Neural network model training method and system used for adversarial defense, and related device
Patent Information
- Application Number
- PCT/CN2025/118806
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2025-03-14
- Filing Date
- 2025-09-03
- Publication Date
- 2026-09-17
Smart Images
Figure CN2025118806_17092026_PF_FP_ABST
Abstract
Description
Neural network model training methods, systems, and related equipment for adversarial defense Technical Field
[0001] This application relates to the field of neural network technology, and in particular to a method, system and related equipment for training neural network models for adversarial defense. Background Technology
[0002] With the development of science and technology, neural network models are being used more and more widely. For example, point cloud processing can be performed based on neural network models, which can then be applied in fields such as autonomous driving, scene modeling, and medical imaging. However, attacks targeting neural network models are also increasing, such as adversarial attacks.
[0003] Existing technologies can provide adversarial defenses against attacks. However, these technologies typically focus on data-level defenses, such as preprocessing training data to improve subsequent training results. The problem with these existing technologies is that they only focus on data-level defenses, while data preprocessing itself may introduce errors or information loss, leading to a decline in the performance of the main task, affecting model training results, and thus hindering the improvement of model robustness.
[0004] Therefore, the relevant technologies still need to be improved and developed. Summary of the Invention
[0005] The main purpose of this application is to provide a neural network model training method, system, and related equipment for adversarial defense. It aims to solve the technical problem that when conducting adversarial defense in related technologies, only data-level defense measures are considered, while data preprocessing itself may introduce errors or information loss, leading to a decline in the performance of the main task, affecting the model training effect, and thus hindering the improvement of the model's robustness.
[0006] To achieve the above objectives, the first aspect of this application provides a method for training a neural network model for adversarial defense, wherein the method includes:
[0007] The first adversarial sample corresponding to the model to be trained is generated based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained.
[0008] Based on the first adversarial example, the above-mentioned model to be trained is adversarially trained to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and the above-mentioned model to be trained is updated. The above-mentioned structural parameters are used to update the sub-network layer structure of the above-mentioned model to be trained.
[0009] Return to the above steps of generating the first adversarial example corresponding to the above-mentioned training model based on the information of the above-mentioned training model, until the preset structure search termination condition is met, and obtain the candidate model after the structure search is completed.
[0010] By fixing the structural parameters of the above candidate models, the above candidate models are trained to obtain the target network weight parameters. Based on the target network weight parameters and the fixed structural parameters, the target neural network model after training is obtained.
[0011] Optionally, before generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained, the method further includes:
[0012] Based on the preset initial state network framework, an initial model to be trained is obtained. In the network framework of the initial model to be trained, each node is provided with multiple alternative sub-network layers and structural parameters corresponding to each sub-network layer.
[0013] Optionally, generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained includes:
[0014] Based on the information of the model to be trained, a first adversarial sample corresponding to the model to be trained is generated using a preset first adversarial sample generation algorithm.
[0015] Optionally, the above-mentioned adversarial training of the model to be trained based on the first adversarial example is performed to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and the model to be trained is updated, including:
[0016] Based on the first adversarial example and the preset structure search strategy, the optimal operation is determined from all candidate operations between nodes of the model to be trained, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and the model to be trained is updated according to the structure parameters and network weight parameters corresponding to the current structure search round.
[0017] Optionally, the structural parameters of the aforementioned candidate model are fixed, and the candidate model is trained to obtain the target network weight parameters, including:
[0018] Based on the information of the above candidate models, generate the second adversarial sample corresponding to the above model to be trained;
[0019] The structural parameters of the above candidate models are fixed, and the above candidate models are adversarially trained based on the above second adversarial sample to obtain the target network weight parameters.
[0020] Optionally, the generation of the second adversarial example corresponding to the model to be trained based on the information of the candidate model includes:
[0021] Based on the information of the model to be trained, second adversarial samples corresponding to the model to be trained are generated using a variety of preset second adversarial sample generation algorithms.
[0022] Optionally, the second adversarial example generation algorithm mentioned above includes projective gradient descent, addition attack, and dropout attack.
[0023] A second aspect of this application provides a neural network model training system for adversarial defense, wherein the aforementioned neural network model training system for adversarial defense includes:
[0024] The first adversarial example generation module is used to generate a first adversarial example corresponding to the model to be trained based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained.
