Explainable defense system and method based on causal feature decoupling and counterfactual verification

Abstract

The application belongs to the technical field of artificial intelligence security, and discloses an interpretable defense system and method based on causal feature decoupling and counterfactual verification. The defense method first constructs a causal structure model of an image to decouple features with causal significance. Secondly, a counterfactual sample generator is learned, and counterfactual samples generated by the counterfactual sample generator are used as a supervision signal to train a classifier, so that the model focuses on real causal features. The defense system comprises a causal feature decoupling network module, a counterfactual sample generation module, a robust classifier training module, a defense effectiveness verification module and a classification task model. The application blocks the way for attackers to use non-causal feature vectors to attack from the source, greatly improving the defense capability of the model against various adversarial attacks.

Description

Technical Field

[0001] This application belongs to the field of artificial intelligence security technology, specifically relating to an explainable defense system and method based on causal feature decoupling and counterfactual verification. Background Technology

[0002] Deep neural network technology has developed rapidly, and artificial intelligence models based on deep neural networks have been widely used in safety-critical systems such as autonomous driving and facial recognition. However, deep neural networks have shown significant vulnerability to adversarial attacks, and this vulnerability is gradually becoming a major threat affecting the reliable deployment of deep models.

[0003] To address the security threats posed by adversarial examples, current mainstream model defense strategies can be categorized into three main types: adversarial training methods, input preprocessing-based methods, and methods that optimize model structure and regularization. However, adversarial training methods can lead to the model focusing only on a single perturbation, resulting in overfitting to attack patterns. When the model encounters unseen structures or adaptive attacks, its defense performance often declines significantly. Furthermore, adversarial training methods are extremely costly to train, often requiring a performance balance between model robustness and clean sample recognition accuracy. Improving the ability to defend against perturbations often reduces the accuracy of clean sample recognition. Input preprocessing-based defense methods struggle to completely separate perturbation information and important semantic features. Excessive preprocessing can also destroy useful features in the original image, reducing the model's discriminative ability on clean samples. In addition, the stability of this defense method is difficult to guarantee when facing adaptive attacks. Optimizing model structure and regularization only alleviates the surface vulnerability of the model and cannot build a stable and reliable defense discriminative structure. In addition, optimizing model structure and regularization defense methods often increases training difficulty when adjusting model architecture, and has little improvement in generalization defense capability against attacks from unknown adversarial examples.

[0004] To better address these issues, researchers have focused on re-examining the vulnerabilities of deep neural networks in adversarial environments from a more fundamental perspective. Current research shows that traditional data-driven defense strategies often rely on easily captured statistical correlations in the input space for model training or defense processes, rather than key semantic features that truly possess causal stability. Adversarial examples exploit this attribution bias, inducing the model to focus more on non-causal features or statistical correlations in the input data, thus easily achieving attacks.

[0005] The core problem with current mainstream defense strategies being unable to fundamentally defend against adversarial attacks lies in the fact that these defense methods mostly remain at the level of statistical fitting, failing to regulate the erroneous attribution logic within the model from a causal inference perspective. Therefore, guiding the model to truly learn and rely on feature information with causal discriminative power, and blocking the path for attackers to implement perturbations using false statistical associations, is the key breakthrough for improving the robustness and interpretability of the model. Summary of the Invention

[0006] To address the aforementioned technical issues, this application provides an interpretable defense system and method based on causal feature decoupling and counterfactual verification. Based on causal inference, it explicitly represents causal and non-causal features in an image separately. Furthermore, a counterfactual sample generation training method actively regulates the model's learning to use the true causal features of the image through counterfactual training. This also cuts off the attacker's channel to attack the model using non-causal features, increases the model's robustness and generalization ability against attacks, and eliminates attribution bias in deep model decision-making at its root.

[0007] To achieve the above objectives, this application employs the following technical solution:

[0008] This application is an interpretable defense method based on causal feature decoupling and counterfactual verification, characterized in that: the interpretable defense method includes the following steps:

[0009] Step 1: Define the image classification dataset, which includes the original input images. and input image Corresponding category tags Read the input image Normalization is performed on each image to ensure the consistency of the input data and suppress irrelevant noise;

[0010] Step 2: Construct a causal feature decoupling network module to decouple the input image. The encoded initial causal feature latent variables are obtained. and initial non-causal latent variable Initial causal feature latent variables and initial non-causal latent variable After splicing, it is decoded Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. Finally, after decoupling, causal characteristics are obtained. Non-causal characteristics ;

[0011] Step 3: Based on the causal characteristics after final decoupling Non-causal characteristics Generate counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples ;

[0012] Step 4: Input image and counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples Input the classification task model again By constraining the robust classifier training module to rely solely on causal features through counterfactual consistency loss, To make classification decisions and output the correct results, a classification task model constrained by counterfactual consistency loss is used. The output and the category labels of the original image Consistent;

[0013] Step 5: In the testing phase, utilize the trained classification task model. Perform robust prediction: by comparing input images Changes in the causal characteristics of counterfactual inputs determine whether the input is counteracting or whether the resulting decision is stable. If a change in causal characteristics exceeds a preset threshold... The samples were labeled as suspected attacks.

