A robust image classification method based on activation function constraint optimization

Abstract

The application discloses a robust image classification method based on activation function constraint optimization, which is applied to the field of image processing and aims at the problem that computer vision images are prone to misjudgment under the conditions of adversarial perturbation, noise interference and distribution deviation. The first-order derivative upper bound and the second-order derivative (curvature) upper bound of the activation function of the image classification model are controlled and designed to generate a robust activation function with low derivative peak value and smooth curvature. Meanwhile, the method further establishes a systematic evaluation process and index system for robustness, on the basis that the candidate activation function meets the derivative boundary constraint, combines the network-level Lipschitz index, Jacobian stability index and the results of adversarial training and multi-attack evaluation, and quantitatively evaluates the perturbation suppression ability, gradient smoothness and actual adversarial robustness of the candidate activation function. The obtained activation function can more effectively suppress the perturbation propagation and effectively reduce the misjudgment rate in image classification.

Description

Technical Field

[0001] This invention belongs to the field of image processing, and specifically relates to an image classification technology based on neural networks. Background Technology

[0002] Deep neural networks are commonly used in image classification. However, deep neural networks are generally vulnerable to input perturbations. Especially under adversarial attacks, attackers can apply small perturbations to the input data without significantly affecting human perception, causing the model output to shift. This can lead to misjudgments or omissions in the recognition / detection / classification results of the input data, thereby posing artificial intelligence security risks.

[0003] Adversarial attacks typically exploit the non-linear characteristics of deep learning models, constructing adversarial examples to shift the feature representation of the input within the network, thereby causing the model's output to deviate from the true result. These attacks can be applied to various processing objects, including images, speech, and even financial data, and have been proven to pose real-world risks in scenarios such as biometrics, autonomous driving visual perception, and medical image analysis. Therefore, improving the stability and robustness of the model's output to the input object under perturbation conditions and reducing the risk of misjudgment has become a crucial technical challenge in the field of artificial intelligence security.

[0004] Existing research on improving robustness mainly focuses on adversarial training, gradient regularization, data augmentation, and improvements in network structure / training paradigms. A few works have also attempted to replace activation functions empirically, but they usually lack a systematic design and evaluation framework for trigonometric boundaries and stability indices, making it difficult to stably and controllably suppress problems such as layer-by-layer amplification of perturbations, abnormal gradient fluctuations, and error accumulation under different tasks and network structures.

[0005] To better characterize the impact of the activation function on the aforementioned stability problem, let the activation function be... Define an upper bound for its first derivative. The upper bound of the second derivative (curvature bound) In deep network chain structures, and The interlayer composite relationship will affect the upper bound of input perturbation amplification during forward propagation and the smoothness and stability of the gradient field during backpropagation. While commonly used activation functions possess advantages such as optimizability or smoothness, they typically lack explicit controllable constraints regarding the upper bound of derivatives, curvature, or gradient smoothness. This may lead to gradient norm spikes, feature shifts, or convergence instability under perturbation, thus limiting controllable design and stable training in robustness-sensitive tasks. Furthermore, existing techniques still have significant shortcomings in activation function design:

[0006] 1. The activation function lacks derivative boundary control, resulting in an excessively large Lipschitz constant in the network;

[0007] Global Lipschitz constant and upper bound of the first derivative of activation function in deep neural networks There is a direct chain relationship. When the maximum derivative of the activation function is too large, even if the input perturbation is minimal, it will be amplified layer by layer after passing through deep networks. For example, the peak value of the first derivative of smooth activation functions such as SiLU and Mish is usually close to or exceeds 1, causing each layer to amplify the input difference during forward propagation, resulting in a high Lipschitz constant for the network as a whole. In adversarial training scenarios, this uncontrolled upper bound of the derivative can make the gradient sharp and unstable, thereby weakening the model's ability to resist adversarial perturbations. Because existing activation functions generally lack... The effectiveness of explicit constraints in robustness-sensitive tasks is difficult to guarantee.

[0008] 2. Excessively high peak curvature leads to instability in Jacobian, and gradient explosion is prone to occur during depth propagation;

[0009] Besides the upper bound of the first derivative, the second derivative (i.e., curvature) of the activation function also has a significant impact on gradient propagation and local stability of deep networks. For example, while smooth activation functions such as Mish and Smish remain continuous in both positive and negative regions, their peak curvature... A high spectral norm of the Jacobian matrix can cause gradient changes to occur too rapidly in certain input regions, leading to local instability. In deep networks, the spectral norm of the Jacobian matrix accumulates and amplifies along the layers, causing small perturbations in the input to quickly become uncontrollable under the influence of multiple nonlinearities. This unbounded second derivative can lead to gradient explosion, loss oscillations, and other problems, reducing the controllability of network training and its stability in adversarial scenarios. The spectral norm of the Jacobian matrix in deep networks accumulates with increasing layer number, making input perturbations even more uncontrollable after nonlinear propagation.

