A decision tree construction method and a defect detection method for defect classification

Abstract

The application discloses a decision tree construction method and a defect detection method for defect classification, and relates to the technical field of defect detection. The method comprises the following steps: taking each defect in a target image comprising at least one defect as a sample training set to construct a decision tree; starting from a root node, dividing the training set layer by layer from top to bottom until a preset ending condition is met to generate the decision tree; for the division of any current node, the following steps are included: determining a target feature according to evaluation indexes of each feature attribute in a sample set corresponding to the current node in the decision tree under an adversarial attack; determining a sample set corresponding to a left node and a sample set corresponding to a right node of the current node according to the target feature and a feature threshold value corresponding to the target feature; the sample set corresponding to the root node of the decision tree is the training set; the sample set corresponding to the left node or the right node is a subset of the training set; and the current node comprises any one of the root node, the left node and the right node.

Description

Technical Field

[0001] This invention relates to the field of defect detection technology, and in particular to a decision tree construction method and a defect detection method for defect classification. Background Technology

[0002] Semiconductor wafers are the foundation of integrated circuit manufacturing. Through hundreds of combinations and repetitions of key processes such as photolithography, etching, deposition, doping, and polishing, the nanostructure patterns required for integrated circuits are ultimately generated on a patternless wafer. During mass production, various process errors and environmental contamination inevitably lead to defects in the generated circuit patterns. These defects include surface defects such as nanoparticles, depressions, protrusions, scratches, broken lines, and bridging, as well as subsurface and internal defects such as voids and uneven material composition. Therefore, each process is usually followed by an inspection step to check for defects on the wafer surface.

[0003] In existing technologies, wafer images are typically acquired using optical or electron microscopy, and defects are detected on the wafer using image difference processing algorithms. Then, a classification model (such as a decision tree) is used to classify the detected defects.

[0004] However, existing technologies do not take into account the noise interference caused by errors in the detection algorithm, which leads to the model overfitting the training data and the model's classification accuracy being lower than expected in a production environment. Summary of the Invention

[0005] This invention provides a decision tree construction method and a defect detection method for defect classification, so as to realize the construction of a decision tree that can accurately classify defects and determine the defect category based on the decision tree.

[0006] In a first aspect, embodiments of the present invention provide a decision tree construction method for defect classification, comprising:

[0007] A target image containing at least one defect is obtained, and each defect in the target image is used as a sample training set to construct a decision tree. Each sample includes image feature information and category information of the corresponding defect. The image feature information includes multiple feature attributes, and the category information includes a first category and a second category.

[0008] An adversarial attack is applied to each feature attribute of each defect, and through a radius ε of l ∞ Norm constraints the range of perturbations used in adversarial attacks;

[0009] Starting from the root node, the training set is divided layer by layer from top to bottom until a preset termination condition is met to generate a decision tree. The division of any current node includes: determining the target feature based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attack; determining the sample set corresponding to the left node and the sample set corresponding to the right node of the current node based on the target feature and the feature threshold corresponding to the target feature. The sample set corresponding to the root node of the decision tree is the training set, and the sample sets corresponding to the left or right nodes are subsets of the training set. The current node includes any one of the root node, left node, and right node.

[0010] This invention provides a decision tree construction method for defect classification, which has the following advantages: During the decision tree construction process, adversarial attacks are applied to the samples to simulate noise. Then, based on the evaluation index of each feature attribute in the sample set corresponding to each node of the decision tree under the adversarial attack, the target features corresponding to each node that are less sensitive to noise are determined. Based on the target features corresponding to each node and the feature threshold of the target features, the classification strategy of each node is determined. The classification decisions of each node are configured in each node of the decision tree to obtain a decision tree for defect classification. Considering the influence of noise on feature attributes, a decision tree for defect classification is constructed, thereby improving the accuracy, reliability and robustness of the defect classification results.

[0011] Furthermore, the target features are determined based on the evaluation metrics of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attacks, including:

[0012] Determine the minimum information gain of each feature attribute under the adversarial attack, and use the minimum information gain of each feature attribute as the evaluation index of the corresponding feature attribute;

[0013] Based on the evaluation indicators of each feature attribute, the feature attribute corresponding to the largest evaluation indicator is determined as the target feature.

[0014] Furthermore, the minimum information gain of each feature attribute under adversarial attacks is determined, including:

[0015] For each feature attribute, the sample set corresponding to the current node is divided into the first subset I based on the corresponding feature threshold. L Second Subset I R ;

[0016] Within the perturbation range, obtain the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the perturbation amount of the adversarial attack;

[0017] Select the first subset I L Or the second child I RThe set is taken as the target subset I′. The intersection of the target subset I′ and the dynamic sample subset Δi is determined as the perturbation subset I′1 of the target subset I′. The samples in the target subset I′ that do not belong to the wave boundary subset Δi are determined as the stable subset I2′ of the target subset I′.

[0018] Establish the mapping relationship between the first category defect sample variable Δn0 and the second category defect sample variable Δn1 in the perturbation subset I′1;

[0019] Based on stable subsets and mapping relationships, the minimum information gain of the corresponding feature attributes is determined.

