A class-aware adversarial purifying defense method for image classification

Abstract

The application provides a class-aware adversarial purifying defense method for image classification, comprising the following steps: constructing a class-aware adversarial purifying defense model; in a training stage, obtaining clean samples from a training data set, processing the clean samples by using a class-aware strategy, and outputting class weights; constructing a class-aware weighted loss function based on the class weights; adding a disturbance to the clean samples based on the class weights, and generating adversarial samples based on the disturbance information; inputting the adversarial samples into an FGSM-ATDNN model for training, updating model parameters by using a stochastic gradient descent optimization algorithm, and obtaining a trained FGSM-ATDNN model; in a test stage, applying an FGSM disturbance to any test sample, and purifying the test sample, so as to obtain a purified sample; inputting the purified sample into the trained FGSM-ATDNN model, and obtaining a final result; and the application can effectively improve the defense capability of the model against unknown adversarial attacks without knowing the attack type in advance.

Description

Technical Field

[0001] This invention belongs to the field of adversarial sample defense technology, specifically relating to a category-aware adversarial sanitization defense method for image classification. Background Technology

[0002] In recent years, deep neural networks have made significant progress in computer vision tasks such as image classification, object detection, and autonomous driving. However, numerous studies have shown that these models are highly sensitive to adversarial examples. Attackers can induce incorrect predictions by adding minute perturbations, imperceptible to the human eye, to the input image, seriously threatening the security and reliability of deep learning systems. To address the security challenges posed by adversarial examples, researchers have proposed various defense mechanisms. Among them, adversarial training is widely recognized as one of the most effective defense strategies. This method introduces adversarial examples during training, enabling the model to learn to recognize and resist such perturbations, thereby improving its ability to withstand adversarial attacks.

[0003] However, existing adversarial training methods still have several limitations. First, most methods rely on specific attack methods to generate adversarial examples, enabling the trained model to have good defense against attacks seen during the training phase. However, their defense capability decreases significantly when facing unknown attack types. Second, research shows that there is a common problem of class-specific robustness imbalance during adversarial training. That is, samples from different classes have significantly different robustness to adversarial attacks, especially between semantically similar classes, whose feature distributions often overlap significantly in the feature space, easily leading to blurred classification boundaries and thus being more prone to misclassification under adversarial attacks. Existing defense methods mostly focus on improving overall robustness, while giving less consideration to the similarity relationship between classes and its impact on model robustness.

[0004] Therefore, how to improve the model's ability to defend against unknown attacks while alleviating the imbalance in robustness between different categories has become a key challenge in current adversarial defense research. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention proposes a category-aware adversarial sanitization defense method for image classification. This method includes: constructing a category-aware adversarial sanitization defense model; during model training, obtaining clean samples: acquiring a training set and obtaining clean samples from the training dataset; processing the clean samples using a category-aware strategy and outputting category weights; constructing a category-aware weighted loss function based on the category weights; adding perturbations to the clean samples based on the category weights and generating adversarial samples based on the perturbation information; inputting the adversarial samples into the FGSM-ATDNN model and updating the model parameters using a stochastic gradient descent optimization algorithm to obtain the trained FGSM-ATDNN model; during model testing, applying FGSM perturbations to any test sample and sanitizing the sample with applied FGSM perturbations; and inputting the sanitized sample into the trained FGSM-ATDNN model to obtain the final result.

[0006] The beneficial effects of this invention are:

[0007] This invention improves the model's defense against unknown adversarial attacks by adding perturbations to clean samples before inputting them into the FGSM-ATDNN model for adversarial training during the training phase, and then using FGSM perturbations for adversarial cleanup during the testing phase. This enhances the model's defense against unknown adversarial attacks without prior knowledge of the attack type. The invention introduces a category-aware strategy, dynamically adjusting class weights based on the confusion relationships between classes. This makes the model pay more attention to easily confused classes during training, effectively mitigating the problem of class robustness imbalance. The category-aware weighted loss function designed in this invention simultaneously constrains the consistency of the predicted distributions of clean and adversarial samples, improving adversarial robustness while maintaining the model's classification accuracy. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the overall framework structure of the present invention;

