Method for defending and reinforcing adversarial attack aiming at image classification model

Abstract

The invention relates to a method for defending and reinforcing adversarial attacks for an image classification model. The method comprises the following steps: inputting an image to be classified into a feature extraction layer of a trained image classification model for feature extraction to obtain an original feature vector; grading each feature dimension in the original feature vector based on a preset security level classification table to obtain a feature subset; the security level classification table comprises at least three levels; based on a defense key group, encrypting the feature subsets of different levels by applying corresponding encryption algorithms to obtain encrypted feature vectors; on the basis of the defense key group, performing hash value calculation on the encrypted feature vector to obtain a digital watermark; and embedding the digital watermark into the encrypted feature vector to obtain a protection feature vector. By adopting the method, the cost of the against-resistance attack can be greatly increased, and the defense against the against-resistance attack is realized.

Description

Technical Field

[0001] This invention belongs to the field of model defense, and in particular relates to a method for defending against and hardening image classification models against adversarial attacks. Background Technology

[0002] In traditional technologies, defenses against adversarial attacks are typically implemented in the early stages of model deployment. Defense strategies often focus on enhancing the model's inherent robustness during training or attempting to eliminate perturbations by preprocessing input images during inference. These methods constituted the main components of early defense systems. However, the limitations of these mainstream defense approaches have become increasingly apparent in practice. While adversarial training is effective, it is computationally expensive and primarily targets specific attack types encountered during training, offering limited generalization capabilities against unknown attacks and potentially even reducing the model's accuracy on normal data. Input preprocessing methods, on the other hand, can negatively impact model performance by filtering out useful image details, and their effectiveness is easily circumvented by powerful adaptive attacks. These limitations demonstrate that relying solely on a single-layer defense strategy is insufficient to address complex and ever-changing security threats. Summary of the Invention

[0003] Therefore, it is necessary to provide a method for defending against and hardening adversarial attacks on image classification models that can mislead targeted attacks in order to achieve defense against the aforementioned technical problems.

[0004] Firstly, this application provides a method for defending against and hardening image classification models against adversarial attacks, including:

[0005] The image to be classified is input into the feature extraction layer of a trained image classification model to extract features and obtain the original feature vector.

[0006] Based on a pre-defined security level classification table, each feature dimension in the original feature vector is classified into different levels to obtain a feature subset; the security level classification table includes at least three levels.

[0007] Based on the defense key set, the corresponding encryption algorithm is applied to the feature subsets of different levels to encrypt them, and the encrypted feature vector is obtained.

[0008] Based on the defense key set, the hash value of the encrypted feature vector is calculated to obtain the digital watermark; and the digital watermark is embedded in the encrypted feature vector to obtain the protection feature vector.

[0009] Furthermore, before inputting the image to be classified into the feature extraction layer of the image classification model for feature extraction to obtain the original feature vector, the following steps are also included:

[0010] Based on the trained image classification model and the corresponding training dataset, the contribution of each feature dimension to the classification result and its sensitivity to adversarial attacks are evaluated, and a feature importance analysis report is obtained.

[0011] Based on the feature importance analysis report, the feature dimensions are divided into multiple levels to obtain a security level classification table;

[0012] Based on the system security configuration parameters, the dynamic key management system is initialized to generate a defense key group; the system security configuration parameters include the selection of encryption algorithm, key length and update frequency.

[0013] Furthermore, based on the trained image classification model and the corresponding training dataset, the contribution of each feature dimension to the classification result and its sensitivity to adversarial attacks are evaluated, resulting in a feature importance analysis report, including:

[0014] The training dataset is input into the image classification model to obtain the training feature vector; the average activation intensity of each feature dimension on samples of different categories is calculated, the feature dimensions that make key contributions to the classification decision are identified, and the feature dimension class discrimination is obtained.

[0015] Based on the occlusion sensitivity analysis method, the influence of different regions of the image on the feature dimensions is evaluated to obtain a sensitivity distribution map; and the gradient contribution of each feature dimension to the classification decision is calculated to obtain the importance weight.

[0016] Slight random noise and simulated adversarial perturbations were added to the training dataset, and the stability changes of each feature dimension under the perturbations were observed to obtain the perturbation sensitivity score.

[0017] Calculate the correlation coefficients between different feature dimensions, analyze the structural characteristics of the feature space, and obtain the correlation matrix analysis results;

[0018] By integrating the results of correlation matrix analysis, perturbation sensitivity score, importance weight, sensitivity distribution map, and feature dimension category discrimination, a feature importance analysis report is obtained.

[0019] Furthermore, after initializing the dynamic key management system based on system security configuration parameters and generating defense key sets, the process also includes:

[0020] Acquire usage data for the defense key group; and based on the usage data, generate a statistical report on the current usage status of the defense key group; the usage data includes the usage counter of the defense key group, the time of the most recent generation of the defense key group, and the current time;

[0021] The status statistics report and the preset security policy are compared to check whether the key update triggering conditions are met, and the key update decision result is obtained.

[0022] If the key update decision result is that an update is needed, then prepare the environment and parameters required for new key generation to obtain the newly generated key material set; the environment and parameters include random number generator initialization, encryption algorithm parameter settings, and key length confirmation;

[0023] The integrity of the newly generated key material set is verified to obtain a new defense key set; the new defense key set is used to replace the old defense key set.

[0024] Furthermore, based on the usage data, a statistical report on the current usage status of the defense key group is generated, including:

[0025] Based on usage data, the average usage frequency of the defense key group is calculated using the following formula:

[0026]

[0027]

[0028] in, For average usage frequency, For the number of times it is used, For usage duration, For the current time, The creation time is 3600, which is the conversion factor from seconds to hours.

[0029] Based on a preset frequency threshold, the average usage frequency is mapped to the corresponding usage intensity level to obtain the intensity classification result;

[0030] Based on usage data, calculate the remaining usage margin of the defense key set; and calculate the remaining lifetime of the defense key set.

[0031] Based on the strength classification results, remaining service life, and remaining useful life, the urgency score is calculated using the following formula:

[0032]

[0033] in, Assess urgency level. , , For the corresponding weighting coefficients, To use the margin, The maximum number of uses threshold, For the remaining service life, The maximum usage time threshold, To use the strength coefficient;

[0034] By integrating urgency scores, intensity classification results, remaining usage capacity, and service life, a usage status statistical report is obtained.