[0014] A further improvement in this application is that step 2 specifically includes the following steps:

[0015] Step 2.1: Read the input image from Step 1. Input classification task model Extract initial features, and then input the extracted initial features into the causal feature encoder of the causal feature decoupling network module. Non-causal feature encoder In the context of causal feature encoders Non-causal feature encoder The initial features input by each entity are encoded into initial causal feature latent variables. and initial non-causal latent variable ;

[0016] Step 2.2: The initial causal feature latent variables output in Step 2.1... and initial non-causal latent variable Perform feature concatenation to obtain concatenated encoded features. decoder splicing coding features Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. ;

[0017] Step 2.3: Train the causal feature decoupling network module using a variational autoencoder framework. The loss function includes reconstruction loss. KL divergence loss Minimize mutual information loss and causal intervention regularization loss ,in:

[0018] Reconstruction losses Measuring reconstructed images Compared with the original input image The difference between them, for pixel values ​​normalized to The image is calculated using the following formula:

[0019]

[0020] in, For decoder The reconstructed pixel value, Total number of pixels;

[0021] KL divergence loss The KL divergence loss measures the difference between the encoded posterior distribution and the standard Gaussian prior. The parsing expression is:

[0022]

[0023] in, Latent variables The total dimension , The first The mean and variance of the dimension will be used to concatenate and encode features. Minimize the loss by calculating mutual information. To ensure the quality of feature decoupling:

[0024]

[0025] in, This indicates the number of samples in the current training batch. Indicates that in the given first Initial causal feature latent variables for each sample Under the condition of initial non-causal latent variable The conditional probability distribution, and They represent the first The initial non-causal latent variable and the initial causal feature vector latent variable of each sample;

[0026] In the initial causal feature latent variables Then, a causal classification head was introduced. Maximize the accuracy of image category prediction;

[0027] In the initial non-causal latent variable The non-causal classification head is introduced later. After training with causal intervention and regularization constraints, the non-causal classification head is made more efficient. The highest prediction accuracy is achieved by making That is, maximizing cross-entropy so that causality focuses on the initial causal feature latent variables. , Non-causal classification head The loss is calculated using initial non-causal latent variable features. Unable to predict categories, guaranteeing initial causal feature latent variables It is the main basis for decision-making;

[0028] Step 2.4, Based on reconstruction loss KL divergence loss The total loss is obtained by weighted summation of all losses. :

[0029]

[0030]

[0031] in, KL divergence loss Minimize mutual information loss and causal intervention regularization loss Weight parameters;

[0032] Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head ;

[0033] Step 2.5: Repeat steps 2.1-2.4 until training is complete. After training, fix the causal feature encoder. Non-causal feature encoder and shared decoder The parameters are obtained, and the causal characteristics after decoupling are also obtained. Non-causal characteristics The goal during the training phase is to learn a model that can decouple causal and non-causal features. During the testing phase, no further model training is required; the decoupling is achieved in one step, yielding the decoupled causal features. Non-causal characteristics .

[0034] A further improvement to this application is that step 3 specifically includes the following steps:

[0035] Step 3.1: Target non-causal features using a non-causal feature intervention generator. Intervention, or feature replacement, involves preserving causal features under non-causal feature intervention. Unchanged, only for non-causal characteristics Perform random replacement or noise reduction, then randomly select non-causal features from another comparison image in the image classification dataset. Then, after passing through the decoder, counterfactual samples of the same category can be obtained. The PGD attack generator adds perturbations to counterfactual samples. Generate counterfactual adversarial samples with perturbation information. ;

[0036] Step 3.2: Continue to apply causal feature intervention through the causal feature generator to generate cross-class counterfactual samples: Under causal feature intervention, maintain non-causal features. The causal characteristics remain unchanged. Replace with causal features of contrasting images of another category Generate a cross-category counterfactual sample This is used to verify the decisive role of causal features in decision-making and the causal consistency of causal feature decoupling network modules;

[0037] Step 3.3: For each original input image generate A sample of counterfactual facts of the same category By adding these counterfactual samples to the counterfactual sample pool, we can ultimately obtain diverse counterfactual samples of the same category generated through causal intervention. Counterfactual samples Cross-category counterfactual samples Then, these counterfactual samples are used to augment the image classification dataset and strengthen the classifier's reliance on causal features.

