Task processing method and device based on parallel BN architecture deep neural network, and medium

Abstract

The invention relates to a task processing method and device based on a parallel BN architecture deep neural network and a medium, and the method comprises the steps: inputting an input sample of a target task into an improved deep neural network, and obtaining a task processing result; the improved deep neural network introduces a BN selector for identifying whether an input sample is a clean sample or an adversarial sample category, and gives a classification probability of the sample; and each batch normalization network layer in the improved deep neural network adopts a parallel BN architecture and consists of a plurality of BNs, and weighted average is performed on the output of the plurality of BNs by taking the classification probability of a sample as an adaptive coefficient to obtain a final feature normalization result. Compared with the prior art, the method has the advantages that collaborative optimization of model generalization and anti-interference capability is realized through the parallel BN architecture, the calculation complexity is effectively controlled by a BN module pruning mechanism, and a new technical path is provided for constructing a high-performance deep neural network.

Description

Technical Field

[0001] The present invention relates to the field of computer data processing technology, and in particular to a task processing method, device and medium based on a parallel BN architecture deep neural network. Background Art

[0002] Deep neural networks (DNNs) demonstrate remarkable performance in fields such as computer vision and natural language processing, but they are vulnerable to adversarial attacks. Attackers can add subtle perturbations, imperceptible to the human eye, to legitimate inputs, inducing model outputs to erroneous predictions, severely threatening the security and reliability of intelligent systems. Therefore, improving the robustness of DNNs, enabling them to maintain stable predictions despite adversarial attacks, has become a crucial research topic in safety-critical fields such as autonomous driving, financial risk management, and medical diagnostics.

[0003] Currently, adversarial training is the mainstream method for improving model robustness. Its core idea is to introduce adversarial examples as data enhancement during the training process, so that the model can learn to resist potential attacks. The adversarial training strategy proposed in the paper "Explaining and Harnessing Adversarial Examples" (SAT for short) significantly enhances the model's anti-interference ability. However, this method suffers from the problem of robustness-accuracy trade-off: although robustness is improved, the natural accuracy of the model on clean samples often decreases. Research shows that this phenomenon may be due to the difference in the distribution of adversarial samples and natural samples in the feature space, making it difficult for a single model to optimize both data distributions simultaneously. Summary of the Invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a task processing method, device and medium based on a parallel BN architecture deep neural network.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] As a first aspect of the present invention, a task processing method based on a parallel BN architecture deep neural network is provided, the method comprising the following steps:

[0007] Inputting the input sample of the target task into the improved deep neural network to obtain the task processing result; wherein the input sample includes image data, text encoding, voice data or sensor data; the target task type includes: classification task, regression task or prediction task;

[0008] The improved deep neural network introduces a BN selector to identify the category of input samples and give the classification probability of the samples; each batch normalization network layer in the improved deep neural network adopts a parallel BN architecture, consists of multiple BNs, and uses the classification probability of the samples as an adaptive coefficient to perform weighted averaging on the outputs of multiple BNs to obtain the final feature normalization result.

[0009] As a preferred technical solution, the parallel BN architecture includes a master BN and one or more slave BNs.

[0010] As an optimal technical solution, the improved deep neural network uses a variety of adversarial samples generated by different attack algorithms during the training phase, and the multiple auxiliary BNs are matched with various types of adversarial samples generated by the adversarial attack algorithms.

[0011] As a preferred technical solution, the improved deep neural network adopts a unique BN training strategy during the training phase:

[0012] The BN selector classifies the input samples into adversarial sample types and outputs the probability of each sample category;

[0013] Select the BN path corresponding to the category with the highest probability to normalize the input sample data and change the gradient calculation path.

[0014] As a preferred technical solution, the network loss function L of the improved deep neural network is designed as follows:

[0015] L=c[L s (θ,x clean ,1)+L s (θ,x adv ,0)]+[L r (θ,x clean ,y)+L r (θ,x adv ,y)]

[0016] Where, L s Represents the loss function of the BN selector, L r represents the loss function of the original network, θ represents the network parameters, y represents the label of the clean sample, and x clean represents a clean sample, x adv represents the adversarial sample, and the hyperparameter c represents the weight of the BN selector loss function.

