Adversarial training method and device based on neural network model

Abstract

The invention provides an adversarial training method and device based on a neural network model. In adversarial training of the neural network model, defining a plurality of mixed features in the neural network model, and performing feature purification on the plurality of mixed features; forming a correlation matrix based on features in the neural network model, and performing hierarchical clustering on the correlation matrix to construct a tree diagram; forming different clustering groups according to the tree diagram, and allocating each clustering group to a corresponding neuron; associating each neuron with a cluster group, introducing Gaussian random variables and spherical Gaussian variables to guide adversarial training, at the moment, performing adversarial training on a neural network model so as to facilitate adversarial training on the neural network model, performing feature purification on a plurality of mixed features, and allocating each cluster group to the corresponding neuron so as to obtain an adversarial training result; gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training, so that the adversarial robustness of the neural network model is enhanced.

Description

Technical Field

[0001] The present application relates to the technical field of adversarial training based on neural network models, and in particular to an adversarial training method and device based on a neural network model. Background Art

[0002] With the development of science and technology, neural network models are gradually applied to various learning models and serve as the core part. At this time, the neural network model needs to be trained multiple times. During the training, traditional adversarial training is introduced. In the existing technology, traditional adversarial training is performed based on the neural network model. Traditional adversarial training generates adversarial samples by adding small perturbations to the input data during the training process. The neural network model contains multiple mixed features, which affects the adversarial robustness of the neural network model. Summary of the Invention

[0003] One purpose of the present application is to provide an adversarial training method and device based on a neural network model, which performs adversarial training on the neural network model to facilitate adversarial training of the neural network model. At the same time, multiple mixed features are purified, each cluster group is assigned to a corresponding neuron, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training, so as to effectively improve the feature purification effect of the neural network model, clearly distinguish feature mixtures, and eliminate redundant features to enhance the adversarial robustness of the neural network model.

[0004] To achieve the above objectives, some embodiments of the present application provide an adversarial training method based on a neural network model, which is applied to a neural network scenario. The adversarial training method based on a neural network model includes:

[0005] Collect neural network models and perform adversarial training on the neural network models;

[0006] In the adversarial training of the neural network model, multiple mixed features in the neural network model are defined and feature purification is performed on the multiple mixed features;

[0007] Forming a correlation matrix based on the features in the neural network model and performing hierarchical clustering on the correlation matrix to construct a dendrogram;

[0008] Different cluster groups are formed according to the dendrogram, and each cluster group is assigned to the corresponding neuron;

[0009] Each neuron is associated with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

[0010] Some embodiments of the present application further provide an adversarial training device based on a neural network model, comprising:

[0011] The acquisition module is used to acquire the neural network model and perform adversarial training on the neural network model;

[0012] The feature purification module is used to define multiple mixed features in the neural network model and perform feature purification on the multiple mixed features during the adversarial training of the neural network model;

[0013] The dendrogram module is used to form a correlation matrix based on the features in the neural network model and perform hierarchical clustering on the correlation matrix to construct a dendrogram;

[0014] An allocation module, used to form different cluster groups according to the dendrogram and allocate each cluster group to a corresponding neuron;

[0015] The adversarial training module is used to associate each neuron with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

[0016] Some embodiments of the present application also provide a computer-readable medium having computer program instructions stored thereon, which can be executed by a processor to implement the above-mentioned adversarial training method based on the neural network model.

[0017] Compared with the prior art, in the solution provided in the embodiment of the present application, a neural network model is collected and adversarial training is performed on the neural network model; in the adversarial training of the neural network model, multiple mixed features in the neural network model are defined, and feature purification is performed on the multiple mixed features; a correlation matrix is ​​formed based on the features in the neural network model, and the correlation matrix is ​​hierarchically clustered to construct a tree diagram; different cluster groups are formed according to the tree diagram, and each cluster group is assigned to a corresponding neuron; each neuron is associated with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model. At this time, adversarial training is performed on the neural network model to facilitate adversarial training of the neural network model. At the same time, feature purification is performed on multiple mixed features, each cluster group is assigned to a corresponding neuron, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training, so as to effectively improve the feature purification effect of the neural network model, clearly distinguish feature mixtures, and eliminate redundant features to enhance the adversarial robustness of the neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0019] Figure 2A schematic diagram of the process of step S11 of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the process of step S12 of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0021] Figure 4 A schematic diagram of the process of step S13 of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0022] Figure 5 A schematic diagram of the process of step S14 of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0023] Figure 6 A flowchart of S15 of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0024] Figure 7 A schematic diagram of an adversarial training method based on a neural network model provided in an embodiment of the present application;

[0025] Figure 8 A schematic diagram of the various modules of an adversarial training device based on a neural network model provided in an embodiment of the present application. DETAILED DESCRIPTION

[0026] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0027] refer to Figures 1 to 8 , an embodiment of the present application further provides an adversarial training method based on a neural network model, which is applied to a neural network scenario. The adversarial training method based on a neural network model includes: step S110, acquiring a neural network model, and performing adversarial training on the neural network model;

[0028] Step S120, in the adversarial training of the neural network model, defining multiple mixed features in the neural network model, and performing feature purification on the multiple mixed features;

[0029] Step S130, forming a correlation matrix based on the features in the neural network model, and performing hierarchical clustering on the correlation matrix to construct a dendrogram;

[0030] Step S140, forming different cluster groups according to the dendrogram, and assigning each cluster group to a corresponding neuron;

[0031] In step S150, each neuron is associated with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

[0032] In the solution provided in the embodiments of the present application, adversarial training is performed on the neural network model to facilitate adversarial training of the neural network model. At the same time, feature purification is performed on multiple mixed features, each cluster group is assigned to a corresponding neuron, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training, so as to effectively improve the feature purification effect of the neural network model, clearly distinguish feature mixtures, and eliminate redundant features to enhance the adversarial robustness of the neural network model.