[0038] A further improvement in this application is that step 4 specifically includes the following steps:

[0039] Step 4.1: Develop a classification task model. Perform loss calculation and classification task model The training loss function includes classification loss. Counterfactual consistency loss and combating robustness loss ,in:

[0040] Classification loss Cross-entropy loss is applied to the original input image. Corresponding actual category labels :

[0041]

[0042] in, This indicates the number of samples in the current training batch. Indicates the total number of categories. Indicates the first The label indicator function for each sample. Representation of classification task model For the The output of the nth sample Class probability;

[0043] Counterfactual consistency loss Constrained causal feature decoupling network module for the original input image and counterfactual samples of the same category The output remains consistent, obtained through KL divergence calculation:

[0044]

[0045] in, This indicates the number of samples in the current training batch. The output is a probability distribution;

[0046] Combat robust loss Action on counterfactual adversarial samples This requires that the causal feature decoupling network module can still correctly classify its original category label. :

[0047]

[0048] The overall loss function is defined as: ;

[0049] Where λ1 and λ2 are hyperparameters that control each loss weight;

[0050] Step 4.2: Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head Repeat steps 4.1-4.2 until training is complete, and finally output the trained classifier. .

[0051] A further improvement in this application is that step 5 specifically includes the following steps:

[0052] Step 5.1: Test image Using a trained causal feature encoder Obtain the corresponding causal features Then, the causal characteristics As input to the classifier Output the classification results;

[0053] Step 5.2: To further ensure the robustness of the decision, generate multiple counterfactual samples of the same class under non-causal feature perturbations online. Counterfactual samples Cross-category counterfactual samples Observe the classification task model Whether the output results are consistent: If the predicted class labels are the same under all perturbations and the confidence change is less than the threshold. The range of values ​​for T is: If the result is positive, the decision is deemed robust; otherwise, an anomaly alert is issued through the anomaly detection unit module.

[0054] Step 5.3: Output classification results for normal samples; output alarm information for abnormal samples.

[0055] A further improvement of this application is that the interpretable defense method is implemented through an interpretable defense system, which includes a causal feature decoupling network module, a counterfactual sample generation module, a robust classifier training module, a defense effectiveness verification module, and a classification task model. ,in:

[0056] The causal feature decoupling network module adopts an encoder-decoder structure, including a parallel causal feature encoder. Non-causal feature encoder and shared decoder The decoupling effect is ensured by minimizing mutual information constraints and causal intervention regularization constraints, where the mutual information minimization constraint minimizes the initial causal feature latent variables. and initial non-causal latent variable Mutual information between them, using classification task models through causal intervention regularization constraints. From the initial causal feature latent variables respectively and initial non-causal latent variable Predict the output;

[0057] The mutual information minimization constraint employs a contrastive log-ratio upper bound estimator (CLUB) to minimize causal features. and initial non-causal latent variable Mutual information between them, forcing initial causal feature latent variables Non-causal characteristics Statistical independence;

[0058] The counterfactual sample generation module includes a non-causal feature intervention generator and a causal feature intervention generator; wherein the non-causal feature intervention generator is responsible for generating counterfactual samples of the same category, while the causal feature intervention generator is responsible for generating counterfactual samples across categories;

[0059] The robust classifier training module includes a standard classification loss unit, a counterfactual consistency loss unit, and an adversarial robustness loss unit.

[0060] The defense effectiveness verification module includes a causal feature extractor, a stability verification unit, and an anomaly detection unit. The causal feature extractor is used to extract causal features from the input image. The stability verification unit verifies whether the model's decision is robust. The anomaly detection unit outputs the final result and an interpretable alarm based on the stability verification result.

[0061] The beneficial effects of this application are as follows: The defense method first constructs a causal structure model of an image to decouple causally meaningful features. Second, by learning a counterfactual sample generator and using the generated counterfactual samples as supervision signals to train a classifier, the model focuses on true causal features. This fundamentally blocks attackers from using non-causal feature vectors for attacks, greatly improving the model's defense capabilities against various adversarial attacks. Specifically, it has the following advantages:

[0062] (1) This application does not attempt to fit all possible perturbations, but actively guides the model to learn to distinguish between causal and non-causal features. Therefore, as long as the attack cannot destroy the real causal features that the model is interested in, no attack of any type will be effective. This greatly improves the model's ability to defend against different attack methods and fundamentally enhances the defense capability.

[0063] (2) Because the model focuses only on causal features, it can automatically become immune to new attacks that it has never seen before without any additional adjustment or maintenance work. This application effectively solves the serious generalization problem of adversarial training methods in the prior art.

[0064] (3) This application not only has the function of preventing attacks, but also can visualize and explain to a certain extent why the model can achieve effective defense, which increases the interpretability of the model's defense decision process. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating the process of this application.

[0066] Figure 2 This is a schematic diagram of the causal feature decoupling network module in this application.

[0067] Figure 3 This is a schematic diagram of counterfactual sample generation and classifier training in this application.

[0068] Figure 4 This is a diagram showing the verification results of the anti-defense performance in the embodiments of this application.

[0069] Figure 5 This is a diagram showing the interpretability verification results in the embodiments of this application. Detailed Implementation

[0070] The embodiments of the present invention will be disclosed below with reference to the drawings. For clarity, many practical details will be described in the following description. However, it should be understood that these practical details are not intended to limit the present invention. That is, in some embodiments of the present invention, these practical details are not essential. In addition, for the sake of simplicity, some conventional structures and components will be shown in the drawings in a simple schematic manner.

