A deep learning model robustness enhancement method against adversarial sample attacks

Abstract

The application relates to the technical field of deep learning security, and discloses a deep learning model robustness enhancement method for an adversarial sample attack, which mixes original training data and adversarial attack samples into a deep neural network, smoothes hidden layer feature maps in the middle, and outputs reconstructed feature maps; the mean square error of feature expression of original samples and adversarial samples is calculated to obtain a feature alignment loss, and model parameters are updated in combination with a classification cross-entropy loss; a security benchmark library is constructed based on correctly classified samples, a feature vector and a predicted category of an online input sample are extracted, Mahalanobis distance of the feature vector and the security benchmark library is calculated to obtain an abnormal score, and if the score is greater than a preset threshold, the sample is intercepted. The application can inhibit high-frequency noise caused by adversarial disturbance, accurately quantize feature deviation degree, and intercept abnormal samples, thereby improving the robustness of the model in defending unknown attacks.

Description

Technical Field

[0001] This invention relates to the field of deep learning security technology, specifically to a method for enhancing the robustness of deep learning models against adversarial example attacks. Background Technology

[0002] Although deep neural networks are widely used, they are extremely vulnerable to small perturbations in adversarial examples during the inference phase, which can lead to misjudgments and severely limit their deployment in security-critical scenarios.

[0003] Currently, existing defenses largely rely on conventional adversarial training, which is prone to overfitting to specific perturbations and exhibits poor generalization against unknown attacks. Furthermore, they ignore the anomalous high-frequency noise generated by minute perturbations during forward propagation in the network's hidden layers. Relying solely on end-level classifier optimization lacks intermediate-level spatial denoising and feature consistency constraints, failing to fundamentally repair feature corruption. In addition, existing detection techniques largely depend on end-level probability prediction, making it difficult to identify high-confidence adversarial examples. They lack the ability to mine normal data feature manifolds and construct statistical security benchmarks, making it impossible to accurately quantify the degree of anomalies. Moreover, existing models are mostly static and fixed after deployment, lacking closed-loop collection and adaptive update mechanisms for online interception samples, making them ill-equipped to cope with constantly evolving attack techniques. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method for enhancing the robustness of deep learning models against adversarial attacks. This method solves the problem that existing defense methods lack smoothing and consistency constraints on intermediate features of deep networks, leading to severe deviations in feature space distribution due to adversarial perturbations.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for enhancing the robustness of deep learning models against adversarial example attacks, comprising the following steps: The original training dataset is acquired, and adversarial attack samples are generated. These are then combined to form a hybrid training dataset, which is input into a deep neural network for forward propagation. Spatial dimension smoothing is applied to the feature maps of the intermediate hidden layers of the deep neural network, and reconstructed feature maps are output. Subsequently, the mean squared error of the feature representations of the original samples and adversarial samples is calculated to obtain the feature alignment loss. This loss is combined with the classification cross-entropy loss of the prediction results from the forward propagation output to construct a joint loss function. The model parameters are then updated using the backpropagation algorithm. After the model update, correctly classified samples are extracted to construct a security benchmark library. During the online detection phase, the Mahalanobis distance between the features of the online input samples and the security benchmark library is calculated to obtain an anomaly score. Anomaly samples are then intercepted based on a preset threshold.

[0006] In the smoothing process of the intermediate hidden layer feature map, the feature map is flattened in terms of spatial dimensions, and a linear mapping is performed using a convolutional layer to extract mapped features of different dimensions. A feature similarity weight matrix is ​​constructed by calculating the dot product between different mapped features and performing summation and normalization. This weight matrix is ​​multiplied by the feature vector and aggregated across spatial locations to achieve spatial smoothing of abnormal high-frequency noise. After restoring the dimensions of the aggregated features and multiplying them with the scaling parameter, the features are added element-wise to the original feature map to complete feature reconstruction.

[0007] For generating adversarial attack samples, an adaptive adjustment factor is calculated using a decay mapping function based on the cross-entropy loss of forward propagation. The dynamic update amount is calculated by combining the gradient sign value, the base step size, and this adjustment factor. Multi-step iterations and projection operator truncation are then performed on the perturbation amount to generate adversarial attack samples superimposed on the original input samples.

[0008] Furthermore, this invention divides the deep neural network into a feature extractor and a classifier, and selects the output node of the global average pooling layer in the deep neural network as the target constraint point. At this node, the original feature representation of the original input sample and the adversarial feature representation of the adversarial attack sample are extracted, and the mean squared error of the feature representation is calculated to obtain the feature alignment loss.

[0009] When constructing a safety benchmark library based on correctly classified samples, benchmark feature vectors are extracted using a clean offline dataset. The prototype mean vector and the regularized feature covariance matrix are calculated according to the true category to construct the safety benchmark library. During online detection, the Mahalanobis distance between the test feature vector and the normal feature distribution is calculated using the inverse of the regularized feature covariance matrix as the anomaly score. For samples determined to be normal, their feature vectors are included in a dynamic update pool, and the prototype mean vector of the category is smoothly updated using an exponential moving average mechanism. For intercepted samples, they are stored in an isolated region to construct a dynamic adversarial sample pool. After reaching the update batch threshold, they are re-labeled and added to the training dataset. The updated training dataset is then used to re-execute the training steps of joint optimization of feature space denoising and feature consistency constraints to obtain the updated deep neural network model parameters.

[0010] This invention provides a method for enhancing the robustness of deep learning models against adversarial example attacks. It offers the following advantages: 1. This invention mixes adversarial examples with the original data and inputs them into a neural network, performing spatial smoothing on the hidden layer feature maps. This method can directly suppress high-frequency noise caused by perturbations, reduce the feature differences between the two, and improve the model's accuracy and robustness against unknown attacks.

[0011] 2. This invention utilizes the features of correctly classified samples to calculate the mean and covariance matrix to construct a secure benchmark library. During inference, the anomaly score is obtained by calculating the Mahalanobis distance between the input features and the benchmark. This mechanism can accurately quantify the sample deviation without changing the original network structure, intercept adversarial attacks, and reduce security risks.

