Image recognition robustness enhancement method based on antagonism generation network

Abstract

The invention relates to an image recognition robustness enhancement method based on an antagonism generation network. The method comprises the following steps: acquiring original image data; inputting the original image data and a preset random noise vector into a preset generative adversarial network to obtain an initial adversarial characteristic vector; based on the original image data, the real label and a preset target image recognition model, optimizing the initial adversarial characteristic vector to obtain a refined adversarial characteristic vector; based on the target image recognition model, the original image data and the generative adversarial network, recombining the refined adversarial characteristic vector to obtain enhanced adversarial sample data; and based on the original image data, the real label and the enhanced adversarial sample data, optimizing the target image recognition model in combination with the adversarial generative network to obtain an enhanced image recognition model. By adopting the method, the working accuracy and robustness of the image recognition model can be improved.

Description

Image recognition robustness enhancement method based on adversarial generative networks Technical Field

[0001] This invention belongs to the field of image recognition, and in particular relates to a method for enhancing the robustness of image recognition based on adversarial generative networks. Background Technology

[0002] With the development of image recognition technology, deep neural networks have achieved outstanding performance in image recognition tasks, and their applications have spread to key fields such as security, healthcare, and autonomous driving. However, researchers have found that these models are highly vulnerable to adversarial attacks. This means that by adding subtle perturbations to the input that are imperceptible to the human eye, the model can produce high-confidence erroneous outputs, seriously threatening the security and reliability of intelligent systems. To address this threat, adversarial training has become the mainstream defensive paradigm for improving model robustness.

[0003] In traditional adversarial training methods, the core process involves embedding an adversarial example generation step within the model's standard training loop. Specifically, in each training iteration, adversarial examples are first generated specifically for the clean samples in the current batch. This generation process typically relies on iterative attack algorithms, such as projective gradient descent, which requires multiple forward and backward propagation calculations to search for effective perturbations that maximize the classification loss for the current model state. Subsequently, these dynamically generated adversarial examples are mixed with the original clean samples and used together to calculate the loss and update the model parameters, aiming to force the model to simultaneously learn to correctly classify normal samples and resist malicious perturbations.

[0004] However, current adversarial training methods suffer from a significant bottleneck: their defensive efficiency is limited by the efficiency of adversarial example generation. Because they rely on iterative internal optimization to generate adversarial examples, each round of model parameter updates requires several times the computational cost of conventional training, resulting in an extremely time-consuming overall training process that is difficult to scale to large-scale datasets or complex models. This severely restricts the accuracy and robustness of image recognition models. Summary of the Invention

[0005] Therefore, it is necessary to provide an image recognition robustness enhancement method based on adversarial generative networks that can improve the accuracy and robustness of image recognition models, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a robustness enhancement method for image recognition based on adversarial generative networks, including:

[0007] Obtain the raw image data; the raw image data contains real labels;

[0008] The original image data and a preset random noise vector are input into a preset adversarial generative network to obtain an initial adversarial characteristic vector. The initial adversarial characteristic vector is used to characterize the encoding result of the adversarial generative network on the original image data and the random noise vector. The initial adversarial characteristic vector includes an initial adversarial component and an initial perturbation component.

[0009] Based on the original image data, real labels, and a pre-defined target image recognition model, the initial adversarial characteristic vector is optimized to obtain a refined adversarial characteristic vector.

[0010] Based on the target image recognition model, the original image data, and the adversarial generative network, the refined adversarial feature vectors are recombined to obtain enhanced adversarial sample data.

[0011] Based on the original image data, real labels, and enhanced adversarial sample data, the target image recognition model is optimized by combining adversarial generative networks to obtain an enhanced image recognition model.

[0012] Furthermore, based on the original image data, real labels, and a pre-defined target image recognition model, the initial adversarial feature vector is optimized to obtain a refined adversarial feature vector, including:

[0013] The original image data and the initial perturbation component are superimposed to obtain the perturbation image data;

[0014] The perturbation image data is input into the target image recognition model to obtain the perturbation model prediction label corresponding to the perturbation image data;

[0015] By combining the initial perturbation components and the preset perturbation tradeoff coefficients, the difference between the predicted label and the true label of the perturbation model is quantified to obtain the adversarial loss value;

[0016] Calculate the gradient of the adversarial loss value with respect to the initial adversarial components to obtain the adversarial loss gradient vector;

[0017] Based on the adversarial loss gradient vector, the initial adversarial components are iteratively updated until the preset iteration termination condition is met, resulting in a refined adversarial characteristic vector.

[0018] Furthermore, the expression for the adversarial loss value is:

[0019]

[0020] in, It is the adversarial loss value. It is the cross-entropy loss function. The label is predicted by the perturbation model. It's a real label. It is the disturbance trade-off coefficient. It is the initial disturbance component.

[0021] Furthermore, based on the target image recognition model, the original image data, and the generative adversarial network, the refined adversarial feature vectors are recombined to obtain enhanced adversarial sample data, including:

[0022] Based on refined adversarial characteristic vectors, a characteristic population is constructed;

[0023] Based on the feature population, repeat steps S1 to S5 until the preset loop termination condition is met to obtain the updated feature population, and based on the updated feature population, obtain the optimized feature vector set.

[0024] Enhanced adversarial sample data is obtained based on optimized feature vector sets and adversarial generative networks;

[0025] Steps S1 to S5 are as follows:

[0026] S1, based on the target image recognition model, the original image data and the adversarial generative network, calculates the fitness value of each refined adversarial characteristic vector in the characteristic population;

[0027] S2, based on fitness values, select and refine adversarial trait vectors from the trait population to form the parent trait vector group;

[0028] S3, perform a cross operation on the refined adversarial characteristic vectors in the parent characteristic vector group to obtain the child characteristic vector group;

[0029] S4. Add random perturbation noise to the refined adversarial characteristic vector in the offspring characteristic vector group to obtain the mutated characteristic vector group.

[0030] S5, merge the mutated trait vector group and the trait population to obtain the updated trait population.

