An adversarial attack defense method for a deep neural network model and the deep neural network model.

Abstract

This application relates to the field of deep learning technology, and more particularly to a method for defending against adversarial attacks using a deep neural network model, as well as the deep neural network model itself. By processing the training and input datasets of the deep neural network model through morphological operations, the resulting deep neural network model exhibits a high degree of adversarial attack defense performance, enabling defense against typical adversarial attacks without requiring knowledge of the attack, network, and image details. The aim is to solve the problem of how to achieve reliable adversarial attack defense without knowing the details of the attack, network, and image.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and in particular to an adversarial attack defense method for a deep neural network model and a deep neural network model. Background Technology

[0002] In recent years, deep neural networks (DNNs) have achieved remarkable results in many fields, especially in tasks such as image classification, speech recognition, and natural language processing. However, with the popularization of deep learning technology, security issues of deep neural networks have gradually been exposed, among which the most serious security vulnerability is adversarial attacks. Adversarial attacks deceive the model by adding small, imperceptible but well-designed attack data to the model's input, thereby causing serious problems to the model.

[0003] In related technical solutions, Perlin noise is often used for defense against adversarial attacks. The main idea is to add noise to the model input and training data to defend against adversarial attacks, but this method has shortcomings in robustness and accuracy.

[0004] In view of this, this application proposes a new adversarial attack defense method, which aims to achieve reliable and widely applicable adversarial attack defense. Summary of the Invention

[0005] The main objective of this application is to provide an adversarial attack defense method for deep neural network models, aiming to solve the problem of how to achieve reliable adversarial attack defense without knowing the details of the attack, network, and image.

[0006] To achieve the above objectives, this application provides a method for defending against adversarial attacks on deep neural network models, which includes the following steps: The deep neural network model is trained using a training set that has undergone morphological operations, and adversarial attack data that has undergone morphological operations is input into the trained deep neural network.

[0007] Optionally, the morphological operation processing includes morphological operations, structuring element settings, and kernel size settings.

[0008] Optionally, the morphological operations include one or more of the following: erosion, dilation, opening, and closing operations.

[0009] Optionally, the kernel size can be set to a range of 0 to 5.

[0010] Optionally, the structural element is set to a rhombus structure.

[0011] In addition, to achieve the above objectives, this application also provides an adversarial attack defense method using a deep neural network model as described in any of the preceding claims, wherein the obtained deep neural network model is...

[0012] This application has at least the following beneficial effects: 1. Achieving reliable defense against adversarial attacks for deep learning models by proposing morphological operations; 2. The optimal kernel size for the best defense effect was determined. 3. Compared with the commonly used Perlin noise processing method, experiments have shown that the morphological processing proposed in this application has superior accuracy and robustness. Attached Figure Description

[0013] Figure 1 This is a flowchart illustrating the adversarial attack defense method for a deep neural network model involved in the embodiments of this application; Figure 2 This is a schematic diagram of the overall execution architecture of the adversarial attack defense method for the deep neural network model involved in the embodiments of this application; Figure 3 This is a schematic diagram illustrating the morphological operation effects of different kernel sizes involved in the embodiments of this application; Figure 4 This is a graph showing the defense accuracy results of different morphological operations under PGD attacks in the embodiments of this application; Figure 5 This is a graph showing the defense accuracy results of different morphological operations under the FGSM attack involved in the embodiments of this application; Figure 6 This is a graph showing the defense accuracy results of different morphological operations under SLD attacks involved in the embodiments of this application; Figure 7 This is a graph showing the defense accuracy results of a single morphological operation and two consecutive morphological operations under the PGD attack involved in the embodiments of this application. Figure 8 This is a graph showing the defense accuracy results of a single and two consecutive morphological operations under the SLD attack involved in the embodiments of this application. Figure 9 This is a graph showing the defense accuracy results of a single morphological operation and two consecutive morphological operations under the FGSM attack involved in the embodiments of this application. The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0014] To better understand the above technical solutions, exemplary embodiments of this disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art.

[0015] First Embodiment Reference Figure 1 and Figure 2 This embodiment provides a method for defending against adversarial attacks on deep neural network models, which includes the following steps: S10 uses a training set that has undergone morphological operations to train a deep neural network model, and inputs morphologically processed adversarial attack data into the trained deep neural network.

[0016] In this embodiment, our method uses morphological operations to replace previous defense methods on the attack sample in order to mask the adversarial attack.

