Image classification method and device based on endogenous feature denoising and storage medium

Abstract

The disclosure provides an image classification method and device based on endogenous feature denoising and a storage medium, including: obtaining a to-be-processed image, performing specification unification and numerical normalization operations on the to-be-processed image through a preset image transformation process to obtain standardized image data; inputting the standardized image data into a pre-trained anti-disturbance residual network model to output a classification result of the to-be-processed image; wherein the anti-disturbance residual network model is constructed based on a residual network model, and an adaptive feature denoising model is embedded in a feature transmission path of the residual network model; the adaptive feature denoising model is used for purifying high-dimensional features output by the residual network. The disclosure uses machine learning, such as artificial intelligence, neural networks and training models, takes neural networks as a core technology carrier, supports the construction and training of the residual network model and the adaptive feature denoising model, and solves the problem of deviation in image data classification caused by anti-disturbance.

Description

Technical Field

[0001] This disclosure relates to the field of image data processing technology, and in particular to an image classification method, apparatus and storage medium based on endogenous feature denoising. Background Technology

[0002] As deep learning technology penetrates deeply into security-sensitive fields such as autonomous driving, smart security, and financial payments, its role in supporting decision-making in complex scenarios is becoming increasingly prominent. However, the robustness challenges faced by deep learning models have become a key bottleneck restricting their large-scale industrial application, with adversarial example attacks being one of the main threats. The core logic of adversarial example attacks is to inject minute perturbations into the input layer that are imperceptible to the human eye. Although these perturbations do not affect the normal judgment of human input information, they can directly induce severe classification biases in deep learning models with extremely high recognition accuracy, thereby causing decision-making errors in security-sensitive scenarios and resulting in potential security risks and economic losses.

[0003] In computer vision and various vertical industry applications, deep residual networks, represented by ResNet-50, effectively solve the gradient vanishing problem in deep network training due to their unique bottleneck block structure. This greatly improves the training efficiency and representation depth of residual network models in complex semantic scenarios, making them the current mainstream basic network architecture. However, the inherent skip connection mechanism of this type of network, while efficiently transferring gradients and ensuring training stability, also logically provides a "lossless channel" for the penetration and layer-by-layer amplification of adversarial perturbations. This allows adversarial perturbations to accumulate continuously in the deep feature space, further exacerbating the classification bias of the residual network model.

[0004] To address the above issues, various defense schemes against perturbations have been proposed in the existing technology, but all of them have obvious defects and are difficult to meet the needs of practical applications. On the one hand, some schemes adopt the method of "static denoising" outside the residual network model, using methods such as autoencoders, JPEG compression, and Gaussian filtering to filter out noise before the input image data enters the residual network model, in an attempt to destroy the structure against perturbations. However, such methods lack dynamic interaction with the internal features of the residual network model, and can only achieve gradient "hiding" rather than truly eliminating the model's vulnerability. Attackers can easily bypass the preprocessing layer through techniques such as Backward Pass Differentiable Approximation (BPDA), resulting in limited defense effectiveness. Furthermore, strong denoising operations may destroy key details such as edges and textures of the input image data, leading to a decrease in the model's recognition accuracy for normal samples. On the other hand, some solutions achieve defense through "brute-force adversarial training," that is, generating adversarial examples in real time during training and adding them to the training set to force the model to learn the correct classification of adversarial examples. However, its essence is to forcibly change the model parameters to adapt to adversarial examples, which not only has the problem of huge computational overhead (generating strong adversarial examples requires multiple backpropagations, and the training time is usually 10-20 times that of ordinary training), but also causes serious robustness and accuracy trade-offs. The improvement of the residual network model's defense capability against adversarial examples often comes at the cost of a significant drop in the accuracy of normal sample recognition (usually a decrease of 10%-20%), making it difficult to meet the dual requirements of actual business for the performance of residual network models. Summary of the Invention

[0005] This disclosure provides an image classification method, apparatus, and storage medium based on endogenous feature denoising to solve the problem of deviations in image data classification caused by existing adversarial perturbations.

[0006] In view of the above problems, firstly, this disclosure provides an image classification method based on endogenous feature denoising, comprising: The image to be processed is acquired, and the image to be processed is subjected to standardization and numerical normalization operations through a preset image transformation process to obtain standardized image data. The standardized image data is input into a pre-trained robust residual network model, which outputs the classification result of the image to be processed. The robust residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model. The adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

[0007] In conjunction with the first aspect, in one possible implementation, the residual network model includes: a start layer, a first residual stage, a second residual stage, a third residual stage, a fourth residual stage, and a classification head; the adaptive feature denoising model includes: a first adaptive feature denoising model and a second adaptive feature denoising model; the first adaptive feature denoising model is embedded between the second residual stage and the third residual stage, and the second adaptive feature denoising model is embedded between the third residual stage and the fourth residual stage.

[0008] In conjunction with the first aspect, in one possible implementation, the high-dimensional features include: a first high-dimensional feature and a second high-dimensional feature; The step of inputting the standardized image data into a pre-trained perturbation-resistant residual network model and outputting the classification result of the image to be processed includes: The standardized image data is input into the starting layer, and feature extraction is performed through the starting layer, the first residual stage, and the second residual stage to obtain the first high-dimensional feature; the first high-dimensional feature is a four-dimensional tensor type. The first high-dimensional feature is input into the first adaptive feature denoising model for purification processing to obtain the first purified feature; The first purification feature is input into the third residual stage for feature extraction to obtain the second high-dimensional feature; the second high-dimensional feature is a four-dimensional tensor type. The second high-dimensional feature is input into the second adaptive feature denoising model for purification processing to obtain the second purified feature; The second purification feature is input into the fourth residual stage, where feature extraction is performed and the classification head performs classification and recognition, outputting the classification result of the image to be processed.

[0009] In conjunction with the first aspect, in one possible implementation, the step of inputting the first high-dimensional feature into a first adaptive feature denoising model for purification processing to obtain the first purified feature includes: The first high-dimensional feature input is compressed across channels using a convolution operation to obtain a first low-dimensional feature map. The features are reorganized by calculating the autocorrelation coefficient matrix between pixels in the first low-dimensional feature map to obtain the first feature noise prediction component. The first channel descriptor of the first high-dimensional feature is extracted by global average pooling; The first channel descriptor is input into a two-layer fully connected layer to obtain the first channel weight vector; The first high-dimensional feature is subtracted from the first feature noise prediction component to remove the noise component, resulting in a first cleaned feature map. Then, the first cleaned feature map is multiplied by the first channel weight vector using a broadcast multiplication operation to obtain the first cleaned feature. The formula is as follows: ; in, Represents the first high-dimensional feature. Represents the first characteristic noise prediction component. This represents the weight vector of the first channel. Indicates the first purification characteristic; The step of inputting the second high-dimensional feature into the second adaptive feature denoising model for purification processing to obtain the second purified feature includes: The second high-dimensional feature of the input is compressed across channels by convolution operation to obtain the second low-dimensional feature map; The features are recombined by calculating the autocorrelation coefficient matrix between pixels in the second low-dimensional feature map to obtain the second feature noise prediction component. The second channel descriptor of the second high-dimensional feature is extracted by global average pooling; The second channel descriptor is input into the two-layer fully connected layer to obtain the second channel weight vector; The second high-dimensional feature is subtracted from the second feature noise prediction component to remove the noise component, resulting in the second cleaned feature map. Then, the second cleaned feature map is multiplied by the second channel weight vector using a broadcast multiplication operation to obtain the second cleaned feature. The formula is as follows: ; in, This represents the second high-dimensional feature. This represents the second characteristic noise prediction component. This represents the weight vector of the second channel. This indicates the second purification characteristic.

[0010] In conjunction with the first aspect, in one possible implementation, the disturbance-resistant residual network model is trained in the following manner: Obtain normal samples; Based on the normal samples, adversarial samples are generated using the PGD attack generator; Normal samples and adversarial samples are input into the robust residual network model, and the model is iteratively trained using a hybrid loss function until the hybrid loss function meets the iteration stopping condition, at which point the iterative training stops; the expression for the hybrid loss function is: ; in, Represents the mixed loss function. This indicates a normal sample. Indicates adversarial examples, The cross-entropy classification loss represents the normal sample. The cross-entropy classification loss represents the adversarial examples. Indicates feature distance loss, This represents the deep features extracted by the perturbation-resistant residual network model from normal samples. This indicates the deep features extracted from adversarial examples by the aforementioned perturbation-resistant residual network model. , This represents the loss weighting coefficient.