[0031] Furthermore, based on the target image recognition model, the original image data, and the generative adversarial network, the fitness values ​​of each refined adversarial feature vector in the feature population are calculated, including:

[0032] The refined adversarial characteristic vector is input into the adversarial generator network to obtain the secondary perturbation component;

[0033] The original image data is superimposed with the secondary perturbation component to obtain the current adversarial sample data;

[0034] Input the current adversarial sample data into the target image recognition model to obtain the current predicted label;

[0035] Based on the target image recognition model, the current prediction result label, the true label, the preset weighting coefficients, the preset perturbation norm threshold, and the secondary perturbation components, the fitness value of each refined adversarial characteristic vector is calculated.

[0036] Furthermore, based on the original image data, real labels, and enhanced adversarial example data, the target image recognition model is optimized using an adversarial generative network to obtain an enhanced image recognition model, including:

[0037] The original image data is input into the target image recognition model to obtain the original model's predicted label. Based on the original model's predicted label and the true label, the first loss value is calculated.

[0038] The enhanced adversarial sample data is input into the target image recognition model to obtain the enhanced model's predicted label, and the second loss value is calculated based on the enhanced model's predicted label and the real label;

[0039] The total loss of the model is calculated based on the first loss value and the second loss value;

[0040] Based on the total loss of the model, the target image recognition model is updated to obtain the enhanced image recognition model.

[0041] Secondly, this application also provides an image recognition robustness enhancement device based on an adversarial generative network, comprising:

[0042] The data acquisition module is used to acquire raw image data; the raw image data contains real labels.

[0043] The initial perturbation generation module is used to input the original image data and the preset random noise vector into the preset adversarial generative network to obtain the initial adversarial characteristic vector. The initial adversarial characteristic vector is used to characterize the encoding result of the adversarial generative network on the original image data and the random noise vector. The initial adversarial characteristic vector includes the initial adversarial component and the initial perturbation component.

[0044] The refined vector generation module is used to optimize the initial adversarial characteristic vector based on the original image data, real labels and preset target image recognition models to obtain the refined adversarial characteristic vector.

[0045] The enhanced sample generation module is used to reorganize the refined adversarial feature vectors based on the target image recognition model, the original image data, and the adversarial generative network to obtain enhanced adversarial sample data.

[0046] The optimized model generation module is used to optimize the target image recognition model based on the original image data, real labels, and enhanced adversarial sample data, combined with the adversarial generative network, to obtain an enhanced image recognition model.

[0047] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the image recognition robustness enhancement methods based on adversarial generative networks described in the first aspect of this application.

[0048] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the image recognition robustness enhancement methods based on adversarial generative networks described in the first aspect of this application.

[0049] The aforementioned image recognition robustness enhancement method based on adversarial generative networks (PGNs) involves: acquiring original image data with real labels; inputting the original image data and a pre-defined random noise vector into a pre-defined GPN to obtain an initial adversarial characteristic vector; the initial adversarial characteristic vector characterizing the encoding result of the GPN on the original image data and random noise vector; the initial adversarial characteristic vector including initial adversarial components and initial perturbation components; optimizing the initial adversarial characteristic vector based on the original image data, real labels, and a pre-defined target image recognition model to obtain a refined adversarial characteristic vector; recombining the refined adversarial characteristic vector based on the target image recognition model, original image data, and GPN to obtain enhanced adversarial sample data; and optimizing the target image recognition model based on the original image data, real labels, and enhanced adversarial sample data, combined with the GPN, to obtain an enhanced image recognition model. This achieves a closed-loop co-evolution of attack generation and model defense. The approach shifts from traditional, time-consuming iterative search to a combination of efficient, learnable generative networks and intelligent evolutionary strategies. This approach improves the overall efficiency of adversarial training while ensuring the strong attack and high diversity of adversarial examples, resulting in a significantly more robust image recognition model. This enhances the accuracy and robustness of the image recognition model. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 is a flowchart illustrating an image recognition robustness enhancement method based on adversarial generative networks according to an embodiment of this application;

[0052] Figure 2 is a schematic diagram of the structure of an image recognition robustness enhancement device based on an adversarial generative network according to an embodiment of this application;

[0053] Figure 3 is a schematic diagram of the structure of a computer device for an image recognition robustness enhancement method based on an adversarial generative network according to an embodiment of this application. Detailed Implementation

[0054] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0055] In one embodiment, as shown in Figure 1, an image recognition robustness enhancement method based on adversarial generative networks is provided. This embodiment illustrates the application of this method to a training terminal. It is understood that this method can also be applied to a server, and further to a system including both a training terminal and a server, and implemented through the interaction between the training terminal and the server. In this embodiment, the method includes the following steps S101-S105, wherein:

[0056] S101, Obtain raw image data; the raw image data contains real labels.

[0057] Specifically, the training terminal acquires a certain amount of raw image data. Raw image data is image data that has undergone standardization and preprocessing; its mathematical form can be expressed as... ,in It indicates that it is the first One original image data, Represents the height of the original image data. Represents the width of the original image data. Represents the number of color channels in the original image data (when (Representing RGB three channels). Each raw image data The pixel values ​​can be normalized to or The interval is used to facilitate neural network processing. The true label is a classification annotation corresponding to the original image data, and its mathematical form is: ,in The total number of categories for an image classification task. It is a one-hot encoded vector, which is only in the first... Dimension (i.e., the true category index) The first dimension is set to 1, and the other dimensions are set to 0, which is used to accurately represent each original image data. The category to which it belongs. The original image data and its true labels may come from publicly available large image datasets (such as ImageNet, CIFAR-10 / 100) or specific industry application datasets.

[0058] S102, the original image data and the preset random noise vector are input into the preset adversarial generative network to obtain the initial adversarial characteristic vector; the initial adversarial characteristic vector is used to characterize the encoding result of the adversarial generative network on the original image data and the random noise vector; the initial adversarial characteristic vector includes the initial adversarial component and the initial perturbation component.

