An adversarial attack defense method based on pulse neural network and internal dynamic activation review

Abstract

This invention belongs to the field of artificial intelligence security technology and discloses an adversarial attack defense method based on spiking neural networks and internal dynamic activation auditing. This invention aims to solve the problem that existing static detection methods struggle to capture subtle adversarial perturbations. The method includes: pre-setting feature probes in a frozen target model; calculating gradient sensitivity and generating dynamic attention weights; constructing a temporal input code that integrates a dynamic weighted flow and a static baseline flow; utilizing the leakage integral distribution characteristic of spiking neural networks to transform the static code into a dynamic pulse sequence for temporal dynamic auditing; and generating a discriminant score based on the output layer membrane potential to intercept adversarial examples. This invention, through adaptive focusing on key feature layers and the temporal amplification effect of spiking neural networks, can effectively identify deeply hidden adversarial traces, significantly improving the robustness and security of deep learning models under various white-box and black-box attacks.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence security and deep learning defense technology. Specifically, it relates to an adversarial example defense method that uses a dynamic probe mechanism to capture the internal state of a model and combines it with a spiking neural network for temporal anomaly detection. This method is particularly suitable for improving the robustness and security of deep learning models in security-critical fields such as autonomous driving perception systems, facial recognition access control, and intelligent diagnosis of medical images. Background Technology

[0002] Deep neural networks excel in computer vision tasks, but their structure inherently makes them highly vulnerable to adversarial attacks. Attackers can induce high-performance models to output incorrect results with extremely high confidence by simply superimposing tiny perturbations, imperceptible to the human visual system, onto the original image.

[0003] Existing defense techniques mainly include adversarial training, gradient obfuscation, and adversarial detection. While adversarial training can improve model robustness, it often comes with huge computational resource consumption and is difficult to generalize to unknown attack types outside the training set. Gradient obfuscation techniques attempt to hinder attackers by disrupting gradient calculations, but have been shown to be easily bypassed by adaptive attack strategies such as approximate gradients. Traditional adversarial detection methods usually treat the detected samples as static data points and judge anomalies by analyzing their statistical distribution in the feature space. This approach is passive, lacks the ability to actively examine the dynamic changes in the information flow within the model, and often struggles to achieve a balance between detection rate and false positive rate.

[0004] To achieve deeper defense, some studies have begun to focus on the activation features of intermediate layers within the model. However, existing techniques have significant limitations in utilizing this internal information: First, the setting of observation points is usually static and empirical, unable to dynamically adjust the degree of attention to different layers based on the specific content of the input image, resulting in low information extraction efficiency, either missing key anomalies or introducing excessive noise; second, for the extracted multi-layer features, simple concatenation or weighted averaging is often used before feeding them into a common classifier. This approach is essentially a static voting mechanism, ignoring the temporal cumulative effects and nonlinear dynamic distortions caused by adversarial perturbations propagating deep within the model, making it difficult to analyze the complex spatiotemporal dependencies between internal signals. Therefore, how to effectively capture deeply hidden adversarial perturbation traces without sacrificing the original model performance remains a challenge that lacks mature and efficient solutions. Summary of the Invention

[0005] To address the problems of low utilization of internal features, lack of dynamic attention mechanisms, and difficulty in capturing subtle adversarial perturbations by static detectors in existing technologies, this invention provides an adversarial attack defense method based on spiking neural networks and internal dynamic activation review. The method of this invention includes the following steps: Step S1: Receive the input digital image to be detected and the pre-trained target deep neural network model, and keep all parameters of the target deep neural network model frozen during the defense process; Step S2: Dynamically sample and fuse the internal state of the target deep neural network model to construct a temporal input code that comprehensively reflects the model's response characteristics; Step S3: Perform time-series dynamic auditing on the time-series input code using a spiking neural network, and output a binary classification result based on the audit results.

[0006] Optionally, step S2 includes: Step S21: Multiple feature probes are preset at different layers of the target deep neural network model, and the feature probes are used to capture the intermediate layer feature map during the forward propagation of the input digital image. Step S22: Based on the prediction results of the current input digital image, calculate the gradient norm of the classification loss function relative to the feature map captured by each feature probe to quantify the sensitivity, and convert the sensitivity into a dynamic attention weight vector through a mapping network. Step S23: Construct a feature fusion mechanism that includes a dynamic weighted stream and a static baseline stream, combine the dynamic attention weight vector with the feature vector, and concatenate the weight vector itself to form the temporal input code.