[0025] The structure search module is used to perform adversarial training on the model to be trained based on the first adversarial example to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and update the model to be trained, wherein the structure parameters are used to update the sub-network layer structure of the model to be trained.
[0026] The search control module is used to return to the step of generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained, until the preset structure search termination condition is met, and the candidate model after the structure search is completed is obtained.
[0027] The network weight training module is used to fix the structural parameters of the above candidate models, train the above candidate models to obtain the target network weight parameters, and obtain the target neural network model after training based on the target network weight parameters and the fixed structural parameters.
[0028] A third aspect of this application provides a smart terminal, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements any of the steps of the aforementioned neural network model training method for adversarial defense.
[0029] A fourth aspect of this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the steps of the aforementioned neural network model training method for adversarial defense.
[0030] As can be seen from the above, in this application, the first adversarial sample corresponding to the model to be trained is generated based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained; the model to be trained is adversarially trained based on the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and the model to be trained is updated, wherein the structural parameters are used to update the sub-network layer structure of the model to be trained; the step of generating the first adversarial sample corresponding to the model to be trained based on the information of the model to be trained is returned to be executed until the preset structural search termination condition is met, and a candidate model with completed structural search is obtained; the structural parameters of the candidate model are fixed, and the candidate model is trained to obtain the target network weight parameters; based on the target network weight parameters and the fixed structural parameters, the target neural network model after training is obtained.
[0031] Compared to existing technologies, the neural network model training method for adversarial defense provided in this application focuses on defense measures at the model structure level rather than the data level during neural network model training. This eliminates the need for preprocessing training data, avoiding errors or information loss introduced during data preprocessing. Furthermore, by focusing on defense measures at the model structure level and selecting the most robust network structure through model structure search during training, the model's training effectiveness and robustness are improved. This, in turn, enhances the trained model's ability to defend against adversarial attacks. Attached Figure Description
[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0033] Figure 1 is a flowchart illustrating a neural network model training method for adversarial defense provided in an embodiment of this application;
[0034] Figure 2 is a schematic diagram of a specific process for training a neural network model for adversarial defense provided in an embodiment of this application;
[0035] Figure 3 is a schematic diagram of two training stages of a neural network model training method for adversarial defense provided in an embodiment of this application;
[0036] Figure 4 is a schematic diagram showing the accuracy of the model provided in the embodiments of this application for point cloud classification tasks under adversarial attacks.
[0037] Figure 5 is a schematic diagram of the components of a neural network model training system for adversarial defense provided in an embodiment of this application;
[0038] Figure 6 is a block diagram illustrating the internal structure of a smart terminal according to an embodiment of this application. Detailed Implementation
[0039] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail.
[0040] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.
[0041] It should also be understood that the terminology used in this application specification is for the purpose of describing particular embodiments only and is not intended to limit the application. As used in this application specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.
[0042] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.
[0043] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to classification." Similarly, the phrases "if determined" or "if classified to [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once classified to [the described condition or event]," or "in response to classification to [the described condition or event]."
[0044] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.
[0045] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.
[0046] Currently, neural network models are being used more and more widely. For example, point cloud processing can be based on neural network models, thus applying them to various scenarios. Point clouds, as a core representation of 3D data, are widely used in fields such as autonomous driving, scene modeling, and medical imaging. In recent years, point cloud deep learning technology has developed rapidly, greatly improving the ability to understand 3D scenes. However, point cloud security issues have gradually become prominent, with adversarial attacks being a common attack method. Point cloud adversarial attacks introduce perturbations by adding, deleting, or relocating points to weaken model performance. Existing defense technologies mainly focus on point cloud data processing; for example, DUP-Net restores point clouds by removing outliers and upsampling, while PointCutMix improves robustness by replacing points to generate new samples—these are data-level defense measures.
[0047] However, the above-mentioned defense methods still have shortcomings. For example, they mainly focus on data-level defense measures and do not fully explore the impact of network architecture on adversarial robustness; data preprocessing may introduce errors or information loss, leading to a decline in the performance of the main task; and adversarial training and network architecture lack deep integration, making it difficult to form a comprehensive and efficient defense effect.