[0059] Specifically, the pre-built adversarial generative network is a deep neural network that has been constructed before the process begins, and can be denoted as... Its core structure is an encoder-decoder architecture, where the encoder part can be denoted as... The decoder part can be denoted as The pre-defined generative adversarial network can be configured according to the actual work requirements. First, the encoder part of the network. The pre-defined random noise vector can be sampled from a standard normal distribution, i.e. Its dimensions To counteract the pre-defined dimension of the latent space in generative networks, the pre-defined random noise vector can be set according to the actual work. Each original image data from the training terminal... Independently generate a preset random noise vector and pairing data The input is a pre-defined adversarial generative network, and the specific processing procedure is as follows: the encoder part of the adversarial generative network. take over and It is mapped to an intermediate representation through multiple nonlinear transformations (such as fully connected layers and convolutional layers), called the initial adversarial component, denoted as . This component is a continuous vector that encodes the input. The initial, unoptimized attack direction or pattern. And will Input to decoder section It can be reconstructed into a form similar to the previous one through deconvolution or upsampling layers. Image space perturbations of the same dimension are called initial perturbation components, and can be denoted as... The pre-defined adversarial generative network will and The vectors are concatenated to obtain the initial adversarial characteristic vector, which is then output. For example, if... Then for the first The original image data is processed by a pre-defined adversarial generative network to obtain an initial adversarial feature vector, mathematically expressed as follows: ,in It is a 128-dimensional vector. It is a with Perturbation tensors of the same shape. Random noise. The introduction ensures that even for the same Each time, different initial perturbations can be generated, increasing the diversity of exploration.

[0060] S103 optimizes the initial adversarial characteristic vector based on the original image data, real labels, and a preset target image recognition model to obtain a refined adversarial characteristic vector.

[0061] Specifically, the preset target image recognition model is an image classification model built on a deep convolutional neural network (such as ResNet, VGG) or a visual Transformer, which can be denoted as... Its model parameters can be denoted as The preset target image recognition model can be set according to actual work. The training terminal uses the feedback from the preset target image recognition model to process the initial adversarial component in the initial adversarial characteristic vector generated by S102. Adjustments were made to ensure that the perturbations it generates cause larger classification errors when attacking the target image recognition model, while the magnitude of the perturbations was constrained. This optimization process utilizes the target model. The gradient information. After optimization, the output is a refined adversarial characteristic vector. . It is the initial adversarial component The updated version still has the following mathematical form: A dimensional vector, but it is relative to... It encodes more explicit and stronger attack semantics, targeting more vulnerable areas on the decision boundary of the target model.

[0062] S104, based on the target image recognition model, the original image data and the adversarial generative network, recombines the refined adversarial feature vectors to obtain enhanced adversarial sample data.

[0063] Specifically, the training terminal combines and evolves the refined adversarial feature vectors generated by S103 to produce a more diverse and attack-adaptive set of adversarial samples. The core idea is to treat these refined vectors as "attack genes," exploring new combinations between them by simulating genetic evolution processes (such as crossover, mutation, and selection), thereby generating new samples that surpass the attack capabilities of a single vector. This process generates new candidate feature vectors through crossover (combining partial dimensions of different vectors) and mutation (adding small random changes to vectors). These new vectors are then processed by an adversarial generative network. The decoder maps back to the image space, creating new perturbations that are then superimposed on the original image. This is combined with the target image recognition model. The feedback is processed to obtain enhanced adversarial sample data. Enhanced adversarial sample data is a batch of filtered adversarial samples, which can be mathematically represented as... ,in These perturbations are generated from the optimal feature vectors selected after recombination. These samples are not only highly aggressive but also more diverse in perturbation patterns, aiming to cover a wider range of attack types.

[0064] S105, based on the original image data, real labels and enhanced adversarial sample data, combines an adversarial generative network to optimize the target image recognition model, resulting in an enhanced image recognition model.

[0065] Specifically, the training terminal uses the enhanced adversarial example data generated in step S104 to perform a round of training and updates on the target image recognition model, aiming to improve its robustness. First, using the target image recognition model... The model is primarily optimized by calculating its classification loss on the original clean data and its classification loss on the enhanced adversarial data. These two losses are then combined according to preset weights to form the overall training objective of the model. The model is updated using the backpropagation algorithm. parameters This allows it to learn to correctly classify diverse and challenging adversarial samples while maintaining its original classification capabilities. Secondly, optionally, adversarial generative networks... The parameters are also updated based on the attack effectiveness and diversity metrics of the generated samples in this round, causing its generation capability to evolve accordingly. The final output of this step is the enhanced image recognition model, i.e., the target image recognition model with updated parameters. Theoretically, this model has stronger robustness against adversarial examples compared to the model used for input.

[0066] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. It acquires raw image data and rapidly generates initial adversarial feature vectors using a pre-defined adversarial generative network. These features are then deeply processed in two steps: first, gradient refinement is performed on the current target model to enhance its aggressiveness, resulting in refined adversarial feature vectors; then, a genetic evolution strategy is used to recombine multiple refined features to create diverse new adversarial examples, yielding enhanced adversarial example data. Finally, the enhanced adversarial example data and the original image data are used together to target the image recognition model. This achieves a closed-loop co-evolution of attack generation and model defense. It transforms the traditional, time-consuming iterative search into a combination of efficient, learnable generative networks and intelligent evolutionary strategies. This ensures the strong aggressiveness and high diversity of adversarial examples while improving the overall efficiency of adversarial training, resulting in a significantly enhanced robust image recognition model and improving the accuracy and robustness of the image recognition model.

[0067] In one embodiment, based on the original image data, the real label, and a preset target image recognition model, the initial adversarial feature vector is optimized to obtain a refined adversarial feature vector, including:

[0068] S201, the original image data and the initial perturbation component are superimposed to obtain the perturbation image data.

[0069] Specifically, the training terminal performs a spatial combination operation of adversarial perturbation and clean image for any original image data. and the initial disturbance component obtained in step S102 By adding elements one by one, the corresponding perturbation image data is obtained, and its mathematical expression is: ,in This refers to perturbed image data. To prevent pixel values ​​from exceeding the valid range (e.g., [0,1]), a cropping operation can be performed after overlaying. This yields superimposed and cropped perturbation image data. This data serves as direct input for subsequent evaluation of the attack's effectiveness.

[0070] S202, input the perturbation image data into the target image recognition model to obtain the perturbation model prediction label corresponding to the perturbation image data.

