Gradient sensitivity-based adversarial attack defense method, system, device and medium

Abstract

The present application relates to the technical field of computer vision, and provides an adversarial attack defense method, system, device and medium based on gradient sensitivity, comprising: obtaining an image to be analyzed, and preprocessing the image to be analyzed to obtain a target defense image; inputting the target defense image into a pre-constructed defense image recognition model for processing and analysis to obtain a defense classification result; the training and construction of the defense image recognition model comprises: according to a fixed mask probability matrix obtained by performing image classification gradient sensitivity analysis on a preset training sample set, generating a preset gradual stability training mechanism for each round of training sample set based on mask strength gradual enhancement processing of the preset training sample set according to the iterative training progress and the fixed mask probability matrix, and training a preset basic image classification recognition model. The present application can significantly improve the robustness and efficiency of adversarial attack defense while maintaining normal image recognition performance.

Description

Technical Field

[0001] This invention relates to the field of image recognition and computer vision technology, and in particular to a gradient-sensitive adversarial attack defense method, system, device, and medium. Background Technology

[0002] Smart grids, with their functions of security monitoring and fault diagnosis, have become an indispensable and important component of modern power systems, providing reliable guarantees for the safe and stable operation of power systems. Some functions of smart grids rely on reliable image data support from visual perception systems, such as images from drone inspections and camera monitoring. However, this image data is highly vulnerable to various malicious network attacks during communication transmission, posing significant risks to the operational safety of power systems. Therefore, how to efficiently and accurately identify image-based adversarial attacks has become a hot research topic in the field.

[0003] Current image adversarial attack defenses are primarily based on deep neural network models, and the adversarial defense capability is enhanced by introducing random masking techniques. However, while existing network model construction methods that incorporate random masking can disrupt the gradient direction of adversarial perturbations and improve adversarial defense capabilities to some extent, they neglect the differences in the contribution of different pixels to the model's decisions. Applying a uniform mask probability to all pixels in an image indiscriminately damages the semantic information of the image. This not only leads to a significant decrease in the recognition performance of the network model on normal images, but also, due to the lack of a reasonable design for the mask probability distribution, makes it difficult to establish an effective balance between protecting key features and disrupting adversarial perturbations during model training, thus failing to guarantee the effectiveness of adversarial attack defense in practical application scenarios. Summary of the Invention

[0004] The purpose of this invention is to provide a gradient-sensitive adversarial attack defense method. It constructs a defensive image recognition model by using a fixed mask probability matrix construction mechanism based on image classification gradient sensitivity analysis and a progressive stability training mechanism that progressively enhances the mask strength of a preset training sample set based on iterative training progress. This significantly improves the robustness and efficiency of adversarial attack defense while maintaining normal image recognition performance.

[0005] To achieve the above objectives, it is necessary to provide a gradient-sensitive adversarial attack defense method, system, device, and medium.

[0006] In a first aspect, embodiments of the present invention provide a gradient-sensitive adversarial attack defense method, the method comprising: Each image to be analyzed is acquired, and each image to be analyzed is preprocessed to obtain the corresponding target defense image; Each of the target defense images is input into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification result. The construction steps of the defense image recognition model include: performing image classification gradient sensitivity analysis on a pre-defined training sample set to obtain a fixed mask probability matrix; training a pre-defined basic image classification and recognition model based on the fixed mask probability matrix and a pre-defined progressive stability training mechanism; the pre-defined progressive stability training mechanism includes progressively enhancing the mask strength of the pre-defined training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round.

[0007] Furthermore, the step of performing image classification gradient sensitivity analysis on a preset training sample set to obtain a fixed mask probability matrix includes: Based on the preset basic image classification and recognition model, classify and predict each image sample in the preset training sample set to obtain the corresponding model classification loss; Based on the model classification loss, pixel gradient magnitude is calculated for each image sample to obtain the image gradient magnitude matrix corresponding to each image sample. Gradient aggregation is performed on all the image gradient magnitude matrices to obtain a gradient sensitivity map; The gradient sensitivity map is subjected to nonlinear mapping to obtain the fixed mask probability matrix.

[0008] Further, the step of performing gradient aggregation on all the image gradient magnitude matrices to obtain a gradient sensitivity map includes: The gradient magnitudes at the same pixel position in all the image gradient magnitude matrices are averaged to obtain the corresponding image gradient magnitude mean matrix. The gradient magnitude mean matrix of the image is normalized to obtain the gradient sensitivity map.

