Neural network model training method and system for confrontation and defense, and related equipment
Through adversarial training and neural network structure search technology, the structural and weight parameters of the neural network model are optimized, and the problem of errors introduced at the data level defense means is solved, and the robustness and defense capabilities of the model are improved.
Patent Information
- Application Number
- CN202510305600.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-14
- Publication Date
- 2025-08-01
AI Technical Summary
In the prior art, the adversarial defense of neural network models mainly focuses on data-level defense means, resulting in data preprocessing may introduce errors or information loss, affecting the robustness of the model and the main task performance.
By generating adversarial samples, the neural network model is dynamically optimized, and the structural parameters and network weight parameters of the model are used to optimize the network structure to improve robustness.
It improves the defense ability of the neural network model in the fight against attacks, avoids errors and information loss introduced by data preprocessing, and enhances the robustness and training effect of the model.
Smart Images
Figure CN120409610A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of neural networks, and particularly relates to a method, a system and related devices for training a neural network model for adversarial defense. Background Art
[0002] With the development of science and technology, neural network models are increasingly widely used. For example, point cloud processing can be performed based on neural network models, and thus they can be applied in fields such as autonomous driving, scene modeling, and medical imaging. However, there are also more and more attacks on neural network models at present. For example, adversarial attacks are carried out on neural network models.
[0003] In the prior art, adversarial defense can be carried out to cope with adversarial attacks. However, in the prior art, defense means at the data level are usually concerned. For example, preprocessing is performed on training data to improve subsequent training effects. The problem with the prior art is that only defense means at the data level are concerned, and data preprocessing itself may introduce errors or information loss, resulting in a decline in the performance of the main task, affecting the model training effect, and thus being not conducive to improving the robustness of the model.
[0004] Therefore, the related technology still needs to be improved and developed. Summary of the Invention
[0005] The main purpose of the present application is to provide a method, a system and related devices for training a neural network model for adversarial defense, aiming to solve the technical problem that only defense means at the data level are concerned when performing adversarial defense in the related technology, and data preprocessing itself may introduce errors or information loss, resulting in a decline in the performance of the main task, affecting the model training effect, and thus being not conducive to improving the robustness of the model.
[0006] To achieve the above object, in the first aspect of the present application, a method for training a neural network model for adversarial defense is provided, wherein the method for training a neural network model for adversarial defense includes:
[0007] Generating a first adversarial sample corresponding to the model to be trained according to the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained;
[0008] Performing adversarial training on the model to be trained according to the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and updating the model to be trained, wherein the structural parameters are used to update the sub-network layer structure of the model to be trained;
[0009] Return to the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model above, until a preset structure search termination condition is met, and obtain a candidate model with the structure search completed;
[0010] Fix the structure parameters of the above candidate model, train the above candidate model to obtain target network weight parameters, and obtain the trained target neural network model according to the above target network weight parameters and the fixed above structure parameters.
[0011] Optionally, before generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model, the method further includes:
[0012] Obtain an initial to-be-trained model according to a preset initial state network framework, wherein, in the network framework of the above initial to-be-trained model, multiple alternative sub-network layers are set between each node and structure parameters corresponding to the above sub-network layers one by one.
[0013] Optionally, generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model includes:
[0014] Generate the first adversarial sample corresponding to the to-be-trained model based on a preset first adversarial sample generation algorithm according to the information of the to-be-trained model.
[0015] Optionally, performing adversarial training on the to-be-trained model according to the above first adversarial sample to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and updating the above to-be-trained model includes:
[0016] Determine the optimal operation from all candidate operations between the nodes of the to-be-trained model according to the above first adversarial sample and a preset structure search strategy, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and update the to-be-trained model according to the structure parameters and network weight parameters corresponding to the current structure search round.
[0017] Optionally, fixing the structure parameters of the above candidate model and training the above candidate model to obtain target network weight parameters includes:
[0018] Generate the second adversarial sample corresponding to the to-be-trained model according to the information of the above candidate model;
[0019] Fix the structure parameters of the above candidate model, and perform adversarial training on the above candidate model according to the above second adversarial sample to obtain target network weight parameters.