[0071] Specifically, the training terminal inputs perturbed image data into the target image recognition model. The model performs one forward propagation, passing through internal layers of convolution, pooling, and fully connected layers, ultimately producing a score vector (Logits) for each category at the output layer. By applying the Softmax function to this score vector, the predicted probability distribution of the target image recognition model for each category is obtained. The perturbed model predicts the label. That is, take the category index with the highest probability in the probability distribution. Form and Real Labels Consistency is a one-hot encoded vector that is only used in the first... Dimension (i.e., the category index with the highest probability in the probability distribution) The value for the first dimension is 1, and the values ​​for the other dimensions are 0.

[0072] S203 combines the initial perturbation components and the preset perturbation tradeoff coefficients to quantify the difference between the predicted label and the true label of the perturbation model, and obtain the adversarial loss value.

[0073] Specifically, the training terminal combines the initial perturbation components and a preset perturbation tradeoff coefficient to quantify the difference between the predicted label and the true label of the perturbation model, thus obtaining the adversarial loss value. The adversarial loss value characterizes two aspects of loss: firstly, quantifying the attack effect, i.e., calculating the difference between the predicted label and the true label of the perturbation model, which can be obtained through cross-entropy loss; secondly, quantifying the magnitude of the perturbation, which can be obtained by calculating a certain norm of the initial perturbation components. The mathematical form of the adversarial loss value can be... The representation is based on the first The adversarial loss value calculated from the original image data.

[0074] S204, calculate the gradient of the adversarial loss value with respect to the initial adversarial components to obtain the adversarial loss gradient vector.

[0075] Specifically, the training terminal performs backpropagation to determine the optimization direction, and uses automatic differentiation (Autograd) technology to calculate... Compared to The partial derivatives of are calculated using the backpropagation algorithm, which clearly indicates how to increase . (That is, to enhance the attack effect and control the disturbance). The direction and relative magnitude of adjustment for each dimension. The calculated gradient is a relationship between... Vectors of the same dimension are called adversarial loss gradient vectors, and can be denoted as... .

[0076] S205, based on the adversarial loss gradient vector, iteratively update the initial adversarial components until the preset iteration termination condition is met, and obtain the refined adversarial characteristic vector.

[0077] Specifically, the training terminal employs a gradient-based optimization algorithm (such as gradient ascent) based on the adversarial loss gradient vector. To iteratively update the initial adversarial components The specific process is as follows: Set an initial learning rate. In each iteration In China, according to The rules need to be updated. After each update, the updated rules must be used. A new initial adversarial feature vector is regenerated by decoding using the adversarial generative network, and steps S201 to S204 are repeated to calculate the new loss and gradient. This iterative process continues until a preset iteration termination condition is met, resulting in a refined adversarial feature vector. The preset iteration termination condition can be set according to the cost requirements and prediction accuracy requirements of iterative training in actual work. It can be set to reach the preset maximum number of iterations, or the change in the adversarial loss value is less than a certain threshold, indicating that convergence has been achieved. This embodiment does not further limit the setting of this preset iteration termination condition.

[0078] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. It obtains the predicted label of the perturbation model by superimposing an initial perturbation component onto the original image data and inputting it into the target model. An adversarial loss function, which integrates attack success rate and perturbation magnitude constraints, is constructed to obtain the adversarial loss value. The gradient of this loss relative to the initial adversarial component guides its iterative update until convergence, resulting in a refined adversarial feature vector. This shifts the search for adversarial examples from the image pixel space to a lower-dimensional, more structurally regular latent feature space learned by the adversarial generative network for gradient optimization. This allows for more precise identification of effective attack features against the current target model with fewer iterations and computational overhead, providing high-quality "attack primitives" for subsequent reassembly steps.

[0079] In one embodiment, the expression for the adversarial loss value is:

[0080]

[0081] in, It is the adversarial loss value. It is the cross-entropy loss function. The label is predicted by the perturbation model. It's a real label. It is the disturbance trade-off coefficient. It is the initial disturbance component.

[0082] Specifically, the cross-entropy loss function This is the standard loss in classification tasks, and its specific calculation method is as follows: , The real label is in the first The class component (0 or 1). The perturbation model predicts the label in the first... The class components. This excitation perturbation model predicts the label. Stay away from real labels Initial disturbance components norm Used to measure the strength of a disturbance, commonly used The value is 2 (Euclidean distance) or (Maximum absolute value). Disturbance trade-off coefficient This is a key hyperparameter preset before training begins, which precisely controls the trade-off between attack strength and imperceptible perturbation: a larger... The value will strictly limit the size of the disturbance, which may result in a decrease in attack power; a smaller value... The value grants the attack greater degrees of freedom, potentially generating stronger perturbations. The significance of the entire formula lies in the fact that the optimization process (gradient ascent) attempts to maximize... (Making the model make mistakes) while minimizing A (Controlling perturbations) thereby guiding the generation of powerful and covert adversarial examples.

[0083] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. By explicitly employing a specific loss function combining cross-entropy loss and perturbation norm, it provides a clear and differentiable optimization objective for refining adversarial characteristics. This design ensures that the process of generating adversarial examples not only pursues attack effectiveness but also considers visual concealment, conforming to the characteristics of adversarial attacks in the real world. Therefore, it can be used to train models that are more robust to "concealed" attacks.

[0084] In one embodiment, based on the target image recognition model, the original image data, and the adversarial generative network, the refined adversarial feature vector is recombined to obtain enhanced adversarial sample data, including:

[0085] S401 constructs a feature population based on refined adversarial feature vectors.

[0086] Specifically, the training terminal collects and processes all raw image data to obtain the corresponding refined adversarial feature vectors. ,in This represents the total number of original image data, and these refined adversarial trait vectors are considered as "individuals" in the evolutionary algorithm. The set of these individuals is the trait population, denoted as . Each individual .

[0087] S402, based on the feature population, repeat steps S1 to S5 until the preset loop termination condition is met to obtain the updated feature population, and based on the updated feature population, obtain the optimized feature vector set.