[0012] 3. This invention introduces a closed-loop online update mechanism, which isolates intercepted abnormal samples to build a dynamic adversarial sample pool. When the number of samples reaches a preset threshold, they are re-labeled and added to the training set to iteratively optimize the model. This mechanism enables the model to continuously learn new attack patterns, solving the problem of diminishing defensive capabilities of traditional static models. Attached Figure Description

[0013] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a bar chart comparing the classification accuracy of the present invention. Figure 3 This is a bar chart showing the distribution of Mahalanobis distance anomaly scores according to the present invention. Figure 4 This is the ROC curve for adversarial sample detection in this invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] See attached document Figure 1 This invention provides a method for enhancing the robustness of deep learning models against adversarial example attacks, and the system for implementing this method includes: The adaptive adversarial sample generation module, feature space denoising module, feature consistency constraint module, and robust real-time monitoring module are all included. During the model training phase, the adaptive adversarial sample generation module obtains the original training dataset.

[0016] The adaptive adversarial sample generation module calculates an adaptive adjustment factor based on the current training loss state of the deep neural network. Based on the adaptive adjustment factor, the module generates adversarial attack samples corresponding to the original training dataset. The module then mixes the adversarial attack samples with the original training dataset to form a hybrid training dataset. The system inputs the hybrid training dataset into the deep neural network for forward propagation.

[0017] During the forward propagation of the deep neural network, the feature space denoising module obtains the feature maps of the intermediate hidden layers of the deep neural network. Based on the principle of nonlocal mean filtering, the feature space denoising module performs spatial domain smoothing on the feature maps and outputs the reconstructed feature maps to the next layer of the deep neural network. After the forward propagation is completed, the deep neural network outputs the prediction results of the original samples and adversarial attack samples, and at the same time outputs the feature representations of the original samples and adversarial attack samples in the hidden layers.

[0018] The feature consistency constraint module obtains the first feature expression of the original sample in the hidden layer and the second feature expression of the adversarial attack sample in the hidden layer. The feature consistency constraint module calculates the mean square error between the first feature expression and the second feature expression to obtain the feature alignment loss. The system calculates the classification cross-entropy loss based on the prediction results. The system weights and sums the classification cross-entropy loss and the feature alignment loss according to preset weights to obtain the joint loss function.

[0019] The system calculates the network gradient based on the joint loss function and updates the model parameters of the deep neural network through the backpropagation algorithm until the model training converges. During the model inference phase, the model parameters of the deep neural network are fixed, and the robustness real-time monitoring module obtains the correctly classified samples in the training dataset.

[0020] The robust real-time monitoring module inputs correctly classified samples into a deep neural network to extract deep feature vectors of the samples. Based on the deep feature vectors, the robust real-time monitoring module calculates the mean vector and covariance matrix of each category to construct a safety benchmark for each category. The system obtains test samples and inputs them into the deep neural network. The feature space denoising module smooths the intermediate feature maps during the forward inference process of the deep neural network.

[0021] The deep neural network outputs the predicted category of the test sample and the corresponding deep feature vector. The robust real-time monitoring module obtains the deep feature vector and calculates the Mahalanobis distance between the deep feature vector and the safety benchmark corresponding to the predicted category. The Mahalanobis distance is used as the anomaly score of the test sample.

[0022] The robust real-time monitoring module compares the anomaly score with a preset safety threshold.

[0023] If the anomaly score is greater than the preset security threshold, the robust real-time monitoring module determines that the test sample is a malicious attack input and intercepts the test sample. If the anomaly score is not greater than the preset security threshold, the system outputs the predicted category of the test sample as the final classification result.

[0024] In the specific implementation of the adaptive adversarial sample generation module, the system performs the following initialization operations to build the basic data environment for adversarial training.

[0025] The system executes step S201 to obtain the original training dataset. The original training dataset is set as... .in, This represents the total number of training samples. Indicates the first One original input sample. This represents the dimension of the input sample. In image processing tasks, dimension... It is typically composed of the number of channels, height, and width of the image. Indicates the relationship with the first One original input sample The system divides the original training dataset into predefined batch sizes for subsequent iterations.

[0026] The system executes step S202, configuring the hyperparameters of the adaptive perturbation generation mechanism. The configured hyperparameters include the maximum perturbation boundary. Basic attack stride Maximum number of iterations and temperature hyperparameters Maximum perturbation boundary This is used to constrain the generation range of adversarial perturbations. To prevent the generated perturbations from corrupting the original semantic information of the image, a [specific method / mechanism] is employed. The norm space constrains the perturbation. In the specific implementation of lower-level features, the system adopts... The norm, as a metric, ensures that the maximum absolute error between the corresponding pixel positions of the original input sample and the adversarial attack sample does not exceed [a certain value]. Basic attack stride Used to control the distance of a single update during projective gradient descent. Maximum number of iterations. A multi-step iterative process used to terminate perturbations. Temperature hyperparameter. Used to control the sensitivity of the training loss state to the mapping of an adaptive adjustment factor.

[0027] The system executes step S203, reading the original input samples from the current training batch. and their corresponding real tags and initialize the initial disturbance. To prevent overfitting of the model under a fixed perturbation mode, the system is configured within a certain value range. The initial disturbance is generated by uniformly distributed random sampling. Specifically, the system targets the original input samples. Each dimension element is randomly sampled independently, resulting in an initial perturbation. The tensor shape and the original input sample The tensor shape remains consistent. The system will maintain the initial perturbation. Superimposed on the original input sample The initial adversarial attack sample is generated.

[0028] The system executes step S204 to calculate the initial loss state of the model. The system inputs the initial adversarial attack sample into the current parameters. In a deep neural network, the deep neural network performs forward propagation calculations and outputs the raw network output value for the initial adversarial attack sample. The system inputs the raw network output value into the Softmax activation function for normalization processing, obtaining the predicted probability distribution for the initial adversarial attack sample. The system then obtains the predicted probability distribution and the ground truth label. Calculate the initial cross-entropy loss Initial cross-entropy loss The calculation formula is as follows: ; in: This indicates the total number of categories for the classification task; Indicates real label The one-hot encoded vector corresponding to the first The truth value of the class; it can be 0 or 1. Indicates the corresponding number in the predicted probability distribution. The probability value of the class.