[0011] In conjunction with the first aspect, in one possible implementation, generating adversarial samples using a PGD attack generator based on the normal samples includes: Initialize the perturbation step size of the PGD attack generator and generate initial adversarial samples based on the normal samples; During the training iteration of the disturbance-resistant residual network model, the fluctuation ratio of the mixed loss function in the current iteration to that in the previous iteration is monitored in real time. If the fluctuation ratio is greater than a preset threshold, the perturbation step size is reduced by a first preset ratio; if the fluctuation ratio is less than a preset threshold, the perturbation step size is increased by a second preset ratio to obtain a new perturbation step size. Based on the normal samples and the new perturbation step size, generate adversarial samples for the next iteration.

[0012] In conjunction with the first aspect, in one possible implementation, during the iterative training of the robust residual network model using a hybrid loss function, a stochastic gradient descent optimizer is used to update the parameters of the robust residual network model.

[0013] In conjunction with the first aspect, in one possible implementation, the residual network model is constructed based on the ResNet-50 network, wherein: The initial layer includes a convolutional layer and a max pooling layer, used for preliminary feature extraction and downsampling of the input standardized image data; the first residual stage includes 3 bottleneck blocks; the second residual stage includes 4 bottleneck blocks; the third residual stage includes 6 bottleneck blocks; the fourth residual stage includes 3 bottleneck blocks; the classification head includes a global average pooling layer and a fully connected layer, used for classifying the features output from the fourth residual stage and outputting the classification result of the image to be processed.

[0014] Secondly, an image classification device based on endogenous feature denoising is provided, comprising: The standardization module is used to acquire the image to be processed and perform standardization and numerical normalization operations on the image to be processed through a preset image transformation process to obtain standardized image data. The classification and recognition module is used to input the standardized image data into a pre-trained anti-perturbation residual network model and output the classification result of the image to be processed; wherein, the anti-perturbation residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model; the adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

[0015] Thirdly, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, performs the steps of the image classification method based on endogenous feature denoising as described in the first aspect or any possible implementation thereof.

[0016] The beneficial effects of the embodiments disclosed herein include: This disclosure provides an image classification method, apparatus, and storage medium based on endogenous feature denoising, comprising: acquiring an image to be processed; performing standardization and numerical normalization operations on the image to be processed through a preset image transformation process to obtain standardized image data; inputting the standardized image data into a pre-trained anti-perturbation residual network model; and outputting the classification result of the image to be processed; wherein the anti-perturbation residual network model is constructed based on a residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model; the adaptive feature denoising model is used to purify the high-dimensional features output by the residual network. This embodiment of the image classification method based on endogenous feature denoising uses machine learning, such as artificial intelligence, neural networks, and training models, with neural networks as the core technology carrier to support the construction and training of the residual network model and the adaptive feature denoising model, thus solving the problem of image data classification deviation caused by anti-perturbation. Compared to traditional methods, it can effectively reduce computational overhead and improve training and inference efficiency. By embedding an adaptive feature denoising model inside the residual network model, it achieves endogenous denoising of the feature layer. Unlike traditional PGD adversarial training, it does not require repeated iterations to generate strong adversarial samples, thus avoiding the computational consumption caused by multiple backpropagations. It solves the problems of high computational overhead and long training time in traditional adversarial training, and balances defense effect and computational efficiency, making it more suitable for large-scale industrial applications. Furthermore, it solves the trade-off between robustness and accuracy. Standardized preprocessing provides high-quality input to the anti-disturbance residual network model to reduce irrelevant noise interference. The adaptive feature denoising model only targets adversarial disturbances without destroying the key semantic features of normal samples. Relying on the high-performance representation capabilities of the residual network backbone, it avoids the problem of a significant decrease in the accuracy of normal samples accompanied by the improvement of defense capabilities in traditional solutions, thus meeting the business requirements for dual performance. It can also suppress the side effects of skip connections in the residual network and block the propagation of adversarial disturbances. By embedding the adaptive feature denoising model into the feature transmission path for real-time purification, it cuts off the disturbance transmission and amplification channels from the inside, alleviates the nonlinear superposition of noise in the deep feature space, and improves the intrinsic security of the anti-disturbance residual network model. Compared with external preprocessing solutions, the defense effect is more stable and less likely to be bypassed by technologies such as BPDA. Attached Figure Description

[0017] Figure 1 A flowchart of an image classification method based on endogenous feature denoising provided in this embodiment of the disclosure; Figure 2 This is a structural diagram of the disturbance-resistant residual network model provided in the embodiments of this disclosure; Figure 3 A structural diagram of the adaptive feature denoising model provided in the embodiments of this disclosure; Figure 4 A schematic diagram of the training process of the disturbance-resistant residual network model provided in the embodiments of this disclosure; Figure 5 This is a schematic diagram showing the comparison of classification results provided in the embodiments of this disclosure; Figure 6 This is a structural diagram of an image classification device based on endogenous feature denoising provided in an embodiment of this disclosure. Detailed Implementation

[0018] This disclosure provides an image classification method, apparatus, and storage medium based on endogenous feature denoising. Preferred embodiments of this disclosure are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit this disclosure. Furthermore, the embodiments and features described in this application can be combined with each other unless otherwise specified.

[0019] This disclosure provides an image classification method based on endogenous feature denoising, such as... Figure 1 As shown, it includes: S101. Obtain the image to be processed, and perform standardization and numerical normalization operations on the image to be processed through a preset image transformation process to obtain standardized image data. S102. Standardized image data is input into a pre-trained anti-perturbation residual network model, and the classification result of the image to be processed is output. The anti-perturbation residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model. The adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

[0020] In this embodiment, the core mechanism of adversarial example attacks is to search for the optimal perturbation component in the input space, thereby breaking through the discrimination boundary of the deep learning model and causing it to make incorrect predictions. Mathematically, this can be clearly defined as follows: given a pre-trained classifier f and a normal sample (x, y) (where x is the normal sample itself, and y is the true class label corresponding to the normal sample). In deep learning (especially in image classification and adversarial example defense), a normal sample (also known as a clean sample) refers to the original input data that has not been artificially disturbed, contaminated by noise, or maliciously tampered with, and can truly reflect the essential characteristics of the target object. It is the basic data carrier for model training, validation, and performance benchmarking. The attacker's goal is to find a perturbation... It satisfies the following constraints: ; in, Indicates obedience, This indicates the use of the Lp norm as a metric (commonly used) or The perturbation strength of the norm. The norm (infinite norm, also known as the Chebyshev norm) represents the perturbation. The maximum absolute value of a single element; in the context of an image scene, it represents the maximum change in pixel value across all pixels. The norm (Euclidean norm) represents the Euclidean length of the perturbation δ as a vector; in image scenarios, it is the square root of the sum of squares of the changes in all pixels, and is suitable for attack scenarios that require "minimizing the overall energy of the perturbation". The maximum allowable limit for the perturbation (i.e., the perturbation budget) is set. This formula reveals the essence of adversarial example attacks: under the premise of ensuring that the perturbation is "imperceptible" to human senses (limiting the noise intensity), the deep learning model is forced to produce incorrect predictions by inducing deviations in the activation of internal features.

[0021] Traditionally, some solutions employ adversarial training (PGD) for defense. The core idea of ​​PGD is to generate adversarial examples (i.e., perturbations in the opposite direction of gradients onto the input data) in real-time during deep learning model training and add these examples to the training set, forcing the deep learning model to learn and correctly classify these attack examples. PGD is a mainstream adversarial training method based on projected gradient descent to generate adversarial examples and integrate them into the deep learning model training process. It is also a core and classic method for improving the adversarial example defense capabilities of deep learning models. Belonging to the category of constrained iterative adversarial training, it can generate more aggressive adversarial examples, allowing the deep learning model to fully learn the characteristics of adversarial perturbations during training, thereby achieving stronger robustness. Essentially, this is a "Min-Max" game process.

