Image classification authentication defense method based on frequency domain random smoothing

Abstract

This invention proposes an image classification authentication defense method based on frequency domain random smoothing, belonging to the technical field of image classification. The method involves decomposing the input image, mapping it from the spatial domain to the frequency domain, obtaining different frequency sub-band components. Random noise of varying intensities is injected into each frequency sub-band component to obtain noisy sub-band components, which are then reconstructed into a spatial domain image, resulting in a reconstructed image. A basic classification model is used to obtain the predicted image classification result of the reconstructed image under the current random noise injection conditions. The probability of each image category predicted by the basic classification model is calculated, constructing a frequency domain authentication boundary. Based on the frequency domain authentication boundary and the injected random noise of different intensities, the robustness guarantee of the predicted image classification result against attacks is determined. This invention extends the defense process from the spatial domain to the frequency domain, effectively compensating for the shortcomings of existing methods in handling frequency domain perturbations, and achieving fine-grained control over the image classification result.

Description

Technical Field

[0001] This invention relates to the technical field of image classification, and more specifically, to an image classification authentication defense method based on frequency domain random smoothing. Background Technology

[0002] With the development of computer vision technology, deep learning-based image classification methods have achieved remarkable results in many fields. However, research shows that deep neural network models are susceptible to adversarial examples, which involve adding small perturbations to the input image to cause the model to make incorrect predictions. To improve the security of the model, researchers have proposed a variety of adversarial defense methods.

[0003] Existing adversarial defense methods mainly include adversarial training, input transformation, and stochastic smoothing. Among them, adversarial training enhances the robustness of the model by introducing adversarial examples during training, but it has high computational complexity and limited generalization ability. Input transformation methods reduce the impact of perturbations by preprocessing the image, but lack rigorous theoretical guarantees. Stochastic smoothing methods construct a smooth classifier by superimposing random noise on the input image and statistically analyzing multiple prediction results. It can provide theoretical robustness certification within a certain perturbation range and has therefore attracted widespread attention.

[0004] Existing adversarial defense research mainly revolves around spatial domain perturbations, and methods such as stochastic smoothing have achieved provable robustness certification in the spatial domain. However, this spatial domain modeling approach has two key limitations: (1) Adversarial attacks have expanded from the spatial domain to the frequency domain. By introducing perturbations in high-frequency or low-frequency regions, they are visually difficult to detect but can effectively interfere with model prediction results. Existing stochastic smoothing methods mainly target spatial perturbations for noise injection and certification, making it difficult to directly defend against such frequency domain attacks. (2) Although some studies have attempted to detect attacks or conduct empirical defenses through frequency domain analysis, they lack provable robustness guarantees, which is not conducive to analyzing attack intensity and cannot achieve fine-grained robustness control. Summary of the Invention

[0005] To address the problem that existing technologies cannot effectively defend against frequency domain attacks on image classification, this invention proposes an image classification authentication defense method based on frequency domain random smoothing. This method effectively suppresses disturbances in the frequency domain, obtains accurate image classification results, and achieves fine-grained robustness control.

[0006] To achieve the above-mentioned technical effects, the technical solution of the present invention is as follows: Firstly, this application proposes an image classification authentication defense method based on frequency domain random smoothing, comprising the following steps: S1: Decompose the input image to be classified by mapping the input image from the spatial domain to the frequency domain to obtain different frequency sub-band components; S2: Inject random noise of different intensities into the frequency sub-band components to obtain the noisy frequency sub-band components. Reconstruct the noisy frequency sub-band components into a spatial domain image to obtain the reconstructed image. S3: Based on the reconstructed image, using a preset basic classification model, obtain the predicted image classification result of the reconstructed image under the current random noise injection conditions; S4: Based on the predicted image classification results, obtain the probability of each image category predicted by the basic classification model; S5: Based on the probability, construct a frequency domain authentication boundary, and determine whether the predicted image classification result has a robust guarantee against attacks based on the frequency domain authentication boundary and random noise of different intensities injected into the frequency sub-band components.

[0007] Preferably, the process of S1 is as follows: Let the input image to be classified be: ;in, and These represent the height and width of the input image, respectively. Using Discrete Wavelet Transform on Input Image The components are decomposed to obtain several frequency sub-band components, including low-frequency sub-band components and high-frequency sub-band components.

