Adversarial sample generation method and system for enhancing model robust generalization performance

Abstract

The invention belongs to the technical field of adversarial samples, and discloses an adversarial sample generation method and system for enhancing model robust generalization performance, and the method comprises the steps: classifying input samples, and dividing the input samples into robust samples and easy-to-attack (or fragile) samples according to the closeness of the input samples and a decision boundary; applying a standard adversarial training program for robust samples; for fragile samples, adversarial training by using a diffusion model is adopted. According to the novel adversarial sample generation method, namely DPGD, a purification module is added, constraints in adversarial samples are generated, the adversarial sample is used for limiting the influence of too strong adversarial samples on model training, and the adversarial sample is used for ensuring necessary attack intensity. The DPGD is combined with a traditional adversarial training framework, and a DifAT method is obtained. The DifAT keeps and even improves the effectiveness of the generalization performance of the DNNs while improving the robustness of the DNNs.

Description

Technical Field

[0001] The present invention belongs to but is not limited to the field of adversarial sample technology, and in particular relates to a method and system for generating adversarial samples that enhance the robust generalization performance of a model. Background Art

[0002] With the continuous advancement of technology, Deep Neural Networks (DNNs) are increasingly penetrating into various fields of human activities with their excellent prediction accuracy, including speech recognition, image classification, and disease detection. However, recent studies have shown that DNNs are vulnerable to adversarial examples, which are characterized by adding imperceptible perturbations to clean samples, resulting in misclassification.

[0003] In order to defend against the attacks of adversarial samples, researchers have proposed a large number of defense methods, including defense distillation, image purification, adversarial training, network pruning, etc. Although many defense methods have been proposed to enhance model robustness, adversarial training (AT) remains one of the most effective methods to date. AT improves the robustness of the model to a certain extent by using adversarial samples as part of the training data. Although training with adversarial samples can enhance the robustness of the model, researchers observed during the research process that this comes at the expense of reducing the accuracy on clean data. Therefore, when DNNs are trained using these adversarial samples as their datasets, the resulting learned data distribution will inherently deviate from the true distribution and align with the adversarial distribution. This phenomenon is called "overfitting of DNNs in adversarial training."

[0004] To address this issue, data augmentation is a common method for improving model generalization. This involves augmenting the training dataset with geometric transformations such as rotation, cropping, and flipping, which has been shown to be effective on datasets such as CIFAR-10, CIFAR-100, and ImageNet. However, effective data augmentation in standard training does not apply to AT. Fortunately, Rebuffi et al. discovered that data augmentation using generative models can be a method to mitigate overfitting in adversarial training models. Wang et al. further improved the robustness of the model by enriching the data with a diffusion model.

[0005] Data augmentation is widely used to alleviate overfitting to some extent. However, its effectiveness is not always satisfactory due to the significant computational overhead and potential issues with the quality of the generated data. These challenges pose new obstacles to the application of data enrichment methods. Is there really no good solution to the generalization problem in AT? We believe that the fundamental problem of AT lies in the adversarial examples used during training. As adversarial examples gradually deviate from the original examples, the model naturally learns the distribution after the "distortion" caused by the adversarial examples.

[0006] To address the distorted distribution caused by adversarial examples, Zhang et al. argued that the strongest attack is not necessarily the best. They sought adversarial examples that could mislead the classifier while minimizing loss and proposed Friendly Adversarial Training (FAT). FAT significantly improved the model's classification accuracy for clean examples, but was less effective against stronger adversarial attacks. Zhu et al. used data fine-tuning to generalize the dataset to ImageNet, improving generalization both within and outside the distribution, but still failing to improve the model's defense capabilities.

[0007] While FAT may not currently be the most sophisticated defense method, it is undeniably a significant source of inspiration. Traditional AT employs a uniform strategy to generate adversarial examples, applying the same sample generation strategy to all samples. Initially, this approach seems intuitive and has demonstrated some effectiveness; however, it is crucial to acknowledge its limitations: it primarily captures common features across data while ignoring their unique characteristics. For example, consider two training examples, one close to the decision boundary and the other far away. When we use the same projected gradient descent (PGD) algorithm to generate adversarial examples, the one near the boundary is more likely to cross the decision boundary than the other. Furthermore, there may be a large number of examples similar to these in the entire training dataset. If adversarial examples are not generated according to their distributional characteristics, the decision boundary learned by the model will inevitably be severely distorted compared to standard training. As the strength of these perturbations increases, the adversarial examples deviate further and further from their original form. This increasing divergence not only alters visual perception but also changes the data distribution learned by the model. When a sample lies near the decision boundary, even small perturbations can push it beyond this boundary, resulting in increased classification error. Therefore, it is necessary to perform pruning on individual examples.