[0035] Furthermore, after embedding the digital watermark into the encryption feature vector to obtain the protection feature vector, it also includes:

[0036] The similarity of the digital watermark in the protected feature vector with the expected digital watermark recalculated based on the current key and feature content is compared to obtain the feature integrity verification result.

[0037] If the feature integrity verification result indicates that the protected feature vector is intact, then the corresponding decryption algorithm is used to restore the protected feature vector to obtain the original feature vector;

[0038] The original feature vector is input into the classifier of the image classification model to obtain the probability distribution of the image belonging to each category;

[0039] The image is identified as the category with the highest probability in the probability distribution, thus obtaining the image classification result.

[0040] Furthermore, based on the defense key set, different levels of feature subsets are encrypted using corresponding encryption algorithms to obtain encrypted feature vectors, including:

[0041] Based on the defense key set, homomorphic encryption is performed on a high-security feature subset to obtain advanced encryption features;

[0042] A random projection linear transformation is performed on a subset of features with medium security level to obtain intermediate projection features; Gaussian noise is then added to the intermediate projection features to obtain intermediate encryption features.

[0043] A low-security feature subset is lightly obfuscated by applying a nonlinear activation function, resulting in a low-level encryption feature.

[0044] Based on the random rearrangement sequence in the defense key group, the feature dimensions of high-level encryption features, intermediate-level encryption features, and low-level encryption features are rearranged to obtain the encryption feature vector.

[0045] Secondly, this application also provides a device for defending against and hardening image classification models against adversarial attacks, comprising:

[0046] The extraction module is used to input the image to be classified into the feature extraction layer of the trained image classification model to extract features and obtain the original feature vector.

[0047] The hierarchical module is used to classify each feature dimension in the original feature vector according to a preset security level classification table to obtain a feature subset; the security level classification table includes at least three levels.

[0048] The encryption module is used to encrypt feature subsets of different levels based on the defense key set, applying corresponding encryption algorithms to obtain encrypted feature vectors.

[0049] The watermarking module is used to calculate the hash value of the encrypted feature vector based on the defense key group to obtain a digital watermark; and to embed the digital watermark into the encrypted feature vector to obtain the protection feature vector.

[0050] Thirdly, this application also provides a computer device including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement any step of the method provided in the first aspect of this application.

[0051] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any step of the method provided in the first aspect of this application.

[0052] The aforementioned method for defending against and hardening image classification models against adversarial attacks involves inputting the image to be classified into the feature extraction layer of a trained image classification model to extract features, obtaining an original feature vector. Based on a pre-defined security level classification table, each feature dimension in the original feature vector is classified into different levels, resulting in feature subsets. The security level classification table includes at least three levels. Based on a defense key set, the feature subsets at different levels are encrypted using corresponding encryption algorithms to obtain encrypted feature vectors. Based on the defense key set, a hash value is calculated on the encrypted feature vectors to obtain a digital watermark. The digital watermark is then embedded into the encrypted feature vectors to obtain a protected feature vector. Encrypting the features prevents attackers from understanding and optimizing their attack methods by analyzing the feature space, increasing attack costs, reducing attack portability, and preventing the scaling of attack methods, thereby achieving the function of defending against adversarial attacks. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 This is a schematic diagram illustrating a process for implementing defense and hardening methods against adversarial attacks on image classification models, as provided in an embodiment of the present invention.

[0055] Figure 2 This is a schematic diagram of the structure of a defense and hardening device for adversarial attacks on image classification models, provided in an embodiment of the present invention. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] In one embodiment, such as Figure 1 As shown, a method for defending against and hardening image classification models against adversarial attacks is provided. This embodiment illustrates the method using a terminal as an example. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0058] Step 101: Input the image to be classified into the feature extraction layer of the trained image classification model to extract features and obtain the original feature vector.

[0059] In this context, the image to be classified refers to the raw image data input to the system that requires category determination. The trained image classification model refers to a deep learning network that has been trained using a large amount of labeled data and possesses image classification capabilities. The feature extraction layer is the network layer in the image classification model located after the input layer and before the final classification layer. It is responsible for progressively converting raw pixel information into high-level, abstract feature representations. The original feature vector, generated by the feature extraction layer, is a mathematical representation representing the core information of the input image. It can be a one-dimensional array or a vector, where each element describes a certain abstract attribute of the image and is the direct basis for the model's classification decision. The terminal propagates the image data forward through the feature extraction layer of the image classification model. The image pixel values ​​undergo layers of convolution, activation, and other operations, and are finally transformed and flattened into a vector form at the end of the feature extraction layer, mapping the image from pixel space to a more discriminative feature space.

[0060] Step 102: Based on the preset security level classification table, classify each feature dimension in the original feature vector into a sub-class to obtain a feature subset; the security level classification table includes at least three levels.

[0061] Specifically, the preset security level classification table is a predefined mapping table or set of rules that specifies the security level to which each feature dimension in the original feature vector belongs. The classification table is generated through preparation and contains at least three levels, such as high, medium, and low security levels. A feature dimension refers to a single element in the original feature vector, representing a feature. Feature subsets are several feature sets divided from the original feature vector according to the security level classification table, where each subset contains all feature dimensions belonging to the same security level. The terminal, based on the security level classification table, traverses each feature dimension of the original feature vector, determines its security level, and groups feature dimensions belonging to the same level together to form different feature subsets.

[0062] Step 103: Based on the defense key set, apply the corresponding encryption algorithm to the feature subsets of different levels to encrypt them, and obtain the encrypted feature vector.

[0063] Specifically, the defense key set is a set of secret parameters used for encryption and decryption operations. It contains multiple keys, exemplified by keys for different encryption algorithms, matrices for random projection, and sequences for rearrangement, and is dynamically generated and managed. An encryption algorithm refers to a mathematical method used to transform data so that it cannot be understood without the key. An encrypted feature vector is a new, obfuscated, and protected vector obtained by processing each subset of features separately using their corresponding encryption algorithms and then recombinating them. To an attacker without the key, it is chaotic and unreadable. For high-security feature subsets, the terminal applies the strongest encryption algorithm to ensure that some computation can be performed even in the encrypted state, while providing the highest level of confidentiality. For medium-security feature subsets, a method balancing security and efficiency is used for encryption. For low-security feature subsets, only light obfuscation is applied to increase the difficulty of analysis for attackers with minimal computational cost. A random sequence from the defense key set is used to rearrange all encrypted features dimensionally, further increasing the degree of obfuscation.