[0022] ; in, These represent the update parameters of the deep learning model. This indicates that by adjusting the parameters By minimizing the classification loss under the "worst perturbation", we can learn feature representations that are robust to adversarial examples. This means finding the perturbation δ that maximizes the model loss while meeting the perturbation budget, generating the strongest adversarial example, and simulating the "worst perturbation". Represents the loss function. Indicates by parameters The defined deep learning model faces several technical bottlenecks in practical applications: First, the computational cost is enormous, requiring multiple rounds of backpropagation iterations to generate strong adversarial examples, resulting in an overall training time that is typically 10-20 times longer than ordinary training, significantly increasing computational costs and training cycles. Second, there is the thorny trade-off between robustness and accuracy; the improved defense capabilities of deep learning models against adversarial examples often come at the cost of a significant drop in accuracy on normal examples, with accuracy losses typically reaching 10%-20%, making it difficult to meet the dual requirements of actual business for model performance. Furthermore, the inherent skip connection mechanism of residual networks, such as ResNet, also brings side effects. While efficiently propagating gradients to alleviate gradient vanishing, it also provides a "lossless propagation" channel for adversarial perturbations, causing noise to be nonlinearly superimposed and amplified in the deep feature space, further exacerbating the vulnerability of deep learning models.

[0023] Another common defense strategy is input preprocessing / denoising, which uses autoencoders or traditional image processing techniques such as JPEG compression and Gaussian filtering to filter out high-frequency noise before the image is input into the deep learning model, attempting to disrupt the structure against adversarial perturbations. However, this type of method also has significant drawbacks: First, it essentially hides gradients by gradient masking and does not truly eliminate the vulnerability of the model. Attackers can use techniques such as BPDA to bypass the preprocessing layer through a strategy of "forward truth preprocessing and backward differentiable approximation," which greatly reduces the defense effect. In addition, excessive denoising operations can destroy key details such as image edges and textures, causing a significant decline in the model's recognition accuracy of normal, clear samples, making it difficult to achieve a balance between defense effectiveness and basic performance.

[0024] In this embodiment, the present invention aims to achieve inherent immunity to strong adversarial attacks on residual network architectures by embedding an adaptive feature denoising model (AFDM) at key nodes of feature abstraction, without sacrificing the accuracy of normal sample recognition. The original image to be processed is transformed into standardized data that meets the input requirements of the robust residual network, eliminating the impact of data heterogeneity on the model's inference accuracy and laying the foundation for subsequent feature extraction and denoising operations. First, the image to be processed is acquired. This image can be a road condition map in autonomous driving scenarios, a monitoring frame in smart security, or a face image in financial payments—original images from security-sensitive fields. The image format is compatible with common types such as RGB and grayscale, with no special format restrictions. Then, a preset image transformation process is executed. First, the image is standardized by using mainstream image processing algorithms such as bilinear interpolation to adjust the image to a preset size (typically set to 224×224 pixels or 32×32 pixels, adapting to mainstream datasets such as CIFAR-10 and ImageNet, considering the characteristics of ResNet series models). This ensures consistent spatial resolution of the input image and avoids feature extraction deviations in the pre-trained robust residual network model due to size differences. Next, numerical normalization is performed. The pixel values ​​of the standardized images are normalized by applying mean and standard deviation normalization operations, mapping the pixel values ​​to a preset range (usually [0,1] or [-1,1]). This eliminates the interference of pixel value magnitude differences on the inference results of the anti-perturbation residual network model, while also accelerating the model's convergence speed. Finally, standardized image data is obtained. This data is in a multidimensional tensor format and can be directly input into the anti-perturbation residual network model for further processing.

[0025] Furthermore, by embedding an adaptive feature denoising model into the robust residual network, adversarial perturbations are purified from the internal feature space of the robust residual network model while completing the classification task, thus improving the robustness of the robust residual network model. First, standardized image data is input into the pre-trained robust residual network model, which uses a residual network model (such as ResNet-50) as its backbone. The core improvement lies in embedding an adaptive feature denoising model into the feature transmission path of the residual network model, forming a complete link of "feature extraction → feature purification → deep feature processing → classification output". The pre-training process of the robust residual network combines PGD adversarial training with a hybrid loss function to ensure that the model has fully learned adversarial perturbation features during the training phase and possesses basic robustness. The adaptive feature denoising model, as the core denoising unit, precisely cleans the high-dimensional feature maps output from each stage of the residual network. Specifically, it generates noise prediction components through cross-channel dimensionality compression and global correlation modeling, while simultaneously extracting feature channel descriptors to generate channel weight vectors. Based on these two methods, adversarial perturbations in the high-dimensional feature maps are stripped and suppressed, achieving endogenous denoising at the feature layer. After high-dimensional features are extracted from the standardized image data by the residual network model backbone, they are first cleaned by the adaptive feature denoising model. The cleaned features are then fed back into the residual network for further deep feature mining and optimization. Finally, the classification result of the image to be processed is output through the residual network model classification head, completing the entire inference process. This step breaks through the limitations of traditional defense schemes such as "external denoising" or "brute-force adversarial training," achieving a synergistic improvement in classification performance and robustness.

[0026] Compared to traditional methods, this embodiment effectively reduces computational overhead and improves training and inference efficiency. By embedding an adaptive feature denoising model within the residual network model, intrinsic denoising at the feature layer is achieved. Unlike traditional PGD adversarial training, it eliminates the need for repeated iterations to generate strong adversarial samples, avoiding the computational consumption caused by multiple backpropagations. This solves the problems of huge computational overhead and significantly extended training time in traditional adversarial training, balancing defense effectiveness and computational efficiency, and is more suitable for large-scale industrial applications. Secondly, it overcomes the trade-off between robustness and accuracy, ensuring dual performance targets are met. Standardized preprocessing provides high-quality input to the perturbation-resistant residual network model, reducing the interference of irrelevant noise on accuracy. The adaptive feature denoising model only specifically purifies adversarial perturbations without destroying key semantic features such as edges and textures of normal samples. At the same time, relying on the high-performance representation capabilities of the residual network backbone, it effectively avoids the problem of "improved defense capabilities accompanied by a significant decrease in the accuracy of normal samples" in traditional solutions, simultaneously meeting the dual requirements of model robustness and basic recognition accuracy in actual business applications. It suppresses the side effects of skip connections and blocks the propagation of adversarial perturbations. To address the issues of lossless propagation and deep superposition of adversarial disturbances caused by skip connections in residual networks, an adaptive feature denoising model is embedded in the feature transmission path. This model performs real-time purification during disturbance propagation, cutting off the transmission and amplification channels of disturbances from within. This effectively alleviates the problem of nonlinear superposition of noise in deep feature spaces, further enhancing the intrinsic security of the adversarial residual network model. Compared to external preprocessing schemes, the defense effect is more stable and less susceptible to bypassing by techniques such as BPDA.

[0027] In another embodiment of this disclosure, the residual network model includes: a start layer, a first residual stage, a second residual stage, a third residual stage, a fourth residual stage, and a classification head; the adaptive feature denoising model includes: a first adaptive feature denoising model and a second adaptive feature denoising model; the first adaptive feature denoising model is embedded between the second residual stage and the third residual stage, and the second adaptive feature denoising model is embedded between the third residual stage and the fourth residual stage.