[0029] In the specific implementation of the adaptive adversarial sample generation module, the system executes the following dynamic feedback mechanism based on the acquired initial loss state.

[0030] The system executes step S205 to obtain the current iteration step number. The corresponding training loss state. Let the current iteration step be... ,in The value range is 0 to The system retrieves the integer. step disturbance amount The disturbance amount Superimposed on the original input sample Above, generate the first The system extracts the current adversarial attack sample during multi-step iterations and inputs it into a deep neural network. The deep neural network performs forward propagation calculations and outputs the raw network output value for the current adversarial attack sample. The system inputs the raw network output value into a Softmax activation function for normalization to obtain the predicted probability distribution for the current adversarial attack sample. The system obtains the predicted probability distribution and combines it with the ground truth labels. Calculate the cross-entropy loss at the current step. Current step cross-entropy loss This reflects the model's effect on the first parameter under the current parameter state. The classification error of the adversarial attack samples.

[0031] The system executes step S206, calculating the adaptive adjustment factor. The system will use the cross-entropy loss of the current step. As an input variable, the adaptive adjustment factor is calculated using a preset decay mapping function. The calculation formula is as follows: ; in: This represents an exponential function with the natural constant as its base. This indicates temperature hyperparameters. The system uses temperature hyperparameters... Control the cross-entropy loss of the current step For adaptive adjustment factor The numerical impact of the cross-entropy loss in the current step. When the value is large, the system outputs a smaller adaptive adjustment factor to reduce the magnitude of subsequent perturbation updates. This applies when the current step's cross-entropy loss... When the value is small, the system outputs an adaptive adjustment factor close to 1 to maintain the original attack strength.

[0032] The system executes step S207, performing numerical truncation on the adaptive adjustment factor. To ensure the numerical stability of subsequent gradient update calculations, the system pre-sets a minimum scaling threshold in memory. The minimum scaling threshold It is a real number greater than zero and less than 1. The system will calculate the adaptive adjustment factor. With minimum scaling threshold Perform numerical comparison. If the adaptive adjustment factor... Less than the minimum scaling threshold The system will reset the value of the adaptive adjustment factor to This truncation operation ensures that the adversarial perturbation generation process maintains its update capability even when the cross-entropy loss is significant.

[0033] In the specific implementation of the adaptive adversarial sample generation module, after obtaining the adaptive adjustment factor, the system executes the following perturbation iteration and sample synthesis mechanism to finally generate adversarial data for training.

[0034] The system executes step S208, calculating the gradient vector of the loss function with respect to the input samples. The system uses the cross-entropy loss from the current step. The cross-entropy loss of the current step is obtained by performing backpropagation calculation through a deep neural network. Compared to the first The partial derivatives of each dimension of the current adversarial attack sample are used to form the gradient vector.

[0035] The system executes step S209, calculating the dynamic update amount over multiple iterations. The system uses a sign function to extract the sign values ​​of each dimension element in the gradient vector, ensuring the update direction increases along the direction of the current step's cross-entropy loss. The system then uses this sign value and the base attack step size... and adaptive adjustment factor Perform element-wise multiplication to obtain the dynamic update value for the current step. The system then adds the dynamic update value to the next step. step disturbance amount Up, get the first The unprojected perturbation of the step.

[0036] The system executes step S210, performing a projection operation on the disturbance space. This is to ensure that the final generated disturbance conforms to the set maximum disturbance boundary. Furthermore, the superimposed sample is within the range of valid data values, and the system performs the following on the first... The unprojected perturbation is then subjected to a projection operator. In the specific implementation of the lower-level features, the system compares each element value in the unprojected perturbation with a preset boundary interval. The system performs a comparison. If the element value exceeds the range, the system will forcibly truncate the element value to the corresponding boundary value. or , obtained the step disturbance amount Subsequently, the system will... step disturbance amount Superimposed on the original input sample The values ​​of each dimension after superposition are then forcibly truncated to the physically valid range of the input data. The complete calculation formula for the above multi-step iterative update process is as follows: ; in: Indicates the first The amount of disturbance in the step. This represents the projection operator. This represents a sign function that outputs 1 when the input is greater than zero, -1 when the input is less than zero, and 0 when the input is equal to zero. This represents the gradient operator with respect to the input variable. This represents the cross-entropy loss function.

[0037] The system executes step S211, updating the iteration step count and determining whether the termination condition is met. The system will then update the iteration step count. The value is incremented by 1. The system will update the iteration step count. With maximum number of iterations Perform numerical comparison. If the number of iterations... Less than the maximum number of iterations The system returns to the steps of extracting the current adversarial attack sample and calculating the cross-entropy loss of the current step, and then proceeds to the next iteration. If the number of iteration steps... Equal to the maximum number of iterations The system terminates the multi-step iterative process.

[0038] The system executes step S212, synthesizing adversarial attack samples and a mixed training dataset. After the multi-step iterative process terminates, the system stores the first... step disturbance amount Extract it. The system will then extract the first... step disturbance amount Superimposed on the original input sample Generate adversarial attack samples. The system performs the above generation steps in parallel or sequentially on all original input samples in the current training batch to obtain adversarial batch data composed of multiple sets of adversarial attack samples. The system concatenates the adversarial batch data with the current training batch of the original training dataset according to a preset ratio to form a hybrid training dataset. The system then feeds the hybrid training dataset into a deep neural network for subsequent forward propagation and feature extraction calculations.

[0039] In the specific implementation of the feature space denoising module, in order to block the propagation and amplification of adversarial perturbations in the adversarial attack samples at the architecture level, the system performs the following denoising unit embedding operation in the forward propagation computation graph of the deep neural network.

[0040] The system executes step S301 to obtain the hierarchical structure of the deep neural network. The deep neural network consists of multiple sequentially connected feature extraction layers or residual stages. The feature maps of shallow network regions contain texture information such as object edges and colors. Performing global smoothing operations in shallow network regions can lead to the loss of image details. The feature maps of deep network regions undergo pooling operations, compressing their spatial resolution and failing to provide sufficient pixel data for spatial self-similarity calculations. The system sets the mid-to-high-level semantic feature extraction stages as candidate embedding intervals for feature smoothing units.