[0064] Step 104: Based on the defense key group, perform hash value calculation on the encrypted feature vector to obtain the digital watermark; and embed the digital watermark into the encrypted feature vector to obtain the protection feature vector.

[0065] Hash value calculation is a one-way mathematical function operation that maps input data of arbitrary length to a fixed-length, unique, and seemingly random string. Even a small change in the input can lead to a huge and unpredictable change in the output hash value. In this embodiment, a digital watermark specifically refers to a digest obtained by calculating the hash value of an encrypted feature vector. The watermark is strongly bound to the current encrypted feature vector content and the defense key set. The protection feature vector is an encrypted feature vector that already contains its own integrity verification information; it is hardened data ready for storage or transmission. The terminal uses the defense key set as salt, inputting it along with the encrypted feature vector into the hash function to calculate a unique digital watermark. This digital watermark is then embedded into the encrypted feature vector itself in a specific way; the embedding method can be simple concatenation or a transformation to hide the watermark information within it.

[0066] This embodiment provides a method for defending against and hardening image classification models against adversarial attacks. The method involves inputting the image to be classified into the feature extraction layer of a trained image classification model to extract features, obtaining an original feature vector. Based on a preset security level classification table, each feature dimension in the original feature vector is classified into different levels, resulting in feature subsets. The security level classification table includes at least three levels. Based on a defense key set, the feature subsets of different levels are encrypted using corresponding encryption algorithms to obtain encrypted feature vectors. Based on the defense key set, a hash value is calculated on the encrypted feature vectors to obtain a digital watermark. The digital watermark is then embedded into the encrypted feature vectors to obtain a protected feature vector. By encrypting the features using these methods, the attacker's ability to understand and optimize attack methods by analyzing the feature space is blocked, increasing attack costs, reducing attack portability, and preventing the scaling of attack methods, thereby achieving the function of defending against adversarial attacks.

[0067] In one embodiment, before inputting the image to be classified into the feature extraction layer of the image classification model for feature extraction to obtain the original feature vector, the method further includes:

[0068] Step 201: Based on the trained image classification model and the corresponding training dataset, evaluate the contribution of each feature dimension to the classification result and its sensitivity to adversarial attacks, and obtain a feature importance analysis report.

[0069] Specifically, a feature dimension refers to a single element in the original feature vector, representing an abstract attribute extracted by the model from the image. Contribution refers to the magnitude of a feature dimension's effect on correct classification; features with high contribution are crucial for distinguishing different categories. Adversarial attack sensitivity refers to how easily a feature dimension's value changes in the face of minor perturbations in the input image; highly sensitive features are unstable and easily exploited by attackers. The feature importance analysis report is a comprehensive analysis result, recording the contribution, sensitivity, and other relevant analytical data for each feature dimension, providing data support for subsequent feature classification. The terminal analyzes the output of the training dataset in the model to calculate the average activation intensity of each feature dimension on samples from different categories. Features that consistently exhibit high activation values ​​on samples of a specific category are considered to have high contribution and are key class discriminators. By systematically occluding different regions of an image, the changes in feature dimension values ​​are observed to identify which image regions have the greatest impact on the classification results, generating a sensitivity distribution map. The gradient of the classification decision with respect to each feature dimension is calculated. The larger the gradient, the greater the impact of small feature changes on the decision. This feature dimension is also more easily exploited by attackers using gradient ascent / descent methods. Slight random noise and simulated adversarial perturbations are actively added to the training data. The degree of change in the value of each feature dimension before and after the perturbation is observed and quantified. The more drastic the change, the higher the sensitivity and the worse the stability.

[0070] Step 202: Based on the feature importance analysis report, the feature dimensions are divided into multiple levels to obtain a security level classification table.

[0071] The security level classification table is a defined mapping rule or lookup table that specifies which security level each feature dimension in the original feature vector should be assigned to. The terminal makes decisions and classifications based on the feature importance analysis report. According to the contribution and sensitivity scores of each feature dimension in the report, it formulates classification rules, and these rules are then formalized to generate the security level classification table. For example, the classification rules could be: High security level: Feature dimensions with the highest contribution and high sensitivity are the primary targets of attacks and require the strongest protection; Medium security level: Feature dimensions with high contribution but moderate sensitivity, or moderate contribution but high sensitivity, require effective protection, but the strength can be lower than the highest level; Low security level: Feature dimensions with low contribution and low sensitivity, which can be lightly processed or left unprocessed to optimize computational efficiency.

[0072] Step 203: Based on the system security configuration parameters, initialize the dynamic key management system and generate a defense key group; the system security configuration parameters include the selection of encryption algorithm, key length and update frequency.

[0073] The system security configuration parameters are a set of high-level parameters pre-set by the system administrator or security policy, defining the behavioral guidelines for cryptographic components. These parameters primarily include: specifying a list of encryption algorithms usable at different security levels; specifying the number of bits in the generated key, directly affecting the difficulty of cracking the key; specifying the trigger conditions for key updates; and a subsystem responsible for the full lifecycle management of the key, dynamically reflected in the fact that the key is not permanent but automatically updated periodically or after triggering conditions. The defense key set is a set of key materials generated by the dynamic key management system according to the configuration parameters, which will be used for subsequent encryption, watermark generation, and feature rearrangement operations. The terminal starts and configures the cryptographic core of the entire defense system, initializes the dynamic key management system according to the system security configuration parameters, calls a secure random number generator to generate the initial key based on the specified algorithm and key length, sets the key update strategy, and generates the first complete key set that can be used for all encryption and watermarking operations.

[0074] This embodiment employs a refined and differentiated security strategy, precisely targeting the strongest encryption computing power and the most stringent protection measures to the most critical and vulnerable features. This achieves an optimal balance between security and computational efficiency, providing a variable and controlled source of secrets for the entire defense scheme, fundamentally enhancing the durability and proactiveness of the defense. Even if the current key is cracked by an attacker through some means, a new key can be automatically switched to after preset conditions are met, immediately rendering the attacker's cracked key invalid and significantly increasing the attacker's long-term attack costs.