[0048] To address at least one of the aforementioned technical problems, this application proposes the following steps: First, a first adversarial sample is generated based on information about the model to be trained, wherein the information about the model to be trained includes structural parameters and / or network weight parameters. The model to be trained is then subjected to adversarial training based on the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and the model to be trained is updated, wherein the structural parameters are used to update the sub-network layer structure of the model to be trained. The process of generating the first adversarial sample based on the information about the model to be trained is repeated until a preset structural search termination condition is met, resulting in a candidate model with completed structural search. The structural parameters of the candidate model are then fixed, and the candidate model is trained to obtain target network weight parameters. Finally, based on the target network weight parameters and the fixed structural parameters, a target neural network model after training is obtained.
[0049] Compared to existing technologies, the neural network model training method for adversarial defense provided in this application focuses on defense measures at the model structure level rather than the data level during neural network model training. This eliminates the need for preprocessing training data, avoiding errors or information loss introduced during data preprocessing. Furthermore, by focusing on defense measures at the model structure level and selecting the most robust network structure through model structure search during training, the model's training effectiveness and robustness are improved. This, in turn, enhances the trained model's ability to defend against adversarial attacks.
[0050] As shown in Figure 1, this application embodiment provides a neural network model training method for adversarial defense. Specifically, the method includes the following steps:
[0051] Step S100: Generate a first adversarial sample corresponding to the model to be trained based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained.
[0052] Among them, the above-mentioned training model is a neural network model that needs to be trained for adversarial defense. The specific model can be preset according to actual needs.
[0053] Specifically, before generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained, the method further includes:
[0054] Based on the preset initial state network framework, an initial model to be trained is obtained. In the network framework of the initial model to be trained, each node is provided with multiple alternative sub-network layers and structural parameters corresponding to each sub-network layer.
[0055] It should be noted that the problem addressed in this application is that existing point cloud deep learning models lack adversarial robustness in their structural design, making them difficult to effectively resist adversarial attacks and resulting in insufficient reliability and stability. This application introduces Neural Architecture Search (NAS) based on adversarial training, which can dynamically optimize the network structure during adversarial defense training, making it more robust in adversarial scenarios. Simultaneously, a hybrid adversarial training strategy is combined to further improve the model's overall performance under both adversarial attacks and normal input, overcoming the problem of insufficient adversarial robustness in existing model structures.
[0056] The neural network model training method for adversarial defense provided in this application can improve the robustness of the trained neural network model (e.g., a point cloud model) in adversarial scenarios. The training process mainly consists of two stages: robust structure search and network weight training. In robust structure search, the initial network framework is composed of supernets, meaning that there are multiple candidate sub-network layers and corresponding structural parameters between each node. After the robust structure search is completed, a suitable sub-network is selected. In network weight training, various attack methods are used to generate different adversarial samples, enabling the model to achieve more comprehensive defensive performance during adversarial training.
[0057] It should be noted that, in the embodiments of this application, the use of a neural network model for point cloud processing is taken as an example for specific explanation, that is, the trained neural network model is a point cloud processing model, but this is not intended as a specific limitation.
[0058] Specifically, for the point cloud adversarial problem, the target model f() is trained on the dataset Above, among which, For a point cloud containing N points, Y i For the corresponding tags. Adversarial sample X generated by the adversarial attack. i 'Aims to make f(X)' i )≠Y i The goal of the defense method is to minimize the impact of adversarial examples on the model. The optimization objective is shown in the following formula (1):
[0059] Where θ is the model parameter, which is determined according to the model training process; L() is the loss function. Subscripts indicate that the data was taken from the training set. This represents the expectation (or probability average) of the data. Unlike traditional point cloud adversarial training, this application introduces a differentiable structure search mechanism into the network, enabling the model to dynamically optimize architecture parameters and network weights during training. Correspondingly, the optimization objective is modified as shown in the following formula (2):
[0060] Here, A and W represent structural parameters and network weights, respectively. Their specific values are determined based on the model's training process, and their initial values can be preset during training.
[0061] Furthermore, the generation of the first adversarial example corresponding to the model to be trained based on the information of the model to be trained includes:
[0062] Based on the information of the model to be trained, a first adversarial sample corresponding to the model to be trained is generated using a preset first adversarial sample generation algorithm.
