 3: Optimize the parameters of the Wide Residual Networks (WideResNet) model;

[0030] Step 3-1: Establish a Wide Residual Networks model. The Wide Residual Networks model is a standard deep neural network (DNN), which was proposed by Zagoruyko et al. in 2016 and is widely used in image classification and adversarial training.

[0031] The forward propagation process of the Wide Residual Networks model is as Figure 2 shown. Input the combined examples into the Wide Residual Networks model and perform forward propagation.

[0032] The combined mixed samples first pass through an initial convolutional layer to extract the preliminary features of the data, then pass through 3 network frameworks with the same structure, and the output of the last network framework is successively passed through a standard batch normalization layer (BatchNorm, BN layer), a ReLU activation function, a global pooling layer, and a fully connected layer;

[0033] Each network framework contains four residual blocks; in each residual block, there are successively a mixed batch normalization layer 1

[0034] (MixBatchNorm1), a gating module 1 (Gate1), an activation function 1 (ReLU activation function), a convolutional layer 1 (Conv1), a mixed batch normalization layer 2 (MixBatchNorm2), a gating module 2 (Gate2), an activation function 2 (ReLU activation function), and a convolutional layer 2 (Conv2); in each residual block, the output of convolutional layer 2 is connected to the input data of this residual block as the output of this residual block. Each residual block has to perform the above-mentioned batch normalization operation twice and then perform a residual connection to enhance the model's learning ability for features and alleviate the problem of gradient disappearance or explosion; 4 residual blocks are performed in each stage, and the entire forward propagation process contains 3 stages;

[0035] The mixed batch normalization layer includes a main batch normalization layer (main BN layer) and an auxiliary batch normalization layer (ABN layer) set in parallel; both the main batch normalization layer and the auxiliary batch normalization layer are standard batch normalization layers BatchNorm. When training the mixed batch normalization layer, the main batch normalization layer is used to process clean samples, and the auxiliary batch normalization layer is used to process adversarial samples. The mixed batch normalization layer splits the input mixed samples, with the first half being clean samples and the second half being adversarial samples. The clean samples are passed through the main BN layer, and the adversarial samples are passed through the auxiliary BN layer (ABN layer). As an important structure in the deep neural network, the residual block can effectively alleviate the problem of gradient disappearance or explosion, enabling the network to train a deeper model and thus learn richer and more abstract features. The main batch normalization layer can make the input data have a stable distribution among different batches, accelerate the model convergence, and reduce the internal covariate shift; the structure of the auxiliary batch normalization layer is the same as that of the main batch normalization layer, but adversarial samples are used for processing during the training process, and the updated parameter features are more in line with adversarial samples. When training the gating module and applying the model to actual image recognition, the input data will be input into both the main batch normalization layer and the auxiliary batch normalization layer at the same time; during the training process of the gating module using mixed samples, the output shapes of both the main batch normalization layer and the auxiliary batch normalization layer are [B*2, C, H, W]. Subsequently, the outputs of these two batch normalization layers are stacked in a new dimension. For each sample x i, generate a dual-channel BN output [B*2, 2, C, H, W]. The advantage of this is that it provides richer feature information for the subsequent gating mechanism, facilitating the gating mechanism to dynamically select or combine the outputs of different normalization methods according to the learned weights, thereby enhancing the model's adaptive processing ability for different data features.

[0036]

[0037] BN main (x i ) is the sample processed through the main batch normalization layer path, and BN aux (x i ) is the sample processed through the auxiliary batch normalization layer path, and F bn is the stacked sample.

[0038] The gating module includes a standard batch normalization layer (BatchNorm), an activation function (ReLU activation function), a convolutional layer, a global pooling layer, and a fully connected layer connected in sequence; first, the features are normalized through the standard batch normalization layer, which can make the input data have a more stable distribution among different batches, accelerate the model convergence, reduce the internal covariate shift, and help the model better learn features. Then, the ReLU activation function is used to introduce non-linearity and enhance the model's expressive ability, enabling the model to learn more complex feature patterns. After that, convolutional operations are performed through the convolutional layer to further extract features. The convolutional kernel can detect specific features in the input data, such as edges, textures, etc., to obtain more representative gating features. Then, global pooling is performed on these features to compress the spatial dimension of the feature map to 1, integrate the spatial information, and obtain a fixed-length feature vector for subsequent processing. Finally, weights are generated through the fully connected layer, and these weights will play a key role when the subsequent gating mechanism is enabled, helping the model adaptively select the appropriate processing method.