[0041] In step S302, the system determines the specific embedding node based on the spatial resolution and channel dimension of the feature map. Taking a residual network architecture as an example, the system selects the layer between the third and fourth residual stages in the residual network as the target embedding node. At this target embedding node, the feature map has the spatial size required to capture spatial dependencies and can separate abnormally high-frequency activation signals from semantic features.

[0042] The system executes step S303, connecting a feature smoothing unit at the target embedding node. The system modifies the data transmission path at the target embedding node. The system obtains the output features of the previous layer at the target embedding node, uses these output features as the input to the feature smoothing unit, and defines them as the first... The input feature map of the layer is denoted as The system sets the input feature map. The tensor dimension is .

[0043] ; in: It represents the set of real numbers. Represents the input feature map The number of channels. Represents the input feature map Spatial height. Represents the input feature map Spatial width. The system will input feature maps. The data is fed into the feature smoothing unit for computation. The system sets the tensor dimension of the reconstructed feature map output by the feature smoothing unit to be the same as that of the input feature map. To maintain consistency, the integration of the feature smoothing unit does not alter the original channel and parameter dimension matching relationships of the deep neural network. The system then passes this reconstructed feature map to the next layer of the deep neural network to continue subsequent feature extraction and classification forward propagation.

[0044] In the specific implementation of the feature space denoising module, the system acquires the input feature map at the target embedding node. Then, perform the following spatial feature self-similarity calculation steps to obtain the degree of pixel association within the global spatial range of the feature map.

[0045] The system executes step S304, processing the input feature map. Spatial flattening is performed. The system acquires the input feature map. Based on the input feature map Space height and space width Calculate the total number of spatial locations The calculation formula is: The system will input feature maps. Reshaping in spatial dimension, from tensor dimension... Convert to The flattened feature map contains There are 1 spatial location, and each spatial location corresponds to a length of 1. eigenvectors.

[0046] The system executes step S305, performing feature dimensionality reduction and linear mapping on the flattened feature map. The system uses a convolutional layer with a kernel size of 1×1 as the mapping operator. The system utilizes the corresponding first linear mapping function. The first convolutional layer on the input feature map The system performs calculations to obtain the first mapping feature. The system then utilizes the corresponding second linear mapping function. The second convolutional layer on the input feature map The calculation is performed to obtain the second mapping feature. The channel dimension of both the first and second mapping features is set to the number of channels of the mapping feature. The number of mapping feature channels Smaller than the input feature map Number of channels The aforementioned implementation of lower-level features based on 1×1 convolution provides independent query features and key features for similarity calculation.

[0047] The system executes step S306, calculating the inner product between each pair of global spatial locations. The system extracts spatial locations from the first mapping features. The corresponding first mapping feature vector is used to extract spatial location from the second mapping feature vector. The corresponding second mapped feature vector. The system calculates the dot product of the first and second mapped feature vectors. The system divides the dot product result by a scaling factor. The scaling factor is set to the number of mapped feature channels. The square root, that is The scaling factor is used to prevent excessively large absolute values ​​in high-dimensional dot product calculations, thus avoiding gradient vanishing phenomena caused by subsequent activation function operations.

[0048] The system executes step S307, generating feature similarity weights based on a normalized Gaussian kernel function. The system inputs the scaled dot product result into an exponential function, spanning all spatial locations. After performing summation and normalization, the spatial location is calculated. and spatial location Feature similarity weights between The calculation formula is as follows: ; in: Indicates spatial location and spatial location Feature similarity weights between them. This represents an exponential function with the natural constant as its base. This represents the first linear mapping function. Represents the input feature map In spatial location The feature vector after being processed by the first linear mapping function. This represents the second linear mapping function. Represents the input feature map In spatial location The feature vector after processing by the second linear mapping function. (Superscript) This represents the matrix transpose operation. This indicates the number of mapping feature channels. This represents the total number of spatial locations. The system iterates through all combinations of spatial locations, constructing a system of size [size missing]. The feature similarity weight matrix records the input feature map. The semantic association strength between all pixel pairs within the area.

[0049] In the specific implementation of the feature space denoising module, after calculating and obtaining the feature similarity weight matrix, the system performs the following smooth reconstruction steps for abnormal high-frequency noise in order to suppress feature activation anomalies induced by adversarial attack samples.

[0050] The system executes step S308, constructing a third linear mapping function to extract feature value representations. The system utilizes a third convolutional layer on the input feature map. Perform linear mapping calculations. The third convolutional layer corresponds to the third linear mapping function. The kernel size is set to 1×1. The system will input the feature map. After being flattened along the spatial dimension, the input is fed into the third convolutional layer to obtain the input feature map. The feature vectors after mapping at each spatial location. To reduce the computational complexity of the global aggregation operation, the system sets the output channel dimension of the third convolutional layer to the number of mapped feature channels. This feature vector is used as the value feature for subsequent global aggregation.

[0051] The system executes step S309, performing global feature aggregation based on the feature similarity weight matrix. The system extracts spatial location. and spatial location Feature similarity weights between and input feature map In spatial location The feature vector is processed by the third linear mapping function. The system then assigns feature similarity weights. Perform a scalar-vector product operation with the eigenvector. The system iterates through all spatial location combinations and performs cross-spatial location operations on the product result. The spatial location is obtained by summing the sums. The corresponding aggregated feature vector. This aggregation calculation process uses global semantic similarity as a weight guide. Since adversarial perturbations usually manifest as isolated and anomalously high-frequency responses in the feature space, they cannot be matched with high-weight similar pixels globally. Therefore, during the weighted summation process, they are covered by the values ​​of normal semantic features, achieving spatial smoothing of anomalously high-frequency noise.