[0020] Further, within the range of the disturbance amount, the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack disturbance amount are obtained, including:

[0021] In the sample set corresponding to the current node, samples whose feature values ​​of the current feature attribute belong to the dynamic interval are constructed as dynamic sample subsets Δi, and samples whose feature values ​​of the current feature attribute belong to the perturbation boundary interval are constructed as fluctuation boundary subsets ΔI. The dynamic interval is determined based on the perturbation amount and the feature threshold of the current feature attribute, and the perturbation boundary interval is determined based on the radius ε and the feature threshold of the current feature attribute.

[0022] Furthermore, the mapping relationships include:

[0023]

[0024] Where N0 represents the number of samples with the first category of defects in the sample set corresponding to the current node, and N1 represents the number of samples with the second category of defects in the sample set corresponding to the current node. The number of samples with first-class defects in the stable subset I′2. I1 represents the number of samples of the second category of defects in the stable subset I′2, and I1 represents the set of samples of the second category of defects in the sample set corresponding to the current node.

[0025] Furthermore, based on stable subsets and mapping relationships, the minimum information gain of the corresponding feature attributes is determined, including:

[0026] For each feature attribute, a corresponding objective function is established, where the objective function is...

[0027] The value of the objective function under the corresponding condition is calculated by traversing the value range of the first category defect sample variable Δn0. The adversarial attack corresponding to the minimum objective function value is taken as the target adversarial attack as the corresponding feature attribute. The value range of the first category defect sample variable Δn0 is [0,|ΔI∩I0|].

[0028] By obtaining the information gain of the characteristic attributes under the condition of adversarial attack on the target, the minimum information gain of the corresponding characteristic attribute can be obtained.

[0029] Furthermore, the information gain S of the feature attributes under adversarial attack conditions is calculated using the following formula:

[0030]

[0031]

[0032] Where C1 and C2 are constants, Let Δn0 be the value of the first-class defect sample variable under the condition of adversarial attack. The value of the second category defect sample variable Δn1 under the condition of target adversarial attack.

[0033] Furthermore, the target features are determined based on the evaluation metrics of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attacks, including:

[0034] Based on the evaluation index of each feature attribute under adversarial attack, the maximum evaluation index value is selected as the target feature.

[0035] Furthermore, it also includes pruning the generated decision tree.

[0036] Secondly, embodiments of the present invention also provide a defect detection method, including:

[0037] Construct a defect classification decision tree using any of the methods described in the first aspect;

[0038] Acquire images of the defects to be classified in the sample and extract image feature information of the regions where each defect to be classified is located in the images;

[0039] The image feature information of the defects to be classified is input into the decision tree so that the decision tree can determine the defect category of each defect in the image to be classified.

[0040] The description of the second aspect in this application can be found in the detailed description of the first aspect, and will not be repeated here.

[0041] These or other aspects of this application will become more readily apparent in the following description. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart illustrating a decision tree construction method for defect classification provided in an embodiment of the present invention;

[0044] Figure 2a For images containing defects, Figure 2b To process through detection algorithms Figure 2a The obtained image of the predicted defect area;

[0045] Figure 3 A flowchart for obtaining the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attack is provided in an embodiment of the present invention;

[0046] Figure 4 This is a flowchart of a defect detection method provided in an embodiment of the present invention. Detailed Implementation

[0047] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0048] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0049] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0050] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0051] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of these operations can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations can be rearranged. The process can be terminated when its operation is completed, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc. Moreover, embodiments and features in the embodiments of the present invention can be combined with each other without conflict.

[0052] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0053] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0054] Figure 1 This is a flowchart illustrating a decision tree construction method for defect classification provided in an embodiment of the present invention. This embodiment is applicable to situations requiring accurate classification of wafer defects, such as... Figure 1 As shown, the specific steps include the following:

[0055] Step 110: Obtain a target image containing at least one defect, and use each defect in the target image as a sample training set to construct a decision tree.

[0056] Each sample includes image feature information and category information of the corresponding defect.

[0057] The target image can be a sample image containing at least one defect. The image feature information of the defect includes multiple feature attributes, such as geometric attributes such as width, height, area and eccentricity, as well as image attributes such as average gray value, gray level variation range and texture features.

[0058] For a sample, defect categories can include surface defects and internal defects. For a user, defects can typically be divided into defects that the user cares about and defects that the user doesn't care about. In this embodiment, a first category and a second category from the defect category information are used to represent defects that the user cares about and defects that the user doesn't care about. Specifically, the first category can be defects that the user cares about, and the second category can be defects that the user doesn't care about.

[0059] Specifically, firstly, images of samples can be acquired using defect detection equipment, such as optical or electro-optical inspection equipment, and images containing at least one defect can be used as target images to be classified. Secondly, the image feature information of each defect in the target image can be determined, including the width, height, area, eccentricity, average gray value, grayscale range, and texture features of each defect. The category information of each defect can also be determined, i.e., whether each defect is a surface defect or an internal defect. If the defect is determined to be a surface defect, the category information is determined to be the first category; if the defect is determined to be an internal defect, the category information is determined to be the second category. Then, the image feature information and category information of each defect in the target image can be used as samples to construct a training set.