[0039] In the wide residual neural network, the sample selection of different BN layers is controlled by the gating module, and the specific process is as follows:

[0040] (a) Generation of Gating Weights. In model training, the gating weight generation step is executed with the aim of providing dynamic and adaptive weight allocation for subsequent feature processing, so as to enhance the model's learning and processing capabilities for different data features. Specifically, first, the mixed data is input into the batch normalization layer for normalization processing, and the shape of the input data is [B*2, C, H, W]. The BN layer normalization can make the input data have a more stable distribution among different batches, accelerate model convergence, and reduce internal covariate shift. Then, the normalized output is passed through the ReLU activation function. The ReLU activation function can introduce non-linearity, enhance the model's expressive power, enable the model to learn more complex feature patterns, and is computationally simple, effectively alleviating the vanishing gradient problem. After that, a convolution operation is performed on the activated output. The convolution operation uses a learnable convolution kernel to slide on the input data to extract local features of the data, and the output shape remains [B*2, C, H, W]. After the convolution operation is completed, global pooling is carried out. Global pooling compresses the spatial dimension of the feature map to 1, integrates spatial information, obtains a fixed-length feature vector, reduces the data dimension and computational amount. Then, the result after global pooling is flattened so that its shape becomes [B*2, 2]. Finally, the softmax function is applied to the flattened result to convert it into normalized weights. The values of these weights range from 0 to 1, and the sum of all weights is 1, which can be used for subsequent weighted selection or combination of different features or processing branches.

[0041]

[0042]

[0043]

[0044] w i is the raw weight score (Raw Logits) generated by the gating module, representing the initial importance scores for the two paths (the main batch normalization path and the auxiliary batch normalization path) of the input feature map x i is w i after softmax normalization, representing the dynamic fusion weights of the two paths. represents a two-dimensional real vector space, that is, the output is a vector composed of two real numbers (each component belongs to the real number field). are the raw scores output by the gating module respectively. Through exponential operation, the probability is ensured to be non-negative; the subscript i represents the i-th sample, the subscript 0 represents the probability of the clean sample, and the subscript 1 represents the probability of the adversarial sample. and the sum of the two is 1.

[0045] (b) Feature weighted fusion. In the feature processing flow of the model, feature weighted fusion and residual connection are key steps to improve the model performance and flexibility. For the dual-channel features F i = [f main , f aux corresponding to each sample, in order to make full use of these two types of feature information, a dynamic weighted fusion method is adopted. Specifically, the weights and learned through the gating decision mechanism are used to perform weighted summation on f main and f aux to obtain the fused features. The weights and here are obtained through training, and they can adaptively adjust the contribution ratios of the main batch normalization layer and the auxiliary batch normalization according to the characteristics of different samples, so as to realize the dynamic control of the hybrid batch normalization process by the gating module mechanism. This dynamic control method enables the model to flexibly select appropriate normalized features according to the specific situation of the input data, enhancing the adaptability and processing ability of the model to different data features. The following is the formula for the fused features:

[0046]

[0047] f main is the main feature information, usually output by the main batch normalization layer, which can reflect the conventional feature distribution of the data; is the weight of the main feature information learned by the gating module; f aux is the auxiliary feature information, output by the auxiliary batch normalization layer, which may capture the data features from different perspectives or special scenarios; is the weight of the auxiliary feature information learned by the gating module.