[0033] In step S110, a neural network model is collected and adversarial training is performed on the neural network model.

[0034] The specific steps are as follows:

[0035] Step S111: Acquire a neural network model and trigger training of the neural network model;

[0036] Step S112: During the training of the neural network model, define the type of the neural network model;

[0037] Step S113: Match the corresponding adversarial training strategy according to the type of neural network model;

[0038] Step S114: triggering adversarial training of the neural network model according to the adversarial training strategy.

[0039] In an embodiment of the present application, a neural network model is collected and training processing is performed on the neural network model. At this time, the training of the neural network model is triggered. During the training of the neural network model, the type of the neural network model is defined to introduce the type of the neural network model, thereby realizing the classification of the type of the neural network model, so as to match the corresponding adversarial training strategy according to the type of the neural network model, and then trigger the adversarial training of the neural network model according to the adversarial training strategy, thereby ensuring the targeted training of the neural network model.

[0040] The concept of adversarial training is expressed in mathematical form:

[0041] The present invention considers the training set The classification task is m, where m samples are drawn from the data distribution D; for brevity, the label y associated with each sample x is omitted; the adversarial example denoted as x' usually does not belong to the natural dataset S, and it is constrained ,in Defaults to ; Let the learning model be f(·), g(x) be the feature representation layer (the last hidden layer); For a given vector x, let x[i] be the i-th component of the vector; The loss function is expressed as , quantifies the cross entropy loss between f(x) and y by appropriate normalization; the Kullback-Leibler divergence is denoted as KL(·).

[0042] General adversarial training: The concept of adversarial training is mathematically expressed as a minimax optimization problem, which can be expressed as follows:

[0043]

[0044] where x' represents an adversarial example that causes the maximum loss within the ϵ sphere centered at the clean example x, which involves Norm distance; The main goal of adversarial training is to train the model to minimize the loss caused by adversarial examples, while the loss of clean examples is not explicitly prioritized.

[0045] More advanced adversarial training techniques, exemplified by TRADES, aim to strike a balance between clean accuracy and adversarial robustness through regularization:

[0046]

[0047] The first term helps improve accuracy, while the second term, controlled by the hyperparameter λ, serves as a regularization term for adversarial robustness; it effectively balances the output of clean samples and adversarial samples, promoting a trade-off between these two objectives.

[0048] In addition, during the training process of the neural network model, it is crucial to define the model type because it determines the model's structure, characteristics, and applicable scenarios. The following is a detailed breakdown of this step: clarify the specific problems that the neural network needs to solve, such as image classification, object detection, natural language processing, etc.; understand the size of the dataset, data type (such as images, text, audio, etc.), data distribution, and labeling. At this time, gain an in-depth understanding of the dataset through visualization, statistical summaries, etc.; based on the task requirements, clarify the model's performance indicators, such as accuracy, recall rate, F1 score, etc.

[0049] Based on the task requirements and dataset characteristics, select an appropriate neural network model type, such as a convolutional neural network (CNN), recurrent neural network (RNN), Transformer, or generative adversarial network (GAN). Determine key elements such as the model's hierarchical structure, number of neurons, activation function, and loss function. At this stage, balance model complexity and performance to avoid overfitting or underfitting. Ensure that the selected model type is compatible with deep learning frameworks (such as TensorFlow and PyTorch). Conduct preliminary experiments on small datasets or simplified tasks to verify the model's suitability. Evaluate model performance through methods such as cross-validation and holdout to ensure that the model type meets the task requirements.

[0050] In the adversarial training of neural network models, matching the appropriate adversarial training strategy is crucial. Different types of neural network models have different sensitivities to different types of adversarial attacks, so it is necessary to select or design corresponding adversarial training strategies based on the model type. At this time, it is important to understand the hierarchy, number of neurons, connection method, etc. of the neural network model; clarify the input data types processed by the model, such as images, text, audio, etc.; review the specific tasks that the model needs to solve, such as classification, regression, generation, etc.; understand the model's sensitivity to adversarial attacks through preliminary experiments or literature research; and be familiar with common adversarial attack types, such as FGSM, PGD, CW, etc., and their performance on different models.

[0051] Select an appropriate adversarial training strategy based on the characteristics of the neural network model. For example, for CNN models in image classification tasks, choose gradient-based adversarial training strategies such as FGSM or PGD. If necessary, design a new adversarial training strategy based on the specific needs of the model. For example, for RNN or Transformer models that process sequence data, it is necessary to consider adversarial attacks and defense strategies that take into account temporal dependencies. At this point, ensure that the method for generating adversarial samples matches the selected strategy and can effectively simulate potential adversarial attacks. During training, parameters such as the learning rate and batch size need to be adjusted to meet the needs of adversarial training.

[0052] Designing reasonable experiments to verify the effectiveness of adversarial training strategies usually involves adding adversarial examples to the training set and evaluating the model's performance on the test set (including clean and adversarial examples). Select appropriate performance metrics to evaluate the model's adversarial robustness, such as accuracy and robustness. During the experiment, control the intensity of the adversarial attack to ensure the reliability of the evaluation results. Due to the randomness of adversarial training, it is recommended to conduct multiple experiments and take the average to evaluate the model's performance.

[0053] Specifically, assume that adversarial training is being performed on a convolutional neural network (CNN) model for image classification; model architecture: the CNN model contains multiple convolutional layers, pooling layers, and fully connected layers; input data type: image data; task requirement: classify images; model sensitivity analysis: preliminary experiments found that the CNN model is relatively sensitive to FGSM attacks.

