Adaptive optimization framework of neural network robust precision trade-off learning

Abstract

The invention discloses an adaptive optimization framework for robust precision trade-off learning of a neural network, which is characterized by comprising the following steps of: dividing training into a plurality of training stages according to each K cycles, evaluating the neural network of each stage through a designed fitness function, adaptively obtaining an attack strategy most suitable for the current stage, and obtaining the attack strategy of the current stage. The method is used for training a neural network in the next stage, and a self-adaptive adversarial training framework TRA2SO is integrally established. According to the method, the model learns attack intensity required by robustness improvement in different stages, the anti-robustness of the model is finally improved, the prediction accuracy of the network on a clean sample is sacrificed as little as possible, and meanwhile, the model is prevented from being over-fitted according to the evaluation information, so that the model can stop early.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of neural network robust precision trade-off learning, in particular to an adaptive optimization framework for neural network robust precision trade-off learning. BACKGROUND

[0002] The discovery of adversarial examples is an important breakthrough in the field of deep learning security. The pioneering research by Szegedy et al. in 2013 showed that by adding a human visually imperceptible perturbation to the input sample, a deep neural network (DNN) can output an incorrect classification result with high confidence. This phenomenon reveals that the decision boundary of DNN has highly nonlinear fragile regions in the input space. To address this security threat, Goodfellow et al. proposed the fast gradient sign method (FGSM) in 2014, which generates adversarial samples through single-step gradient backpropagation, and first proposed using adversarial samples for model training (i.e., adversarial training) to improve robustness.

[0003] Madry et al. established a mathematical framework for adversarial training in 2017, which is formalized as a minimax optimization problem:

[0004]

[0005] where the inner maximization problem solves the adversarial perturbation δ by projected gradient descent (PGD), and the outer minimization problem updates the model parameters W. This framework uses alternating optimization, i.e., in each training cycle, adversarial samples are first generated, and then the model parameters are updated. This method is widely used in subsequent research (such as TRADES, MART) and has become the basic paradigm for current adversarial training.

[0006] In recent years, to address the high computational cost of standard adversarial training, researchers have proposed several improvement schemes:

[0007] 1. Dynamic adversarial training: FreeAT proposed by Shafahi et al. reduces the overhead of adversarial sample generation by reusing gradient computation, increasing the training speed by about 40%. FastAT by Wong et al. further proves that single-step attacks (such as FGSM) combined with random initialization can achieve robustness comparable to multi-step attacks, but this method is still limited by the fixed adversarial strength strategy.

[0008] 2. Adaptive perturbation generation: Zhang et al. proposed in CVPR 2019 to dynamically adjust the perturbation step size α and the number of iterations K, and adaptively control the complexity of adversarial samples according to the current model state. However, this method relies on pre-set heuristic rules and fails to establish a quantitative relationship between adversarial strength and training progress.

[0009] 3. High-efficiency optimization architecture: Rice et al. pointed out in ICML 2020 that traditional alternating optimization leads to Delayed Coupling between adversarial sample generation and model updating, and proposed an Early Stopping strategy to balance the computational cost and robustness. However, this method lacks the ability to adaptively divide the training phase.

[0010] Despite the progress made by the above methods, there are still the following key defects:

[0011] 1. Lack of process monitoring: Existing methods rely on empirical epoch division, lack real-time quantitative evaluation of model robustness gain and adversarial intensity saturation (such as undefined dynamic convergence indicators), resulting in blindness of early stopping strategy or intensity adjustment.

[0012] 2. Computational efficiency limitation: In the alternating optimization framework, adversarial sample generation accounts for 60%-75% of the overall computational load, especially in the later stages of model convergence, a large amount of computation is wasted in generating invalid adversarial samples (i.e. samples that cannot further improve robustness).

[0013] 3. Sample generation rigidity: The parameter settings (such as ∈ = 8 / 255) of existing adversarial sample generation strategies (such as FGSM / PGD) are mostly empirical values, and the attack strategy cannot be dynamically adjusted according to the current defense ability of the model, resulting in the attack success rate of some adversarial samples being lower than the threshold in the later training period.