[0028] In this embodiment, the anti-disturbance residual network model is constructed based on the residual network model. By clarifying the hierarchical composition of the residual network and the targeted embedding position of the adaptive feature denoising model, an intrinsic anti-disturbance link is built, consisting of "stepwise feature extraction → mid-to-deep precise denoising → feature deepening optimization → classification output". The overall structure revolves around the feature transfer rules at each stage of the residual network, embedding a dual adaptive feature denoising model into key nodes to achieve segmented interception and purification against disturbances, balancing feature representation integrity and anti-disturbance capability. This forms the core structural support for the intrinsic image feature denoising and robust enhancement method. Figure 2As shown, the residual network model adopts a hierarchical progressive structure, consisting of an initial layer 201, a first residual stage 202, a second residual stage 203, a third residual stage 204, a fourth residual stage 205, and a classification head 206. Each layer performs its specific function and works together to progressively improve the original features into semantic features and map them to the categories. The initial layer 201 is responsible for preliminary feature capture and downsampling of the input standardized image data, filtering redundant information and reducing the size of the feature map, laying the foundation for feature extraction in subsequent residual stages. The first residual stage 202 to the fourth residual stage 205 are all composed of several bottleneck blocks stacked together. Through a three-stage structure of "1×1 dimensionality reduction → 3×3 feature extraction → 1×1 dimensionality increase", the computational cost is reduced while deeply mining the semantic features of the image. The number of feature channels in each stage gradually increases, and the semantic representation ability is enhanced step by step. The classification head 206, as the final output unit, maps the deep semantic features output by the fourth residual stage 205 to the prediction results (probability distribution or discrete label) of the corresponding category, completing the classification task. The adaptive feature denoising model includes a first adaptive feature denoising model 207 and a second adaptive feature denoising model 208. The two have the same structure and function. They both have the core capabilities of cross-channel dimensional compression, global correlation modeling to generate noise prediction components, and extracting channel descriptors to generate weight vectors. They can selectively remove adversarial perturbations in high-dimensional features, and can achieve segmented denoising when deployed independently, avoiding feature distortion or incomplete denoising caused by excessive processing pressure of a single denoising model. Based on the feature transfer characteristics and adversarial perturbation propagation laws of the residual network model, a precise embedding strategy is adopted: A first adaptive feature denoising model 207 is embedded between the second residual stage 203 and the third residual stage 204. At this point, the features have completed preliminary semantic extraction, and adversarial perturbations begin to gradually accumulate but have not yet spread on a large scale, enabling early interception and preliminary purification of the perturbations. A second adaptive feature denoising model 208 is embedded between the third residual stage 204 and the fourth residual stage 205. In this stage, the features enter the deep semantic space, and perturbations are easily amplified nonlinearly through skip connections. Secondary denoising can completely remove residual perturbations, providing clean feature input for feature optimization in the fourth residual stage 205 and accurate prediction by the classification head 206. The embedding positions of both adaptive feature denoising models are located at the deep feature transition nodes in the residual network, avoiding interference from shallow feature denoising on the basic representation and preventing the problem of difficult purification after the accumulation of deep feature perturbations. This precisely blocks the perturbation propagation path and strengthens the intrinsic anti-perturbation capability. To address the issue of "lossless propagation" and deep superposition of adversarial disturbances caused by skip connections in residual networks, a dual adaptive feature denoising model is embedded in mid-to-deep transition nodes to form a defense link of "segmented interception and step-by-step purification." This effectively alleviates the nonlinear superposition of noise in deep feature spaces by cutting off the channels for disturbance transmission and amplification from within. Compared with external preprocessing or a single denoising model, this approach offers stronger defense targeting and more stable results.Balancing feature representation and denoising effectiveness, the model overcomes the challenge of balancing accuracy. The adaptive feature denoising model specifically targets adversarial perturbations and is deployed at the mid-to-deep feature stages, where basic semantic features are already largely formed. The denoising operation does not damage key features such as edges and textures of normal samples. Simultaneously, leveraging the high-performance representation capabilities of the residual network at each stage ensures that the denoised features still accurately reflect the image semantics, avoiding the problem of "defense enhancement accompanied by accuracy decline" in traditional solutions. Optimized computational allocation improves operational efficiency. The dual adaptive feature denoising model is specifically deployed at key nodes where perturbations easily accumulate, eliminating the need for full-chain deployment of adaptive feature denoising models. This avoids the high computational cost of repeatedly generating adversarial examples in traditional PGD adversarial training and reduces resource waste from redundant denoising operations. While ensuring defense effectiveness and classification accuracy, it improves the training and inference efficiency of the anti-perturbation residual network model, adapting to the needs of large-scale industrial applications.

[0029] In another embodiment of this disclosure, the high-dimensional features include: a first high-dimensional feature and a second high-dimensional feature; In step S102 above, standardized image data is input into a pre-trained perturbation-resistant residual network model, and the classification result of the image to be processed is output, including: Step 1: Input standardized image data into the starting layer, and perform feature extraction through the starting layer, the first residual stage, and the second residual stage to obtain the first high-dimensional feature; the first high-dimensional feature is a four-dimensional tensor type. Step 2: Input the first high-dimensional feature into the first adaptive feature denoising model for purification processing to obtain the first purified feature; Step 3: Input the first purification feature into the third residual stage for feature extraction to obtain the second high-dimensional feature; the second high-dimensional feature is a four-dimensional tensor type. Step 4: Input the second high-dimensional feature into the second adaptive feature denoising model for purification processing to obtain the second purified feature; Step 5: Input the second purification feature into the fourth residual stage. The fourth residual stage performs feature extraction and classification head classification recognition, and outputs the classification result of the image to be processed.

[0030] In this embodiment, standardized image data is processed within an anti-perturbation residual network. Through a progressive logic of "staged feature extraction - targeted denoising and purification - deep feature optimization - classification output," accurate interception and purification against perturbations are achieved, while ensuring in-depth semantic mining of features. This ultimately outputs reliable image classification results, balancing inference efficiency with enhanced anti-perturbation capability and classification accuracy of the anti-perturbation residual network model. Regarding step 1 above, in the initial feature extraction stage, standardized image data is transformed into a first high-dimensional feature with mid-level semantic information. The standardized image data is first input into the starting layer of the anti-perturbation residual network. The starting layer performs convolution and downsampling operations to capture preliminary features of the original image, filtering pixel-level redundant information and reducing the feature map size to improve subsequent processing efficiency. Subsequently, the feature data is sequentially fed into the first residual stage and the second residual stage. These two stages, through a stacked bottleneck block structure, progressively complete the mining from basic texture features to mid-level semantic features. The first residual stage focuses on basic feature extraction, while the second residual stage deepens semantic representation, ultimately outputting the first high-dimensional feature. The first high-dimensional feature is a four-dimensional tensor, with dimensions corresponding to "batch size × number of channels × feature map height × feature map width". It can fully carry the mid-level semantic information output from the second residual stage, providing a format-adapted and information-complete input carrier for subsequent denoising processing. Regarding step 2 above, adversarial perturbations in the first high-dimensional feature are removed to prevent further accumulation of perturbations as they are passed along with the feature. The first high-dimensional feature is input into the first adaptive feature denoising model. Based on cross-channel dimensionality compression and global correlation modeling techniques, the first adaptive feature denoising model accurately identifies adversarial perturbation components in the feature and generates noise prediction results. Simultaneously, it extracts feature channel descriptors to construct weight vectors, achieving targeted removal and suppression of perturbations, retaining only normal semantic features. After purification, the first purified feature is output. This first purified feature not only continues the mid-level semantic attributes of the first high-dimensional feature but also significantly reduces residual adversarial perturbations, laying a clean foundation for subsequent deep feature extraction. The input type of the adaptive feature denoising model is required to be a four-dimensional tensor. The adaptive feature denoising model achieves perturbation removal based on cross-channel dimensional compression and global correlation modeling. It relies on multi-dimensional information from a four-dimensional tensor: the number of channels provides the foundation for cross-channel feature interaction and weight vector construction; the feature map height / width dimension carries spatial semantic information (such as edges and textures); and the batch size dimension adapts to batch inference scenarios. If the input is not a four-dimensional tensor, cross-channel analysis and spatial feature association cannot be completed, leading to the failure of perturbation identification and removal. To address step 3 above, the model aims to improve the class discriminative power of features.The first cleaned feature is input into the third residual stage. This stage, by stacking more bottleneck blocks, deeply mines the complex semantic features of the image without perturbation. Compared to the first high-dimensional feature, the second high-dimensional feature output by the third residual stage has a further increased number of channels, more condensed semantic information, and can accurately reflect the core category attributes of the image. Furthermore, due to the pre-cleaning process, the early superposition problem of adversarial perturbations in the deep feature space is completely avoided. In addition, the second high-dimensional feature is also a four-dimensional tensor type, maintaining consistency with the format of the preceding features, ensuring the smoothness of subsequent processing. For step 4 above, the second high-dimensional feature is input into the second adaptive feature denoising model, using the same cleansing logic as in step 2. Perturbation residues that are prone to nonlinear superposition due to skip connections in deep features are targeted for removal and suppression. Since deep features directly affect the final classification result, residual perturbations can be completely removed, preventing them from interfering with classification decisions. The final output second cleaned feature combines deep semantic attributes with high purity, providing a reliable guarantee for subsequent classification and recognition. For step 5 above, the second purified features are input into the fourth residual stage. This fourth residual stage performs final deepening and optimization of the features, further strengthening the representational ability of core category features and filtering out remaining redundant information. Subsequently, the optimized features are fed into the classification head. The classification head uses fully connected layers and other structures to map high-dimensional semantic features into probability distributions or discrete labels of the corresponding categories, finally outputting the classification result of the image to be processed, thus completing the entire inference process. Two denoising steps precisely block the propagation of disturbances, enhancing the model's anti-disturbance stability. By setting denoising stages at mid-layer and deep feature nodes respectively, a dual defense of "early interception + late-stage cleanup" is formed, precisely blocking the transmission and superposition of adversarial disturbances in the residual network, cutting off the disturbance amplification channel from within. Compared with external preprocessing schemes, the defense effect is more stable and less easily bypassed by techniques such as BPDA, significantly improving the model's intrinsic security. High-dimensional tensors ensure feature integrity, solving the problem of precision trade-offs. Both the first and second high-dimensional features adopt a four-dimensional tensor format, which can completely preserve the semantic feature information at each stage. The two adaptive denoising models only target adversarial perturbations without destroying the edges, textures, and core semantic features of normal samples. At the same time, relying on the staged feature extraction capability of the residual network, the anti-perturbation capability and classification accuracy are synergistically improved, avoiding the problem of "defense enhancement accompanied by accuracy decline" in traditional solutions. The process is highly adaptable, improving inference and training efficiency. Each step follows the progressive logic of "feature extraction-denoising-re-extraction-re-denoising-classification", which is highly compatible with the natural structure of the residual network and requires no additional redundant operations. It avoids the high computational cost of repeated iterations to generate adversarial examples in traditional PGD adversarial training, and also avoids the resource waste of full-link denoising. It improves the model's running efficiency while ensuring performance, and is suitable for large-scale industrial applications.