[0054] We choose FGSM as the adversarial training strategy because it is simple and effective and can simulate gradient-based adversarial attacks. During training, we use the FGSM method to generate adversarial examples and add them to the training set. We also reduce the learning rate appropriately to stabilize the training process.

[0055] A certain proportion of FGSM adversarial samples are added to the training set to train the model; then, the performance of the model is evaluated on the test set (including clean samples and FGSM adversarial samples); accuracy is used as the performance indicator; experimental results show that the accuracy of the CNN model after adversarial training on the test set is significantly improved, and its robustness to FGSM attacks is significantly enhanced; through this process, the corresponding adversarial training strategy is matched according to the type of neural network model, and its effectiveness is verified, which helps to improve the robustness and performance of the model in the face of potential adversarial attacks.

[0056] After determining the adversarial training strategy, the next step is to trigger adversarial training of the neural network model according to the strategy. This usually involves adjusting the training process to include the generation and use of adversarial samples, thereby enhancing the model's robustness to adversarial attacks. At this point, ensure that the training dataset has been preprocessed and is ready for training the neural network model. Based on the selected adversarial training strategy, implement an adversarial sample generator that will receive clean samples and model parameters as input and output adversarial samples.

[0057] Set key parameters in the training process, such as learning rate, batch size, number of training rounds, and the proportion of adversarial samples. Ensure that the neural network model architecture, loss function, optimizer, etc. have been configured according to the task requirements. At this point, select appropriate training parameters through experiments or literature research to optimize the model's performance. Ensure that the selected adversarial training strategy is compatible with the model's architecture and framework.

[0058] In each training batch, adversarial samples are injected into clean samples in a predetermined ratio to form a mixed training set; the model is trained using the mixed training set, and the model weights are updated through the back-propagation algorithm; at the same time, the proportion of adversarial samples should be adjusted according to the task requirements and model characteristics to avoid overfitting or underfitting; during the training process, the performance of the model on the validation set is regularly evaluated to monitor the improvement of overfitting and adversarial robustness.

[0059] After training, use a validation set containing clean samples and adversarial samples to evaluate the performance of the model. If available, use a test set to further verify the model's generalization ability and adversarial robustness. Select appropriate performance indicators to evaluate the model's adversarial robustness, such as accuracy, robustness indicators, and the success rate of adversarial samples. Conduct an in-depth analysis of the validation and testing results to understand the model's performance under different types of adversarial attacks.

[0060] Specifically, suppose that a convolutional neural network (CNN) model for image classification is being adversarially trained, and FGSM is selected as the adversarial training strategy; there is a preprocessed CIFAR-10 dataset containing 60,000 32x32 color images divided into 10 categories; an FGSM-based adversarial sample generator is implemented, which receives clean samples and model gradients as input and outputs adversarial samples; the learning rate is set to 0.001, the batch size is 128, the number of training rounds is 50, and the proportion of adversarial samples is 20%; a standard CNN architecture is used, consisting of multiple convolutional layers, pooling layers, and fully connected layers, using the cross entropy loss function and the Adam optimizer.

[0061] In each training batch, FGSM adversarial samples were injected into clean samples at a ratio of 20% to form a mixed training set; the model was trained using the mixed training set, and the model weights were updated through the backpropagation algorithm; a validation set containing clean samples and FGSM adversarial samples was used to evaluate the performance of the model; experimental results show that the accuracy of the CNN model after adversarial training on the validation set is significantly improved, and its robustness to FGSM attacks is significantly enhanced; the generalization ability and adversarial robustness of the model were further verified using the test set, and similar results were obtained; through this process, the adversarial training of the neural network model was successfully triggered according to the adversarial training strategy, and its effectiveness was verified, which helps to improve the robustness and performance of the model in the face of potential adversarial attacks.

[0062] In step S120, in the adversarial training of the neural network model, multiple mixed features in the neural network model are defined, and feature purification is performed on the multiple mixed features.

[0063] The specific steps are as follows:

[0064] Step S121, monitoring the adversarial training of the neural network model;

[0065] Step S122: performing feature traversal on the neural network model during adversarial training of the neural network model;

[0066] Step S123: defining a plurality of hybrid features based on feature traversal of the neural network model;

[0067] Step S124: trigger feature purification based on the multiple mixed features, and remove the multiple mixed features.

[0068] In an embodiment of the present application, the adversarial training of the neural network model is monitored and tracked in real time. At this time, during the adversarial training of the neural network model, feature traversal of the neural network model is performed, thereby defining multiple hybrid features based on the feature traversal of the neural network model, ensuring the screening of multiple hybrid features, so as to facilitate subsequent processing of the multiple hybrid features.

[0069] At this time, multiple mixed features are defined based on the feature traversal of the neural network model; feature purification is triggered based on the multiple mixed features, and the multiple mixed features are removed, thereby avoiding the influence of the multiple mixed features.

[0070] Specifically, feature purification is an important concept in adversarial training. It aims to improve the robustness of the model by eliminating the "dense mixture" in the feature space, making the features learned by the model simpler and more distinct.

[0071] During normal training, the features learned by the model often contain a mixture of features from multiple categories. These mixed features have little correlation with the individual inputs and do not affect normal classification results. However, using a small perturbation that is highly correlated with these mixed features can be sufficient to change the model's classification results. This is the essence of adversarial examples. Therefore, the goal of adversarial training is to guide the model to remove these mixed features, making the learned features more simple.