[0060] In this embodiment of the invention, the training set is constructed by acquiring the image feature information and category information of each defect in the target image.

[0061] Step 120: Apply adversarial attacks to each feature attribute of each defect, and use a radius of ε to... ∞ Norm constraints limit the range of perturbations in adversarial attacks.

[0062] Machine learning-based classifiers can significantly improve classification accuracy, and decision trees are a widely used classification method in machine learning. A decision tree is a tree-like predictive model, including a root node, internal nodes, and leaf nodes. The root node is used for input data, internal nodes for feature splitting, and leaf nodes for determining the category or class distribution of the data. Decision trees are generally modeled using heuristic methods, such as ID3, C4.5, and CART algorithms. Starting from the root node, a certain feature is selected as the splitting condition to divide the samples. Based on evaluation metrics such as information gain and Gini coefficient, the feature attribute that maximizes the improvement of the evaluation metric under the current state is selected as the splitting basis, and the decision tree is generated iteratively from top to bottom. Thus, the path from the root node to the leaf node represents a decision rule, and the leaf node represents the category corresponding to the rule. In this embodiment of the invention, a decision tree for defect classification is constructed to improve the classification accuracy and robustness of the decision tree.

[0063] Figure 2a For images containing defects, Figure 2b To process through detection algorithms Figure 2a The obtained predicted defect area image is obtained by Figure 2a and Figure 2b It can be seen that the predicted defect area by the detection algorithm is smaller than the actual defect area. When the features extracted by the feature extraction algorithm based on the predicted defect area are used as the image feature information of the defect, noise will be introduced into the image feature information of the defect. In order to reduce the impact of noise on decision tree construction, noise should be considered when calculating the evaluation index of image feature information.

[0064] In this embodiment of the invention, adversarial attacks are applied to each feature attribute of each defect in the target image to simulate the influence of noise during the tree construction process. Specifically, since decision trees are discrete and non-differentiable, a black-box attack method that does not require gradient calculation is used to apply noise interference to the image feature information of each defect in the target image used for decision tree construction. Attack methods can include MILP attack and Papernot's attack, etc. Simultaneously, through a radius of ε... ∞ Norm constraints constrain the range of perturbation in adversarial attacks to limit the maximum value of noise. This allows for the determination of target features for node splitting that are less sensitive to noise based on the evaluation metrics of each feature attribute under adversarial attacks within this perturbation range. This reduces the deteriorating impact of noise on decision tree classification results and improves the accuracy of decision tree construction.

[0065] Step 130: Starting from the root node, divide the training set layer by layer from top to bottom until the preset termination condition is met to generate a decision tree.

[0066] The partitioning of any current node includes: determining the target feature based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attack; determining the sample set corresponding to the left node and the sample set corresponding to the right node of the current node based on the target feature and the feature threshold corresponding to the target feature; the sample set corresponding to the root node of the decision tree is the training set; the sample set corresponding to the left node or the right node is a subset of the training set; and the current node includes any one of the root node, left node, and right node.

[0067] Specifically, the current node can be understood as any node in the decision tree. When dividing any current node in the decision tree training process, the minimum information gain of each feature attribute of the sample set corresponding to the node under adversarial attack can be determined as the evaluation index of each feature attribute under adversarial attack. Then, the magnitude of the evaluation index of each feature attribute under adversarial attack is compared, and the feature attribute corresponding to the largest evaluation index is determined as the target feature.

[0068] After determining the target features, the training set is divided into two subsets based on the target features and their corresponding feature thresholds. These two subsets are the sample sets corresponding to the left and right nodes of the current node. The subset consisting of training samples whose target features are less than the corresponding feature threshold is the sample set corresponding to the left node, and the subset consisting of training samples whose target features are not less than the corresponding feature threshold is the sample set corresponding to the right node.

[0069] The preset termination conditions include at least one of the following: the class information of all training samples in the sample set corresponding to the left node is consistent and the class information of all training samples in the sample set corresponding to the right node is consistent; there are no feature attributes used to segment the sample set; and the tree depth is reached.

[0070] First, the evaluation index of each feature attribute in the training set corresponding to the root node under adversarial attack is obtained to determine the target feature that is less sensitive to noise. Based on the target feature and the feature threshold corresponding to the target feature, the training set is divided into two subsets to determine the sample set corresponding to the left node and the sample set corresponding to the right node of the root node, thus realizing the construction of the first layer of internal nodes in the decision tree structure.

[0071] Then, the left and right nodes of the root node are taken as the current nodes, and the process continues to determine the target features based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under adversarial attacks. The current node is then further divided based on the target features and their corresponding feature thresholds. This process is repeated iteratively from top to bottom until a preset termination condition is met, resulting in a decision tree for defect classification.