[0088] Specifically, the training terminal uses a characteristic population. Starting from this point, an iterative evolutionary loop is initiated. This loop consists of five fixed sub-steps, S1 to S5, and each execution of these five steps is called a generation. The loop will continue until a preset loop termination condition is reached. Upon loop termination, the updated trait population of the final generation is obtained. The training terminal is based on the updated characteristics of the population. This yields an optimized feature vector set. The training terminal can then update the feature population. It can be used directly as an optimization feature vector set, or it can be based on individual fitness or other selection strategies (such as elite selection) from... Select a subset of the best individuals to form an optimized characteristic vector set. The preset loop termination condition can be set according to the cost requirements and prediction accuracy requirements of loop training in actual work. The default setting is to reach the preset maximum number of iterations. This embodiment does not further limit the setting of this preset loop termination condition.

[0089] S403, based on optimized feature vector sets and adversarial generative networks, yields enhanced adversarial sample data.

[0090] Specifically, the training terminal will optimize the feature vector set. Each vector in Input a pre-defined generative adversarial network decoder Generate the corresponding disturbance components. Subsequently, these perturbation components are compared with the corresponding (or randomly assigned) original image data. The adversarial examples are then superimposed to generate the final adversarial examples. By all The set consisting of the original image and its corresponding ground truth labels (using the labels from the original image) constitutes the enhanced adversarial example data. .

[0091] Steps S1 to S5 are as follows:

[0092] S1, based on the target image recognition model, the original image data and the adversarial generative network, calculates the fitness value of each refined adversarial characteristic vector in the characteristic population.

[0093] Specifically, the training terminal is used for the current population. Each individual (characteristic vector) in the vector. An assessment will be conducted. This indicates the first iteration of the loop. The assessment requires the participation of three parties: the individual themselves. Pre-defined adversarial generative network (Used to decode features into perturbations), raw image data (as the basis for perturbation superposition) and target image recognition model (As a judge of attack effectiveness and training value). A complete evaluation process typically includes: 1) using Generating disturbances 2) Create adversarial examples ;3) Use Evaluate The attack success rate and the potential value of the data as training data (such as the gradient norm) are considered. Finally, a scalar fitness value is calculated. The higher the value, the better the "quality" of the individual, and the more likely it is to be selected for the next generation.

[0094] S2, based on fitness values, selects and refines adversarial trait vectors from the trait population to form the parent trait vector group.

[0095] Specifically, the training terminal calculates each individual based on S1. fitness value A selection strategy is adopted from the current population. Select several individuals to form a parent characteristic vector group. Common selection strategies include "roulette wheel selection" (the probability of an individual being selected is proportional to its fitness) and "tournament selection" (randomly selecting several individuals and keeping the one with the highest fitness).

[0096] S3 performs a cross operation on the refined adversarial characteristic vectors in the parent characteristic vector group to obtain the child characteristic vector group.

[0097] Specifically, the training terminal trains the parent feature vector set. Individuals in the vector are paired up, and a crossover operation is performed on each pair of parent vectors to produce new offspring. The most common crossover methods are single-point crossover or uniform crossover. For example, for a pair of parent vectors... Uniform crossover will generate a random 0 / 1 mask. Then the child vector ,in This represents element-wise multiplication. Through crossover operations, different attack characteristics can be inherited from two parents (e.g., one specializing in texture attacks, the other in color attacks), potentially creating new characteristics with stronger attack power or better generalization. All newly generated child individuals constitute a child characteristic vector group. .

[0098] S4. Add random perturbation noise to the refined adversarial characteristic vector in the offspring characteristic vector group to obtain the mutated characteristic vector group.

[0099] Specifically, the training terminal trains the offspring feature vector set. Each individual in the process is subjected to a low-probability mutation operation. Specifically, this involves applying a preset, relatively low mutation probability. (e.g., 0.05), randomly select certain dimensions from the child vectors, and add a Gaussian distribution to these dimensions. Random disturbance noise, of which This is the preset mutation strength. The mutated offspring vectors constitute the mutated characteristic vector set. .

[0100] S5, merge the mutated trait vector group and the trait population to obtain the updated trait population.

[0101] Specifically, the training terminal will mutate the feature vector group Compared with the current characteristic population The individuals are merged to form an expanded candidate set. Then, based on their fitness values, a number of individuals equal to the original population size are selected from this merged set to form a new generation of updated trait populations. The training terminal uses " "Choose a strategy, among which..." It is the size of the parent population. It is the number of offspring, ultimately from Select the best from the individuals One, obtain the updated characteristic population , It will be used in the next round of the loop (S1 to S5) or as the final output.

[0102] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. By constructing a refined adversarial characteristic vector into an evolutionary population and iteratively executing a complete genetic algorithm process—fitness evaluation, selection, crossover, mutation, and population update—it achieves automated exploration and recombination of adversarial attack characteristics. This effectively overcomes the limitation of traditional gradient methods in generating samples with a single pattern, providing a crucial data foundation for training robust models capable of withstanding unknown and complex attacks.

[0103] In one embodiment, based on the target image recognition model, the original image data, and the adversarial generative network, the fitness value of each refined adversarial feature vector in the feature population is calculated, including:

[0104] S501 inputs the refined adversarial characteristic vector into the adversarial generator network to obtain the secondary perturbation component.

[0105] Specifically, for each refined adversarial characteristic vector to be evaluated in the population (It is an individual in the evolutionary process, possibly already a descendant of the initial refined vector), and the training terminal inputs it into a pre-defined adversarial generative network. encoder section In this process, the secondary perturbation components corresponding to the refined adversarial characteristic vector are obtained.

[0106] S502, the original image data is superimposed with the secondary perturbation component to obtain the current adversarial sample data.

[0107] Specifically, the training terminal selects the original image data used to generate the refined adversarial characteristic vector. This is then added element-wise to the secondary perturbation component obtained from S501 to obtain the current adversarial sample data. The specific mathematical expression is as follows: ,in It is an index to any raw image data. It is based on the first The secondary perturbation component, calculated from the refined adversarial characteristic vector obtained from the original image data, can be obtained according to S501. It is the first The current adversarial sample data corresponding to each original image data.

[0108] S503: Input the current adversarial sample data into the target image recognition model to obtain the current prediction result label.