[0072] Through adversarial training, the features learned by the model become more distinct, better able to distinguish between objects of different categories. Furthermore, adversarial training can improve the model's adversarial resistance, making it more robust to adversarial examples. Although adversarial training requires significant time and computing resources and can result in reduced model accuracy, improving adversarial robustness is still considered worthwhile in academic research.

[0073] Furthermore, in the adversarial training of the neural network model, defining multiple mixed features in the neural network model and performing feature purification on the multiple mixed features also includes:

[0074] In the feature purification stage of multiple mixed features,;

[0075] Input data generated by sparse coding:

[0076] The corresponding relationship between weight and data basis:

[0077] Where x is the input data generated by the sparse coding model; z is a random hidden vector; ξ is a random noise; is the hidden weight; As the data foundation; It is a mixed term, which is a mixture of other features.

[0078] At this point, feature purification in adversarial training: the adversarial training phase does not learn new robust features or remove existing non-robust features, but purifies these mixed terms. , and compare it with the main features The goal of adversarial training is to eliminate these mixed terms and make the model more robust to adversarial examples.

[0079] In addition, monitor the changes in the loss function during training to understand how well the model fits the data; calculate the accuracy of clean samples and adversarial samples on the validation set to evaluate the model's generalization ability and adversarial robustness; such as the success rate of adversarial samples, the average perturbation size of the model, etc., to quantify the model's resistance to adversarial attacks.

[0080] Use the logging function provided by the deep learning framework to record key indicators such as loss value and accuracy for each training round; save the model weights and checkpoints corresponding to the best performance for subsequent analysis and model recovery; use tools such as TensorBoard and Matplotlib to visualize key indicators in the training log, such as loss curves and accuracy curves; use visual charts to quickly identify anomalies or performance bottlenecks in the training process.

[0081] If the performance on the validation set does not improve significantly over multiple consecutive rounds, consider terminating training early to avoid overfitting. Set a performance improvement threshold, and trigger early stopping when the validation set performance improvement falls below this threshold. At the same time, dynamically adjust training parameters such as learning rate and batch size based on monitoring data to optimize the training process. Use a learning rate scheduler, such as cosine annealing and step decay, to automatically adjust the learning rate according to the training round.

[0082] Determine which network layers to extract features from; typically, the outputs of convolutional layers, pooling layers, or fully connected layers are selected as features; consider the interpretability of the features and their relevance to the task, and select the feature layer that is most helpful for analysis; at this point, for each input sample, calculate the feature output of the selected layer through the forward propagation of the network; save the feature output as a tensor or array for subsequent analysis; traverse all samples in the training set or validation set to extract the features of each sample; selectively use adversarial samples for feature extraction to compare the differences between clean samples and adversarial samples in the feature space.

[0083] Use dimensionality reduction techniques (such as PCA and t-SNE) to project high-dimensional features into low-dimensional space for visualization; display feature distribution and correlation through visual charts (such as scatter plots and heat maps); analyze the interpretability of features, that is, whether the features are associated with human-understandable attributes; evaluate the importance of features, that is, the degree to which the features contribute to model decisions; identify redundant or irrelevant features to provide a basis for subsequent feature selection or purification.

[0084] Specifically, suppose that a convolutional neural network (CNN) model for image classification is being adversarially trained, and FGSM is selected as the adversarial attack strategy; the following is a specific feature traversal example: the output of the last convolutional layer is selected as the feature. This layer usually contains rich spatial information and high-level features, which helps to understand how the model processes the input image; for each sample in the training set, the output of the last convolutional layer is calculated through the forward propagation of the network and saved as a tensor; at the same time, feature extraction is also performed on the FGSM adversarial sample to compare the differences between the two in the feature space.

[0085] The entire training set was traversed and features were extracted for each sample; in order to analyze the impact of adversarial samples, features of adversarial samples were specifically extracted; t-SNE was used to project the extracted features from high-dimensional space to two-dimensional space, and a scatter plot was drawn; in the scatter plot, the distribution of clean samples and adversarial samples in the feature space was seen; by comparing the two, it was found that the adversarial samples had significant changes in some feature dimensions, and these changes were related to the adversarial robustness of the model; the interpretability and importance of the features were further analyzed; through visual feature graphs and correlation analysis, it was found that some features were associated with human-understandable attributes (such as edges, textures), while other features were related to high-level abstractions of model decisions; at the same time, some redundant or irrelevant features were identified, which contributed less to the model decision and were removed in the subsequent feature selection or purification process.

[0086] Select representative, relevant and important features from the features extracted by feature traversal; consider the complementarity between features and select features that can jointly describe multiple aspects of the input data; combine the selected features to form hybrid features; the combination methods include concatenation, weighted summation, nonlinear transformation (such as ReLU, Sigmoid), etc.; design the structure of the hybrid features according to the task requirements and feature attributes; for example, for image classification tasks, combine low-level spatial features with high-level semantic features to capture richer image information.

[0087] If the dimension of the mixed features is too high, consider using dimensionality reduction techniques (such as PCA and Autoencoder) to reduce the dimension to reduce computational complexity and avoid overfitting; introduce the mixed features into subsequent layers of the model and retrain the model to evaluate the effect of the mixed features; adjust the design of the mixed features based on the training results to optimize model performance.

[0088] Use correlation analysis, importance scoring, or model selection methods (such as Lasso regression, random forest feature importance) to evaluate the contribution of each hybrid feature to model performance; determine which features are redundant, irrelevant, or have a negative impact on model decisions; based on the evaluation results, remove those unfavorable hybrid features; gradually remove features, retrain the model after each removal and evaluate performance to determine which features have a positive impact on model performance.