[0072] Specifically, after determining the sample set corresponding to the left node and the sample set corresponding to the right node of the current node, it can be determined whether the category information of each training sample in the sample set corresponding to the left node is consistent, whether the category information of each training sample in the sample set corresponding to the right node is consistent, whether there are feature attributes for segmenting the sample set, and whether the predefined tree depth has been reached. If at least one of the following conditions is met, it is determined that the preset termination condition is met. Then, based on the target features and feature thresholds of each node in the decision tree, each sample in the sample set of each node can be further divided into the left or right node of that node.

[0073] Of course, if any of the following conditions are not met, the class information of each training sample in the sample set corresponding to the left node is consistent, the class information of each training sample in the sample set corresponding to the right node is consistent, there is no feature attribute for splitting the sample set, or the predefined tree depth is reached, the sample set corresponding to the left node and the sample set corresponding to the right node can continue to be divided in an iterative manner from top to bottom until the preset termination condition is met to construct a decision tree.

[0074] In this embodiment of the invention, during the decision tree construction process, adversarial attacks are applied to the samples to simulate noise. Then, based on the evaluation index of each feature attribute in the sample set corresponding to each node of the decision tree under the adversarial attack, the target features corresponding to each node that are less sensitive to noise are determined. Based on the target features corresponding to each node and the feature threshold of the target features, the classification strategy of each node is determined. The classification decisions of each node are configured in each node of the decision tree to obtain a decision tree for defect classification. Considering the influence of noise on feature attributes, a decision tree for defect classification is constructed, thereby improving the accuracy, reliability and robustness of defect classification results.

[0075] Furthermore, taking a wafer as an example, the target image in step 110 can be a wafer image containing at least one defect. After acquiring the wafer image using a wafer defect detection device, the image feature information of each defect in the wafer image can be determined. Specifically, the defect image can be processed based on a detection algorithm to determine the predicted defect region, and then the image feature information of the predicted defect region can be extracted based on a feature extraction algorithm, as shown in Table 1. The image feature information includes multiple feature attributes, such as width, height, area, eccentricity, average gray value, grayscale variation range, texture features, etc. To improve the performance and stability of the decision tree, the feature values ​​of the feature attributes can be normalized. Normalization can unify the data to a single scale. Specifically, z-score normalization can be used to transform the data into a standard normal distribution. z-score normalization does not change the shape of the original data distribution and is less sensitive to outliers.

[0076] Table 1

[0077] defect Width Height Area AspectRatio Perimeter Radius Eccentricity Magnitude Brightness Roughness 1 0.000407 0.000335 8.35E-08 1.305602 4.852691 0.000163 0.64292358 28 215 96 2 0.000287 0.000335 6.06E-08 1.212609 4.145584 0.000139 0.56561644 36 183 111 3 0.000359 0.000335 7.32E-08 1.218155 4.51127 0.000153 0.57105198 35 223 116 4 0.000383 0.00043 1.08E-07 1.188736 5.452691 0.000185 0.54067781 32 211 125 5 0.000335 0.000358 7.32E-08 1.218155 4.51127 0.000153 0.57105198 30 207 116 …

[0078] Furthermore, based on the acquisition of defect images using an optical microscope or a scanning electron microscope, the defects are determined by an image difference processing algorithm to be surface defects such as nanoparticles, depressions, protrusions, scratches, broken lines, bridging, etc., or subsurface and internal defects such as voids and uneven material composition. For example, the category information of surface defects is determined as the first category (represented by 0), and the category information of subsurface and internal defects is determined as the second category (represented by 1).

[0079] Then, each defect can be used as a sample training set to construct a decision tree. Specifically, the image feature information of each defect can be used as training data, and the category information of each defect can be used as a label.

[0080] Taking the image feature information of each defect, which includes d feature attributes, as an example, the training samples can be obtained through a d-dimensional vector x. i and category label y i The training set D, consisting of N training samples, can be represented as:

[0081]

[0082] Where d and N are both natural numbers.

[0083] In this embodiment of the invention, the training set is constructed by using the image feature information of each defect in the acquired defective wafer image as training data and the category information of each defect as a label.

[0084] In step 120, an adversarial attack is applied to each feature attribute of each defect, and through a radius of ε. ∞ Norm constraints limit the range of perturbations in adversarial attacks.

[0085] Correspondingly, the image feature information of the defects After applying an adversarial attack to each feature attribute, the image feature information under the adversarial attack can be represented as follows:

[0086] Figure 3 This invention provides a flowchart for obtaining the evaluation index of each feature attribute in the sample set corresponding to the current node in a decision tree under adversarial attacks, as shown in the embodiment of the invention. Figure 3 As shown, when performing a partition on any current node during the decision tree training process, the specific steps may include:

[0087] Step 310: Determine the minimum information gain of each feature attribute under adversarial attack.

