Image classification model robustness enhancement method and system based on improved generative adversarial network

Abstract

The application discloses an image classification model robustness enhancement method and system based on an improved generative adversarial network, aiming to solve the problems of low quality of generated adversarial samples, insufficient transferability, and difficulty in balancing model robustness and accuracy during adversarial training in the prior art. The application includes improvements to the generative adversarial network, which includes an enhanced generator that integrates multi-head self-attention mechanism and dense residual block, and an adaptive multi-scale discriminator based on spectral normalization. The network generates high-quality adversarial samples with high attack success rate and strong transferability. Through optimization strategies such as curriculum learning, these samples are used in the adversarial training process of the target model. The application effectively improves the defense capability of the model against various adversarial attacks while maintaining high standard accuracy on clean data, providing an efficient and complete solution for building a safe and reliable artificial intelligence system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer vision, artificial intelligence security and deep learning, and in particular to a method and system for generating high-quality adversarial samples by constructing an improved generative adversarial network and performing adversarial training on a deep neural network based on the generated adversarial samples, thereby systematically improving the robustness of the model. BACKGROUND

[0002] Deep neural networks (DNNs) have become the core technology of modern artificial intelligence systems, but behind their widespread application, the inherent security vulnerability problem has become increasingly prominent. Studies have shown that by adding a tiny perturbation imperceptible to the human eye to the input end of the model, an "adversarial sample" can be constructed, causing the model to produce an incorrect output with high confidence. This vulnerability poses a serious threat to the reliability of safety-critical systems such as autonomous driving, medical diagnosis, and financial risk control.

[0003] To address this threat, adversarial training is recognized as one of the most effective defense strategies. Its core lies in incorporating adversarial samples as a form of data augmentation into the model training process, forcing the model to learn more robust feature representations. However, traditional adversarial training methods usually rely on gradient-based attack algorithms (such as PGD) to generate adversarial samples in real time, which has problems such as high computational cost and insufficient diversity of generated samples, which may cause the model to overfit to the specific attack type used during training, limiting its generalization ability.

[0004] Generative adversarial networks (GANs) provide a new approach to generating diverse and high-quality adversarial samples. Methods such as AdvGAN directly generate adversarial perturbations by training a generator, improving generation efficiency. Subsequent improvements such as AdvGAN++ introduce latent features as priors to improve the realism of generated samples. However, existing GAN-based methods still face challenges in the following areas:

[0005] (1) Balance between perturbation quality and stealth: How to generate perturbations that are both highly successful in attacks and difficult to detect visually remains a difficult problem.

[0006] (2) Attack transferability: The generated adversarial samples are often effective against the target model used during training (white-box model), but have low attack success rates against other models with unknown architectures (black-box models), limiting their value in threat assessment in real-world scenarios.

[0007] (3) Training stability and efficiency: GANs themselves have problems such as mode collapse and unstable gradients, requiring sophisticated network architectures and training strategies to ensure their convergence and the quality of generated samples.

[0008] Therefore, there is an urgent need for a new GAN architecture that can generate higher-quality, more transferable adversarial samples and deeply integrate it with the adversarial training process to systematically improve the defense capabilities of the model.

[0009] In summary, in the research of adversarial samples, generating high-quality, diverse, and well-transferable adversarial samples is the key to improving the effectiveness of subsequent adversarial training. Although the traditional attack method based on single-step or iterative optimization is direct, it has shortcomings in the variety and efficiency of generated samples. The generative adversarial network (GAN) provides a new way for the generation of adversarial samples due to its strong distribution learning ability. The present application will overcome the limitations of existing methods and improve the quality of generated adversarial samples through an enhanced adversarial sample generation method based on AdvGAN (IMP-AdvGAN model). SUMMARY

[0010] The purpose of the present application is to provide an improved generative adversarial network-based image classification model robustness enhancement method to address the problems of low-quality adversarial sample generation, insufficient diversity and transferability, and the difficulty of balancing model robustness and standard classification accuracy in adversarial training in the prior art. On the other hand, based on the implementation of the method, the second purpose of the present application is to provide a robustness enhancement training system for image recognition models, which can realize the construction and robustness enhancement training of the target classification model.