[0009] Further, the step of performing nonlinear mapping processing on the gradient sensitivity map to obtain the fixed mask probability matrix includes: Based on the gradient sensitivity of each pixel position in the gradient sensitivity map, the corresponding sensitivity level is obtained; Based on the sensitivity level corresponding to each pixel position in the gradient sensitivity map, a corresponding preset nonlinear mapping relationship is obtained, and the gradient sensitivity is subjected to probability transformation processing according to the preset nonlinear mapping relationship to obtain an initial mask probability matrix; the preset nonlinear mapping relationship is constructed based on the principle of differentiating masks for different sensitive regions and balancing feature protection and information preservation. The initial mask probability matrix is ​​optimized to obtain the fixed mask probability matrix.

[0010] Further, the step of optimizing the initial mask probability matrix to obtain the fixed mask probability matrix includes: The initial mask probability matrix is ​​smoothed by Gaussian filtering to obtain the corresponding first mask probability matrix; The first mask probability matrix is ​​subjected to probability clipping to obtain the second mask probability matrix; The second mask probability matrix is ​​iteratively calibrated based on a preset target mask rate to obtain the fixed mask probability matrix.

[0011] Furthermore, the iterative training step in training the preset basic image classification and recognition model based on the fixed mask probability matrix and a preset progressive stability training mechanism includes: Based on the current training round number, the corresponding training mask intensity factor for the current round is obtained based on the preset mask intensity linear enhancement model; the preset mask intensity linear enhancement model is constructed with the preset initial mask intensity and the preset target mask intensity as the starting point and ending point of the mask intensity change, respectively, and with the iterative training progress as the intensity growth factor. Based on the current round training mask strength factor and the fixed mask probability matrix, the corresponding current round mask probability map is obtained; The preset training sample set is enhanced according to the current round mask probability map to obtain the corresponding current round enhanced preset training sample set; Based on the current round of enhanced preset training sample set and the preset training sample set, the parameters of the preset basic image classification and recognition model obtained in the previous round of training are updated and optimized based on the preset defensive image recognition loss function. In response to the completion of parameter updates in the current iteration, it is determined whether the preset iteration termination condition has been met. If not, the next iteration continues; otherwise, the preset basic image classification and recognition model with updated parameters is used as the defensive image recognition model.

[0012] Furthermore, the preset defensive image recognition loss function is constructed by introducing a prediction consistency loss constraint on the basis of cross-entropy classification loss; the balancing hyperparameter of the prediction consistency loss constraint increases linearly with the progress of iterative training.

[0013] Secondly, embodiments of the present invention provide a gradient-sensitive adversarial attack defense system, the system comprising: The image acquisition module is used to acquire each image to be analyzed and to preprocess each image to obtain the corresponding target defense image; The defense classification module is used to input each of the target defense images into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification results. The training and construction of the defense image recognition model includes: performing image classification gradient sensitivity analysis on a pre-defined training sample set to obtain a fixed mask probability matrix; training a pre-defined basic image classification and recognition model based on the fixed mask probability matrix and a pre-defined progressive stability training mechanism; the pre-defined progressive stability training mechanism includes progressively enhancing the mask strength of the pre-defined training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round.

[0014] Thirdly, embodiments of the present invention also provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method.

[0015] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the above-described method.

[0016] This invention provides a gradient-sensitivity-based adversarial attack defense method, system, computer device, and storage medium. The method acquires an image to be analyzed, preprocesses it to obtain a target defense image, and then inputs the target defense image into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification result. The training and construction of the defense image recognition model includes: performing image classification gradient sensitivity analysis on a preset training sample set to obtain a fixed mask probability matrix; training a preset basic image classification and recognition model based on the fixed mask probability matrix and a preset progressive stability training mechanism; the preset progressive stability training mechanism includes progressively enhancing the mask strength of the preset training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round. Compared with existing technologies, this gradient-sensitivity-based adversarial attack defense method, through the synergistic effect of a gradient-sensitivity-driven fixed mask probability matrix and a progressive stability training mechanism, can not only effectively protect key discriminative features and maintain the recognition performance of normal images through gradient-sensitivity-guided differential masks, but also effectively disrupt the gradient structure of adversarial perturbations, significantly improving the robustness of adversarial attack defense. Furthermore, it can improve the training efficiency of the defensive image recognition model through the pre-computation of the fixed mask probability matrix, achieving a good balance between defense effectiveness and computational cost. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the gradient-sensitive adversarial attack defense method in an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of the gradient-sensitive adversarial attack defense system in an embodiment of the present invention; Figure 3 This is an internal structural diagram of the computer device in an embodiment of the present invention; The attached figures are labeled as follows: 1. Image acquisition module; 2. Defense classification module. Detailed Implementation

[0018] To make the objectives, technical solutions, and beneficial effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the embodiments described below are only part of the embodiments of this invention and are used to illustrate the invention, but are not intended to limit the scope of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0019] The gradient-sensitivity-based adversarial attack defense method provided by this invention can be understood as addressing the current application situation where existing adversarial defenses use randomly designed mask probability distributions that are unreasonable and ignore the differences in the contribution of different pixels to model decisions. This leads to a decline in normal image recognition performance and insufficient robustness in adversarial attack defense due to the inability to balance the protection of key features and the disruption of adversarial perturbations. Therefore, this invention proposes a method for training and constructing a model based on gradient-sensitivity-guided differentiated masks combined with a progressive stability training mechanism to improve the ability to defend against image recognition attacks. The following embodiments will provide a detailed description of the gradient-sensitivity-based adversarial attack defense method of this invention.