[0010] 3. In adversarial training scenarios, the derivative characteristics of activation functions lack specific design, making gradient propagation difficult to control stably;

[0011] Adversarial training, a typical gradient-based method for enhancing model robustness, relies on the gradient information of the loss function with respect to the input for both the generation of adversarial examples in the inner layer and the updating of model parameters in the outer layer. In this process, nonlinear mappings within the network directly influence the gradient propagation path and perturbation amplification. However, existing activation function designs typically do not specifically consider the stability of gradient propagation in adversarial training scenarios, and their derivative properties lack controllable constraints, making it difficult to suppress the layer-by-layer amplification of perturbations in multi-layer nonlinear mappings.

[0012] Without changing the network structure and training process, existing technologies cannot uniformly and controllably adjust the gradient smoothness, perturbation accumulation effect, and network Lipschitz characteristics during adversarial training solely at the activation function level. This limits the potential for improving model stability in robustness-sensitive scenarios such as adversarial attacks.

[0013] 4. Activation function design lacks a unified theoretical framework and is mostly constructed heuristically;

[0014] The mainstream activation functions in current deep learning, such as ReLU, ELU, SiLU, Mish, and Smish, are mostly designed based on empirical heuristics or local performance observations, rather than on derivable mathematical principles. Existing activation functions generally lack an upper bound on their first derivative. and the upper bound of the second derivative Explicit constraints have not been established, nor have systematic guiding methods been developed from the perspective of global Lipschitz properties and gradient propagation stability. Due to the lack of theoretical characterization of the derivative properties of activation functions, their performance under different network depths and task settings is often unpredictable, and their robustness enhancement effects are difficult to explain at the theoretical level. Furthermore, existing research has not established a unified relationship between the derivative boundaries of activation functions and the Jacobian stability of deep networks, nor has it provided a principled path for controlling perturbation accumulation and gradient smoothness through activation layers, thus limiting the controllable design capability of activation functions in high-safety tasks. Therefore, current technology urgently needs a theoretical framework that can standardize activation function construction and uniformly describe the derivative boundaries and network stability.

[0015] 5. The lack of a systematic evaluation toolchain for activation functions makes it difficult to form a closed loop in design and verification;

[0016] Existing deep learning evaluation systems primarily focus on overall model performance (such as accuracy and loss convergence), lacking a systematic toolchain specifically for analyzing the mathematical properties and stability of activation functions. Current research typically cannot automatically calculate the first and second derivative boundaries of activation functions on real-world data distributions, and also lacks effective mechanisms to quantify the Lipschitz index and Jacobian spectral norm of activation functions at different network layers. Furthermore, there is a lack of a unified evaluation process for the robustness of different activation functions across multiple architectures, datasets, and various adversarial attacks, making it difficult to establish a closed-loop system of "proposal-verification-comparison-optimization" for activation function design. Due to the lack of this toolchain, activation function design often relies on extensive experimental exploration, which is both costly and lacks systematicity, making it difficult to guarantee the controllability and interpretability of the resulting activation structures in terms of mathematical properties and robustness. Summary of the Invention

[0017] To address the aforementioned technical problems, this invention proposes an image classification method based on an improved deep neural network. By designing controllable constraints and evaluating the robustness of activation functions in the neural network, and combining adversarial example generation with robust training, the model maintains output stability under adversarial attacks, noise interference, and distribution shift scenarios.

[0018] The technical solution adopted in this invention is: a robust image classification method based on activation function constraint optimization, comprising:

[0019] S1. Acquire computer vision image data and construct a dataset;

[0020] S2. Under the preset first-order derivative boundary constraints and second-order derivative curvature constraints, construct and screen a set of candidate activation functions;

[0021] S3. Construct an image classification model, which includes a feature extraction backbone network and a classification output layer. The feature extraction backbone network is used to extract features from the input image, and the classification output layer performs classification calculations based on the extracted features. The feature extraction backbone network includes convolutional layers, normalization layers, and activation functions.