[0048] (c) After completing the feature weighted fusion, the fused feature F out,i is input into the convolutional layer again for feature extraction. The convolutional operation can further explore the local information and patterns in the features and extract more advanced and abstract feature representations. Finally, the features after the convolutional operation are added to the original input features in a residual connection manner. The introduction of the residual connection can effectively alleviate the problem of gradient vanishing or explosion, enabling the network to train deeper models, while retaining the information of the original input features, which helps the model learn more complex feature mapping relationships, improve the generalization performance and stability of the model, and finally obtain the final output of the whole step. The following is the formula for the final output:

[0049] F res = F out + ConvShortcut(F in )

[0050] F out : The output of the sample features obtained through weighted calculation; F in : The original input feature map of the residual block.

[0051] After the three network frameworks, the data is processed through a standard batch normalization layer, and then activated through the ReLU activation function to introduce non-linear factors and enhance the model's expressive ability; then convolution operations are performed through the convolutional layer. Then global average pooling is carried out to compress the spatial dimension of the feature map to 1, integrate the spatial information, reduce the data dimension, and reduce the computational amount. Finally, classification is performed through the fully connected layer to output the prediction result, and the probability that the input sample belongs to each semantic category is output; the forward propagation process is completed.

[0052] Global pooling and classification. At the key stage of the model processing flow, global pooling and classification operations are required to complete the final classification decision on the input data. First, global pooling operations are carried out on the results output by the residual block. As an important structure of the deep neural network, the residual block can effectively alleviate the problems of gradient disappearance or explosion, enabling the network to learn richer and more abstract features. And global pooling can compress the spatial dimension of the feature map to 1, integrate the spatial information of the feature map, and obtain a feature vector of a fixed length. This not only reduces the data dimension and computational amount, but also enhances the translation invariance of the model and avoids the overfitting problem. After global pooling, the obtained feature vector is input into the fully connected layer for classification. The fully connected layer can map the feature vector after global pooling to different category spaces, assign a score to each sample for each category, and these scores reflect the likelihood of the sample belonging to each category, providing a basis for subsequent classification decisions. The following is the final output of the network:

[0053]

[0054] W fc Is the learnable weight matrix of the fully connected layer, used to map the features after global pooling to the category scores. b fc Is the learnable bias vector of the fully connected layer, used to adjust the baseline shift of the classification result. num_classes is the number of categories that the model needs to distinguish. For example, the MINIST dataset needs to distinguish (0-9), so num_classes is 10.

[0055] The parameter optimization process of the wide residual network model in the present invention includes 2 optimization processes: (1) learning the statistical distribution of the mixed batch normalization layer with clean samples and adversarial samples; (2) learning the gating module and training the recognition ability of the overall network model for both clean samples and adversarial samples.

[0056] The optimization process specifically includes the following steps:

[0057] Step 3-2: Use the clean samples and adversarial samples to learn the statistical distribution of the mixed batch normalization layer; in this step, the gating module does not participate in the decision-making process, and the parameters of the gating module are fixed and not updated.

[0058] Input the mixed samples into the wide residual network model. In this step, the mixed batch normalization layer will divide the mixed samples into clean samples and adversarial samples. The clean samples are input into the main batch normalization layer, and the adversarial samples are input into the auxiliary batch normalization layer.

[0059] Calculate the loss function of the wide residual network model, and update the parameters of other network layers except the gating module (including the initial convolutional layer, the mixed batch normalization layer and convolutional layer in each residual block, the standard batch normalization layer and fully connected layer after the three network frameworks) through backpropagation. In this way, the wide residual network model of the present invention can fully learn the features of clean samples and adversarial samples, laying a good foundation for the effective enabling of the subsequent gating mechanism.

[0060] Specifically, calculate the cross-entropy loss between the prediction result obtained by the wide residual network model and the combined label; the cross-entropy loss function can effectively measure the difference between the model prediction distribution and the true label distribution, and is a widely used and effective loss metric in classification tasks. By calculating the cross-entropy loss, the deviation degree of the current prediction result of the model from the real situation can be clarified. Subsequently, backpropagation is performed to calculate the gradient of the loss function with respect to all parameters of the model based on the chain rule; the gradient reflects the change trend of the loss function in the parameter space and is an important basis for parameter update. Through the gradient information obtained by backpropagation, the direction and degree of the influence of each parameter on the loss function can be clarified for parameter update, so as to make the normalization process of the BN layer for clean samples and adversarial samples perform better; the calculation formula of the cross-entropy loss function is:

[0061]

[0062] is the cross-entropy loss of the prediction result, logits merged is the prediction result of the mixed samples, y merged is the label of the mixed samples, and CrossEntropy(·,·) is the cross-entropy loss function.