[0008] In view of the above analysis, the technical problems that need to be solved urgently in the existing technology are:

[0009] The main trade-off faced by traditional AT methods is that they only focus on the collective characteristics of samples and ignore the unique properties of individual samples. Summary of the Invention

[0010] In response to the problems existing in the prior art, the present invention provides a method and system for generating adversarial samples to enhance the robust generalization performance of the model.

[0011] The present invention is implemented as follows: a method for generating adversarial samples to enhance the robust generalization performance of a model, characterized in that the algorithm for generating adversarial samples to enhance the robust generalization performance of a model specifically includes:

[0012] S1: Classify input samples into robust and easily attacked (or vulnerable) samples based on their proximity to the decision boundary;

[0013] S2: For robust samples, apply the standard adversarial training procedure;

[0014] S3: For fragile samples, adversarial training using a diffusion model is used.

[0015] Furthermore, the S1 is classified according to the following constraints:

[0016]

[0017] in is the neighborhood with x0 as the center and ε as the radius, is the vulnerability indicator of the model at x, c is a constant greater than or equal to 0, and D(x,y) is the true distribution of the dataset. Samples that do not meet this constraint are considered robust samples, and samples that meet this constraint are considered vulnerable (or vulnerable) samples.

[0018] Furthermore, S3 introduces a denoising projected gradient descent algorithm. In each iteration, if the generated adversarial sample satisfies the constraints, it is diffused and denoised. The noise caused by diffusion is first used to enhance the subject; then, in the reverse diffusion denoising stage, the diffusion-enhanced version of the clean sample is used as a guiding reference.

[0019]

[0020] Among them Clip B(x,∈) (·) is the projection function, De(·) represents the denoising process based on the diffusion model, α is the attack step size, L is the loss function, and f c For classification models.

[0021] Furthermore, in S3, the diffusion step length S=1.

[0022] Furthermore, S3 uses Diffusion Adversarial Training (DifAT), and according to the framework used in adversarial training, DifAT is defined as:

[0023]

[0024] where x adv is the adversarial sample generated by the DPGD algorithm, and Lc is the cross entropy loss.

[0025] Another object of the present invention is to provide an adversarial sample generation system for enhancing the robust generalization performance of a model, the system specifically comprising:

[0026] Input classification module, which is used to classify input samples into robust samples and fragile samples based on their proximity to the classification decision boundary;

[0027] Robust sample training module, which performs standard adversarial training on robust samples;

[0028] The fragile sample training module is used to perform adversarial training based on the diffusion model on fragile samples and introduce a denoising projected gradient descent algorithm to generate adversarial samples;

[0029] The model update module is used to update the classification model parameters in real time according to the training results to improve its robustness and generalization performance.

[0030] Furthermore, the input classification module classifies samples according to the following conditions:

[0031] When there exists x that satisfies the classification function and outputs consistent results within the neighborhood U_ε(x0), it is considered a robust sample; otherwise, it is considered a fragile sample.

[0032] Furthermore, the fragile sample training module is equipped with a noise reduction diffusion processing unit with a diffusion step size S=1.

[0033] It is used to perform noise enhancement and reverse denoising on the generated adversarial samples in each iteration, and combine diffusion guidance and projection operations to generate optimized adversarial samples.

[0034] Furthermore, the model update module uses the Diffusion Adversarial Training (DifAT) framework,

[0035] The classification model is jointly optimized based on the cross-entropy loss of adversarial samples and original samples to improve its robustness and decision stability under different disturbances.

[0036] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0037] First, conventional adversarial training methods typically treat all samples uniformly, failing to fully distinguish between differences in sample vulnerability near the decision boundary. This leads to a decrease in robustness and overfitting when facing complex distributional perturbations. Furthermore, existing diffusion models used in adversarial training primarily focus on data augmentation, lacking mechanisms to precisely target vulnerable samples. This makes it difficult to balance model performance and security in practical deployments.

