A robustness measurement method for LeNet-5 networks based on adversarial spatial boundary constraints

Abstract

A robustness measurement method for LeNet-5 networks based on adversarial boundary constraints is presented, relating to the field of deep learning model testing. The main steps include: for each training sample, dynamically generating adversarial examples based on the model's current state during training iterations; constructing a composite loss function based on standard cross-entropy loss and dynamic boundary constraint loss; performing end-to-end training on all parameters of the LeNet-5 network; and using the overall approximate robustness boundary as a measure of model robustness after training. This method effectively improves the resistance of the LeNet-5 model to fast gradient sign-based adversarial attacks without altering the basic structure of the LeNet-5 network by designing a new loss function.

Description

Technical Field

[0001] This invention relates to the field of deep learning model testing, and in particular to a robustness measurement method for LeNet-5 networks based on adversarial spatial boundary constraints. Background Technology

[0002] With the widespread application of deep neural networks (DNNs) in key fields such as image recognition and speech processing, their security issues have become increasingly prominent. Research shows that DNNs are vulnerable to adversarial attacks, meaning that adding minute perturbations that are imperceptible to humans to the original input can cause the model to make incorrect judgments with high confidence. This vulnerability seriously hinders the deployment of DNNs in security-sensitive scenarios such as autonomous driving and medical diagnosis.

[0003] To improve model robustness, existing techniques mainly focus on adversarial training and gradient masking. Adversarial training methods typically use a fixed upper limit for perturbation, lack differentiation on the vulnerability of individual samples, have high training costs, and often lead to a decrease in model accuracy on clean samples. Gradient masking methods often give a false impression of security; the model does not actually become more robust, but simply makes it more difficult to generate attacks.

[0004] Especially for lightweight classic networks like LeNet-5, the above methods have significant shortcomings, as the computational burden of adversarial training is mismatched with their simple structure. Most existing techniques focus on "measuring," "testing," or "hard-enhancing" model robustness through external attacks, lacking a lightweight solution that can explicitly and measurably improve and evaluate the inherent robustness by addressing the internal geometry of the model's decision boundary.

[0005] Therefore, there is an urgent need for a new method that is highly targeted, computationally efficient, and can provide intrinsic robustness evaluation metrics. Summary of the Invention

[0006] This disclosure provides a method for improving and evaluating the robustness of LeNet-5 networks based on dynamic boundary constraint loss. This method can effectively improve the resistance of LeNet-5 models to adversarial attacks by constructing and designing a new loss function without changing the basic structure of the LeNet-5 network.

[0007] The robustness measurement method for LeNet-5 networks based on adversarial spatial boundary constraints disclosed herein mainly includes the following steps: S1, Adaptive Adversarial Example Generation: For each training sample (x, y), adversarial examples are dynamically generated for it based on the current state of the model during the training iteration. S2, based on standard cross-entropy loss and dynamic boundary constraint loss, constructs a composite loss function; S3, based on the loss function constructed in step S2, applies to all parameters of the LeNet-5 network. End-to-end training is performed, and after the model is trained, its overall approximate robustness boundary is used as a measure of the model's robustness.

[0008] Compared with the prior art, the beneficial effects of this disclosure are: (1) Significantly improved robustness: By explicitly optimizing the decision boundary geometry through a dynamic boundary constraint loss function, the model's immunity to adversarial attacks is substantially enhanced. Tests on datasets such as MNIST show that, under the same intensity of FGSM attacks, the LeNet-5 model trained using the method described in this disclosure is significantly more robust than DNN.

[0009] (2) Good performance is maintained: Since the core of the method is to "broaden" rather than "distort" the decision boundary, the ability to fit the original data is preserved to the greatest extent. Experiments show that the model provided in this disclosure has a significantly better accuracy than the original LeNet-5 model before the attack than many defense methods that would lead to a large loss of accuracy.

[0010] (3) High training efficiency and strong adaptability: The adaptive sample generation mechanism concentrates computational resources on the weak links of the model (difficult samples), avoiding the waste of uniform sampling, making the training process more efficient and targeted. At the same time, this method does not introduce any additional network parameters or complex structural modifications, which perfectly matches the lightweight characteristics of LeNet-5 and is easy to implement and deploy. Attached Figure Description

[0011] The above and other objects, features and advantages of this disclosure will become more apparent from the more detailed description of exemplary embodiments of this disclosure taken in conjunction with the accompanying drawings, in which the same reference numerals generally represent the same components.

[0012] Figure 1 This is a schematic diagram of the LeNet-5 model architecture; Figure 2 This is a flowchart of the overall training process according to this disclosure. Detailed Implementation

[0013] Preferred embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0014] This disclosure provides a robustness measurement method for LeNet-5 networks based on adversarial spatial boundary constraints. The LeNet-5 model architecture is shown in the attached figure. Figure 1 As shown.

[0015] In one exemplary implementation, the robustness measurement method of LeNet-5 network based on adversarial spatial boundary constraints mainly includes three core modules: an adaptive adversarial example generation module, a dynamic boundary constraint loss calculation module, and a robust boundary approximation estimation module.