[0009] Figure 2 This is a comparison chart of the classification results of the animal category set and the non-animal category set of the present invention;

[0010] Figure 3 This is a comparison chart showing the differences in predicted probabilities between the difficult category, the similar category, and the distant category in this invention;

[0011] Figure 4 This paper presents a comparison of Grad-CAM attention heatmaps based on the ResNet-18 model on the CIFAR-10 dataset, demonstrating the differences in attention distribution among clean samples, adversarial samples, and cleaned samples. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] To address the shortcomings of existing adversarial example defense methods in resisting unknown attacks and the imbalance in robustness between different categories, this invention proposes a category-aware adversarial sanitization defense method for image classification. This method introduces a category-aware strategy, combining adversarial training based on the Fast Gradient Sign Method (FGSM) to build a robust model during the training phase. During the testing phase, gradient perturbations in the form of FGSM are used to sanitize the input samples, causing samples subjected to unknown attacks to revert to more stable feature regions. This improves the model's defense against unknown attacks and alleviates the robustness disparities between categories.

[0014] A category-aware adversarial sanitization defense method for image classification, such as Figure 1 As shown, the method includes: constructing a category-aware adversarial sanitization defense model; during the model training phase, obtaining clean samples: reading original images and their corresponding ground truth labels from the training set of an image classification dataset as clean samples. The dataset is a standard image classification dataset, such as CIFAR-10, CIFAR-100, or SVHN. A category-aware strategy is used to process the clean samples, outputting category weights; a category-aware weighted loss function is constructed based on the category weights; perturbations are added to the clean samples based on the category weights, and adversarial samples are generated based on the perturbation information; further, the adversarial samples are input into the FGSM-ATDNN model, and the model parameters are updated using a stochastic gradient descent optimization algorithm to obtain the trained FGSM-ATDNN model; during the model testing phase, obtaining test samples: reading original images and their corresponding ground truth labels from the test set of the image classification dataset as test samples. The test samples are subjected to adversarial perturbations generated by unknown attack methods. For any test sample (including samples with unknown adversarial perturbations added by the attacked party, such as adversarial samples generated by attack methods like PGD, CW, and STA), apply the FGSM perturbation to it to adapt it to the defense model that has learned the distribution of the perturbation, thereby obtaining a cleaned sample; input the cleaned sample into the trained FGSM-ATDNN model to obtain the final result.

[0015] In this embodiment, the class-aware strategy for processing clean samples includes: initializing corresponding class weights for each class based on the true labels of the training samples, wherein the class weights are initialized to the same preset value; during training, based on the model's predicted probability distribution of adversarial examples, statistically analyzing the classification confidence information of each class of samples, and calculating the classification difficulty of each class accordingly; dynamically updating the class weights based on the classification difficulty and inter-class similarity; when generating adversarial examples, weighting the adversarial perturbation according to the class weight corresponding to the class to which the sample belongs, so that different classes of samples are subjected to perturbations of different intensities; during model training, introducing the class weights into the loss function to weight the loss of different classes of samples, thereby achieving class-aware adversarial training.

[0016] The method described in this invention mainly includes the following steps:

[0017] Step 1: Calculate category weights using a category-aware strategy;

[0018] In the early stages of model training, the confusion relationships between categories are statistically predicted based on the categories of the training data, and the category weight of each category is calculated.

[0019] Specifically, categories are classified through statistical models. Misclassified as a category average probability And the probability of correctly classifying it into a category. Quantify the similarity between categories and assign adaptive weights to each category:

[0020]

[0021] For each category Assign a category weight Its value range is ,in This represents the total number of categories in the dataset. When a category is more likely to be misclassified as another category, its weight will be increased, thus receiving more attention during training.

[0022] Step 2: Construct a category-aware weighted loss function;

[0023] To simultaneously optimize the model's classification performance and adversarial robustness, a category-aware weighted loss function is constructed:

[0024]

[0025] In the category-aware weighted loss function This represents the original input sample. To give it its true label, Based on Generated adversarial examples; ...