[0031] In another embodiment of this disclosure, in step 2 above, the first high-dimensional feature is input into the first adaptive feature denoising model for purification processing to obtain the first purified feature, including: Step 1: Perform cross-channel dimensionality compression on the first high-dimensional input feature using convolution operations to obtain the first low-dimensional feature map; Step 2: Calculate the autocorrelation coefficient matrix between pixels in the first low-dimensional feature map to reorganize the features and obtain the first feature noise prediction component; Step 3: Extract the first channel descriptor of the first high-dimensional feature using global average pooling; Step 4: Input the first channel descriptor into the two-layer fully connected layer to obtain the first channel weight vector; Step 5: Subtract the first high-dimensional feature from the first feature noise prediction component to remove the noise component and obtain the first cleaned feature map. Then, perform a broadcast multiplication operation between the first cleaned feature map and the first channel weight vector to obtain the first cleaned feature, expressed by the formula: ; in, Represents the first high-dimensional feature. Represents the first characteristic noise prediction component. This represents the weight vector of the first channel. Indicates the first purification characteristic; In step 4 above, the second high-dimensional feature is input into the second adaptive feature denoising model for purification processing to obtain the second purified feature, including: Step 6: Perform cross-channel dimensionality compression on the input second high-dimensional feature using convolution operations to obtain the second low-dimensional feature map; Step 7: Calculate the autocorrelation coefficient matrix between pixels in the second low-dimensional feature map, reorganize the features, and obtain the second feature noise prediction component; Step 8: Extract the second channel descriptor of the second high-dimensional feature using global average pooling; Step 9: Input the second channel descriptor into the two-layer fully connected layer to obtain the second channel weight vector; Step 10: Subtract the second high-dimensional feature from the second feature noise prediction component to remove the noise component and obtain the second cleaned feature map. Then, perform a broadcast multiplication operation between the second cleaned feature map and the second channel weight vector to obtain the second cleaned feature. The formula is as follows: ; in, This represents the second high-dimensional feature. This represents the second characteristic noise prediction component. This represents the weight vector of the second channel. This indicates the second purification characteristic.

[0032] In this embodiment, the first adaptive feature denoising model and the second adaptive feature denoising model have the same structure and logic, both revolving around the progressive logic of "dimensionality compression - noise prediction - channel representation - weight generation - feature purification". Noise is accurately located through convolutional compression and autocorrelation analysis. Channel weights are constructed by combining global pooling and fully connected layers. Finally, noise is removed and effective features are strengthened through addition and subtraction operations, achieving targeted purification of high-dimensional features. This thoroughly removes adversarial perturbations while retaining core semantic features, providing reliable support for subsequent feature extraction and classification. Figure 3 As shown, in step one above, cross-channel dimensionality compression generates the first low-dimensional feature map. The core purpose of this step is to reduce the feature dimensionality and focus on key information, thus reducing the burden on subsequent noise recognition. A convolution operation is performed on the input first high-dimensional feature (high-dimensional feature 301), using a 1×1 convolution kernel to achieve cross-channel linear transformation (1×1 pointwise convolution dimensionality reduction 302). Without losing core spatial semantic information, the number of feature channels is significantly compressed, resulting in a first low-dimensional feature map with lower dimensionality and more concise information. This improves subsequent computational efficiency and strengthens the correlation between features, laying the foundation for noise component recognition. In step two above, autocorrelation analysis generates the first feature noise prediction component. This step is the core of accurate noise localization, using noise prediction branch 303 to mine the internal correlation of features and identify perturbations. The autocorrelation coefficient matrix between all pixels in the first low-dimensional feature map is calculated. The autocorrelation coefficients are used to quantify the feature similarity between pixels, and then the features are reorganized and sorted. Feature components with low correlation to normal semantic features and conforming to the distribution law of adversarial perturbations are separated to obtain the first feature noise prediction component, achieving accurate locking of adversarial perturbations. For step three above, global average pooling (304) extracts the first channel descriptor. The core of this step is capturing channel-level global features to provide a basis for channel weight allocation. Global average pooling processes the original first high-dimensional features, compressing the spatial dimension information of each feature channel into a single value to generate the first channel descriptor. This descriptor accurately represents the global feature importance of each channel, reflecting the contribution of different channels to semantic classification and providing data support for subsequent weighted optimization. For step four above, a two-layer fully connected layer (305) generates the first channel weight vector. This step enhances the discriminative power of the channel weights through nonlinear transformation. The first channel descriptor obtained in step three is input into the two-layer fully connected layer. The first fully connected layer performs feature dimension mapping and nonlinear transformation, while the second fully connected layer outputs the first channel weight vector, consistent with the number of feature channels. Each element in the vector corresponds to the weight coefficient of a feature channel, thus strengthening effective channels and suppressing redundant channels. For step five above, feature purification generates the first purified feature (purified feature 306). This step is the final purification stage, achieving noise removal and feature optimization through computation, expressed as follows: ; in, Representing high-dimensional features, Represents the characteristic noise prediction component. Represents the channel weight vector. This indicates purification characteristics.

[0033] First, perform element-wise subtraction on the original first high-dimensional feature and the first feature noise prediction component obtained in step two to accurately remove the adversarial perturbation component and obtain the first clean feature map. Then, perform broadcast multiplication on the first clean feature map and the first channel weight vector obtained in step four to enhance the representation ability of the core semantic feature channel and finally output the first clean feature with both high purity and strong semantics.

[0034] The second adaptive feature denoising model has the same structure as the first adaptive feature denoising model, and the process of generating the second purified feature is conceptually the same as that of generating the first purified feature; repeated details will not be elaborated further. Through a combination strategy of "dimensionality compression + autocorrelation analysis," it reduces computational complexity while accurately targeting adversarial perturbation components, avoiding the problems of "falsely deleting effective features" or "residual perturbations" in traditional denoising methods. It achieves targeted removal of adversarial perturbations, and the two models use consistent logic to ensure the uniformity and thoroughness of mid-to-deep feature denoising effects. It boasts high noise recognition accuracy and thorough denoising. It has strong feature representation capabilities, ensuring classification accuracy. By constructing channel weights through global pooling and two fully connected layers, it strengthens the core semantic feature channels, preserving and enhancing the semantic representation capabilities of features while denoising, avoiding feature distortion caused by denoising operations, fundamentally resolving the contradiction between "denoising and accuracy," and providing high-quality feature support for subsequent classification stages. The process is highly versatile, balancing adaptability and efficiency. Both adaptive denoising models employ a completely consistent purification process, adaptable to the processing needs of high-dimensional features at medium to deep levels without requiring additional structural adjustments. Simultaneously, operations such as 1×1 convolutional compression and broadcast multiplication have low computational cost, avoiding redundant computational consumption and balancing denoising effectiveness with model running efficiency, making them suitable for large-scale inference scenarios. They exhibit excellent defensive stability and strong resistance to bypassing. Through intrinsic denoising at the feature layer and relying on autocorrelation analysis to accurately identify the nature of perturbations, compared to external preprocessing schemes, they effectively resist attacks from bypassing techniques such as BPDA, strengthening the model's robustness from within and improving defensive stability and intrinsic security.

