Image classification model robustness enhancement method and system based on structure improvement

Abstract

The invention provides an image classification model robustness enhancement method and system based on structure improvement, and relates to the technical field of artificial intelligence. Optimization is carried out on the basis of the structure of a traditional image classification model, a DWT module is adopted in the improved classification model for processing, images are analyzed in a frequency domain, high-frequency information and low-frequency information of the images are effectively separated and processed, and the multi-scale information modeling capacity is enhanced; a CondConv module is introduced into a middle layer and a high layer, a classification model dynamically adjusts a convolution kernel according to input features, and the adaptability of feature extraction is improved; a DAM module is added to the rear end of the classification model to dynamically and adaptively adjust the weight of important features, and the sensitivity to irrelevant disturbance is reduced; experiments show that the robust performance of the model can be further enhanced, so that the model can be applied to FGSM, PGD and Camp; and higher classification stability is maintained under common attacks such as W and the like.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method and system for enhancing the robustness of an image classification model based on structural improvement. Background Art

[0002] Across various computer vision tasks, CNNs, relying on their powerful feature extraction capabilities, have been widely used in fields such as image classification and object detection. Because their design relies on local receptive fields and weight sharing, CNNs exhibit good generalization capabilities when processing clean samples. However, they are susceptible to perturbations when faced with carefully designed adversarial examples. These small but precise perturbations can introduce biases in the model's high-level feature space, leading to misclassification. Improving model robustness has become a key challenge in deep learning research for safety-critical applications such as autonomous driving and medical image analysis.

[0003] The poor performance of CNNs in adversarial attack environments may be related to their reliance on local features and the limitations of fixed convolution kernels. Traditional CNNs extract local features through layer-by-layer convolution and implement dimensionality reduction with the help of pooling layers. However, this design makes the model susceptible to local perturbations, causing a shift in the overall feature representation. The fixed convolution kernel mechanism of CNNs fixes model parameters, making them unable to adjust to changes in image samples. This makes image classification models difficult to adapt to different image sample types. When subjected to adversarial attacks, fixed filters may amplify the perturbation effect, reducing the model's robustness.

[0004] Therefore, the present invention provides a method and system for enhancing the robustness of an image classification model based on structural improvement to solve the technical problem that the existing CNN model suffers from reduced model robustness when subjected to adversarial attacks. Summary of the Invention

[0005] The present invention aims to overcome the shortcomings of existing technologies by providing a method and system for enhancing the robustness of image classification models based on structural improvements. This improved image classification model improves the robustness of the model while maintaining high classification accuracy for clean samples. The improved classification model incorporates multi-scale feature extraction and a dynamic adjustment mechanism to enhance the model's ability to capture global information and its adaptability to local perturbations.

[0006] To achieve the above objectives, the present application proposes a robustness enhancement system for image classification models based on structural improvement, which is used to structurally optimize traditional image classification models, including a front-end layer, several middle layers, a back-end layer and a fully connected layer arranged in sequence; wherein, the front-end layer is arranged in sequence through the DWT module, the Conv module and the Pool module; the middle layer is arranged in sequence through the Conv module and the Pool module, and when it is judged to be a medium or high layer, the Conv module is replaced by the CondConv module, and the back-end layer is arranged in sequence through the CondConv module, the DAM module and the Pool module.

[0007] As a further solution, the traditional image classification model adopts deep traditional CNN architecture, including AlexNet, VGG, ResNet and Inception.

[0008] As a further solution, the DWT module performs frequency domain transformation on the image samples, and decomposes the image samples into different frequency sub-bands, including low-frequency approximate components and high-frequency detail components in different directions.

[0009] As a further solution, the CondConv module includes a routing function RouteFN, several expert convolution kernels, a Combine module, a Conv module and a BN+Relu module; wherein, The routing function RouteFN receives input data and generates corresponding weights according to each expert convolution kernel. The Combine module performs weighted combination of each expert convolution kernel to obtain the final dynamic convolution kernel. The Conv module extracts features from the input data based on the dynamic convolution kernel and outputs unnormalized activation values; the BN+Relu module normalizes the activation values, pulls the activation values ​​back to a stable distribution, and performs nonlinear activation on the normalized activation values.

[0010] As a further solution, the routing function is set as follows: In this example, x represents the input data, Sigmoid (*) is the threshold function of the neural network, mapping the variable to between 0 and 1; GlobalAveragePool (*) is the global average pooling function, and R is the learnable weight matrix.

[0011] As a further solution, the intermediate layer is determined to be a mid-high layer when the number of convolution channels is greater than or equal to 256.