[0020] Optionally, generating the second adversarial sample corresponding to the to-be-trained model according to the information of the above candidate model includes:
[0021] Based on the information of the to-be-trained model above, and based on a variety of preset second adversarial sample generation algorithms, generate second adversarial samples corresponding to the to-be-trained model above.
[0022] Optionally, the above second adversarial sample generation algorithms include the projected gradient descent method, the add attack, and the drop attack.
[0023] The second aspect of this application provides a neural network model training system for adversarial defense. Among them, the neural network model training system for adversarial defense includes:
[0024] A first adversarial sample generation module, configured to generate first adversarial samples corresponding to the to-be-trained model according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structural parameters and / or network weight parameters of the to-be-trained model;
[0025] A structure search module, configured to perform adversarial training on the to-be-trained model according to the above first adversarial samples to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and update the to-be-trained model, where the structural parameters are used to update the sub-network layer structure of the to-be-trained model;
[0026] A search control module, configured to return and execute the step of generating the first adversarial samples corresponding to the to-be-trained model according to the information of the to-be-trained model until a preset structure search termination condition is met, and obtain a candidate model with the structure search completed;
[0027] A network weight training module, configured to fix the structural parameters of the candidate model, train the candidate model to obtain target network weight parameters, and obtain a trained target neural network model according to the target network weight parameters and the fixed structural parameters.
[0028] The third aspect of this application provides an intelligent terminal. The intelligent terminal includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of any one of the above neural network model training methods for adversarial defense.
[0029] The fourth aspect of this application provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, it implements the steps of any one of the above neural network model training methods for adversarial defense.
[0030] As can be seen from the above, in the solution of this application, the first adversarial sample corresponding to the to-be-trained model is generated according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structural parameters and / or network weight parameters of the to-be-trained model; the to-be-trained model is adversarially trained according to the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and the to-be-trained model is updated, where the structural parameters are used to update the sub-network layer structure of the to-be-trained model; return to execute the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model until a preset structure search termination condition is met, and a candidate model with completed structure search is obtained; fix the structural parameters of the candidate model, train the candidate model to obtain target network weight parameters, and obtain the trained target neural network model according to the target network weight parameters and the fixed structural parameters.
[0031] Compared with the prior art, in the solution corresponding to the neural network model training method for adversarial defense provided in this application, in the adversarial defense during neural network model training, it does not focus on the defense means at the data level, but on the defense means at the model structure level. There is no need to preprocess the training data, avoiding problems such as introduced errors or information loss during the data preprocessing process. At the same time, focusing on the defense means at the model structure level, the most robust network structure is selected through model structure search during the training process, which is beneficial to improving the model training effect and the robustness of the model. Furthermore, it is beneficial to improve the defense ability of the trained model against adversarial attacks. BRIEF DESCRIPTION OF THE DRAWINGS
[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.
[0033] Figure 1 is a schematic flowchart of a neural network model training method for adversarial defense provided by an embodiment of the present application;
[0034] Figure 2 is a specific flowchart of a neural network model training method for adversarial defense provided by an embodiment of the present application;
[0035] Figure 3 is a schematic diagram of two training stages of a neural network model training method for adversarial defense provided by an embodiment of the present application;
[0036] Figure 4It is a schematic diagram for comparing the accuracy of the model provided by the embodiments of the present application for the point cloud classification task under adversarial attacks;
[0037] Figure 5 It is a schematic diagram of the composition modules of a neural network model training system for adversarial defense provided by the embodiments of the present application;
[0038] Figure 6 It is a block diagram of the internal structure principle of an intelligent terminal provided by the embodiments of the present application. Detailed implementation manners
[0039] In the following description, for the purpose of illustration rather than limitation, specific details such as specific system architectures and technologies are presented in order to thoroughly understand the embodiments of the present application. However, those skilled in the art should clearly understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details from interfering with the description of the present application.
[0040] It should be understood that when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, wholes, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or their combinations.
[0041] It should also be understood that the terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification of the present application and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an", and "the" are intended to include the plural forms.
[0042] It should be further understood that the term "and / or" used in the specification of the present application and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.
