Image classification method and device for migratory black box adversarial defense and medium

Abstract

This invention relates to an image classification method, apparatus, and medium for transfer-based black-box adversarial defense. The method includes acquiring an input image to be classified; determining a predefined expansion factor, spatial phase offset, and gap-filling value; calculating signal pixel positions based on the expansion factor and spatial phase offset; mapping the pixel values ​​of each original pixel to a high-dimensional space according to their corresponding signal pixel positions to form an expanded representation; filling gaps in regions other than all signal pixel positions with gap-filling values; and training a target neural network classification model with the obtained expanded representation. During inference on the trained target neural network classification model, the same acquisition, determination, calculation, mapping, and filling operations are performed on the input image, and the obtained expanded representation is input into the target neural network classification model to obtain the classification result. This method achieves a synergistic improvement in clean sample accuracy and black-box transfer robustness without relying on adversarial training.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and computer vision technology, specifically to an image classification method, apparatus, and medium for migrating black-box adversarial defense. Background Technology

[0002] Deep neural networks have achieved remarkable success in computer vision tasks such as image recognition and object detection, and are widely used in key fields such as autonomous driving, security monitoring, and medical image analysis. However, research shows that deep models are highly sensitive to even small perturbations in the input. Attackers can induce the model to output incorrect classification results by adding noise that is imperceptible to the human eye to the original image; these samples are called adversarial examples. This security vulnerability severely limits the practical deployment of deep neural networks in security-sensitive scenarios.

[0003] In real-world deployment environments, attackers often cannot obtain the internal structure, parameters, or gradient information of the target model. Therefore, they frequently employ a transfer-based black-box attack approach. This involves the attacker first training an alternative model, generating adversarial examples based on this model, and then transferring these examples to the target model for attack. Such attacks are highly practical and covert, making them one of the main threats facing current deep learning systems.

[0004] To counter adversarial attacks, researchers have proposed various defense strategies, mainly including the following three categories: 1. Introducing adversarial examples during training enhances the model's robustness to perturbations. However, this method is computationally expensive and has high training complexity, often at the cost of sacrificing the accuracy of clean samples, resulting in a trade-off between accuracy and robustness.

[0005] 2. Provide verifiable robustness guarantees for the model through formal methods. Although theoretically advantageous, such methods are often difficult to scale to large-scale networks or high-resolution inputs, limiting practical deployment.

[0006] 3. Methods such as random padding, compression, and noise addition attempt to suppress input perturbations during the inference phase. These methods are simple to implement, but their robustness improvement is unstable when facing adaptive attacks, and they may introduce additional accuracy losses.

[0007] In summary, existing defense methods generally suffer from the following problems: First, it is difficult to effectively improve black-box robustness without sacrificing the accuracy of clean samples; second, defense methods that rely on adversarial example generation are computationally expensive; and third, input transformation methods lack training-inference consistency and are easily bypassed by attackers. Furthermore, existing technologies have not effectively utilized structural transformations of the input space to disrupt the transferability of attack gradients, lacking targeted defenses against the fundamental mechanisms of transfer-based black-box attacks. Summary of the Invention

[0008] This invention provides an image classification method, apparatus, and medium for transferable black-box adversarial defense. Its purpose is to solve the technical problem that existing transferable black-box adversarial defense methods are unable to simultaneously improve the accuracy of clean sample identification and effectively reduce the transferability of adversarial perturbations without adversarial training.

[0009] To achieve the above objectives, the first aspect of the present invention provides an image classification method for migration-based black-box adversarial defense, comprising the following steps: Obtain the input image to be classified; Determine the predefined spread factor, spatial phase offset, and gap fill value; Based on the expansion factor and the spatial phase offset, calculate the signal pixel position of each original pixel in the input image in the expanded high-dimensional space; The pixel values ​​of each original pixel are directly mapped to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation, and the gap filling value is filled in the region of the high-dimensional space other than all the signal pixel positions. The target neural network classification model is trained using the extended representation obtained from the above steps; When inferring on the trained target neural network classification model, the same acquisition, determination, calculation, mapping and filling operations are performed on the input image, and the resulting extended representation is input into the target neural network classification model to obtain the classification result.