[0017] As a preferred technical solution, the improved deep neural network adopts an adaptive BN strategy in the inference stage:

[0018] For each input sample, the BN selector output gives the multi-classification probability of the sample;

[0019] The multi-classification probability is used to perform weighted averaging on the outputs of multiple BNs in the same parallel BN module to obtain the final feature normalization result of the parallel BN module.

[0020] As a preferred technical solution, the improved deep neural network uses BN pruning to accelerate the training and inference time of the model, as follows:

[0021] Calculate the parameter differences between multiple BNs within the parallel BN module in each network layer. The parameter differences between multiple BNs in the same network layer are expressed as follows:

[0022]

[0023] Where l is the number of network layers, i≠j represents the number of different BNs in the same network layer; k represents the type of BN parameters;

[0024] When df(x l,i,j,k ) is less than or equal to the set parameter difference threshold, the BN layer l i and BN j Merge into one BN;

[0025] Repeat the above process until all network layers are traversed and the pruning and merging of multiple BNs are completed.

[0026] As a preferred technical solution, the parameters used to calculate the differences between multiple BNs include: distribution statistical parameters, learnable weights, and offsets; wherein the distribution statistical parameters include sliding mean and sliding variance.

[0027] As a second aspect of the present invention, a task processing device based on a parallel BN architecture deep neural network is provided, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the task processing method based on a parallel BN architecture deep neural network as described above when executing the program.

[0028] As a third aspect of the present invention, a storage medium is provided on which a program is stored, wherein when the program is executed, the task processing method based on the parallel BN architecture deep neural network as described above is implemented.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1) This paper proposes a deep neural network optimization method based on a parallel batch normalization architecture. It introduces a BN selector module, dynamically distinguishes input sample types, and adopts a multi-BN branch structure. During the training phase, the distribution data of different attack types are processed independently. During the inference process, the parallel multi-BN paths are weighted and output based on the classification probability output by the BN selector. By explicitly decoupling the normalization process of adversarial samples and clean samples, the model can adaptively learn the characteristics of different data distributions. Compared with the traditional single BN architecture, this method can effectively alleviate the adversarial trade-off problem and significantly improve robust accuracy while maintaining high natural accuracy.

[0031] 2) The present invention also merges branches with similar distributions through an adaptive BN pruning strategy, ensuring that the hybrid network architecture with coexistence of multiple BNs and single BNs can effectively save training and inference time while ensuring model accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a flowchart of the task processing method based on the parallel BN architecture deep neural network of the present invention;

[0033] Figure 2 A schematic diagram of the backbone network structure of a BN selector in a specific embodiment of the present invention;

[0034] Figure 3 A schematic diagram of the position of a BN selector in a specific embodiment of the present invention;

[0035] Figure 4 This is a sample processing flow chart of a unique BN strategy in a specific embodiment of the present invention;

[0036] Figure 5 This is a sample processing flow chart in an adaptive BN strategy in a specific embodiment of the present invention;

[0037] Figure 6 This is a comparison chart of the difference in double BN parameters on different BN layers of ResNet50 in a specific embodiment of the present invention, including a) weight b) offset c) sliding mean d) sliding variance. DETAILED DESCRIPTION

[0038] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0039] Example 1

[0040] In order to improve the natural accuracy (performance on clean samples) and robust accuracy (stability under adversarial samples) of the deep neural network model, this paper proposes a task processing method based on a parallel BN architecture deep neural network. The specific steps are as follows:

[0041] Inputting the input sample of the target task into the improved deep neural network to obtain the task processing result; wherein the input sample includes image data, text encoding, voice data or sensor data; the target task type includes: classification task, regression task or prediction task;

[0042] The improved deep neural network introduces a BN selector to identify input samples as clean samples or adversarial samples, and gives a sample score α; each batch normalization network layer in the improved deep neural network adopts a parallel BN architecture, which consists of multiple BNs, and uses the sample score α as the adaptive coefficient to perform weighted averaging on the outputs of multiple BNs to obtain the final feature normalization result.

[0043] The specific design of the improved deep neural network is as follows:

[0044] 1. BN selector design

[0045] To ensure that the model not only maintains good accuracy on clean samples but also resists adversarial attacks, it needs to automatically identify clean and adversarial samples and then adaptively normalize features based on the sample type. To achieve this, a BN selector is designed. The BN selector takes as input either a clean sample or a certain type of adversarial sample and outputs a multi-classification result for either "clean sample" or "a certain type of adversarial sample."