[0088] Furthermore, step 310 may specifically include:

[0089] For each feature attribute, the sample set corresponding to the current node is divided into the first subset I based on the corresponding feature threshold. L Second Subset I R Within the perturbation range, obtain the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack perturbation; select the first subset I. L Or the second child I R The set is taken as the target subset I′. The intersection of the target subset I′ and the dynamic sample subset Δi is determined as the perturbation subset I′1 of the target subset I′. The samples in the target subset I′ that do not belong to the fluctuation boundary subset Δi are determined as the stable subset I′2 of the target subset I′. The mapping relationship between the first category defect sample variable Δn0 and the second category defect sample variable Δn1 in the perturbation subset I′1 is established. Based on the stable subset and the mapping relationship, the minimum information gain of the corresponding feature attribute is determined.

[0090] Furthermore, within the perturbation range, the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack perturbation are obtained, including:

[0091] In the sample set corresponding to the current node, samples whose feature values ​​of the current feature attribute belong to the dynamic range are constructed as a dynamic sample subset Δi, and samples whose feature values ​​of the current feature attribute belong to the disturbance boundary range are constructed as a fluctuation boundary subset ΔI.

[0092] The dynamic range is determined based on the disturbance amount and the feature threshold of the current feature attribute, while the disturbance boundary range is determined based on the radius ε and the feature threshold of the current feature attribute.

[0093] Specifically, for each feature attribute, firstly, it can be based on the current feature attribute. The feature threshold η of the current feature attribute will be used to set the sample set I(I={(x i ,y i )|y i The subset I is divided into the first subsets of the subset {0, 1}. L Second Subset I R

[0094] After applying an adversarial attack to the samples, the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack perturbation amount are obtained within the perturbation range. The fluctuation boundary subset ΔI represents the sample set within the perturbation range affected by a radius of ε. ∞ The set of all training samples affected by the perturbation in the sample set under norm-constrained adversarial attacks is considered. Therefore, the perturbation boundary interval of the current adversarial attack can be determined as [η-ε, η+ε] based on the radius of the adversarial attack, i.e., the boundary value ε of the perturbation amount, and the feature threshold η of the current feature attribute. A fluctuation boundary subset is constructed based on the training samples in the sample set whose feature values ​​of the current feature attribute belong to the perturbation boundary interval. Within the perturbation range, the dynamic interval corresponding to the current adversarial attack is determined as [η-ε′, η+ε′] based on the perturbation amount ε′ of any applied adversarial attack and the feature threshold η of the current feature attribute. Then, a dynamic sample subset Δi is constructed based on the training samples in the sample set whose feature values ​​of the current feature attribute belong to the dynamic interval. Training samples within the dynamic sample subset Δi, after being perturbed by the current adversarial attack, will be affected when partitioned using the current feature attribute, leading to changes in the classification results and thus affecting the calculation of information gain S. The classification results of training samples in the sample set I / Δi, which are not within the dynamic interval [η-ε′, η+ε′], will not be affected by the adversarial attack. There is an inherent consistency between the boundary of the adversarial attack and the decision boundary of the decision tree. When calculating the information gain of the current feature attribute, perturbations of other feature attributes besides the current feature attribute will not affect the calculation results. Therefore, within the perturbation range, a dynamic sample subset Δi is constructed based on the perturbation amount ε of a set I / Δi with radius ε. ∞ Under norm-constrained adversarial attacks, when calculating the information gain of the current feature attribute under different adversarial attack perturbations, it is only necessary to consider training samples in the sample set whose feature values ​​of the current feature attribute belong to the dynamic interval corresponding to the adversarial attack.

[0095] The first subset I L Or the second child I R After determining the target subset I′, the intersection of the target subset I′ and the dynamic sample subset Δi is determined as the perturbation subset I′1 of the target subset I′. Thus, I′1 = I′∩Δi. The first-category defect sample variable Δn0 in the perturbation subset I′1 can be understood as the number of first-category defect samples whose classification results change with different adversarial attack perturbation amounts. The value range of Δn0 is [0, |ΔI∩I0|], where I0 represents the number of samples in the sample set whose category information is first-category. I0 = I∩{(x i ,y i )|y i =0}, the second-category defect sample variable Δn1 can be understood as the number of second-category defect samples whose classification results change due to different adversarial attack perturbation amounts. The value range of Δn1 is [0,|ΔI∩I1|], where I1 represents the set of samples in the sample set whose category information is second-category, I1=I∩{(x i ,y i )|y i =1}. The samples in the target subset I′ that do not belong to the fluctuation boundary subset ΔI are determined as the stable subset I′2 of the target subset I′. This allows us to determine that I′2 = I′1\ΔI, and the number of samples in the stable subset I′2 that belong to the first category is... The number of samples in the stable subset I′2 whose class information is the second class is

[0096] Furthermore, the mapping relationship between the first category defect sample variable Δn0 and the second category defect sample variable Δn1 in the perturbation subset I′1 can be established as follows:

[0097]

[0098] N0 represents the number of samples with the first category of defects in the sample set corresponding to the current node, and N1 represents the number of samples with the second category of defects in the sample set. The number of samples with first-class defects in the stable subset I′2. I1 represents the number of samples of the second category of defects in the stable subset I′2, and I1 represents the set of samples of the second category of defects in the sample set.