[0020] In one embodiment, such as Figure 1 As shown, a gradient-sensitive adversarial attack defense method is provided, including: S11. Acquire each image to be analyzed and preprocess each image to obtain the corresponding target defense image. The image to be analyzed can be understood as an image requiring adversarial attack defense identification in a real-world application scenario. To ensure the efficiency and reliability of subsequent model analysis and processing, preprocessing such as image format conversion, size adjustment, and pixel value normalization is required before classifying and identifying the image to be analyzed, in order to obtain a target defense image suitable for direct analysis and processing by the subsequent model. It should be noted that the actual preprocessing process for the image to be analyzed can be determined based on the processing requirements of the actual application scenario, and is not specifically limited here.

[0021] S12. Input each of the target defense images into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification results; wherein, the training and construction of the defense image recognition model includes: A fixed mask probability matrix is ​​obtained by performing image classification gradient sensitivity analysis on a preset training sample set. The preset training sample set can be understood as including normal image samples and adversarial attack image samples with various category annotation results in the application scenario. The normal image samples can be directly derived from images collected in real application scenarios, and the adversarial attack image samples can be derived from adversarial attack images collected in real application scenarios, or they can be adversarial attack images simulated based on existing mainstream attack methods such as FGSM (Fast GradientSign Method), PGD (Projected Gradient Descent), and C&W (Carlini and Wagner Attacks). No specific limitation is made here.

[0022] The image classification gradient sensitivity analysis in this embodiment can be understood as a systematic analysis of the gradient response pattern of the image recognition model on the image, in order to identify the differences in the impact of small changes in different pixel positions on the model's classification decision. The corresponding fixed mask probability matrix can be understood as a pixel mask matrix designed based on the gradient sensitivity analysis results and suitable for the image recognition model; specifically, the step of performing image classification gradient sensitivity analysis on a preset training sample set to obtain the fixed mask probability matrix includes: The preset basic image classification and recognition model is used to classify and predict the classification of each image sample in the preset training sample set, thereby obtaining the corresponding model classification loss. The preset basic image classification and recognition model can be understood as a network model capable of classifying and recognizing images, and can be selected from any existing deep neural network model capable of this function; no specific limitation is made here. In practical applications, each image sample in the preset training sample set is input into the preset basic image classification and recognition model for classification prediction. After obtaining the classification prediction results for each image sample, the model classification loss is calculated based on the cross-entropy loss function, according to the classification prediction results of each image sample and the corresponding ground truth labeled sample classification results. This yields the classification decision loss of the preset basic image classification and recognition model on the preset training sample set.

[0023] Based on the model classification loss, pixel gradient magnitudes are calculated for each image sample to obtain an image gradient magnitude matrix for each image sample. This image gradient magnitude matrix can be understood as a matrix obtained by calculating the gradient magnitude at each pixel position in the image sample based on the model classification loss, directly reflecting the influence of small changes at each pixel position on the model's classification decision output. It should be noted that the gradient magnitude at each pixel position in the image sample can be calculated using the existing standard backpropagation algorithm. The calculation primarily focuses on the magnitude of the gradient magnitude at each pixel position, which reflects the difference in the impact of changes in the input image on the model output.

[0024] Gradient aggregation is performed on all the image gradient magnitude matrices to obtain a gradient sensitivity map. Gradient aggregation can be understood as considering that the image gradient magnitude matrix of each image sample only represents the influence of the rate of change of different pixel positions on the model's classification decision. To minimize the random influence of a single sample, this embodiment preferably performs a statistical average of the image gradient magnitude matrices of all image samples in a preset training sample set to obtain stable image gradient sensitivity analysis results. Specifically, the step of performing gradient aggregation on all the image gradient magnitude matrices to obtain the gradient sensitivity map includes: The gradient magnitudes at the same pixel position in all the image gradient magnitude matrices are averaged to obtain the corresponding image gradient magnitude mean matrix; that is, the gradient magnitude corresponding to each pixel position in the image gradient magnitude mean matrix is ​​the average of the gradient magnitudes at the same pixel position in all image samples in the preset training sample set. The specific calculation process will not be detailed here.