[0035] In another embodiment of this disclosure, the disturbance-resistant residual network model is trained in the following manner: Step (1): Obtain normal samples; Step (2): Generate adversarial samples using the PGD attack generator based on normal samples; Step (3): Input normal samples and adversarial samples into the anti-perturbation residual network model, and use a hybrid loss function to iteratively train the anti-perturbation residual network model until the hybrid loss function meets the iteration stopping condition, and then stop the iterative training; the expression of the hybrid loss function is: ; in, Represents the mixed loss function. This indicates a normal sample. Indicates adversarial examples, The cross-entropy classification loss represents the normal sample. The cross-entropy classification loss represents the adversarial examples. Indicates feature distance loss, This represents the deep features extracted by the perturbation-resistant residual network model from normal samples. This indicates the deep features extracted by the perturbation-resistant residual network model from adversarial examples. , This represents the loss weighting coefficient.

[0036] In this embodiment, a PGD attack generator constructs strong adversarial examples based on normal samples. Then, using a hybrid loss function that combines classification loss and feature distance loss as the optimization objective, the model is iteratively trained. This forces the model to learn the feature differences between normal and adversarial samples, improving its adversarial perturbation defense capability while constraining adversarial sample features to align with normal sample features. Ultimately, this achieves synergistic optimization of "defense performance - classification accuracy," addressing the core deficiency of traditional adversarial training. Traditional adversarial training only focuses on the classification loss of the output result; this invention introduces consistency constraints at the feature layer. For example... Figure 4 As shown, for step (1) above, the obtained normal sample 401 (i.e., clean sample, corresponding to the formula) The samples must meet the requirements of the target task scenario. For example, in image classification tasks, they can be original images from standard datasets such as CIFAR-10 and ImageNet, or noise-free and tamper-free images collected in actual business scenarios (such as autonomous driving road condition maps and smart security monitoring frames). The samples need to undergo conventional preprocessing such as specification unification and numerical normalization to be converted into a format suitable for the input of the anti-perturbation residual network. At the same time, it is ensured that the sample labels are completely consistent with the real semantics and there are no labeling errors. This provides an accurate standard answer for subsequent loss calculation and optimization of the anti-perturbation residual network model parameters, which is the basic premise for ensuring the training effect. For the above step (2), an adversarial sample 403 with strong attack and conforming to the concealment constraint is constructed to simulate a real attack scenario to improve the model's anti-perturbation ability. Based on the obtained normal samples, adversarial samples are generated by the PGD attack generator 402 (projection gradient descent). Compared to the weak adversarial samples generated by single-step attacks, the adversarial samples generated by PGD are more aggressive and have better generalization ability, which can fully expose the anti-perturbation residual network model to the "worst perturbation" during training, providing effective training data for improving the robustness of the anti-perturbation residual network model. For the above step (3), a multi-objective hybrid loss function is designed to balance classification accuracy and anti-perturbation ability, thereby achieving a comprehensive improvement in model performance. First, normal samples and adversarial samples are mixed in a preset ratio to form a hybrid training set, which is then input into the anti-perturbation residual network model 404 to be trained; second, the hybrid loss function 405 is calculated, and the components work together to achieve multi-objective optimization; finally, with the goal of minimization, the parameters of the anti-perturbation residual network model are iteratively updated through optimizers such as SGD until the value of the hybrid loss function converges to a preset threshold (iteration stopping condition), and the iterative training is stopped to obtain a stable anti-perturbation residual network model.

[0037] like Figure 5 As shown, Indicates characteristics of normal samples. Representing adversarial example features, in the traditional approach of no defense (501), under the no-defense state on the left (adversarial feature deviation), the normal sample features in category A cluster are stably clustered within the cluster, while the corresponding adversarial example features undergo significant "adversarial feature deviation" under perturbation, shifting sharply along the direction indicated by the dashed arrow (attack-induced shift), even approaching the feature region of category B cluster. This shift causes the model to misclassify adversarial examples of category A as category B. However, in the defended state on the right (502), the normal sample features and adversarial example features in the same category A cluster completely overlap, successfully aligning into the feature space of category A. The original category B cluster is no longer affected by adversarial examples. This demonstrates that the defense mechanism of this invention, through feature layer optimization and denoising, completely eliminates the feature shift caused by adversarial perturbation, making the features of adversarial examples highly consistent with those of normal samples, fundamentally avoiding model misclassification, and achieving accurate feature alignment and reliable classification. By employing a hybrid loss function—normal sample classification loss to ensure basic accuracy, adversarial sample classification loss to enhance robustness, and feature distance loss to constrain feature alignment—these three elements work synergistically to avoid the problem of "increased robustness accompanied by decreased accuracy" in traditional adversarial training. This balances robustness and accuracy, overcomes the bottlenecks of traditional training, and achieves dual performance targets to meet actual business needs. It enhances the generalization ability of the robust residual network model against perturbations and ensures stable defense effects. Relying on strong adversarial samples constructed by the PGD generator, the robust residual network model fully learns adversarial perturbation features. Compared to training with weak adversarial samples, it exhibits stronger generalization ability against various iterative attacks. Combined with feature alignment constraints, it fundamentally improves the stability of feature representation, making it less susceptible to circumvention techniques such as BPDA. It optimizes training efficiency and adapts to industrial applications. Through hybrid sample training and a multi-objective hybrid loss function, it eliminates the need for additional complex training chains, avoiding the redundant computational consumption of repeated sample generation in traditional PGD adversarial training. Furthermore, the weight coefficients can be flexibly adjusted, balancing training efficiency and performance, and adapting to large-scale industrial deployments. The perturbation-resistant residual network model possesses inherent security and is adapted to core business scenarios. The training process focuses on feature layer optimization, which is deeply compatible with the intrinsic denoising logic of the adaptive feature denoising model. This enables the perturbation-resistant residual network model to have perturbation resistance capabilities at the parameter level. Compared with external preprocessing defense, the defense effect is more thorough and the stability is stronger, making it suitable for the core needs of security-sensitive scenarios such as autonomous driving and financial payment.

[0038] In another embodiment of this disclosure, step (2) above, generating adversarial samples using a PGD attack generator based on normal samples, includes: Step (1): Initialize the perturbation step size of the PGD attack generator and generate initial adversarial samples based on the normal samples; Step (II): During the training iteration of the perturbation-resistant residual network model, monitor in real time the fluctuation ratio of the mixed loss function of the current iteration to the mixed loss function of the previous iteration; Step (3): If the fluctuation ratio is greater than the preset threshold, reduce the perturbation step size by the first preset ratio; if the mixed fluctuation ratio is less than the preset threshold, increase the perturbation step size by the second preset ratio to obtain a new perturbation step size. Step (iv): Generate adversarial examples for the next iteration based on normal samples and the new perturbation step size.

[0039] In this embodiment, an initial adversarial sample is obtained by initializing the perturbation step size. The perturbation step size is dynamically adjusted based on the fluctuation ratio of the hybrid loss function during the training of the anti-perturbation residual network model. Then, adversarial samples adapted for the next round of training are generated based on the new perturbation step size. This achieves precise matching between the perturbation step size and the training state of the anti-perturbation residual network model, allowing the aggressiveness and adaptability of the generated adversarial samples to be optimized simultaneously, providing high-quality sample support for subsequent hybrid loss function training. Regarding step (i) above, the perturbation step size of the PGD attack generator is first initialized. This perturbation step size is the core hyperparameter of the PGD iterative attack. The initial value needs to be preset based on the task scenario and sample characteristics (e.g., the initial step size can be set to 1 / 255) to ensure that the initial perturbation has a certain degree of aggressiveness without exceeding the preset perturbation budget. Subsequently, based on the initialized perturbation step size, the initial perturbation is added through the PGD attack generator to obtain the initial adversarial sample. This initial adversarial sample serves as the adversarial sample input for the first round of training of the anti-perturbation residual network model, and also provides a benchmark reference for subsequent perturbation step size adjustments. Regarding step (ii) above, during each training iteration of the perturbation-resistant residual network model, the PGD attack generator synchronously monitors the loss change in real time, specifically calculating the fluctuation ratio between the mixed loss function of the current iteration and the mixed loss function of the previous iteration. The formula for calculating the fluctuation ratio can be set as |(L total,current -L total,prev ) / L total,prev |, where L total,current L represents the hybrid loss function for the current iteration. total,prevThis represents the hybrid loss function of the previous iteration. The fluctuation ratio directly reflects the adaptability and training stability of the robust residual network model to the current adversarial sample. If the fluctuation ratio is too large, it indicates that the current adversarial sample is either too aggressive or too weak, requiring adjustment of the perturbation step size to optimize the adversarial sample. If the fluctuation ratio is too small, it indicates that the adversarial sample is well-adapted, and the perturbation step size can be appropriately adjusted to enhance the sample's aggressiveness. Regarding step (iv) above, based on the original normal sample, the PGD attack generation logic is used, combined with a new perturbation step size, to regenerate the adversarial sample. This sample serves as the adversarial sample input for the next round of model training. By adjusting the perturbation step size in real time by monitoring the fluctuation ratio of the mixed loss function, the problem of excessively strong or weak sample aggression caused by a fixed step size is avoided. This ensures that the adversarial examples generated in each round are adapted to the current training state of the anti-perturbation residual network model, promoting the model to gradually strengthen its anti-perturbation ability and improve the overall training effect while training stably. At the same time, it can optimize the quality of adversarial examples and enhance the anti-perturbation generalization of the anti-perturbation residual network model. The dynamic adjustment strategy can accurately balance the aggression and concealment of the samples, ensuring that the adversarial examples effectively simulate real attack scenarios without exceeding the perturbation budget. Compared with samples generated by a fixed step size, the aggression is more accurate and the generalization is stronger, helping the anti-perturbation residual network model to fully learn various perturbation features and improve its ability to handle unknowns. It possesses strong defense capabilities against attacks; it also helps anti-perturbation residual network models converge quickly and improves training efficiency. By adjusting the perturbation step size, it stabilizes the fluctuations of the mixed loss function, avoiding training oscillations caused by drastic loss fluctuations, shortening the convergence cycle. Moreover, it does not require an additional sample generation link, but only optimizes the quality of adversarial examples through dynamic parameter tuning, ensuring both training effectiveness and efficiency, and adapting to the needs of large-scale model training. In addition, it has extremely strong adaptability and can flexibly adapt to different training scenarios. The first preset ratio, the second preset ratio, and the fluctuation threshold can all be flexibly adjusted according to task requirements and adversarial example characteristics. It can adapt to different computer vision tasks such as image classification and object detection, and is compatible with the sample distribution characteristics of different datasets, demonstrating significant generalization and practical value.