[0089] After removing unfavorable mixed features, redesign the model structure, including adjusting the number of layers, the number of neurons, and the connection method; ensure that the new model structure can make full use of the remaining effective features and maintain a balance between the complexity and generalization ability of the model; at the same time, use the validation set or test set to evaluate the performance of the purified model to ensure that removing features will not significantly reduce the accuracy or robustness of the model; if the performance declines, it is necessary to re-examine the feature purification process and consider retaining some previously removed features; feature purification and model reconstruction is an iterative process, which requires multiple attempts and adjustments to find the optimal model structure; during the iterative process, new features or mixed features are continuously introduced, and feature purification and removal are performed again.

[0090] In step S130, a correlation matrix is ​​formed based on the features in the neural network model, and hierarchical clustering is performed on the correlation matrix to construct a dendrogram.

[0091] The specific steps are as follows:

[0092] Step S131, collecting various features in the neural network model;

[0093] Step S132: forming a correlation matrix based on each feature, wherein each element in the matrix represents the correlation between corresponding features;

[0094] Step S133: trigger hierarchical clustering according to the correlation matrix and construct a dendrogram.

[0095] In the embodiments of the present application, in the process of optimizing and analyzing the neural network model, collecting various features in the model is a key step. These features come from the input layer, hidden layer or output layer, and they are crucial for understanding the decision-making process of the model, diagnosing model problems and optimizing model performance.

[0096] First, it is necessary to clarify which layers to extract features from. Typically, the features of the input layer are raw data, while the features of the hidden and output layers are representations learned by the model. Select representative and explanatory features based on the task requirements and model structure. For convolutional neural networks (CNNs), extract feature maps from the convolutional layers and activation values ​​from the fully connected layers. For recurrent neural networks (RNNs) or long short-term memory networks (LSTMs), extract features from the hidden states or output layers. For feedforward neural networks (FNNs), usually extract features from the hidden layers or output layers.

[0097] The extracted features need to be saved in an appropriate format for subsequent analysis; commonly used formats include NumPy arrays, Pandas DataFrames, or TensorFlow / PyTorch tensors; if the dataset is large, features need to be extracted in batches to avoid memory overflow; use data loaders and batch processing techniques to extract features efficiently; save feature metadata, such as feature name, source layer, extraction method, etc., so that these features can be easily identified and understood during subsequent analysis.

[0098] Specifically, suppose that feature collection is being performed on a convolutional neural network (CNN) model for image classification; input layer: accepts 224x224x3 RGB images; convolution layer 1 (Conv1): outputs 64 7x7 feature maps; pooling layer 1 (Pool1): performs 2x2 maximum pooling on the output of Conv1; convolution layer 2 (Conv2): outputs 128 3x3 feature maps; pooling layer 2 (Pool2): performs 2x2 maximum pooling on the output of Conv2; fully connected layer 1 (FC1): outputs 4096 neurons; fully connected layer 2 (FC2): outputs 1000 neurons (corresponding to 1000 categories).

[0099] It was decided to extract features from the four layers Conv1, Conv2, FC1 and FC2; for Conv1 and Conv2, extract the feature maps and flatten them into one-dimensional vectors; for FC1 and FC2, directly extract the activation values; use a NumPy array to save the features of each sample; for Conv1 and Conv2, since the feature maps are two-dimensional (height x width x number of channels), flatten them into one-dimensional vectors and append them to the corresponding positions of the NumPy array; for FC1 and FC2, the activation values ​​are already one-dimensional and are directly appended to the end of the NumPy array.

[0100] Create a Pandas DataFrame to store feature metadata, including feature name (such as "Conv1_feature_map" and "FC1_activation"), feature dimension, source layer, and other information. This yields a NumPy array containing the features extracted from Conv1, Conv2, FC1, and FC2 for each sample. Also, a Pandas DataFrame records the metadata for these features. This example shows that collecting features from a neural network model requires careful consideration of the feature source, extraction method, storage format, and metadata recording. These steps ensure the effective extraction, storage, and understanding of the model's features, providing a foundation for subsequent analysis and optimization.

[0101] The feature data extracted from the neural network model must be organized into an appropriate format, such as a two-dimensional array or PandasDataFrame, where rows represent samples and columns represent features. Ensure that data cleaning and preprocessing are completed, including missing value processing, outlier detection and processing, etc. At the same time, choose an appropriate correlation measurement method based on the data type and the relationship between features. Commonly used methods include the Pearson correlation coefficient (applicable to linear relationships between continuous variables), the Spearman rank correlation coefficient (applicable to hierarchical data or data that does not meet the normal distribution assumption), and mutual information (applicable to nonlinear relationships).

[0102] Using the selected correlation measure method, the correlation coefficients between feature pairs are calculated; the obtained coefficients will constitute the elements of the correlation matrix, and the dimension of the matrix is ​​consistent with the number of features; the calculated correlation coefficients are arranged in the order of features to form a correlation matrix; each element in the matrix represents the correlation coefficient between the corresponding features; the correlation matrix is ​​visualized using tools such as heat maps and matrix plots to more intuitively show the correlation between features; set color mapping to distinguish positive correlation, negative correlation, and correlation strength.

[0103] Analyze the correlation matrix to identify pairs of features with high correlation, which reflect redundancy or potential relationships in the data; pay attention to the diagonal elements of the matrix, which should be close to 1 (indicating the correlation between the feature and itself) and can be used as a reference to verify the correctness of the calculation.

[0104] Specifically, there is a neural network model with 5 features, which are represented as F1, F2, F3, F4 and F5 respectively. The following is a specific example of constructing a correlation matrix: a data set containing 100 samples is extracted from the model, each sample has 5 eigenvalues; the data has been cleaned and preprocessed, with no missing values ​​or outliers; considering that the features are continuous variables and there are nonlinear relationships, mutual information is selected as the correlation measurement method.