[0022] The activation functions of the image classification model are replaced sequentially with the candidate activation functions in the candidate activation function set to obtain several candidate image classification models that adopt the candidate activation functions;

[0023] S4. Based on the computer vision dataset obtained in step S1, train each candidate image classification model, and after training, calculate the Lipschitz surrogate index, Jacobian stability index, and accuracy index under clean sample and perturbed sample conditions for each candidate image classification model.

[0024] S5. Based on the Lipschitz proxy index, Jacobian stability index and adversarial accuracy index, the candidate image classification models are comprehensively evaluated and ranked, and the candidate image classification model with the best overall performance is selected.

[0025] S6. Input the acquired computer vision image to be classified into the candidate image classification model with the best sorting performance obtained in step S5 to obtain the classification result.

[0026] The beneficial effects of this invention are as follows: The Lipschitz-Gradient Double Constraint (LGAC) framework proposed in this invention, by jointly constraining the upper bound of the first derivative and the upper bound of the curvature of the second derivative of the activation function in the image classification model, controls the amplification effect of small input perturbations in the forward propagation of the activation layer and reduces the drasticness of gradient changes in the backpropagation. This improves phenomena such as gradient norm surges, loss oscillations, and convergence instability that may occur during the training of deep neural networks, thereby enhancing the smoothness of gradient propagation and the stability of the training process. Compared with commonly used activation functions such as ReLU, SiLU, and Mish, this invention's framework provides more controllable derivative boundaries and smoother curvature characteristics at the activation function design level, making the model's output response more stable under conditions of noise perturbation, data distribution changes, and adversarial attacks. This improves the predictability and robustness of model behavior and reduces the risk of misclassification / missed classification. Attached Figure Description

[0027] Figure 1 This is a flowchart of the method of the present invention;

[0028] Figure 2 This is a schematic diagram of the overall process of the activation function design and evaluation system described in this invention;

[0029] Figure 3 A schematic diagram of the process for constructing the activation function design constraints in step S1 of a specific embodiment of the present invention;

[0030] Figure 4 This is a flowchart illustrating the process of forming candidate activation functions in steps S2 and S3 of a specific embodiment of the present invention.

[0031] Figure 5 This is a schematic diagram illustrating the calculation and determination process for whether the candidate activation function satisfies the constraints in step S4 of a specific embodiment of the present invention.

[0032] Figure 6 This is a schematic diagram comparing the LTSiLU activation function proposed in this invention with its first and second derivatives and the curves of ReLU and SiLU activation functions. Detailed Implementation

[0033] To facilitate understanding of the technical content of this invention by those skilled in the art, the following description, in conjunction with the accompanying drawings, further illustrates the invention.

[0034] like Figure 1 As shown, a robust image classification method based on activation function constraint optimization according to the present invention includes the following steps:

[0035] Step 0: Acquire computer vision image data and construct a dataset;

[0036] Step 01: In this embodiment, the input data of the image to be processed is obtained. The input data The sources include at least one of the following: sensor data acquisition, business system logs, database import, or public dataset import. The input data... It can be a two-dimensional grayscale image or a three-channel color image, represented as ,in Image height, Image width, This represents the number of channels.

[0037] For example, taking CIFAR-10 image classification as an example, the input can be a 32×32 color image sample imported from a public dataset, with category labels including 10 categories: airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and truck.

[0038] Step 02: In obtaining After that, it can be preprocessed to obtain The preprocessing includes, but is not limited to, scaling, normalization, cropping, and color space transformation, to ensure stable input distribution and adapt to the computational needs of neural network inference. These still fall under the category of "clean samples" and are used for subsequent training and evaluation. Here, "clean samples" should be understood as malicious perturbation samples that have not been introduced with adversarial target constraints.

[0039] Step 03: In the image classification task, the supervision information in this embodiment For image category labels. Specifically, This can be represented as a category index. (in (the number of categories), or expressed as a length of A one-hot vector.

[0040] Taking the CIFAR-10 image classification in this embodiment as an example, the supervision information y corresponds to 10 class indices or one-hot labels. Subsequently, the sample pairs (x, y) are divided into training set, validation set, and test set. In addition to being randomly divided according to a fixed ratio, the division can also be based on acquisition time, device source, or data domain, thereby constructing evaluation conditions with inconsistent training / test distributions to better reflect the generalization requirements in real application environments.

[0041] Step 04: To improve the robustness of the image classification model under adversarial and real input perturbation conditions, this embodiment constructs perturbation samples under given perturbation constraints and uses these perturbation samples for adversarial training and robustness evaluation. Specifically, during training, the input samples... Online generation of perturbation samples The perturbation samples are then used for robust optimization and safety performance evaluation of the model.