[0007] Optionally, step S3 includes: Step S31: The timing input code is used as an analog current input to the spiking neural network audit module, and the static code is converted into a dynamic pulse sequence by utilizing the dynamic characteristics of the leakage integral firing neuron. Step S32: Calculate the average membrane potential of the output layer of the spiking neural network audit module, generate a discrimination score, and if it is determined to be an adversarial sample, intercept it; if it is determined to be a clean sample, output the original classification result.

[0008] Compared with existing technologies, this invention has the following significant advantages: First, it abandons the traditional static feature extraction method and proposes a sensitivity-driven dynamic probe mechanism, which can adaptively identify and amplify the feature levels that have the greatest impact on the classification results according to the characteristics of each input sample, thereby accurately capturing key traces of adversarial perturbations. Second, it innovatively introduces a spiking neural network as an auditor, utilizing its unique temporal dynamics characteristics to expand the originally static feature vector into a pulse sequence that evolves over time. This mechanism is similar to integrating and amplifying abnormal signals in the time dimension, greatly improving the detection sensitivity to weak perturbations. Finally, through the fusion of dynamic and static flows and a multi-objective joint optimization strategy, this invention ensures strong generalization ability against unknown attacks while effectively avoiding misjudgment of clean samples, achieving an excellent balance between defense effectiveness and operational efficiency. Attached Figure Description

[0009] Figure 1 This is a flowchart of an adversarial attack defense method based on spiking neural networks and internal dynamic activation review provided by an embodiment of the present invention. Detailed Implementation

[0010] Step S1: Receive the input digital image to be detected. and pre-trained target deep neural network model . Target model All weight and bias parameters are set to an untrainable state, and their parameter values ​​are frozen.

[0011] Step S2 involves dynamically sampling and fusing the internal states of the target deep neural network model to construct a temporal input code that comprehensively reflects the model's response characteristics. The specific execution process of this step is as follows: Step S21, define a set of feature probes. ,in This represents the number of probes. If the target model... For convolutional neural network architecture, feature probes are registered at the output node immediately before the spatial downsampling operation at the end of each major convolutional stage. If the target model For the visual Transformer architecture, feature probes are registered at the output nodes of the shallow, middle, and deep layers of the encoder stack. The forward hook mechanism of the deep learning framework is used to attach these probes to the specified layers.

[0012] Input digital image Input Model To propagate forward, through this Each probe captures the intermediate feature map tensor of the corresponding layer and outputs a set of feature maps. .

[0013] Step S22, Obtain the model For the current input Predicted output category Based on this prediction category The backpropagation algorithm is used to calculate the classification loss function. Relative to sets Each feature map gradient The scalar form of the sensitivity energy is obtained by calculating the L2 norm of each gradient tensor. .

[0014] Construct a vector consisting of the sensitivity energies of all probes. And perform L2 normalization operation on it to obtain ,in is the numerical stability constant.

[0015] Normalize the sensitivity vector The input is fed into a multilayer perceptron network containing an input layer, hidden layers, and an output layer, with an output dimension of . The log-odds vector.

[0016] Perform temperature coefficient on the log-probability vector The Softmax function operation outputs a normalized dynamic attention weight vector. .

[0017] Step S23, set Each original feature map in An adaptive average pooling layer is used to compress the space to a uniform size, and then a linear projection layer is used to map it to a uniform feature dimension. This yields a standardized set of feature vectors. .

[0018] Dynamically monitor the weight vector Each element in respectively with the corresponding standardized feature vectors Perform scalar multiplication and concatenate all product results to obtain the dynamically weighted stream vector. .

[0019] Utilizing a globally learnable scalar parameter With all standardized feature vectors Perform scalar multiplication and concatenate all product results to obtain the static reference flow vector. .

[0020] Learnable fusion coefficients activated by the Sigmoid function right and Perform a linear weighted summation to obtain the mixed feature vector. .

[0021] Dynamically monitor the weight vector spliced ​​into the mixed feature vector The tail of the output timing input code .