[0063] The aforementioned first adversarial example generation algorithm is set and adjusted according to actual needs. In this embodiment, Projected Gradient Descent (PGD) is used as the first adversarial example generation algorithm to generate the first adversarial examples used in the structure search process. In actual use, other algorithms can also be set as the first adversarial example generation algorithm, and no specific limitation is made here.
[0064] In this embodiment, adversarial examples are generated based on one or more of the model's gradient information, structural parameters, network weight parameters, and output feedback. The purpose is to cause the model to make incorrect predictions by making small perturbations to the input data. For example, when generating adversarial examples based on the PGD algorithm, gradient perturbations are applied iteratively, and projection is performed within the perturbation range.
[0065] It should be noted that the model structure includes the number of layers, activation functions, and connection methods. Adversarial example generation algorithms can utilize the structural information of the model to design more effective attack methods.
[0066] Step S200: Perform adversarial training on the model to be trained based on the first adversarial example to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and update the model to be trained. The structural parameters are used to update the sub-network layer structure of the model to be trained.
[0067] Specifically, the above-mentioned adversarial training is performed on the above-mentioned model to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and the above-mentioned model to be trained is updated, including:
[0068] Based on the first adversarial example and the preset structure search strategy, the optimal operation is determined from all candidate operations between nodes of the model to be trained, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and the model to be trained is updated according to the structure parameters and network weight parameters corresponding to the current structure search round.
[0069] In this embodiment, during the robust model structure search phase, the network is structured around computational units as basic building blocks. Each computational unit contains two input nodes, one output node, and three intermediate nodes. Node x i and x j The operations between them are determined by the architecture parameter α. (i,j) The definition, in its specific form, is shown in formula (3) below:
[0070] Where O is the set of all operations in the search space, o(x i ) represents a network layer in the search space, o (i,j) (x i The output is obtained by aggregating the outputs of these network layers. Intermediate nodes aggregate the outputs of all predecessor nodes, while output nodes aggregate the results of all intermediate nodes, as shown in formula (4) below:
[0071] In this embodiment, during the structure search phase, a PGD-based adversarial example generation module is used to transform the input point cloud into adversarial examples and perform adversarial training. In each update, the structural parameters and network weights are optimized to search for a robust network architecture. The core steps of the architecture search include: initializing the network, with node operations encompassing all possible operations in the search space; optimizing the structural parameters A and network weights W using an adversarial training strategy; employing a greedy strategy in the decision-making phase, progressively selecting the optimal operation between nodes until only one operation is retained for all candidate edges; and discarding the network weights and retaining the robust network structure for the next stage after the robust architecture (i.e., robust model structure) search is completed.
[0072] Step S300: Return to the above steps of generating the first adversarial example corresponding to the above-mentioned training model based on the information of the training model, until the preset structure search termination condition is met, and obtain the candidate model after the structure search is completed.
[0073] In this embodiment, during the structure search phase, iterative training is performed until a preset structure search termination condition is met. This preset structure search termination condition can be pre-set and adjusted according to actual needs; for example, it can be set to the number of iterations reaching a preset iteration threshold, or the loss of the trained model reaching a preset loss threshold. No specific limitations are imposed here.
[0074] Step S400: Fix the structural parameters of the above candidate model, train the above candidate model to obtain the target network weight parameters, and obtain the target neural network model after training based on the target network weight parameters and the fixed structural parameters.
[0075] Specifically, the structural parameters of the aforementioned candidate model are fixed, and the candidate model is trained to obtain the target network weight parameters, including:
[0076] Based on the information of the above candidate models, generate the second adversarial sample corresponding to the above model to be trained;
[0077] The structural parameters of the above candidate models are fixed, and the above candidate models are adversarially trained based on the above second adversarial sample to obtain the target network weight parameters.
[0078] The generation of the second adversarial sample corresponding to the model to be trained based on the information of the candidate model includes:
[0079] Based on the information of the model to be trained, second adversarial samples corresponding to the model to be trained are generated using a variety of preset second adversarial sample generation algorithms.