[0042] In one embodiment, perturbation samples are generated iteratively, with an upper limit for the perturbation strength. The number of iterations is 10, and the update increment per step is... A random starting point strategy is preferred, and a probability-based approach is set. From clean sample Initialization, with probability The perturbation starting point is randomly initialized within the allowed range to obtain perturbation samples for training and evaluation. .

[0043] Step 1: Set the design constraints for the activation function;

[0044] In one embodiment of the present invention, in order to reduce the sensitivity of deep neural networks to small input perturbations (including adversarial perturbations and natural perturbations), suppress abnormal gradient amplification, and improve model robustness, the activation function to be designed or selected is first... Derivative and curvature constraints are set. These constraints limit the maximum slope and peak curvature of the activation function in the pre-activated input space, thereby reducing the gradient amplification effect of the network as a whole and improving the security stability under the preset threat model.

[0045] in, independent variable This represents the pre-activation value after a linear transformation of a network layer, such as the scalar / feature response of the output of a convolutional or fully connected layer after adding bias:

[0046]

[0047] in These are the output features of the previous layer. and These are trainable parameters. It should be noted that... It is not the original image pixels themselves, but the intermediate feature values ​​generated after the image has been mapped through the first few layers of the network.

[0048] Step 11: Set the upper bound of the first derivative: Set the upper bound threshold of the first derivative of the activation function. This is used to constrain the maximum slope of the activation function, satisfying:

[0049]

[0050] in Pre-activation value The range of values ​​for can be obtained statistically from the training data during forward propagation or preset. Preferably, Pick .

[0051] The Preferred range Based on suppressing layer-by-layer perturbation amplification (required) ) and guaranteeing gradient propagation / training convergence ( A compromise was reached (not too small), and validation experiments on typical networks and datasets showed that the overall performance within this range was better.

[0052] In one embodiment In the function, .

[0053] Step 12: Set the activation function upper bound threshold of the second derivative Used to constrain the peak curvature, satisfying:

[0054]

[0055] The The setting is based on the following: the upper bound of the second derivative restricts the rate at which the slope of the activation function changes with the input, that is, it satisfies:

[0056]

[0057] This can suppress sharp peaks and drastic fluctuations in the gradient field, improving the stability of the training and adversarial evaluation processes. Preferably, Pick Similarly, The robustness index and stability surrogate index of the validation set can be calibrated and determined to balance robustness and model expressiveness.

[0058] In one embodiment In the function, .Right now Greater than or equal to 0.44.

[0059] Step 13: Set the input range: Set the activation function range Used to perform operations within this interval and The upper bound is used for constraint and evaluation, and is generally taken as a value. ,Right now , .

[0060] The rationale is that in deep networks containing normalization layers (such as BatchNorm) and / or weight regularization, pre-activation values ​​are typically concentrated around 0. It can cover most pre-activation values ​​during the training and inference phases, including both unsaturated and saturated regions, thus facilitating the constraint of the maximum slope and curvature peak of the activation function under extreme input conditions, thereby improving security and stability. Furthermore, Alternatively, the pre-activation distribution can be determined statistically by forward propagation of the training data (e.g., set according to quantile range) to adapt to different network structures and data distributions.

[0061] Step 14: Parameterization setting: If a parameterized activation function is used, set the smoothing parameter β of the Sigmoid gate, β∈(0,1).

[0062] The basis for this is: Used to control the smoothness of the gate function: The smaller the gate size, the smoother the curve and the lower the upper bound of the derivative. The larger the value, the sharper the gating, and the larger the upper bound of the derivative may be. For example, its maximum derivative satisfies Therefore, it can With step 11 The linkage setting, that is, when selecting and determining the value of β, must ensure that it does not cause the first derivative of the activation function to exceed the maximum allowable value Lmax set in step 11, so as to satisfy the overall first derivative upper bound constraint. The specific value can be calibrated by verifying the robustness and convergence performance of the validation set.