[0017] Morphological defense methods do not require knowledge of any details about the attack or the model. This method only requires specific, well-designed morphological operations on the training data and model input to defend against adversarial attacks. The morphological defense process is divided into two phases: training and runtime. During training, the training data is divided into the original training set and the morphologically processed training set. The training results in these two cases are used for testing on the input data, respectively. During runtime, after the model has been trained on both training sets, the model input is divided into adversarial attack data and morphologically processed adversarial attack data. Finally, the classification accuracy of the model under these two types of input data is calculated. The original training set and the adversarial attack data do not use morphological operations during training and runtime, respectively. This morphological defense method achieves the goal of using morphological operations not only on the training data but also on the input data.

[0018] Specifically, in the process of defending against adversarial attacks, morphological operations can be divided into four basic types: erosion, dilation, opening, and closing. Erosion removes small regions, such as noise, from the image by "shrinking" structural elements away from the image edges. Dilation expands structural elements to the surrounding area of ​​the image, increasing the local area and helping to highlight certain structural parts. Opening performs erosion first, followed by dilation. It is mainly used to remove small objects or noise while preserving larger structures. Closing, the opposite of opening, performs dilation first, followed by erosion. It is mainly used to fill small holes or breaks in the image and smooth boundaries. Opening and closing, as combinations of erosion and dilation, are used to smooth contours or fill holes. The core idea of ​​image morphological operations is to analyze and modify the local structure of an image, highlighting or suppressing certain structural features, especially local noise and small-scale perturbations. In the context of adversarial attacks, image morphological operations can reduce the impact of adversarial perturbations in the following ways, thereby enhancing the robustness of the model.

[0019] As one of the optional implementation methods, in this embodiment, the morphological defense method is implemented using ImageMagick. Relevant parameters include morphological operations, structuring elements, and kernel size. Morphological operations include four basic morphological operations. The structuring element is the structural element used in the current morphological operation. The kernel size represents the radius of the structuring element in this morphological operation, which is also the distance from the center pixel of the structuring element to the nearest edge. These two parameters, structuring element and kernel size, together determine how the morphological operation will manipulate the image pixels and affect structural features. The final size of the kernel and the shape of the structuring element are crucial for locating and enhancing or deleting image elements larger or smaller than this shape. Generally, the larger the kernel size and the more complex the shape of the structuring element, the longer the morphological operation takes.

[0020] It's important to note that adversarial attacks are subtle visual disturbances that are difficult for the human eye to detect, leading deep neural networks to misinterpret them. Therefore, our main approach is to use morphological operations to mask these attacks. This involves leveraging the property that morphological operations affect the structural features of image pixels. We need to find a suitable morphological operation, structuring element, and kernel size, or a series of morphological operations with a defined structuring element and kernel size, to apply to the image. This allows the adversarial attack to be masked while preserving as much of the original image information as possible, enabling the deep neural network to correctly recognize the image.

[0021] Furthermore, and optionally, the parameter kernel size can be rounded down from 0 to 5 depending on the experiment.

[0022] Furthermore, and optionally, in this embodiment, the parameter structuring element is selected as a rhombus structure, which is the smallest structuring element. The rhombus defines the smallest actual neighborhood: the original pixel plus the four directly contacting pixels. The shape of the rhombus becomes more obvious as the kernel size increases.

[0023] In the technical solution provided in this embodiment, morphological operations are used to process the training dataset and input dataset of the deep neural network model, so that the resulting deep neural network model has a good degree of adversarial attack defense effect, and can defend against typical adversarial attacks without knowing the details of the attack, network and image.

[0024] Verification Implementation Examples Based on the first embodiment, this embodiment verifies the effectiveness of the above-mentioned technical solution through experiments.

[0025] This embodiment includes two sets of experiments using the CIFAR-10 dataset and a ResNet18 deep neural network model. The CIFAR-10 dataset was used, and the classification model employed an 18-layer ResNet18 network (17 convolutional layers and 1 connection layer) with corresponding data augmentation (random flipping, shifting, whitening, and rotation). The loss function was the common cross-entropy loss function. The optimizers were SGD and learning rate (lr), with a learning rate of 0.01 during model training. Both sets of experiments utilized three adversarial attacks and four different morphological operations to validate the effectiveness of the proposed method.