[0038] This paper proposes a robustness enhancement method that combines sample classification with diffusion adversarial training. This method, for the first time, introduces a dynamic partitioning mechanism for the relationship between samples and decision boundaries, employing differentiated training strategies for robust and vulnerable samples. For vulnerable samples, a denoising diffusion model is combined to guide the generation of more subtle and effective adversarial examples, fully stimulating the model's defensive potential. This allows the overall training framework to dynamically adapt to sample vulnerability characteristics and systematically improve the model's robustness.

[0039] By applying the technical solution of the present invention, in industrial practice, such as in high-security fields such as autonomous driving image recognition, financial transaction anomaly detection, and medical image-assisted diagnosis, the generalization performance and anti-attack capability of the model in complex disturbance environments can be significantly improved, the system failure rate can be reduced, and the prediction stability can be improved, effectively supporting the strict requirements for the reliability and security of AI models in high-risk application scenarios.

[0040] The present invention not only introduces a targeted enhancement strategy based on the diffusion model in the adversarial training process, but also realizes a sample-level adaptive defense mechanism, breaking through the bottleneck of local robustness insufficient caused by unified adversarial training in the existing technology, and significantly improving the model's anti-interference ability to different types of disturbances. It has outstanding substantive characteristics and significant technological progress.

[0041] This paper proposes a new adversarial attack algorithm, DPGD. Compared to traditional PGD attacks, DPGD generates adversarial examples that are highly similar to the original examples. The adversarial examples generated by DPGD are then applied to an adversarial training algorithm, called DifAT. Compared to traditional adversarial training, DifAT demonstrates higher classification accuracy on the original examples while maintaining robustness. Furthermore, DifAT demonstrates superior resistance to adversarial attacks in a black-box environment.

[0042] Second, for adversarial training, the trade-off between the robustness and generalization of the model has always been a focus of discussion among researchers. The model with standard training has the best generalization performance, but has almost no ability to resist adversarial attacks (i.e., robustness); the model that has undergone adversarial training has a certain degree of robustness, but the generalization performance has decreased. And as the intensity of the adversarial attack in adversarial training increases, this difference becomes more and more obvious. In the present invention, we did not pursue the strongest adversarial attack intensity, but tried to find the "most suitable" intensity (between the weakest and the strongest). From the experimental results, even without using the strongest adversarial attack, we still achieved the same robustness. In addition, the generalization performance of the model has been improved, not only the predictive ability on clean samples has been improved, but the overall performance in the black box environment has also been significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1This is a flow chart of a method for generating adversarial samples to enhance the robust generalization performance of a model, provided by an embodiment of the present invention;

[0044] Figure 2 Schematic diagram of the DifAT pipeline provided by an embodiment of the present invention;

[0045] Figure 3 The distribution of DPGD-10 adversarial samples (red) and PGD-10 adversarial samples (blue) for the CIFAR-10 (top) and CIFAR-100 (bottom) datasets provided by embodiments of the present invention is shown in Figure 1. The x-axis shows the distance between the adversarial sample and the original sample, and the y-axis shows the distribution of the number of adversarial samples.

[0046] Figure 4 This is a module diagram of an adversarial sample generation system for enhancing the robust generalization performance of a model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0048] like Figure 1 As shown, an embodiment of the present invention provides an adversarial sample generation method for enhancing the robust generalization performance of a model. The algorithm specifically includes:

[0049] S1: Classify input samples into robust and easily attacked (or vulnerable) samples based on their proximity to the decision boundary;

[0050] S2: For robust samples, apply the standard adversarial training procedure;

[0051] S3: For fragile samples, adversarial training using a diffusion model is used.

[0052] The S1 is classified according to the following constraints:

[0053]

[0054] in is the neighborhood with x0 as the center and ε as the radius, is the model's vulnerability indicator at x, and c is a constant greater than or equal to 0. This constraint specifies a lower bound on the attack strength of generated adversarial examples. Examples that do not satisfy this constraint are considered robust examples, indicating that they are far from the decision boundary in terms of the data distribution. Therefore, these adversarial examples remain in the region where the model is confident in their classification, and applying small perturbations has little effect on the classification results of the target model. Examples that satisfy this constraint are considered vulnerable (or vulnerable) examples. These examples can induce misclassification, thus significantly affecting the classification results of the target model and worthy of our attention.

[0055] This constraint is well-founded. The goal of generating adversarial examples is to induce misclassification by the target model. This constraint ensures the effectiveness of the attack by ensuring that the class with the highest confidence prediction is outside the true class (in the context of untargeted attacks).