[0012] As a further solution, the DAM module includes a multi-scale feature extraction layer, a CondConv module and a parallel attention mechanism layer; wherein, The multi-scale feature extraction layer is used to extract multi-scale features of the input data, and input the multi-scale features together with the input data into the CondConv module; The CondConv module dynamically adjusts the weights of the convolution kernel based on the distribution of input features, selectively emphasizes important features, suppresses redundant or adversarial perturbation features, and obtains dynamically adjusted features; The parallel attention mechanism layer processes the dynamic adjustment features according to different attention mechanisms to obtain fused dynamic features and retains the dynamic adjustment features in combination with residual connections.

[0013] As a further solution, the multi-scale feature extraction layer uses the BN module and the Conv module to extract basic features, and then uses the multi-scale depth-separable convolution DSConv to extract local and global information using different receptive fields respectively, and the channel splicing module CAT aggregates features of different scales to obtain multi-scale features.

[0014] As a further solution, the parallel attention mechanism layer extracts important features at the pixel level, channel level and spatial level respectively through the pixel attention module, channel attention module and spatial attention module; The pixel attention module uses 1×1 convolution to extract pixel information of dynamic adjustment features and uses Sigmoid module to generate pixel weights; The channel attention module uses the global average pooling (GAP) module to extract the channel information of the dynamic adjustment features and generates channel weights through 1×1 convolution and activation function; The spatial attention module extracts the spatial information of the dynamic adjustment features through 1×1 convolution and 3×3 convolution, and generates spatial weights using the Sigmoid module.

[0015] On the other hand, the present invention also provides a method for enhancing the robustness of an image classification model based on structural improvement, wherein the traditional image classification model is structurally optimized by using a system for enhancing the robustness of an image classification model based on structural improvement as described in any of the above items.

[0016] Compared with related technologies, the present invention provides a method and system for enhancing the robustness of image classification models based on structural improvement, which has the following advantages: The present invention optimizes the structure of the traditional image classification model, adopts the DWT module for processing in the improved classification model to enhance the multi-scale information modeling capability, then introduces the CondConv module at the middle and high levels, so that the convolution kernel parameters can be dynamically adjusted with the input, improving the adaptability of feature extraction, and finally adds the DAM module at the back end of the classification model to further optimize the feature expression and enhance the discrimination capability; wherein, the DWT module enables it to analyze the image in the frequency domain and effectively separate and process the high-frequency and low-frequency information of the image; at the same time, the CondConv module replaces part of the standard convolution with the conditional convolution, allowing the classification model to dynamically adjust the convolution kernel according to the input features; finally, the DAM module with dynamic feature enhancement is added at the end of the classification model so that the model can dynamically and adaptively adjust the weights of important features and reduce its sensitivity to irrelevant disturbances; experiments have shown that the present invention can further enhance the robust performance of the model, so that it can maintain higher classification stability under common attacks such as FGSM, PGD and C&W. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 A schematic diagram of the improved classification model structure provided by the present invention; Figure 2 This is a schematic diagram of the structure of the existing traditional classification model; Figure 3 Schematic diagram of the conditional convolution Condconv module structure provided by the present invention; Figure 4 A schematic diagram of the DAM module structure provided by the present invention; Figure 5 A schematic diagram of the attention structure provided by the present invention; Figure 6 Schematic diagram of the SVHN dataset image provided by the present invention; Figure 7 A schematic diagram of the classification accuracy of FGSM under the ResNet34 model provided by the present invention; Figure 8 A schematic diagram of the classification accuracy of FGSM under the VGG19 model provided by the present invention; Figure 9Schematic diagram of the classification accuracy of PGD under the ResNet34 model provided by the present invention; Figure 10 Schematic diagram of the classification accuracy of PGD under the VGG19 model provided by the present invention; Figure 11 A schematic diagram of the classification accuracy of C&W under the ResNet34 model provided by the present invention; Figure 12 A schematic diagram of the classification accuracy of C&W under the VGG19 model provided by the present invention; Figure 13 A schematic diagram of the classification accuracy of FGSM under the ResNet34 model provided by the present invention; Figure 14 A schematic diagram of the classification accuracy of FGSM under the VGG19 model provided by the present invention; Figure 15 Schematic diagram of the classification accuracy of PGD under the ResNet34 model provided by the present invention; Figure 16 Schematic diagram of the classification accuracy of PGD under the VGG19 model provided by the present invention; Figure 17 A schematic diagram of the classification accuracy of C&W under the ResNet34 model provided by the present invention; Figure 18 This is a schematic diagram of the classification accuracy of C&W under the VGG19 model provided by the present invention.

[0020] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0022] See also Figure 1, an embodiment of the present application provides an image classification model robustness enhancement system based on structural improvement, which is used to structurally optimize the traditional image classification model, including a front-end layer, several middle layers, a back-end layer and a fully connected layer arranged in sequence; wherein, the front-end layer is arranged in sequence through the DWT module, the Conv module and the Pool module; the middle layer is arranged in sequence through the Conv module and the Pool module, and when it is judged to be a medium or high layer, the Conv module is replaced by the CondConv module, and the back-end layer is arranged in sequence through the CondConv module, the DAM module and the Pool module.