[0046] 1.1) Backbone Network of BN Selector

[0047] The BN selector network primarily detects whether a test sample is a normal sample, an adversarial sample, or which type of adversarial sample it is. When only a single attack algorithm is used to generate adversarial samples, a dual BN design is appropriate. The network's input is the sample data, and its output is a binary classification result: clean or adversarial. When multiple different attack algorithms are used to generate adversarial samples, a multi-BN design is appropriate. Suppose m attack algorithms are used, and the adversarial samples generated by these algorithms have significant distribution differences. m+1 BNs are designed to extract these different distributions, and the BN selector outputs a multi-classification result. For example, if two distinct attack algorithms, a white-box attack and a black-box attack, are used simultaneously during adversarial training, the BN selector outputs a three-class classification result: {clean sample, white-box adversarial sample, black-box adversarial sample}. Accordingly, the number of parallel BNs is set to 3. This step is typically accomplished by designing different networks based on the task of the deep neural network model. The BN selector is connected to the first layer of the original deep neural network, which is responsible for receiving input samples and judging whether the input samples are clean samples. If the samples are adversarial samples, it is determined which type of adversarial samples they belong to, and the multi-classification probability p = {α1, α2, ... α l},(0≤α i ≤1), α will be used as the adaptive coefficient of k parallel BN.

[0048] 1.2) BN selector training

[0049] When training the BN selector, taking the double BN design as an example, the score label α of the clean sample is set to 1, and the score label α of the adversarial sample is set to 0. The network loss function L after introducing the BN selector is designed as follows:

[0050] L=c[L s (θ,x clean ,1)+L s (θ,x adv ,0)]+[L r (θ,x clean ,y)+L r (θ,x adv ,y)]

[0051] Where, L s Represents the loss function of the BN selector, L r represents the loss function of the original network, θ represents the network parameters, y represents the label of the clean sample, and x clean represents a clean sample, x adv represents the adversarial example, and the hyperparameter c represents the weight of the BN selector loss function. Typically, the BN selector performs a simpler task than the original network and can have a smaller weight in the overall optimization objective (e.g., c ≤ 0.5). In practical applications, the appropriate hyperparameter c should be selected based on the complexity of the network.

[0052] Taking the design of k BNs as an example, assuming 4 BNs, the classification label of the clean sample is c1, and the classification labels of the adversarial samples generated by different adversarial attack algorithms are also different. The classification label of the adversarial sample generated by the PGD white-box attack algorithm is c2, the classification label of the adversarial sample generated by the C&W white-box attack algorithm is c3, and the classification label of the adversarial sample generated by the Square black-box attack algorithm is c4. In this case, the network loss function L is designed as follows:

[0053]

[0054] 2. Parallel BN module design

[0055] Usually clean samples and adversarial samples have different data distributions (mean μ and standard deviation σ of normal distribution), and different BN layer parameters (normalization parameters) need to be used to normalize them. For this reason, the present invention proposes the design of a parallel BN module. Different from the traditional single BN layer design, the parallel BN consists of multiple BNs. Taking the dual BN design as an example, the main BN can be used to extract the distribution parameters of clean samples, while the auxiliary BN is used to extract the distribution parameters of adversarial samples. Since the distribution of adversarial samples generated by different adversarial attack algorithms may also be different, in order to distinguish different types of adversarial samples, more than 2 BNs can be designed to form a parallel BN module. The input of the parallel BN module is the feature to be normalized, and its output is the normalized feature.

[0056] This embodiment uses a dual-BN design as an example to illustrate a design method for a parallel BN module, but the design concept of a multi-BN module is similar.

[0057] 2.1) Unique BN strategy design during training

[0058] During the training process, the unique BN strategy means that a sample x is routed only through a certain BN, and the specific BN is determined by the BN selector. At this time, the BN selector is a multi-classification problem. For an input sample x∈R d , the output sample category y∈{c1,c2,…,c k}, the probability output of the BN selector is {α1,α2,…α k}, the category output is c, c is the category corresponding to the maximum probability, that is Where 1≤i≤k, at this time, according to the category output c of the BN selector, the system selects BN accordingly c Normalize the data of sample x.