[0026] Step 3: Based on the category-aware weighted loss function, a perceptual strategy is used to modulate the weights to generate adversarial examples;

[0027] Specifically, this includes: during the training phase, a category-aware strategy is used to process clean samples and output category weights; a category-aware weighted loss function is constructed based on the category weights; adversarial perturbations are added to clean samples based on the category weights and the category-aware weighted loss function, and adversarial examples are generated based on the perturbation information.

[0028] Specifically, this includes: given input samples and its labels Adversarial perturbations are generated by calculating the gradient of the input with respect to the loss function:

[0029]

[0030] Generate adversarial examples:

[0031]

[0032] in Indicates the input sample. To represent in the original sample Based on this, adversarial examples are generated by adding FGSM perturbations scaled by category-aware weights; Indicates the disturbance amplitude, used to control the overall strength of the countermeasures against the disturbance, representing the magnitude of the disturbance. Maximum perturbation intensity under constraints. The sign function is used to extract gradient direction information. This represents the loss function of a deep neural network model.

[0033] By introducing class weights into gradient calculation, different classes can have different perturbation intensities when generating adversarial examples.

[0034] In this embodiment, inputting adversarial examples into the FGSM-ATDNN model includes: inputting clean samples and corresponding adversarial samples into the FGSM-ATDNN model respectively to obtain the predicted output of the clean samples and the predicted output of the adversarial samples; calculating the standard classification loss based on the predicted output of the clean samples and the ground truth labels; calculating the adversarial loss based on the predicted output of the adversarial samples and the ground truth labels; in calculating the above two losses, class weights are introduced to weight the losses of different class samples to construct a class-aware weighted loss function; calculating the gradient of the model parameters through the backpropagation algorithm, and updating the model parameters using the stochastic gradient descent optimization algorithm; repeating the above process until the model converges to obtain the trained FGSM-ATDNN model.

[0035] Step 4: Update model parameters.

[0036] Update model parameters using the stochastic gradient descent optimization algorithm:

[0037]

[0038] Step 5: Testing against purification.

[0039] During the testing phase, when the input sample may be subject to unknown attacks, gradient perturbation in the form of FGSM is used to perform a perturbation correction on the input sample in order to achieve adversarial cleanup.

[0040] First, obtain the category prior information based on the model's initial prediction results, and then calculate the purification perturbation:

[0041]

[0042]

[0043] in, This indicates that the perturbation amplitude used in the anti-pollution process is consistent with the FGSM perturbation scale used in the training phase; Represents the loss function. This represents an adversarial sample with unknown perturbations. This represents an adversarial sample that has been enhanced with purification and perturbation.

[0044] Step 6: Output the classification results.

[0045] The purified samples are then input into the trained classification model to obtain the final classification result:

[0046]

[0047] This invention proposes a category-aware strategy based on category similarity. By statistically analyzing the misclassification probability between categories, quantifying the degree of confusion between categories, and assigning adaptive weights to different categories, the model focuses more on vulnerable and highly similar difficult categories during training, thereby mitigating the robustness imbalance problem between categories. Significant robustness imbalance exists between categories during adversarial training, as detailed in the following results: Figures 2-3 As shown.

[0048] This invention employs an adversarial training strategy based on the fast gradient sign method during the training phase, and introduces class weights during the adversarial example generation process, so that different classes have different perturbation intensities during adversarial training, thereby improving the robustness of the model on difficult classes.

[0049] In the testing phase, this invention uses gradient perturbation in the form of FGSM to perform a directional perturbation correction on the input sample. By utilizing the robust gradient structure learned by the model during the training phase, the perturbation generated by the unknown attack is covered and reconstructed, so that the adversarial sample returns to a more stable feature region, thereby achieving the purification effect against the unknown attack.

[0050] This invention constructs a defense framework that combines adversarial training during the training phase with adversarial cleanup during the testing phase. During the training phase, a robust model is built through adversarial training using the Free Gaussian Model (FGSM), while during the testing phase, adversarial cleanup is performed through FGSM perturbations. These two approaches work together to achieve effective defense against various unknown attacks without requiring prior knowledge of the attack type.