[0023] It's important to note that traditional CNNs extract local features through layer-by-layer convolution and implement dimensionality reduction with the help of pooling layers. However, this design makes the model susceptible to local perturbations, causing a shift in the overall feature representation. CNN's fixed convolution kernel mechanism fixes model parameters, making them unable to adjust to changes in image samples. This makes image classification models difficult to adapt to different image sample types. When subjected to adversarial attacks, fixed filters can amplify the perturbation effect, reducing the model's robustness.

[0024] In order to improve the robustness of the model in the adversarial sample environment, this paper optimizes the structure of the traditional image classification model. The traditional classification model mainly consists of standard convolutional layers, pooling layers and fully connected layers, such as Figure 2 As shown in Figure 3, this traditional CNN structure performs well in classification on clean samples. However, due to the fixed filter characteristics of the convolutional layer, the model is difficult to adapt to input perturbations when facing adversarial samples, resulting in a significant decrease in classification performance.

[0025] To this end, this paper optimizes the structure of the traditional image classification model. Figure 1 As shown in the figure, the DWT module is used in the improved classification model to enhance the multi-scale information modeling capability. Then, the CondConv module is introduced in the middle and high levels so that the convolution kernel parameters can be dynamically adjusted with the input, improving the adaptability of feature extraction. Finally, the DAM module is added to the back end of the classification model to further optimize the feature expression and enhance the discrimination capability. By introducing the Discrete Wavelet Transform (DWT) module into the classification model, it can analyze images in the frequency domain and effectively separate and process high- and low-frequency information. Furthermore, some standard convolutions are replaced with Conditionally Parameterized Convolution (CondConv) modules, allowing the classification model to dynamically adjust the convolution kernel based on input features. Finally, a dynamic feature enhancement (DAM) module is added at the end of the classification model, enabling the model to dynamically and adaptively adjust the weights of important features, reducing sensitivity to irrelevant perturbations.

[0026] In the improved classification model architecture, a DWT module is first applied to image samples to decompose them into frequency subbands, including low-frequency approximate components and high-frequency detail components in different directions. The key role of the DWT module is to perform frequency-domain transforms on image samples, allowing the model to process global structural information and local detail information separately. Traditional CNNs primarily rely on spatial-domain feature learning and lack the ability to model frequency-domain information. Adversarial attacks often inject subtle perturbations into high-frequency components, inducing model deviations during feature extraction and thus affecting classification decisions. Therefore, this paper introduces a DWT module on top of the traditional classification model to enhance the model's multi-scale feature modeling capabilities. This improvement has a positive effect on improving the model's perception of information at different scales, allowing it to extract key discriminative information from a richer and more diverse feature space. Because adversarial attack methods often involve the introduction of localized high-frequency noise, CNN structures that rely solely on spatial information struggle to effectively identify and suppress such perturbations. The DWT module, by explicitly decomposing the high-frequency components of the image, enables the model to model different frequency components separately, effectively distinguishing adversarial perturbations from true features and improving the robustness of the classification model in adversarial environments.

[0027] In the structure of the improved classification model, this paper introduces the conditional convolution Condconv module for dynamic feature extraction. The structure of the CondConv module is as follows Figure 3 As shown in the figure, the CondConv module mainly consists of the routing function RouteFN, expert convolution kernels (W1, W2, W3), Combine module, Conv module and BN+Relu module. According to the weights generated by the routing function, different expert convolution kernels are weighted and combined to obtain the final dynamic convolution kernel. The calculation formula of the routing function can be expressed as: In this example, x represents the input data, Sigmoid (*) is the threshold function of the neural network, mapping the variable to between 0 and 1; GlobalAveragePool (*) is the global average pooling function, and R is the learnable weight matrix.

[0028] Finally, the combined dynamic convolution kernel is used to perform convolution operation on the input features to obtain the output features. This process can be described by the formula: Traditional convolutional layers have fixed weight parameters, making it difficult to dynamically adjust feature extraction methods based on different samples. However, adversarial attacks typically use subtle perturbations to induce model misclassification, making convolutional layers with fixed weights difficult to handle. In contrast, the CondConv module introduces a dynamic parameter allocation mechanism that allows the weights of the convolution kernel to adaptively adjust based on input features, thereby employing different feature extraction strategies for clean and adversarial samples.