[0010] Furthermore, the method for calculating the signal pixel position corresponding to each original pixel in the input image in the expanded high-dimensional space includes: For the input image Each spatial location ,in, , Based on the expansion factor and the spatial phase offset, its coordinate position in the expanded high-dimensional space is calculated using the following formula. :

[0011] in, This represents the original input image, with a size of [size missing]. , Image height, Image width, The number of image channels. Represents the original input image Spatial location index in For row index, For column indexes, Indicates the expansion factor. and These represent the spatial phase offset, which are the offset values ​​in the height and width directions, respectively. For the new altitude direction coordinates, The coordinates for the new width direction; All calculated coordinate positions Constituting the set of signal pixel locations .

[0012] Furthermore, the method of directly mapping the pixel values ​​of each original pixel to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation includes: Based on the expansion factor and the spatial phase offset, construct a system with a size of The extended tensor; Initialize all elements in the extended tensor to the gap fill value; For each channel of the original input image ch And for each spatial location, based on the corresponding coordinates in the set of signal pixel locations, the original pixel value is... Directly assign the value to the channel in the extended tensor ch Coordinate position The element at that location.

[0013] Furthermore, the gap filling value is a constant between 0 and 1.

[0014] Furthermore, the spatial phase offset value is determined using either corner alignment or center alignment: Among them, corner alignment This allows the original pixel to be located in each of the expanded high-dimensional spaces. The corner positions of a local block; Among them, center alignment This makes the original pixel located in each The center of the local block, and a symmetrical constant buffer zone is formed around it.

[0015] Furthermore, the training phase includes: For each sample in the training set, perform the acquisition, determination, calculation, mapping, and padding operations to obtain the extended representation; The extended representation is input into the target neural network classification model, and forward and backward propagation are performed to update the model parameters.

[0016] Furthermore, the reasoning phase includes: For any input image to be classified, including images with adversarial perturbations, perform the exact same acquisition, determination, computation, mapping, and filling operations as in the training phase; The resulting extended representation is input into the trained target neural network classification model, and the classification result is output.

[0017] Furthermore, it also includes a front-end sampling coupling step: Based on the expansion factor, i.e. the spatial phase offset, the kernel size, stride, and padding of the first convolutional layer of the target neural network classification model are set. This ensures that the receptive field of the first convolutional layer satisfies the preset relationship between the sampling of signal pixels and structural anchor points, controls the resolution and computational cost of the output feature map, and maintains an effective receptive field.

[0018] To achieve the above objective, a second aspect of the present invention provides an image classification apparatus for performing the image classification method, comprising: An input acquisition module is used to acquire the input image; The parameter determination module is used to determine the expansion factor, the spatial phase offset, and the gap fill value; The position calculation module is used to calculate the signal pixel position of each original pixel in the input image in the expanded high-dimensional space based on the expansion factor and the spatial phase offset. The extended embedding module directly maps the pixel values ​​of each original pixel to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation, and fills the gap padding value in the high-dimensional space except for all signal pixel positions; The model training module uses the extended representation obtained in the above steps to train the target neural network classification model; The classification inference module is used to perform the same acquisition, determination, calculation, mapping and filling operations on the input image when inferring on the trained target neural network classification model, and input the obtained extended representation into the target neural network classification model to obtain the classification result.

[0019] To achieve the above objectives, a third aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the image classification method for migration-based black-box adversarial defense.

[0020] The beneficial effects of this invention are: Compared with existing technologies, this invention provides an image classification method, apparatus, and medium for transfer-based black-box adversarial defense. After acquiring the input image, the method first determines the expansion factor, spatial phase offset, and gap-filling value. Then, based on the expansion factor and offset, it calculates the signal position of each original pixel in the expanded high-dimensional space and directly maps the original pixel values ​​to these positions without interpolation. The remaining areas are filled with constants to form an expanded representation. During the training phase, the model learns based on this expanded representation, thus being forced to adapt to an input distribution containing structural anchor points and high-frequency sparse grid points. During the inference phase, a complete phase shift is performed on any input (including images that may contain adversarial perturbations). The data is then fed into the model for classification after undergoing the same expansion operation. This training-inference consistent expansion embedding mechanism breaks the assumption of continuous smoothness of input data through spatial isolation and phase shift. This causes the gradient direction of the adversarial perturbation generated by the alternative model trained on the original dense image to tend to be orthogonal to the sensitive direction of the target model after being mapped to the expansion space, thus effectively blocking the perturbation transmission path of transfer-based black-box attacks. At the same time, this expansion embedding induces manifold expansion in the feature space, enhances the cohesion of intra-class features and makes the inter-class boundaries clearer, thereby improving the recognition accuracy of clean samples. Finally, it achieves a synergistic improvement in clean sample accuracy and black-box transfer robustness without relying on adversarial training. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below.