[0080] It should be noted that the second adversarial examples are generated using multiple second adversarial example generation algorithms, and the network weight parameters are trained based on these algorithms. The aforementioned first adversarial example generation algorithms may include the first adversarial example generation algorithm itself, or they may be several other completely different algorithms; no specific limitation is made here. In this embodiment, the aforementioned second adversarial example generation algorithms include projective gradient descent, additive attack (ADD), and dropout attack (Drop).
[0081] Specifically, during the network weight training phase, the robust network structure generated in the first phase is fixed, and only the network weights W are optimized. The training employs a hybrid adversarial training strategy, which combines multiple adversarial attack methods (such as PGD, Add, and Drop attacks) to generate adversarial samples, and simultaneously uses both clean samples and adversarial samples for training. The optimization objective is shown in the following formula (5):
[0082] After the network weight training phase, the final network weight parameters are obtained as the target weight parameters. Based on the target network weight parameters and the fixed structure parameters determined in the structure search phase, the trained target neural network model is obtained. After the network weight training phase, the final network model has a robust architecture and robust network weights, significantly enhancing the robustness of the point cloud model in adversarial scenarios.
[0083] As can be seen from the above, in this application, the first adversarial sample corresponding to the model to be trained is generated based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained; the model to be trained is adversarially trained based on the first adversarial sample to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and the model to be trained is updated, wherein the structural parameters are used to update the sub-network layer structure of the model to be trained; the step of generating the first adversarial sample corresponding to the model to be trained based on the information of the model to be trained is returned to be executed until the preset structural search termination condition is met, and a candidate model with completed structural search is obtained; the structural parameters of the candidate model are fixed, and the candidate model is trained to obtain the target network weight parameters; based on the target network weight parameters and the fixed structural parameters, the target neural network model after training is obtained.
[0084] Compared to existing technologies, the neural network model training method for adversarial defense provided in this application focuses on defense measures at the model structure level rather than the data level during neural network model training. This eliminates the need for preprocessing training data, avoiding errors or information loss introduced during data preprocessing. Furthermore, by focusing on defense measures at the model structure level and selecting the most robust network structure through model structure search during training, the model's training effectiveness and robustness are improved. This, in turn, enhances the trained model's ability to defend against adversarial attacks.
[0085] In this embodiment, the above-mentioned neural network model training method for adversarial defense is further described in detail based on a specific application scenario. Figure 2 is a schematic flowchart of a neural network model training method for adversarial defense provided in this embodiment, and Figure 3 is a schematic diagram of two training stages of a neural network model training method for adversarial defense provided in this embodiment. As shown in Figures 2 and 3, the neural network model training method for adversarial defense in this embodiment includes two stages of model framework training: a robust structure search stage and a network weight training stage. This embodiment proposes a point cloud defense framework (RobNAS) that combines neural architecture search (NAS) and adversarial training. By introducing PGD-based adversarial training in the NAS structure search stage, the robustness of the network architecture is directly optimized, avoiding the limitations of randomly selecting sub-networks. Specifically, in the architecture search stage of point cloud adversarial defense, the framework introduces adversarial examples into the training process. By adjusting the optimization objective of the network, the most robust network architecture is selected. Subsequently, in the weight training stage, adversarial examples generated by various attack methods are used to perform mixed training on the model, thereby enhancing the adaptability of the model parameters to different attack strategies. This application significantly improves the adversarial defense performance in point cloud classification tasks by optimizing the adversarial robustness of point cloud models from the perspective of network structure. It effectively alleviates the problems of insufficient robustness, information loss, and limited defense effect in existing methods, achieving leading defense performance in black-box adversarial scenarios. It should be noted that the robust architecture search in Figure 2 and the robust structure search stage in Figure 3 both represent the structure search stage in this application, used to search for robust neural network model structures.
[0086] Specifically, in related technologies, defense methods for point cloud models mainly include traditional adversarial training methods and preprocessing techniques. Adversarial training methods use adversarial examples from the point cloud as training data to enable the model to adapt to adversarial examples during training. Preprocessing techniques, on the other hand, insert a preprocessing layer before the model's input layer to render the adversarial examples harmless to the model. While these methods improve adversarial defense capabilities from different perspectives, they often neglect the dynamic optimization of the network structure itself.