[0011] Technical solution: An improved generative adversarial network-based image classification model robustness enhancement method, characterized in that the method comprises constructing an IMP-advGAN model to train the target model to enhance the robustness of the target model; the IMP-advGAN model comprises a generator G and a discriminator D, specifically:

[0012] The generator G fuses a multi-head self-attention mechanism and a dense residual connection block, captures long-range dependencies within the image through the multi-head self-attention mechanism to focus on the key areas of the image, enhances feature extraction and gradient flow through the dense residual block, and focuses on learning the perturbation itself through the residual learning strategy;

[0013] The discriminator D takes into account a multi-scale discrimination mechanism and dynamically fuses multi-scale features to comprehensively evaluate the quality of the generated samples, including selecting high-quality adversarial samples and mixing original clean samples to retrain the target model F, while introducing spectral normalization processing to stabilize the training process of the generative adversarial network until the model converges;

[0014] For the generator G, the total loss function is defined as:

[0015] ,

[0016] wherein, is an adversarial loss for maximizing the confidence of misclassification in image classification for the target model F; is a generative adversarial network loss for the generator G and the discriminator D to conduct an adversarial game; is a perturbation constraint loss in a norm form for visually constraining the generated perturbation amplitude; , , is a weight hyperparameter of each loss.

[0017] Further, the generator G is a network structure of an encoder-bottleneck-decoder, which fuses a multi-head self-attention module and a dense residual connection block in the bottleneck layer;

[0018] The multi-head self-attention module realizes capturing long-distance dependency between pixels in the input feature map by calculating scaled dot-product attention between queries, keys and values, so as to guide the generated adversarial perturbation to be applied to the image key semantic region having the greatest influence on the classification result;

[0019] The dense residual connection block sets the input of each convolutional sub-module to be the concatenation of the output features of the previous convolutional sub-modules in the channel dimension, so as to strengthen feature reuse and gradient flow in the network.

[0020] Further, the discriminator D includes a plurality of parallel sub-discriminator paths acting on different image resolution inputs, and performs spectral normalization processing on the convolutional layer weights of all sub-discriminators, so as to constrain the spectral norm of the weight matrix to force the discriminator function to satisfy the Lipschitz continuity, so as to stabilize the entire adversarial network training process.

[0021] Further, the adversarial training process adopts a sample scheduling strategy of curriculum learning, uses adversarial samples with smaller perturbation budget generated by the generator in the early stage of training, and gradually increases the perturbation budget with the training, so as to introduce adversarial samples with increasing difficulty, stabilize and optimize the training process of the target model.

[0022] Further, the adversarial loss is used to drive the generator G to generate adversarial samples that can successfully deceive the image classification target model F, and adopts the loss form in the C&W attack, which is mathematically expressed as:

[0023] ,

[0024] denotes mathematical expectation, denotes the original output of the image classification target model F without Softmax activation, which guides the generator to find the most effective attack direction, refers to the adversarial sample generated by the generator, is the true class label of the input sample, i is the index of other classes except the true class, is a hyper-parameter to ensure a sufficient gap between the logit value of the true class and the highest logit value of other classes, which is set to 0 in this method;

[0025] GAN loss is used to train the generator G and discriminator D, which adopts the loss form of least square generative adversarial network, and the mathematical expression is:

[0026] ,

[0027] represents the discrimination result of the adaptive multi-scale discriminator D on the input adversarial sample .

[0028] Disturbance constraint loss is used to adjust the disturbance amplitude, which adopts the L2 norm loss, and the mathematical expression is:

[0029] ,

[0030] In the formula, represents the adversarial disturbance generated by the enhanced generator G for the original input x, represents the norm of the calculation vector, that is, the Euclidean distance, which is used to measure the overall energy of the disturbance.

[0031] Further, the sample scheduling strategy includes mixing the original clean sample and the corresponding adversarial sample generated by the generator G in real time in each training batch, and the loss function is defined as the combination of the standard cross-entropy loss, and the mathematical expression is:

[0032] ,

[0033] In the formula, represents the total loss function used when the target classification model F is adversarially trained, is a weight factor used to balance the loss of the model on clean samples and adversarial samples, represents the standard cross-entropy loss function, represents the prediction result of the image classification target model F on the sample x, represents the true label, is the adversarial sample.