[0075] In one embodiment, based on a trained image classification model and the corresponding training dataset, the contribution of each feature dimension to the classification result and its sensitivity to adversarial attacks are evaluated, resulting in a feature importance analysis report, including:

[0076] Step 301: Input the training dataset into the image classification model to obtain the training feature vector; calculate the average activation intensity of each feature dimension on samples of different categories, identify the feature dimensions that make key contributions to the classification decision, and obtain the feature dimension category discrimination.

[0077] The training feature vectors are the set of corresponding feature vectors obtained by inputting a large number of images from the training dataset into the model. The feature dimension class discriminative measure quantifies the importance of a single feature dimension in distinguishing different image categories; feature dimensions with high discriminative power are key indicators for the model to identify specific categories. The terminal inputs the entire training dataset into the model to obtain the feature vectors of each image, forming a large set of feature vectors. These are grouped according to the true category of the image. For each feature dimension, the average value of its value across all samples in each category is calculated. The difference in average activation intensity of this feature dimension across different categories is analyzed. Features with high class discriminative power are usually the primary targets of attackers because tampering with them can most effectively mislead the model; therefore, they need to be carefully protected.

[0078] Step 302: Based on the occlusion sensitivity analysis method, evaluate the impact of different regions of the image on the feature dimensions to obtain a sensitivity distribution map; and calculate the gradient contribution of each feature dimension to the classification decision to obtain the importance weight.

[0079] Specifically, occlusion sensitivity analysis is an interpretable artificial intelligence technique that systematically occludes different local regions of the input image and observes changes in the model's output or internal features. Sensitivity distribution maps describe the impact of occlusion on the activation values ​​of specific feature dimensions, revealing the strength of the correlation between feature dimensions and local image regions. Gradient contribution refers to the partial derivative of the model's final classification decision with respect to a certain feature dimension, measuring the impact of small changes in that feature dimension on the decision result. Importance weight is a value calculated based on gradient contribution, directly quantifying the direct influence of changes in each feature dimension on the classification result. The terminal performs sliding window-style occlusion on the image, occluding a small area at a time, and observes the changes in the activation values ​​of the target feature dimension. The larger the change, the more sensitive that feature dimension is to this image region. Using the backpropagation algorithm, the gradient of the model's output layer class probability with respect to each dimension of the feature layer is calculated; the absolute value of the gradient is the importance weight of that feature dimension.

[0080] Step 303: Add slight random noise and simulated adversarial perturbation to the training dataset, observe the stability changes of each feature dimension under the perturbation, and obtain the perturbation sensitivity score.

[0081] Specifically, slight random noise is low-intensity noise that mimics natural image distortion. Simulated adversarial perturbations are small perturbations generated using algorithms such as the fast gradient sign method or projective gradient descent, designed to mislead the model. The perturbation sensitivity score is a quantitative metric used to measure the stability of each feature dimension's value when the input data is perturbed. A higher score indicates that the feature is more unstable and more susceptible to perturbations. The terminal adds slight random noise and simulated adversarial perturbations to images in the training dataset, generating two perturbed datasets. The original images and the two perturbed images are then input into the model, and the activation values ​​of each feature dimension are recorded under three conditions. By comparing the magnitude of the change in each feature dimension's value before and after the perturbation, a comprehensive perturbation sensitivity score is generated; the greater the change, the higher the score.

[0082] Step 304: Calculate the correlation coefficients between different feature dimensions, analyze the structural characteristics of the feature space, and obtain the correlation matrix analysis results.

[0083] The correlation coefficient is a statistic used to measure the degree of linear correlation between two feature dimensions, typically ranging from -1 to 1. The correlation matrix analysis result is a matrix in form, where each element represents the correlation coefficient between two feature dimensions, revealing whether there is redundancy or co-occurrence between different dimensions in the feature space. The terminal iterates through all training feature vectors, calculates the correlation coefficient between any two different feature dimension values, analyzes the resulting correlation matrix, and identifies highly positively or negatively correlated feature dimension groups. Highly correlated feature groups imply overlapping information.

[0084] Step 305: Integrate the correlation matrix analysis results, perturbation sensitivity scores, importance weights, sensitivity distribution maps, and feature dimension category discrimination to obtain a feature importance analysis report.

[0085] The feature importance analysis report is a comprehensive document or data structure that integrates evaluation results for each feature dimension from multiple perspectives, including class discrimination, local sensitivity, gradient importance, perturbation stability, and structural correlation. The terminal aligns and integrates class discrimination, sensitivity distribution maps, importance weights, perturbation sensitivity scores, and correlation matrices, normalizes each indicator, and performs a comprehensive evaluation based on preset weights or rules, ultimately generating one or more comprehensive importance scores for each feature dimension.

[0086] This embodiment generates a comprehensive, three-dimensional, and multi-dimensional feature profile, avoiding the bias that may result from drawing conclusions based on only a single dimension. This ensures the scientific nature and accuracy of subsequent security level classification, and establishes the entire defense plan on a rigorous data analysis foundation.

[0087] In one embodiment, after initializing the dynamic key management system based on system security configuration parameters and generating a defense key set, the method further includes:

[0088] Step 401: Obtain the usage data of the defense key group; and based on the usage data, generate a statistical report on the current usage status of the defense key group; the usage data includes the usage counter of the defense key group, the time of the most recent generation of the defense key group, and the current time.

[0089] The usage data for defense key groups consists of operation logs and status information collected by the key management system during operation, regarding currently used key groups. This data may include: a usage counter to record the total number of times the key group has been used since its creation; the most recent creation time to record the creation timestamp of the current key group; and the current time, the system time at the time of the status check. The usage status statistics report is a comprehensive evaluation report calculated based on the raw usage data, quantitatively describing the current health status and remaining lifespan of the key group. The terminal reads the aforementioned key raw usage data from the key manager's logs and counters. Based on this data, it generates higher-level status indicators through a series of calculations, exemplarily including: average usage frequency, usage intensity level, usage margin, remaining lifespan, and urgency score, enabling continuous monitoring and quantitative evaluation of the key lifecycle.

[0090] Step 402: Compare the usage status statistics report with the preset security policy to check whether the key update triggering conditions are met, and obtain the key update decision result.

[0091] Specifically, the preset security policy is a predefined set of rules and thresholds regarding key management. Key update trigger conditions are specific rules stipulated in the security policy that can initiate a key update process. The key update decision result is a simple binary judgment: update is required or not. The terminal compares each trigger condition in the preset security policy with key indicators from the status statistics report. If any trigger condition is met, the decision result is set to require an update.