[0063] Step 2: Construct the basic sub-functions;

[0064] To facilitate the subsequent generation of candidate activation functions and ensure that their first / second derivative boundaries are computable and verifiable, the candidate activation functions are first evaluated before constructing the basic subfunctions. The construction of the candidate activation function sets constraints. The candidate activation function must simultaneously satisfy the following requirements: (1) Differentiability requirement: In the interval It must be at least twice differentiable to enable computation. and (2) Numerical stability requirements: (2) Boundary assessment shall be performed. exist No overflow or non-numerical values ​​should appear within the specified range. (3) Structural controllability requirements: Constructed from a finite number of combinatorial operators and combinatorial templates, wherein the combinatorial operators include at least addition, multiplication, and gated functions. (like , Its gating parameters are ,For example ) and output scale scaling (scaling factor is ,For example ); by introducing a small number of adjustable parameters (such as , (e.g.) to adjust the upper bound of the derivative and the upper bound of curvature; (4) the safety constraints can be verified: It can be obtained through automatic differentiation or analytical methods. , For subsequent use and Boundary estimation and screening.

[0065] Under the premise of satisfying the above construction constraints, construct the set of basic sub-functions. This is used for subsequent combination to generate candidate activation functions. A set of preferred basic sub-functions are given below as examples; in other embodiments, functions such as ReLU, ELU, GELU, SiLU, and Softsign can also be introduced to expand the candidate space.

[0066] by Taking a function as an example, this embodiment constructs the following sub-function:

[0067] Step 21: Construct the Sigmoid gate function ;

[0068] Step 22: Construct the Softplus function ;

[0069] Step 23: Construct the Tanh smooth gate ;

[0070] in, The input is for pre-activation and is not the original image pixels; the above function is applied to the network feature response values ​​point by point.

[0071] Step 24: Record the derivative expressions of each sub-function for subsequent calculations.

[0072] Step 3: Combine to form candidate activation functions;

[0073] Step 31: Combine basic functions to form activation functions ;

[0074] Step 32: When using parameterized Sigmoid gating, Replace with:

[0075]

[0076] in Used to control the gating smoothness and the upper bound of the derivative; The smaller the value, the smoother the gating, the lower the maximum slope, and the easier it is to satisfy the first-order upper bound constraint of step 11.

[0077] Step 33: Generate the first derivative expression of the activation function. The system utilizes automatic differential generation: ;

[0078] Step 34: Generating the second derivative expression of the activation function. The system further generates: ;

[0079] Step 35: Output the candidate activation functions and their derivative expressions.

[0080] The following is an activation function expression that meets the requirements of this embodiment:

[0081]

[0082] Step 4: Calculate the boundary value of the derivative of the activation function;

[0083] Step 41: Interval setting and sampling. Within the preset interval... The independent variable is sampled to obtain a set of sampling points. .in The accuracy range can be 1,000 to 50,000, depending on the required precision.

[0084] Step 42: Derivative Calculation and Upper Bound Estimation. The first and second derivatives of the candidate activation functions at the sampling points are calculated using an automatic differentiation framework. , And based on this, the discrete upper bound estimate is obtained:

[0085]

[0086] Step 43: Constraint Determination and Rollback Reconstruction. The results obtained in Step 42... Compared with a preset threshold, if the following conditions are met:

[0087]

[0088] If the candidate activation function satisfies the constraints, it is added to the set of candidates that satisfy the constraints and proceeds to the next step. If it does not satisfy the constraints, a rollback and reconstruction are performed.

[0089] 1) When In this case, it is preferable to reduce the gating parameter. Or adjust the output scaling factor ( To reduce the maximum slope;

[0090] 2) When In this case, it is preferable to introduce scaling on the input. ( or Alternatively, a smoother structure with gentler curvature can be used to reduce the peak curvature. The "smooth structure" refers to using smoothing functions such as Sigmoid, tanh, and Softplus to smooth the gated terms or transition segments, thereby reducing the upper bound of the second derivative of the function in the transition region. This includes both the selection of smoothing functions and the nested composition or gated combination of smoothing functions.

[0091] 3) When and When both parameters exceed the limit simultaneously, adjustments can be made sequentially according to 1) and 2) above (adjusting only one parameter at a time), or a combined adjustment can be used (updating multiple parameters simultaneously in the same adjustment, such as simultaneously decreasing...). and After each adjustment, the process returns to steps 41-42 to recalculate and re-evaluate. To avoid an infinite loop in the rollback and reconstruction process, a maximum number of reconstructions is set. (For example, 5 to 20 times), when reaching The process may terminate when the out-of-limit indicator stops decreasing after several consecutive adjustments.

[0092] In this embodiment In the function, pre-selected parameters (e.g., gating smoothing parameters) (and optional scaling factor) already satisfy the constraint range; calculated through steps 41 to 42, the following is obtained: and Therefore, in this embodiment, there is no need to trigger a rollback reconstruction, and the process proceeds directly to the next step.