[0025] The gradient magnitude mean matrix of the image is normalized to obtain the gradient sensitivity map. The normalization process can be understood as mapping the matrix elements in the gradient magnitude mean matrix of the image to the interval [0,1], which can be achieved using existing normalization methods. Each matrix element (gradient sensitivity of each pixel position) in the obtained gradient sensitivity map can be understood as the importance of the corresponding pixel change in the image sample to the model's final classification decision.

[0026] The gradient sensitivity map is subjected to nonlinear mapping to obtain the fixed mask probability matrix. This nonlinear mapping can be understood as converting the importance of pixel changes in the gradient sensitivity map to the model's final classification decision into the corresponding mask probability for each pixel position. To establish an effective balance between protecting key features and disrupting adversarial perturbations, and to achieve a processing effect where key features are not easily masked while non-key features are easily masked, this embodiment preferably employs differentiated masking processing for pixel positions of different importance, ensuring that high-importance pixel positions correspond to low mask probabilities and low-importance pixel positions correspond to high mask probabilities. Specifically, the step of performing nonlinear mapping on the gradient sensitivity map to obtain the fixed mask probability matrix includes: Based on the gradient sensitivity of each pixel position in the gradient sensitivity map, the corresponding sensitivity level is obtained; wherein, the sensitivity level corresponding to the gradient sensitivity of each pixel position depends on the gradient sensitivity range corresponding to different preset sensitivity levels, that is, the sensitivity level of the corresponding pixel position is determined according to the actual gradient sensitivity range to which the gradient sensitivity belongs; in this embodiment, a high sensitivity level, a medium sensitivity level and a low sensitivity level are preferably set, and the gradient sensitivity range corresponding to the high sensitivity level is (0.7,1], the gradient sensitivity range corresponding to the medium sensitivity level is (0.3,0.7], and the gradient sensitivity range corresponding to the low sensitivity level is [0,0.3].

[0027] Based on the sensitivity level corresponding to each pixel position in the gradient sensitivity map, a corresponding preset nonlinear mapping relationship is obtained. Then, a probability transformation is performed on the corresponding gradient sensitivity based on the preset nonlinear mapping relationship to obtain an initial mask probability matrix. The preset nonlinear mapping relationship is constructed based on the principle of differentiated masks for different sensitive regions, balancing feature protection and information preservation. In practical applications, to ensure the rationality of the mask probability settings for pixel positions corresponding to different sensitivity levels, this embodiment preferably sets different nonlinear mapping relationships for different sensitivity levels: high sensitivity levels use a square root function for compression to ensure sufficient protection of key features; medium sensitivity levels use a linear mapping; and low sensitivity levels use a square function for expansion to increase the discriminative power of the mask probability. Specifically, the preset nonlinear mapping relationship can be expressed as: in, The first in the gradient sensitivity map Gradient sensitivity at each pixel location; The first element in the initial mask probability matrix Initial mask probability at each pixel position; , and These represent the minimum mask probability, the basic mask probability, and the maximum mask probability, respectively. They can be set based on empirical values ​​according to actual application needs. In this embodiment, the preferred values ​​are 0.1, 0.4, and 0.8, respectively.

[0028] Based on the above-mentioned pre-defined nonlinear mapping relationship, we can see that: 1) Considering that pixels with high gradient sensitivity are usually discriminative features in the image, such as object edges and texture details, which are regions that play a crucial role in model decision-making, in order to protect these region features as much as possible, the masking probability of pixels with high sensitivity is mapped through the square root. The square root function grows slowly when the gradient sensitivity is close to 1, making the masking probability difference between pixels with subtle differences in gradient magnitude very small. This means that all key features can receive almost equal and strong protection, ensuring that the key feature information that needs to be protected is not destroyed; 2) The masking probability of pixels with medium sensitivity is mapped linearly, ensuring that the gradient sensitivity of a pixel remains proportional to its masking probability within this interval, achieving... A smooth transition is achieved by moderately masking non-core discriminative features of a certain importance to enhance model robustness without excessively damaging useful information: 3) Considering that low-sensitivity pixels belong to regions with inconspicuous features in the image and are areas with dispersed perturbations in actual adversarial attack images, these regions have low information value for model feature learning. The masking probability of low-sensitivity pixels is mapped through a square function. The square function decays very rapidly when the gradient sensitivity is close to 0, making the already low sensitivity value even smaller after squaring. This ensures that the probability of being masked is much higher than other regions. That is, by performing high-frequency masking on these regions, the structure of adversarial perturbations can be effectively absorbed and destroyed with minimal semantic loss of masking, without affecting the model's feature learning. It can be seen that the masking probability design mechanism of differentiated masking protection for pixels of different importance provided in this embodiment can achieve a fine balance between key features being less likely to be masked and non-key features being easily masked.