[0063] Perform loss calculation and backpropagation operations to update the parameters of the wide residual network model except the gating module; to promote the parameter adjustment of the wide residual network model in a better direction.

[0064] Step 3-3: Freeze the parameters of the MixBatchNorm layer, and learn the parameters of the remaining network layers in the wide residual network model, training the wide residual network model for the recognition ability of clean samples and adversarial samples; when the model is training, it may not directly know the type of each sample, but automatically judges and gives weights according to the features through the gating module. Therefore, the gating module plays a role of dynamic routing here. By training the gating module, it is ensured that each sample undergoes the most appropriate processing, thereby improving the robustness of the model. It includes the following steps;

[0065] Step 3-3-1: Calculate the total loss function of the wide residual network model. In the training process of the deep learning model, loss calculation is a key link. It can quantify the difference between the model prediction result and the true label, providing a direction for the optimization of the model parameters. The total loss function of the wide residual network model of the present invention includes the classification loss and the gating loss :

[0066]

[0067] λ is the weight of the gating loss in the total loss, which can be adjusted independently according to requirements, and the default value is 1.0.

[0068] The specific calculation methods of each loss function are as follows:

[0069] (a) Calculate the classification loss of the model for samples. In order to enable the model to learn data features more comprehensively, in this classification loss calculation, all samples will pass through two paths of the batch normalization layer and the auxiliary batch normalization layer at the same time. The batch normalization layer and the auxiliary batch normalization layer will capture the feature information of different aspects of the data, and the dual-path processing can fully explore the multi-dimensional features of the data. Then, dynamic weighted fusion is carried out using the gating weights, and the gating weights will adaptively adjust the contribution ratio of the output BN(x i ) of the BN path and the output ABN(x i ) of the ABN path according to the specific features of the sample. This dynamic fusion method enables the model to flexibly select appropriate normalized features according to the characteristics of the input data, enhancing the adaptability of the model to different data. Finally, the cross-entropy loss function is used to calculate the classification loss .

[0070]

[0071] BN(x i ) is the output of the mixed sample passing through the BN path; ABN(x i ) is the output of the mixed sample passing through the ABN path.

[0072] (b) Gating Module Loss Calculation. The gating loss calculation aims to further optimize the model performance, especially to improve the effectiveness of the gating mechanism and the robustness of the model. The gating loss consists of two parts: classification loss and consistency loss, and the formula is:

[0073]

[0074] is the classification loss of the gating module for samples; is the consistency loss.

[0075] Classification Loss of the Gating Module for Samples. In the adversarial training method based on dynamic gating hybrid batch normalization, the calculation of the classification loss of the gating module for samples is an important link to improve the classification ability of the model. Specifically, in each residual block, the gating module independently predicts the samples and calculates the corresponding loss based on these predictions. To clarify the categories of the samples, the merged samples are labeled: the labels of the first B samples are set to 0 to represent clean samples; the labels of the last B samples are set to 1 to represent adversarial samples. Such label setting helps the gating module accurately distinguish different types of samples, thus making more effective predictions. When calculating the loss, a small value is added to the calculation process to ensure numerical stability. The addition of this small value can avoid the situation where the input to the logarithmic function is zero, thus ensuring the accuracy and stability of the loss calculation.

[0076]

[0077] L is the number of layers of the residual block; is the normalized weight generated by the gating module in the l-th layer, representing the probability distribution of the sample path selection in this layer; ∈ = 10 -10 , to prevent numerical instability caused by taking the logarithm of zero probability;

[0078]

[0079] Consistency Loss. The introduction of the consistency loss is to enhance the robustness of the model. In the model, the gating modules of different layers may have differences in the path selection of the same sample, and this difference may lead to model instability. The consistency loss penalizes the prediction differences between different layers, forcing the path selections of all layers for the same sample to tend to be consistent. By minimizing the consistency loss, the gating predictions between different layers of the model can be made more stable and consistent, thus improving the robustness and generalization ability of the model.