[0092] Step 403: If the key update decision result is that an update is needed, prepare the environment and parameters required for new key generation to obtain the newly generated key material set; the environment and parameters include random number generator initialization, encryption algorithm parameter setting, and key length confirmation.

[0093] Specifically, the environment and parameters required for new key generation are the underlying conditions and settings that need to be pre-configured to ensure the secure generation of high-strength keys. Random number generator initialization ensures that the random number source used to generate the key is cryptographically secure and unpredictable. Encryption algorithm parameter settings specify which encryption algorithm the new key will use and set the corresponding parameters. Key length confirmation determines the number of bits in the new key, which is directly related to the difficulty of cracking it. The newly generated key material set is a set of raw, unused key data generated based on the above environment and parameters. The terminal initializes a secure, isolated execution environment to ensure that the key generation process is not interfered with or intercepted. Based on the security configuration, the algorithm type, key length, etc., are set, and the initialized cryptographically secure random number generator is invoked to generate new key material that meets the requirements, ensuring the quality of the generated new key.

[0094] Step 404: Perform integrity verification on the newly generated key material set to obtain a new defense key set; the new defense key set is used to replace the old defense key set.

[0095] Specifically, integrity verification refers to checking the newly generated key material set to ensure that it has not been accidentally modified or maliciously tampered with after generation or during transmission. The new defense key set is a valid key set that has passed integrity verification and can be used immediately. The terminal calculates the hash value of the newly generated key material set and compares it with the expected value to ensure the key data is complete and error-free. After successful verification, an atomic switching operation is performed, setting the new key set as the currently valid key and marking the old key set as expired. To ensure business continuity, tasks currently using the old key are allowed to complete immediately during the switchover, while all new tasks will immediately use the new key.

[0096] This embodiment prevents the use of compromised or captured keys through secure, smooth, and seamless key rotation. The secure replacement mechanism ensures that the defense system can continue to operate without service interruption due to key updates. This allows the encryption foundation of the entire defense to change dynamically, effectively limiting the validity period of a single key. Even if a key is cracked, its impact is temporary and localized, greatly enhancing the long-term security resilience of the defense reinforcement.

[0097] In one embodiment, a usage status statistics report for the current defense key group is generated based on usage data, including:

[0098] Step 501: Based on the usage data, calculate the average usage frequency of the defense key group using the following formula:

[0099]

[0100]

[0101] in, For average usage frequency, For the number of times it is used, For usage duration, For the current time, The creation time is 3600, which is the conversion factor from seconds to hours.

[0102] Specifically, the terminal subtracts the key creation time from the current time to get the total number of seconds the key has been active. The number of seconds is then divided by 3600 to convert it into a total duration in hours. This standardized time unit facilitates comparison with frequency thresholds. The total number of times the key is used is divided by the total usage duration to obtain the average number of times the key is used per hour. This converts the key usage from a cumulative value to a rate value, which can determine whether the key is currently under high or low load. A frequently used key may mean that its security risks accumulate faster and require closer attention.

[0103] Step 502: Based on a preset frequency threshold, map the average usage frequency to the corresponding usage intensity level to obtain the intensity classification result.

[0104] The preset frequency thresholds are a set of values ​​predefined by the security policy to divide different usage strength intervals. The usage strength coefficient is a numerical coefficient corresponding to the strength level, transforming discrete levels into continuous weights that can be used for subsequent mathematical calculations. The strength classification result characterizes the level to which the key's current usage strength belongs. The terminal compares the calculated average usage frequency with the preset frequency thresholds to determine which interval it falls into, thus classifying it into the corresponding usage strength level and assigning it the appropriate strength coefficient.

[0105] Step 503: Calculate the remaining usage of the defense key set based on the usage data; and calculate the remaining lifespan of the defense key set.

[0106] Here, "remaining capacity" refers to the number of times the current key can be used, expressed by the formula... Calculate, where, To use the margin, The maximum number of uses threshold, The remaining lifespan refers to the number of uses; the remaining validity period refers to the remaining effective time of the current key, calculated using the formula... Calculate, where, For the remaining service life, The maximum usage time threshold, For the current time, The terminal performs a threshold-based consumption calculation based on the creation time. According to the two impact limits set by the security policy, it calculates the remaining amount of the current key before expiration from both the frequency and time perspectives.

[0107] Step 504: Based on the strength classification results, remaining service life, and remaining useful life, calculate the urgency score using the following formula:

[0108]

[0109] in, Assess urgency level. , , For the corresponding weighting coefficients, To use the margin, The maximum number of uses threshold, For the remaining service life, The maximum usage time threshold, For the use of strength coefficient.

[0110] Specifically, the terminal performs multi-factor weighted fusion. The less remaining usage, the closer the urgency level is to 1, indicating higher urgency in the usage dimension. Conversely, the shorter the remaining lifetime, the closer the urgency level is to 1, indicating higher urgency in the time dimension. Each component is multiplied by its preset weight coefficient and then summed to obtain the final urgency score. The weight coefficients reflect the security strategy's emphasis on different factors.

[0111] Step 505: Integrate the urgency score, intensity classification results, remaining usage, and service life to obtain a usage status statistical report.

[0112] Specifically, the terminal aggregates and encapsulates information, integrating all calculated key indicators and classification results, including average usage frequency, intensity classification results, usage margin, remaining lifespan, and urgency score, into a structured data object or document.

[0113] This embodiment generates comprehensive factual evidence for key management decisions, compares it with preset security policies, and ultimately automatically decides whether to immediately initiate the key update process, ensuring the objectivity, timeliness, and accuracy of key management decisions.

[0114] In one embodiment, after embedding the digital watermark into the encrypted feature vector to obtain the protection feature vector, the method further includes:

[0115] Step 601: Compare the similarity between the digital watermark in the protected feature vector and the expected digital watermark recalculated based on the current key and feature content to obtain the feature integrity verification result.