[0034] Further, the target model F is used for image classification, and is composed of a plurality of sub-target models For each sub-target model , the adversarial loss function in the training process is the sum of the adversarial loss functions of each sub-target model a weighted sum of each sub-target model The corresponding loss function is represented as follows:

[0035]

[0036] In the formula, i is used to represent the corresponding sub-image classification target model, j represents the sequence number of the batch sample, is the sub-image classification target model adversarial sample the original output logit without Softmax activation, the logit value of its corresponding category y, B is the batch size, and margin is a hyperparameter used to ensure that there is a sufficient gap between the logit value of the true category and the highest logit value of other categories, which is set to 0 in this method.

[0037] Further, the method inputs the original image into the generator G to generate an adversarial perturbation ; the adversarial perturbation is superimposed with the original image x to form an adversarial sample ; the adversarial sample is sent into the target model F on one hand to calculate the adversarial loss for optimizing the attack effect of the generator G; on the other hand, the adversarial sample is sent into the discriminator D together with the original image x to calculate the GAN loss for optimizing the concealment of the generated sample.

[0038] The target model includes an image classification model constructed by a deep neural network such as LeNet or ResNet.

[0039] An image classification model robustness enhancement training system for implementing the image classification model robustness enhancement method described above.

[0040] The system is constructed based on an IMP-AdvGAN network framework and includes:

[0041] A model construction module that constructs a target model F for image classification according to preset parameters and images;

[0042] A sample generation module connected to the model construction module and configured to perform the adversarial sample generation process of the generator G in the image classification model robustness enhancement method;

[0043] A model training module connected to the sample generation module, which performs adversarial training on the target model after mixing original clean samples and finally outputs an image classification model with enhanced robustness. ​

[0044] Beneficial effects: Compared with the prior art, the present application can make the disturbance more accurately applied to the key semantic area of the image by fusing multi-head attention and dense residual blocks in the generator, and the average of the structural similarity (SSIM) of the generated adversarial samples reaches 0.65. At the same time, the structured disturbance has stronger generalization ability, and the migration attack success rate of unknown architecture model (such as ResNet18) is as high as 98.93%, which is better than the traditional method. Secondly, the present application combines high-quality sample generation with optimized adversarial training process, and trains the model by using diversified and migratory adversarial samples, so that the model learns more generalized robust features. Experimental results show that the trained model not only obtains more than 40% significant improvement in robust accuracy under multiple strong adversarial attacks (such as PGD, FGSM), but also maintains a high level of 98.7% in standard accuracy on clean samples, successfully alleviating the performance trade-off problem. In addition, the adaptive multi-scale discriminator combined with the spectral normalization technology proposed by the present application effectively constrains the Lipschitz constant of the discriminator, avoiding problems such as mode collapse and gradient explosion, and ensuring the stable convergence of the entire adversarial generation network, providing a guarantee for generating high-quality samples. Finally, the present application proposes a complete and closed-loop technical framework from attack sample generation to model defense training, which provides a set of fully experimentally verified, reproducible and efficient solutions for evaluating and improving the security of artificial intelligence systems. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 The flowchart of the method of the present application is shown in the figure.

[0046] Figure 2 The general structure diagram of the IMP-AdvGAN model used in the present application is shown in the figure.

[0047] Figure 3 The structure diagram of the enhanced generator of the present application is shown in the figure.

[0048] Figure 4 The structure diagram of the adaptive multi-scale discriminator of the present application is shown in the figure.

[0049] Figure 5 The comparison diagram of the defense effect of the robust model and the standard model under multiple attacks in the embodiment is shown in the figure. DETAILED DESCRIPTION

[0050] To further introduce the technical scheme disclosed by the present application, the following will be further introduced in combination with the embodiments.

[0051] In combination Figure 1 The model robustness enhancement method based on the improved generative adversarial network provided by the present application mainly includes the following steps:

[0052] Step S1, input original image data, initialize target classification model.

[0053] First, load the original image dataset for training and testing, such as MNIST, CIFAR-10, etc. Second, define and initialize one or more target classification models F, which are the objects of subsequent attacks and robustness enhancement, which can be any standard deep neural network model such as LeNet, ResNet, etc.