[0087] To address the aforementioned issues, this application proposes a model training method based on neural network architecture search and adversarial training for point cloud classification tasks. Unlike traditional adversarial training methods that use a fixed network structure, this application introduces neural network architecture search technology, enabling the network structure to be optimized along with the network weights during adversarial training, thereby effectively improving the model's robustness. Furthermore, this robustness is only related to the network structure and not to the network weights. Even when training with clean point cloud samples during the network weight training phase, good defensive performance can be maintained. The robust architecture search method proposed in this application allows for flexible adjustment of the network structure during training, searching for structures with better robustness under adversarial attacks. This dynamic structure optimization approach allows for fine-tuning and adaptation according to the required task, modifying the type of adversarial examples, thereby improving overall model performance.
[0088] It should be noted that the network weight training strategy and its optimization objective used in the embodiments of this application, as well as the basic model of the entire framework, can be adjusted according to actual needs, and are not specifically limited here.
[0089] Figure 4 is a schematic diagram comparing the accuracy of the model provided in this application for point cloud classification tasks under adversarial attacks. Specifically, Figure 4 shows the accuracy of the target neural network model trained by this application (i.e., the model processed by the RobNAS method in Figure 4) and the existing models based on point cloud defense techniques Hybrid Training and IF-Defense under different adversarial attacks for point cloud classification tasks. As can be seen from Figure 4, the solution of this application significantly improves the model's defense capability against adversarial examples compared with existing solutions.
[0090] As shown in Figure 5, corresponding to the above-described neural network model training method for adversarial defense, this application embodiment also provides a neural network model training system for adversarial defense, the above-described neural network model training system for adversarial defense comprising:
[0091] The first adversarial sample generation module 510 is used to generate a first adversarial sample corresponding to the model to be trained based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained.
[0092] The structure search module 520 is used to perform adversarial training on the model to be trained based on the first adversarial example to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and update the model to be trained, wherein the structure parameters are used to update the sub-network layer structure of the model to be trained.
[0093] Search control module 530 is used to return to the step of generating the first adversarial example corresponding to the training model based on the information of the training model, until the preset structure search termination condition is met, and obtain the candidate model after structure search is completed.
[0094] The network weight training module 540 is used to fix the structural parameters of the above candidate model, train the above candidate model to obtain the target network weight parameters, and obtain the target neural network model after training based on the above target network weight parameters and the fixed structural parameters.
[0095] Therefore, adversarial defense during neural network model training focuses on defenses at the model structure level, rather than data-level defenses. This eliminates the need for preprocessing training data, avoiding errors or information loss introduced during data preprocessing. Simultaneously, focusing on structural defenses allows for the selection of the most robust network structure through model structure search during training, improving both training effectiveness and robustness. This, in turn, enhances the trained model's ability to defend against adversarial attacks.
[0096] It should be noted that the specific structure and implementation of the neural network model training system for adversarial defense and its various modules or units can be referred to the corresponding descriptions in the above method embodiments, and will not be repeated here.
[0097] It should be noted that the division of the modules in the neural network model training system for adversarial defense described above is not unique and is not intended as a specific limitation.
[0098] Based on the above embodiments, this application also provides a smart terminal, the principle block diagram of which is shown in Figure 6. The smart terminal includes a processor, a memory, a network interface, and a display screen connected via a system bus. The processor of the smart terminal provides computing and control capabilities. The memory of the smart terminal includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the smart terminal is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps of any of the above-described neural network model training methods for adversarial defense. The display screen of the smart terminal can be a liquid crystal display screen or an e-ink display screen.
[0099] Those skilled in the art will understand that the principle block diagram shown in Figure 6 is merely a block diagram of a portion of the structure related to the solution of this application, and does not constitute a limitation on the smart terminal to which the solution of this application is applied. A specific smart terminal may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.
[0100] In one embodiment, a smart terminal is provided, the smart terminal including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of any of the neural network model training methods for adversarial defense provided in the embodiments of this application.
[0101] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the neural network model training methods for adversarial defense provided in this application.
[0102] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.
[0103] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the above device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above device can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.
[0104] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.