[0105] , 0.10, 1.00, 0.02], [0.05, 0.60, 0.35, 0.02, 1.00]]; Save the correlation coefficient matrix as a two-dimensional array or Pandas. DataFrame for subsequent analysis; use Python's seaborn library or matplotlib library to draw heat maps to show the correlation between features; the color mapping of the heat map can be set as needed, usually positive correlation is represented by warm colors, negative correlation is represented by cool colors, and the color depth reflects the strength of the correlation.

[0106] Analyzing the heat map, we found that there is a high correlation (0.80) between F1 and F4, indicating that these two features are redundant in the data; there is also a high correlation (0.60) between F2 and F5, but compared with F1 and F4, their correlation is weaker; the diagonal elements of the matrix are all 1, indicating that the correlation between the features and themselves is correctly calculated; through the above steps, the correlation matrix between features was successfully constructed, and visualization and result interpretation were performed, providing an important basis for subsequent feature selection, dimensionality reduction or model optimization.

[0107] Make sure you have calculated the correlation matrix based on the features. Each element in the matrix represents the correlation coefficient between a pair of features. The correlation matrix should be symmetrical, and the diagonal elements are usually 1 (indicating the correlation between the feature and itself). In hierarchical clustering, it is necessary to define the distance or similarity between features. Since you already have a correlation matrix, convert it directly to a distance matrix (if the correlation matrix uses the correlation coefficient, calculate the distance by subtracting the correlation coefficient from 1). You can also choose other distance measurement methods, such as Euclidean distance, Manhattan distance, etc., but here we mainly focus on how to use the existing correlation matrix.

[0108] There are two main approaches to hierarchical clustering: agglomerative and divisive. In agglomerative methods, each feature is initially treated as a separate cluster, and the most similar clusters are progressively merged until a stopping criterion is met (such as reaching a predetermined number of clusters or the distance between clusters exceeds a certain threshold). Here, we will use the agglomerative approach for hierarchical clustering. Using the selected distance metric and clustering method, we hierarchically cluster the features in the correlation matrix.

[0109] During the clustering process, a tree structure (dendrogram) is generated that represents the order in which features are merged. The dendrogram (also called a clustering tree or tree structure) intuitively shows the hierarchical relationship and merging order between features. Each node in the dendrogram represents a cluster, with leaf nodes corresponding to individual features and internal nodes corresponding to clusters formed by merging operations. The height of the dendrogram represents the distance or similarity at the time of merging, with a higher merging distance meaning greater differences between clusters. The dendrogram is analyzed to identify the hierarchical structure and groupings between features. As needed, the dendrogram is cut at a certain height to form a group with a specific number of clusters.

[0110] In step S140 , different cluster groups are formed according to the dendrogram, and each cluster group is assigned to a corresponding neuron.

[0111] The specific steps are as follows:

[0112] Step S141, collecting a tree diagram;

[0113] Step S142: cutting the tree diagram at a specific similarity threshold to form different cluster groups;

[0114] Step S143: associate each cluster group with the neuron; and assign each cluster group to a corresponding neuron.

[0115] At this point, use a hierarchical clustering algorithm (such as agglomerative hierarchical clustering) to analyze the feature dataset. The algorithm will generate a dendrogram, which shows the merging order and relative distances between features in a tree-like structure. Carefully examine the generated dendrogram, paying attention to the merging points (i.e., nodes) between features and the heights of these nodes (representing distance or similarity). Analyze the hierarchical structure of the dendrogram to understand how features are gradually merged into larger clusters. Based on the purpose of the analysis and the characteristics of the dataset, confirm whether the dendrogram accurately reflects the hierarchical relationship between features. If the dendrogram looks reasonable and meets expectations, collect it and use it as the basis for subsequent analysis.

[0116] When collecting a dendrogram, we also need to consider potential cut points. These points are locations on the dendrogram where a specific height (or distance threshold) is selected for cutting to form different cluster groups. When selecting cut points, we need to balance the number of clusters (that is, the number of clusters obtained after cutting) and the similarity within each cluster.

[0117] Before cutting, you first need to determine a similarity threshold. This threshold represents the minimum similarity level between features that are considered "similar enough" to be classified into the same cluster. The selection of the similarity threshold is usually based on the characteristics of the data, the purpose of the analysis, and domain knowledge. Too high a threshold leads to too many cluster groups, while too low a threshold merges too many features, thus losing the meaning of cluster analysis.

[0118] The determined similarity threshold is converted into a height (or distance) value on the dendrogram; in the dendrogram, the height represents the distance between features or the inverse of the similarity (i.e., the greater the distance, the lower the similarity); a height line corresponding to the similarity threshold is found on the dendrogram, and this line will serve as the basis for cutting; cutting is performed along the height line located on the dendrogram; the cutting operation divides the dendrogram into multiple branches, each branch representing a cluster group; after cutting, each cluster group contains all features located in the same branch on the dendrogram, which exceed the selected threshold in similarity and are therefore classified into the same cluster group.

[0119] Based on the cutting results, the features are assigned to different cluster groups; each cluster group contains a group of features that are relatively close in similarity; the member features of each cluster group are recorded for subsequent analysis and interpretation.

[0120] In step S150, each neuron is associated with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

[0121] The specific steps are as follows:

[0122] Step S151: Associating each neuron with a cluster group to output an indicator matrix;

[0123] Step S152: introducing a Gaussian random variable and a spherical Gaussian variable into the indicator matrix;

[0124] Step S153: guiding adversarial training based on the Gaussian random variable and the spherical Gaussian variable pair indicator matrix to enhance the adversarial robustness of the neural network model.