[0116] The digital watermark in the protection feature vector is a digest embedded in the encrypted feature vector, representing the original record of the feature vector in its encrypted state. The expected digital watermark, recalculated based on the current key and feature content, is a new watermark calculated in real-time for verification. The calculation process is identical to the previous steps, using the currently valid defense key set to recalculate the hash value of the received protection feature vector. Similarity comparison refers to the operation of comparing two digital watermarks. Since hash values ​​are usually strings, the comparison can be a similarity calculation. The feature integrity verification result is a confidence score, used to explicitly indicate whether the protection feature vector has been tampered with or damaged from its creation to the current verification time. The terminal extracts the previously embedded digital watermark from the received protection feature vector by parsing specific fields or performing an inverse transformation. Using the currently received entire protection feature vector and the currently valid defense key set as input, it performs the same hash function operation again to obtain a new, expected digital watermark. The watermark extracted in the first step is compared with the expected watermark calculated in the second step. If they are completely identical, the verification passes; otherwise, the verification fails.

[0117] Step 602: If the feature integrity verification result indicates that the protected feature vector is intact, then the corresponding decryption algorithm is used to restore the protected feature vector to obtain the original feature vector.

[0118] Specifically, the corresponding decryption algorithm refers to the inverse operation algorithm corresponding to the encryption algorithm used in the aforementioned steps. For example, if homomorphic encryption was used during encryption, homomorphic decryption is used during decryption; if noise was added during encryption, noise removal or inverse transformation is required during decryption. The original feature vector is the feature vector obtained after decrypting and restoring the protection feature vector. The terminal only performs a reverse, step-by-step restoration process when the verification result is complete. The reverse embedding operation removes the digital watermark information from the protection feature vector, obtaining a pure encrypted feature vector. Using the corresponding key in the defense key set, the encrypted feature vector is decrypted according to the reverse order and algorithm used during encryption. The feature vector is restored to its original state before encryption, ensuring that the defense measures do not affect the normal and legitimate classification process.

[0119] Step 603: Input the original feature vector into the classifier of the image classification model to obtain the probability distribution of the image belonging to each category.

[0120] Specifically, the classifier in an image classification model is the part located after the feature extraction layer. It calculates the probability that an image belongs to each preset category based on the feature vector. The probability distribution is a vector where each element corresponds to an image category, and the value of each element represents the probability that the input image belongs to that category. The sum of all probabilities is 1. The terminal inputs the reconstructed original feature vector into the classifier of the image classification model. After a series of linear or nonlinear operations within the classifier, the feature vector outputs a probability distribution.

[0121] Step 604: Identify the image as the category with the highest probability in the probability distribution to obtain the image classification result.

[0122] Specifically, the category with the highest probability in the probability distribution is the category label with the highest probability value in the probability distribution vector. The image classification result is a clear category label that represents the model's classification of the input image content. The terminal scans the probability distribution vector, finds the element with the largest value, and determines the category label corresponding to that element as the image classification result.

[0123] This embodiment obtains classification results while ensuring that the input features have not been tampered with by adversarial attacks, thus exhibiting high reliability. It successfully and significantly improves the defense capability against adversarial attacks without sacrificing functionality. Any malicious modification or accidental damage to the protected feature vector will cause the recalculated expected watermark to mismatch with the previously embedded watermark, enabling the defense reinforcement measures to detect tampering in a timely manner and prevent potentially contaminated features from entering the subsequent classification process, thereby improving the reliability of the defense.

[0124] In one embodiment, based on the defense key set, different levels of feature subsets are encrypted using corresponding encryption algorithms to obtain encrypted feature vectors, including:

[0125] Step 701: Based on the defense key set, homomorphic encryption is performed on the high-security feature subset to obtain advanced encryption features.

[0126] Specifically, homomorphic encryption is a special encryption algorithm that allows specific mathematical operations to be performed directly on the ciphertext. The result of the operation, after decryption, is identical to the result of performing the same operation on the plaintext, meaning that data can be processed without decryption. Advanced encryption features are ciphertext forms obtained by homomorphically encrypting a subset of high-security features. The terminal uses a specific key allocated for homomorphic encryption in the defense key set to perform homomorphic encryption operations on the high-security feature subset. After encryption, the original sensitive feature values ​​are transformed into unreadable ciphertext. It provides the highest level of confidentiality protection for the most important features; even if an attacker obtains the encryption features, they cannot decipher their content without the key. The characteristics of homomorphic encryption reserve the possibility of performing advanced computations in an encrypted state in the future. Due to the high computational cost, it is only used for the most critical feature subset, achieving a balance between security and efficiency.

[0127] Step 702: Perform a random projection linear transformation on the feature subset of the medium security level to obtain the medium-level projection features; and add Gaussian noise to the medium-level projection features to obtain the medium-level encryption features.

[0128] Random projection linear transformation is a dimensionality reduction obfuscation technique that uses a matrix generated by random numbers to linearly transform the original feature vector, projecting it onto a new feature space. Intermediate projection features are intermediate results obtained by applying random projection linear transformation to a subset of features with medium security levels. Gaussian noise is a random value conforming to a Gaussian distribution, with its strength and mean controlled by the defense key group. Intermediate encryption features are obtained by adding Gaussian noise of a specific strength to the intermediate projection features. The terminal uses a random matrix derived from the key to linearly transform the subset of features with medium security levels, changing the spatial structure and values ​​of the features to achieve obfuscation. Adding key-controlled Gaussian noise to the transformed features further increases the uncertainty and randomness of the feature values, making it difficult for attackers to reverse engineer. This is a compromise solution with computational efficiency far exceeding homomorphic encryption, while still offering considerable security strength.

[0129] Step 703: Apply a nonlinear activation function to the low-security feature subset to perform light obfuscation, thereby obtaining low-level encryption features.

[0130] Nonlinear activation functions are fundamental mathematical functions in deep learning, introducing nonlinear transformations into data. Low-level encryption features are obtained by transforming a subset of low-security features using a nonlinear activation function. Applying a nonlinear activation function to the low-security feature subset at the terminal can be viewed as a form of nonlinear obfuscation where the function determines whether the obfuscation is reversible or irreversible, achieving a basic obfuscation effect with extremely low computational cost.

[0131] Step 704: Based on the random rearrangement sequence in the defense key group, rearrange the feature dimensions of the high-level encryption features, intermediate-level encryption features, and low-level encryption features to obtain the encryption feature vector.

[0132] Specifically, the random rearrangement sequence in the defense key set is a non-repeating random index sequence generated by the defense key set, used to specify the new order of feature dimensions. The encrypted feature vector is a complete, encrypted feature vector formed by recombining all dimensions of the high-level, mid-level, and low-level encryption features according to the new order specified by the random rearrangement sequence. The terminal concatenates all the obtained encryption features into a temporary vector, and then, according to the random rearrangement sequence, completely scrambles and rearranges each dimension of this temporary vector to form the final encrypted feature vector.