[0022] Figure 1 This is a flowchart of an image classification method for migration-based black-box adversarial defense disclosed in an embodiment of the present invention.

[0023] Figure 2 This is a schematic diagram of a sparse lattice embedding disclosed in an embodiment of the present invention, wherein, Figure 2 (a) is a schematic diagram of the original dense input signal; (b) is a schematic diagram of the sparse lattice structure after symmetry breaking and dimensional expansion embedding.

[0024] Figure 3 This is a schematic diagram of an input transformation disclosed in an embodiment of the present invention, wherein, Figure 2 (a) is a dense image of the original CIFAR-10 sample; (b) is a high-dimensional sparse tensor image after symmetry-broken dimension expansion embedding.

[0025] Figure 4 This is a schematic diagram of a training and inference process and a migration-based black-box defense process disclosed in an embodiment of the present invention.

[0026] Figure 5This is a visualization comparison of the feature space t-SNE between the method of this invention and the traditional method, wherein... Figure 5 In the diagram, (a) is the feature map of the baseline model of the traditional method, and (b) is the feature map of the SBDE model, which is the feature map of this method.

[0027] Figure 6 This is a quantitative distance analysis diagram of the geometric evidence (cosine distance distribution) for the manifold expansion of the method of the present invention.

[0028] Figure 7 This is a frequency domain preference difference analysis diagram between the method of this invention and the traditional method, wherein, Figure 7 In the diagram, (a) is the original image, (b) is the surrogate gradient, and (c) is the gradient map of the present invention.

[0029] Figure 8 This is a cosine similarity distribution diagram of the gradients of the target model and the alternative model in the method of this invention, wherein... Figure 8 In the diagram, (a) is the cosine similarity map of the gradient of the baseline model, and (b) is the cosine similarity map of the gradient of the SBDE model. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] According to embodiments of the present invention, it should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the following methods, in some cases the steps shown or described may be executed in a different order than that shown here.

[0032] like Figure 1 As shown, this invention provides an image classification method for migration-based black-box adversarial defense, comprising the following steps: Step S100: Obtain the input image to be classified; The input image is a digital image that can come from various sources, such as surveillance video frames captured in real time by a camera, image files read from a storage device, cloud image data received via a network, or intermediate image results output by other computer vision systems.

[0033] In this invention, the input image is a multi-channel data structure, represented as follows: ,in Represents the height of the image (number of pixel rows). Represents the width of the image (number of pixel columns). The number of channels in an image (e.g., for a grayscale image). For RGB color images It should be noted that the "input image" can be either a clean, undisturbed natural image or an image that may be encountered in actual deployment and already contains adversarial perturbations.

[0034] Step S200: Determine the predefined spread factor, spatial phase offset, and gap fill value; Expansion factor It is a positive integer greater than or equal to 2, used to control the expansion factor of the original input image in the spatial dimension. After the expansion embedding of this invention, the original size is... The image will be mapped to a size of In a high-dimensional sparse lattice space. Expansion factor The value of directly determines the sparsity of the embedding: Value too small (e.g.) =2 or 3) may result in insufficient sparsity to effectively block the propagation of attack gradients; Value too large (e.g.) >6) This may affect the model's recognition performance due to excessively low information density; preferably, when When the value is 4, it can achieve optimal black-box transfer robustness while maintaining high accuracy on clean samples.

[0035] Spatial phase offset and These represent offset values ​​in the height and width directions, respectively, used to control the specific embedding position of the original pixel within the expanded high-dimensional sparse grid. By adjusting the phase offset, the relative spatial relationship between the signal pixel and the surrounding constant-filled region can be changed, thereby constructing different embedding topologies. Its settings include "corner alignment" (…). ), so that the original pixel is located in each The corner points of local blocks; and "center alignment" ( This allows the original pixel to be located at the center of the local block, forming a symmetrical constant buffer band around it. Different phase offset choices affect the training stability of the model and the final defense performance.