[0080]

[0081] KL(·||·) is the Kullback-Leibler divergence, which measures the difference between two probability distributions.

[0082] Step 3-3-2: Perform backpropagation to update the parameters of other network layers in the wide residual network model except for the hybrid batch normalization layer (including all parameters of the gating module, the initial convolutional layer parameters, the standard batch normalization layer and fully connected layer parameters after the three network frameworks, and the convolutional layer parameters in each residual block). First, calculate the gradients of the loss function with respect to the model parameters through the backpropagation algorithm. Next, update each parameter through backpropagation. The gating module plays an important role in dynamically adjusting the feature processing method in the model. Updating its parameters can make the gating mechanism make more accurate decisions according to the characteristics of the input data, thereby optimizing the model's processing ability for different features. The convolutional layer and linear layer in the gating mechanism are responsible for extracting and transforming features. Updating their parameters enables the model to learn more representative and discriminative feature representations. The main convolutional layer is the core part of the model for feature extraction. Updating its parameters helps improve the model's feature extraction ability for the input data. The fully connected layer is used to map the extracted features to specific categories or values. Updating its parameters can make the classification or regression results of the model more accurate. However, during the update process, we will freeze all normalization layer parameters. The role of the batch normalization layer is to make the input data have a stable distribution among different batches, accelerate model convergence, and reduce internal covariate shift. In the case of the gating mechanism decision, fixing the parameters of BN and ABN can prevent the parameters of these normalization layers from being over-adjusted during training, disturbing the calculation of the weights of the gating mechanism for clean and adversarial samples, thereby maintaining the stability of the model. After the model has learned the distribution characteristics of clean samples and adversarial samples in the BN layer, freezing these parameters can prevent them from being disturbed in subsequent training, ensuring that the model continues to optimize the parameters of other parts based on the existing feature representations. Through this targeted parameter update and freezing strategy, it is possible to effectively improve the performance and generalization ability of the model while ensuring the stability of the model.

[0083] Step 4: Detection and evaluation: Calculate the test set accuracy and the test set robust accuracy. After the model training is completed, it is necessary to accurately detect and evaluate its performance to determine the effectiveness and reliability of the model in practical applications. This step covers two key links: data pre-preparation and performance metric calculation, and measures the classification ability of the model on clean samples and adversarial samples through scientific methods and metrics.

[0084] Step 4-1, Data Preparation in Advance. In the testing phase, to comprehensively evaluate the robustness of the model, adversarial samples need to be generated. Adversarial samples are specially designed samples aimed at misleading the model to make incorrect classifications. Testing them can examine the performance of the model when facing malicious attacks. If the gating mechanism is enabled, the attack will be generated based on the dynamic path and adopt the DNN mode. This method allows the model to dynamically adjust the processing path according to the characteristics of the input data, making the attack more in line with the actual operation of the model, so as to more accurately evaluate the effectiveness of the gating mechanism. Then, the clean samples and adversarial samples are combined to construct a test set containing various types of data. Then, the combined samples are input into the gating module, which processes the sample features through convolutional and linear layers and outputs weights. These weights, after being normalized by the Softmax function, can be represented as a probability distribution and are used to weighted-fuse the features of the main path and the auxiliary path. This weighted-fusion method can adaptively adjust the contribution ratio of the main and auxiliary path features according to the specific features of the samples, thereby improving the model's processing ability for different types of samples. To reduce the randomness of the one-way gating and enhance the stability of the model's decision-making, a voting mechanism is adopted to dynamically select the feature processing path to optimize the inference process of the model for each sample. Specifically, the gating selections of the last 10 residual blocks are counted, and the final processing path is determined according to the result of the majority vote. This can avoid misclassifications caused by the randomness of individual gating decisions and make the model's decision more reliable.

[0085] Step 4-2, Calculation of Performance Metrics. After multiple rounds of training, the performance of the model is evaluated by calculating two important metrics: natural accuracy and adversarial accuracy, and the model is selected according to the needs.