[0071] like Figure 1 As shown, this application presents an interpretable defense method based on causal feature decoupling and counterfactual verification. This interpretable defense method is implemented through an interpretable defense system, which includes a causal feature decoupling network module, a counterfactual sample generation module, a robust classifier training module, a defense effectiveness verification module, and a classification task model. ,in:

[0072] The causal feature decoupling network module adopts an encoder-decoder structure, including a parallel causal feature encoder. Non-causal feature encoder and shared decoder The decoupling effect is ensured by minimizing mutual information constraints and causal intervention regularization constraints, where the mutual information minimization constraint minimizes the initial causal feature latent variables. and initial non-causal latent variable Mutual information between them ensures statistical independence, and classification task models are used through causal intervention regularization constraints. From the initial causal feature latent variables respectively and initial non-causal latent variable Predicting output requires initial causal feature latent variables. The prediction accuracy should be as high as possible, with initial non-causal latent variables. The prediction accuracy is close to random.

[0073] Causal feature encoder Designed as a convolutional neural network, its mapping dimension is much smaller than that of the input image, facilitating the learning of a compact class of causal feature codes. To ensure better representation of the semantic information of causal features, the causal feature encoder can use attention mechanisms or spatial average pooling to capture the main parts of the object.

[0074] Non-causal feature encoder : Input image Encoding these features into a non-causal latent space yields initial non-causal latent variables containing style information such as background, texture, and color. Non-causal feature encoder With causal feature encoder The structure is symmetrical but the parameters are different, and the output dimension can be of any size, which can be set according to the needs of the task. Generally, it can be combined with the initial causal feature latent variables. Same dimension.

[0075] decoder To ensure that the latent space features contain all the information of the image, the decoder consists of deconvolutional layers, and skip connections are used to achieve better reconstruction.

[0076] This causal feature decoupling network module is trained using the VAE framework. The loss includes reconstruction loss, KL divergence loss, mutual information minimization loss, and causal intervention regularization loss. After training, the encoder parameters are fixed and used as the feature generator in the next layer.

[0077] The mutual information minimization constraint employs a contrastive log-ratio upper bound estimator (CLUB) to minimize the initial causal feature latent variables. and initial non-causal latent variable Mutual information between them, forcing initial causal feature latent variables and initial non-causal latent variable Statistical independence;

[0078] The counterfactual sample generation module generates counterfactual samples by using causal intervention operations on the decoupled causal and non-causal features, enriching the sample distribution faced by the classifier and improving its robustness. The counterfactual sample generation module includes a non-causal feature intervention generator and a causal feature intervention generator; the non-causal feature intervention generator is responsible for generating counterfactual samples of the same category, while the causal feature intervention generator is responsible for generating cross-category counterfactual samples.

[0079] Non-causal feature intervention generator preserves initial causal feature latent variables Unchanged for the initial non-causal latent variable Operations such as replacement, adding Gaussian noise, and style transfer were performed. The non-causal features after intervention and the invariant initial causal features (latent variables) were analyzed. The decoder generates counterfactual samples of the same category. These samples exhibit stylistic diversity while remaining semantically invariant, implying that attackers may generate adversarial samples by perturbing non-causal spaces.

[0080] The causal feature intervention generator retains the initial non-causal feature latent variables. Remain unchanged, with the initial causal feature latent variables unchanged. Instead of using image causal features of other categories, generate cross-category counterfactual samples of different categories. It is used to test the contribution of causal features to decision-making, and can also be used as data augmentation to help the causality of the model.

[0081] The robust classifier training module is the core defense unit, responsible for training the classification task model. The system includes a standard classification loss unit, a counterfactual consistency loss unit, and an adversarial robustness loss unit. The robust classifier training module uses the original image and samples provided by the counterfactual sample generation module as training objects, training a pre-designed loss function to force the classifier to learn to use only causal features for judgment. The standard classification loss unit calculates cross-entropy loss on the original image to ensure the model's basic classification performance. The counterfactual consistency loss unit handles counterfactual samples of the same class generated due to non-causal features. The desired output of the model is the class label. The value of is chosen such that the loss function adopts either KL divergence or cross-entropy, making the network module inert to changes in non-causal features due to the decoupling of causal features. The adversarial robustness loss module is used on counterfactual samples of the same class. Within the neighborhood of the model, adversarial examples are generated using the PGD algorithm for adversarial training, thereby improving the model's robustness to local perturbations.

[0082] The defense effectiveness verification module is activated during the testing phase to test the model's defense behavior, verify its defense capabilities, and interpret the verification results. This module includes a causal feature extractor. The causal feature extractor reuses the causal feature encoder from the causal feature decoupling network module. The system comprises a stability verification unit and an anomaly detection unit. The causal feature extractor extracts causal features from the input image. The stability verification unit checks the robustness of the model's decisions and observes the stability of the model's output. If the output is highly unstable, it issues an anomaly report. The anomaly detection unit outputs the final result and an interpretable alarm based on the stability verification results.