[0026] In this embodiment, three attacks—fast gradient signification and projective gradient descent (L∞ attacks) and sparse L1 descent—are used to evaluate the defensive effectiveness of morphological operation methods. L∞ attacks aim to minimize the changes in the pixels with the greatest variation; while L1 attacks refer to the process of generating adversarial attacks. While ensuring the deep neural network is successfully misled, they strive to minimize the distance between the original sample and the adversarial sample. Unlike L∞ attacks, which perturb all pixels, L1 attacks only perturb a small number of key pixels, making the attack more visually covert.

[0027] The Fast Gradient Sign Method (FGSM) is an adversarial attack method based on gradient information. This method generates adversarial examples by calculating the gradient of the model's loss function with respect to the input data and adding a perturbation of a specific size along the gradient direction. The core feature of FGSM is its high computational efficiency, requiring only one gradient calculation to complete the attack. The perturbations generated by this attack method are usually relatively uniform and may produce visually noticeable noise patterns in images. FGSM is commonly used to quickly assess model vulnerability and is also frequently used as a foundational method for generating adversarial examples in adversarial training. FGSM controls the direction of the gradient through a sign function, allowing the model's loss error to accumulate continuously, thereby causing the model to misclassify.

[0028] Projected Gradient Descent (PGD) is an improvement and extension of the Fast Gradient Signed Method (FGSM), belonging to the iterative attack method. PGD generates adversarial examples through multiple small-step gradient updates, projecting the perturbation into an allowed range after each update. This method can produce stronger attack effects and find better adversarial perturbations. Compared with FGSM, PGD has a higher computational cost, but its attack success rate is significantly improved. PGD is often used as a benchmark method for evaluating model robustness and is also a key attack type that many defense methods need to address.

[0029] Sparse L1 Descent (SLD) is an adversarial attack method for generating sparse perturbations. Unlike FGSM and PGD, SLD constrains the sparsity of the perturbation through L1 norm constraints, ensuring that the generated adversarial example modifies only a small number of key pixels in the input data. Perturbations generated by this attack method typically have better stealth because only local regions are modified. The computation of SLD is relatively complex, requiring specific optimization strategies to select the most effective pixels for modification. This method is suitable for attack scenarios requiring high stealth and is often used to study the sensitivity of models to local perturbations. Compared to traditional attacks such as FGSM, it improves the robustness and generalization ability of adversarial examples.

[0030] In this embodiment, adversarial attack samples are generated using FGSM, PGD, and SLD attacks implemented with CleaverHan. Pre-designed morphological operations are incorporated into the adversarial samples during both training and testing. The kernel sizes for the four basic morphological operations are set to 0, 1, 2, 3, 4, and 5, respectively, where a kernel size of 0 indicates that morphological operations are not currently used. The model is trained using both the original data and the morphologically processed data. Two training scenarios are used to predict the original attack data and the morphologically processed attack data, respectively. Images with and without morphological operations are used for training and testing, respectively. The steps for applying morphological operations to the training data and adversarial samples are as follows: During the training phase, training image data (x, y) is first input into the model. Then, according to the defined morphological operations, structuring elements, and kernel size, the ImageMagick method is applied to the input image to obtain processed morphological samples, and then the model is trained. During the testing phase, different adversarial samples are generated based on different adversarial attacks. These adversarial samples are then used as input image data (x, y), and the defined morphological operations are applied to them as well. Finally, the model performs classification prediction on the morphologically processed data. During training, loss and morphological gradients are calculated to further update network parameters. In the testing phase, adversarial examples are combined with the morphological operations used in the testing phase, and then fed into the neural network along with image data for testing.

[0031] When the four morphological operations are applied to an image, structural features unique to the morphological operations are added to the image. These features are determined by the predefined parametric morphological operations, structuring elements, and kernel size. Furthermore, when the parametric morphological operations and structuring elements are determined, the structural features become denser as the kernel size increases. A sufficiently large kernel will destroy the original image information rather than simply masking adversarial attacks. Figure 3 This demonstrates the application of morphological operations to a car image from the CIFAR-10 dataset. Each row shows four morphological operations: erosion, dilation, opening, and closing. The kernel sizes for each row of morphological operations are set from left to right as 0, 1, 2, 3, 4, and 5, respectively, and the structuring element is a diamond.