[0056] In S2, due to its weak and inconsistent attack effectiveness, only the traditional PGD attack is applied to robust adversarial samples.

[0057] S3 introduces the Denoising Projection Gradient Descent (DPGD) algorithm. Building on the PGD algorithm, it adds an additional denoising module after each attack iteration. This denoising module employs a diffusion model. When diffusion reaches a critical threshold, its distribution becomes consistent with that of clean samples that have undergone the same degree of diffusion, enabling the diffusion model to purify adversarial examples. In each iteration, if the generated adversarial example satisfies the constraints, it is diffused and denoised. The subject is first augmented with the diffusion-induced noise; subsequently, in the reverse diffusion denoising phase, the diffusion-enhanced version of the clean example is used as a guide.

[0058]

[0059] Among them Clip B(x,∈) (·) is the projection function, De(·) represents the denoising process based on the diffusion model, α is the attack step size, L is the loss function, and f c For classification models, this not only limits adversarial samples but also leaves room for enhancing adversarial samples.

[0060] The diffusion step length S=1.

[0061] The S3,uses Diffusion Adversarial Training (DifAT), as Figure 2As shown in Figure 2, for samples that meet the requirements, they are fed into the diffusion model for a back-diffusion process, using the diffused version of the clean sample as guidance. This process is then fed into the attacker module to generate an adversarial sample. The ultimate goal is to encourage the denoised sample to converge towards the clean example, thereby reducing the strength of the attack and enhancing its generalization ability. Based on the framework used in adversarial training, we define DifAT as:

[0062]

[0063] where x adv The adversarial sample generated by the DPGD algorithm, L c is the cross entropy loss. It is worth noting that we continue the traditional adversarial training framework to pursue the robustness of external minimization. At the same time, for internal maximization, we abandon the maximized features and instead look for the relatively weak DPGD adversarial examples we proposed to improve the generalization of the model. To clarify the difference between PGD and DPGD algorithms, Figure 3 Figure 1 shows the distribution of adversarial examples generated using the PGD and DPGD attack algorithms for the CIFAR-10 and CIFAR-100 datasets. The horizontal axis represents the distance between the generated adversarial examples and their corresponding original examples, and the vertical axis represents the count of adversarial examples. Notably, the average distance of adversarial examples generated by PGD exceeds that of DPGD. Essentially, PGD introduces greater perturbations to adversarial examples, resulting in increased image distortion. Therefore, in the context of AT, while DNNs may appear robust to PGD-generated adversarial examples during training, after multiple iterations, adversarial examples deviate significantly from the original examples. This shift in the data distribution learned by the DNN leads to a decrease in its accuracy on the clean test set, as shown in Table 1. The pseudocode for DPGD is shown in Algorithm 1.

[0064]

[0065] It's worth noting that in Algorithm 1, to further constrain the attack strength of generated adversarial examples, we set an additional control coefficient, con. Whenever the constraint holds, the control coefficient increases by 1. Subsequent DPGD operations are performed only when con is greater than or equal to the control factor, τ. This sets a higher standard for the attack strength of adversarial examples, preventing the generation of adversarial examples that are too weak to successfully attack, which would otherwise reduce adversarial robustness.

[0066] Table 1 Classification accuracy of different models and the distance between adversarial samples and clean samples.

[0067]

[0068] like Figure 4As shown, an embodiment of the present invention provides an adversarial sample generation system for enhancing the robust generalization performance of a model, specifically comprising:

[0069] A search module is used to identify adversarial examples that satisfy the imposed constraints.

[0070] The denoising module is used to purify the current adversarial samples to a certain extent and reduce the attack intensity;

[0071] Attacker module, used to generate adversarial samples.

[0072] The present invention belongs to the field of image classification in computer vision. As a basic task of computer vision, image classification aims to identify and mark the main objects or contents in an image, aiming to determine to which category or type the image belongs.

[0073] In practical applications, image classification technology is widely used in scenarios such as face recognition, product recognition, medical image analysis, and object detection in autonomous driving.