[0029] The initial mask probability matrix is ​​optimized to obtain the fixed mask probability matrix. The optimization process can be understood as a procedure to eliminate noise and ensure numerical stability, thereby obtaining a robust and practical mask probability matrix with global controllability. Specifically, the step of optimizing the initial mask probability matrix to obtain the fixed mask probability matrix includes: The initial mask probability matrix is ​​smoothed using Gaussian filtering to obtain the corresponding first mask probability matrix. Gaussian filtering removes noise from the initial mask probability matrix, making probability changes in the matrix smoother, eliminating isolated outliers, and preventing drastic changes in probabilities between adjacent positions. This ensures the local spatial continuity of the probability distribution and provides a reliable basis for subsequent masking processes. It should be noted that the specific Gaussian filtering process can refer to existing Gaussian filtering techniques and will not be detailed here.

[0030] The first mask probability matrix is ​​subjected to probability pruning to obtain the second mask probability matrix; wherein, probability pruning can be understood as restricting all mask probabilities in the first mask probability matrix to a certain value. Within a certain range, to prevent situations where certain positions are almost always masked or almost never masked due to excessively low or high mask probabilities, this ensures a more uniform mask and avoids extreme cases. It should be noted that actual probability clipping may alter the probability distribution, especially if many values ​​in the original probability distribution are outside the clipping range. In such cases, clipping may cause the probability distribution to cluster towards the clipping boundary. Therefore, it is necessary to set the range appropriately based on the actual application scenario. and .

[0031] The second mask probability matrix is ​​iteratively calibrated based on a preset target mask rate to obtain the fixed mask probability matrix. The preset target mask rate can be understood as the actual desired mask ratio, which can be set based on actual application requirements. The corresponding iterative calibration can be understood as scaling the second mask probability matrix by multiplying it with a global scaling factor constructed based on the ratio of the preset target mask rate to the current average mask rate corresponding to the second mask probability matrix. After scaling, the matrix is ​​then truncated. If the current average mask rate of the calibrated and truncated second mask probability matrix still does not meet the preset target mask rate, another round of scaling and truncating operations is performed until the mask probability matrix with the overall mask rate closest to the preset target mask rate is obtained as the required fixed mask probability matrix.

[0032] Based on the fixed mask probability matrix, a preset basic image classification and recognition model is trained using a preset progressive stability training mechanism. This preset progressive stability training mechanism includes progressively enhancing the mask strength of the preset training sample set based on the iterative training progress and the fixed mask probability matrix, generating a training sample set for each round. Each round of training sample set can be understood as a combination of the enhanced sample set and the original preset training sample set, obtained by enhancing the mask strength of the preset training sample set based on the iterative training progress and the fixed mask probability matrix.

[0033] The preset progressive stability training mechanism in this embodiment does not simply apply the fixed mask probability matrix obtained by the aforementioned method directly to the training sample set enhancement processing in model training. Instead, it introduces a controllable progressive mask strength enhancement mechanism on the preset basic image classification and recognition model, enabling the model to gradually increase the mask strength with each training round, smoothly adapting to the phased, progressive enhancement processing training optimization strategy with varying degrees of information loss. Specifically, the step of each iteration training step in the preset basic image classification and recognition model training based on the fixed mask probability matrix and the preset progressive stability training mechanism includes: Based on the current training round number, the corresponding training mask intensity factor for the current round is obtained using a preset mask intensity linear enhancement model. This preset mask intensity linear enhancement model is constructed using a preset initial mask intensity and a preset target mask intensity as the starting and ending points of the mask intensity change, respectively, and with the iterative training progress as the intensity growth factor. It can be expressed as: In the formula, and These are the preset initial mask strength and the preset target mask strength, respectively. The specific values ​​can be set based on actual application requirements. The total number of training rounds is preset and set based on actual application needs; The current training round number The corresponding mask strength factor for the current training round increases linearly from the preset initial mask strength to the preset target mask strength as the training rounds increase.

[0034] Based on the current round training mask strength factor and the fixed mask probability matrix, the corresponding current round mask probability map is obtained; wherein, the current round mask probability map can be represented as: in, This is element-wise multiplication; The mask probability matrix is ​​fixed. The current training round number The mask probability matrix used for data augmentation.

[0035] This embodiment uses a fixed mask probability matrix constructed based on gradient sensitivity analysis as a foundation. It introduces a mask strength factor that increases linearly with the progress of iterative training to progressively adjust the mask probability matrix used for data augmentation. This can effectively avoid the impact of sudden large-scale masking on model training by compressing the mask matrix to a low probability level in the early stage of training and then progressively increasing and adjusting it with the number of training iterations, which is beneficial to the stability of the training process.