[0022] Step S3 involves performing a temporal dynamics audit on the temporal input code using a spiking neural network, and outputting a binary classification result based on the audit results. The specific execution process of this step is as follows: Step S31: Encode the timing input. A constant analog current is input to the spiking neural network audit module, which consists of multi-layered leakage integral discharge neurons.

[0023] Set the simulation time window to Each discrete time step. For the first Layer neurons, based on the residual membrane potential from the previous time step Synaptic input at the current time step and the reset voltage of the previous time step Update current membrane potential Its update formula can be expressed as: in As the attenuation factor, This is the weight matrix. This is the output of the previous layer. The threshold value is used.

[0024] For the first layer neurons, set their input... All time steps are Determine the updated membrane potential. Is it greater than The pulse firing is determined using a step function: in This is a step function; if it is greater than a certain value, an output pulse will be generated. Record the reset status; otherwise, output... .

[0025] Step S32, after completion After simulation at each time step, the average membrane potential values ​​of the output layer neurons of the spiking neural network audit module are calculated at all time steps to obtain the discrimination score vector. The calculation formula is: in Represents the output layer neurons at time step The membrane potential vector, This represents the total number of time steps.

[0026] right Perform a softmax operation to obtain normalized classification probabilities. If the probability result corresponds to the "adversarial example" category, discard the input. If it corresponds to the "clean sample" category, then output the model. The original classification results. During the training phase, based on the total loss function... Update the parameters of the mapping network and the spiking neural network auditing module. The total loss function formula is as follows: in Represents the cross-entropy detection loss. and These represent the weight coefficients of the contrastive loss and the entropy regularization term, respectively. The contrastive weight loss... The calculation formula is: in Represents batch size. This represents the preset boundary threshold. This represents the number of probes. and Representing the first The dynamic attention weight vector generated by the clean and adversarial versions of each sample. Represents the L1 norm. The composite entropy regularization term... The calculation formula is: in Represents the desired operation. Shannon entropy represents the weight vector. Represents the maximum possible entropy value. Represents the KL divergence. It represents a uniform distribution.

[0027] This invention, through the aforementioned steps, particularly by combining sensitivity-driven dynamic probe weighting, multi-source feature stream fusion, and a temporal dynamic auditing mechanism based on spiking neural networks, can transform weak adversarial perturbations latent in the activation features of deep models into significant temporal anomaly signals, thereby achieving precise interception. Experimental results show that this method achieves significant defense effects against various mainstream network architectures, including VGG, ResNet, and Vision Transformer, on large-scale benchmark datasets such as CIFAR-10 and ImageNet. Specifically, on the CIFAR-10 dataset, for the VGG16 model, when facing high-intensity AutoAttack white-box attacks, this method significantly improves the robust accuracy from the baseline of 5.4% to 68.0%; for the WideResNet-34-10 model, the robust accuracy is greatly improved from 9.5% to 73.5%; and when facing black-box Square Attacks, the ResNet50 model achieves a high robustness of 88.0%. On the more challenging ImageNet dataset, this method also performs exceptionally well, improving the robust accuracy of ResNet50 against AutoAttacks from 6.2% to 48.0%, and the robust accuracy of ViT-B / 16 from 7.8% to 51.0%. Furthermore, as an independent detector, this method demonstrates extremely high accuracy in distinguishing clean samples from adversarial examples, with the false positive rate (FPR) consistently below 1.5% across all test models, reaching a minimum of 0.8%. Simultaneously, the area under the receiver operating characteristic (AUROC) curve exceeds 98.8% for various attacks, reaching a maximum of 99.7%, and achieves a true positive rate (TPR) exceeding 99% against highly covert black-box attacks, effectively balancing the security of the defense with the usability of the system.

[0028] The above embodiments are merely one specific implementation of the present invention and are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, without departing from the core ideas and spirit of the present invention, various equivalent substitutions, modifications, or improvements can be made to the specific formula forms, network layer selection, spiking neuron models, hyperparameter settings, etc., and all such changes should be included within the scope of protection of the present invention. For example, the specific number and location of feature probes can be adjusted according to different model depths; other gradient variants can be used for sensitivity calculation; and the neuron model of the spiking neural network can also be replaced with other variant models possessing temporal memory capabilities.