[0059] Taking the double BN design as an example, the unique BN strategy design refers to the strict binary classification of the input samples during the model training process, and outputs α and the classification threshold t according to the score of the BN selector. α, which is divided into clean samples and adversarial samples. When α≤t α When , it is an adversarial sample, otherwise it is a clean sample. Then, based on the classification results, a binary selection strategy is adopted between the main BN and auxiliary BN paths. If the sample is judged to be a clean sample, the main BN path is selected for normalization; if the sample is judged to be an adversarial sample, the auxiliary BN path is selected for processing. This strategy ensures that the main BN can correctly extract the distribution parameters of the clean sample, while the auxiliary BN can correctly extract the distribution parameters of the adversarial sample.

[0060] The subsequent training process employs an adversarial training approach. Each iteration generates adversarial examples based on the previously trained model, thereby improving the model's robustness. Our parallel BN architecture differs significantly from a standard single BN network: in a single BN architecture, the network routing and reverse gradient calculation path for each sample are fixed; in a parallel BN architecture, the BN layers that each sample passes through are dynamically selected, causing the gradient calculation path to also change dynamically.

[0061] Taking the dual BN design as an example, the dynamic routing process for generating adversarial examples is as follows. When using the PGD iterative attack algorithm to generate adversarial examples, assuming the number of iterations is n, as the iterative attack progresses, the generated samples gradually evolve from clean samples to adversarial samples, becoming increasingly adversarial. In the first iteration, when faced with a clean sample, the BN selector routes it to the main BN for normalization. The reverse gradient calculation relies on the main BN. As the iteration progresses, after a certain iteration (e.g., n / 2), the BN selector will identify it as an adversarial example and switch its routing to the auxiliary BN branch, resulting in a change in the subsequent gradient calculation path. This dynamic routing mechanism makes the generated adversarial examples more diverse and uncertain. Involving such adversarial examples in the training process can further improve the robustness of the model.

[0062] 2.2) Design of Adaptive BN Strategy in Inference Process

[0063] Adaptive BN strategy design refers to the process of model inference. For each input sample, the score output α of the BN selector is used to perform weighted averaging on the outputs of multiple BNs in the same parallel BN module to obtain the final feature normalization result. Taking adaptive double BN as an example, the normalization result is calculated as follows:

[0064]

[0065] in, represents the normalized result of the main BN, Represents the normalized result of auxiliary BN.

[0066] For more than 2 BNs, taking the design of k BNs as an example, the BN selector changes from a binary classifier to a k classifier. For a sample x, the output of the BN selector is p = {α1, α2, ... α k}, where α i The sample belongs to c i The probability of the category satisfies 0≤α i ≤0 and The corresponding normalized results of the parallel BN layer are calculated as follows:

[0067]

[0068] Considering the issue of robust generalization, we want the model to be able to dynamically adapt to new attack types and intensities even with limited training data. For example, if weak adversarial examples are generated by a relatively weak attack, the mean and variance obtained by BN statistics should theoretically be between those of clean and strong adversarial examples. In this case, the statistical properties of clean or strong adversarial examples should not be directly used. Adaptive BN methods offer a way to predict where the distribution of newly input weak adversarial examples lies between clean and strong adversarial examples using the probabilistic output of the BN selector.

[0069] 3. BN pruning acceleration

[0070] Compared to traditional single-BN design methods, parallel multi-BN design increases the time cost of model training and inference. However, BN pruning can accelerate the model training and inference process. BN pruning involves traversing the network and merging multiple BNs with small differences in distribution parameters. This hybrid network architecture, which maintains the coexistence of multiple BNs and a single BN, can effectively reduce training and inference time while maintaining model accuracy.

[0071] 3.1) Analysis of the differences in distribution parameters of different BNs

[0072] The parameters of BN include (1) distribution statistical parameters, specifically the running mean μ and the sliding variance σ 2 (Running variance), these parameters are used to maintain model stability during training; (2) learnable weights ω (Weight) and bias b (Bias), these parameters are optimized during training to improve model performance. Statistics and analysis of the parameter differences of the double BN at different network layers, find BNs with small differences and prune and merge them.

[0073] 3.2) Hybrid network architecture with coexistence of multiple BNs and single BN

[0074] Considering the differences in these parameters between multiple BNs in the same network layer:

[0075] df(xl,i,j,k )=|x l,i,k -x l,j,k |

[0076] Among them, l is the number of network layers, i≠j represents different BN numbers, and k is the four parameters of BN. When satisfied, it is considered that the BN of the lth layer i and BN j They can be merged into one BN, traversing all network layers to complete the pruning and merging of multiple BNs.