[0029] This article chooses to replace the Conv modules in the middle and high layers of the traditional classification model with CondConv modules, that is, to replace them when the number of convolution channels is greater than or equal to 256, in order to enhance the model's adaptability to different input features, thereby improving its robustness. 256 was chosen as the starting point for replacement because the network generally starts to extract high-level semantic features from this layer, and at the same time, adversarial attacks in the middle and high layers have a significant impact on the classification of the network. This can effectively improve the defense capabilities of the model while not significantly increasing the computational cost. After replacing these layers with CondConv modules, the model can more flexibly adjust the feature extraction method, maintain high accuracy on clean samples, and adapt to perturbations when subjected to adversarial attacks, thereby improving the robustness of the model under adversarial attacks. This paper proposes a DAM module (dynamic feature extraction module) based on the static characteristics of the traditional classification model structure. Figure 4As shown in the figure. This structure is an improved feature extraction module that aims to improve the expressiveness and robustness of the model. The module first uses the BN module and the Conv module to extract basic features. Then, the multi-scale depthwise separable convolution (DSConv module) uses different receptive fields to extract local and global information, and aggregates features of different scales through channel splicing. Traditional convolution usually relies on filters of a single scale to extract features, but adversarial attacks may optimize features of a specific scale. When an attack method mainly affects local detail information, a single-scale convolution may be difficult to effectively distinguish between clean samples and adversarial samples. Therefore, the DAM module contains multiple convolution operations with different receptive fields, including DSConv3x3, DSConv5x5, and DSConv7x7, corresponding to different feature extraction ranges. Convolution operations with different receptive fields are beneficial for the model to identify cross-regional adversarial perturbation patterns and make up for the global modeling defects of traditional CNN. Multi-scale feature fusion of the extracted features allows the classification model to analyze input data at different scales, thereby reducing the adversarial examples' dependence on specific feature channels and improving overall classification stability and robustness. The fused features are then subjected to standard convolution to further integrate feature information, and residual connections are used to ensure the stability of the feature flow.

[0030] In the DAM module, the CondConv module is located after the multi-scale feature extraction, which means that the input has integrated local and global information from different receptive fields. At this time, the CondConv module can dynamically adjust the weights of the convolution kernel based on the distribution of input features, selectively emphasize important features, and suppress redundant or adversarial perturbation features. Compared with the standard convolution with fixed parameters, the CondConv module allows the network to adopt the optimal feature extraction method for different image samples, thereby improving the generalization and robustness of the model. From the perspective of adversarial attacks, the CondConv module can also increase the instability of the gradient, making it difficult for attackers to construct effective adversarial perturbations. The CondConv module subsequently normalizes the stable distribution through the BN module, and further extracts important features at the pixel level, channel level, and spatial level through a parallel attention mechanism to achieve more refined feature enhancement.

[0031] Figure 5Three different attention mechanisms are demonstrated; among them, the parallel attention mechanism layer extracts important features at the pixel level, channel level, and spatial level through the pixel attention module, channel attention module, and spatial attention module respectively; the pixel attention module uses 1×1 convolution to extract pixel information of dynamically adjusted features, and uses the Sigmoid module to generate pixel weights; the channel attention module uses the global average pooling GAP module to extract channel information of dynamically adjusted features, and generates channel weights through 1×1 convolution and activation function; the spatial attention module extracts spatial information of dynamically adjusted features through 1×1 convolution and 3×3 convolution, and uses the Sigmoid module to generate spatial weights.

[0032] These attention mechanisms help enhance the model's feature representation capabilities, improving classification performance and robustness. Finally, the features processed by the different attention mechanisms are fused and fed into a standard convolution for further processing. Residual connections are also used to preserve the original information, thereby maintaining high representation capabilities while improving robustness against adversarial attacks.

[0033] In the improved classification model structure, the DAM module is inserted after the last convolutional block in the CNN structure and before the fully connected layer (FC module). The first few layers of a CNN are primarily responsible for extracting low-level features, while the later layers are responsible for extracting high-level features. In classification tasks, high-level features are closer to the semantic level and play a decisive role in the classification results. Therefore, in adversarial attacks, attackers generally alter the distribution of high-level features in image data, making it difficult for the classification model to distinguish between adversarial examples and clean samples. Therefore, this paper utilizes the DAM module for feature enhancement and optimization before the model enters the final decision stage. This allows the model to readjust the feature distribution across multiple receptive fields. Combined with the CondConv module, this method implements a dynamic input adaptive feature extraction method to mitigate the impact of adversarial perturbations.

[0034] The improved classification model proposed in this paper is primarily applicable to medium-depth traditional CNN architectures such as AlexNet, VGG, ResNet, and Inception. Its hierarchical convolutional structure is highly compatible with the DWT, CondConv dynamic parameter adjustment, and DAM modules, effectively improving the model's robustness in adversarial environments. However, in lightweight models (such as MobileNet and ShuffleNet), non-CNN architectures (such as Vision Transformer), and relatively simple shallow models (such as linear classification models and LeNet), the improved classification model struggles to fully realize its performance advantages due to limitations in computational overhead, structural characteristics, or network depth.