[0054] Step S2, establish an enhanced generative adversarial network architecture module.

[0055] This step is to build an adversarial sample generation network IMP-AdvGAN model, and its overall interaction relationship is as shown in Figure 2 The core components of the IMP-AdvGAN model include an enhanced generator G and an adaptive multi-scale discriminator D. By training the generator G, it can generate a small perturbation , and the resulting adversarial sample can deceive the target model F, while the discriminator D tries to distinguish between real images and generated adversarial samples (or perturbations).

[0056] In order to generate higher quality and more deceptive adversarial perturbations, the present application makes the following improvements and enhancements based on the generative adversarial network:

[0057] The network structure of the generator G integrates multi-head self-attention mechanism and dense residual connection block, which enables it to learn the long-distance dependency relationship and fine local features of the input data, and focuses on generating efficient and structured adversarial perturbations. In addition, the adaptive multi-scale discriminator D adopts parallel multi-scale discrimination paths to distinguish the input samples at different resolutions, and applies spectral normalization technology to the network weights to enhance the stability of the training process and provide high-quality gradient signals for the generator.

[0058] The implementation of step S2 specifically includes:

[0059] Step S201, build an enhanced generator, integrate dense residual block structure.

[0060] The generator G is designed as an encoder-bottleneck-decoder fully convolutional network, as shown in Figure 3 , whose input is the original image , and the output is the adversarial perturbation δ. This design focuses on learning residual , rather than directly generating complete adversarial samples , which simplifies the learning goal and preserves the original image information. The network structure details are as follows:

[0061] ​(1) Encoder: composed of a series of convolutional layers with a step size of 2, used for down-sampling the input image and extracting multi-level features. For example, the configuration of Conv2d(in_channels, out_channels, kernel_size=3, stride=2, padding=1) is adopted.

[0062] (2) Bottle-neck layer: composed of N Dense Residual Blocks and a Multi-Head Self-Attention module.

[0063] Dense Residual Block: Inside each block, it contains multiple convolutional sub-modules. For the l-th sub-module, its input is the original block input concatenated with the outputs of the previous sub-modules in the channel dimension. This dense feature reuse mechanism greatly enhances the information flow and gradient flow within the network, enabling the generator to learn more complex perturbation patterns. The mathematical expression is: .

[0064] Multi-Head Self-Attention Module: In this invention, this module is placed at the end of the bottle-neck layer, used to capture long-range dependencies between pixels within the feature map. It projects the input feature map X through independent 1x1 convolutional layers to obtain Query (Q), Key (K), and Value (V). The attention map is obtained by computing and is applied to the value V. The multi-head mechanism allows the model to learn from different representation subspaces in parallel, capturing richer contextual information, thus making the generated perturbation more globally structured.

[0065] (3) Decoder: composed of a series of de-convolutional layers with a step size of 2, used for gradually up-sampling the feature map output by the bottle-neck layer to restore the original image size, and finally generating the adversarial perturbation δ. The output layer adopts the tanh activation function to constrain the perturbation value range to [−1, 1], facilitating subsequent scaling by the perturbation budget ε.

[0066] Step S202, introduce multi-head attention mechanism and spectral normalization to improve stability.

[0067] This step constructs an adaptive multi-scale discriminator: a powerful discriminator is the key to stable GAN training and guiding the generator to output high-quality samples. The adaptive multi-scale discriminator designed in this invention is shown in Figure 4 , which has the following characteristics:

[0068] Architecture of adaptive multi-scale discriminator: inspired by the idea of Pix2PixHD, the adaptive multi-scale discriminator D is composed of at least 3 sub discriminators with the same structure but acting on different scale inputs. The first sub discriminator acts on the original resolution image, and the subsequent sub discriminators act on the down-sampled images through average pooling. This design enables the discriminator to simultaneously review the global consistency and local detail authenticity of the image, which is crucial for capturing subtle adversarial artifacts.

[0069] Spectral normalization: to solve the core problem of unstable GAN training, spectral normalization is applied to all convolutional layer weights of the adaptive multi-scale discriminator D. This technique normalizes the weight matrix W in each iteration to make its spectral norm (the largest singular value) , This forces the discriminator function to satisfy Lipschitz continuity, thereby stabilizing the training dynamics, effectively preventing gradient explosion, and providing the generator with more meaningful gradient signals, which is superior to the gradient penalty in WGAN-GP.