[0077] Example 2

[0078] As one of the specific implementation examples of the present invention, in this embodiment, the original deep neural network is a CNN network, and the original deep neural network performs image classification tasks.

[0079] In this embodiment, the BN selector uses the CNN network as the backbone network structure and adopts the following Figure 2 The network structure shown in Figure 1 is used to form a BN selector. The input image sample passes through multiple convolutional layers and maximum pooling MP (MaxPooling) set in sequence, and the global average pooling GAP (Global Average Pooling) outputs the sample score α.

[0080] In this embodiment, BN is a double selector, and its position relative to the original deep neural network is shown as follows: Figure 3 shown.

[0081] Deep neural network, adopts unique BN strategy during training, and the image sample processing flow is as follows Figure 4 As shown, in this embodiment, k=2, and the classification threshold t is set α =0.5.

[0082] The image sample X is input into the BN selector and the deep neural network respectively. The output score α of the BN selector is used, and the convolution layer of the deep neural network outputs the convolution result conv(X);

[0083] Scoring output α and classification threshold t based on BN selector α = 0.5, the input image samples are divided into clean samples and adversarial samples,

[0084] When α>0.5, the input image sample X is judged to be a clean sample. The parallel BN module selects the main BN path to normalize the output conv(X) of the convolutional layer to obtain the normalized result bn1(conv(X)), and enters the subsequent module after passing the activation function ReLU.

[0085] When α≤0.5, the input image sample X is judged to be a clean sample. The parallel BN module selects the auxiliary BN path to normalize the output conv(X) of the convolutional layer to obtain the normalized result bn2(conv(X)), and enters the subsequent module after passing the activation function ReLU.

[0086] This unique BN training strategy ensures that the main BN can correctly extract the distribution parameters of clean samples, while the auxiliary BN can correctly extract the distribution parameters of adversarial samples.

[0087] The image sample processing flow of the deep neural network adaptive BN strategy during inference is as follows Figure 5 As shown, k=2 at this time.

[0088] Example 3

[0089] In order to test the advantages of the adaptive BN strategy, this example completed the training of the parallel BN model under strong attack (perturbation range of 32 / 255), respectively using the "adaptive BN strategy" and "unique BN strategy" for model inference, and performed targeted attack tests on adversarial samples with perturbation ranges of 8 / 255 and 32 / 255 and different attack types. The experimental results are shown in Table 1.

[0090] It can be seen that under strong attacks with a large perturbation range (32 / 255, the same as during training), the adaptive BN method's advantage is not significant. In fact, under the FGSM attack, its robust accuracy of 72.77% is slightly lower than the 72.83% of the unique BN strategy. However, under weak attacks with a smaller perturbation range (8 / 255), the adaptive strategy clearly achieves higher robust accuracy. Under the FGSM attack, its robust accuracy of 60.20% far exceeds the 45.98% of the unique BN strategy. Similarly, under the PGD attack, its robust accuracy of 59.05% far exceeds the 18.06% of the unique BN strategy. This is consistent with our experimental results, which suggest that FGSM and PGD adversarial examples with a small perturbation range should be distributed somewhere between clean and strong adversarial examples. Directly adopting the "unique BN strategy" and forcing it to correspond strictly to clean or strong adversarial examples in terms of distribution is likely to result in a decrease in robust accuracy.

[0091] Table 1 Test results of ResNet50 on CIFAR-10 using different perturbation ranges for targeted attack samples

[0092]

[0093] (The optimal indicator is bold, and the unit of accuracy is %)

[0094] Example 4

[0095] In this embodiment, the original deep neural network uses the ResNet50 deep neural network as an example, and BN pruning is performed on it. By analyzing the 53 BN layers of ResNet50, it is found that the four parameter differences of the BN layer show an obvious U-shaped structure, that is, the BN parameters at the two ends are relatively different, while the BN parameters in the middle layer are relatively small. Figure 6 As shown in the figure, the horizontal axis represents the number of network layers, and the vertical axis represents the absolute value of the difference in the parameters of the parallel dual BN. Figure 6 It can be seen that the difference in parallel BN parameters from layer 13 to layer 31 is relatively small.