[0040] In another embodiment of this disclosure, during the iterative training of the adversarial perturbation residual network model using a hybrid loss function, a stochastic gradient descent optimizer is used to update the parameters of the adversarial perturbation residual network model.

[0041] In this embodiment, while iteratively calculating the mixed loss function, a stochastic gradient descent (SGD) optimizer is used to complete the closed-loop update of the parameters of the perturbation-resistant residual network model. The loss variation pattern is captured through gradient backpropagation, and the learnable parameters of the perturbation-resistant residual network model are iteratively adjusted along the negative gradient direction, ensuring that the parameters continuously converge towards minimizing the mixed loss. This simultaneously adapts to the training objectives of normal sample classification, adversarial sample perturbation resistance, and feature alignment, guaranteeing a steady improvement in model performance. In each training round, after calculating the mixed loss function for the current round, the stochastic gradient descent optimizer is activated. Based on the training feedback from the normal and adversarial samples input in the current round, the partial derivatives of the mixed loss function with respect to all learnable parameters of the model are calculated, generating a gradient matrix. This matrix accurately reflects the degree of influence and adjustment direction of each parameter on the loss value, providing a core basis for parameter updates. Subsequently, the SGD optimizer performs parameter updates in conjunction with preset hyperparameters: the preset learning rate controls the magnitude of each parameter update, preventing excessively large magnitudes from causing the robust residual network model to fail to converge or excessively small magnitudes from prolonging the training cycle; the momentum parameter is used to mitigate gradient oscillations, improve convergence stability, and reduce parameter update fluctuations caused by adversarial example perturbations. The optimizer employs a random batch sampling strategy, extracting a portion of samples from the mixed training set to calculate gradients, eliminating the need for the full set of samples and significantly reducing computational consumption. Iterative adjustments are made to each parameter batch by batch along the negative gradient direction. After each round of parameter updates, the updated model parameters are directly used for the next round of mixed loss function calculation and adversarial example generation, forming an iterative closed loop of "loss calculation - gradient solution - parameter update - sample adaptation" until the mixed loss function meets preset stopping conditions (such as the loss value converging to a threshold or the number of iterations reaching a target), at which point parameter updates and the overall training process cease. Stochastic Gradient Descent (SGD) is a classic parameter optimization algorithm. Its core function during model training is to calculate gradients by randomly sampling batches of samples and iteratively adjusting model parameters along the negative gradient direction, driving the loss function towards its minimum. SGD accurately captures gradient changes in mixed loss functions, simultaneously responding to the combined needs of normal sample classification loss, adversarial sample classification loss, and feature distance loss. It selectively adjusts each model parameter, improving the model's robustness without sacrificing classification accuracy, ultimately leading to the convergence of parameters to an optimal state that balances multiple objectives.

[0042] In another embodiment of this disclosure, the residual network model is constructed based on the ResNet-50 network, wherein: The initial layer includes a convolutional layer and a max pooling layer, used for preliminary feature extraction and downsampling of the input standardized image data; the first residual stage includes 3 bottleneck blocks; the second residual stage includes 4 bottleneck blocks; the third residual stage includes 6 bottleneck blocks; the fourth residual stage includes 3 bottleneck blocks; the classification head includes a global average pooling layer and a fully connected layer, used for classifying the features output from the fourth residual stage and outputting the classification result of the image to be processed.

[0043] In this embodiment, the residual network model is based on the classic ResNet-50 framework. Through a hierarchical and modular design, it constructs a complete feature extraction and classification chain from input to classification output. The model consists of a start layer, four residual stages (containing different numbers of bottleneck blocks), and a classification head. Each module has a clear division of labor, which not only retains the efficient feature representation capability of ResNet-50, but also adapts to the requirements of perturbation-resistant training and feature denoising, achieving synergistic optimization of basic classification performance and intrinsic perturbation resistance.

[0044] Initial layer: includes a 7x7 convolutional layer (stride 2) and a max pooling layer; The first residual stage includes 3 bottleneck blocks, with 256 output channels.

[0045] The second residual stage includes 4 bottleneck blocks and has 512 output channels.

[0046] The third residual stage includes 6 bottleneck blocks and 1024 output channels.

[0047] The fourth residual stage includes 3 bottleneck blocks and has 2048 output channels.

[0048] The classification head includes a Global Average Pooling (GAP) layer and 10 fully connected layers.

[0049] The initial layer performs convolution operations on the input standardized image data through convolutional layers to capture the basic edge and texture features of the image. Subsequently, a max-pooling layer is used for downsampling, reducing the feature map size and minimizing subsequent computation while preserving key feature information, laying the foundation for deeper feature extraction in the residual stage. The first residual stage consists of three ResNet-50 standard bottleneck blocks concatenated. Each bottleneck block follows a structure of "1×1 convolution dimensionality reduction → 3×3 convolution feature extraction → 1×1 convolution dimensionality increase," using skip connections to alleviate the gradient vanishing problem. This reduces computational complexity while achieving initial deepening and fusion of basic features, outputting a feature map with mid-level semantic information. The second residual stage includes four bottleneck blocks, continuing the feature extraction logic of the first residual stage, further increasing the number of feature channels and network depth to mine richer mid-level semantic features (such as target contours and local structures). The first high-dimensional feature output from this stage is directly input into the first adaptive feature denoising model for purification. The third residual stage, comprising six bottleneck blocks, is the deepest residual stage in the model, responsible for extracting more complex deep semantic features (such as target category attributes and global structure). This stage takes the first cleaned features as input and, under perturbation-free conditions, deeply mines the core semantic information of the image. The output second high-dimensional features are then input to the second adaptive feature denoising model for secondary cleansing. The fourth residual stage, comprising three bottleneck blocks, takes the second cleaned features as input and performs final optimization and enhancement on the features, further improving the class discriminative power of the features and providing highly recognizable deep feature input for the subsequent classification head. The classification head includes a global average pooling layer and a fully connected layer. The global average pooling layer compresses the high-dimensional feature map output from the fourth residual stage into a channel-level global feature vector, reducing redundant information; the fully connected layer maps this vector to the probability distribution or discrete label of the corresponding category, ultimately outputting the classification result of the image to be processed. Through a hierarchical, progressive structure from the initial layer to the classification head, features are progressively enhanced from basic texture to deep semantics. The skip connection design of the bottleneck block effectively alleviates the gradient vanishing problem in deep networks, ensuring feature representation capabilities and classification accuracy in complex scenarios. The "dimensionality reduction-extraction-dimensionality enhancement" structure of the bottleneck block significantly reduces computational complexity. Downsampling in the initial layer and channel number optimization at each stage further improve computational efficiency. Combined with the efficient parameter updates of the stochastic gradient descent optimizer, performance is guaranteed while adapting to the needs of large-scale industrial deployment.