[0036] The preset training sample set is enhanced according to the current round mask probability map to obtain the corresponding current round enhanced preset training sample set; wherein, the current round enhanced preset training sample set can be understood as a sample set composed of enhanced image samples obtained by enhancing each image sample in the preset training sample set using the current round mask probability map respectively; the specific process of enhancing image samples using the current round mask probability map can be referred to relevant existing technologies, and will not be described in detail here.

[0037] Based on the current round of enhanced preset training sample set and the preset training sample set, the parameters of the preset basic image classification and recognition model obtained from the previous round of training are updated and optimized based on the preset defensive image recognition loss function. In practical applications, after obtaining the current round of enhanced preset training sample set corresponding to the current training round number through the above method steps, the current round of enhanced preset training sample set and the preset training sample set are combined to generate an image sample set used for the current model training. Then, the image sample set corresponding to the current round is input into the preset basic image classification and recognition model obtained from the previous round of iterative training for classification prediction to obtain the corresponding classification prediction result. The classification prediction result is analyzed based on the preset defensive image recognition loss function to obtain the classification loss of the current round of training. Based on the classification loss of the current round, the parameters of the preset basic image classification and recognition model are updated. It should be noted that if the current training round number is the first round, the parameters of the original preset basic image classification and recognition model are updated and optimized; otherwise, the parameters of the preset basic image classification and recognition model after updating the model parameters in the previous round of iteration are updated and optimized again. The specific parameter update mechanism can still be implemented using relevant existing technologies, which will not be detailed here.

[0038] In this embodiment, by introducing only weak perturbations in the early stage of training to enable the model to establish preliminary feature representations, and gradually increasing the mask probability as the number of training rounds increases, the model is forced to gradually build up its learning ability under the condition of missing local features. This can effectively improve the robustness of the model to adversarial perturbation defense while ensuring training stability.

[0039] In principle, the preset defensive image recognition loss function in this embodiment can also adopt the existing cross-entropy loss function. However, in order to ensure that the model can produce stable classification prediction results for different mask versions of the same image (maintaining a similar prediction distribution in the model output space), this embodiment preferably incorporates a prediction consistency constraint in addition to considering the standard cross-entropy classification loss. That is, the preset defensive image recognition loss function is constructed by introducing a prediction consistency loss constraint on the basis of the cross-entropy classification loss. At the same time, in order to effectively avoid the gradient conflict problem caused by the instability of feature representation in the early stage of training, this embodiment also preferably introduces an asymptotic signal to make the balancing hyperparameter of the consistency constraint grow linearly during training, so as to precisely control the adjustment strength of the consistency constraint. That is, the balancing hyperparameter of the prediction consistency loss constraint grows linearly with the progress of iterative training. Specifically, the preset defensive image recognition loss function is expressed as follows: In the formula, in, To prevent total loss in image recognition; and These are cross-entropy classification loss and consistency loss, respectively; To balance the upper limit of hyperparameters; To balance the hyperparameters, they are linearly increased to a preset upper limit as the training process progresses, so that the model pays more attention to prediction stability in the later stages of training; This is the current training round number; T The preset total number of training rounds; This indicates the number of samples in each training batch; This indicates the number of augmented samples corresponding to each sample; Indicates the j-th batch. One image sample; For the first Image samples The An enhanced version; Represents the original image sample With enhanced samples The KL divergence is used to quantify the difference between the predicted probability distributions of the original image samples and the enhanced image samples. For specific calculations, please refer to relevant existing technologies.

[0040] The preset defensive image recognition loss function design provided in this embodiment ensures that the model prioritizes optimizing the cross-entropy classification loss during the initial training phase. Focusing on learning basic discrimination abilities, while consistency constraints... In the early stages, the weights are close to zero to avoid optimization conflicts caused by consistency loss due to the model not yet establishing stable feature representations; as training progresses, As the weight of the consistency loss increases, it forces the model, already possessing a certain classification ability, to generate a stable and consistent prediction distribution for both the original image samples and the masked image samples. This explicitly encourages the model to learn global semantic representations independent of local occlusion. It's important to note that this loss function design is not a simple weighted sum of existing cross-entropy and consistency loss. It abandons the random augmentation blindness of traditional contrastive learning, employing structured occlusion based on the mask probability matrix to ensure the semantic rationality of the augmentation. Simultaneously, it precisely controls the consistency constraint strength by introducing a progressive signal. This effectively avoids gradient conflicts caused by unstable feature representations in the early stages of training, enabling the model to develop robustness to missing local information when learning classification features. Thus, it significantly improves adversarial robustness while maintaining normal recognition accuracy.

[0041] In response to the completion of parameter updates in the current iteration, it is determined whether the preset iteration termination condition has been met. If not, the next iteration continues; otherwise, the preset basic image classification and recognition model with updated parameters is used as the defensive image recognition model. The preset iteration termination condition can be set according to actual application needs, such as the number of iterations reaching a preset total number of training rounds, etc., which is not specifically limited here.