[0093] Step 5: Build a classification model;

[0094] Step 51: Construct a classification model. Based on the computer vision image data described in Step 0, construct an image classification model. (e.g., ResNet, WideResNet, or ViT), the classification model includes a feature extraction backbone network and a classification output layer. After extracting features from the images in the image dataset through the backbone feature extraction network, the features are then fed into the output classification layer for classification calculation, thereby achieving image classification. In this embodiment, the backbone feature extraction network block mainly includes convolutional layers, normalization layers, and activation functions. The activation layer is set in the backbone feature extraction network of the classification model and is used to perform nonlinear transformations on the linear outputs of the convolutional layers or fully connected layers. Preferably, the activation layer, convolutional layers, and normalization layers are connected in series in the order of "convolutional layer → normalization layer → activation layer" to form basic network units. When using a residual network (ResNet / WideResNet), the basic network units further form residual blocks, and the activation layer is repeatedly set in each residual block. When using a visual Transformer (ViT), the activation layer is preferably set between two linear layers of an MLP sublayer.

[0095] Step 52: Replace the activation function to obtain the candidate classification model.

[0096] Candidate activation functions Replace the activation layer of the classification model to obtain a candidate classification model using the candidate activation function. .

[0097] In this example: the candidate activation function is LTSiLU proposed in this invention, and WideResNet-28-10 (containing BatchNorm layers) is used as the image classification model. The feature extraction backbone network is constructed, and the classification output layer consists of a global average pooling and a fully connected classification head. The LTSiLU activation function is then replaced in each activation layer position to obtain a candidate classification model using LTSiLU. .

[0098] Step 6: Train and evaluate the classification model based on the acquired computer vision data;

[0099] Step 61: Train the classification model.

[0100] Using the training set to evaluate candidate classification models Training is performed; in one embodiment, perturbation samples are used in the training (adversarial training) to obtain a trained classification model. .

[0101] Step 62: Evaluate cleaning accuracy and disturbance accuracy.

[0102] Evaluate the trained model on the validation or test set. The classification performance was used to obtain the cleaning accuracy. Accuracy under perturbation conditions This is used for the comprehensive comparison and selection of subsequent candidate activation functions.

[0103]

[0104] in To determine the number of adversarial samples that are correctly classified, To determine the total number of adversarial samples.

[0105]

[0106] in The number of clean samples that were correctly classified. This represents the total number of clean samples.

[0107] In the example: a candidate classification model based on WideResNet-28-10 (including BatchNorm layers) constructed in step 5. The candidate activation function chosen is LTSiLU, as proposed in this invention. The candidate classification model is then subjected to adversarial training using the training set, with 76 training rounds and a batch size of 512, resulting in the trained classification model. Subsequently, the accuracy under clean conditions and the accuracy under perturbation conditions were calculated on the test set: the classification accuracy of the trained model on clean samples was [value missing]. The classification accuracy on perturbed samples is The corresponding test loss is 0.89000.

[0108] Step 7: Calculate stability metrics and select candidate activation functions on the trained model;

[0109] When there are multiple candidate activation functions At that time, for each candidate activation function The following process will be executed:

[0110] Step 71: Calculate the network Lipschitz proxy metric.

[0111] After the model is trained Above, for each linear / convolutional layer weight operator Estimating the spectral norm And combined with the upper bound of the first derivative of each activation function Calculate the Lipschitz proxy metric at the hierarchical level:

[0112]

[0113] The overall Lipschitz surrogate index is obtained by performing logarithmic cumulative calculation or geometric mean on the indicators of each layer. .For example:

[0114]

[0115] in The number of linear / convolutional layers included in the statistics.

[0116] Under the same training model and evaluation settings, the overall Lipschitz surrogate index of LTSiLU is approximately 0.78, which is significantly lower than that of SiLU (approximately 1.35) and Mish (approximately 1.41), indicating that its amplification effect on input perturbations is weaker.

[0117] Step 72: Calculate the Jacobian stability index.

[0118] After the model is trained Above, select several input samples from the validation set or test set. Calculate the gradient of the loss function with respect to the input:

[0119]

[0120] Apply a small perturbation to each sample to obtain (For example, the change in each pixel does not exceed the preset limit) ), and calculate Using the gradient difference norm as the Jacobian fluctuation:

[0121]

[0122] The mean or high quantile of multiple samples is used as the Jacobian stability metric to characterize the stability of gradient propagation of the model to small changes in the input.