[0083] like Figure 1 As shown, the causal feature decoupling network module provides decoupling features to the counterfactual sample generation module, the counterfactual sample generation module provides augmented samples to the robust classifier training module, the robust classifier training module outputs the defense augmentation task model, and the defense capability verification module is used to verify and interpret the model results during testing.

[0084] This application presents an interpretable defense method based on causal feature decoupling and counterfactual verification, comprising the following steps:

[0085] Step 1: Construct a structural causal model (SCM) for the image classification task: Define an image classification dataset, which includes the original input images. and input image Corresponding category tags Read the input image Normalization is performed on each image to ensure the consistency of the input data and suppress irrelevant noise;

[0086] Step 2: Construct a causal feature decoupling network module to decouple the input image. The encoded initial causal feature latent variables are obtained. and initial non-causal latent variable Initial causal feature latent variables and initial non-causal latent variable After splicing, it is decoded Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. The causal characteristics after final decoupling Non-causal characteristics Specifically, the steps include the following:

[0087] Step 2.1: Read the input image from Step 1. Input classification task model Extract initial features, and then input the extracted initial features into the causal feature encoder of the causal feature decoupling network module. Non-causal feature encoder In the context of causal feature encoders Non-causal feature encoder The initial features input by each entity are encoded into initial causal feature latent variables. and initial non-causal latent variable .like Figure 2 As shown, the causal feature encoder Non-causal feature encoder All are composed of convolutional networks, among which the causal feature encoder It contains 4 convolutional layers and is a non-causal feature encoder. It contains 3 convolutional layers, each yielding 128-dimensional initial causal feature latent variables. and initial non-causal latent variable 128-dimensional output. Decoder. It consists of symmetrical transposed convolutional layers, which are stitched together from the convolutional layers to reconstruct the original 32×32-dimensional image from 256-dimensional features.

[0088] Step 2.2: The initial causal feature latent variables output in Step 2.1... and initial non-causal latent variable Perform feature concatenation to obtain concatenated encoded features. decoder splicing coding features Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. ;

[0089] Step 2.3: Train the causal feature decoupling network module using a variational autoencoder framework. The loss function includes reconstruction loss. KL divergence loss Minimize mutual information loss and causal intervention regularization loss ,in:

[0090] Reconstruction losses Measuring reconstructed images Compared with the original input image The difference between them, for images with pixel values ​​normalized to [0,1], is calculated using the following formula:

[0091]

[0092] in, For decoder The reconstructed pixel value, Total number of pixels;

[0093] KL divergence loss The KL divergence loss measures the difference between the encoded posterior distribution and the standard Gaussian prior. The parsing expression is:

[0094]

[0095] in, Latent variables The total dimension , The first The mean and variance of the dimension will be used to concatenate and encode features. Minimize the loss by calculating mutual information. To ensure the quality of feature decoupling:

[0096]

[0097] in, This indicates the number of samples in the current training batch. Indicates that in the given first Initial causal feature latent variables for each sample Under the condition of initial non-causal latent variable The conditional probability distribution, and They represent the first The initial non-causal latent variable and the initial causal feature vector latent variable of each sample;

[0098] In the initial causal feature latent variables Then, a causal classification head was introduced. To maximize the accuracy of image category prediction, cross-entropy loss is employed. Let cross-entropy loss Make it as large as possible to ensure accuracy;

[0099] In the initial non-causal latent variable The non-causal classification head is introduced later. After training with causal intervention and regularization constraints, the non-causal classification head is made more efficient. The highest prediction accuracy is achieved by making That is, maximizing cross-entropy so that causality focuses on the initial causal feature latent variables. , Non-causal classification head The loss is calculated using initial non-causal latent variable features. The category cannot be predicted, thus ensuring the initial causal feature latent variables. This is the main basis for decision-making. Step 2.4: Based on reconstruction losses KL divergence loss The total loss is obtained by weighted summation of all losses. :

[0100]

[0101]

[0102] in, KL divergence loss Minimize mutual information loss and causal intervention regularization loss In this embodiment, the weight parameters are... =0.1, =0.01, =0.1. The Adam optimizer was used during training with a learning rate of 0.001 and 100 iterations. The encoder weights of the model remained fixed after training.

[0103] Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head ;

[0104] Step 2.5: Repeat steps 2.1-2.4 until training is complete. After training, fix the causal feature encoder. Non-causal feature encoder and shared decoder The parameters are obtained, and the causal characteristics after decoupling are also obtained. Non-causal characteristics The goal during the training phase is to learn a model that can decouple causal and non-causal features. During the testing phase, no further model training is required; the decoupling is achieved in one step, yielding the decoupled causal features. Non-causal characteristics .