[0014] The existing adaptive adversarial training methods have the following shortcomings

[0015] The training process cannot be effectively monitored, and the progress of adversarial training cannot be accurately estimated.

[0016] The overall training time cost is high, and the efficiency is not high.

[0017] In the training process, the effectiveness of adversarial samples cannot be guaranteed, and the complexity and diversity are low.

[0018] The existing adaptive adversarial training methods mainly have the following technical defects to be optimized:

[0019] 1. Lack of quantitative monitoring mechanism in the training process, leading to inaccurate evaluation of adversarial training progress

[0020] The prior art does not establish a real-time quantitative evaluation system for adversarial training, mainly relying on empirical manual observation and offline testing for progress judgment. Due to the dynamic game characteristics of adversarial training (continuous interaction and evolution of model parameters and adversarial samples), traditional static evaluation indicators cannot accurately reflect the dynamic balance state of the adversarial strength in the training process. The lack of such monitoring methods makes the training phase fuzzy, making it difficult to adjust the adversarial sample generation strategy in a timely manner, resulting in a lagging deviation in the model optimization direction.

[0021] 2. Iterative training architecture is inefficient, significantly increasing time cost

[0022] The current method mainly uses an alternating training mechanism (internal loop to generate adversarial samples, external loop to update model parameters), which results in more computational resource consumption in repeated generation of adversarial samples. More seriously, existing algorithms generally use a fixed adversarial strength strategy (such as a pre-set maximum perturbation range), which causes waste of computational resources in the early stage of training due to excessive pursuit of high adversarial strength, and a sharp decline in convergence speed in the later stage of training due to insufficient adversarial strength, resulting in a higher overall training time than the theoretical optimal value.

[0023] 3. There are performance defects in the adversarial sample generation mechanism, and the coverage is insufficient

[0024] Current adversarial sample generation mainly relies on pre-defined attack modes such as FGSM and PGD, and the strategy space is limited by manually set prior parameters (such as step size and iteration number). This static generation method leads to:

[0025] On the effectiveness level, the matching degree of the generated adversarial samples with the current defense capability of the model is insufficient, and part of the samples lose attack effectiveness in the later stage of training;

[0026] On the complexity level, the single sample generation strategy is difficult to adapt to the vulnerability characteristics of the model in different training stages;

[0027] On the diversity level, the adversarial samples generated by the existing method have insufficient coverage of the decision boundary, restricting the improvement space of the robustness of the model.

[0028] The root cause of these technical defects is that the existing method fails to establish a state-aware system for the training process, lacks a dynamic resource allocation mechanism, and the adversarial sample generation strategy is mismatched with the model evolution stage. The specific manifestations are that the lack of monitoring dimension leads to uncontrolled training, the rigid allocation of computational resources leads to efficiency loss, the single sample generation strategy limits the development of the model's defense capability, and ultimately affects the overall effect and practical value of adversarial training. SUMMARY

[0029] To solve the above problems, the present application provides an adaptive optimization framework for neural network robustness precision trade-off learning. The present application is realized by the following technical solutions.

[0030] The adaptive optimization framework of neural network robust precision trade-off learning comprises: dividing the training into multiple training stages according to every K cycles, evaluating the neural network of each stage through the designed fitness function, adaptively obtaining the attack strategy most suitable for the current stage for the training of the neural network of the next stage, and establishing an adaptive adversarial training framework TRA as a whole 2 SO, specifically comprising the following steps:

[0031] S1, initializing a neural network f(x, w);

[0032] S2, designing a fitness function;

[0033] S3, evaluating the neural network;

[0034] S4, obtaining an adversarial sample by using a PGD attack method according to the attack strategy a suitable for the current training stage, and using the adversarial sample as a training set for the training of the neural network.

[0035] Further, in the step S1, the corresponding fitness function curve can be obtained when the current neural network is evaluated each time, and whether a more advantageous attack strategy for adversarial training can be found in the current strategy space can be judged by observing the change trend.

[0036] Further, in the step S2, the fitness function comprises two parts: a robustness evaluation part and a precision retention part, and the fitness function comprises two parts: a robustness evaluation part and a precision retention part, when evaluating the strategy in the strategy space, the current stage neural network is virtually updated after generating an adversarial sample by using the strategy, and the robustness evaluation part calculates the accuracy of classifying the adversarial sample under the standard adversarial strategy for the updated neural network, and the precision retention part aims to calculate the accuracy of classifying clean samples.