[0099] Furthermore, based on the stable subset I′2 and the mapping relationship, the perturbation range can be determined by a radius l of ε. ∞ Minimum information gain of the current feature attribute under an adversarial attack constrained by norm.

[0100] Furthermore, based on stable subsets and mapping relationships, the minimum information gain of the corresponding feature attributes is determined, including:

[0101] For each feature attribute, a corresponding objective function is established, where the objective function is... The value of the objective function under the corresponding condition is calculated by traversing the value range of the first category defect sample variable Δn0. The adversarial attack corresponding to the minimum objective function value is taken as the target adversarial attack of the corresponding feature attribute. The value range of the first category defect sample variable Δn0 is [0,|ΔI∩I0|]. The information gain of the feature attribute under the target adversarial attack condition can be obtained to obtain the minimum information gain of the corresponding feature attribute.

[0102] Specifically, for the sample set corresponding to the current node, the formula for calculating the information gain S of the current feature attribute is as follows:

[0103]

[0104] Where n0 = |I′∩I0|, n1 = |I′∩I1|, |·| represents the number of samples in the set, C1 and C2 are constants, C1 > 0, C2 is related to n0, and

[0105] Specifically, this embodiment uses the gradient-based extremum method to find the minimum value of the objective function F. The gradient formula of the information gain S with respect to n0 is shown below:

[0106]

[0107] From the above formula, we can see that when hour, As n0 increases, S will decrease accordingly; when hour, As n0 increases, S will increase accordingly. When S is minimized, n0, n1, N0, and N1 are all integer variables, which may not necessarily satisfy the condition. therefore, and The information gain is minimized when the two are closest.

[0108] Therefore, the objective function can be established as follows:

[0109]

[0110] The objective function is calculated by iterating through the range of values ​​for the first-category defect sample variable Δn0 under the corresponding conditions. When the objective function value reaches its minimum, the information gain S of the current feature attribute also reaches its minimum. Therefore, the adversarial attack corresponding to the minimum objective function value can be used as the target adversarial attack for the corresponding feature attribute, and the value of the first-category defect sample variable Δn0 under the target adversarial attack is determined as follows. The value of the second-category defect sample variable Δn1 under the target adversarial attack is determined. Furthermore, it is possible to determine the target's resistance to attack. based on and By replacing n0 and n1 in the formula for calculating information gain S, we can obtain the formula for calculating the information gain S of the feature attributes under adversarial attack conditions:

[0111]

[0112] That is, based on the above formula, we can obtain the minimum information gain of the current feature attribute under adversarial attacks within the set perturbation range.

[0113] Using the same approach, each feature attribute can be traversed. Each feature attribute is used as the current feature attribute, and the minimum information gain of each feature attribute is calculated.

[0114] Step 320: Determine the minimum information gain of each feature attribute as the evaluation index of the corresponding feature attribute.

[0115] Adversarial attacks alter the classification results of the decision tree for training samples within a dynamic sample subset Δi. Different perturbation amounts ε′ correspond to different dynamic sample subsets Δi, causing changes in the first and second subsets obtained by partitioning the sample set based on feature attributes. Therefore, the information gain also changes under different perturbation amounts ε′, and the impact of different perturbation amounts ε′ on the information gain is different. This embodiment obtains a radius of ε... ∞The lower bound of the information gain of each feature attribute within the perturbation range of the norm constraint, that is, the minimum value of the information gain under adversarial attack is used as the evaluation index of the corresponding feature attribute. This minimum value represents the case where the noise factor has the greatest influence on the corresponding feature attribute.

[0116] Step 330: Based on the evaluation indicators of each feature attribute, determine the feature attribute corresponding to the largest evaluation indicator as the target feature.

[0117] In this embodiment of the invention, by applying a radius of ε to each feature attribute... ∞ Adversarial attacks are conducted within the perturbation range of norm constraints. Then, the minimum information gain corresponding to each feature attribute is obtained within this constraint range. The minimum information gain under adversarial attacks represents the maximum influence of noise factors on the corresponding feature attribute. Therefore, using the minimum information gain as the evaluation index of feature attributes can improve the decision tree's resistance to noise. Furthermore, the feature attribute corresponding to the maximum evaluation index among all evaluation indices is determined as the target feature. Thus, the target feature that is less sensitive to noise is selected from each feature attribute, thereby improving the robustness of the decision tree when using the target feature to partition the current node.

[0118] Alternatively, the evaluation index of each feature attribute under adversarial attack can be determined based on other methods. For example, the evaluation index of each feature attribute under adversarial attack can be determined based on the adversarial sample detection rate, false positive rate, false negative rate or transferability of each feature attribute under adversarial attack, and the feature attribute corresponding to the maximum evaluation index can be determined as the target feature.

[0119] In this embodiment of the invention, target features that are less sensitive to noise are determined based on the evaluation index of each feature attribute in the sample set under adversarial attacks.

[0120] It should be noted that a test set can be constructed simultaneously with the training set. After the decision tree is determined, its classification accuracy can be measured on the test set to determine its classification performance. Specifically, the classification accuracy of the decision tree can be determined based on the following formula:

[0121]

[0122] Where Acc represents classification accuracy, the number of correctly classified samples represents the number of samples whose category determined by the decision tree matches the true category, and the total number of samples represents the number of samples in the test set.