[0105] Step 3: Based on the causal characteristics after final decoupling Non-causal characteristics Generate counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples Specifically, it includes the following steps:

[0106] Step 3.1: Target non-causal features using a non-causal feature intervention generator. Intervention (feature replacement) is performed, where causal features are preserved under non-causal feature intervention. Unchanged, only for non-causal characteristics Perform random replacement or noise reduction, then randomly select non-causal features from another comparison image in the image classification dataset. Then, after passing through the decoder, counterfactual samples of the same category can be obtained. The PGD attack generator adds perturbations to counterfactual samples. Generate counterfactual adversarial samples with perturbation information. ;

[0107] Step 3.2: Continue to perform causal feature intervention using the causal feature intervention generator to generate cross-class counterfactual samples: simulate the attacker's operation of adding noise to the non-causal feature space, and maintain the non-causal features under causal feature intervention. The causal characteristics remain unchanged. Replace with causal features of contrasting images of another category Generate a cross-category counterfactual sample This is used to verify the decisive role of causal features in decision-making and the causal consistency of causal feature decoupling network modules;

[0108] Step 3.3: For each original input image generate A sample of counterfactual facts of the same category By adding these counterfactual samples to the counterfactual sample pool, we can ultimately obtain diverse counterfactual samples of the same category generated through causal intervention. Counterfactual samples Cross-category counterfactual samples Then, these counterfactual samples are used to augment the image classification dataset and strengthen the classifier's reliance on causal features.

[0109] Step 4: Input image and counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples Input the classification task model again The classifier was trained using both the original images and generated counterfactual samples. Training employed the SGD optimizer with an initial learning rate of 0.01, a momentum parameter of 0.9, a decay rate of 5e-4, a batch size of 32, and 80 training epochs. The learning rate decayed by a factor of 5 at epochs 40 and 65. The robust classifier training module was constrained to rely solely on causal features by using counterfactual consistency loss. To make classification decisions and output the correct results, a classification task model constrained by counterfactual consistency loss is used. The output and the category labels of the original image Consistency. Specifically, this includes the following steps:

[0110] Step 4.1: Develop a classification task model. Perform loss calculation and classification task model The training loss function includes classification loss. Counterfactual consistency loss and combating robustness loss ,in:

[0111] Classification loss Cross-entropy loss is applied to the original input image. Corresponding actual category labels :

[0112]

[0113] in, This indicates the number of samples in the current training batch. Indicates the total number of categories. Indicates the first The label indicator function for each sample. Representation of classification task model For the The output of the nth sample Class probability;

[0114] Counterfactual consistency loss Constrained causal feature decoupling network module for the original input image and counterfactual samples of the same category The output remains consistent, obtained through KL divergence calculation:

[0115]

[0116] in, This indicates the number of samples in the current training batch. The output is a probability distribution;

[0117] Combat robust loss Action on counterfactual adversarial samples This requires that the causal feature decoupling network module can still correctly classify its original category label. :

[0118]

[0119] The overall loss function is defined as:

[0120] ;

[0121] Here, λ1 and λ2 are hyperparameters that control the weights of each loss. Through this training process, a model can be developed that relies solely on causal features to make decisions and ensures that its output remains consistent regardless of any perturbations to non-causal features.

[0122] Step 4.2: Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head Repeat steps 4.1-4.2 until training is complete, and finally output the trained classifier. .

[0123] Step 5: In the testing phase, utilize the trained classification task model. Perform robust prediction: by comparing input images Changes in the causal characteristics of counterfactual inputs determine whether the input is counteracting or whether the resulting decision is stable. If a change in causal characteristics exceeds a preset threshold... The samples were labeled as potentially malicious. The specific steps included:

[0124] Step 5.1: Test image Using a trained causal feature encoder Obtain the corresponding causal features Then, the causal characteristics As input to the classifier Output the classification results;

[0125] Step 5.2: To further ensure the robustness of the decision, generate multiple counterfactual samples of the same class under non-causal feature perturbations online. Counterfactual samples Cross-category counterfactual samples Observe the classification task model Whether the output results are consistent: If the predicted class labels are the same under all perturbations and the confidence change is less than the threshold. The range of values ​​for T is: If the result is positive, the decision is deemed robust; otherwise, an anomaly alert is issued through the anomaly detection unit module. This additional verification step enhances the interpretability of the defense mechanism and improves its resistance to unknown attack methods.

[0126] Step 5.3: Output classification results for normal samples; output alarm information for abnormal samples and provide interpretable evidence, such as excessive causal feature shift.

[0127] On the Cifar10 dataset, the defensive performance of the proposed method, using ResNet50 as the backbone classifier, was compared. Attack success rate was used as the performance metric; a lower success rate indicates better defensive performance. The performance of the classification model was tested against four adversarial attacks: BIM attack, PGD attack, CW attack, and AP attack, in comparison to no defense, adversarial training defense method, JPEG compression defense method, and the proposed defense method.

[0128] like Figure 4 The diagram showing the performance verification results of the adversarial defense shows that, under the four attack methods, the undefended classification model has the highest attack success rate; the adversarial training defense method and the JPEG compression defense method have improved performance compared to the undefended method, and the attack success rate has decreased, but the attack success rate is still maintained at around 30%; the defense method of this application has the best defense performance, and the attack success rate under the four attack methods tested can be reduced to less than 10%.