[0037] Further, the robustness evaluation part and the precision retention part have fixed weights at each evaluation, and the strategy output by the fitness function after evaluating the strategy space at different stages of neural network training is used to improve the robustness and clean accuracy of the model.

[0038] Further, in the step S3, the following step is further included: evaluating the neural network of the current stage every K training cycles, the purpose being to find an attack strategy a more suitable for the current training stage for the training of the next K training cycles.

[0039] Further, in the step S4, the following step is further included: the attack intensity, step length and step number change in the attack strategies obtained through different stages of optimization can explain the change of the robust accuracy.

[0040] Compared with the prior art, the present application has the beneficial effects that:

[0041] The present application enables the model to learn the attack strength required for robust improvement at different stages, ultimately improves the adversarial robustness of the model, and as little as possible sacrifices the prediction accuracy of the network on clean samples, while preventing the model from overfitting according to the evaluation information, so that the model can be stopped early. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the present application, the drawings needed in the specific implementation description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0043] Figure 1 is the overall flowchart;

[0044] Figure 2 is the robust accuracy (%) of each strategy on CIFAR-10;

[0045] Figure 3 is the clean accuracy (%) of each strategy on CIFAR-10;

[0046] Figure 4 is the TRA of each stage of training 2 SO attack strategy optimization results on CIFAR-10 (attack strength and attack step multiplied by 255);

[0047] Figure 5 is the TRA 2 SO on CIFAR-10, the optimal individual fitness function of each evolution changes;

[0048] Figure 6 is the model test accuracy (%) comparison of each adversarial training method on CIFAR-10 data;

[0049] Figure 7 is the model test accuracy (%) comparison of each adversarial training method on CIFAR-10 data. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0051] Embodiment 1

[0052] As Figures 1-5 shown, the embodiment provides an adaptive optimization framework for neural network robust precision trade-off learning, including: dividing the training into multiple training stages according to every K cycles, evaluating the neural network for each stage through a designed fitness function, adaptively obtaining the attack strategy most suitable for the current stage, and using it for the training of the neural network in the next stage, and overall establishing an adaptive adversarial training framework TRA 2 SO, specifically comprising the following steps:

[0053] S1, initializing a neural network f(x, w);

[0054] S2, designing a fitness function;

[0055] S3, evaluating the neural network;

[0056] S4, using the PGD attack method to obtain an adversarial sample according to the attack strategy a suitable for the current training stage, as a training set for the training of the neural network.

[0057] In step S1, when evaluating the current neural network each time, the corresponding fitness function curve can be obtained, and by observing its change trend, it can be judged whether a more advantageous attack strategy for adversarial training can be found in the current strategy space.

[0058] In step S2, the fitness function includes the following two parts: a robustness evaluation part and a precision retention part. When evaluating the strategy in the strategy space, the adversarial sample is generated by using the strategy, and the virtual update is performed on the neural network in the current stage. For the updated neural network, the robustness evaluation part calculates the accuracy of classifying the adversarial sample under the standard adversarial strategy, and the precision retention part aims to calculate the accuracy of classifying the clean sample.

[0059] The robustness evaluation part and the precision retention part have fixed weights at each evaluation, and the strategy output by the fitness function after evaluating the strategy space in different stages of neural network training is used to improve the robustness and clean accuracy of the model.

[0060] In step S3, it further includes the following steps: evaluating the neural network in the current stage every K training cycles, the purpose is to find an attack strategy a more suitable for the current training stage, for the training of the next K training cycles.

[0061] In step S4, it further includes the following steps: through the change of attack strength, step size and number of steps in the attack strategy optimized in different stages, the change of robust accuracy can be explained.

[0062] Example 2

[0063] Model convergence trend

[0064] As Figures 2-4 shown, the changes in attack strength, step size and step number in the attack strategy obtained by different stages of optimization can explain the changes in robust accuracy. When the attack strength becomes stronger, the corresponding robust accuracy improves, directly indicating that our invention has stronger explainability for the changes in robust accuracy and stronger model credibility.