[0032] based on Figure 3 Experimental results of morphological defense with different kernel sizes show that, regardless of the morphological operation, the defense effect of a kernel size of 1 is significantly better than other values ​​in most cases. Therefore, the kernel size is preferably set to 1.

[0033] Therefore, the model was trained using alternating training images with and without morphological operations, and two consecutive morphological operations were added to both the training and testing images. Specifically, during model training and testing, three methods were used: no morphological operations, single-step morphological operations (erosion, dilation, opening, and closing operations), and continuous morphological operations (erosion, dilation, opening, and closing operations on top of the single-step operation). The structural elements of the morphological operations were all rhombuses, and the kernel size was set to 1 to verify the defense effect against three adversarial attacks. (1) The effectiveness of morphological defenses with different kernel sizes Figure 4 The diagram illustrates the defensive performance of erosion, dilation, opening, and closing operations with different kernel sizes under a single morphological defense and a rhombus structuring element when facing PGD attacks. The kernel size at coordinate runtime refers to the kernel size used for morphological operations during testing, and the curves of different colors represent morphological operations with different kernel sizes added during training.

[0034] As can be seen, the model accuracy drops to 7% under PGD attack. The accuracy is significantly improved after using the morphological defense method. With the structuring element being rhombus, the morphological operation with kernel size of 1 and dilation operation is used during the training phase and during the testing phase, the morphological operation with kernel size of 1 and dilation operation has the best defense effect, with an accuracy of 56%. This shows that the method can effectively defend against PGD attacks.

[0035] on the other hand, Figure 5 This paper demonstrates the defensive performance of erosion, dilation, opening, and closing operations with different kernel sizes under a rhombus structuring element in the face of SLD attacks. Under FGSM attacks, the model accuracy drops to 11%, showing some improvement after using morphological defense methods. It can be seen that, with a rhombus structuring element, using morphological operations with a kernel size of 1 and closing operations during the training phase yields the best defense effect during the testing phase, although the recognition accuracy is only 49%, which is a mediocre result.

[0036] on the other hand, Figure 6 This paper demonstrates the defensive performance of erosion, dilation, opening, and closing operations with different kernel sizes under a rhombus structuring element in the face of FGSM attacks. Under SLD attacks, the model accuracy drops to 46%, and there is no significant improvement after using morphological defense methods. Under the rhombus structuring element, using morphological operations with a kernel size of 1 and dilation operation during the training phase and kernel size of 1 and dilation operation during the testing phase have the best defense effect, but the recognition accuracy is only 65%, indicating limited improvement.

[0037] (2) The effectiveness of two morphological defenses with a kernel size of 1 Figure 7 This demonstrates two morphological defenses: the performance of single and consecutive morphological operations against PGD attacks, with a rhombus structuring element and a kernel size of 1. The horizontal axis represents runtime morphological operations, referring to the single and consecutive morphological operations used during testing. Consecutive morphological operations are built upon the single operation. Different colored curves represent six training methods used during training, including no morphological operations and single and consecutive morphological operations. No morphological operations are used during training and testing.

[0038] As can be seen, under PGD attacks, the model accuracy drops to 7%. The accuracy improves significantly after using morphological defense methods. With a rhombus structuring element and a kernel size of 1, the best defense effect (58% accuracy) is achieved by using morphological operations that first open and then erode, both during training and testing. This indicates that the method effectively defends against PGD attacks, but the improvement compared to a single morphological operation in Experiment 1 is only 2%.

[0039] Figure 8 The study demonstrates the performance of two morphological defenses against SLD attacks: single and consecutive double morphological operations with a rhombus structuring element and a kernel size of 1. Under SLD attacks, the model accuracy drops to 46%. The morphological defense method provides some improvement. With a rhombus structuring element and a kernel size of 1, using morphological operations with closing operations during training and consecutive double closing operations during testing yields the best defense performance, achieving an accuracy of 68%. This shows that the method is effective in defending against SLD attacks, but only represents a 3% improvement over the single morphological operation in Experiment 1.

[0040] Figure 9 This study demonstrates the performance of two morphological defenses against FGSM attacks: single and consecutive two morphological operations with a rhombus structuring element and a kernel size of 1. Under FGSM attacks, the model accuracy drops to 11%. After applying the morphological defense method, the accuracy improves. It can be seen that with a rhombus structuring element and a kernel size of 1, using the morphological operation of closing followed by expanding during both training and testing phases yields the best defense effect, achieving an accuracy of 55%. This indicates that the method remains effective in defending against FGSM attacks and represents a 6% improvement over the single morphological operation in Experiment 1.