[0036] gap fill value `p` is a constant used to fill all regions in the extended tensor except for the signal pixel locations. This value is set to a real number between 0 and 1 (consistent with the range of normalized image pixel values), such as 0 or 0.5. Choosing a constant as the fill value ensures that the extended representation contains only the original, undistorted pixel information, while introducing deterministic structural anchors, thus violating the original assumption of continuous smoothness in the image.

[0037] It should be noted that the "expansion factor" determines the distribution density of the original information in the high-dimensional space, the "spatial phase offset" fine-tunes the information distribution pattern, and the "gap filling value" defines the baseline value for non-information regions. These three parameters together define the input representation space of this invention. In practical applications, these parameters can be predefined or optimized through offline experiments based on specific defense requirements, target model architecture, and computational cost.

[0038] Step S300: Based on the expansion factor and the spatial phase offset, calculate the signal pixel position of each original pixel in the input image in the expanded high-dimensional space; For the original input image obtained in step S100 This step will iterate through every pixel position in the image. For any pixel located at the... line, number Raw pixels of the column (where row index) The range of values ​​is Column index The range of values ​​is According to the expansion factor determined in step S200 Spatial phase offset (Height offset) (Width-direction offset), its new coordinate position in the expanded high-dimensional space is calculated using the following linear mapping formula. :

[0039] in, This represents the original input image, with a size of [size missing]. , Image height, Image width, The number of image channels. Represents the original input image Spatial location index in For row index, For column indexes, Indicates the expansion factor. and These represent the spatial phase offset, which are the offset values ​​in the height and width directions, respectively. For the new altitude direction coordinates, For the new width direction coordinates.

[0040] In this formula, As an expansion factor, the original coordinates enlarge The scaling factor is the basic scaling operation used to expand dimensions. and As a spatial phase offset, a fixed offset is introduced based on this scaled coordinate system to finely adjust the final anchoring position of the signal pixel within the expanded grid. All coordinate pairs calculated using this formula... Together they constitute the set of signal pixel locations, denoted as This set is essentially a sparse, structured set of lattice points, its sparsity determined by the expansion factor. Determine (the interval between grid points is) (pixels), and its topology (such as corner alignment or center alignment) is determined by spatial phase offset. and Decide.

[0041] It should be noted that this step only performs coordinate mapping calculations and does not involve any pixel value operations. New coordinates The range of values ​​will be expanded to , The range of values ​​is expanded to .

[0042] This step transforms the original dense, continuous image coordinate space into a discrete, anchored sparse grid coordinate system, providing a precise "address" for the subsequent step S400 to losslessly "place" the original pixel values ​​into the correct position in the extended tensor, thereby ensuring the determinism and repeatability of the entire embedding process.

[0043] Step S400: Map the pixel values ​​of each original pixel directly to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation, and fill the gap padding value in the high-dimensional space except for all signal pixel positions; Based on the expansion factor determined in step S200 Build a size of Extended tensor The height and width of this tensor are respectively the height and width of the original image. The number of channels remains unchanged, and all elements within it are uniformly set to the gap fill value determined in step S200 in the initial state. This initialization operation completes the filling of the area "except for all signal pixel positions", creating a "blank" background composed of constants.

[0044] Then, direct mapping begins. Direct mapping refers to mapping the original input image... Each channel in ch and each spatial location The set of signal pixel positions calculated in step S300 Corresponding coordinates in The original pixel values The expanded tensor is written unchanged through the assignment operation. Same channel ch coordinates Through one-to-one mapping, the original pixel value does not change numerically during the migration process, nor does it involve any interpolation calculations that depend on neighboring pixels (such as bilinear interpolation, nearest neighbor interpolation, etc.).

[0045] It is important to emphasize that the "direct mapping" or "assignment" operation here is fundamentally different from traditional image scaling or interpolation techniques. Traditional methods aim to generate new, continuous pixel content to fill the target space through computation, while this invention deliberately leaves "gaps" filled with constants between signal pixels, forming a sparse, discontinuous, structured lattice-like representation. This representation disrupts the local smoothness of the original image, forcing subsequent neural networks to learn decision patterns based on these discrete anchors and high-frequency structural features, rather than relying on traditional low-frequency semantic smoothness.