[0043] As used in this specification and the appended claims, the term "if" can be interpreted as "when", "once", "in response to determining", or "in response to classifying into" according to the context. Similarly, the phrase "if determined" or "if classified into [the described condition or event]" can be interpreted as meaning "once determined", "in response to determining", "once classified into [the described condition or event]", or "in response to classifying into [the described condition or event]" according to the context.
[0044] Combined with the accompanying drawings of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.
[0045] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application. However, the present application may be implemented in other ways different from those described herein. Those skilled in the art can make similar generalizations without departing from the spirit of the present application. Therefore, the present application is not limited by the specific embodiments disclosed below.
[0046] Currently, the application of neural network models is becoming increasingly widespread. For example, point cloud processing can be performed based on neural network models and thus applied in various scenarios. As the core representation form of three-dimensional data, point clouds are widely used in fields such as autonomous driving, scene modeling, and medical imaging. In recent years, point cloud deep learning technology has developed rapidly, greatly improving the ability to understand three-dimensional scenes. However, the security issues of point clouds have gradually emerged, and adversarial attacks are a common attack method among them. Point cloud adversarial attacks introduce perturbations to weaken the model performance by adding, deleting, or repositioning points. Existing defense technologies mainly focus on point cloud data processing. For example, DUP-Net restores the point cloud by removing outliers and upsampling, and PointCutMix improves robustness by generating new samples through replacing points, that is, adopting defense means at the data level.
[0047] However, the above defense methods still have deficiencies. For example: they mainly focus on defense means at the data level and do not fully explore the impact of the network architecture on adversarial robustness; data preprocessing may introduce errors or information loss, resulting in a decline in the performance of the main task; adversarial training and the network architecture lack deep integration, making it difficult to form a comprehensive and efficient defense effect.
[0048] To solve at least one of the above-mentioned multiple technical problems, in the solution of this application, a first adversarial sample corresponding to the to-be-trained model is generated according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structural parameters and / or network weight parameters of the to-be-trained model; the to-be-trained model is adversarially trained according to the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and the to-be-trained model is updated, where the structural parameters are used to update the sub-network layer structure of the to-be-trained model; return to execute the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model until a preset structure search termination condition is met, and a candidate model with completed structure search is obtained; fix the structural parameters of the candidate model, train the candidate model to obtain target network weight parameters, and according to the target network weight parameters and the fixed structural parameters, obtain the target neural network model after training is completed.
[0049] Compared with the prior art, in the solution corresponding to the method for training a neural network model for adversarial defense provided by this application, in the adversarial defense during the training of the neural network model, it does not focus on the defense means at the data level, but on the defense means at the model structure level. There is no need to preprocess the training data, avoiding problems such as the introduction of errors or information loss during the data preprocessing process. At the same time, focusing on the defense means at the model structure level, the most robust network structure is selected through model structure search during the training process, which is beneficial to improving the model training effect and the robustness of the model. Furthermore, it is beneficial to improve the defense ability of the trained model against adversarial attacks.
[0050] As Figure 1 shown, an embodiment of this application provides a method for training a neural network model for adversarial defense. Specifically, the method includes the following steps:
[0051] Step S100, generate a first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structural parameters and / or network weight parameters of the to-be-trained model.
[0052] Among them, the to-be-trained model is a neural network model that needs to be trained for adversarial defense, and the specific model can be preset according to actual needs.
[0053] Specifically, before generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model, the method further includes:
[0054] According to a preset initial state network framework, obtain an initial model to be trained. In the network framework of the above-mentioned initial model to be trained, multiple alternative sub-network layers are set between each node, and structure parameters corresponding to the above-mentioned sub-network layers one by one.
[0055] It should be noted that the problem to be solved in the embodiments of the present application is that the existing point cloud deep learning models lack adversarial robustness in structural design and are difficult to effectively resist adversarial attacks, resulting in insufficient reliability and stability of the models. In the present application, a neural architecture search technology based on adversarial training (NAS, Neural Architecture Search) is introduced, which can dynamically optimize the network structure during the adversarial defense training process to make it more robust in adversarial scenarios. At the same time, combined with a hybrid adversarial training strategy to further improve the comprehensive performance of the model under adversarial attacks and normal inputs, and overcome the problem of insufficient adversarial robustness of the existing model structure.