[0065] Prevent neural network overfitting phenomenon by fitness function change

[0066] As Figure 5 shown, the corresponding fitness function curve can be obtained when the current neural network is evaluated each time. By observing its change trend, it can be judged whether a more advantageous attack strategy for adversarial training can be found in the current strategy space. When the change trend of a certain part of the fitness function is not obvious, it can be determined that there is no suitable strategy in the current strategy space to make the clean accuracy and robustness of the neural network improve simultaneously. At this time, the adversarial training can be ended in advance to avoid the model from falling into overfitting.

[0067] Comparison of the established adaptive robust framework and other adversarial training methods

[0068] As Figures 6-7 shown, the optimal performance is identified in bold, the second and third best performance is identified by ‘_____’ and underlined. As can be seen from the table, on the CIFAR-10 dataset, TRA 2 SO (adv) shows the first performance under multiple attacks, TRA 2 SO (early) also achieves the top three performance under all attacks, and from the running time analysis, combined with the early stopping strategy, the calculation cost does not increase significantly compared with the standard adversarial training PGD-AT. On the CIFAR-100 dataset, TRA 2 SO can also obtain a good model under relatively small time overhead. Although the final model performance of the early stopping strategy is not very ideal, the robust model under multiple attack evaluations shows the first or second performance, which reflects the overall effectiveness of TRA 2 SO method.

[0069] The preferred embodiments of the application disclosed above are only to facilitate the elucidation of the application. The preferred embodiments do not describe all the details of the application and limit the application to the specific embodiments. Obviously, many modifications and variations can be made in light of the teachings above. The description is chosen and described in order to provide the best illustration of the application and its practical application to those skilled in the art and to enable those skilled in the art to best utilize the application. The application is limited only by the claims and their full scope and equivalents.

Claims

1. An adaptive optimization framework for robust accuracy trade-off learning in neural networks, characterized by: include: The training is divided into multiple training stages according to each K cycles. The neural network in each stage is evaluated through the designed fitness function, and the attack strategy that is most suitable for the current stage is adaptively obtained for the training of the neural network in the next stage. The adaptive adversarial training framework TRA is established as a whole. 2 SO, specifically includes the following steps: S1. Initialize the neural network f(x,w); S2, design fitness function; S3, evaluate the neural network; S4. According to the attack strategy a suitable for the current training stage, use the PGD attack method to obtain adversarial samples, which are used as training sets for neural network training.

2. The adaptive optimization framework for robust accuracy trade-off learning of neural networks according to claim 1, characterized in that: In step S1, each time the current neural network is evaluated, a corresponding fitness function curve can be obtained. By observing its changing trend, it can be determined whether an attack strategy that is more conducive to adversarial training can be found in the current strategy space.

3. The adaptive optimization framework for robust accuracy trade-off learning of neural networks according to claim 2, characterized in that: In step S2, the fitness function includes the following two parts: a robustness evaluation part and an accuracy preservation part. When evaluating the strategy in the strategy space, the neural network at the current stage is virtually updated after using the strategy to generate adversarial samples. For the updated neural network, the robustness evaluation part calculates its accuracy in classifying adversarial samples under the standard adversarial strategy, and the accuracy preservation part is intended to calculate its accuracy in classifying clean samples.

4. The adaptive optimization framework for robust accuracy trade-off learning of neural networks according to claim 3, characterized in that: The weights of the robustness evaluation part and the accuracy maintenance part are fixed values ​​at each evaluation. At different stages of neural network training, the strategy output after evaluating the strategy space through the fitness function is used to improve the robustness and clean accuracy of the model.

5. The adaptive optimization framework for robust accuracy trade-off learning of neural networks according to claim 4, characterized in that: The step S3 further includes the following steps: evaluating the neural network in the current stage every K training cycles, with the aim of finding an attack strategy a that is more suitable for the current training stage, for use in the training of the next K training cycles.

6. The adaptive optimization framework for robust accuracy trade-off learning of neural networks according to claim 5, characterized in that: Said step S4 further includes the following steps: the changes in attack intensity, step length and number of steps in the attack strategies obtained by optimization at different stages can explain the changes in robust accuracy.

Images