[0035] In a more detailed embodiment, we use Figure 6 The performance of the proposed method is evaluated using the CIFAR10 dataset and the SVHN dataset shown in Figure 2. The SVHN (StreetViewHouseNumbers) dataset is a large-scale digit recognition dataset primarily used for image classification tasks in computer vision. Collected by researchers at Stanford University, the dataset simulates the problem of house number recognition in street scenes and therefore contains images from real street scenes. The SVHN dataset is unique in that its images are derived from real street-view photographs and involve recognizing house numbers in actual street scenes. The SVHN dataset contains 10 categories, corresponding to the digits 0 to 9. These digit images are 32×32 RGB images and can be divided into two categories: single digit images and images of multiple digits in parallel. The training set contains 73,257 images, and the test set contains 26,032 images.

[0036] In this experiment, we used a variety of evaluation metrics to measure the model's performance in clean and adversarial environments, enabling a comprehensive analysis of the effectiveness and robustness of the classification model. These metrics include clean sample classification accuracy, adversarial sample classification accuracy, and transferability.

[0037] Clean sample classification accuracy is a key metric for measuring a model's basic classification capabilities. It is calculated based on the classification accuracy of a clean test set in an attack-free environment. A high clean sample classification accuracy indicates that the model has effectively learned the data distribution and can provide reliable predictions under clean conditions.

[0038] Adversarial example classification accuracy is a key metric for measuring a model's ability to correctly classify objects under adversarial attacks. Higher classification accuracy indicates greater model robustness and reduced sensitivity to input perturbations. Adversarial example classification accuracy directly reflects the model's security in practical applications, particularly in the face of potential adversarial attacks.

[0039] Transferability expands the scope of adversarial example classification accuracy assessment, primarily used to measure a model's robustness against cross-model attacks. In real-world scenarios, attackers may not be able to directly access a model's gradient information. Instead, they generate adversarial examples on other models and use them to attack the target model. Transferability testing typically employs different attack conditions, such as generating adversarial examples using one model and then testing their classification accuracy on the target model. If the target model still accurately classifies under these cross-model attack conditions, it demonstrates strong resistance to adversarial transfer attacks.

[0040] This experiment first systematically analyzes the model's robustness under various attack types and intensities, focusing on comparing the performance of a traditional classification model with an improved classification model under the same experimental conditions to verify the effectiveness and superiority of the proposed improved approach. During the experimental design, we define F as the traditional classification model and G as the improved classification model. The training settings for both models, including the exact same training dataset, optimizer type, learning rate, weight decay, batch size, and number of training epochs, are maintained. This ensures that the evaluation process is free from interference from training conditions and ensures a fair and scientific comparison. This control variable approach allows for a clearer analysis of the direct contribution of model structural improvements to robustness, while minimizing the influence of other external factors. Furthermore, to comprehensively characterize the performance differences between the two models under different types of adversarial threats, the models are evaluated under both clean samples and FGSM, PGD, and C&W adversarial attacks.

[0041] (1) Robustness evaluation Figure 7 and Figure 8 The classification accuracy of the traditional classification model F and the improved classification model G under two different network architectures, ResNet34 and VGG19, in the face of different attacks on the CIFAR10 dataset is comprehensively demonstrated. The strength of the adversarial attack is determined by the perturbation amplitude. ε Control, here this article sets ε The four cases are 0 (no attack), 10 / 255, 20 / 255, and 30 / 255. Comparative analysis of the experimental results conducted on the two model structures and different attack intensities can more comprehensively evaluate the effectiveness of the improved strategy.

[0042] In a non-attack environment ( ε =0), the G classification model in both the ResNet34 and VGG19 architectures outperformed the F classification model. In the ResNet34 architecture, the G model achieved a classification accuracy of 92.97%, approximately 0.52% higher than the F model's 92.45%. In the VGG architecture, the G model achieved a classification accuracy of 90.68%, also higher than the F model's 90.19%. These results indicate that the G classification model exhibits stronger feature representation and classification capabilities for clean samples, and this improved capability lays the foundation for the stability of subsequent models in adversarial environments.