[0016] (1) Adaptive adversarial example generation For each training sample (x, y), adversarial examples are dynamically generated based on the current state of the model during training iterations. First, the loss gradient of the model with respect to the clean sample x is calculated. x L(θ, x, y); next, adaptive perturbation amplitude calculation is performed, dynamically determining a perturbation amplitude based on the current prediction confidence or loss function value of the sample. For "hard samples" with low model prediction confidence (high loss value), assign a larger [sample size]. For "simple samples" with high confidence (low loss value), a smaller [value] is assigned. Specifically, it can be set to... ,in It is a basic disturbance value. It is a scaling factor. This is the cross-entropy loss for that sample. Introducing FGSM to generate adversarial examples The calculation formula is as follows: .

[0017] (2) Calculation of dynamic boundary constraint loss The core of this disclosure lies in designing a new composite loss function. Its expression is: .in The standard cross-entropy loss function, To balance hyperparameters, The loss is the Dynamic Boundary Constraint (DBC) loss proposed in this disclosure. The design idea of ​​the loss function is to increase the distance between the features of clean samples and the decision boundary.

[0018] In a preferred embodiment, The loss function is defined as:

[0019] in, This represents the feature output of the penultimate layer (i.e., the first fully connected layer) of the LeNet-5 network. It is a Euclidean distance (L2 norm) metric function, and margin is a preset safety boundary value.

[0020] The significance of this loss term lies in its penalty for situations where adversarial sample features are too close to clean sample features. This is achieved by minimizing... The network parameters are optimized so that adversarial perturbations cannot easily push sample features beyond the decision boundary, thus forming a "safe buffer" around clean samples in the feature space.

[0021] (3) Model training and boundary estimation The above definition is used during the training process. The loss function is based on stochastic gradient descent (SGD) on all parameters of the LeNet-5 network. End-to-end training is performed. Each training batch contains clean samples. and its corresponding adaptively generated adversarial examples The overall training process is as follows: Figure 2 As shown.

[0022] After the model is trained, for a given test sample Its robustness boundary It can be approximately estimated by the distance between its adversarial examples and clean examples in the feature space, i.e. For a model, its overall approximate robustness boundary can be defined as the boundary value of all correctly classified test samples. The average or median of the sample points. The larger this value, the further the decision boundary of the model is from the sample points, and the stronger its robustness.

[0023] Application Examples 10,000 images randomly selected from the MNIST handwritten digit image dataset were used to generate adversarial examples. The widely used FSGM method was employed for adversarial example generation. The model was considered to have failed when its classification accuracy fell below 80%. The test results are shown in Table 1. The prediction accuracy of DNN decreased from 97.48% to 81.62%, while the accuracy of the improved LeNet-5 decreased from 97.48% to 80.47%. The improved LeNet-5 showed significantly better robustness than DNN.

[0024] Table 1. Robustness test results for FSGM

[0025] The above technical solutions are merely exemplary embodiments of the present invention. For those skilled in the art, based on the application methods and principles disclosed in the present invention, it is easy to make various types of improvements or modifications, and not limited to the methods described in the specific embodiments of the present invention. Therefore, the methods described above are merely preferred and not restrictive.

Claims

1. A robustness measurement method for LeNet-5 networks based on adversarial spatial boundary constraints, characterized in that, Includes the following steps: S1, Adaptive Adversarial Example Generation: For each training sample (x, y), adversarial examples are dynamically generated for it based on the current state of the model during the training iteration. S2, based on standard cross-entropy loss and dynamic boundary constraint loss, constructs a composite loss function; S3, based on the loss function constructed in step S2, applies to all parameters of the LeNet-5 network. End-to-end training is performed, and after the model is trained, its overall approximate robustness boundary is used as a measure of the model's robustness.

2. The method according to claim 1, characterized in that, The specific method of step S1 includes: S11, Calculate the loss gradient of the model with respect to the clean sample x. x L(θ, x, y); S12, Adaptive perturbation amplitude calculation: Dynamically determine a perturbation amplitude based on the current prediction confidence level or loss function value of the sample. For samples with low model prediction confidence or high loss values, a larger [value] is assigned. For samples with high confidence or low loss values, a smaller [value] is assigned. ; S13, will Introducing FGSM to generate adversarial examples The calculation formula is as follows: 。 3. The method according to claim 2, characterized in that, In step S1, the disturbance amplitude Set to: In the formula, Based on the basic perturbation value, This is the scaling factor. This represents the cross-entropy loss for that sample.

4. The method according to claim 1, characterized in that, In step S2, the composite loss function Its expression is: In the formula, The standard cross-entropy loss function, To balance hyperparameters, For dynamic boundary constraint loss, The loss function is used to increase the distance between the features of clean samples and the decision boundary.

5. The method according to claim 4, characterized in that, In step S2, the dynamic boundary constraint loss function is defined as: In the formula, This represents the feature output of the second-to-last layer of the LeNet-5 network, i.e., the first fully connected layer. It is a Euclidean distance, i.e., the L2 norm metric function; The margin is a preset safety boundary value.

6. The method according to any one of claims 1-5, characterized in that, Step S3 specifically includes: The training process uses the method defined in step S2. The loss function, based on stochastic gradient descent, applies to all parameters of the LeNet-5 network. Perform end-to-end training; each training batch contains clean samples. and its corresponding adaptively generated adversarial examples ; After the model is trained, for a given test sample Its robustness boundary It is approximately estimated by the distance between its adversarial examples and clean examples in the feature space: that is... ; For a model, its overall approximate robustness boundary is defined as: the bound of all correctly classified test samples. The average or median of the model is used to determine the model's decision boundary. The larger the value, the further away the model's decision boundary is from the sample points, and the stronger its robustness.

Images