[0129] On the Cifar10 dataset, the interpretability of the proposed method is compared using classifiers with ResNet18 and ResNet50 as backbones. The credibility and reliability of the causal explanations generated by the proposed method are systematically evaluated from two dimensions: stability and fidelity. Figure 5 The interpretability verification results shown are illustrated. The Lipshitz estimation is used to measure the degree of change in the explanation results under small input perturbations; a lower metric indicates a more stable model. The iterative feature removal rate is used to evaluate the actual contribution of the attribution results to the model's predictions. This is calculated by progressively masking high-importance regions and observing the decrease in predicted probabilities. A higher iterative feature removal rate indicates better fidelity of the current model system. Among all the tested comparative methods, this application achieves the best performance in both stability and fidelity dimensions.

[0130] The above description is merely an embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. An interpretable defense method based on causal feature decoupling and counterfactual verification, characterized in that: The explainable defense method includes the following steps: Step 1, defining an image classification dataset comprising original input images and input images corresponding class labels ; Step 2: Construct a causal feature decoupling network module to decouple the input image. The encoded initial causal feature latent variables are obtained. and initial non-causal latent variable Initial causal feature latent variables and initial non-causal latent variable After splicing, it is decoded Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. Finally, after decoupling, causal characteristics are obtained. Non-causal characteristics ; Step 3: Based on the causal characteristics after final decoupling Non-causal characteristics Generate counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples ; Step 4: Input image and counterfactual samples of the same category Counterfactual samples Cross-category counterfactual samples Input the classification task model again By constraining the robust classifier training module to rely only on causal features through counterfactual consistency loss, To make classification decisions and output the correct results, a classification task model constrained by counterfactual consistency loss is used. The output and the category labels of the original image Consistent; Step 5: In the testing phase, utilize the trained classification task model. Perform robust prediction: by comparing input images Changes in the causal characteristics of counterfactual inputs determine whether the input is counteracting or whether the resulting decision is stable. If a change in causal characteristics exceeds a preset threshold... The samples were labeled as suspected attacks.

2. The explainable defense method based on causal feature decoupling and counterfactual verification according to claim 1, characterized in that: Step 2 specifically includes the following steps: Step 2.1: Read the input image from Step 1. Input classification task model Extract initial features, and then input the extracted initial features into the causal feature encoder of the causal feature decoupling network module. Non-causal feature encoder In the context of causal feature encoders Non-causal feature encoder The initial features input by each entity are encoded into initial causal feature latent variables. and initial non-causal latent variable ; Step 2.2: The initial causal feature latent variables output in Step 2.1... and initial non-causal latent variable Perform feature concatenation to obtain concatenated encoded features. decoder splicing coding features Decode the image, then reconstruct the image using the decoded features to obtain the reconstructed image. ; Step 2.3: Train the causal feature decoupling network module using a variational autoencoder framework. The loss function includes reconstruction loss. KL divergence loss Minimize mutual information loss and causal intervention regularization loss ,in: Reconstruction losses Measuring reconstructed images Compared with the original input image The difference between them, for pixel values ​​normalized to The image is calculated using the following formula: in, For decoder The reconstructed first pixel value, Total number of pixels; KL divergence loss The KL divergence loss measures the difference between the encoded posterior distribution and the standard Gaussian prior. The parsing expression is: in, Latent variables The total dimension , The first The mean and variance of the dimension will be used to concatenate and encode features. Minimize the loss by calculating mutual information. To ensure the quality of feature decoupling: in, This indicates the number of samples in the current training batch. Indicates that in a given number Initial causal feature latent variables for each sample Under the condition of initial non-causal latent variable The conditional probability distribution, and They represent the first The initial non-causal latent variable and the initial causal feature vector latent variable of each sample; In the initial causal feature latent variables Then, a causal classification head was introduced. Maximize the accuracy of image category prediction; In the initial non-causal latent variable The non-causal classification head is introduced later. After training with causal intervention and regularization constraints, the non-causal classification head is made more efficient. The highest prediction accuracy is achieved by making That is, maximizing cross-entropy so that causality focuses on the initial causal feature latent variables. , Non-causal classification head The loss is calculated using initial non-causal latent variable features. Unable to predict categories, guaranteeing initial causal feature latent variables It serves as the basis for decision-making; Step 2.4, Based on reconstruction loss KL divergence loss The total loss is obtained by weighted summation of all losses. : in, KL divergence loss Minimize mutual information loss and causal intervention regularization loss Weight parameters; Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head ; Step 2.5: Repeat steps 2.1-2.4 until training is complete. After training, fix the causal feature encoder. Non-causal feature encoder and shared decoder The parameters are obtained, and the causal characteristics after decoupling are also obtained. Non-causal characteristics During the testing phase, a single decoupling operation yields the decoupled causal characteristics. Non-causal characteristics .