[0056] The neural network model training method for adversarial defense provided by the embodiments of the present application can improve the robustness of the trained neural network model (such as a point cloud model) in adversarial scenarios. During the training process, it is mainly divided into two stages: robust structure search and network weight training. In the robust structure search, the initial state network framework consists of a super network, that is, there are multiple alternative sub-network layers and corresponding structure parameters between each node, and a suitable sub-network is selected after completing the robust structure search; in the network weight training, multiple attack methods are used to generate different adversarial samples, so that the model can obtain a more comprehensive defense performance in adversarial training.
[0057] It should be noted that in the embodiments of the present application, taking the neural network model used for point cloud processing as an example for specific illustration, that is, the trained neural network model is a point cloud processing model, but it is not specifically limited.
[0058] Specifically, for the point cloud adversarial problem, the target model f() is trained on the dataset where, is a point cloud containing N points, and Y i is the corresponding label. The adversarial sample X i ' generated by the adversarial attack aims to make f(X' i ) ≠ Y i , and the goal of the defense method is to minimize the impact of the adversarial sample on the model. The optimization goal is shown in the following formula (1):
[0059]
[0060] where θ is the model parameter, which is determined according to the training process of the model; L() is the loss function. The subscripts below represent data taken from the training set, which represents taking the expectation (or probability average) of this data. Different from traditional point cloud adversarial training, in this application, a differentiable architecture search mechanism is introduced into the network, enabling the model to dynamically optimize the architecture parameters and network weights during the training process. Correspondingly, the optimization objective is corrected as shown in the following formula (2):
[0061]
[0062] where A and W represent the architecture parameters and network weights respectively, and their specific values are determined according to the training process of the model. Their initial values can be preset during training.
[0063] Furthermore, generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model includes:
[0064] Generating the first adversarial sample corresponding to the to-be-trained model based on a preset first adversarial sample generation algorithm according to the information of the to-be-trained model.
[0065] Among them, the above first adversarial sample generation algorithm is set and adjusted according to actual needs. In the embodiments of this application, the projected gradient descent method (PGD, Projected Gradient Descent) is used as the first adversarial sample generation algorithm for generating the first adversarial sample used in the architecture search process. In actual use, other algorithms can also be set as the first adversarial sample generation algorithm, which is not specifically limited here.
[0066] In the embodiments of this application, the adversarial sample is generated based on one or more of the gradient information, architecture parameters, network weight parameters, and output feedback of the model, aiming to make the model produce incorrect predictions by making small perturbations to the input data. For example, when generating an adversarial sample based on the PGD algorithm, the gradient perturbation is iteratively applied and projected within the perturbation range.
[0067] It should be noted that the model architecture includes the number of layers, activation functions, connection methods, etc. The adversarial sample generation algorithm can design more effective attack methods using the architecture information of the model.
[0068] Step S200, performing adversarial training on the to-be-trained model according to the above first adversarial sample to obtain the architecture parameters and network weight parameters corresponding to the current architecture search round, and updating the to-be-trained model, where the above architecture parameters are used to update the sub-network layer structure of the to-be-trained model.
[0069] Specifically, performing adversarial training on the to-be-trained model according to the above first adversarial sample to obtain the architecture parameters and network weight parameters corresponding to the current architecture search round, and updating the to-be-trained model includes:
[0070] Based on the above first pair of adversarial samples and a preset structure search strategy, determine the optimal operation from all candidate operations among the nodes of the to-be-trained model above, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and update the to-be-trained model according to the structure parameters and network weight parameters corresponding to the current structure search round.