[0046] To illustrate this embedding process more intuitively, please refer to [link / reference]. Figure 2 and Figure 3 .like Figure 2 As shown, the original dense input signal ( Figure 2 a) Embedded into sparse, structured lattice points ( Figure 2 b) In this model, active signal pixels (yellow and dark gray) are spatially isolated by symmetrical "buffer bands" of constant values ​​(gray). This geometric extension creates deterministic structural anchors, transforming the optimization problem from learning on a continuous manifold to learning on a discrete, anchored grid. Figure 3 Taking the CIFAR-10 sample as an example, the original image is shown ( Figure 3 a) The high-dimensional tensor formed after extended embedding ( Figure 3 (b) where the sparse structure is clearly visible, which is the characterization basis required for symmetry breaking.

[0047] Finally, the expanded tensor obtained after the above assignment and padding operations This is the "extended representation" described in this invention, which completely preserves all pixel information of the original image (which can be obtained through reverse indexing). (lossless recovery), and also introduced the necessary symmetry breaking through structured constant gaps.

[0048] Step S500: Using the extended representation obtained in the above steps, train the target neural network classification model; This step aims to introduce the structured extended representation built in the preceding steps into the model's learning process, enabling the target neural network to establish decision boundaries in a high-dimensional representation space composed of sparse grid points and constant gaps, thereby gaining inherent defense against transfer-based black-box attacks.

[0049] In practice, for each original sample in the training dataset First, steps S100 to S400 are executed sequentially to generate the corresponding extended representation. Subsequently, this extended representation is used as input and fed into the target neural network classification model (such as standard architectures like ResNet and ViT) for standard forward propagation computation. During forward propagation, the model receives input that is no longer the original dense, continuous image, but a sparse structure tensor composed of isolated signal pixels and constant-padded regions. This input format forces the model's convolutional kernels to traverse the "blank" regions formed by gap padding values ​​to perceive and aggregate scattered signal pixels, thereby learning a representation based on high-frequency structural features and long-distance spatial relationships. After completing forward propagation and calculating the loss function value between the predicted and true labels, the backpropagation algorithm is executed to update the network weights based on the gradient information of the loss function with respect to the model parameters. This process is iteratively performed on the entire training dataset until the model converges.

[0050] It should be noted that the optimizer (such as stochastic gradient descent SGD) and training hyperparameters used in this step can remain consistent with those used in regular training and do not require special adjustments for defensive purposes. However, due to the fundamental change in the input representation space, the landscape of the loss function will change significantly during training. For example... Figure 5 and Figure 6 As shown in the t-SNE visualization and cosine distance distribution, under this sparse embedding constraint, the feature space undergoes a "manifold unfolding" effect: features of samples of the same class (intra-class features) tend to be highly clustered (neural collapse), while features of samples of different classes (inter-class features) tend to become orthogonal and dispersed from each other. This reconstruction of the feature space not only establishes a huge safety boundary for the model, but is also the fundamental reason why this invention can unexpectedly improve the accuracy of clean sample recognition.

[0051] Furthermore, from a frequency domain perspective, such as Figure 7As shown, the alternative model (trained on the original image) focuses on low-frequency semantic shapes (represented by smooth heatmaps), while the method of this invention (SBDE) relies on high-frequency structural patterns (such as speckle noise induced by extended grids). This difference in frequency domain preference further explains the effectiveness of the defense mechanism.

[0052] Through this training step, the target model can eventually form a stable and robust discriminant function on the unique representation space defined by the symmetry-breaking dimension extension.

[0053] Step S600: When inferring the trained target neural network classification model, the same acquisition, determination, calculation, mapping and filling operations are performed on the input image, and the resulting extended representation is input into the target neural network classification model to obtain the classification result.