[0070] Further explanation for step S2, the adversarial perturbation does not need to be uniformly distributed on every pixel of the image. It may be more effective to apply perturbation in certain key areas (such as the edges of the strokes of the digits) than in smooth background areas. The attention mechanism allows the model to dynamically focus on different parts of the input image, thereby concentrating the perturbation in the areas that have the greatest impact on the classification result. The self-attention mechanism can capture long-range dependencies within the image, helping the generator understand the global structure and local details of the image. The multi-head mechanism allows the model to learn attention weights from different representation subspaces in parallel, thereby capturing more rich context information. Through the learned attention map, the generator can adaptively adjust the intensity and pattern of perturbation in different areas. Its working principle is as follows:

[0071] Projection: the input feature map X generates query, key and value through three independent convolutional layers respectively:

[0072] ,

[0073] Grouped and scaled dot-product attention: Q, K, V are divided into h heads, and the attention is calculated independently for each head, as shown in the following formula:

[0074] ,

[0075] where is the dimension of the key vector.

[0076] Concatenation and output projection: The outputs of each head are concatenated and projected to the final attention layer output by another convolution, whose formula is shown as follows:

[0077] ,

[0078] Residual connection: The final output is connected to the original input feature map X by a learnable scaling parameter γ, whose formula is shown as follows:

[0079] ,

[0080] During the training process of deep neural networks, it is very easy to have the problem of gradient disappearance or gradient explosion, which affects the performance of the model. GAN as a representative cannot avoid this problem. The present application can effectively alleviate these problems by introducing residual learning and dense connection, and can also enhance the feature propagation technology. Specifically, multiple dense residual blocks are used in the neck of the generator.

[0081] The structure of a dense residual block can be summarized as follows:

[0082] Multi-layer convolution: It contains n convolution sub-modules. For the i-th sub-module, its input is to concatenate the original block input X with the output of the previous i-1 sub-modules. Each sub-module usually contains convolution, normalization and activation function. Its formula is shown as follows:

[0083] ,

[0084] Feature fusion: The original block input and the output of all convolution sub-modules are concatenated again, and a 1x1 convolution is used for feature fusion to restore the channel number to be consistent with the original input, whose formula is shown as follows:

[0085] ,

[0086] Residual connection: The fused features are connected to the original block input by a learnable scaling parameter γ, whose formula is shown as follows:

[0087] ,

[0088] It is a complex task to let the generator learn the complete adversarial sample In contrast, it is usually easier and more stable to learn the small difference between the original sample and the adversarial sample , i.e. the adversarial perturbation δ.

[0089] ​​​The generator G in the present application is designed to learn the adversarial perturbation δ. Given an input sample x, the generator outputs the perturbation δ = G(x). The final adversarial sample is obtained by This residual learning strategy has the following advantages:

[0090] Simplify the learning objective: the perturbation usually has a sparser and simpler structure than the original image.

[0091] Easy to control the perturbation amplitude: the size of the perturbation can be directly controlled by constraining the output of G(x) (e.g., limiting it to the range [-ε, ε] through a Tanh activation function, or adding a penalty on in the loss function).

[0092] Preserve the original image information: ensure that the adversarial sample is highly similar to the original sample in visual appearance.

[0093] The present application uses nn.Tanh() activation function in the output layer of the generator, which limits the generated perturbation value range to [-1, 1], and then adjusts the maximum amplitude of the actual perturbation by a scaling factor ε as needed.

[0094] Step S3 establishes a multi-dimensional loss optimization and adaptive training module.

[0095] This step trains the IMP-AdvGAN system by a total loss function composed of a weighted combination of adversarial loss, generative adversarial network loss and perturbation constraint loss, and combines with a curriculum learning strategy.

[0096] Step S301, the training process of IMP-advGAN is a min-max game process, the core of which is to construct a combined loss function to guide the training process.