[0051] This invention proposes a category-aware adversarial sanitization defense method for image classification, such as... Figure 1As shown, the method of this invention includes two stages: the first stage is the anti-training stage, which first constructs training data and generates adversarial examples. Specifically, for clean input samples, the Fast Gradient Sign Method (FGSM) is used to generate corresponding adversarial examples to simulate the impact of adversarial attacks on the model's classification performance. Subsequently, a category-aware strategy is introduced, which calculates the semantic similarity between categories and performs weighted scaling on the generated adversarial examples. Specifically, for categories with high semantic similarity, they are more likely to cause confusion in the feature space, so they are assigned higher weights during training, making the model pay more attention to these easily confused categories when updating parameters; while for distant categories with large semantic differences, their interference on the classification decision boundary is relatively small, so the corresponding weight adjustment is smaller. Through this category-aware mechanism, the model can be guided to focus on optimizing the discrimination boundary between similar categories, thereby enhancing the model's classification ability under complex category structures. Based on the above mechanism, this invention further designs a category-aware weighted loss function. This loss function integrates category similarity information, can dynamically adjust the loss weights of each category according to the similarity between categories, and assign higher learning intensity to categories that are more easily confused. This strategy allows the model to learn more effectively the discriminative features between similar categories during training, thus mitigating class imbalance and class confusion. Subsequently, adversarial examples, processed with class-aware weighting, are input into the deep neural network for adversarial training, and the model parameters are continuously updated to maintain stable classification performance under FGSM perturbation conditions. Once the model achieves stable robustness under FGSM attacks, training is stopped and network parameters are fixed for subsequent adversarial example cleanup and classification tasks in the testing phase. Second phase: Testing phase. This invention utilizes the adversarial network, which has acquired FGSM robustness during training, to clean up adversarial examples generated by unknown attacks, thereby further enhancing the model's defense against unknown attacks. Specifically, when an input sample is perturbed by an unknown attack, the adversarial example is first input into the trained model to obtain the model's preliminary prediction result for the sample, and the corresponding class prior information is extracted accordingly. Then, guided by this prior information, an FGSM-based gradient perturbation is applied to the input sample, i.e., the input sample is updated along the gradient ascent direction of the current model's loss function, thereby generating a corrected cleaned sample. It's important to note that this operation is not intended to further enhance the attack strength, but rather to utilize the robust FGSM gradient structure learned during model training to cover and reshape the perturbations introduced by the unknown attack. This process can, to some extent, reduce the interference of the unknown attack on the model's feature representation, bringing the samples back closer to the region where the model has stable discriminative power. From the perspective of gradient space, this cleanup process can be understood as explicitly projecting the input samples onto the robust FGSM gradient subspace learned by the model during training.Since the gradient response corresponding to this subspace has been fully constrained during training, this projection operation can suppress the influence of unknown attack perturbations on the model decision boundary, thereby achieving a generalization purification effect against unknown attacks.

[0052] This embodiment provides a specific implementation of the method of the present invention. Using three publicly available image datasets—CIFAR-10, CIFAR-100, and SVHN—and employing three classic network architectures—ResNet18, VGG16, and WideResNet34—the defensive performance of the method against various types of adversarial attacks is systematically evaluated. The tested attack types cover gradient-based attacks (FGSM, PGD-20, PGD-100), optimization-based attacks (CW, DDN, FWA), geometric transformation attacks (STA, TI-DIM), and ensemble attacks (AutoAttack, AA), comprehensively verifying the generalized defensive capabilities of the method under various attack scenarios. The final results are as follows: Figure 4 As shown.

[0053] To verify the effectiveness of the method of this invention, four representative existing defense methods were selected as comparison benchmarks: PGD-AT is a classic adversarial training method; TRADES is a method that balances clean accuracy and robustness through KL divergence; MART is a method that focuses on misclassified samples to improve robustness; and TPAP is a defense method based on adversarial cleanup during the testing phase.

[0054] Experimental results are shown in the table. The proposed method achieves excellent defense performance on three datasets and three network architectures. Taking the ResNet18 architecture on the CIFAR-10 dataset as an example, the proposed method outperforms all benchmark methods on seven out of nine attacks, especially achieving defense accuracies of 98.65% and 95.49% against CW and DDN attacks, respectively, significantly higher than the comparative methods. This result verifies the effectiveness and good generalization ability of the proposed method in resisting unknown attacks.