[0109] Specifically, the training terminal will use the current adversarial sample data Input a preset target image recognition model The algorithm performs one forward propagation, passing through internal convolutional, pooling, and fully connected layers, ultimately producing a score vector (Logits) for each category at the output layer. Applying the Softmax function to this score vector yields the predicted probability distribution for each category by the target image recognition model. Current prediction label. That is, take the category index with the highest probability in the probability distribution. Form and Real Labels Consistency is a one-hot encoded vector that is only used in the first... Dimension (i.e., the category index with the highest probability in the probability distribution) The value for the first dimension is 1, and the values ​​for the other dimensions are 0.

[0110] S504 calculates the fitness value of each refined adversarial characteristic vector based on the target image recognition model, the current prediction result label, the true label, the preset weighting coefficient, the preset perturbation norm threshold, and the secondary perturbation component.

[0111] Specifically, for each refined adversarial feature vector, the training terminal uses the following formula based on the current predicted label and secondary perturbation component of the refined adversarial feature vector, as well as the true label of the corresponding original image data, preset weighting coefficients, and preset perturbation norm threshold: The fitness value of the refined adversarial characteristic vector is calculated. It is the fitness value. It is an indicator function used to determine the label of the current prediction result. Is it not equal to the real label? If successful, this output will be... In other cases, output 0. This is the label for the current prediction result. It's a real label. It is the first positive weighting coefficient. These are the model parameters of the target image recognition model, used to calculate the model loss of the current target image recognition model. The gradient of the current parameters, which characterizes the current adversarial example data. Target image recognition model The "training value" of the current parameters It is the model loss of the current target image recognition model on the target image recognition model. The norm of the gradient of the current parameters. The larger the norm, the greater the correction of the model parameters by training with this sample, and the more significant the potential improvement in robustness. It is the cross-entropy loss function. It is the second positive weighting coefficient. It is a secondary disturbance component. This is the perturbation norm threshold. The preset weighting coefficients include the first positive weighting coefficient. Second positive weighting coefficient First positive weighting coefficient The second positive weighting coefficient is used to control the importance of training utility in fitness. The settings for controlling the importance of perturbation constraints in fitness can be configured according to actual work requirements. The perturbation norm threshold controls the influence of the norm of the perturbation norm threshold on fitness and can also be configured according to actual work requirements.

[0112] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. By designing a multi-objective fitness function, when evaluating adversarial feature vectors, it not only considers whether their direct attack on the target model is successful, but also innovatively introduces "forward-looking training utility" as a core evaluation metric. This allows the evolutionary algorithm to proactively select adversarial examples that can not only deceive the model but also provide strong learning signals for it. This effectively aligns the generation objective of adversarial examples with the final objective of enhancing model robustness, thereby guiding the evolutionary process to generate adversarial example data most valuable for improving model robustness, thus improving the efficiency and quality of adversarial training.

[0113] In one embodiment, based on the original image data, real labels, and enhanced adversarial example data, an adversarial generative network is used to optimize the target image recognition model, resulting in an enhanced image recognition model, including:

[0114] S601, input the original image data into the target image recognition model to obtain the original model predicted label, and calculate the first loss value based on the original model predicted label and the true label.

[0115] Specifically, the training terminal inputs the raw image data into the target image recognition model. The target image recognition model performs one forward propagation, undergoing internal processing through convolutional, pooling, and fully connected layers, ultimately generating a score vector (Logits) for each category at the output layer. By applying the Softmax function to this score vector, the predicted probability distribution of the target image recognition model for each category is obtained. Based on the predicted probability distribution, the original model predicted label corresponding to the raw image data is obtained. The form of the original model predicted label is the same as the true label. Consistency is a one-hot encoded vector that is only used in the first... Dimension (i.e., the category index with the highest probability in the probability distribution) The first loss value is calculated by setting the value of 1 for the first dimension and 0 for the other dimensions. Based on the labels predicted by the original model, the difference between the predicted labels and the true labels is calculated using the standard cross-entropy loss function.

[0116] S602, the enhanced adversarial sample data is input into the target image recognition model to obtain the enhanced model predicted label, and the second loss value is calculated based on the enhanced model predicted label and the real label.

[0117] Specifically, the training terminal inputs the enhanced adversarial example data into the target image recognition model. The target image recognition model performs one forward propagation, undergoing internal processing through convolutional, pooling, and fully connected layers, ultimately generating a score vector (Logits) for each category at the output layer. By applying the Softmax function to this score vector, the predicted probability distribution of the target image recognition model for each category is obtained, and the enhanced model's predicted label corresponding to the enhanced adversarial example data is derived based on the predicted probability distribution. The format of the enhanced adversarial example data is the same as the true label. Consistency is a one-hot encoded vector that is only used in the first... Dimension (i.e., the category index with the highest probability in the probability distribution) The value for the first dimension is 1, and the values ​​for the other dimensions are 0. Based on the labels predicted by the augmented model, the difference between the predicted labels and the true labels is calculated using the standard cross-entropy loss function to obtain the second loss value.

[0118] S603, based on the first loss value and the second loss value, calculates the total loss of the model.

[0119] Specifically, the training terminal uses the following formula: The first loss value and the second loss value are weighted and combined to obtain the total loss of the model. It is the total loss of the model. This is the first loss value. These are weighting coefficients used to balance the importance of clean sample accuracy and adversarial robustness. They can be set according to the specific task at hand. It is the second loss value.

[0120] S604. Based on the total model loss, the target image recognition model is updated to obtain the enhanced image recognition model.

[0121] Specifically, the training terminal uses automatic differentiation to calculate the total loss of the model. Regarding model parameters in target image recognition models gradient Then, the model parameters are updated based on this gradient using an optimization algorithm (such as stochastic gradient descent SGD or Adam): ,in It is the learning rate, which yields the updated target image recognition model. The updated target image recognition model This is an enhanced image recognition model.

[0122] This embodiment provides an image recognition robustness enhancement method based on adversarial generative networks. By separately calculating the loss of the target model on the original clean data and the enhanced adversarial data, and then weighting and fusing the two to form a unified total model loss, it simultaneously considers the model's natural accuracy and adversarial robustness in a single optimization step. The adversarial data used are higher-quality and more diverse enhanced samples generated by the preceding refinement and recombination steps, enabling the target image recognition model to face more challenging attacks during updates, learn universal robust features more efficiently, and obtain an enhanced image recognition model with both high accuracy and high robustness.