[0105] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0106] In the embodiments provided in this application, it should be understood that the disclosed systems / terminal devices and methods can be implemented in other ways. For example, the system / terminal device embodiments described above are merely illustrative. For instance, the division of modules or units described above is merely a logical functional division, and in actual implementation, it can be divided in other ways. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0107] If the integrated modules / units described above are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, and software distribution media, etc. It should be noted that the content included in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.
[0108] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions are not in essence a departure from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.
Claims
1. A method for training a neural network model for adversarial defense, characterized in that, The method includes: The first adversarial sample corresponding to the model to be trained is generated based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained; The model to be trained is subjected to adversarial training based on the first adversarial example to obtain the structural parameters and network weight parameters corresponding to the current structural search round, and the model to be trained is updated, wherein the structural parameters are used to update the sub-network layer structure of the model to be trained. Return to the step of generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained, until the preset structure search termination condition is met, and obtain the candidate model after the structure search is completed; The structural parameters of the candidate model are fixed, and the candidate model is trained to obtain the target network weight parameters. Based on the target network weight parameters and the fixed structural parameters, the target neural network model after training is obtained.
2. The neural network model training method for adversarial defense according to claim 1, characterized in that, Before generating the first adversarial example corresponding to the model to be trained based on the information of the model to be trained, the method further includes: Based on the preset initial state network framework, an initial model to be trained is obtained. In the network framework of the initial model to be trained, each node is provided with multiple alternative sub-network layers and structural parameters corresponding to each sub-network layer.
3. The neural network model training method for adversarial defense according to claim 1, characterized in that, The step of generating the first adversarial sample corresponding to the model to be trained based on the information of the model to be trained includes: Based on the information of the model to be trained, a first adversarial sample corresponding to the model to be trained is generated using a preset first adversarial sample generation algorithm.
4. The neural network model training method for adversarial defense according to claim 1, characterized in that, The step of performing adversarial training on the model to be trained based on the first adversarial example to obtain the structural parameters and network weight parameters corresponding to the current structure search round, and updating the model to be trained, includes: Based on the first adversarial example and the preset structure search strategy, the optimal operation is determined from all candidate operations between nodes of the model to be trained, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and the model to be trained is updated according to the structure parameters and network weight parameters corresponding to the current structure search round.
5. The method for training a neural network model for adversarial defense according to any one of claims 1 to 4, characterized in that, The process of fixing the structural parameters of the candidate model, training the candidate model, and obtaining the target network weight parameters includes: Generate a second adversarial sample corresponding to the model to be trained based on the information of the candidate model; The structural parameters of the candidate model are fixed, and the candidate model is adversarially trained based on the second adversarial example to obtain the target network weight parameters.
6. The neural network model training method for adversarial defense according to claim 5, characterized in that, The step of generating the second adversarial sample corresponding to the model to be trained based on the information of the candidate model includes: Based on the information of the model to be trained, second adversarial samples corresponding to the model to be trained are generated using a variety of preset second adversarial sample generation algorithms.
7. The neural network model training method for adversarial defense according to claim 6, characterized in that, The second adversarial example generation algorithm includes projective gradient descent, additive attack, and dropout attack.
8. A neural network model training system for adversarial defense, characterized in that, The system includes: The first adversarial example generation module is used to generate a first adversarial example corresponding to the model to be trained based on the information of the model to be trained, wherein the information of the model to be trained includes the structural parameters and / or network weight parameters of the model to be trained. The structure search module is used to perform adversarial training on the model to be trained based on the first adversarial example, so as to obtain the structure parameters and network weight parameters corresponding to the current structure search round, and update the model to be trained, wherein the structure parameters are used to update the sub-network layer structure of the model to be trained. The search control module is used to return to the step of generating the first adversarial sample corresponding to the model to be trained based on the information of the model to be trained, until the preset structure search termination condition is met, and the candidate model after the structure search is completed is obtained. The network weight training module is used to fix the structural parameters of the candidate model, train the candidate model to obtain the target network weight parameters, and obtain the target neural network model after training based on the target network weight parameters and the fixed structural parameters.
9. A smart terminal, characterized in that, The smart terminal includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When executed by the processor, the computer program implements the steps of the neural network model training method for adversarial defense as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the neural network model training method for adversarial defense as described in any one of claims 1 to 7.