[0133] This embodiment achieves a balance between security and computational efficiency by applying encryption methods with different costs to feature subsets of different levels. It performs global scrambling of encrypted features, disrupting the relative positional relationships of features of different security levels in the vector. This makes it impossible for attackers to infer which dimensions belong to the high security level by analyzing the vector structure. It adds an extra layer of position-based obfuscation, hiding the traces of hierarchical encryption, making the encrypted feature vectors appear more uniform and random as a whole. This further increases the difficulty for attackers to conduct targeted analysis and achieves the effect of protecting the image classification model in adversarial attacks.

[0134] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0135] Based on the same inventive concept, this application also provides an apparatus for implementing the above-described method for defending against and hardening against adversarial attacks on image classification models. The solution provided by this apparatus is similar to the implementation described in the above-described method. Therefore, the specific limitations of one or more embodiments of the apparatus for defending against and hardening against adversarial attacks on image classification models provided below can be found in the above-described limitations of the method for defending against and hardening against adversarial attacks on image classification models, and will not be repeated here.

[0136] In one exemplary embodiment, such as Figure 2 As shown, a defense and hardening device 800 for adversarial attacks against image classification models is provided, comprising:

[0137] The extraction module 801 is used to input the image to be classified into the feature extraction layer of the trained image classification model to extract features and obtain the original feature vector.

[0138] The hierarchical module 802 is used to classify each feature dimension in the original feature vector according to a preset security level classification table to obtain a feature subset; the security level classification table includes at least three levels.

[0139] The encryption module 803 is used to encrypt feature subsets of different levels based on the defense key group by applying corresponding encryption algorithms to obtain encrypted feature vectors.

[0140] The watermark module 804 is used to calculate the hash value of the encrypted feature vector based on the defense key group to obtain a digital watermark; and to embed the digital watermark into the encrypted feature vector to obtain a protection feature vector.

[0141] Furthermore, the device also includes a basic module for:

[0142] Based on the trained image classification model and the corresponding training dataset, the contribution of each feature dimension to the classification result and its sensitivity to adversarial attacks are evaluated, and a feature importance analysis report is obtained.

[0143] Based on the feature importance analysis report, the feature dimensions are divided into multiple levels to obtain a security level classification table;

[0144] Based on the system security configuration parameters, the dynamic key management system is initialized to generate a defense key group; the system security configuration parameters include the selection of encryption algorithm, key length and update frequency.

[0145] Furthermore, the basic module is also used for:

[0146] The training dataset is input into the image classification model to obtain the training feature vector; the average activation intensity of each feature dimension on samples of different categories is calculated, the feature dimensions that make key contributions to the classification decision are identified, and the feature dimension class discrimination is obtained.

[0147] Based on the occlusion sensitivity analysis method, the influence of different regions of the image on the feature dimensions is evaluated to obtain a sensitivity distribution map; and the gradient contribution of each feature dimension to the classification decision is calculated to obtain the importance weight.

[0148] Slight random noise and simulated adversarial perturbations were added to the training dataset, and the stability changes of each feature dimension under the perturbations were observed to obtain the perturbation sensitivity score.

[0149] Calculate the correlation coefficients between different feature dimensions, analyze the structural characteristics of the feature space, and obtain the correlation matrix analysis results;

[0150] By integrating the results of correlation matrix analysis, perturbation sensitivity score, importance weight, sensitivity distribution map, and feature dimension category discrimination, a feature importance analysis report is obtained.

[0151] Furthermore, the device also includes an update module for:

[0152] Acquire usage data for the defense key group; and based on the usage data, generate a statistical report on the current usage status of the defense key group; the usage data includes the usage counter of the defense key group, the time of the most recent generation of the defense key group, and the current time;

[0153] The status statistics report and the preset security policy are compared to check whether the key update triggering conditions are met, and the key update decision result is obtained.

[0154] If the key update decision result is that an update is needed, then prepare the environment and parameters required for new key generation to obtain the newly generated key material set; the environment and parameters include random number generator initialization, encryption algorithm parameter settings, and key length confirmation;

[0155] The integrity of the newly generated key material set is verified to obtain a new defense key set; the new defense key set is used to replace the old defense key set.

[0156] Furthermore, the update module is also used for:

[0157] Based on usage data, the average usage frequency of the defense key group is calculated using the following formula:

[0158]

[0159]

[0160] in, For average usage frequency, For the number of times it is used, For usage duration, For the current time, The creation time is 3600, which is the conversion factor from seconds to hours.

[0161] Based on a preset frequency threshold, the average usage frequency is mapped to the corresponding usage intensity level to obtain the intensity classification result;

[0162] Based on usage data, calculate the remaining usage margin of the defense key set; and calculate the remaining lifetime of the defense key set.

[0163] Based on the strength classification results, remaining service life, and remaining useful life, the urgency score is calculated using the following formula:

[0164]

[0165] in, Assess urgency level. , , For the corresponding weighting coefficients, To use the margin, The maximum number of uses threshold, For the remaining service life, The maximum usage time threshold, To use the strength coefficient;

[0166] By integrating urgency scores, intensity classification results, remaining usage capacity, and service life, a usage status statistical report is obtained.

[0167] Furthermore, the device also includes a sorting module for:

[0168] The similarity of the digital watermark in the protected feature vector with the expected digital watermark recalculated based on the current key and feature content is compared to obtain the feature integrity verification result.

[0169] If the feature integrity verification result indicates that the protected feature vector is intact, then the corresponding decryption algorithm is used to restore the protected feature vector to obtain the original feature vector;

[0170] The original feature vector is input into the classifier of the image classification model to obtain the probability distribution of the image belonging to each category;

[0171] The image is identified as the category with the highest probability in the probability distribution, thus obtaining the image classification result.

[0172] Furthermore, the encryption module 803 is also used for:

[0173] Based on the defense key set, homomorphic encryption is performed on a high-security feature subset to obtain advanced encryption features;

[0174] A random projection linear transformation is performed on a subset of features with medium security level to obtain intermediate projection features; Gaussian noise is then added to the intermediate projection features to obtain intermediate encryption features.

[0175] A low-security feature subset is lightly obfuscated by applying a nonlinear activation function, resulting in a low-level encryption feature.