[0008] Preferably, the random noise of different intensities includes low-frequency noise and high-frequency noise, wherein the low-frequency noise satisfies ,in, The standard deviation of low-frequency noise. Represents the identity matrix. The high-frequency noise is represented by a Gaussian distribution; the high-frequency noise satisfies ,in, This represents the standard deviation of high-frequency noise.

[0009] Preferably, the inverse discrete wavelet transform is used to reconstruct the spatial domain image from the noisy frequency subband components, resulting in the reconstructed image. .

[0010] Preferably, before S4, the following is also included: Repeat the S2~S3 operations multiple times for the same input image to be classified until a preset number of image categories corresponding to different intensities of random noise are obtained.

[0011] Preferably, in S4, the probability of each image category predicted by the basic classification model is calculated, satisfying the expression:

[0012] in, This is an indicator function that takes the value 1 when the condition is true and 0 otherwise. Indicates the first Reconstructed image after subsampling; This indicates that the image category is predicted by the basic classification model. The probability of; The image category with the highest probability is used as the final predicted image category, satisfying the expression:

[0013] in, Indicates low-frequency noise and high frequency noise Through the combined effect of the basic classification model, the image category is predicted. The probability of; This represents the pre-defined basic classification model; This indicates the reconstructed image.

[0014] Preferably, in S5, the injected random noise of different intensities is uniformly considered as a covariance matrix. Gaussian noise, Let the frequency domain countermeasures be as follows: ; Based on the aforementioned probability, calculate the frequency domain authentication boundary. The expression is:

[0015] in, This represents the probability of the final predicted image category. This represents the second-largest probability among all image categories. It represents the inverse function of the cumulative distribution function of the standard Gaussian distribution; The frequency domain perturbation range is calculated based on random noise of varying intensities injected into the frequency sub-band components. The expression is:

[0016] in, Indicates the intensity of the applied low-frequency noise disturbance. Indicates the intensity of the applied high-frequency noise disturbance; If the frequency domain disturbance range Less than or equal to the frequency domain authentication boundary If so, the predicted image classification results have a robustness guarantee against attacks.

[0017] Secondly, this application proposes an electronic device, comprising: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps in the image classification authentication defense method based on frequency domain random smoothing.

[0018] This application also proposes a readable storage medium for storing a program that, when executed by a processor, implements the steps in the frequency-domain random smoothing-based image classification authentication defense method.

[0019] This application also proposes a computer program product, including computer instructions that, when executed by a processor, implement the steps in the image classification authentication defense method based on frequency domain random smoothing.

[0020] Compared with the prior art, the beneficial effects of the technical solution of the present invention are: This invention proposes an image classification authentication defense method based on frequency domain random smoothing. The method decomposes the input image to be classified, mapping it from the spatial domain to the frequency domain to obtain different frequency sub-band components. Random noise of varying intensities is injected into each frequency sub-band component, resulting in noisy frequency sub-band components that are then reconstructed into a spatial domain image, yielding a reconstructed image. Based on this reconstructed image, a preset basic classification model is used to obtain the predicted image classification result under the current random noise injection conditions. According to the predicted image classification result, the probability of each image category predicted by the basic classification model is obtained, constructing a frequency domain authentication boundary. Based on this frequency domain authentication boundary and the different intensities of random noise injected into the frequency sub-band components, it is determined whether the predicted image classification result possesses robustness guarantees against attacks. This invention extends the defense process from the spatial domain to the frequency domain, effectively compensating for the shortcomings of existing methods in handling frequency domain perturbations, and maintains strong adaptability even in complex attack scenarios. The robustness guarantee conditions established on the basis of defense enable fine-grained control over the image classification results. Attached Figure Description

[0021] Figure 1 This is a flowchart illustrating the image classification authentication defense method based on frequency domain random smoothing proposed in this embodiment of the invention. Figure 2 This diagram illustrates the implementation framework of the image classification authentication defense method based on frequency domain random smoothing proposed in this invention. Figure 3 This diagram illustrates the structure of the electronic device proposed in the embodiments of the present invention. Detailed Implementation

[0022] The accompanying drawings are for illustrative purposes only and should not be construed as limiting the scope of this patent. To better illustrate this embodiment, some parts of the accompanying drawings may be omitted, enlarged, or reduced, and do not represent the actual dimensions; It is understandable to those skilled in the art that some well-known details may be omitted from the accompanying drawings.