[0123] The aforementioned image recognition robustness enhancement method based on adversarial generative networks (PGN) involves: acquiring original image data with real labels; inputting the original image data and a pre-defined random noise vector into a pre-defined GPN to obtain an initial adversarial characteristic vector; the initial adversarial characteristic vector characterizing the encoding result of the GPN on the original image data and random noise vector; the initial adversarial characteristic vector including initial adversarial components and initial perturbation components; optimizing the initial adversarial characteristic vector based on the original image data, real labels, and a pre-defined target image recognition model to obtain a refined adversarial characteristic vector; recombining the refined adversarial characteristic vector based on the target image recognition model, original image data, and GPN to obtain enhanced adversarial sample data; and optimizing the target image recognition model based on the original image data, real labels, and enhanced adversarial sample data, combined with the GPN, to obtain an enhanced image recognition model. This achieves a closed-loop co-evolution of attack generation and model defense. The approach shifts from traditional, time-consuming iterative search to a combination of efficient, learnable generative networks and intelligent evolutionary strategies. This approach improves the overall efficiency of adversarial training while ensuring the strong attack and high diversity of adversarial examples, resulting in a significantly more robust image recognition model. This enhances the accuracy and robustness of the image recognition model.

[0124] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0125] Based on the same inventive concept, this application also provides an image recognition robustness enhancement device based on adversarial generative networks (PGNs) for implementing the image recognition robustness enhancement method based on adversarial generative networks described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the image recognition robustness enhancement device based on adversarial generative networks provided below can be found in the limitations of the image recognition robustness enhancement method based on adversarial generative networks described above, and will not be repeated here.

[0126] In an exemplary embodiment, as shown in FIG2, an image recognition robustness enhancement device 200 based on an adversarial generative network is provided, comprising:

[0127] Data acquisition module 201 is used to acquire raw image data; the raw image data contains real labels;

[0128] The initial perturbation generation module 202 is used to input the original image data and the preset random noise vector into the preset adversarial generation network to obtain the initial adversarial characteristic vector; the initial adversarial characteristic vector is used to characterize the encoding result of the adversarial generation network on the original image data and the random noise vector; the initial adversarial characteristic vector includes the initial adversarial component and the initial perturbation component.

[0129] The refined vector generation module 203 is used to optimize the initial adversarial characteristic vector based on the original image data, real labels and preset target image recognition model to obtain the refined adversarial characteristic vector.

[0130] The enhanced sample generation module 204 is used to reorganize the refined adversarial feature vector based on the target image recognition model, the original image data and the adversarial generative network to obtain enhanced adversarial sample data.

[0131] The optimization model generation module 205 is used to optimize the target image recognition model based on the original image data, real labels and enhanced adversarial sample data, combined with the adversarial generative network, to obtain an enhanced image recognition model.

[0132] Furthermore, the refined vector generation module is also used for:

[0133] The original image data and the initial perturbation component are superimposed to obtain the perturbation image data;

[0134] The perturbation image data is input into the target image recognition model to obtain the perturbation model prediction label corresponding to the perturbation image data;

[0135] By combining the initial perturbation components and the preset perturbation tradeoff coefficients, the difference between the predicted label and the true label of the perturbation model is quantified to obtain the adversarial loss value;

[0136] Calculate the gradient of the adversarial loss value with respect to the initial adversarial components to obtain the adversarial loss gradient vector;

[0137] Based on the adversarial loss gradient vector, the initial adversarial components are iteratively updated until the preset iteration termination condition is met, resulting in a refined adversarial characteristic vector.

[0138] Furthermore, the expression for the adversarial loss value is:

[0139]

[0140] in, It is the adversarial loss value. It is the cross-entropy loss function. The label is predicted by the perturbation model. It's a real label. It is the disturbance trade-off coefficient. It is the initial disturbance component.

[0141] Furthermore, the enhanced sample generation module may also include:

[0142] Feature population construction unit, used to construct feature populations based on refined adversarial feature vectors;

[0143] The iterative loop unit is used to repeat steps S1 to S5 based on the feature population until a preset loop termination condition is met, to obtain an updated feature population, and to obtain an optimized feature vector set based on the updated feature population.

[0144] An enhanced adversarial sample data generation unit is used to obtain enhanced adversarial sample data based on an optimized feature vector set and an adversarial generation network.

[0145] Steps S1 to S5 are as follows:

[0146] S1, based on the target image recognition model, the original image data and the adversarial generative network, calculates the fitness value of each refined adversarial characteristic vector in the characteristic population;

[0147] S2, based on fitness values, select and refine adversarial trait vectors from the trait population to form the parent trait vector group;

[0148] S3, perform a cross operation on the refined adversarial characteristic vectors in the parent characteristic vector group to obtain the child characteristic vector group;

[0149] S4. Add random perturbation noise to the refined adversarial characteristic vector in the offspring characteristic vector group to obtain the mutated characteristic vector group.

[0150] S5, merge the mutated trait vector group and the trait population to obtain the updated trait population.

[0151] Furthermore, the image recognition robustness enhancement device based on adversarial generative networks may also include a fitness value calculation unit, which can be used for:

[0152] The refined adversarial characteristic vector is input into the adversarial generator network to obtain the secondary perturbation component;

[0153] The original image data is superimposed with the secondary perturbation component to obtain the current adversarial sample data;

[0154] Input the current adversarial sample data into the target image recognition model to obtain the current predicted label;

[0155] Based on the target image recognition model, the current prediction result label, the true label, the preset weighting coefficients, the preset perturbation norm threshold, and the secondary perturbation components, the fitness value of each refined adversarial characteristic vector is calculated.

[0156] Furthermore, the optimized model generation module can also be used for:

[0157] The original image data is input into the target image recognition model to obtain the original model's predicted label. Based on the original model's predicted label and the true label, the first loss value is calculated.

[0158] The enhanced adversarial sample data is input into the target image recognition model to obtain the enhanced model's predicted label, and the second loss value is calculated based on the enhanced model's predicted label and the real label;

[0159] The total loss of the model is calculated based on the first loss value and the second loss value;

[0160] Based on the total loss of the model, the target image recognition model is updated to obtain the enhanced image recognition model.