Claims

1. A method for defending against adversarial attacks based on pulse neural networks and internal dynamic activation review, characterized in that, Includes the following steps: Step S1: Receive the input digital image to be detected and the pre-trained target deep neural network model, and keep all parameters of the target deep neural network model frozen during the defense process; Step S2: Dynamically sample and fuse the internal state of the target deep neural network model to construct a temporal input code that comprehensively reflects the model's response characteristics; Step S3: Perform time-series dynamic auditing on the time-series input code using a spiking neural network, and output a binary classification result based on the audit results; Step S2 includes the following steps: Step S21: Multiple feature probes are preset at different layers of the target deep neural network model, and the feature probes are used to capture the intermediate layer feature map during the forward propagation of the input digital image. Step S22: Based on the prediction results of the current input digital image, calculate the gradient norm of the classification loss function relative to the feature map captured by each feature probe to quantify the sensitivity, and convert the sensitivity into a dynamic attention weight vector through a mapping network. Step S23: Construct a feature fusion mechanism that includes a dynamic weighted stream and a static baseline stream, combine the dynamic attention weight vector with the feature vector, and concatenate the weight vector itself to form the temporal input code; Step S3 includes the following steps: Step S31: The timing input code is used as an analog current input to the spiking neural network audit module, and the static code is converted into a dynamic pulse sequence by utilizing the dynamic characteristics of the leakage integral firing neuron. Step S32: Calculate the average membrane potential of the output layer of the spiking neural network audit module, generate a discrimination score, and if it is determined to be an adversarial sample, intercept it; if it is determined to be a clean sample, output the original classification result.

2. The method according to claim 1, characterized in that, In step S21, the preset positions of the feature probes follow the principle of hierarchical representativeness. For convolutional neural network architectures, the feature probes are deployed at the output nodes at the end of each major convolutional stage and before the spatial downsampling operation. For visual Transformer architectures, the feature probes are deployed at the shallow, middle and deep output nodes of the encoder stacking layers.

3. The method according to claim 1, characterized in that, In step S22, the process of calculating the gradient norm and converting it into a dynamic attention weight vector includes: calculating the L2 norm of the gradient of the classification loss function of the target deep neural network model with respect to the feature map captured by the k-th probe as the original sensitivity value; performing L2 normalization on the vector composed of the original sensitivity values ​​of all probes; inputting the normalized sensitivity vector into a multilayer perceptron network to output the log odds, and processing it through a Softmax function with a temperature coefficient to obtain the normalized dynamic attention weight vector.

4. The method according to claim 1, characterized in that, In step S23, the feature fusion mechanism processes as follows: adaptive average pooling and projection are performed on the feature map captured by the feature probe to obtain a standardized feature vector; a dynamic weighted stream is constructed, that is, the elements of the dynamic attention weight vector are multiplied with the corresponding standardized feature vectors and concatenated; a static baseline stream is constructed, that is, the standardized feature vectors are weighted and concatenated using a globally learnable scalar; the dynamic weighted stream and the static baseline stream are linearly combined using learnable fusion coefficients to obtain a hybrid feature vector; the hybrid feature vector is concatenated with the dynamic attention weight vector to form the temporal input encoding.

5. The method according to claim 1, characterized in that, In step S31, the neuronal dynamics of the spiking neural network audit module are as follows: at each discrete time step, the membrane potential of the neuron is updated based on the residual membrane potential of the previous time step, the synaptic input of the current time step, and the reset voltage of the previous time step; the synaptic input is obtained by weighting the pulse signal emitted by the previous layer of neurons in the current time step through the synaptic weight matrix; when the membrane potential exceeds a preset threshold, a pulse is generated and the sensor is reset.

6. The method according to claim 1, characterized in that, The method also includes a joint training step, with the total loss function consisting of three parts: a cross-entropy detection loss based on binary labels; a contrastive weight loss, used to maximize the L1 distance between the dynamic attention weight vectors generated by the clean and adversarial versions of the same image; and a composite entropy regularization term, which includes constraints on maximizing the Shannon entropy of the dynamic attention weight vector and minimizing the KL divergence of a uniform distribution.

7. A defense system against adversarial attacks based on a spiking neural network and internal dynamic activation review, characterized in that, The system is configured to perform the method as described in any one of claims 1 to 6.

Images