[0023] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments; The positional relationships depicted in the accompanying drawings are for illustrative purposes only and should not be construed as limiting this patent.

[0024] Example 1 This embodiment provides an image classification authentication defense method based on frequency domain random smoothing. The flowchart of this method can be found in [link to flowchart]. Figure 1 This includes the following steps: S1: Decompose the input image to be classified by mapping the input image from the spatial domain to the frequency domain to obtain different frequency sub-band components; S2: Inject random noise of different intensities into the frequency sub-band components to obtain the noisy frequency sub-band components. Reconstruct the noisy frequency sub-band components into a spatial domain image to obtain the reconstructed image. S3: Based on the reconstructed image, using a preset basic classification model, obtain the predicted image classification result of the reconstructed image under the current random noise injection conditions; S4: Based on the predicted image classification results, obtain the probability of each image category predicted by the basic classification model; S5: Based on the probability, construct a frequency domain authentication boundary, and determine whether the predicted image classification result has a robust guarantee against attacks based on the frequency domain authentication boundary and random noise of different intensities injected into the frequency sub-band components.

[0025] In this embodiment, the input image to be classified is decomposed by mapping it from the spatial domain to the frequency domain, resulting in different frequency sub-band components. Then, random noise of varying intensities is injected into each frequency sub-band component to obtain noisy frequency sub-band components. These noisy frequency sub-band components are then reconstructed into a spatial domain image to obtain a reconstructed image. Based on the reconstructed image, a preset basic classification model is used to obtain the predicted image classification result of the reconstructed image under the current random noise injection conditions. The basic classification model can be any existing image classification network. Based on the predicted image classification result, the probability of the basic classification model predicting each image category is obtained. A frequency domain authentication boundary is constructed based on the probability. Finally, based on the frequency domain authentication boundary and the random noise of varying intensities injected into the frequency sub-band components, it is determined whether the predicted image classification result has robustness against attacks.

[0026] This embodiment extends the defense process from the spatial domain to the frequency domain. By processing the image frequency components, it effectively compensates for the shortcomings of existing methods in dealing with frequency domain perturbations and still has strong adaptability under complex attack scenarios. The robustness guarantee conditions established on the basis of defense enable fine-grained control over the image classification results.

[0027] Example 2 In this embodiment, as Figure 2 As shown, the input image is decomposed into four frequency sub-band components using Discrete Wavelet Transform (DWT) and noise of different intensities is added to each component. The noise-added frequency sub-band components are then reconstructed into a noisy image using Inverse Discrete Wavelet Transform (IDWT), i.e., the reconstructed image. The reconstructed image is then input into a basic classification model composed of a neural network. Multiple operations are performed to obtain the predicted image classification result, construct the frequency domain authentication boundary, and perform authentication.

[0028] Specifically, the process of S1 is as follows: Let the input image to be classified be: ;in, and These represent the height and width of the input image, respectively. Using Discrete Wavelet Transform on Input Image The components are decomposed to obtain several frequency sub-band components, including low-frequency sub-band components and high-frequency sub-band components.

[0029] Specifically, the input image Decomposed into four frequency sub-band components, satisfying the expression:

[0030] in, Indicates the input image The low-frequency subband components mainly contain the overall contour and thematic semantic information of the input image; , and These represent the input images respectively. The high-frequency subband components in the vertical, horizontal, and diagonal directions represent detailed information in the corresponding directions, respectively. This is a low-pass filter matrix; This is the high-pass filter matrix.

[0031] Since frequency domain adversarial attacks typically affect classification results by modulating certain frequency components of an image, this embodiment first uses Direct Wrapper (DWT) to split the input image into different frequency bands, enabling subsequent differentiated defense processing for different frequency bands. DWT can simultaneously preserve both spatial and frequency information, making it suitable for separating and modeling different frequency features of an image. To construct an authentication defense mechanism suitable for the frequency domain, considering the significant differences between low-frequency and high-frequency components in terms of numerical amplitude, semantic role, and perceptual characteristics, directly using uniform isotropic Gaussian noise would lead to an imbalance in defense between low and high frequencies, affecting the defense effect and classification accuracy. Therefore, this application employs an anisotropic Gaussian noise injection method, setting different noise intensities for the low-frequency and high-frequency sub-band components respectively.

[0032] The random noise of different intensities includes low-frequency noise and high-frequency noise, wherein the low-frequency noise satisfies ,in, The standard deviation of low-frequency noise. Represents the identity matrix. The high-frequency noise is represented by a Gaussian distribution; the high-frequency noise satisfies ,in, This represents the standard deviation of high-frequency noise.