[0176] Based on the random rearrangement sequence in the defense key group, the feature dimensions of high-level encryption features, intermediate-level encryption features, and low-level encryption features are rearranged to obtain the encryption feature vector.

[0177] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of a method for defending against and hardening an adversarial attack on an image classification model as described above.

[0178] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0179] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0180] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A defense and hardening method against an adversarial attack on an image classification model, characterized in that, The method comprises: inputting the image to be classified into the feature extraction layer of the trained image classification model for feature extraction to obtain an original feature vector; based on a preset security level classification table, classifying each feature dimension in the original feature vector to obtain a feature subset; the security level classification table comprises at least three levels; based on a defense key group, applying a corresponding encryption algorithm to the feature subset of different levels for encryption to obtain an encrypted feature vector; based on the defense key group, calculating the hash value of the encrypted feature vector to obtain a digital watermark; and embedding the digital watermark in the encrypted feature vector to obtain a protected feature vector.

2. The method of claim 1, wherein, Before the step of inputting the image to be classified into the feature extraction layer of the image classification model for feature extraction to obtain an original feature vector, the method further comprises: based on the trained image classification model and the corresponding training data set, evaluating the contribution degree of each feature dimension to the classification result and the adversarial attack sensitivity to obtain a feature importance analysis report; based on the feature importance analysis report, dividing the feature dimensions into multiple levels to obtain the security level classification table; based on system security configuration parameters, initializing a dynamic key management system to generate the defense key group; the system security configuration parameters include encryption algorithm selection, key length and update frequency.

3. The method of claim 2, wherein, The step of evaluating the contribution degree of each feature dimension to the classification result and the adversarial attack sensitivity based on the trained image classification model and the corresponding training data set to obtain a feature importance analysis report comprises: inputting the training data set into the image classification model to obtain a training feature vector; and calculating the average activation intensity of each feature dimension on different category samples to identify the feature dimensions that are critical to classification decision, to obtain the feature dimension category discriminability; based on a blocking sensitivity analysis method, evaluating the influence of different regions of the image on the feature dimensions to obtain a sensitivity distribution map; and calculating the gradient contribution of each feature dimension to the classification decision to obtain an importance weight; adding slight random noise and simulated adversarial perturbation to the training data set to observe the stability change of each feature dimension under perturbation to obtain a perturbation sensitivity score; calculating the correlation coefficient between different feature dimensions to analyze the structural characteristics of the feature space to obtain a correlation matrix analysis result; integrating the correlation matrix analysis result, the perturbation sensitivity score, the importance weight, the sensitivity distribution map and the feature dimension category discriminability to obtain the feature importance analysis report.

4. The method of claim 2, wherein, After the step of initializing a dynamic key management system based on system security configuration parameters to generate the defense key group, the method further comprises: obtaining the use data of the defense key group; and based on the use data, generating a use state statistical report of the current defense key group; the use data includes the use counter of the defense key group, the time of the last generation of the defense key group and the current time; comparing the use state statistical report with a preset security policy to check whether the key update trigger condition is met to obtain a key update decision result; If the key update decision result is that the key needs to be updated, an environment and parameters required for generating a new key are prepared, and a newly generated key material group is obtained; the environment and parameters include random number generator initialization, encryption algorithm parameter setting, and key length confirmation; The newly generated key material group is subjected to integrity verification, and a new defense key group is obtained; the new defense key group is used to replace the old defense key group.

5. The method of claim 4, wherein, The use state statistical report of the current defense key group is generated based on the use data, including: Based on the use data, the average use frequency of the defense key group is calculated by the following formula: wherein, is the average frequency of use, is the number of uses, is the length of use, is the current time, is the creation time, 3600 is the conversion factor from seconds to hours; Based on a preset frequency threshold, the average use frequency is mapped to a corresponding use intensity level to obtain an intensity classification result; Based on the use data, the use margin of the defense key group is calculated; and the remaining use life of the defense key group is calculated; Based on the intensity classification result, the use margin, and the remaining use life, the urgency score is calculated by the following formula: wherein, is an urgency score, , , is a corresponding weight coefficient, is a usage margin, is a maximum usage number threshold, is a remaining usage life, is a maximum usage duration threshold, is a usage intensity coefficient; The urgency score, the intensity classification result, the use margin, and the use life are integrated to obtain the use state statistical report.

6. The method of claim 1, wherein, After the digital watermark is embedded in the encrypted feature vector to obtain a protected feature vector, the method further includes: The digital watermark in the protected feature vector is compared with an expected digital watermark recalculated based on a current key and feature content to obtain a feature integrity verification result; If the feature integrity verification result indicates that the protected feature vector is complete, a corresponding decryption algorithm is used to restore the protected feature vector to obtain the original feature vector; The original feature vector is input into a classifier of the image classification model to obtain a probability distribution of the image belonging to each category; The image is determined as the category with the maximum probability in the probability distribution to obtain an image classification result.

7. The method of claim 1, wherein, The encrypted feature vector is obtained by applying corresponding encryption algorithms to different levels of the feature subsets based on the defense key group, including: The high-level encrypted feature is obtained by homomorphic encryption of the feature subset with a high security level based on the defense key group; The medium-level projection feature is obtained by random projection linear transformation of the feature subset with a medium security level; and Gaussian noise is added to the medium-level projection feature to obtain a medium-level encrypted feature; The low-level encrypted feature is obtained by applying a nonlinear activation function to slightly confuse the feature subset with a low security level; The feature dimension of the high-level encrypted feature, the medium-level encrypted feature, and the low-level encrypted feature is rearranged based on the random reordering column in the defense key group to obtain the encrypted feature vector.

8. A device for defending against and hardening against adversarial attacks on image classification models, characterized in that, The device includes: An extraction module configured to input an image to be classified into a feature extraction layer of a trained image classification model for feature extraction to obtain an original feature vector; A hierarchical module configured to classify each feature dimension in the original feature vector based on a preset security level classification table to obtain a feature subset; the security level classification table includes at least three levels. An encryption module is configured to encrypt the feature subsets of different levels based on a defense key set by applying corresponding encryption algorithms to obtain encrypted feature vectors. A watermark module is configured to calculate hash values of the encrypted feature vectors based on the defense key set to obtain digital watermarks, and embed the digital watermarks in the encrypted feature vectors to obtain protected feature vectors. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program, when executed by the processor, implements the steps of the method of any one of claims 1 to 7.

Images