[0096] The intermediate layers 10-40 and 13-31 of the ResNet50 deep neural network were pruned, resulting in pruned models whose performance was compared with the pre-pruning models. The CIFAR-10 test data was used. The adversarial attack algorithms included the white-box attack algorithms FGSM and PGD, and the black-box attack algorithm Square. A targeted attack was employed with a perturbation amplitude of 32 / 255. The model accuracy results before and after pruning are shown in Table 2. The experimental results show that appropriate pruning not only does not reduce model accuracy, but actually improves the model's natural accuracy on clean samples and its average adversarial robustness accuracy under different attacks. Furthermore, a comparison of model training time before and after pruning is shown in Table 3. The experimental results show that pruning effectively reduces the time required for each training round.

[0097] Table 2 Comparison of model accuracy before and after pruning (optimal indicators are bold)

[0098]

[0099] Table 3 Comparison of model training time before and after pruning

[0100] Pruning location Model parameter number (K) Average training time per round (s) 10-40 98635 852.01 13-31 98645 911.50 No pruning 98660 1169.57

[0101] Example 5

[0102] This embodiment provides another application comparison example of the above method. A model containing a parallel BN network architecture is trained. The training data includes clean samples and adversarial samples generated under the adversarial attack algorithm. The sample ratio is 1:1. The changes in the loss function L and the model accuracy A under different training rounds (Epochs) are observed. The training is terminated when the loss function no longer decreases significantly and the model accuracy no longer increases significantly. Here, the model accuracy includes the natural accuracy A on the clean samples. n , the robust accuracy A on adversarial examples r , and comprehensive accuracy A c .

[0103]

[0104] First, perform model inference on the clean sample test dataset and calculate the natural accuracy A of the model n Based on the clean sample test data set, the white box attack algorithm and the black box attack algorithm are used to generate adversarial samples, and the model is inferred on it to calculate the robust accuracy A of the model. r , and finally calculate the comprehensive accuracy A of the model c .

[0105] In order to comprehensively evaluate the advantages of the parallel BN architecture, a variety of model training methods are selected, including (1) traditional training method (Standard Training, ST), which does not introduce adversarial samples and is only trained on clean samples, with the goal of optimizing natural accuracy; (2) adversarial training method (Standard Adversarial Training, SAT), which introduces adversarial samples and trains the model on a set of clean samples and adversarial samples, with the goal of improving the adversarial robust accuracy of the model, but this type of method will inevitably weaken the natural accuracy of the model; (3) collaborative improvement method, the training method of this patent, which aims to collaboratively improve natural accuracy and adversarial robust accuracy.

[0106] For all experiments, the batch size is set to 64, the SGD optimizer with a momentum of 0.9 and a weight decay factor of 1e-4 is used, the initial learning rate of the residual network is set to 0.1, and a total of 30 rounds of training are performed. In the first 5 training rounds, a warm-up strategy is used to adjust the learning rate, starting from 0.001 and gradually increasing the learning rate to 0.1, and then decreasing to 0.01 when the training round is 20; for training stability, when training CIFAR-10, the learning rate of the BN selector is always kept at 0.001, while when training SVHN, the BN selector adopts a learning rate warm-up strategy, gradually increasing from 0.001 to 0.01; for the normalization strategy, the sliding average and variance updates of BN are maintained during training, the momentum is set to 0.1 by default, and Affine is set to True by default.

[0107] The SHVN and CIFAR-10 datasets were selected, with ResNet50 and ResNet18 used as the backbone networks for the classification task. A pruned version of ResNet50 was used, with the 13th to 31st batch normalization layers restored to single batch normalization. ResNet18 was not pruned. FGSM and PGD were used as the white-box attack algorithms. The perturbation range for the CIFAR-10 dataset was set to 32 / 255, the perturbation step size to 1 / 255, and the number of iterations to 5. The perturbation range for the SVHN dataset was changed to 8 / 255. All other parameters were the same as for the CIFAR-10 dataset.

[0108] Experiments were conducted on the ResNet50 classifier based on CIFAR-10. The results are shown in Tables 4 and 5. The optimal indicators are bolded and the suboptimal indicators are underlined.