[0125] In an embodiment of the present application, the feature layer correlation regularization term is a regularization method for guiding adversarial training, which aims to guide the model learning process by introducing relevant random variables, thereby improving the adversarial performance of the model.

[0126] Idea: Assume that neurons in the same group extract common features from the input data, so if they belong to the same group, it is designed to enhance and On the contrary, if they are not in the same group, it promotes and independence.

[0127] Furthermore, the method of associating each neuron with a cluster group and introducing Gaussian random variables and spherical Gaussian variables to guide adversarial training to enhance the adversarial robustness of the neural network model also includes:

[0128] Gaussian variables:

[0129]

[0130] in is a hyperparameter used to balance the weight between the regularization term and the adversarial training loss; is a spherical Gaussian variable.

[0131] Regularization is also applied to the TRADES scheme, namely:

[0132]

[0133] This loss function can be used to improve the adversarial performance of the model in adversarial training without the need for additional data. It can effectively improve the feature purification effect of the model, clearly distinguish feature mixtures, and eliminate redundant features, which is expected to enhance the adversarial robustness of deep neural network models.

[0134] At this time, adversarial training is performed on the neural network model to facilitate adversarial training of the neural network model. At the same time, feature purification is performed on multiple mixed features, each cluster group is assigned to the corresponding neuron, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training, so as to effectively improve the feature purification effect of the neural network model, clearly distinguish feature mixtures, and eliminate redundant features to enhance the adversarial robustness of the neural network model.

[0135] Specifically: First, we evaluate the sensitivity of our method to various hyperparameters. Next, we conduct a comprehensive evaluation of its robustness across benchmark datasets. This evaluation covers a range of adversarial attacks, including white-box attacks and automated attacks (AA). The focus of the experiment is extended to using and Threat models are analyzed to provide a broad perspective on the robustness of the approach.

[0136] The adversarial training experiment uses the ResNet-18 architecture The model processes the CIFAR-10 / 100 dataset and also extends the training to include WideResNet for CIFAR-10 / 100.

[0137] During the experimental evaluation process, it is necessary to evaluate the robustness of the model trained by the invention against various adversarial attacks, including white-box attacks and automatic attack methods. Two benchmark white-box attacks are used to evaluate the robustness of the model, namely PGD-40 and CW-40, where CW-40 represents the CW loss optimized using PGD-40. version. We employ AutoAttack (AA), a composite attack strategy that combines various parameter-free attacks, including three white-box attacks (APGD-CE, APGD-DLR, and FAB) and a black-box attack, the Square Attack. This multi-pronged approach comprehensively evaluates the robustness of the model in real-world scenarios.

[0138] Using WideResNet on CIFAR-10 and CIFAR-100 datasets The results show that both clean accuracy and robust accuracy are enhanced when no additional dataset is used during training and when additional data from DDPM is incorporated.

[0139] refer to Figure 8 Some embodiments of the present application further provide an adversarial training device 200 based on a neural network model, characterized by comprising:

[0140] The acquisition module 210 is used to acquire the neural network model and perform adversarial training on the neural network model;

[0141] A feature purification module 220 is used to define multiple mixed features in the neural network model and perform feature purification on the multiple mixed features during adversarial training of the neural network model;

[0142] a dendrogram module 230 for forming a correlation matrix based on features in the neural network model and performing hierarchical clustering on the correlation matrix to construct a dendrogram;

[0143] an allocation module 240 for forming different cluster groups according to the dendrogram and allocating each cluster group to a corresponding neuron;

[0144] The adversarial training module 250 is used to associate each neuron with a cluster group, and introduces Gaussian random variables and spherical Gaussian variables to guide adversarial training to enhance the adversarial robustness of the neural network model.

[0145] The methods and / or embodiments in the embodiments of the present application are implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the method shown in the flowchart. When the computer program is executed by a processing unit, the above-described functions defined in the method of the present application are performed.

[0146] It should be noted that the computer-readable medium described in this application is a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable media include, but are not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable medium is any tangible medium containing or storing a program that is used by or in conjunction with an instruction execution system, device, or component.

[0147] In the present application, a computer-readable signal medium includes a data signal propagated in baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal takes a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium is also any computer-readable medium other than a computer-readable storage medium, which sends, propagates, or transmits a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium is transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0148] Computer program code for performing the operations of the present application is written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code is executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer is connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or is connected to an external computer (e.g., via the Internet using an Internet service provider).

[0149] The flow chart or block diagram in the accompanying drawings illustrate the architecture, function and operation of the implementation of the device, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram represents a module, program segment or a part of code, and the module, program segment or a part of code comprises one or more executable instructions for realizing the logical function of the specification. It should also be noted that in some alternative implementations, the functions marked in the box also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession are actually executed substantially in parallel, and they are sometimes also executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart, are implemented by a dedicated hardware-specific system that performs the function or operation of the specification, or are implemented by a combination of dedicated hardware and computer instructions.

[0150] As another aspect, embodiments of the present application further provide a computer-readable medium, which is included in the device described in the above embodiments; this computer-readable medium also exists independently and is not incorporated into the device. The above computer-readable medium carries one or more computer-readable instructions, which can be executed by a processor to implement the steps of the methods and / or technical solutions of the above embodiments of the present application.

[0151] In a typical configuration of the present application, the terminal and the equipment of the service network each include one or more processors (CPUs), input / output interfaces, network interfaces and memories.