[0123] Under the same training model and evaluation settings, the Jacobian stability index of LTSiLU is approximately 0.31, which is significantly lower than that of SiLU (approximately 0.58) and Mish (approximately 1.01). This indicates that LTSiLU has smaller gradient propagation fluctuations and is less sensitive to input perturbations.

[0124] Step 73: Comprehensive evaluation and selection of optimal candidate activation functions:

[0125] Under the same evaluation settings, the accuracy metrics of the model corresponding to each candidate activation function under clean sample and perturbed / adversarial sample conditions are further calculated (e.g., , ).based on The candidate activation functions are comprehensively evaluated and ranked, with the preferred ones satisfying the following conditions:

[0126] Smaller (weaker perturbation amplification effect);

[0127] Smaller (more stable gradient propagation);

[0128] Higher (more robust against attacks).

[0129] In one embodiment, under the same trained model and the same adversarial evaluation settings (WideResNet-28-10, adversarial training), ), calculate the overall Lipschitz surrogate metric for each candidate activation function. Jacobian stability metrics And combat accuracy Based on this, a comprehensive evaluation and selection were conducted. Specifically, SiLU and Mish were selected as baseline activation functions, both with adversarial accuracy of approximately [missing value]. (That is, the baseline level measured under the same training and evaluation settings for this baseline activation function scheme), and a preset threshold for adversarial accuracy is set accordingly. In satisfying Further comparison of stability metrics among the candidate activation functions reveals that the overall Lipschitz surrogate metric for LTSiLU is approximately [value missing]. Significantly lower than SiLU's approximately Agreement with Mish Meanwhile, its Jacobian stability index is approximately It is also significantly lower than that of SiLU. Agreement with Mish This indicates that it has significant advantages in input perturbation propagation suppression and gradient stability; furthermore, the adversarial accuracy of LTSiLU is approximately The value is not lower than the preset threshold and slightly higher than the baseline level (0.523). Based on the above results, LTSiLU significantly outperforms the baseline activation function in terms of stability while meeting the adversarial performance threshold, and is therefore determined as the preferred optimal candidate activation function.

[0130] Step 8: Perform computer vision image classification based on the trained classification model;

[0131] Step 81: Output the trained robust classification model.

[0132] The classification model trained based on step 7 is now complete. It was determined to be a robust classification model. And output; wherein This is an image classification model trained using the activation function of this invention, which is then used for subsequent inference and classification tasks.

[0133] Step 82: Perform forward inference on the image to be classified to obtain the classification result.

[0134] Obtain computer vision images to be classified The image Input the robust classification model Perform forward inference to obtain the output response / confidence vectors for each category:

[0135]

[0136] And the predicted category is obtained according to the maximum response principle:

[0137]

[0138] Step 83: Output classification results and optional evaluation report.

[0139] Output prediction category This enables computer vision image classification based on a trained classification model; furthermore, to facilitate model acceptance and comparative analysis, the results obtained in step 6 can be used... , and the result obtained in step 7 , The evaluation report is generated by summarizing the indicators.

[0140] In the example: a comparison of the accuracy of various activation functions on the WideResNet-28-10 (including BatchNorm) network structure. Table 1 shows that the WideResNet-28-10 classification model using the LTSiLU activation function in this example achieves a perturbation accuracy of 0.5270 under adversarial training conditions, significantly outperforming classification models using existing activation functions such as ReLU, GELU, and ELU. This demonstrates that the activation function of this invention can effectively improve the robust classification performance of the model.

[0141] Table 1. Performance comparison between the image classification model of this invention and existing technologies.

[0142]

[0143] Based on the above-mentioned technical effects, the method and activation function of the present invention can be applied to deep learning models that identify, detect, classify or assess the risks of input data, including but not limited to images, video frames and other feature data; and can be used for robust training and robust inference in artificial intelligence security-related scenarios to reduce the risk of misjudgment of the system under conditions of adversarial disturbances, noise and distribution shift, and improve the overall operational security and reliability.

[0144] Those skilled in the art will recognize that the embodiments described herein are for the purpose of helping to understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Various modifications and variations can be made to the invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the scope of the claims of the invention.