[0041] (3) Conclusion (3.1) Comparison of the best defense effects of morphological operations and Perlin noise fusion The model achieves classification accuracies of approximately 7%, 46%, and 11% under PGD, SLD, and FGSM attacks, respectively. Applying the Perlin noise fusion defense method, the maximum accuracies are 39%, 88%, and 38%, respectively. It is evident that applying morphological defense methods yields maximum accuracies of 58%, 68%, and 55%, respectively.

[0042] Combination Figure 4 and Figure 9 It can be seen that morphological operations offer some improvement in defense against FGSM and PGD, but the effect is not very good, and the improvement is even more limited in defense against SLD. Furthermore, the morphological operations used for optimal defense differ depending on the adversarial attack, but the kernel size remains almost unchanged, with the highest accuracy occurring when the kernel size is 1. Moreover, two consecutive morphological operations offer only limited improvement over a single morphological operation. Although the defense against these adversarial attacks is unsatisfactory, it can be concluded that the structuring elements used in morphological operations for defense against various attacks should not be too complex, and the kernel size should not be too large.

[0043] The results, as shown in Table 1, are obtained through comparison. It is evident that in most cases, the defensive effect of using Perlin noise with different spatial frequencies is inferior to that of using morphological operations. However, under certain conditions, the defensive effect of Perlin noise is superior to that of using morphological operations. Furthermore, the Perlin noise fusion method merely adds noise to the image without manipulating its essential structural features.

[0044] Table 1. Accuracy of morphological defense method and Perlin noise fusion method on CIFAR-10

[0045] (3.2) Comparison of the defensive effects of morphological operations and spatial frequency noise Morphological defense methods can defend against various attacks without knowing any details of the attack or the model. Experimental results show that morphological operation methods are weaker than Perlin noise fusion methods against SLD attacks, but slightly better than Perlin noise fusion methods against PGD and FGSM attacks. Therefore, we conclude that adding morphological operations with image structural features to the model during training and testing does not improve defense performance, and this method has a limited range of adversarial attacks it can defend against.

[0046] On the CIFAR-10 dataset, when facing SLD attacks, adding morphological operations is not an effective defense; adding Perlin noise with spatial properties provides better protection. Against PGD and FGSM attacks, both methods perform only moderately, but morphological operations outperform the Perlin noise fusion defense method. The conclusion is that when the structuring element is rhomboid, as long as the kernel size does not exceed 1, morphological operations will not obscure the original image information, and the classification model can still correctly classify it with decent accuracy. The reason why morphological operations cannot effectively defend against SLD attacks is not that the noise destroys the original image information, but rather that it may simply not effectively mask the attack data.

[0047] (3.3) Accuracy of the model Similarly, refer to... Figures 4 to 9 The comparison results shown represent the performance of points without morphology and points trained without morphology, without using morphological defense methods. All other points represent the performance of points using morphological operations under various kernel sizes and morphological operation conditions. Points with zero input morphology and zero training morphology have the lowest accuracy compared to points with 1, 2, and 3 input morphology and points trained with morphology. This indicates that adding morphology to the model improves the model's classification accuracy when encountering adversarial attacks. The accuracy for kernels 4 and 5 is too low because the structuring element kernel is too large and completely destroys the information of the original image. Figures 4 to 9 The peak value in the value indicates the best defensive effect.

[0048] pass Figures 4 to 6 It can be observed that different morphological operations have some differences in defensive effectiveness, but the differences are not significant. The optimal morphological operation for defense differs depending on the adversarial attack, but the morphological operation with a kernel size of 1 has the best general applicability in defense. While morphological defense methods are effective against SLD attacks, the results are not good. However, against PGD and FGSM attacks, morphological operations significantly improve the accuracy and robustness of the model. The defensive effectiveness of morphological operation methods varies for the three adversarial attacks. Regardless of the attack method, the defensive effect is generally better when the kernel size is 1 or 2 than other values; smaller values ​​are better, with the best effect achieved when the kernel size is 1. At this value, morphological processing can effectively mask perturbations in the image and preserve the original image information to the greatest extent, thus achieving a defensive effect. This is also the supporting condition for the two consecutive morphological defense experiments.