[0071] In the embodiment of the present application, in the robust model structure search stage, the network takes computing units as basic building blocks, and each computing unit includes two input nodes, one output node, and three intermediate nodes. Node x i and x j The operation between is defined by the architecture parameter α (i,j) , and the specific form is shown in the following formula (3):
[0072]
[0073] where O is the set of all operations in the search space, o(x i ) is a certain network layer in the search space, and o (i,j) (x i ) is the output obtained by aggregating the outputs of these network layers. The intermediate nodes aggregate the outputs of all predecessor nodes, and the output node aggregates the results of all intermediate nodes, as shown in the following formula (4):
[0074]
[0075] In the embodiment of the present application, in the structure search stage, a PGD-based adversarial sample generation module is adopted to convert the input point cloud into adversarial samples and perform adversarial training. In each update, both the structure parameters and the network weights are optimized to search for a robust network architecture. The core steps of architecture search include: initializing the network, and the operations between nodes include all possible operations in the search space. Use the adversarial training strategy to optimize the structure parameter A and the network weight W. The greedy strategy is adopted in the decision-making stage to gradually select the optimal operation between nodes until only one operation is retained for all candidate edges. After the search for the robust architecture (i.e., the robust model structure) is completed, the network weights are discarded, and the robust network structure is retained for the next stage.
[0076] Step S300, return to execute the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model above until a preset structure search termination condition is met, and obtain a candidate model with the structure search completed.
[0077] In the embodiments of the present application, in the structure search stage, iterative training is performed until a preset structure search termination condition is met. The above-mentioned preset structure search termination condition can be preset and adjusted according to actual needs. For example, it can be set that the number of iterations reaches a preset iteration threshold, or the loss of the trained model reaches a preset loss threshold, which is not specifically limited herein.
[0078] Step S400: Fix the structural parameters of the above candidate model, train the above candidate model to obtain target network weight parameters, and obtain the trained target neural network model according to the above target network weight parameters and the fixed above structural parameters.
[0079] Specifically, the above-mentioned fixing the structural parameters of the above candidate model and training the above candidate model to obtain target network weight parameters includes:
[0080] Generating a second adversarial sample corresponding to the to-be-trained model according to the information of the above candidate model;
[0081] Fixing the structural parameters of the above candidate model, and performing adversarial training on the above candidate model according to the above second adversarial sample to obtain target network weight parameters.
[0082] Among them, the above-mentioned generating a second adversarial sample corresponding to the to-be-trained model according to the information of the above candidate model includes:
[0083] Generating a second adversarial sample corresponding to the to-be-trained model based on a preset variety of second adversarial sample generation algorithms according to the information of the to-be-trained model.
[0084] It should be noted that the second adversarial sample is generated according to a variety of second adversarial sample generation algorithms, and the network weight parameters are trained based on a variety of second adversarial samples. The above first adversarial sample generation algorithm may include a first adversarial sample generation algorithm, or may use a completely different variety of other algorithms, which is not specifically limited herein. In the embodiments of the present application, the above second adversarial sample generation algorithms include the projected gradient descent method, additive attack (ADD), and dropout attack (Drop).
[0085] Specifically, in the network weight training stage, the robust network structure generated in the first stage is fixed, and only the network weight W is optimized. The training adopts a mixed adversarial training strategy, that is, combining a variety of adversarial attack methods (such as PGD, Add, and Drop attacks) to generate adversarial samples, and at the same time using clean samples and adversarial samples for training. The optimization objective is shown in the following formula (5):
[0086]
[0087] After the network weight training stage, the final network weight parameters are obtained as the target weight parameters. Based on the target network weight parameters and the fixed structure parameters determined in the structure search stage, the trained target neural network model is obtained. After the network weight training stage, the finally obtained network model has a robust architecture and robust network weights, significantly enhancing the robustness of the point cloud model in adversarial scenarios.
[0088] As can be seen from the above, in the solution of the present application, the first adversarial sample corresponding to the to-be-trained model is generated according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structure parameters and / or network weight parameters of the to-be-trained model; the to-be-trained model is adversarially trained according to the first adversarial sample to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and the to-be-trained model is updated, where the structure parameters are used to update the sub-network layer structure of the to-be-trained model; return to execute the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model until a preset structure search termination condition is met, and a candidate model with completed structure search is obtained; fix the structure parameters of the candidate model, train the candidate model to obtain the target network weight parameters, and based on the target network weight parameters and the fixed structure parameters, obtain the trained target neural network model.