[0033] Specifically, low-frequency noise and high-frequency noise are injected into the frequency sub-band components respectively to obtain the noisy frequency sub-band components, which satisfy the expression:

[0034]

[0035]

[0036] in, This represents the low-frequency subband component after noise addition. This represents the high-frequency sub-band component in the vertical direction after noise addition. This represents the high-frequency sub-band component in the horizontal direction after noise addition. This represents the high-frequency subband component in the diagonal direction after noise is added.

[0037] To balance robustness and classification accuracy, settings can be configured based on the statistical characteristics of low-frequency and high-frequency subband components. and In this embodiment, the noise intensity of low-frequency noise is set to several times that of high-frequency noise to accommodate the larger amplitude and stronger semantic carrying characteristics of low-frequency sub-band components.

[0038] The inverse discrete wavelet transform is used to reconstruct the spatial domain image from the noisy frequency subband components, resulting in the reconstructed image. .

[0039] Specifically, reconstructing the image Satisfying the expression: in, This indicates the matrix transpose.

[0040] Reconstruct the image The input is fed into the base classifier to obtain the predicted image classification result under the current random noise injection condition. Let the base classifier be... Then we have:

[0041] in, This represents the predicted image category under the current random noise injection condition. The base classifier can be any existing image classification network, such as ResNet, VGG, DenseNet, or other convolutional neural network models, and can be flexibly selected according to the actual application scenario.

[0042] Before S4, it also included: Repeat the S2~S3 operations multiple times for the same input image to be classified until a preset number of image categories corresponding to different intensities of random noise are obtained.

[0043] Specifically, the preset number is Perform on the same input image to be classified After the operations S2~S3, we get Each corresponding predicted image classification result.

[0044] In S4, the probabilities of each image category predicted by the base classification model are calculated, satisfying the expression:

[0045] in, This is an indicator function that takes the value 1 when the condition is true and 0 otherwise. Indicates the first Reconstructed image after subsampling; This indicates that the image category is predicted by the basic classification model. The probability of; The image category with the highest probability is used as the final predicted image category, satisfying the expression:

[0046] in, Indicates low-frequency noise and high frequency noise Through the combined effect of the basic classification model, the image category is predicted. The probability of; This represents the pre-defined basic classification model; This indicates the reconstructed image.

[0047] Specifically, this embodiment estimates the probability of each image category by Monte Carlo sampling. To improve the reliability of the probability estimation, a confidence interval estimation method can also be used to conservatively estimate the probability of each image category, thereby providing a basis for subsequent robustness certification.

[0048] In S5, let the injected random noise of different intensities be uniformly regarded as the covariance matrix as follows: Gaussian noise, Let the frequency domain countermeasures be as follows: ; Based on the aforementioned probability, calculate the frequency domain authentication boundary. The expression is:

[0049] in, This represents the probability of the final predicted image category. This represents the second-largest probability among all image categories. It represents the inverse function of the cumulative distribution function of the standard Gaussian distribution; The frequency domain perturbation range is calculated based on random noise of varying intensities injected into the frequency sub-band components. The expression is:

[0050] in, Indicates the intensity of the applied low-frequency noise disturbance. Indicates the intensity of the applied high-frequency noise disturbance; If the frequency domain disturbance range Less than or equal to the frequency domain authentication boundary If so, the predicted image classification results have a robustness guarantee against attacks.

[0051] Specifically, when the low-frequency and high-frequency perturbations experienced by the input image in the frequency domain are within the frequency domain authentication boundary, the predicted image classification result has a robust guarantee against attacks, and the final predicted image category does not need to be re-predicted. This embodiment establishes an authentication boundary in the frequency domain, which not only enables defense but also clearly defines the theoretical range of defendable perturbations.

[0052] Example 3 This embodiment provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described embodiment of an image classification authentication defense method based on frequency domain random smoothing, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0053] Specifically, see Figure 3 This application also provides an electronic device, including a bus 401, a transceiver 402, an antenna 403, a bus interface 404, a processor 405, and a memory 406.