[0054] When any input image to be classified is received (denoted as...) When the input image is obtained, regardless of whether it is a clean, natural image or an attack sample that may contain adversarial perturbations, the exact same sequence of operations as steps S100 to S400 will be performed. This means that the input image is first acquired, and then the same set of parameters (expansion factor) predefined and fixed in step S200 is called. Spatial phase offset, gap fill value Then, based on these parameters, the signal pixel position of each original pixel in the image in the extended space is calculated. Finally, the extended representation of the input image is generated through direct mapping and constant padding. This process introduces no randomness; it is completely deterministic and consistent with the training phase.

[0055] After completing the above transformation, the generated extended representation The input is fed into the target neural network classification model that has been trained in step S500, and a forward propagation computation is performed. The model classifies the input based on the decision boundary it has learned in the high-dimensional sparse representation space, and finally outputs the classification result.

[0056] It is important to note that because the inference phase applies the exact same structured transformation to the input as the training phase, the model can operate stably in its familiar representation space, characterized by sparse grid points and constant gaps. More importantly, this consistency mechanism fundamentally disrupts the propagation path of transfer-based black-box attacks: such as... Figure 4 and Figure 8 As shown, the adversarial perturbation generated by the attacker based on an alternative model trained on the original dense image. This method targets the original image space. After the perturbed image undergoes the extended embedding of this invention, its perturbed structure is completely reconstructed in the extended space. Experimental data shows that the average gradient cosine similarity between the surrogate model and the target model in the extended space is as low as 0.019, exhibiting near-orthogonality. This subspace mismatch caused by the inconsistency of the representation space makes previously effective attack directions almost ineffective in the face of the target model, thus significantly reducing the transferability of adversarial examples. At the same time, due to the consistency of the transformation, clean samples can also be accurately classified in the extended space, thereby ensuring the practical accuracy of the model.

[0057] like Figure 4 The training phase flowchart is shown. During training, for the original input image... First, the extended representation is obtained by applying the SBDE embedding proposed in this invention. ,in Indicated by the expansion factor Spatial phase shift and gap fill value The commonly defined dimension expansion embedding function (i.e., the operation described in steps S300 to S400). Fill the constant gaps with values. Then, Input target model Perform forward propagation and calculate cross-entropy loss. The gradient of the loss with respect to the input is calculated through backpropagation. (here) This represents the loss function with respect to the original input. gradient, This gradient value is then used to update the model parameters. This process enables the target model to learn stable discriminative features on an extended representation space consisting of sparse grid points and constant gaps.

[0058] like Figure 4 As shown in the inference phase (defense) flowchart, in a migratory black-box attack scenario, the attacker first bases their attack on the original image... Train a proxy model and use it to generate adversarial examples using attack algorithms such as PGD, BIM, and TIFGSM. When the defense system receives an image to be classified, it performs the exact same SBDE embedding as during the training phase to obtain an extended representation. Finally, this extended representation is input into the trained target model. Output classification results And simultaneously evaluate the model's accuracy on clean samples and adversarial samples (i.e., clean accuracy and robust accuracy).

[0059] To further optimize the matching of computational overhead and receptive field, this invention also includes an optional front-end sampling coupling step. In practical deployment, this can be adjusted according to the expansion factor. and phase shift and The kernel size of the first convolutional layer in the target neural network classification model Step length and filling The settings are configured so that the receptive field of the first convolutional layer samples signal pixels and structural anchor points according to a preset relationship, thereby controlling the resolution and computational cost of the output feature map and maintaining an effective receptive field. For example, when the expansion factor... At this time, a larger convolutional kernel and an appropriately increased stride can be used to reduce the size of subsequent feature maps while maintaining sampling coverage; under different stride and padding combinations, the optimal... This can be determined through offline verification or grid search. This coupled design allows the method of this invention to flexibly adapt to various mainstream network architectures, achieving plug-and-play lightweight acceleration.

[0060] To verify the impact of different parameter settings on defense performance, this invention examines the expansion factor. A systematic ablation experiment was conducted using phase-shifted topology. Experimental results show that: when When the embedding sparsity is 3, it is insufficient to completely block gradient propagation, resulting in limited improvement in black-box robustness; when At times, low information density leads to a decrease in the recognition rate of clean samples; when At the same time, it forms the best non-resonant coupling with the convolution stride and pooling operations commonly used in ResNet, achieving the best average robustness (see Table 1 below).

[0061] In addition, two embedding topologies were compared: 1) Corner alignment: This makes the signal pixel located in each Corner points of a local block.