[0086] (a) Natural Accuracy (Clean Accuracy) The correct classification rate of the model on clean data, which reflects the classification ability of the model under normal circumstances. Its calculation formula is:

[0087]

[0088] N is the total number of samples in the test set, is the model output (unnormalized class score) of the i-th clean sample, y i is the true label of the i-th sample, is the indicator function (1 for correct prediction, 0 otherwise);

[0089] (b) Adversarial Accuracy (Adversarial Accuracy) The correct classification rate of the model on adversarial samples, which reflects the robustness of the model when facing malicious attacks. The calculation method is:

[0090]

[0091] is the model output for the i-th adversarial example.

[0092] By calculating the adversarial accuracy, the classification ability of the model in complex and malicious environments can be judged, providing an important reference for the practical application of the model. After multiple rounds of training, the natural accuracy reaches 98.7%, the adversarial accuracy reaches 85.2%, and for the PGD attack method, the accuracy and robust accuracy can reach 91% and 53% respectively, indicating that the model has high classification accuracy under normal circumstances and also has a certain degree of robustness when facing adversarial examples.

[0093] Those of ordinary skill in the art will realize that the embodiments described herein are for helping the reader understand the principles of the present invention, and it should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those of ordinary skill in the art can make various other specific deformations and combinations without departing from the essence of the present invention based on the technical revelations disclosed in the present invention, and these deformations and combinations are still within the protection scope of the present invention.

Claims

1. An adversarial defense method based on dynamic gating hybrid batch normalization, characterized in that, It includes the following steps: Step 1, data acquisition and model initialization: Use a standard publicly available dataset in the field of image recognition as the training set, which is regarded as clean samples. The clean samples in the dataset come with their own labels; Step 2, call the adversarial attack algorithm to generate adversarial samples: Attack the clean samples through the PGD adversarial attack algorithm to generate adversarial samples. The labels of the adversarial samples are the same as those of the input samples; Combine the adversarial samples and the clean samples to form a mixed sample; In the mixed sample, the first half is clean samples and the second half is adversarial samples; Step 3, optimize the parameters of the wide residual network model; Step 3-1, establish a wide residual network model; The mixed sample first passes through an initial convolutional layer to extract the preliminary features of the data, and then passes through 3 network frameworks with the same structure. The output of the last network framework passes through a standard batch normalization layer, a ReLU activation function, a global pooling layer, and a fully connected layer in sequence; Each network framework contains four residual blocks; In each residual block, there are, in sequence, a mixed batch normalization layer 1, a gating module 1, an activation function 1, a convolutional layer 1, a mixed batch normalization layer 2, a gating module 2, an activation function 2, and a convolutional layer 2; The mixed batch normalization layer includes a main batch normalization layer and an auxiliary batch normalization layer set in parallel; Both the main batch normalization layer and the auxiliary batch normalization layer are standard batch normalization layers BatchNorm; The gating module includes a standard batch normalization layer, an activation function, a convolutional layer, a global pooling layer, and a fully connected layer connected in sequence; Step 3-2, use clean samples and adversarial samples to learn the statistical distribution of the mixed batch normalization layer; In this step, the gating module does not participate in the decision-making process, and the parameters of the gating module are fixed and not updated; Input the mixed sample into the wide residual network model. In this step, the mixed batch normalization layer will divide the mixed sample into clean samples and adversarial samples. The clean samples are input into the main batch normalization layer, and the adversarial samples are input into the auxiliary batch normalization layer; Calculate the loss function of the wide residual network model, and update the parameters of other network layers except the gating module through backpropagation; Specifically, calculate the cross-entropy loss between the prediction result obtained by the wide residual network model and the combined labels; Step 3-3, freeze the parameters of the mixed batch normalization layer and learn the parameters of the remaining network layers in the wide residual network model; It includes the following steps; Step 3-3-1, calculate the total loss function of the wide residual network model: the total loss function of the wide residual network model including the classification loss and the gating loss Step 3-3-2, perform backpropagation to update the parameters of other network layers in the wide residual network model except the mixed batch normalization layer.

Images