[0089] Compared with the prior art, in the solution corresponding to the method for training a neural network model for adversarial defense provided by the present application, in the adversarial defense during the training of the neural network model, it does not focus on the defense means at the data level, but on the defense means at the model structure level. There is no need to preprocess the training data, avoiding problems such as introduced errors or information loss during the data preprocessing process. At the same time, focusing on the defense means at the model structure level, the most robust network structure is selected through model structure search during the training process, which is beneficial to improving the model training effect and the robustness of the model. Furthermore, it is beneficial to improve the defense ability of the trained model against adversarial attacks.
[0090] In the embodiments of the present application, a specific application scenario is also used to specifically describe the above method for training a neural network model for adversarial defense. Figure 2 It is a schematic flowchart of a specific process of a method for training a neural network model for adversarial defense provided by an embodiment of the present application. Figure 3 It is a schematic diagram of two training stages of a method for training a neural network model for adversarial defense provided by an embodiment of the present application. As Figure 2 and Figure 3As shown in the figure, the neural network model training method for adversarial defense in the embodiments of the present application includes two stages of model framework training, namely, the robust architecture search stage and the network weight training stage. In the embodiments of the present application, a point cloud defense framework (RobNAS) combining neural architecture search (NAS) and adversarial training is proposed. By introducing PGD-based adversarial training in the architecture search stage of NAS, the robustness of the network architecture is directly optimized, avoiding the limitation of randomly selecting sub-networks. Specifically, in the architecture search stage of point cloud adversarial defense, the framework introduces adversarial samples into the training process, and by adjusting the optimization objective of the network, the most robust network architecture is selected. Subsequently, in the weight training stage, the model is mixed-trained with adversarial samples generated by various attack methods, so as to enhance the adaptability of the model parameters to different attack strategies. The present application optimizes the adversarial robustness of the point cloud model from the perspective of network structure, achieving a significant improvement in the adversarial defense performance in the point cloud classification task, effectively alleviating problems such as insufficient robustness, information loss, and limited defense effect in existing methods, and achieving a leading defense performance in the black box adversarial scenario. It should be noted that Figure 2 the robust architecture search and Figure 3 the robust architecture search stage in this application both represent the architecture search stage in this application, which is used to search for the robust neural network model architecture.
[0091] Specifically, in the related art, the defense methods of point cloud models mainly include traditional adversarial training methods and preprocessing techniques. The adversarial training method enables the model to obtain the adaptability to adversarial samples during the training process by inputting point cloud adversarial samples as training data, while the preprocessing technique inserts a preprocessing layer before the input layer of the model, so that the adversarial samples are harmless to the model after being processed. Although these methods improve the adversarial defense ability from different perspectives, they often ignore the dynamic optimization of the network structure itself.
[0092] To solve the above problems, the present application proposes a model training method based on neural network architecture search and adversarial training for point cloud classification tasks. Different from the fixed network structure in the traditional adversarial training process, the present application introduces neural network architecture search technology, enabling the network structure to be optimized together with the network weights during the adversarial training process, thus effectively improving the robustness of the model. In addition, this robust feature is only related to the network structure and has nothing to do with the network weights. Even when using pure point cloud samples for training in the network weight training stage, good defense performance can be maintained. The robust architecture search method proposed in the present application enables the network structure to be flexibly adjusted during the training process, searching for a structure with better robustness under adversarial attacks. This way of dynamically optimizing the structure can be fine-tuned according to the required tasks and modify the type of adversarial samples, thereby improving the overall model performance.
[0093] It should be noted that in the embodiments of the present application, the network weight training strategy and its optimization objective used, as well as the base model of the entire framework, can be adjusted according to actual needs, and no specific limitations are set here.