[0062] 2) Center alignment: This makes the original pixel located in each The center of the local block, and a symmetrical constant buffer zone is formed around it.

[0063] Experimental data show that corner alignment is about 0.35% more robust than center alignment when defending against alternative models based on architectures such as ViT. This indicates that introducing additional phase offset can further disrupt the spatial assumptions of black-box attackers and enhance the defense effect.

[0064] To verify the effectiveness of the method in practical tasks, image classification experiments were conducted on the CIFAR-10 and ImageNet-100 datasets, and compared with several existing defense methods. The experimental setup was as follows: the target model was ResNet-18, with a naturally trained ResNet-18 model used as an alternative (for generating transfer-based black-box attacks). Defense methods included natural training, adversarial training (FGSM-AT, PGD-AT, MART-AT), and the method of this invention (SBDE). Evaluation metrics included clean sample accuracy and robust accuracy under various black-box attacks, such as PGD, Transfer-AAT, IFGSM, APGD, FAB, APGDBIM, and DeepFool. Finally, the average robust accuracy (AVG) was calculated.

[0065] Table 1: Adversarial robustness accuracy (%) of different adversarial defense methods against black-box attacks on the CIFAR-10 dataset (alternative model: naturally trained ResNet-18). The "Defense" section lists the evaluated adversarial defense methods.

[0066]

[0067] Table 1 shows the results on the CIFAR-10 dataset. As can be seen, the method of this invention (SBDE) achieves 95.71% accuracy on clean samples, a 2.61% improvement over 93.10% achieved by natural training. Simultaneously, it achieves an average black-box robust accuracy of 70.37%, significantly higher than 48.57% achieved by natural training, and even surpassing many adversarial training methods. When SBDE is combined with PGD-AT (PGD-AT-SBDE), the average robust accuracy is further improved to 72.94%.

[0068] Table 2: Adversarial robustness accuracy (%) of different adversarial defense methods against black-box attacks on the ImageNet-100 dataset (alternative model: naturally trained ResNet-18). The "Defense" section lists the adversarial defense methods evaluated.

[0069]

[0070] Table 2 shows the results on the ImageNet-100 dataset. The method of this invention (SBDE) achieves an accuracy of 85.60% on clean samples, which is higher than 82.00% for natural training. The average black-box robust accuracy is 69.98%, which is far superior to 3.09% for natural training and also outperforms most adversarial training methods.

[0071] Table 3: Robust accuracy (%) of ResNet-18 on CIFAR-10 under white-box attacks. The attacker is fully aware of the defense mechanisms, including the expansion factor. The transformation parameter Δ is used, and end-to-end optimization is performed on the composite model.

[0072]

[0073] Furthermore, robustness in white-box attack scenarios was evaluated, i.e., when the attacker is fully aware of the defense mechanisms (including the expansion factor). (with phase shift parameters), and end-to-end optimization for the composite model. Table 3 shows the white-box attack results of the SBDE model on CIFAR-10. It can be seen that although the robustness of white-box attacks is reduced (the average robust accuracy is only 6.99%), this invention is mainly designed for transfer-based black-box threat models and can be combined with complementary techniques such as adversarial training to improve robustness under stronger attacks (as shown in PGD-AT-SBDE in Tables 1 and 2).

[0074] The above experimental results fully demonstrate the superiority of the method of the present invention under the transferable black-box threat model: without adversarial training, it not only significantly improves the identification accuracy of clean samples, but also effectively reduces the transferability of adversarial perturbations, and achieves a synergistic improvement in clean accuracy and black-box robustness.

[0075] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor and a memory, wherein the processor is configured to implement the steps of the method when executing a computer program stored in the memory.

[0076] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0077] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0078] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0079] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0080] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An image classification method for migration-based black-box adversarial defense, characterized in that, Includes the following steps: Obtain the input image to be classified; Determine the predefined spread factor, spatial phase offset, and gap fill value; Based on the expansion factor and the spatial phase offset, calculate the signal pixel position of each original pixel in the input image in the expanded high-dimensional space; The pixel values ​​of each original pixel are directly mapped to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation, and the gap padding values ​​are filled in the high-dimensional space except for all signal pixel positions. The target neural network classification model is trained using the extended representation obtained from the above steps; When inferring on the trained target neural network classification model, the same acquisition, determination, calculation, mapping and filling operations are performed on the input image, and the resulting extended representation is input into the target neural network classification model to obtain the classification result.