[0123] Table 2 shows the classification accuracy of the decision tree determined based on ID3 and the decision tree determined in this application under adversarial attacks. As shown in Table 2, the decision tree determined in this application has higher classification accuracy than the decision tree determined based on ID3 under both normal conditions and adversarial attacks. Furthermore, the decision tree determined based on ID3 can achieve a classification accuracy of 0.8905 on the original test set, but the classification accuracy drops to 0.1000 and 0.1095 after applying MILP attack and Papernot's attack, respectively. The classification accuracy of the decision tree determined in this application only decreases by 0.0047 under Papernot's attack.

[0124] Table 2

[0125]

[0126] In this embodiment of the invention, after determining the classification strategy of each node constituting the decision tree, the classification decision of each node is configured to each node in the decision tree to realize the determination of the decision tree for defect classification. Furthermore, the determination process of the decision tree takes into account the influence of noise on the characteristic attributes of defects, thereby improving the robustness of the defect classification results.

[0127] Furthermore, the decision tree construction method for defect classification provided by the present invention further includes: pruning the generated decision tree.

[0128] Specifically, if the defect category information includes multiple categories, then the determined decision tree will have multiple leaf nodes. To reduce the complexity of the decision tree, it can be pruned. Specifically, Cost-Complexity Pruning (CCP) can be used to prune the decision tree. This involves calculating the cost complexity of each node upwards from the leaf node and selecting the node that reduces the overall complexity the most for pruning. Of course, the complexity of the decision tree can be controlled by adjusting the pruning rate α to adjust it to a complexity that meets the user's needs.

[0129] In this embodiment of the invention, after generating the decision tree, the complexity of the decision tree is reduced and the efficiency of the decision tree in classifying defects is improved by pruning the decision tree.

[0130] Figure 4 This is a flowchart illustrating a defect detection method provided in an embodiment of the present invention. In this embodiment, defect detection is performed using a decision tree constructed for defect classification in the above embodiments. Figure 4 As shown, in this embodiment, the method may include:

[0131] Step 410: Construct a defect classification decision tree.

[0132] Specifically, a defect classification decision tree is constructed using the method described in any of the foregoing embodiments.

[0133] Step 420: Acquire images of the defects to be classified in the sample and extract image feature information of the regions where each defect to be classified is located in the images.

[0134] Specifically, a defect classification decision tree can classify defects based on their image features to determine the defect type. Therefore, to classify defects within a sample, the first step is to acquire an image of the sample, i.e., determine the defect image to be classified. The second step is to determine the image feature information of the region where each defect to be classified is located. Specifically, the defect image to be classified can be segmented to determine the defect image of each defect to be classified. Based on the defect image of each defect to be classified, the image feature information of the region where each defect to be classified is located can be determined. That is, the image feature information of each defect to be classified can be extracted from the defect image of each defect to be classified based on a feature extraction algorithm.

[0135] Step 430: Input the image feature information of the defects to be classified into the decision tree so that the decision tree can determine the defect category of each defect in the image to be classified.

[0136] Specifically, after obtaining the image feature information of the defect to be classified, this information can be input into a decision tree. The decision tree can then sequentially classify the defect according to the target features and feature thresholds of each node, until the defect is classified to a leaf node. The decision tree for defect classification includes two leaf nodes representing the first category and the second category, respectively. When the decision tree classifies the defect to be classified to the leaf node representing the first category, it can determine that the defect corresponding to the image is of the first category. When the decision tree classifies the image to the leaf node representing the second category, it can determine that the defect corresponding to the image is of the second category.

[0137] In this embodiment of the invention, by inputting the image feature information of each defect to be classified in the sample into a decision tree constructed using any of the aforementioned embodiments, the decision tree can sequentially divide the defects to be classified according to the target features corresponding to each node and the feature threshold of the target features, until the defects to be classified are divided to the leaf nodes. The category information of the defects to be classified is determined according to the category represented by the leaf nodes, thereby realizing the determination of the defect category of each defect to be classified in the sample based on the decision tree.

[0138] The defect detection method provided in this invention involves inputting the image feature information of each defect to be classified in a sample into a trained decision tree. The decision tree then sequentially divides the defects to be classified according to the target features and feature thresholds of each node until the defects to be classified are classified to leaf nodes. The category of the defect to be classified is determined according to the category represented by the leaf node, thereby improving the accuracy of defect classification by determining the defect category of each defect to be classified in the sample based on the decision tree.

[0139] Furthermore, the acquisition, storage, use, and processing of data in the technical solution of this invention all comply with the relevant provisions of national laws and regulations.