[0094] Figure 4 It is a schematic diagram of the accuracy comparison of the model provided by the embodiments of the present application for the point cloud classification task under adversarial attacks. Specifically, Figure 4 shows the trained target neural network model provided by the present application (i.e., Figure 4 the model processed based on the RobNAS method in Figure 4 and the accuracy of the point cloud classification task of the models based on the point cloud defense technologies Hybrid Training and IF-Defense in the prior art under different adversarial attacks. According to
[0095] As Figure 5 shown in
[0096] A first adversarial sample generation module 510, configured to generate a first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model, where the information of the to-be-trained model includes the structural parameters and / or network weight parameters of the to-be-trained model;
[0097] A structure search module 520, configured to perform adversarial training on the to-be-trained model according to the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and update the to-be-trained model, where the structural parameters are used to update the sub-network layer structure of the to-be-trained model;
[0098] A search control module 530, configured to return to execute the step of generating the first adversarial sample corresponding to the to-be-trained model according to the information of the to-be-trained model until a preset structure search termination condition is satisfied, and obtain a candidate model with the structure search completed;
[0099] A network weight training module 540, configured to fix the structural parameters of the candidate model, train the candidate model to obtain target network weight parameters, and obtain a trained target neural network model according to the target network weight parameters and the fixed structural parameters.
[0100] Thus, in the adversarial defense during the training of a neural network model, attention is not focused on the defense means at the data level, but on the defense means at the model structure level. There is no need to preprocess the training data, avoiding problems such as the introduction of errors or information loss during the data preprocessing process. At the same time, by focusing on the defense means at the model structure level and screening out the most robust network structure through model structure search during the training process, it is beneficial to improve the model training effect and the robustness of the model. Furthermore, it is beneficial to improve the defense ability of the trained model against adversarial attacks.
[0101] It should be noted that the specific structures and implementation manners of the above neural network model training system for adversarial defense and its various modules or units can refer to the corresponding descriptions in the above method embodiments, and will not be elaborated herein.
[0102] It should be noted that the division method of the various modules of the above neural network model training system for adversarial defense is not unique, and will not be specifically limited herein either.
[0103] Based on the above embodiments, the present application also provides an intelligent terminal, and its principle block diagram can be as Figure 6 shown. The above intelligent terminal includes a processor, a memory, a network interface, and a display screen connected through a system bus. Among them, the processor of the intelligent terminal is used to provide computing and control capabilities. The memory of the intelligent terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the intelligent terminal is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, it implements the steps of any of the above methods for training a neural network model for adversarial defense. The display screen of the intelligent terminal can be a liquid crystal display screen or an electronic ink display screen.
[0104] Those skilled in the art can understand that Figure 6 the principle block diagram shown in
[0105] merely shows the block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the intelligent terminal to which the solution of the present application is applied. The specific intelligent terminal may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.
[0106] The embodiments of the present application further provide a computer-readable storage medium. A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of any one of the neural network model training methods for adversarial defense provided by the embodiments of the present application are implemented.
[0107] It should be understood that the sequence numbers of the steps in the above embodiments do not mean the order of execution. The execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
[0108] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the above division of each functional unit and module is used as an example. In actual applications, the above functions can be allocated to different functional units and modules according to needs, that is, the internal structure of the above device is divided into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiments can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit. In addition, the specific names of each functional unit and module are only for the convenience of mutual distinction and do not limit the protection scope of the present application. The specific working process of the units and modules in the above device can refer to the corresponding process in the foregoing method embodiments and will not be elaborated herein.
[0109] In the above embodiments, the descriptions of the various embodiments have their own emphases. For the parts not detailed or recorded in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0110] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed in this article can be implemented by electronic hardware, or by a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Skilled professionals can use different methods for each specific application to implement the described functions, but such implementation should not be considered to exceed the scope of the present application.
[0111] In the embodiments provided in the present application, it should be understood that the disclosed system / terminal device and method can be implemented in other ways. For example, the system / terminal device embodiments described above are only illustrative. For example, the above division of modules or units is only a logical function division. In actual implementation, there can be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0112] When the above integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, to implement all or part of the processes in the above method embodiments of this application, it can also be completed by a computer program instructing relevant hardware. The above computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above method embodiments can be implemented. Among them, the above computer program includes computer program code, and the above computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The above computer-readable medium can include: any entity or device capable of carrying the above computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disc, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electrical carrier signal, and software distribution medium, etc. It should be noted that the content included in the above computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.