2. The image classification method for migration-based black-box adversarial defense as described in claim 1, characterized in that, The method for calculating the signal pixel position corresponding to each original pixel in the input image in the expanded high-dimensional space includes: For the input image Each spatial location ,in, , Based on the expansion factor and the spatial phase offset, its coordinate position in the expanded high-dimensional space is calculated using the following formula. : in, This represents the original input image, with a size of [size missing]. , Image height, Image width, The number of image channels. Represents the original input image Spatial location index in For row index, For column indexes, Indicates the expansion factor. and These represent the spatial phase offset, which are the offset values ​​in the height and width directions, respectively. For the new altitude direction coordinates, The coordinates for the new width direction; All calculated coordinate positions Constituting the set of signal pixel locations .

3. The image classification method for migration-based black-box adversarial defense as described in claim 2, characterized in that, The method of directly mapping the pixel values ​​of each of the original pixels to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation includes: Based on the expansion factor and the spatial phase offset, construct a system with a size of The extended tensor; Initialize all elements in the extended tensor to the gap fill value; For each channel of the original input image ch And for each spatial location, based on the corresponding coordinates in the set of signal pixel locations, the original pixel value is... Directly assign the value to the channel in the extended tensor ch Coordinate position The element at that location.

4. The image classification method for migration-based black-box adversarial defense as described in claim 3, characterized in that, The gap fill value is a constant between 0 and 1.

5. The image classification method for migration-based black-box adversarial defense as described in claim 2, characterized in that, The spatial phase offset value is determined using either corner alignment or center alignment: Among them, corner alignment This allows the original pixel to be located in each of the expanded high-dimensional spaces. The corner positions of a local block; Among them, center alignment This makes the original pixel located in each The center of the local block, and a symmetrical constant buffer zone is formed around it.

6. The image classification method for migration-based black-box adversarial defense as described in claim 1, characterized in that, The training phase includes: For each sample in the training set, perform the acquisition, determination, calculation, mapping, and padding operations to obtain the extended representation; The extended representation is input into the target neural network classification model, and forward and backward propagation are performed to update the model parameters.

7. The image classification method for migration-based black-box adversarial defense as described in claim 1, characterized in that, The reasoning phase includes: For any input image to be classified, including images with adversarial perturbations, perform the exact same acquisition, determination, computation, mapping, and filling operations as in the training phase; The resulting extended representation is input into the trained target neural network classification model, and the classification result is output.

8. The image classification method for migration-based black-box adversarial defense as described in claim 1, characterized in that, It also includes the front-end sampling coupling step: Based on the expansion factor, i.e. the spatial phase offset, the kernel size, stride, and padding of the first layer of the target neural network classification model are set. This ensures that the receptive field of the first convolutional layer satisfies the preset relationship between the sampling of signal pixels and structural anchor points, controls the resolution and computational cost of the output feature map, and maintains an effective receptive field.

9. An image classification apparatus for performing the image classification method according to any one of claims 1-8, characterized in that, include: An input acquisition module is used to acquire the input image; A parameter determination module is used to determine the expansion factor, the spatial phase offset, and the gap fill value; The position calculation module is used to calculate the position of the signal pixel corresponding to each original pixel in the input image in the expanded high-dimensional space based on the expansion factor and the spatial phase offset. The extended embedding module directly maps the pixel values ​​of each original pixel to the high-dimensional space according to their corresponding signal pixel positions to form an extended representation, and fills the gap padding value in the high-dimensional space except for all signal pixel positions; The model training module uses the extended representation obtained in the above steps to train the target neural network classification model; The classification inference module is used to perform the same acquisition, determination, calculation, mapping and filling operations on the input image when inferring on the trained target neural network classification model, and input the obtained extended representation into the target neural network classification model to obtain the classification result.

10. A computer-readable storage medium storing a computer program thereon, characterized in that, The computer program, when run by a processor, performs the steps of the image classification method for migratory black-box adversarial defense as described in any one of claims 1-8.

Images