[0042] Furthermore, to maximize the robustness of the image recognition model against external threats, adaptive masks can be introduced for fine-tuning during the training process. In the fine-tuning phase, the learning rate is scheduled using a cosine annealing strategy, gradually decreasing as training progresses. Before inputting batch data into the model, random masking is performed based on a pre-computed fixed mask probability matrix. The masking operation employs a zeroing strategy, setting the selected pixel positions to zero. Throughout the training process, the model parameters are optimized using backpropagation and gradient descent algorithms, ultimately resulting in an image recognition model that combines high accuracy and high robustness. It should be noted that the pre-computed design using a fixed mask matrix effectively avoids redundant computations during training and achieves a good balance between defensive effectiveness and computational cost.

[0043] This invention provides a technical solution that involves acquiring an image to be analyzed, preprocessing it to obtain a target defense image, inputting the target defense image into a fixed mask probability matrix obtained based on image classification gradient sensitivity analysis of a preset training sample set, and employing a preset progressive stability training mechanism that progressively enhances the mask strength of the preset training sample set according to the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round. This mechanism processes and analyzes the defense image recognition model trained by a preset basic image classification and recognition model to obtain the corresponding defense classification result. Through the synergistic effect of the gradient sensitivity-driven fixed mask probability matrix and the progressive stability training mechanism, it can not only effectively protect key discriminative features and maintain the recognition performance of normal images through gradient sensitivity-guided differentiated masks, but also effectively destroy the gradient structure of adversarial perturbations, significantly improving the robustness of adversarial attack defense. Furthermore, the pre-computation of the fixed mask probability matrix can improve the training and construction efficiency of the defense image recognition model, achieving a good balance between defense effectiveness and computational cost.

[0044] It should be noted that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise explicitly stated in this document, there is no strict order requirement for the execution of these steps, and they can be executed in other orders.

[0045] In one embodiment, such as Figure 2 As shown, a gradient-sensitive adversarial attack defense system is provided, the system comprising: Image acquisition module 1 is used to acquire each image to be analyzed and to preprocess each image to be analyzed to obtain the corresponding target defense image; Defense classification module 2 is used to input each of the target defense images into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification results. The training and construction of the defense image recognition model includes: performing image classification gradient sensitivity analysis on a pre-defined training sample set to obtain a fixed mask probability matrix; training a pre-defined basic image classification and recognition model based on the fixed mask probability matrix and a pre-defined progressive stability training mechanism; the pre-defined progressive stability training mechanism includes progressively enhancing the mask strength of the pre-defined training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round.

[0046] Specific limitations regarding gradient-sensitive adversarial attack defense systems can be found in the limitations described above for gradient-sensitive adversarial attack defense methods; the corresponding technical effects are equivalent and will not be repeated here. Each module in the aforementioned gradient-sensitive adversarial attack defense system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, allowing the processor to call and execute the corresponding operations of each module.

[0047] Figure 3 An internal structural diagram of a computer device is shown in one embodiment. This computer device may specifically be a terminal or a server. Figure 3 As shown, the computer device includes a processor, memory, network interface, display, camera, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it can implement a gradient-sensitive adversarial attack defense method. The display screen can be an LCD screen or an e-ink display screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0048] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. Specific computing devices may include more or fewer components than those shown in the figure, or combine certain components, or have the same component arrangement.

[0049] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0050] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0051] In summary, the gradient-sensitivity-based adversarial attack defense method, system, computer device, and storage medium provided by this invention, through the synergistic effect of a gradient-sensitivity-driven fixed mask probability matrix and a progressive stability training mechanism, can not only effectively protect key discriminative features and maintain the recognition performance of normal images through gradient-sensitivity-guided differential masks, but also effectively disrupt the gradient structure of adversarial perturbations, significantly improving the robustness of adversarial attack defense. Furthermore, the pre-computation of the fixed mask probability matrix can improve the training efficiency of the defensive image recognition model, achieving a good balance between defense effectiveness and computational cost.

[0052] The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts of the embodiments, refer to each other. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0053] The above-described embodiments are merely preferred embodiments of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the principles of the present invention, and these improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A gradient-sensitive adversarial attack defense method, characterized in that, The method includes: Each image to be analyzed is acquired, and each image to be analyzed is preprocessed to obtain the corresponding target defense image; Each of the target defense images is input into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification result. The training and construction of the defense image recognition model includes: performing image classification gradient sensitivity analysis on a pre-defined training sample set to obtain a fixed mask probability matrix; training a pre-defined basic image classification and recognition model based on the fixed mask probability matrix and a pre-defined progressive stability training mechanism; the pre-defined progressive stability training mechanism includes progressively enhancing the mask strength of the pre-defined training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round.