[0043] from Figure 7 and Figure 8 The FGSM attack results in the above table show that with the disturbance amplitude εAs the attack intensity increases, the accuracy of the F and G models under the two network architectures shows a significant downward trend, but the G classification model is always better than the F classification model under various attack intensities. ε =10 / 255, the accuracy of the F model dropped to 38.69%, while the G model remained at 41.94%; ε =30 / 255, the accuracy of F further dropped to 25.51%, while G still maintained at 28.12%, which is better than F. A similar trend also appeared in the VGG architecture. The F model ε When the weights are 10 / 255, 20 / 255, and 30 / 255, the accuracies are 39.43%, 33.28%, and 27.53%, respectively, while the corresponding accuracies for the G model are 42.16%, 35.12%, and 30.14%. This shows that the G classification model exhibits superior robustness under adversarial perturbation conditions, whether in the deeper ResNet architecture with residual connections or the simpler VGG architecture with a focus on local feature extraction.

[0044] Figure 9 and Figure 10 The robustness of the classification models F and G under the PGD white box attack on the CIFAR10 dataset is shown for the ResNet and VGG architectures. The number of PGD iterations is set to 10. As an iterative attack, PGD has a much stronger weakening effect on the two models than FGSM, and the greater the attack strength, the more obvious the decline in accuracy. Under the ResNet architecture, the F model is ε =10 / 255, the accuracy of the G model was only 7.16%, while the G model achieved 15.49%, significantly improving the classification accuracy of adversarial examples. When the attack strength increased to 30 / 255, the accuracy of the F model dropped to 2.28%, while the G model maintained 11.42%. Under the VGG architecture, the G model's adversarial classification accuracy also performed well, with a significant advantage of approximately 10% over the F model. The improvement in robustness of the G classification model under the strong PGD attack was significantly greater than that under the FGSM attack. This is because PGD gradually adjusts the input, while G has stronger dynamic adaptability, better able to cope with the cumulative perturbations generated by attack iterations. Under PGD attacks, G achieves a greater accuracy improvement over F. However, under single-step attacks like FGSM, this dynamic adaptation advantage is less pronounced, resulting in a smaller improvement over F. Combining the two architectures, it can be seen that the G classification model effectively alleviates the destructiveness of disturbance accumulation in PGD attacks on the feature extraction process, and exhibits better robustness than F under different network structures.

[0045] Figure 11 and Figure 12This paper demonstrates the classification accuracy of classification models F and G, using the ResNet and VGG architectures, against C&W white-box attacks on the CIFAR10 dataset. As the attack strength parameter K increases, the accuracy of both models decreases, but the G classification model outperforms the F classification model at all attack strengths, demonstrating superior robustness. Using the ResNet architecture, the F classification model achieves an accuracy of 5.21% at K=0, while the G classification model achieves 7.03%. When K=10 and 20, the F model's accuracy drops to 4.76% and 2.57%, respectively, and becomes almost completely ineffective at K=50. However, the G model maintains an accuracy of 7.03% and 5.51% under the same conditions, and maintains 0.78% at K=50. Similarly, using the VGG architecture, the G model consistently outperforms the F model in adversarial accuracy. This trend indicates that the C&W attack, a strong attack method based on minimum perturbation optimization, has a significant destructive effect on the F classification model with a fixed feature extractor. However, the G classification model, by leveraging multi-scale feature decomposition and dynamic convolution mechanisms, increases the diversity of the feature space and the adaptability of the convolution kernel, allowing it to retain key information even under high-intensity optimization attacks.

[0046] Based on the experimental results on the SVHN dataset, combined with Figure 13 、 Figure 14 、 Figure 15 、 Figure 16 、 Figure 17 and Figure 18 The robustness performance of the ResNet model under three white-box attacks, FGSM, PGD, and C&W, shows that despite differences in data characteristics, the G classification model demonstrates significant robustness improvements on both datasets. The SVHN dataset differs from CIFAR10 in its sample source. SVHN consists of digital characters from real street scene images with relatively little background interference. The dataset contains a large number of digital images with low texture and clear structure. This data characteristic results in a more concentrated feature distribution in SVHN, with significant inter-class differences. Under standard conditions, the model generally achieves high classification accuracy.

[0047] In the adversarial attack environment, the adversarial sample classification accuracy of the G model on the SVHN dataset is always better than that of the F model. From the FGSM robust accuracy results under the ResNet34 model, when the perturbation intensity is ε As the number of samples increases gradually, the accuracy of both F and G models decreases significantly, with the accuracy of F model dropping from 94.54% to ε=30 / 255, while the G model's accuracy dropped from 95.12% to 31.11%. Compared to the CIFAR10 experiment, the SVHN dataset achieved higher overall accuracy under the same attack intensity. This is primarily due to the fact that the adversarial perturbations in the feature space of SVHN samples are less likely to obscure the primary structural information of the true digits, allowing the model to retain a certain degree of discriminative ability. However, the G model still outperformed the F model under the FGSM attack, with an average improvement of approximately 2%-3% at all perturbation intensities. This is consistent with its performance on the CIFAR10 dataset, demonstrating that the G classification model effectively mitigates the damage caused by perturbations to model performance.