[0054] The transceiver 402 is used to acquire the input image to be classified. The processor 405 is used to decompose the input image to be classified, mapping the input image from the spatial domain to the frequency domain to obtain different frequency sub-band components; injecting random noise of different intensities into the frequency sub-band components to obtain noisy frequency sub-band components; reconstructing the noisy frequency sub-band components into a spatial domain image to obtain a reconstructed image; based on the reconstructed image, using a preset basic classification model, obtaining the predicted image classification result of the reconstructed image under the current random noise injection conditions; based on the predicted image classification result, obtaining the probability of the basic classification model predicting each image category; based on the probability, constructing a frequency domain authentication boundary, and judging whether the predicted image classification result has a robust guarantee against attacks based on the frequency domain authentication boundary and the random noise of different intensities injected into the frequency sub-band components.

[0055] exist Figure 3 In this context, a bus architecture (represented by bus 401) is used. Bus 401 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 405 and memory represented by memory 406. Bus 401 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 404 provides an interface between bus 401 and transceiver 402. Transceiver 402 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 405 is transmitted over a wireless medium via antenna 403, which further receives data and transmits data to processor 405.

[0056] Processor 405 is responsible for managing bus 401 and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 406 can be used to store data used by processor 405 during operation.

[0057] Optionally, the processor 405 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a complex programmable logic device (CPLD).

[0058] Processor 405 manages bus 401 and general processing, and also provides various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. This embodiment also provides a readable storage medium for storing a program. When executed by a processor, the program implements the various processes of the above-described embodiment of the image classification authentication defense method based on frequency domain random smoothing, and achieves the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0059] This embodiment also provides a computer program product, including computer instructions. When the computer instructions are executed by a processor, they implement the various processes of the above-described embodiment of the image classification authentication defense method based on frequency domain random smoothing, and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0060] Example 4 This embodiment was experimentally verified on the CIFAR-10 dataset and the ImageNet dataset, respectively.

[0061] The base classification model uses the ResNet network structure, with CIFAR-10 using an improved version of ResNet adapted for small images, and ImageNet using the standard ResNet-50. The discrete wavelet transform uses Haar wavelets, performing frequency domain decomposition on each of the three channels of the color input image before concatenation. The number of Monte Carlo samplings is set to N=100000, and the significance level is set to α=0.01 by default.

[0062] Considering that the low-frequency subband components carry more semantic information and have larger numerical amplitudes, this embodiment adopts a differentiated noise injection strategy between the low-frequency and high-frequency subband components. Preferably, the standard deviation of the low-frequency noise is set to 10 times the standard deviation of the high-frequency noise, i.e.:

[0063] By changing the noise intensity of different frequency sub-band components, the authentication accuracy under different frequency domain authentication radii was statistically analyzed, and the results are shown in Table 1.

[0064] Table 1

[0065] As can be seen from Table 1, the present invention can achieve stable robustness certification under different datasets and different noise parameter settings.

[0066] On the CIFAR-10 dataset, when setting When the frequency domain authentication radius R is 0, the authentication accuracy reaches 78.4%. As the frequency domain authentication radius gradually increases to 3.0, the authentication accuracy remains at 55.4%, indicating that even within a large frequency domain disturbance range, it can still maintain a high level of stable classification capability.

[0067] When the noise parameter increases to When the frequency authentication radius is 0, the accuracy slightly improves to 80.1%, but as the frequency authentication radius increases, the accuracy decreases significantly, reaching only 31.0% at a radius of 3.0. This indicates that while larger noise can enhance some authentication boundaries, it has a more significant impact on classification performance.

[0068] Furthermore, when the noise setting continues to increase to At this point, the authentication accuracy drops significantly, reaching only 2.0% at a radius of 3.0, indicating that excessive random perturbation can destroy the original discriminative information of the image, which is not conducive to the classifier maintaining stable predictions.

[0069] The same pattern is observed on the ImageNet dataset. When the frequency domain authentication radius is 3.0, the authentication accuracy can still be maintained at 39.2%, indicating that the present invention is not only applicable to small-scale datasets, but can also work effectively in large-scale complex scenarios.

[0070] The above results demonstrate that by employing a differentiated noise injection strategy for low-frequency and high-frequency components, the present invention can achieve a good balance between classification accuracy and authentication robustness, thereby significantly improving the defense capability against frequency domain adversarial attacks.

[0071] The same or similar labels correspond to the same or similar parts; The terms used to describe positional relationships in the accompanying drawings are for illustrative purposes only and should not be construed as limiting the invention. Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the implementation of the present invention. Those skilled in the art can make other variations or modifications based on the above description. It is neither necessary nor possible to exhaustively describe all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the claims of the present invention.