[0050] Based on the same disclosed concept, this disclosure also provides an image classification device based on endogenous feature denoising. Since the principle of solving the problem by these devices is similar to that of the aforementioned image classification method based on endogenous feature denoising, the implementation of this device can refer to the implementation of the aforementioned method, and the repeated parts will not be described again.

[0051] This disclosure provides an image classification device based on endogenous feature denoising, such as... Figure 6 As shown, it includes: The standardization module 601 is used to acquire the image to be processed and perform standardization and numerical normalization operations on the image to be processed through a preset image transformation process to obtain standardized image data. The classification and recognition module 602 is used to input the standardized image data into a pre-trained anti-perturbation residual network model and output the classification result of the image to be processed; wherein, the anti-perturbation residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model; the adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

[0052] Based on the same disclosed concept, embodiments of this disclosure provide a computer-readable storage medium storing a computer program that, when executed by a processor, performs the steps of the image classification method based on endogenous feature denoising as described in any of the above embodiments.

[0053] Through the above description of the embodiments, those skilled in the art can clearly understand that the embodiments of this disclosure can be implemented in hardware or by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions of the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, mobile hard drive, etc.) and includes several instructions to cause a computer device (such as a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments of this disclosure.

[0054] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the modules or processes in the drawings are not necessarily essential for implementing this disclosure.

[0055] Those skilled in the art will understand that the modules in the apparatus of the embodiments can be distributed in the apparatus of the embodiments as described in the embodiments, or they can be located in one or more devices different from this embodiment with corresponding changes. The modules of the above embodiments can be combined into one module, or they can be further divided into multiple sub-modules.

[0056] The sequence numbers of the embodiments disclosed above are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0057] Obviously, those skilled in the art can make various modifications and variations to this disclosure without departing from its spirit and scope. Therefore, if such modifications and variations fall within the scope of the claims of this disclosure and their equivalents, this disclosure is also intended to include such modifications and variations.

Claims

1. An image classification method based on endogenous feature denoising, characterized in that, include: The image to be processed is acquired, and the image to be processed is subjected to standardization and numerical normalization operations through a preset image transformation process to obtain standardized image data. The standardized image data is input into a pre-trained robust residual network model, which outputs the classification result of the image to be processed. The robust residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model. The adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

2. The method as described in claim 1, characterized in that, The residual network model includes: a starting layer, a first residual stage, a second residual stage, a third residual stage, a fourth residual stage, and a classification head; the adaptive feature denoising model includes: a first adaptive feature denoising model and a second adaptive feature denoising model; the first adaptive feature denoising model is embedded between the second residual stage and the third residual stage, and the second adaptive feature denoising model is embedded between the third residual stage and the fourth residual stage.

3. The method as described in claim 2, characterized in that, High-dimensional features include: first high-dimensional features and second high-dimensional features; The step of inputting the standardized image data into a pre-trained perturbation-resistant residual network model and outputting the classification result of the image to be processed includes: The standardized image data is input into the starting layer, and feature extraction is performed through the starting layer, the first residual stage, and the second residual stage to obtain the first high-dimensional feature; the first high-dimensional feature is a four-dimensional tensor type. The first high-dimensional feature is input into the first adaptive feature denoising model for purification processing to obtain the first purified feature; The first purification feature is input into the third residual stage for feature extraction to obtain the second high-dimensional feature; the second high-dimensional feature is a four-dimensional tensor type. The second high-dimensional feature is input into the second adaptive feature denoising model for purification processing to obtain the second purified feature; The second purification feature is input into the fourth residual stage, where feature extraction is performed and the classification head performs classification and recognition, outputting the classification result of the image to be processed.

4. The method as described in claim 3, characterized in that, The step of inputting the first high-dimensional feature into the first adaptive feature denoising model for purification processing to obtain the first purified feature includes: The first high-dimensional feature input is compressed across channels using a convolution operation to obtain a first low-dimensional feature map. The features are reorganized by calculating the autocorrelation coefficient matrix between pixels in the first low-dimensional feature map to obtain the first feature noise prediction component. The first channel descriptor of the first high-dimensional feature is extracted by global average pooling; The first channel descriptor is input into a two-layer fully connected layer to obtain the first channel weight vector; The first high-dimensional feature is subtracted from the first feature noise prediction component to remove the noise component and obtain the first cleaned feature map. Then, the first cleaned feature map is multiplied by the first channel weight vector to obtain the first cleaned feature, as expressed by the formula: ； in, Represents the first high-dimensional feature. This represents the first characteristic noise prediction component. This represents the weight vector of the first channel. Indicates the first purification characteristic; The step of inputting the second high-dimensional feature into the second adaptive feature denoising model for purification processing to obtain the second purified feature includes: The second high-dimensional feature of the input is compressed across channels by convolution operation to obtain the second low-dimensional feature map; The features are recombined by calculating the autocorrelation coefficient matrix between pixels in the second low-dimensional feature map to obtain the second feature noise prediction component. The second channel descriptor of the second high-dimensional feature is extracted by global average pooling; The second channel descriptor is input into the two-layer fully connected layer to obtain the second channel weight vector; The second high-dimensional feature is subtracted from the second feature noise prediction component to remove the noise component, resulting in the second cleaned feature map. Then, the second cleaned feature map is multiplied by the second channel weight vector using a broadcast multiplication operation to obtain the second cleaned feature. The formula is as follows: ； in, This represents the second high-dimensional feature. This represents the second characteristic noise prediction component. This represents the weight vector of the second channel. This indicates the second purification characteristic.

5. The method as described in claim 1, characterized in that, The disturbance-resistant residual network model is trained in the following manner: Obtain normal samples; Based on the normal samples, adversarial samples are generated using the PGD attack generator; Normal samples and adversarial samples are input into the robust residual network model, and the model is iteratively trained using a hybrid loss function until the hybrid loss function meets the iteration stopping condition, at which point the iterative training stops; the expression for the hybrid loss function is: ； in, Represents the mixed loss function. This indicates a normal sample. Indicates adversarial examples, The cross-entropy classification loss represents the normal sample. The cross-entropy classification loss represents the adversarial examples. Indicates feature distance loss, This represents the deep features extracted by the perturbation-resistant residual network model from normal samples. This indicates the deep features extracted from adversarial examples by the aforementioned perturbation-resistant residual network model. , This represents the loss weighting coefficient.

6. The method as described in claim 5, characterized in that, The step of generating adversarial samples using a PGD attack generator based on the normal samples includes: Initialize the perturbation step size of the PGD attack generator and generate initial adversarial samples based on the normal samples; During the training iteration of the disturbance-resistant residual network model, the fluctuation ratio of the mixed loss function in the current iteration to that in the previous iteration is monitored in real time. If the fluctuation ratio is greater than a preset threshold, the perturbation step size is reduced by a first preset ratio; if the fluctuation ratio is less than a preset threshold, the perturbation step size is increased by a second preset ratio to obtain a new perturbation step size. Based on the normal samples and the new perturbation step size, generate adversarial samples for the next iteration.

7. The method as described in claim 5, characterized in that, During the iterative training of the perturbation-resistant residual network model using a hybrid loss function, the parameters of the perturbation-resistant residual network model are updated using a stochastic gradient descent optimizer.

8. The method as described in claim 2, characterized in that, The residual network model is built based on the ResNet-50 network, wherein: The initial layer includes a convolutional layer and a max pooling layer, used for preliminary feature extraction and downsampling of the input standardized image data; the first residual stage includes 3 bottleneck blocks; the second residual stage includes 4 bottleneck blocks; the third residual stage includes 6 bottleneck blocks; the fourth residual stage includes 3 bottleneck blocks; the classification head includes a global average pooling layer and a fully connected layer, used for classifying the features output from the fourth residual stage and outputting the classification result of the image to be processed.

9. An image classification device based on endogenous feature denoising, characterized in that, include: The standardization module is used to acquire the image to be processed and perform standardization and numerical normalization operations on the image to be processed through a preset image transformation process to obtain standardized image data. The classification and recognition module is used to input the standardized image data into a pre-trained anti-perturbation residual network model and output the classification result of the image to be processed; wherein, the anti-perturbation residual network model is constructed based on the residual network model, and an adaptive feature denoising model is embedded in the feature transmission path of the residual network model; the adaptive feature denoising model is used to purify the high-dimensional features output by the residual network.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the image classification method based on endogenous feature denoising as described in any one of claims 1 to 8.

Images