[0048] From the PGD attack experiment results, we can see that the attack effect of PGD on the SVHN dataset is particularly significant. ε =10 / 255 drops sharply to 12.44%, while ε =30 / 255, only 4.35% remains. The robustness advantage of the G model under PGD attack is even more obvious. ε =10 / 255, the accuracy reaches 25.23%, which is about 1 times that of the F model. Even in high-intensity attacks ( ε =30 / 255), it still achieved an accuracy of 14.95%, far superior to the 5.14% achieved by the F model. This is because the design of the G classification model destroys the gradient consistency that the PGD attack relies on, making it difficult for attackers to find a stable and effective perturbation direction, further amplifying G's defense advantage against PGD attacks.

[0049] In the C&W attack experiment, the results on the SVHN dataset also show a similar trend to that of CIFAR10, such as Figure 17 and Figure 18 As shown in the figure, the accuracy of the F model drops rapidly to 6.14% after K=0 and becomes essentially ineffective after K=50. However, the G model maintains a clear advantage across all attack intensities, achieving accuracies of 1.01% and 1.20% at K=50, outperforming the F model. This demonstrates that the G classification model is also highly resilient to fine-grained optimization attacks. Its dynamic adjustment mechanism and multi-scale feature modeling capabilities effectively reduce the impact of perturbations on the model's discrimination boundaries.

[0050] (2) Migration assessment In this experiment, we further employ cross-model attacks to evaluate the robustness transfer of the target model. Instead of generating adversarial examples directly on the target model, we first generate adversarial examples on a ResNet-18 model and then transfer these examples to the target model for testing. ResNet-18 was chosen as the model for generating adversarial examples due to its simple structure, low computational cost for training and generating examples, and its excellent feature extraction capabilities. The generated adversarial examples generalize well across feature spaces. By evaluating the target model's classification accuracy on these adversarial examples, we can measure its resistance to cross-model attacks.

[0051] In this experiment, the perturbation amplitude of the generated FGSM and PGD adversarial examples was set to 10 / 255, the number of iterations of the PGD attack was set to 10, and the C&W attack was performed with the L2 norm and optimized 100 times. Table 1 shows the transferability results on the CIFAR10 dataset. Using the ResNet34 architecture, model G maintained classification accuracy of 53.10%, 46.35%, and 50.06%, respectively, when faced with FGSM, PGD, and C&W adversarial examples generated by the ResNet18 model. However, model F's classification accuracy was lower than that of model G when faced with adversarial examples generated by other models. This phenomenon indicates that model G exhibits stronger transferability under cross-model adversarial attacks.

[0052] Table 1 Transferability of different models on the CIFAR10 dataset (%) The transferability evaluation results on the SVHN dataset show that model G exhibits stronger anti-interference capabilities against different attack methods, and its classification accuracy is significantly improved compared to model F. As shown in Table 2, the classification accuracy of model G under FGSM, PGD, and C&W attacks reaches 56.37%, 50.80%, and 53.90%, respectively. Compared with model F, the accuracy is improved by approximately 1%-3%. This is consistent with the results on the CIFAR10 dataset, showing stronger transferability. This proves that the construction method of model G is equally applicable to different datasets and can effectively improve the robustness of the model.

[0053] Table 2 Transferability of different models on the SVHN dataset (%) (3) Time performance test In this experiment, we also compared the adversarial example generation time and classification time of the traditional classification model F and the improved classification model G. This test used the FGSM attack (ε=10 / 255) and PGD (ε=10 / 255) on the ResNet34 model to generate adversarial examples from the CIFAR10 dataset, with a batch size of 64. The results, shown in Table 3, show that compared to the traditional classification model F, the improved classification model G experienced increased adversarial example generation time and classification time on the CIFAR10 dataset. However, the higher computational complexity of the G classification model in adversarial scenarios also increases the difficulty of adversarial example generation, thereby reducing the effectiveness of the adversary's attack.

[0054] Table 3 Time performance test results (s) This summary combines the improved classification model with the method in Chapter 3 of this paper and compares it with other methods to demonstrate its robustness. This experiment was conducted on the CIFAR10 dataset and the ResNet34 base model. The attack perturbation amplitudes for FGSM and PGD were set to 30 / 255, and the model was tested as a white-box model. The results are shown in Table 4.4.