[0049] pass Figures 7 to 9It can be observed that, except for the SLD attack where morphological operations are not used during testing, using morphological operations during training improves accuracy to some extent compared to not using morphological operations (proving the effectiveness of morphological operations in defending against adversarial attacks). However, the maximum defensive effect is limited in terms of improvement based on a single morphological operation. The accuracy of using two consecutive morphological operations during testing either increases or decreases based on the accuracy of a single operation. During testing, for the three attacks, when erosion is the starting operation, the accuracy of two erosion operations and erosion plus opening operations decreases based on a single erosion operation; when dilation is the starting operation, two dilation operations and dilation plus closing operations decrease based on a single dilation operation; when opening is the starting operation, opening plus dilation and opening plus closing operations decrease based on a single opening operation; when closing is the starting operation, closing plus erosion and closing plus opening operations decrease based on a single closing operation. For all three attacks, it can be seen that when erosion and closing operations are used as the starting operations during testing, the fluctuation in morphological operation accuracy is similar and relatively large. When dilation and opening operations are used as the starting operations, the fluctuation is more moderate. For SLD attacks, the accuracy reached 58% without any morphological operations during training and testing, indicating that the attack depth was less effective than the other two attacks. The best performance was achieved when dilation was used as the starting operation, with both training and testing using the blue dilation line, reaching a maximum of 71%. For FGSM attacks, a good performance was achieved when closing was used as the starting operation, with both training and testing using the purple line combining closing and dilation operations, reaching a maximum of 55%. For PGD attacks, a good performance was achieved when erosion was used as the starting operation, with both training and testing using the blue erosion line, reaching a maximum of 59%.

[0050] The results clearly show the effectiveness of morphological operations in defense under different categories of training and testing morphological operations. We believe that the defense range of morphological operations that affect the structural features of images is not as wide as that of independent and identically distributed Perlin noise with spatial characteristics. In certain specific cases, it is still recommended to use independent and identically distributed Perlin noise with spatial characteristics for defense.

[0051] (3.4) Model accuracy Generally, deep neural networks require a large amount of clean, noise-free, and undisturbed data to function properly, and adversarial attacks are often a factor that interferes with neural networks. However, the results in this embodiment show that adding morphological operations that affect the structural features of images to the training and testing data can improve the robustness and stability of the model.

[0052] For the CIFAR-10 dataset, after applying morphological operations, the accuracy of kernel sizes 1, 2, and 3 was higher than that without morphological operations in most cases. Even when the kernel size of the structuring element was 4, which is almost unrecognizable by human vision, the neural network still maintained a good recognition rate. By incorporating morphological operations during training, the accuracy of the neural network improved regardless of whether it was subjected to adversarial attacks. The results indicate that morphological operations play a significant role in improving the robustness of the model.

[0053] Furthermore, as an implementation scheme, this application embodiment also relates to an adversarial attack defense method using the deep neural network model described above, and the resulting deep neural network model.

[0054] Optionally, in this embodiment, the deep neural network model adopts an 18-layer ResNet18 network architecture, including 17 convolutional layers and 1 connection layer, and performs data augmentation processing such as random flipping, shifting, whitening, and rotation in sequence. The loss function used is the common cross-entropy loss function. The optimizers are SGD and lr, and the learning rate is set to 0.01 during the training process of the corresponding model.

[0055] It should be noted that although preferred embodiments of this application have been described, those skilled in the art, once they understand the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0056] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for defending against adversarial attacks on a deep neural network model, characterized in that, The adversarial attack defense method for the deep neural network model includes the following steps: The deep neural network model is trained using a training set that has undergone morphological operations, and adversarial attack data that has undergone morphological operations is input into the trained deep neural network.

2. The adversarial attack defense method for deep neural network models as described in claim 1, characterized in that, The morphological operations include morphological operations, setting structuring elements, and setting the kernel size.

3. The adversarial attack defense method for deep neural network models as described in claim 2, characterized in that, The morphological operations include one or more of the following: erosion, dilation, opening, and closing operations.

4. The adversarial attack defense method for deep neural network models as described in claim 3, characterized in that, The kernel size can be set from 0 to 5.

5. The adversarial attack defense method for deep neural network models as described in claim 4, characterized in that, The structural element is set as a rhombus structure.

6. An adversarial attack defense method using a deep neural network model as described in any one of claims 1 to 5, wherein the obtained deep neural network model is...

Images