[0113] The above embodiments are only used to illustrate the technical solutions of this application, rather than limiting them; although this application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not deviate from the spirit and scope of the technical solutions of the various embodiments of this application, and should all be included in the protection scope of this application.
Claims
1. A method for training a neural network model for adversarial defense, characterized in that, The method includes: generating a first adversarial sample corresponding to the model to be trained according to information of the model to be trained, where the information of the model to be trained includes structural parameters and / or network weight parameters of the model to be trained; performing adversarial training on the model to be trained according to the first adversarial sample to obtain structural parameters and network weight parameters corresponding to the current structure search round, and updating the model to be trained, where the structural parameters are used to update the sub-network layer structure of the model to be trained; returning to execute the step of generating the first adversarial sample corresponding to the model to be trained according to the information of the model to be trained until a preset structure search termination condition is satisfied, and obtaining a candidate model with completed structure search; fixing the structural parameters of the candidate model, training the candidate model to obtain target network weight parameters, and obtaining a target neural network model after training according to the target network weight parameters and the fixed structural parameters.
2. The method for training a neural network model for countermeasure defense according to claim 1, wherein, Before generating the first adversarial sample corresponding to the model to be trained according to the information of the model to be trained, the method further includes: obtaining an initial model to be trained according to a preset initial state network framework, where in the network framework of the initial model to be trained, multiple alternative sub-network layers are arranged between each node and structural parameters corresponding to the sub-network layers one by one.
3. The method for training a neural network model for countermeasure defense according to claim 1, wherein The generating the first adversarial sample corresponding to the model to be trained according to the information of the model to be trained includes: generating a first adversarial sample corresponding to the model to be trained based on a preset first adversarial sample generation algorithm according to the information of the model to be trained.
4. The method for training a neural network model for adversarial defense according to claim 1, wherein The performing adversarial training on the model to be trained according to the first adversarial sample to obtain structural parameters and network weight parameters corresponding to the current structure search round, and updating the model to be trained includes: determining an optimal operation from all candidate operations between nodes of the model to be trained according to the first adversarial sample and a preset structure search strategy to obtain structural parameters and network weight parameters corresponding to the current structure search round, and updating the model to be trained according to the structural parameters and network weight parameters corresponding to the current structure search round.
5. The method for training a neural network model for countermeasure defense according to any one of claims 1 to 4, characterized in that, The fixing the structural parameters of the candidate model and training the candidate model to obtain target network weight parameters includes: generating a second adversarial sample corresponding to the model to be trained according to the information of the candidate model; fixing the structural parameters of the candidate model and performing adversarial training on the candidate model according to the second adversarial sample to obtain target network weight parameters.
6. The method for training a neural network model for countermeasure defense according to claim 5, wherein The generating the second adversarial sample corresponding to the model to be trained according to the information of the candidate model includes: generating a second adversarial sample corresponding to the model to be trained based on a preset plurality of second adversarial sample generation algorithms according to the information of the model to be trained.
7. The method for training a neural network model for countermeasure defense according to claim 6, wherein, The second adversarial sample generation algorithms include the projected gradient descent method, the add attack, and the drop attack.
8. A neural network model training system for adversarial defense, characterized in that, The system includes: The first adversarial sample generation module is configured to generate a first adversarial sample corresponding to the model to be trained according to the information of the model to be trained, where the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained; The structure search module is configured to perform adversarial training on the model to be trained according to the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and update the model to be trained, where the structural parameters are used to update the sub-network layer structure of the model to be trained; The search control module is configured to return to execute the step of generating the first adversarial sample corresponding to the model to be trained according to the information of the model to be trained until a preset structure search termination condition is satisfied, and obtain a candidate model with the structure search completed; The network weight training module is configured to fix the structural parameters of the candidate model, train the candidate model to obtain target network weight parameters, and obtain the trained target neural network model according to the target network weight parameters and the fixed structural parameters.
9. An intelligent terminal, characterized in that, The intelligent terminal includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is executed by the processor, the steps of the neural network model training method for adversarial defense according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium. When the computer program is executed by a processor, the steps of the neural network model training method for adversarial defense according to any one of claims 1 to 7 are implemented.