[0052] The system executes step S310, performing channel dimension recovery and residual reconstruction operations. The system will then determine the spatial location... The corresponding aggregated feature vector is input to the output convolutional layer. The output convolutional layer outputs a linear mapping function. Its convolutional kernel size is 1×1. The system uses the output convolutional layer to change the channel dimension of the aggregated feature vector from the number of feature channels. Restore to the input feature map Same number of channels To maintain gradient stability during the initial training phase of the network, the system sets a learnable scaling parameter. Its initial value is set to zero. The system will restore the aggregated feature vector after dimension recovery and the scaling parameter. Multiply them and then combine the product with the input feature map. In spatial location eigenvectors Perform element-wise addition to obtain the spatial location of the reconstructed feature map. Reconstructed feature vectors The calculation formula for the above smooth reconstruction process is as follows: in: Indicates the spatial location of the reconstructed feature map The reconstructed feature vector. Represents the input feature map In spatial location eigenvectors. This represents the learnable scaling parameters. This indicates that the output is a linear mapping function. This represents the third linear mapping function. Represents the input feature map In spatial location The feature vector after processing by the third linear mapping function.

[0053] The system executes step S311, outputting and transmitting the reconstructed feature map. The system traverses all spatial locations. The system calculates the complete reconstructed feature map. It then reshapes the spatial dimensions of the reconstructed feature map, reducing its tensor dimension from... Restore to The system passes the reconstructed feature map after dimension restoration to the next layer of the deep neural network to continue participating in forward propagation.

[0054] In the specific implementation of feature consistency constraints, the system performs the following feature extraction and constraint point selection operations.

[0055] The system executes step S401, constructing the feature extraction mapping function. The system divides the deployed deep neural network into two independent modules: a feature extractor and a classifier. The system further divides the network structure of the deep neural network, from the input layer to the global average pooling layer, into the feature extractor. The feature extractor corresponds to the feature extraction mapping function. The system-defined feature extraction mapping function It includes the original feature extraction layer of a deep neural network and the aforementioned embedded feature smoothing unit. The system divides the network structure after the global average pooling layer into a classifier, which is used to calculate the prediction probability based on the output of the feature extractor.

[0056] The system executes step S402 to determine the nodes for feature consistency constraints. To reduce the dimensionality of feature vector comparisons, the system selects the output node of the global average pooling layer in the computational graph of the deep neural network as the target constraint point. At the target constraint point, the spatial dimension of the network feature map is compressed by the pooling operation, transforming it into a one-dimensional semantic vector. This semantic vector retains the global semantic information processed by the feature space denoising module.

[0057] The system executes step S403 to obtain paired constraint feature vectors. Based on the correspondence from the data synthesis stage, the system matches original input samples belonging to the same image in the mixed training dataset. Adversarial attack samples These samples form homologous sample pairs. The system inputs these homologous sample pairs into a deep neural network for forward propagation computation. At the target constraint point, the system extracts the original input samples. The original feature representation output after processing by the feature extraction mapping function The system captures adversarial attack samples at the target constraint points. The adversarial feature representation output after processing by the feature extraction mapping function The calculation formula for the extraction process is as follows: ; ; in: This represents the feature extraction mapping function. This represents the network parameters of the feature extractor. Original feature representation. Adversarial feature representation All are of length A one-dimensional real vector. Indicates the dimension of the feature extractor's output channels. Obtains paired raw feature representations. Adversarial feature representation Then, the system stores the vector in memory as data input for subsequent calculation of feature consistency loss.

[0058] The system executes step S404, calculating the joint loss function and performing backpropagation update. The system then retrieves the original feature representation stored in memory. Adversarial feature representation The system calculates the mean square error of both in each channel dimension to obtain the feature alignment loss. Feature alignment loss The calculation formula is as follows: ; in: Representing the original feature representation In the Element values ​​in each dimension; Representation of adversarial features In the The system then obtains the element values ​​of each dimension. Subsequently, it acquires the classification cross-entropy loss calculated based on the adversarial attack sample against the training sample. The system will use classification cross-entropy loss. Feature alignment loss The joint loss function is obtained by weighting and summing the results according to preset weights. The formula for calculating the joint loss function is: ,in The system assigns pre-defined feature alignment weights. The system then uses the calculated joint loss function. Calculate the network gradient and update the model parameters of the deep neural network using the backpropagation algorithm until the model training converges.

[0059] After completing the construction of a deep neural network with adversarial robustness, the system performs the following offline construction operation of a security benchmark library to extract the distribution statistical features of normal data in the feature space.

[0060] The system executes step S501 to extract feature representations from clean offline samples. The system acquires a clean offline dataset. This dataset contains original input samples unaffected by adversarial perturbations and their corresponding true class labels. The system inputs each original input sample from the clean offline dataset into a pre-trained deep neural network. At the output node of the global average pooling layer, the system extracts the feature representation output by the feature extraction mapping function. This feature representation is defined as the baseline feature vector. To meet the dimensionality requirements of subsequent outer product matrix calculations, the system reshapes the extracted one-dimensional baseline feature vector into a column vector in the tensor dimension. The formula for calculating the baseline feature vector is as follows: ; in: Indicates the first One baseline feature vector. Indicates the sample index number. This represents the feature extraction mapping function. Indicates the first One original input sample. This represents the network parameters of the feature extractor. Here, the network parameters of the feature extractor are fixed parameters after joint optimization training to reach a convergent state.

[0061] The system executes step S502, calculating the category prototype mean vector for each category feature. The system groups all extracted baseline feature vectors according to the true category label, assigning baseline feature vectors belonging to the same category to the same subset. For each category... The system calculates the arithmetic mean of all baseline feature vectors in the subset of that category, and uses this as the category prototype mean vector in the feature space. The category prototype mean vector is used to characterize the geometric center of each category in the feature space. The calculation formula is as follows: ; in: Indicates the first The class's class prototype mean vector. Indicates the first The number of samples contained in the class. Indicates the first A sample set of classes.

[0062] The system executes step S503, calculating the feature covariance matrix for each category and constructing a safety benchmark library. To obtain the distribution variance and correlation of each category's features across different dimensions, the system performs analysis for each category... Based on the class prototype mean vector Calculate the feature covariance matrix for this category. Characteristic covariance matrix The calculation formula is as follows: ; in: Indicates the first The characteristic covariance matrix of the class. Superscript This represents the matrix transpose operation.