Claims

1. A method for image classification authentication defense based on frequency domain random smoothing, characterized in that, Includes the following steps: S1: Decompose the input image to be classified by mapping the input image from the spatial domain to the frequency domain to obtain different frequency sub-band components; S2: Inject random noise of different intensities into the frequency sub-band components to obtain the noisy frequency sub-band components. Reconstruct the noisy frequency sub-band components into a spatial domain image to obtain the reconstructed image. S3: Based on the reconstructed image, use a preset basic classification model to obtain the predicted image classification result of the reconstructed image under the current random noise injection conditions; S4: Based on the predicted image classification results, obtain the probability of each image category predicted by the basic classification model; S5: Based on the probability, construct a frequency domain authentication boundary, and determine whether the predicted image classification result has a robust guarantee against attacks based on the frequency domain authentication boundary and random noise of different intensities injected into the frequency sub-band components.

2. The image classification authentication defense method based on frequency domain random smoothing according to claim 1, characterized in that, The process of S1 is as follows: Let the input image to be classified be: ;in, and These represent the height and width of the input image, respectively. Using Discrete Wavelet Transform on Input Image The components are decomposed to obtain several frequency sub-band components, including low-frequency sub-band components and high-frequency sub-band components.

3. The image classification defense method based on frequency domain random smoothing according to claim 2, characterized in that, The random noise of different intensities includes low-frequency noise and high-frequency noise, wherein the low-frequency noise satisfies ,in, The standard deviation of low-frequency noise. Represents the identity matrix. The high-frequency noise is represented by a Gaussian distribution; the high-frequency noise satisfies ,in, This represents the standard deviation of high-frequency noise.

4. The image classification defense method based on frequency domain random smoothing according to claim 3, characterized in that, The inverse discrete wavelet transform is used to reconstruct the spatial domain image from the noisy frequency subband components, resulting in the reconstructed image. .

5. The image classification authentication defense method based on frequency domain random smoothing according to claim 1, characterized in that, Before S4, it also included: Repeat the S2~S3 operations multiple times for the same input image to be classified until a preset number of image categories corresponding to different intensities of random noise are obtained.

6. The image classification authentication defense method based on frequency domain random smoothing according to claim 1, characterized in that, In S4, the probabilities of each image category predicted by the base classification model are calculated, satisfying the expression: in, This is an indicator function that takes the value 1 when the condition is true and 0 otherwise. Indicates the first Reconstructed image after subsampling; This indicates that the image category is predicted by the basic classification model. The probability of; The image category with the highest probability is used as the final predicted image category, satisfying the expression: in, Indicates low-frequency noise and high frequency noise Through the combined effect of the basic classification model, the image category is predicted. The probability of; This represents the pre-defined basic classification model; This indicates the reconstructed image.

7. The image classification defense method based on frequency domain random smoothing according to claim 6, characterized in that, In S5, let the injected random noise of different intensities be uniformly regarded as the covariance matrix as follows: Gaussian noise, Let the frequency domain countermeasures be... ; Based on the aforementioned probability, calculate the frequency domain authentication boundary. The expression is: wherein, denotes a probability of the final predicted image class, denotes a second largest probability among the probabilities of the respective image classes, denotes an inverse function of a standard Gaussian distribution cumulative distribution function; calculating a frequency domain perturbation range based on different intensities of random noise injected to frequency sub-band components , the expression is: wherein represents the intensity of the applied low-frequency noise perturbation, represents the intensity of the applied high-frequency noise perturbation; If the frequency domain disturbance range Less than or equal to the frequency domain authentication boundary If so, the predicted image classification results have a robustness guarantee against attacks.

8. An electronic device, comprising: A memory, a processor, and a program stored in the memory and executable on the processor; characterized in that the processor is configured to read the program from the memory to implement the steps of the image classification authentication defense method based on frequency domain random smoothing as described in any one of claims 1 to 7.

9. A readable storage medium for storing a program, characterized by When the program is executed by the processor, it implements the steps in the image classification authentication defense method based on frequency domain random smoothing as described in any one of claims 1 to 7.

10. A computer program product, characterised in that, It includes computer instructions that, when executed by a processor, implement the steps in the image classification authentication defense method based on frequency domain random smoothing as described in any one of claims 1 to 7.

Images