[0074] Extensive experimental evaluation of the practical performance of DifAT is conducted on three datasets (CIFAR-10, CIFAR-100, and Tiny-Imagenet). The results show that the proposed method achieves state-of-the-art results in most test environments. (I) Experimental Setup

[0075] ResNet18 and ResNet50 are used as the classification models used in the experiment. For the diffusion model used in the method proposed in this invention, we follow the structure proposed by Ho et al. for training. Six different training methods are used for comparative testing. The first method, AT, uses PGD adversarial attack with a step size of 10 for adversarial training. The second method, TRADES, aims to strike a balance between model robustness and accuracy by attributing robustness errors to natural errors and boundary errors. The third method, FAT, is called friendly adversarial training. Under the premise of model classification error, the adversarial examples with the smallest loss are selected for training. The fourth method, CAT, cooperative adversarial training, uses different adversarial training methods to train robust models and promotes knowledge interaction between models during the training process. The fifth method is the DifAT method proposed in this invention. In addition, we also introduced DifAT for TRADES, which is an improved version of TRADES that contains the DifAT attack setting. The experiment tested white-box attacks using four classic attack methods: FGSM, PGD, AutoAttack, and C&W. The interference radius was set to 8 / 255, and the step size for the PGD attack was set to 20 steps. For black-box attacks, we used five attack methods: FGSM, PGD-20, TI-FGSM, MI-FGSM, and DI-FGSM. Their parameters followed the data provided by Kim et al. Furthermore, we used the standard adversarially trained ResNet50 model as a surrogate model for the ResNet18 black-box attack, and vice versa.

[0076] The clean accuracy and robust accuracy of the model are used as evaluation criteria for evaluating model performance. Clean accuracy refers to the classification accuracy of the model on clean samples, while robust accuracy refers to the classification accuracy of the model on adversarial samples.

[0077] (2) White-box attack results

[0078] Performance evaluation based on ResNet18. For FGSM, PGD, AA, and C&W tests, the attack perturbations used are all set to 8 / 255. In addition, the attack step size of PGD and C&W is set to 2 / 255, and the iterations are 20 times. As shown in Table 2, the method of the present invention surpasses other baseline methods in terms of clean accuracy. Specifically, on the CIFAR-10 dataset, our method achieved a clean accuracy of 86.52%, which is 0.44% higher than the second-best method, significantly exceeding the performance of other techniques. In addition, DifAT shows a more obvious clean accuracy advantage on the CIFAR-100 and Tiny-ImageNet datasets. In terms of balancing robustness and accuracy, the TRADES method enhanced with DPGD achieved the best results.

[0079] Table 2. Adversarial accuracy (%) of adversarial training against white-box attacks. The target model is ResNet18.

[0080]

[0081] Table 3. Adversarial accuracy (%) of adversarial training against white-box attacks. The target model is ResNet50.

[0082]

[0083] Performance evaluation based on ResNet50. For the ResNet50 model, the experimental attack settings are consistent with those used for the ResNet18 model. As shown in Table 3, our method achieves a clean accuracy of 87.11% on the CIFAR-10 dataset, outperforming the second-best method by 0.86% and significantly outperforming all other techniques. In terms of robustness accuracy, the enhanced Trades method based on our proposed method consistently achieves the highest accuracy.

[0084] Table 4. Adversarial accuracy of defense methods against black-box attacks (%). The target model is ResNet18, and the proxy model is the adversarially trained ResNet50.

[0085]

[0086] (3) Black box attack results

[0087] In real-world scenarios, white-box environments are rare. Typically, attackers face black-box environments, where they cannot access some or all of the target model's parameters. In these cases, attackers often use proxy models to perform transfer attacks. Therefore, testing black-box attacks is more realistic.

[0088] Table 5. Adversarial accuracy of defense methods against black-box attacks (%). The target model is ResNet50, and the proxy model is adversarially trained ResNet18.

[0089]

[0090] In Tables 4 and 5, DifAT demonstrates superior overall performance against black-box attacks compared to white-box attacks, with its advanced generalization capabilities surpassing most defense models. Specifically, under the black-box PGD-20 attack condition, our method outperforms TRADES, FAT, and CAT by 4.18%, 0.11%, and 8.69%, respectively.

[0091] Example 1 (Computer Vision Scenario)

[0092] For the road traffic sign classification task, the GTSRB dataset, containing 43 types of signs, was used as the original training set, and the ResNet-34 was selected as the main classifier. According to step S1, the DeepFool algorithm was first used to calculate the minimum perturbation norm from each image to the current decision boundary. Samples with a perturbation norm greater than 0.15 (l2-norm, relative to the 0–1 normalized pixel scale) were labeled as robust; otherwise, they were labeled as fragile. For robust samples, step S2 was performed: adversarial examples were generated using a 20-step PGD and trained together with the original samples. For fragile samples, step S3 was performed: a diffusion model based on DDPM was invoked, and directed gradient noise was injected at the 850th step of the 1000-step forward diffusion. The adversarial sample was then reconstructed through back-denoising and then jointly updated with the original sample to update the ResNet-34 weights.