3. The explainable defense method based on causal feature decoupling and counterfactual verification according to claim 1, characterized in that: Step 3 specifically includes the following steps: Step 3.1: Target non-causal features using a non-causal feature intervention generator. Interventions were conducted, in which causal characteristics were maintained under non-causal interventions. Unchanged, only for non-causal characteristics Perform random replacement or noise reduction, and randomly select non-causal features from another comparison image in the image classification dataset. Then, after passing through the decoder, counterfactual samples of the same category can be obtained. The PGD attack generator generates samples that add perturbations to counterfactual samples of the same category. Generate counterfactual adversarial samples with perturbation information. ; Step 3.2: Continue to apply causal feature intervention through the causal feature generator to generate cross-class counterfactual samples: Under causal feature intervention, maintain non-causal features. The causal characteristics remain unchanged. Replace with causal features of contrasting images of another category Generate a cross-category counterfactual sample This is used to verify the decisive role of causal features in decision-making and the causal consistency of causal feature decoupling network modules; Step 3.3: For each original input image generate A sample of counterfactual facts of the same category By adding these counterfactual samples to the counterfactual sample pool, we can ultimately obtain diverse counterfactual samples of the same category generated through causal intervention. Counterfactual samples Cross-category counterfactual samples Then, these counterfactual samples were used to augment the image classification dataset.

4. The explainable defense method based on causal feature decoupling and counterfactual verification according to claim 1, characterized in that: Step 4 specifically includes the following steps: Step 4.1: Develop a classification task model. Perform loss calculation and classification task model The training loss function includes classification loss. Counterfactual consistency loss and combating robustness loss ,in: Classification loss Cross-entropy loss is applied to the original input image. Corresponding actual category labels : in, This indicates the number of samples in the current training batch. Indicates the total number of categories. Indicates the first The label indicator function for each sample. Representation of classification task model For the first The output of the nth sample Class probability; Counterfactual consistency loss Constrained causal feature decoupling network module for the original input image and counterfactual samples of the same category The output remains consistent, obtained through KL divergence calculation: in, This indicates the number of samples in the current training batch. The output is a probability distribution; Combat robust loss Action on counterfactual adversarial samples This requires that the causal feature decoupling network module can still correctly classify its original category label. : The overall loss function is defined as: ; Where λ1 and λ2 are hyperparameters that control each loss weight; Step 4.2: Based on the current total training loss Backpropagation updates network parameters, i.e., the causal feature encoder. Non-causal feature encoder and shared decoder Causal classification head Non-causal classification head Repeat steps 4.1-4.2 until training is complete, and finally output the trained classifier. .

5. The explainable defense method based on causal feature decoupling and counterfactual verification according to claim 1, characterized in that: Step 5 specifically includes the following steps: Step 5.1: Test image Using a trained causal feature encoder Obtain the corresponding causal features Then, the causal characteristics As input to the classifier Output the classification results; Step 5.2: Generate multiple counterfactual samples of the same category online under non-causal feature perturbations. Counterfactual samples Cross-category counterfactual samples Observe the classification task model Whether the output results are consistent: If the predicted class labels are the same under all perturbations and the confidence change is less than the threshold. ,in The range of values ​​is If the result is positive, the decision is deemed robust; otherwise, an anomaly alert is issued through the anomaly detection unit module. Step 5.3: Output classification results for normal samples; output alarm information for abnormal samples.

6. An interpretable defense system that implements the interpretable defense method based on causal feature decoupling and counterfactual verification as described in any one of claims 1-5, characterized in that: The explainable defense system includes a causal feature decoupling network module, a counterfactual sample generation module, a robust classifier training module, a defense effectiveness verification module, and a classification task model. ,in: The causal feature decoupling network module adopts an encoder-decoder structure, including a parallel causal feature encoder. Non-causal feature encoder and shared decoder The decoupling effect is ensured by minimizing mutual information constraints and causal intervention regularization constraints, where the mutual information minimization constraint minimizes the initial causal feature latent variables. and initial non-causal latent variable Mutual information between them, using classification task models through causal intervention regularization constraints. From the initial non-causal latent variables respectively and initial non-causal latent variable Predict the output; The mutual information minimization constraint employs a contrastive logarithmic ratio upper bound estimator to minimize causal features. Non-causal characteristics Mutual information between them, forcing initial non-causal latent variables and initial non-causal latent variable Statistical independence; The counterfactual sample generation module includes a non-causal feature intervention generator and a causal feature intervention generator; wherein the non-causal feature intervention generator is responsible for generating counterfactual samples of the same category, while the causal feature intervention generator is responsible for generating counterfactual samples across categories; The robust classifier training module includes a standard classification loss unit, a counterfactual consistency loss unit, and an adversarial robustness loss unit. The defense effectiveness verification module includes a causal feature extractor, a stability verification unit, and an anomaly detection unit. The causal feature extractor is used to extract causal features from the input image. The stability verification unit verifies whether the model's decision is robust. The anomaly detection unit outputs the final result and an interpretable alarm based on the stability verification result.

Images