[0063] Because feature vectors extracted from high-dimensional semantic feature spaces may contain redundant information, the directly estimated feature covariance matrix mathematically exhibits a non-full-rank singular state. To ensure that matrix inversion operations in the subsequent distance metric process can be performed correctly, the system performs a feature covariance matrix... Regularization is performed. The system's characteristic covariance matrix... Adding a tiny positive floating-point number to the diagonal elements yields the regularized feature covariance matrix. The system then calculates the class prototype mean vectors for each category. Combined with the regularized feature covariance matrix, a security benchmark library is constructed. The category prototype mean vector and the regularized feature covariance matrix constitute the lower-level feature implementation of the security benchmark library. The system stores the security benchmark library in the device as reference data for identifying adversarial examples during the online inference stage.

[0064] After completing the offline construction of the security benchmark library and entering the online inference stage, the system performs the following real-time feature distribution linkage and anomaly scoring operations to monitor and intercept adversarial attack samples.

[0065] The system executes step S504 to extract the feature representation of the online input samples. The system acquires the online input samples to be detected. The system will accept online sample input. The input is fed into the deployed deep neural network for forward computation. At the output node of the global average pooling layer, the system extracts the value derived from the feature extraction mapping function. The output feature vector. The system reshapes this feature vector into a column vector in the tensor dimension, which serves as the test feature vector. Test feature vectors The calculation formula is as follows: ; in: This represents the test feature vector. This indicates an online input sample. This represents the feature extraction mapping function. This represents the network parameters of the feature extractor.

[0066] The system executes step S505, performing classification prediction and matching with the baseline distribution. The system will then extract the test feature vector. The input is fed into the classifier to obtain the results for the online input samples. The system selects the category with the largest predicted probability distribution as the predicted category. According to the prediction category The system queries the security benchmark database to retrieve and predict categories. Corresponding category prototype mean vector and the regularized eigencovariance matrix .

[0067] The system executes step S506, calculating the Mahalanobis distance and generating anomaly scores. The system bases these scores on the retrieved class prototype mean vectors. With the regularized eigencovariance matrix Calculate the test feature vector The Mahalanobis distance relative to the normal feature distribution of this category. The system's regularized feature covariance matrix. Perform matrix inversion to obtain the inverse matrix of the regularized eigencovariance matrix. The system uses the calculated Mahalanobis distance values ​​as the basis for evaluating online input samples. Abnormal rating Anomaly scoring The calculation formula is as follows: ; in: This indicates an abnormal score. This represents the vector of the class prototype mean for the predicted class. Indicates the prediction category. Superscript This represents the matrix transpose operation. This represents the inverse matrix of the regularized eigencovariance matrix.

[0068] The system executes step S507, making a security decision and triggering a response based on the anomaly score. The system sets anomaly detection thresholds. As a preferred implementation of the lower-level feature, the system calculates the anomaly score of all clean samples in the validation set during the offline phase, and selects the 99th percentile of these scores in ascending order as the anomaly determination threshold. The system will calculate the anomaly score online. With anomaly detection threshold Perform numerical comparisons. If there are abnormal scores... Greater than the anomaly detection threshold The system determines the online input samples. If the input sample is an adversarial example that has been attacked, the system will intercept the online input sample and refuse to output a classification prediction result, while simultaneously logging or issuing a security alert. If an anomaly is detected... Less than or equal to the anomaly detection threshold The system determines the online input samples. As normal samples, output the predicted category. As the final identification result.

[0069] After completing the security decision based on anomaly scoring, the system performs the following interception decision and security closed-loop operation to update the deep neural network model. The system executes step S508, allowing normal samples to pass and dynamically updating the benchmark library. When online input samples... Abnormal rating Less than or equal to the anomaly detection threshold At that time, the system determines it to be a normal sample. The system will predict the category. The final identification result is then passed to downstream business modules. To accommodate the natural shift in the distribution of online input data, the system uses the test feature vector corresponding to the normal sample. The sample is included in the dynamic update pool for this category. Considering the high computational cost of online real-time calculation of the covariance matrix and its inverse, and the potential for matrix singularity due to frequent additions of single samples, the system maintains the regularized feature covariance matrix unchanged during dynamic updates, only updating the category prototype mean vector. The system employs an exponential moving average mechanism to predict the predicted category of the corresponding category in the safety benchmark library. Class prototype mean vector Perform a smooth update. The update calculation formula is as follows: ; in: This represents the updated class prototype mean vector. This represents the smoothing update coefficient, and its value range is set between 0.90 and 0.99.

[0070] The system executes step S509, intercepting and isolating abnormal samples. When a sample is entered online... Abnormal rating Greater than the anomaly detection threshold The system determines that the online input sample is an adversarial sample that has been attacked. The system refuses to pass the classification result of this online input sample to downstream business modules. The system extracts the online input sample. and their corresponding anomaly scores The system stores the intercepted event in a pre-defined isolated area of ​​the memory. It records the time of the intercepted event and the device source information, generating a security alarm log.

[0071] The system executes step S510, constructing a dynamic adversarial sample pool and performing closed-loop iteration. The system continuously collects intercepted samples within the isolated area to construct the dynamic adversarial sample pool. The system monitors the number of samples in the dynamic adversarial sample pool. When the number of samples reaches a preset update batch threshold, the system performs a model update. Due to the misleading nature of adversarial samples, the system outputs the intercepted samples from the dynamic adversarial sample pool to a manual review terminal or an independent auxiliary verification module, where operators or an independent verification system provide re-labeling with true labels. The system supplements the re-labeled samples into the original mixed training dataset, obtaining an updated training dataset. Using the updated training dataset, the system re-executes the training steps of joint optimization of feature space denoising and feature consistency constraints to obtain updated deep neural network model parameters. After the model parameters are updated, the system reconstructs the security benchmark library based on the offline clean dataset, completing the system's security closed-loop iteration.

[0072] Specific application examples: Application Scenarios and Initialization Configuration: This embodiment applies the robustness enhancement method for deep learning models proposed in this invention to a traffic sign recognition system for autonomous vehicles. The model uses ResNet-50 as the base deep neural network, and the input image dimension is... The dataset size is 3×224×224. The original training dataset acquired by the system is GTSRB (German Traffic Sign Recognition Benchmark Dataset). During the initialization phase, the system sets the maximum perturbation boundary. =8 / 255 adopted Norm constraints, basic attack step size =2 / 255, maximum number of iterations =10.