[0093] Example 2 (Natural Language Processing Scenario)

[0094] For the task of financial public opinion sentiment classification, a dataset of 50,000 annotated financial news headlines was constructed, and a 6-layer BERT-base was used as the main classifier. In step S1, the margin of each sentence to the decision boundary was estimated using a word-by-word gradient masking algorithm. The margin threshold was set to 0.35 to distinguish between robust and fragile sentences. For robust sentences, S2 was performed: adversarial examples were generated using character-level perturbations based on HOTFlip. For fragile sentences, S3 was performed: using the text diffusion model DiffuSeq, 30% of the tokens were randomly replaced at the noise time step t = 600 and directional gradients were injected. The remaining 400 steps of reverse diffusion were then performed to restore the generated adversarial sequence. This sequence was then fed synchronously with the original sentence into the BERT-base for parameter update.

[0095] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0096] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method for generating adversarial samples to enhance the robust generalization performance of a model, characterized by: The method specifically includes: S1: Classify input samples into robust and easily attacked (or vulnerable) samples based on their proximity to the decision boundary; S2: For robust samples, apply the standard adversarial training procedure; S3: For fragile samples, adversarial training using a diffusion model is used.

2. The adversarial sample generation method for enhancing the robust generalization performance of a model as claimed in claim 1, characterized in that: The S1 is classified according to the following constraints: in is the neighborhood with x0 as the center and ε as the radius, It is the vulnerability index of the model at x, c is a constant greater than or equal to 0, and the samples that do not meet the constraint are regarded as robust samples, and the samples that meet the constraint are regarded as easy to attack (or fragile) samples.

3. The adversarial sample generation method for enhancing the robust generalization performance of a model as claimed in claim 1, characterized in that: The S3 introduces a denoising projected gradient descent algorithm. In each iteration, if the generated adversarial sample meets the constraints, it is diffused and denoised. First, the noise caused by diffusion is used to enhance the subject. Subsequently, in the reverse diffusion denoising stage, the diffusion-enhanced version of the clean sample is used as a guiding reference; Among them Clip B(x,∈) (·) is the projection function, De(·) represents the denoising process based on the diffusion model, α is the attack step size, L is the loss function, and f c For classification models.

4. The adversarial sample generation method for enhancing the robust generalization performance of a model as claimed in claim 1, characterized in that: In S3, the diffusion step length S=1.

5. The adversarial sample generation method for enhancing the robust generalization performance of a model as claimed in claim 1, characterized in that: S3 uses Diffusion Adversarial Training (DifAT). Based on the framework used in adversarial training, DifAT is defined as: where x adv The adversarial sample generated by the DPGD algorithm, L c is the cross entropy loss.

6. A robustness-enhancing training system based on adversarial sample generation, characterized in that: include: Input classification module, which is used to classify input samples into robust samples and fragile samples based on their proximity to the classification decision boundary; Robust sample training module, which performs standard adversarial training on robust samples; The fragile sample training module is used to perform adversarial training based on the diffusion model on fragile samples and introduce a denoising projected gradient descent algorithm to generate adversarial samples; The model update module is used to update the classification model parameters in real time according to the training results to improve its robustness and generalization performance.

7. The system according to claim 6, characterized in that The input classification module classifies samples according to the following conditions: When there exists an x that satisfies the classification function and has consistent output in the neighborhood, it is considered a robust sample; otherwise, it is considered a fragile sample.

8. The system according to claim 6, characterized in that The fragile sample training module is equipped with a noise reduction diffusion processing unit with a diffusion step size S=1. It is used to perform noise enhancement and reverse denoising on the generated adversarial samples in each iteration, and combine diffusion guidance and projection operations to generate optimized adversarial samples.

9. The system according to claim 6, wherein: The model update module uses the Diffusion Adversarial Training (DifAT) framework, The classification model is jointly optimized based on the cross-entropy loss of adversarial samples and original samples to improve its robustness and decision stability under different disturbances.

Images