Claims

1. A robust image classification method based on activation function constraint optimization, characterized in that, include: S1. Acquire computer vision image data and construct a dataset; S2. Under the preset first-order derivative boundary constraints and second-order derivative curvature constraints, construct and screen a set of candidate activation functions; the process of screening candidate activation functions in step S2 is as follows: A finite number of combinations are made from all baseline activation functions to obtain a combination operator, which includes at least addition, multiplication, gating functions, and scaling, and allows the introduction of adjustable parameters. A combination operator is considered a candidate activation function when it simultaneously satisfies the following conditions: The combinatorial operator is at least twice differentiable within the given activation function interval; The combination operator does not overflow, produce non-numerical values, or have discontinuities within the set activation function range; Combinatorial operators can have their first and second derivatives obtained through automatic differentiation or analytical methods; The first and second derivatives of the combination operator satisfy the upper bound thresholds of the first and second derivatives of their respective activation functions; The process for determining whether the first and second derivatives of a combination operator satisfy their respective set upper thresholds is as follows: Let the upper bound threshold of the first derivative of the activation function be . The upper bound threshold of the second derivative of the activation function is set as follows: ; Uniform sampling is performed within the activation function interval to obtain a set of sampling points; Calculate the first and second derivatives of the current combined operator at each sampling point, and obtain the discrete upper bound estimates of the first and second derivatives of the current combined operator at each sampling point. Determine the neighborhood of the maximum point based on the discrete upper bound estimate; Using the neighborhood of the maximum point as the search range, the following objective function is maximized in one dimension: ； in, This represents the first derivative of the current combination operator. Denotes the second derivative of the current combination operator. For the activation function value, The activation function interval; If the upper bound of the first derivative of the current combined operator at each sampling point after maximization does not exceed Furthermore, the upper bound of the second derivative of the current combinatorial operator at each sampling point after maximization does not exceed [the upper bound of the second derivative]. If the condition is met, then the combination operator is used as a candidate activation function; otherwise, return to step S2 to reconstruct the combination operator. S3. Construct an image classification model, which includes a feature extraction backbone network and a classification output layer. The feature extraction backbone network is used to extract features from the input image, and the classification output layer performs classification calculations based on the extracted features. The feature extraction backbone network includes convolutional layers, normalization layers, and activation functions. The activation functions of the image classification model are replaced sequentially with the candidate activation functions in the candidate activation function set to obtain several candidate image classification models that adopt the candidate activation functions; S4. Based on the computer vision dataset obtained in step S1, train each candidate image classification model, and after training, calculate the Lipschitz surrogate index, Jacobian stability index, and accuracy index under clean sample and perturbed sample conditions for each candidate image classification model. S5. Based on the Lipschitz proxy index, Jacobian stability index and adversarial accuracy index, the candidate image classification models are comprehensively evaluated and ranked, and the candidate image classification model with the best overall performance is selected. S6. Input the acquired computer vision image to be classified into the candidate image classification model with the best sorting performance obtained in step S5 to obtain the classification result.

2. The robust image classification method based on activation function constraint optimization according to claim 1, characterized in that, The training set in step S1 includes clean samples and perturbation samples. The clean samples are the original computer vision image data, and the perturbation samples are the image samples obtained after perturbing the clean samples under a preset perturbation constraint.

3. The robust image classification method based on activation function constraint optimization according to claim 2, characterized in that, The process of reconstructing the combinatorial operator is as follows: When the upper bound of the first derivative exceeds When the upper bound of the second derivative exceeds..., proceed to step A1; When the time comes, proceed to step A2; A1. Reduce the gating parameter or introduce an output scaling factor to reduce the maximum slope; generate new candidate activation functions that satisfy the derivative boundary constraints and curvature constraints; A2. Introduce scaling or replace the smoothing structure to the input to reduce the curvature peak; generate new candidate activation functions that satisfy the derivative boundary constraints and curvature constraints.

4. The robust image classification method based on activation function constraint optimization according to claim 3, characterized in that, When both the upper bound of the first derivative and the upper bound of the second derivative exceed the limits, steps A1-A2 are executed simultaneously to generate new candidate activation functions that satisfy the derivative boundary constraints and curvature constraints.

5. A robust image classification method based on activation function constraint optimization according to claim 4, characterized in that, When both the upper bound of the first derivative and the upper bound of the second derivative exceed the limits, adjust one parameter at a time in the order of steps A1 and A2 until a new candidate activation function that satisfies the derivative boundary constraints and curvature constraints is generated.

6. A robust image classification method based on activation function constraint optimization according to claim 3, characterized in that, The candidate image classification model is considered to have the best overall performance when the Lipschitz surrogate index and Jacobian stability index are the lowest, and the adversarial accuracy index is greater than the preset threshold and the baseline level.

Images