[0073] Model Training Phase: During training, the adaptive adversarial sample generation module generates adversarial samples online targeting the speed limit 80 flag. After perturbation, the original image still appears to be speed limit 80 in human vision, but it induces the unprotected model to recognize it as having lifted the speed limit. The system inputs a mixed batch of clean and adversarial samples into the ResNet-50. Between Stage 3 and Stage 4 of the residual network, the feature space denoising module extracts an intermediate feature map of size 1024×14×14. Spatial self-attention weighted smoothing is applied to the abnormally high-frequency activations induced by the adversarial perturbation through spatial flattening and a Gaussian kernel-based feature similarity weight matrix. Subsequently, the model outputs a one-dimensional feature vector of length 2048 at the Global Average Pooling (GAP) layer. The system calculates the mean squared error feature alignment loss between the original and adversarial images at this layer and combines it with the classification cross-entropy loss... The weights are added together at a ratio of 1.5, and the ResNet-50 weights are updated through backpropagation.

[0074] Model inference and monitoring phase: The model is deployed on the in-vehicle computing platform. In the offline phase, the system extracts 2048-dimensional features from all correctly classified samples in the GTSRB training set, calculates the prototype mean vector and regularized feature covariance matrix for 43 traffic sign categories, and stores them in the in-vehicle safety benchmark library. During autonomous driving, the in-vehicle camera captures the stop sign ahead.

[0075] Scenario A: Normal Input: Input an uncontaminated stop image. The system extracts the test feature vector and calculates its Mahalanobis distance to the stop category safety benchmark, resulting in an anomaly score of 12.4, which is less than a preset threshold, such as the 99th percentile threshold of 45.0. The system allows the sample, outputs a stop command, and uses an exponential moving average mechanism (…). =0.95) Fine-tune the mean vector of the stopping class.

[0076] Scenario B: Malicious Attack: An attacker affixes an adversarial sticker to a stop sign. The network's predicted category may shift to "go straight." In this case, the system calculates the Mahalanobis distance between the extracted feature vector and the straight-ahead baseline database, and the anomaly score spikes to 185.6, far exceeding the threshold of 45.0. The system immediately intercepts this sample, refuses to output a straight-ahead command, triggers the vehicle deceleration and takeover safety mechanism, and stores the intercepted sample in the isolation zone. Once the isolation zone accumulates 500 samples, it is re-labeled and updated in a closed-loop manner in the cloud to the next generation training set.

[0077] Experimental verification and effect comparison: Test datasets: General image classification dataset (formerly CIFAR-10) and German traffic sign recognition benchmark dataset.

[0078] Compared to the baseline model: Standard training method, the conventional standard network training process, without any targeted defense measures; Adversarial training method, using the classic ten-step projective gradient descent algorithm for adversarial training with mixed data; Logical consistency defense method, existing defense models optimized based on classification logic output consistency loss.

[0079] Evaluation metrics: Clean sample accuracy, the model's classification accuracy on normal test samples without any interference; Robust accuracy, the classification accuracy of the twenty-step projective gradient descent algorithm under a strong attack with the maximum perturbation boundary set at pixel values ​​of 8 / 255.

[0080] Area under the anomaly detection curve: The area under the receiver operating characteristic curve used to evaluate the model's ability to distinguish between clean samples and adversarial samples. This metric is only used for methods with anomaly detection mechanisms.

[0081] Experimental data statistics table:

[0082] in conclusion: As shown in the experimental data and figures, while traditional adversarial training and logical consistency defense methods improve robust accuracy, they lead to a significant decrease in accuracy for clean samples. Figure 2 As shown in the bar chart comparing classification accuracy, existing defense methods show a decline in accuracy on normal data. However, this invention, by introducing a feature space denoising module in the hidden layer and optimizing the joint loss, mitigates the loss of normal semantic information, maintaining a robust accuracy of over 90% for clean samples. Furthermore, due to strict deep feature consistency constraints, the robust accuracy of this invention reaches 61.27% when facing strong attacks, outperforming existing technologies. In addition, the Mahalanobis distance anomaly detection mechanism designed in this invention exhibits excellent discriminative ability. Figure 3 As shown in the Mahalanobis distance anomaly score distribution diagram, the feature distribution of normal samples is highly concentrated and the scores are low, while the scores of adversarial samples are relatively high. The two exhibit extremely high separability in the feature space. This can be determined by setting a threshold. It can accurately isolate attack inputs. Based on this, such as... Figure 4 As shown in the ROC curve of the adversarial sample detection, the detection mechanism achieved an area under the curve (AUC) of up to 95.82%, further demonstrating that the security benchmark library constructed in this invention has extremely high accuracy and reliability in quantifying feature distribution shifts and intercepting anomalous samples.

Claims

1. A method for enhancing the robustness of deep learning models against adversarial example attacks, characterized in that, Includes the following steps: Obtain the original training dataset, generate adversarial attack samples based on the original training dataset, and mix the adversarial attack samples with the original training dataset to form a hybrid training dataset; The hybrid training dataset is input into a deep neural network for forward propagation, the feature maps of the intermediate hidden layers of the deep neural network are smoothed, and the reconstructed feature maps are output. The feature alignment loss is obtained by calculating the mean square error between the first feature representation of the original input sample in the original training dataset and the second feature representation of the adversarial attack sample in the forward propagation output. The classification cross-entropy loss is calculated based on the prediction result of the forward propagation output. The feature alignment loss and the classification cross-entropy loss are weighted and summed to obtain the joint loss function. The model parameters of the deep neural network are updated based on the joint loss function through the backpropagation algorithm. Obtain the samples correctly classified by the updated deep neural network in the original training dataset, construct a safety benchmark library based on the correctly classified samples, input the online input samples into the updated deep neural network, extract the test feature vector and predicted category of the online input samples, and calculate the Mahalanobis distance between the test feature vector and the safety benchmark library corresponding to the predicted category to obtain the anomaly score; If the anomaly score is greater than a preset anomaly determination threshold, the online input sample is blocked.

2. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, The steps of obtaining the original training dataset and generating adversarial attack samples based on the original training dataset include: Read the original input sample, generate an initial perturbation, and superimpose the initial perturbation onto the original input sample to generate an initial adversarial attack sample; Extract the current adversarial attack sample, input the current adversarial attack sample into the deep neural network for forward propagation calculation, normalize the original network output value to obtain the predicted probability distribution, and calculate the current step cross-entropy loss in combination with the true label of the original input sample. The adaptive adjustment factor is calculated by inputting the current step cross-entropy loss into the decay mapping function; Based on the current step cross-entropy loss, backpropagation is performed to obtain the gradient vector relative to the current adversarial attack sample. The sign value of the gradient vector is extracted, and the sign value, the preset base attack step size, and the adaptive adjustment factor are multiplied to calculate the dynamic update amount. The dynamic update amount is superimposed on the perturbation amount of the current step to obtain the unprojected perturbation amount. The unprojected perturbation amount is truncated by the projection operator to obtain the perturbation amount of the next step. The iteration number is updated and the step of extracting the current adversarial attack sample is returned or the multi-step iteration is terminated based on the maximum iteration number. After the multi-step iteration process is terminated, the perturbation amount of the multi-step iteration stored in memory is extracted. The extracted perturbation is superimposed on the original input sample to generate the adversarial attack sample.

3. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, The steps of smoothing the feature maps of the intermediate hidden layers of the deep neural network and outputting the reconstructed feature maps include: The feature map is flattened in spatial dimension to obtain a flattened feature map containing multiple spatial locations. The flattened feature map is subjected to linear mapping operations by convolutional layers to obtain the first mapped feature, the second mapped feature, and the feature vector processed by the third linear mapping function. Calculate the dot product of the first mapping feature and the second mapping feature, and input the dot product result into an exponential function for summation and normalization to calculate the feature similarity weight. Then, traverse all spatial location combinations to construct the feature similarity weight matrix. The feature similarity weight matrix is ​​multiplied with the feature vector processed by the third linear mapping function. The result of the multiplication operation is accumulated and summed across spatial locations to obtain the aggregated feature vector corresponding to the spatial location, thereby achieving spatial smoothing of abnormal high-frequency noise. The channel dimension of the aggregated feature vector is restored to obtain the aggregated feature vector with restored dimension. The aggregated feature vector with restored dimension is multiplied by the scaling parameter. The product result is added element-wise to the feature map to generate the reconstructed feature vector of the reconstructed feature map at the spatial location. The reconstructed feature map is generated by traversing all spatial locations.

4. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, The steps for obtaining the first feature representation of the original input sample and the second feature representation of the adversarial attack sample from the forward propagation output include: The deep neural network is divided into a feature extractor and a classifier. A feature extraction mapping function corresponding to the feature extractor is constructed, and the output node of the global average pooling layer in the deep neural network is selected as the target constraint point. The original feature representation output after the original input sample is processed by the feature extraction mapping function at the target constraint point is taken as the first feature expression; The adversarial feature representation output by the feature extraction mapping function after the adversarial attack sample is extracted at the target constraint point is used as the second feature expression.

5. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, The steps for constructing a security benchmark library based on the correctly classified samples include: Obtain an offline clean dataset consisting of the correctly classified samples, wherein the offline clean dataset contains the original input samples that have not been contaminated by adversarial perturbations and their corresponding true class labels; The original input samples from the offline clean dataset are input one by one into the trained deep neural network, and the baseline feature vector of the original input samples is extracted. The baseline feature vectors are grouped according to the true category labels, and the arithmetic mean of all the baseline feature vectors in each group is calculated as the category prototype mean vector. The feature covariance matrix is ​​calculated based on the category prototype mean vector, and the feature covariance matrix is ​​then regularized to obtain the regularized feature covariance matrix. The security benchmark library is constructed by combining the category prototype mean vector with the regularized feature covariance matrix.

6. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 5, characterized in that, The step of calculating the anomaly score by the Mahalanobis distance between the test feature vector and the security benchmark library corresponding to the predicted category includes: Retrieve the category prototype mean vector and the regularized feature covariance matrix corresponding to the predicted category from the security benchmark library; Perform matrix inversion on the regularized feature covariance matrix to obtain the inverse matrix of the regularized feature covariance matrix; The Mahalanobis distance between the test feature vector and the normal feature distribution is calculated based on the inverse matrix of the category prototype mean vector and the regularized feature covariance matrix, and the Mahalanobis distance is used as the anomaly score.

7. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 6, characterized in that, The method further includes: If the anomaly score is less than or equal to the anomaly determination threshold, the online input sample is determined to be a normal sample, and the predicted category is output as the final recognition result. The test feature vector corresponding to the normal sample is included in the dynamic update pool of the predicted category; An exponential moving average mechanism is used to smoothly update the mean vector of the category prototypes corresponding to the predicted category in the safety benchmark library.

8. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, After intercepting the online input sample, the process also includes: The intercepted online input samples are stored in a preset isolation area; Collect intercepted samples within the isolated area to construct a dynamic adversarial sample pool; When the number of intercepted samples in the dynamic adversarial sample pool reaches a preset update batch threshold, the re-labeled intercepted samples are obtained. The re-labeled intercepted samples are added to the hybrid training dataset to obtain the updated training dataset; The training steps of joint optimization of feature space denoising and feature consistency constraints are re-executed using the updated training dataset to obtain the updated model parameters of the deep neural network.

9. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, The steps for extracting the test feature vector and predicted category of the online input sample include: At the output node of the global average pooling layer of the deep neural network, the feature vector output by the feature extraction mapping function is truncated, and the truncated feature vector is reshaped into a column vector in the tensor dimension as the test feature vector; The test feature vector is input into the classifier to obtain the predicted probability distribution for the online input sample; The category with the largest value in the predicted probability distribution is selected as the predicted category.

10. The method for enhancing the robustness of deep learning models against adversarial example attacks according to claim 1, characterized in that, After updating the model parameters of the deep neural network, the following is also included: Determine whether the training process of the deep neural network has reached a convergence state; If the training process of the deep neural network does not reach the convergence state, return to the step of obtaining the original training dataset and generating adversarial attack samples based on the original training dataset, and enter the next loop iteration; If the training process of the deep neural network reaches the convergence state, the model parameters of the deep neural network are fixed, and the step of constructing a safe benchmark library based on correctly classified samples is triggered.

Images