[0097] Loss function of enhanced generator G:

[0098] ,

[0099] Adversarial loss : adopt the loss form in C&W attack, aiming to maximize the confidence of the target model misclassifying the adversarial sample. Its mathematical form is:

[0100] ,

[0101] where is the logit output of the target model. This loss directly guides the generator to find the most effective attack direction.

[0102] GAN loss To improve the stability of training, the loss form of Least Squares GAN is adopted. The goal of the generator is to make the output of the discriminator on the generated samples as close to the "real" label as possible.

[0103] ,

[0104] Disturbance constraint loss To ensure the visual concealment of the adversarial samples, the amplitude of the disturbance δ is punished. Further, the L2 norm loss is adopted, which is mathematically expressed as:

[0105] ,

[0106] The loss function of the enhanced discriminator D is as follows:

[0107] ,

[0108] The goal of the discriminator is to distinguish between real samples (output close to 1) and generated samples (output close to 0).

[0109] Step S302, adaptively adjust the loss weight and implement the curriculum learning strategy: after the completion of IMP-advGAN training, use its enhanced generator G to conduct adversarial training on the target model F, as shown in Figure 2 .

[0110] Training process: in each training batch, half of the data is original clean samples, and the other half is corresponding adversarial samples generated by the generator G in real time ). The model is trained on such mixed data, and its loss function is a combination of standard cross-entropy loss, which is mathematically expressed as:

[0111] .

[0112] Training optimization strategy:

[0113] (1) Curriculum learning: first, introduce the sample scheduling strategy. In the early stage of training, use smaller disturbance budget ε to generate adversarial samples, so that the model can first learn to resist weak attacks. As the training progresses, gradually increase ε, and then introduce stronger adversarial samples to guide the model to learn a more robust decision boundary.

[0114] (2) Adaptive learning rate: use optimizers such as Adam, and cooperate with learning rate schedulers (such as CosineAnnealingLR) to dynamically adjust the learning rate according to the training process, which helps the model to converge stably in complex loss topography.

[0115] Step S4, establish an adversarial sample generation and model robustness evaluation module.

[0116] After the training is completed, a test set is generated using various standard, training process independent adversarial attack algorithms (such as FGSM, PGD, C&W, DeepFool, AutoAttack, etc.), and the defense effect (robust accuracy) of the enhanced model F' under these attacks is comprehensively evaluated and compared with the original model. For example Figure 5 As shown in the example results, the accuracy of the robust model trained by the method of the present application under various attacks is much higher than that of the standard model, thereby verifying the effectiveness and generalizability of the method of the present application.

Claims

1. An image classification model robustness enhancement method based on improved generative adversarial network, characterized in that, The method comprises constructing an IMP-advGAN model to train a target model to enhance the robustness of the target model; the IMP-advGAN model comprises a generator G and a discriminator D, specifically: The generator G fuses a multi-head self-attention mechanism and a dense residual connection block, captures long-distance dependencies between pixels in an image through the multi-head self-attention mechanism, focuses on key regions of the image, enhances feature extraction and gradient flow through the dense residual block, and focuses on learning the perturbation itself through the residual learning strategy; The discriminator D takes into account a multi-scale discrimination mechanism and dynamically fuses multi-scale features to comprehensively evaluate the quality of generated samples, including screening high-quality adversarial samples and original clean samples to retrain the target model, and introducing spectral normalization processing to stabilize the training process of the generative adversarial network until the model converges; For the generator G, the total loss function is defined as: ， wherein, is an adversarial loss for maximizing the confidence of misclassification of the target model F in image classification; is a generative adversarial network loss for the generator G and the discriminator D to conduct an adversarial game; is a perturbation constraint loss in a norm form for visually constraining the amplitude of the generated perturbation; , , is a weight hyperparameter of each loss. The generator G is a network structure of an encoder-bottleneck-decoder, which fuses a multi-head self-attention module and a dense residual connection block in the bottleneck layer; The multi-head self-attention module calculates the scaled dot product attention between queries, keys and values to capture long-distance dependencies between pixels in the input feature map, and is used to guide the generated adversarial perturbation to be applied to the key semantic regions of the image that have the greatest impact on the classification result; The dense residual connection block sets the input of each convolutional sub-module to be the concatenation of the output features of the previous convolutional sub-modules in the channel dimension to strengthen feature reuse and gradient flow in the network; The adversarial training process adopts a sample scheduling strategy of curriculum learning, uses adversarial samples with a small perturbation budget generated by the generator in the early stage of training, and gradually increases the perturbation budget as the training progresses to introduce adversarial samples with increasing difficulty, stabilize and optimize the training process of the target model; Adversarial loss To drive the generator G to generate adversarial samples that can successfully deceive the image classification target model F, the loss form in the C&W attack is adopted, which is mathematically expressed as: ， denotes the mathematical expectation, denotes the original output of the image classification target model F without Softmax activation, guiding the generator to find the most effective attack direction, refers to the adversarial sample generated by the generator, refers to the true class label of the input sample, i is an index representing other classes except the true class, is a hyperparameter used to ensure that there is enough gap between the logit value of the true class and the highest logit value of other classes, which is set to 0 in this method; GAN loss For training the generator G and the discriminator D, the loss form of least square generative adversarial network is adopted, which is mathematically expressed as: ， denotes the discrimination result of the adaptive multi-scale discriminator D on the input adversarial sample ​ perturbation constraint loss For adjusting the magnitude of the perturbation, the L2 norm loss is adopted, which is mathematically represented as: ， wherein denotes the adversarial perturbation generated by the enhanced generator G for the original input x, denotes the computation of the vector's norm, i.e. the Euclidean distance, is used to measure the overall energy of the perturbation.