[0055] Table 4 Test results of method integration on the CIFAR10 dataset (%) Experimental results demonstrate that, when combined with other robustness-enhancing defense methods, the G-classification model is more effective in improving the model's robustness under adversarial attacks. Under StandardAT defense, the G-classification model achieves improved accuracy compared to the F-classification model under all attacks. In particular, under the PGD attack, StandardAT+G achieves an accuracy improvement of 3.45 percentage points over StandardAT+F, demonstrating that the G-classification model is more stable against iteratively optimized adversarial attacks. Combining the Sabre method with the method proposed in Chapter 3, the G-classification model achieves higher adversarial accuracy than the F-classification model under FGSM, PGD, and C&W attacks, demonstrating the G-classification model's greater adaptability under complex defense strategies. This further validates the G-classification model's effectiveness in addressing various adversarial attack scenarios and demonstrates that its combination with existing defense strategies can further enhance the model's robustness, maintaining higher classification stability under common attacks such as FGSM, PGD, and C&W.

[0056] The above are only some embodiments of the present application and are not intended to limit the patent scope of the present application. All equivalent structural transformations made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A robustness enhancement system for image classification models based on structural improvement, used for structural optimization of traditional image classification models, characterized by: It includes a front-end layer, several middle layers, a back-end layer and a fully connected layer which are arranged in sequence; wherein, the front-end layer is arranged in sequence through the DWT module, the Conv module and the Pool module; the middle layer is arranged in sequence through the Conv module and the Pool module, and when it is judged to be a middle or high layer, the Conv module is replaced by the CondConv module; the back-end layer is arranged in sequence through the CondConv module, the DAM module and the Pool module.

2. The image classification model robustness enhancement system based on structural improvement according to claim 1, characterized in that: The traditional image classification model adopts deep traditional CNN architecture, including AlexNet, VGG, ResNet and Inception.

3. The image classification model robustness enhancement system based on structural improvement according to claim 1, characterized in that: The DWT module performs frequency domain transformation on image samples, decomposing the image samples into different frequency sub-bands, including low-frequency approximate components and high-frequency detail components in different directions.

4. The image classification model robustness enhancement system based on structural improvement according to claim 1, characterized in that: The CondConv module includes a routing function RouteFN, several expert convolution kernels, a Combine module, a Conv module and a BN+Relu module; wherein, The routing function RouteFN receives input data and generates corresponding weights according to each expert convolution kernel. The Combine module performs weighted combination of each expert convolution kernel to obtain the final dynamic convolution kernel. The Conv module extracts features from the input data based on the dynamic convolution kernel and outputs unnormalized activation values; the BN+Relu module normalizes the activation values, pulls the activation values ​​back to a stable distribution, and performs nonlinear activation on the normalized activation values.

5. The image classification model robustness enhancement system based on structural improvement according to claim 4, characterized in that: The routing function is set as follows: In this example, x represents the input data, Sigmoid (*) is the threshold function of the neural network, mapping the variable to between 0 and 1; GlobalAveragePool (*) is the global average pooling function, and R is the learnable weight matrix.

6. The image classification model robustness enhancement system based on structural improvement according to claim 1, characterized in that: The intermediate layer is determined to be a mid-high layer when the number of convolution channels is greater than or equal to 256.

7. The image classification model robustness enhancement system based on structural improvement according to claim 1, characterized in that: The DAM module includes a multi-scale feature extraction layer, a CondConv module and a parallel attention mechanism layer; wherein, The multi-scale feature extraction layer is used to extract multi-scale features of the input data, and input the multi-scale features together with the input data into the CondConv module; The CondConv module dynamically adjusts the weights of the convolution kernel based on the distribution of input features, selectively emphasizes important features, suppresses redundant or adversarial perturbation features, and obtains dynamically adjusted features; The parallel attention mechanism layer processes the dynamic adjustment features according to different attention mechanisms to obtain fused dynamic features and retains the dynamic adjustment features in combination with residual connections.

8. The image classification model robustness enhancement system based on structural improvement according to claim 7, characterized in that: The multi-scale feature extraction layer uses the BN module and the Conv module to extract basic features, and then uses the multi-scale depth-separable convolution DSConv to extract local and global information using different receptive fields, and the channel splicing module CAT to aggregate features of different scales to obtain multi-scale features.

9. The image classification model robustness enhancement system based on structural improvement according to claim 7, characterized in that: The parallel attention mechanism layer extracts important features at the pixel level, channel level and spatial level respectively through the pixel attention module, channel attention module and spatial attention module; wherein, The pixel attention module uses 1×1 convolution to extract pixel information of dynamic adjustment features and uses Sigmoid module to generate pixel weights; The channel attention module uses the global average pooling (GAP) module to extract the channel information of the dynamic adjustment features and generates channel weights through 1×1 convolution and activation function; The spatial attention module extracts the spatial information of the dynamic adjustment features through 1×1 convolution and 3×3 convolution, and generates spatial weights using the Sigmoid module.

10. A method for enhancing the robustness of an image classification model based on structural improvement, characterized in that: The traditional image classification model is structurally optimized by using the image classification model robustness enhancement system based on structural improvement as described in any one of claims 1 to 9.

Images