[0055] Table 1

[0056]

[0057] Table 1 records the classification accuracy comparison results of the method of this invention and four comparative methods (PGD-AT, TRADES, MART, and TPAP) on three datasets under the ResNet-18 architecture. Experiments show that the method of this invention achieves optimal performance under most attacks, verifying the effectiveness and generalization ability of the method.

[0058] Table 2

[0059]

[0060] Table 2 records the classification accuracy comparison results of the method of this invention and four comparative methods (PGD-AT, TRADES, MART, and TPAP) on three datasets under the VGG16 architecture. Experiments show that the method of this invention achieves optimal performance under most attacks, verifying the effectiveness and generalization ability of the method.

[0061] Table 3

[0062]

[0063] Table 3 records the classification accuracy comparison results of the method of this invention and four comparative methods (PGD-AT, TRADES, MART, and TPAP) on three datasets under the WideResNet34 architecture. Experiments show that the method of this invention achieves optimal performance under most attacks, verifying the effectiveness and generalization ability of the method.

[0064] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A category-aware adversarial sanitization defense method for image classification, characterized in that, include: Construct a category-aware adversarial purification defense model; During the model training phase, a training set is obtained, clean samples are obtained from the training dataset, a category-aware strategy is used to process the clean samples, and the category weights are output. A category-aware weighted loss function is constructed based on category weights; perturbations are added to clean samples using category weights, and adversarial examples are generated based on the perturbation information; The adversarial examples are input into the FGSM-ATDNN model for training, and the model parameters are updated by the stochastic gradient descent optimization algorithm to obtain the trained FGSM-ATDNN model. During the model testing phase, FGSM perturbation is applied to any test sample, and the sample with applied FGSM perturbation is cleaned to obtain cleaned samples. The purified sample is input into the trained FGSM-ATDNN model to obtain the final result.

2. The category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, The class-aware strategy for processing clean samples includes: initializing all class weights to the same value; during training, based on the model's prediction probability distribution of adversarial examples, statistically analyzing the classification confidence information of each class of samples; calculating the classification difficulty of each class based on the classification confidence information; dynamically updating the class weights based on the classification difficulty and inter-class similarity; when generating adversarial examples, weighting the adversarial perturbation according to the class weight corresponding to the class to which the sample belongs; and during model training, introducing the class weights into the loss function to weight the loss of samples from different classes, thereby achieving class-aware adversarial training.

3. The category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, The category weights are: ； in, For category Category weights, For scale parameters, To indicate that the true category is The sample was correctly predicted as class The probability, To indicate that the true category is The sample was incorrectly predicted as a class The probability of.

4. The category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, The category-aware weighted loss function is: ； in, This represents the original input sample. To give it its true label, Based on Generated adversarial examples; These are the parameters of the neural network model.

5. A category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, Adding perturbations to clean samples based on class weights includes: ； in, Indicates the magnitude of the disturbance. The sign function is used to extract gradient direction information. This represents the loss function of a deep neural network model.

6. The category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, Training the FGSM-ATDNN model by inputting adversarial examples includes: inputting clean samples and corresponding adversarial samples into the FGSM-ATDNN model to obtain the predicted outputs of the clean samples and the adversarial samples; calculating the standard classification loss based on the predicted outputs of the clean samples and the ground truth labels; calculating the adversarial loss based on the predicted outputs of the adversarial samples and the ground truth labels; introducing class weights to weight the standard classification loss and the adversarial loss to construct a class-aware weighted loss function; calculating the gradient of the model parameters using the backpropagation algorithm and updating the model parameters using the stochastic gradient descent optimization algorithm; repeating the above process until the model converges to obtain the trained FGSM-ATDNN model.

7. A category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, Update the model parameters as follows: ； in, For the parameters of the neural network model, This represents the original input sample. To give it its true label, This represents the category weight.

8. A category-aware adversarial sanitization defense method for image classification according to claim 1, characterized in that, Perturbation correction of input samples using gradient perturbation in the form of FGSM includes: ； ； in, This indicates the magnitude of the disturbance used in the purification process; Represents the loss function. This represents an adversarial sample with unknown perturbations. This represents an adversarial sample that has been enhanced with purification and perturbation.

Images