2. The method of claim 1, wherein, The discriminator D includes several parallel sub-discriminator paths that act on different image resolution inputs, and performs spectral normalization processing on the convolutional layer weights of all sub-discriminators to constrain the spectral norm of the weight matrix to force the discriminator function to satisfy the Lipschitz continuity to stabilize the entire adversarial network training process. 3.The method of claim 1, wherein, The sample scheduling strategy includes mixing original clean samples and corresponding adversarial samples generated by the generator G in each training batch, and the loss function is defined as a combination of standard cross-entropy loss, mathematically represented as: ， wherein, denotes the total loss function used when adversarially training the target classification model F, is a weight factor used to balance the loss of the model on clean and adversarial samples, denotes the standard cross-entropy loss function, denotes the prediction result of the image classification target model F on a sample x , denotes the true label, is an adversarial sample. 4.The method of claim 1, wherein, The target model F is used for image classification, and is composed of a plurality of sub-target models For each sub-target model , the adversarial loss function in the training process is the weighted sum of each sub-target model , wherein each sub-target model The corresponding loss function is represented as follows: ， wherein, i for representing the corresponding sub-image classification target model, j denotes the sequence number in the batch sample, is the sub-image classification target model adversarial sample the original output (logits) without Softmax activation, denotes its corresponding class y the logit value, B is the batch size, and margin is a hyperparameter used to ensure that there is a sufficient gap between the logit value of the true class and the highest logit value of other classes, which is set to 0 in this method.

5. The method of claim 1, wherein, The method inputs an original image into a generator G to generate an adversarial perturbation ; the perturbation is superimposed on the original image x to form an adversarial sample ; the adversarial sample is sent into a target model F on one hand to calculate an adversarial loss for optimizing the attack effect of the generator G; on the other hand, the adversarial sample is sent into a discriminator D together with the original image x to calculate a GAN loss for optimizing the concealment of the generated sample.

6. The method of claim 1, wherein, The target model includes an image classification model constructed by a deep neural network such as LeNet or ResNet.

7. An image classification model robustness enhancement training system, comprising: The system is used to implement the image classification model robustness enhancement method according to any one of claims 1-6; The system is constructed based on an IMP-AdvGAN network and comprises: A model construction module that constructs a target model F for image classification according to preset parameters and images; A sample generation module connected to the model construction module and configured to perform the adversarial sample generation process of the generator G in the image classification model robustness enhancement method; The system is constructed based on an IMP-AdvGAN network and comprises: A model construction module that constructs a target model F for image classification according to preset parameters and images; A sample generation module connected to the model construction module and configured to perform the adversarial sample generation process of the generator G in the image classification model robustness enhancement method; The model training module is connected with the sample generation module, performs adversarial training on the target model after mixing the original clean samples, and finally outputs an image classification model with enhanced robustness.

Images