[0161] In one embodiment, as shown in FIG3, a computer device is provided, including:

[0162] At least one processor 301, and a memory 302 communicatively connected to at least one of the processors 301: the memory stores application code executable by at least one of the processors, the application code being executed by at least one of the processors to enable at least one of the processors to perform the image recognition robustness enhancement method based on adversarial generative networks as described above.

[0163] Computer equipment may also include: sensor 303.

[0164] The processor 301, memory 302 and sensor 303 can be connected via a bus or other means, with the bus being an example in the figure.

[0165] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0166] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0167] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A method for enhancing the robustness of image recognition based on adversarial generative networks, characterized in that, The method includes: acquiring raw image data; the raw image data having real labels; inputting the raw image data and a preset random noise vector into a preset adversarial generative network to obtain an initial adversarial characteristic vector; the initial adversarial characteristic vector being used to characterize the encoding result of the adversarial generative network on the raw image data and the random noise vector; the initial adversarial characteristic vector including an initial adversarial component and an initial perturbation component; optimizing the initial adversarial characteristic vector based on the raw image data, the real labels, and a preset target image recognition model to obtain a refined adversarial characteristic vector; recombining the refined adversarial characteristic vector based on the target image recognition model, the raw image data, and the adversarial generative network to obtain enhanced adversarial sample data; and optimizing the target image recognition model based on the raw image data, the real labels, and the enhanced adversarial sample data, combined with the adversarial generative network, to obtain an enhanced image recognition model.

2. The method according to claim 1, characterized in that, The step of optimizing the initial adversarial characteristic vector based on the original image data, the real label, and a preset target image recognition model to obtain a refined adversarial characteristic vector includes: superimposing the original image data and the initial perturbation component to obtain perturbed image data; inputting the perturbed image data into the target image recognition model to obtain the perturbed model predicted label corresponding to the perturbed image data; quantifying the difference between the perturbed model predicted label and the real label by combining the initial perturbation component and a preset perturbation tradeoff coefficient to obtain an adversarial loss value; calculating the gradient of the adversarial loss value with respect to the initial adversarial component to obtain an adversarial loss gradient vector; and iteratively updating the initial adversarial component according to the adversarial loss gradient vector until a preset iteration termination condition is met to obtain the refined adversarial characteristic vector.

3. The method according to claim 2, characterized in that, The expression for the adversarial loss value is: in, It is the adversarial loss value. It is the cross-entropy loss function. The label is predicted by the perturbation model. It's a real label. It is the disturbance trade-off coefficient. It is the initial disturbance component.

4. The method according to claim 1, characterized in that, The method of recombining the refined adversarial feature vectors based on the target image recognition model, the original image data, and the adversarial generative network to obtain enhanced adversarial sample data includes: constructing a feature population based on the refined adversarial feature vectors; repeating steps S1 to S5 based on the feature population until a preset loop termination condition is met to obtain an updated feature population, and obtaining an optimized feature vector set based on the updated feature population; and obtaining the enhanced adversarial sample data based on the optimized feature vector set and the adversarial generative network; wherein, steps S1 to S5 are: S1, based on the target image... S1. Using the recognition model, the original image data, and the adversarial generative network, calculate the fitness value of each refined adversarial characteristic vector in the characteristic population; S2. Based on the fitness value, select refined adversarial characteristic vectors from the characteristic population to form a parent characteristic vector group; S3. Perform a crossover operation on the refined adversarial characteristic vectors in the parent characteristic vector group to obtain a child characteristic vector group; S4. Add random perturbation noise to the refined adversarial characteristic vectors in the child characteristic vector group to obtain a mutated characteristic vector group; S5. Merge the mutated characteristic vector group and the characteristic population to obtain the updated characteristic population.

5. The method according to claim 4, characterized in that, The step of calculating the fitness value of each refined adversarial characteristic vector in the characteristic population based on the target image recognition model, the original image data, and the adversarial generative network includes: inputting the refined adversarial characteristic vector into the adversarial generative network to obtain a secondary perturbation component; superimposing the original image data with the secondary perturbation component to obtain current adversarial sample data; inputting the current adversarial sample data into the target image recognition model to obtain a current prediction result label; and calculating the fitness value of each refined adversarial characteristic vector based on the target image recognition model, the current prediction result label, the true label, a preset weighting coefficient, a preset perturbation norm threshold, and the secondary perturbation component.

6. The method according to claim 1, characterized in that, The step of optimizing the target image recognition model based on the original image data, the real labels, and the enhanced adversarial sample data, combined with the adversarial generative network, to obtain an enhanced image recognition model includes: inputting the original image data into the target image recognition model to obtain the original model predicted labels, and calculating a first loss value based on the original model predicted labels and the real labels; inputting the enhanced adversarial sample data into the target image recognition model to obtain the enhanced model predicted labels, and calculating a second loss value based on the enhanced model predicted labels and the real labels; calculating a total model loss based on the first loss value and the second loss value; and updating the target image recognition model according to the total model loss to obtain the enhanced image recognition model.

7. An image recognition robustness enhancement device based on adversarial generative networks, characterized in that, The apparatus includes: a data acquisition module for acquiring raw image data; the raw image data having real labels; a preliminary perturbation generation module for inputting the raw image data and a preset random noise vector into a preset adversarial generative network to obtain an initial adversarial characteristic vector; the initial adversarial characteristic vector characterizes the encoding result of the adversarial generative network on the raw image data and the random noise vector; the initial adversarial characteristic vector includes an initial adversarial component and an initial perturbation component; a refined vector generation module for optimizing the initial adversarial characteristic vector based on the raw image data, the real labels, and a preset target image recognition model to obtain a refined adversarial characteristic vector; an enhanced sample generation module for recombining the refined adversarial characteristic vector based on the target image recognition model, the raw image data, and the adversarial generative network to obtain enhanced adversarial sample data; and an optimized model generation module for optimizing the target image recognition model based on the raw image data, the real labels, and the enhanced adversarial sample data, combined with the adversarial generative network, to obtain an enhanced image recognition model.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images