[0152] Memory includes non-permanent storage in a computer-readable medium in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0153] Computer-readable media includes both permanent and non-permanent, removable and non-removable media, implemented by any method or technology for information storage. Information is computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc-read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessed by a computing device.

[0154] In addition, an embodiment of the present application further provides a computer program, which is stored in a computer device, so that the computer device executes the method for controlling code execution.

[0155] It should be noted that the present application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In some embodiments, the software program of the present application is executed by a processor to implement the above steps or functions. Similarly, the software program of the present application (including related data structures) is stored in a computer-readable recording medium, such as a RAM memory, a magnetic or optical drive, a floppy disk, and the like. In addition, some steps or functions of the present application can be implemented in hardware, for example, as a circuit that cooperates with a processor to perform the various steps or functions.

[0156] It is obvious to those skilled in the art that the present application is not limited to the details of the above-mentioned exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the spirit or basic characteristics of the present application. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-restrictive, and the scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes that fall within the meaning and scope of the equivalent elements of the claims are included in the present application. Any figure mark in the claims should not be regarded as limiting the claims involved. In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the device claim are also implemented by one unit or device through software or hardware. Words such as first and second are used to indicate names and do not indicate any particular order.

Claims

1. A neural network model-based adversarial training method, characterized in that: Applied to neural network scenarios, the adversarial training method based on the neural network model includes: Collect neural network models and perform adversarial training on the neural network models; In the adversarial training of the neural network model, multiple mixed features in the neural network model are defined and feature purification is performed on the multiple mixed features; Forming a correlation matrix based on the features in the neural network model and performing hierarchical clustering on the correlation matrix to construct a dendrogram; Different cluster groups are formed according to the dendrogram, and each cluster group is assigned to the corresponding neuron; Each neuron is associated with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

2. The adversarial training method based on a neural network model according to claim 1, characterized in that: The collecting of the neural network model and performing adversarial training on the neural network model include: Collect neural network models and trigger the training of neural network models; In the training of the neural network model, define the type of the neural network model; Match the corresponding adversarial training strategy according to the type of neural network model; Trigger adversarial training of neural network models according to the adversarial training strategy.

3. The adversarial training method based on a neural network model according to claim 2, characterized in that: In the adversarial training of the neural network model, multiple mixed features in the neural network model are defined, and feature purification is performed on the multiple mixed features, including: Monitor adversarial training of neural network models; In the adversarial training of the neural network model, the feature traversal of the neural network model is performed; Defining multiple hybrid features based on feature traversal of a neural network model; Feature purification is triggered based on multiple mixed features, and multiple mixed features are removed.

4. The adversarial training method based on a neural network model according to claim 1, characterized in that: In the adversarial training of the neural network model, multiple mixed features in the neural network model are defined, and feature purification is performed on the multiple mixed features, further comprising: In the feature purification stage of multiple mixed features,; Input data generated by sparse coding: The corresponding relationship between weight and data basis: Where x is the input data generated by the sparse coding model; z is a random hidden vector; ξ is a random noise; is the hidden weight; As the data foundation; is a mixed term, which is a mixture of other features.

5. The adversarial training method based on a neural network model according to claim 4, characterized in that: The features in the neural network model are used to form a correlation matrix, and the correlation matrix is ​​hierarchically clustered to construct a dendrogram, including: Collect various features in the neural network model; A correlation matrix is ​​formed based on each feature, wherein each element in the matrix represents the correlation between corresponding features; Trigger hierarchical clustering based on the correlation matrix and build a dendrogram.

6. The adversarial training method based on a neural network model according to claim 5, characterized in that: The forming of different cluster groups according to the dendrogram and assigning each cluster group to a corresponding neuron includes: Collection dendrogram; According to the dendrogram, the clusters are cut at a specific similarity threshold and different cluster groups are formed.

7. The adversarial training method based on a neural network model according to claim 6, characterized in that: The forming of different cluster groups according to the dendrogram and assigning each cluster group to a corresponding neuron further includes: Associate the various cluster groups and neurons; Each cluster group is assigned to the corresponding neuron.

8. The adversarial training method based on a neural network model according to claim 7, characterized in that: The method associates each neuron with a cluster group and introduces Gaussian random variables and spherical Gaussian variables to guide adversarial training to enhance the adversarial robustness of the neural network model, including: Associate each neuron with a cluster group to output an indicator matrix; Introducing Gaussian random variables and spherical Gaussian variables into the indicator matrix; Adversarial training is guided based on Gaussian random variables and spherical Gaussian variables to indicator matrices to enhance the adversarial robustness of neural network models.

9. The adversarial training method based on a neural network model according to claim 8, characterized in that: The method associates each neuron with a cluster group, introduces Gaussian random variables and spherical Gaussian variables to guide adversarial training, and enhances the adversarial robustness of the neural network model. The method also includes: Gaussian variables: in is a hyperparameter used to balance the weight between the regularization term and the adversarial training loss; is a spherical Gaussian variable.

10. An adversarial training device based on a neural network model, comprising: The acquisition module is used to acquire the neural network model and perform adversarial training on the neural network model; The feature purification module is used to define multiple mixed features in the neural network model and perform feature purification on the multiple mixed features during the adversarial training of the neural network model; The dendrogram module is used to form a correlation matrix based on the features in the neural network model and perform hierarchical clustering on the correlation matrix to construct a dendrogram; An allocation module, used to form different cluster groups according to the dendrogram and allocate each cluster group to a corresponding neuron; The adversarial training module is used to associate each neuron with a cluster group, and Gaussian random variables and spherical Gaussian variables are introduced to guide adversarial training to enhance the adversarial robustness of the neural network model.

Images