2. The gradient-sensitive adversarial attack defense method as described in claim 1, characterized in that, The step of performing image classification gradient sensitivity analysis on a preset training sample set to obtain a fixed mask probability matrix includes: Based on the preset basic image classification and recognition model, classify and predict each image sample in the preset training sample set to obtain the corresponding model classification loss; Based on the model classification loss, pixel gradient magnitude is calculated for each image sample to obtain the image gradient magnitude matrix corresponding to each image sample. Gradient aggregation is performed on all the image gradient magnitude matrices to obtain a gradient sensitivity map; The gradient sensitivity map is subjected to nonlinear mapping to obtain the fixed mask probability matrix.

3. The gradient-sensitive adversarial attack defense method as described in claim 2, characterized in that, The step of performing gradient aggregation on all the image gradient magnitude matrices to obtain a gradient sensitivity map includes: The gradient magnitudes at the same pixel position in all the image gradient magnitude matrices are averaged to obtain the corresponding image gradient magnitude mean matrix. The gradient magnitude mean matrix of the image is normalized to obtain the gradient sensitivity map.

4. The gradient-sensitive adversarial attack defense method as described in claim 2, characterized in that, The step of performing nonlinear mapping on the gradient sensitivity map to obtain the fixed mask probability matrix includes: Based on the gradient sensitivity of each pixel position in the gradient sensitivity map, the corresponding sensitivity level is obtained; Based on the sensitivity level corresponding to each pixel position in the gradient sensitivity map, a corresponding preset nonlinear mapping relationship is obtained, and the gradient sensitivity is subjected to probability transformation processing according to the preset nonlinear mapping relationship to obtain an initial mask probability matrix; the preset nonlinear mapping relationship is constructed based on the principle of differentiating masks for different sensitive regions and balancing feature protection and information preservation. The initial mask probability matrix is ​​optimized to obtain the fixed mask probability matrix.

5. The gradient-sensitive adversarial attack defense method as described in claim 4, characterized in that, The step of optimizing the initial mask probability matrix to obtain the fixed mask probability matrix includes: The initial mask probability matrix is ​​smoothed by Gaussian filtering to obtain the corresponding first mask probability matrix; The first mask probability matrix is ​​subjected to probability clipping to obtain the second mask probability matrix; The second mask probability matrix is ​​iteratively calibrated based on a preset target mask rate to obtain the fixed mask probability matrix.

6. The gradient-sensitive adversarial attack defense method as described in claim 1, characterized in that, The step of each iteration of training the preset basic image classification and recognition model based on the fixed mask probability matrix and a preset progressive stability training mechanism includes: Based on the current training round number, the corresponding training mask intensity factor for the current round is obtained based on the preset mask intensity linear enhancement model; the preset mask intensity linear enhancement model is constructed with the preset initial mask intensity and the preset target mask intensity as the starting point and ending point of the mask intensity change, respectively, and with the iterative training progress as the intensity growth factor. Based on the current round training mask strength factor and the fixed mask probability matrix, the corresponding current round mask probability map is obtained; The preset training sample set is enhanced according to the current round mask probability map to obtain the corresponding current round enhanced preset training sample set; Based on the current round of enhanced preset training sample set and the preset training sample set, the parameters of the preset basic image classification and recognition model obtained in the previous round of training are updated and optimized based on the preset defensive image recognition loss function. In response to the completion of parameter updates in the current iteration, it is determined whether the preset iteration termination condition has been met. If not, the next iteration continues; otherwise, the preset basic image classification and recognition model with updated parameters is used as the defensive image recognition model.

7. The gradient-sensitive adversarial attack defense method as described in claim 1, characterized in that, The preset defensive image recognition loss function is constructed by introducing a prediction consistency loss constraint on the basis of cross-entropy classification loss; the balancing hyperparameter of the prediction consistency loss constraint increases linearly with the progress of iterative training.

8. A gradient-sensitive adversarial attack defense system, characterized in that, The system includes: The image acquisition module is used to acquire each image to be analyzed and to preprocess each image to obtain the corresponding target defense image; The defense classification module is used to input each of the target defense images into a pre-constructed defense image recognition model for processing and analysis to obtain the corresponding defense classification results. The training and construction of the defense image recognition model includes: performing image classification gradient sensitivity analysis on a pre-defined training sample set to obtain a fixed mask probability matrix; training a pre-defined basic image classification and recognition model based on the fixed mask probability matrix and a pre-defined progressive stability training mechanism; the pre-defined progressive stability training mechanism includes progressively enhancing the mask strength of the pre-defined training sample set based on the iterative training progress and the fixed mask probability matrix to generate a training sample set for each round.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images