[0109] Table 4 Comparison of model accuracy under targeted attack

[0110]

[0111] Table 5 Comparison of model accuracy under non-targeted attacks

[0112]

[0113]

[0114] Experiments were conducted on the ResNet18 classifier based on SVHN. The results are shown in Tables 6 and 7. The optimal indicators are bolded and the suboptimal indicators are underlined.

[0115] Table 6 Comparison of model accuracy under targeted attack

[0116]

[0117] Table 7 Comparison of model accuracy under non-targeted attacks

[0118]

[0119] From the experimental results, it can be seen that the network architecture of the parallel BN design proposed in this patent has achieved the best natural accuracy and robust accuracy. Its natural accuracy exceeds that of traditional training methods, and its robust accuracy also surpasses that of adversarial training methods, achieving a coordinated improvement in natural accuracy and robust accuracy.

[0120] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A task processing method based on a parallel BN architecture deep neural network, characterized in that: The method comprises the following steps: Inputting the input sample of the target task into the improved deep neural network to obtain the task processing result; wherein the input sample includes image data, text encoding, voice data or sensor data; the target task type includes: classification task, regression task or prediction task; The improved deep neural network introduces a BN selector to identify the category of input samples and give the classification probability of the samples; each batch normalization network layer in the improved deep neural network adopts a parallel BN architecture, consists of multiple BNs, and uses the classification probability of the samples as an adaptive coefficient to perform weighted averaging on the outputs of multiple BNs to obtain the final feature normalization result.

2. The task processing method based on a parallel BN architecture deep neural network according to claim 1, characterized in that: The parallel BN architecture includes a master BN and one or more slave BNs.

3. The task processing method based on a parallel BN architecture deep neural network according to claim 2, characterized in that: The improved deep neural network uses a variety of adversarial samples generated by different attack algorithms during the training phase, and the multiple auxiliary BNs are matched with various types of adversarial samples generated by the adversarial attack algorithms.

4. The task processing method based on a parallel BN architecture deep neural network according to claim 3, characterized in that: The improved deep neural network adopts a unique BN training strategy during the training phase: The BN selector classifies the input samples into adversarial sample types and outputs the probability of each sample category; Select the BN path corresponding to the category with the highest probability to normalize the input sample data and change the gradient calculation path.

5. The task processing method based on a parallel BN architecture deep neural network according to claim 1, characterized in that: The network loss function L of the improved deep neural network is designed as follows: L=c[L s (θ,x clean ,1)+L s (θ,x adv ,0)]+[L r (θ,x clean ,y)+L r (θ,x adv ,y)] Where, L s Represents the loss function of the BN selector, L r represents the loss function of the original network, θ represents the network parameters, y represents the label of the clean sample, and x clean represents a clean sample, x adv represents the adversarial sample, and the hyperparameter c represents the weight of the BN selector loss function.

6. The task processing method based on a parallel BN architecture deep neural network according to claim 1, characterized in that: The improved deep neural network adopts an adaptive BN strategy in the inference stage: For each input sample, the BN selector output gives the classification probability of the sample; The classification probability is used to perform weighted averaging on the outputs of multiple BNs in the same parallel BN module to obtain the final feature normalization result of the parallel BN module.

7. The task processing method based on a parallel BN architecture deep neural network according to claim 1, characterized in that: The improved deep neural network uses BN pruning to accelerate the training and inference time of the model, as follows: Calculate the parameter differences between multiple BNs within the parallel BN module in each network layer. The parameter differences between multiple BNs in the same network layer are expressed as follows: Where l is the number of network layers, i≠j represents the number of different BNs in the same network layer; k represents the type of BN parameters; When df(x l,i,j,k ) is less than or equal to the set parameter difference threshold, the BN layer l i and BN j Merge into one BN; Repeat the above process until all network layers are traversed and the pruning and merging of multiple BNs are completed.

8. The task processing method based on a parallel BN architecture deep neural network according to claim 7, characterized in that: The parameters used to calculate the differences between multiple BNs include: distribution statistics parameters, learnable weights, and offsets; wherein the distribution statistics parameters include sliding mean and sliding variance.

9. A task processing device based on a parallel BN architecture deep neural network, comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, it implements the task processing method based on the parallel BN architecture deep neural network as described in any one of claims 1 to 8.

10. A storage medium having a program stored thereon, characterized in that: When the program is executed, the task processing method based on the parallel BN architecture deep neural network as described in any one of claims 1 to 8 is implemented.

Images