[0140] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A decision tree construction method for defect classification, characterized in that, include: A target image containing at least one defect is obtained, and each defect in the target image is used as a sample training set to construct a decision tree. Each sample includes image feature information and category information of the corresponding defect. The image feature information includes multiple feature attributes, and the category information includes a first category and a second category. An adversarial attack is applied to each of the aforementioned characteristic attributes of each defect, and through a radius of ε. ∞ The norm constrains the range of the perturbation amount of the adversarial attack; Starting from the root node, the training set is divided layer by layer from top to bottom until a preset termination condition is met to generate the decision tree. The division of any current node includes: determining the target feature based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under the adversarial attack; determining the sample set corresponding to the left node and the sample set corresponding to the right node of the current node based on the target feature and the feature threshold corresponding to the target feature; the sample set corresponding to the root node of the decision tree is the training set; the sample set corresponding to the left node or the right node is a subset of the training set; and the current node includes any one of the root node, the left node, and the right node.

2. The decision tree construction method for defect classification according to claim 1, characterized in that, The step of determining the target feature based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under the adversarial attack includes: Determine the minimum information gain of each of the aforementioned feature attributes under the adversarial attack, and use the minimum information gain of each of the aforementioned feature attributes as the evaluation index of the corresponding feature attribute; Based on the evaluation index of each of the aforementioned feature attributes, the feature attribute corresponding to the largest evaluation index is determined as the target feature.

3. The decision tree construction method for defect classification according to claim 2, characterized in that, Determining the minimum information gain of each of the feature attributes under the adversarial attack includes: For each of the aforementioned feature attributes, the sample set corresponding to the current node is divided into a first subset I based on the corresponding feature threshold. L Second Subset I R ; Within the range of the disturbance amount, obtain the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack disturbance amount; Select the first subset I L Or the second sub-I R The set is taken as the target subset I′, and the intersection of the target subset I′ and the dynamic sample subset Δi is determined as the perturbation subset I′1 of the target subset I′. The samples in the target subset I′ that do not belong to the fluctuation boundary subset Δi are determined as the stable subset I′2 of the target subset I′. Establish a mapping relationship between the first category defect sample variable Δn0 and the second category defect sample variable Δn1 in the perturbation subset I′1; Based on the stable subset and the mapping relationship, the minimum information gain of the corresponding feature attribute is determined.

4. The decision tree construction method for defect classification according to claim 3, characterized in that, The step of obtaining the fluctuation boundary subset ΔI of the sample set corresponding to the current node and the dynamic sample subset Δi corresponding to the adversarial attack perturbation within the perturbation range includes: In the sample set corresponding to the current node, samples whose feature values ​​of the current feature attribute belong to the dynamic interval are constructed as the dynamic sample subset Δi, and samples whose feature values ​​of the current feature attribute belong to the disturbance boundary interval are constructed as the fluctuation boundary subset ΔI. The dynamic interval is determined based on the disturbance amount and the feature threshold of the current feature attribute, and the disturbance boundary interval is determined based on the radius ε and the feature threshold of the current feature attribute.

5. The decision tree construction method for defect classification according to claim 3, characterized in that, The mapping relationship includes: Where N0 represents the number of samples of the first category of defects in the sample set corresponding to the current node, and N1 represents the number of samples of the second category of defects in the sample set corresponding to the current node. The number of samples of the first category of defects in the stable subset I′2. I1 represents the number of samples of the second category of defects in the stable subset I′2, and I1 represents the set of samples of the second category of defects in the sample set corresponding to the current node.

6. The decision tree construction method for defect classification according to claim 5, characterized in that, Determining the minimum information gain of the corresponding feature attribute based on the stable subset and the mapping relationship includes: For each of the aforementioned feature attributes, a corresponding objective function is established, wherein the objective function is: The value of the objective function under the corresponding condition is calculated by traversing the value range of the first category defect sample variable Δn0. The adversarial attack corresponding to the minimum objective function value is taken as the target adversarial attack as the corresponding feature attribute. The value range of the first category defect sample variable Δn0 is [0,|ΔI∩I0|]. By obtaining the information gain of the feature attribute under the target adversarial attack condition, the minimum information gain of the corresponding feature attribute can be obtained.

7. The decision tree construction method for defect classification according to claim 6, characterized in that, The information gain S of the characteristic attribute under the adversarial attack condition is calculated using the following formula: Where C1 and C2 are constants, Let Δn0 be the value of the first category of defect sample variable under the adversarial attack conditions. The value of the second category defect sample variable Δn1 under the target adversarial attack condition.

8. The decision tree construction method for defect classification according to claim 1, characterized in that, The step of determining the target feature based on the evaluation index of each feature attribute in the sample set corresponding to the current node in the decision tree under the adversarial attack includes: Based on the evaluation index of each of the aforementioned feature attributes under the adversarial attack, the maximum evaluation index value is selected as the target feature.

9. The decision tree construction method for defect classification according to any one of claims 1-8, characterized in that, It also includes pruning the generated decision tree.

10. A defect detection method, characterized in that, include: A defect classification decision tree is constructed using the method described in any one of claims 1-9; Acquire images of the defects to be classified in the sample and extract image feature information of the regions where each defect to be classified is located in the images; The image feature information of the defects to be classified is input into the decision tree so that the decision tree can determine the defect category of each defect in the image to be classified.

Images