CN110610208A

CN110610208A - Active safety increment data training method

Info

Publication number: CN110610208A
Application number: CN201910859405.3A
Authority: CN
Inventors: 张吉昕; 秦拯; 黄小凤; 胡玉鹏; 张吉良; 蒋孜博
Original assignee: Hunan University
Current assignee: Hunan University
Priority date: 2019-09-11
Filing date: 2019-09-11
Publication date: 2019-12-24

Abstract

The invention relates to an active safety increment data training method. The invention mainly comprises (1) an incremental data retraining method based on active learning; (2) model security verification method based on anti-sample attack detection. Based on the method, newly added samples are dynamically trained, the model is updated, and the stability of the model is ensured while the decision boundary of the model is expanded.

Description

Active safety increment data training method

Technical Field

The invention relates to the field of machine learning, in particular to an active safety increment data training method.

Background

In recent years, with the rapid development of artificial intelligence technologies represented by machine learning, artificial intelligence technologies such as machine learning are widely used in various fields such as computer vision, natural language processing, security, finance, and the like. The machine learning method is used for fitting a model approximating the real world data law by training a large amount of data and predicting the real world data law based on the model. The machine learning method is mainly classified into a supervised learning method, an unsupervised learning method, an reinforcement learning method, an ensemble learning method, and the like. The supervised learning method has the advantages that the model accuracy is high and the defect is mainly reflected in the requirement of a large amount of marked data by training the data with the labels; the unsupervised learning method only trains unlabeled data, has the advantages of no need of marking data and has the defect of insufficient model accuracy; the reinforcement learning method searches a solution space through an optimization strategy, has the advantages that training data is not needed, and has the disadvantages that the search time is long and the return function designed aiming at the target has a large influence on the result; the ensemble learning method forms a strong classifier by integrating a plurality of weak classifiers, has the advantages of enhancing the accuracy of the original model and having the defect of difficult training for a long time.

Although the above machine learning method has been widely used and has achieved certain effects, there are still some problems to be improved: on one hand, in view of the characteristic that supervised learning methods, especially deep learning methods based on neural networks, have high accuracy, such methods have become one of the most mainstream machine learning methods at present, but such methods require a large amount of labeled data for training, which limits the development of the methods. On the other hand, the deep learning method based on the neural network can be used for resisting sample attack by a small number of wrongly marked samples, so that the accuracy of the originally trained model is sharply reduced.

Disclosure of Invention

The invention aims to solve the problems of small amount of labeled samples in a neural network and false labeled sample attack resistance.

Therefore, the invention provides an active security incremental data training method, which mainly comprises two parts of contents:

(1) an incremental data retraining method based on active learning;

(2) model security verification method based on anti-sample attack detection.

The specific contents are as follows:

retraining incremental data by adopting the method (1) to realize dynamic training of the incremental data; meanwhile, the method (2) is adopted to detect the attack of the countercheck sample, so that the stability of the model in the dynamic training process is ensured; and (3) combining the method (1) and the method (2), and realizing safe incremental training of the neural network algorithm under the condition of only a small number of labeled samples. The specific algorithm is as follows:

(1) incremental data retraining method based on active learning.

Based on labeled initial training sample set X ═ { X₁,x₂,....,x_nAnd its label set Y ═ Y₁,y₂,....,y_nAdopting a neural network algorithm to update a formula according to the weightAnd (5) carrying out supervised training to obtain an initial training model NeuNet (< X, Y >). Wherein Loss is a Loss function, e.g. mean square errorOr the cross entropy Loss is-y · high (w · x) - (1-y) · log (1-h (w · x)).

And copying an initial training model NeuNet (< X, Y >), namely the original model, and obtaining an original model copy NeuNetCopy (< X, Y >). Newly added unlabeled training sample X' ═ { X) based on the model₁',x₂',....,x_n'} calculating confidence level according to the formula Conf NeuNetCopy (X'), with confidence level range of [0,1 }]。

If the confidence of the newly added sample is [0.9,1 ]]And in the range, judging the newly added sample as a credible sample. Marks the original training sample copy X, adds the new sample to the original training sample copy X_copy＝{x_1copy,x_2copy,....,x_ncopyIn the method, a new sample set X is obtained_copy'＝{x_1copy,x_2copy,....,x_ncopy,x₁',x₂',....,x_k' } and use the sampleNeuNetCopy (X) retraining the original model replica_copy') to obtain a new model copy NeuNetCopy (< X)_copyY >, X'). The above process is iterated in sequence.

Compared with the original model, the decision boundary of the new model is continuously enlarged by iteratively retraining the new sample, so that more new samples with confidence coefficient greater than 0.9 can be obtained, more accurate models can be generated more efficiently, and the discrimination capability of the models is improved.

(2) Model security verification method based on anti-sample attack detection.

The invention aims at the new sample set X_copy'＝{x_1copy,x_2copy,....,x_ncopy,x₁',x₂',....,x_k' } and a new model copy NeuNetCopy (< X) retrained from the original model copy_copyY >, X') based on the initial training sample copy X_copy＝{x_1copy,x_2copy,....,x_ncopyDetecting a new model copy NeuNetCopy (< X)_copyY >, X'), through N iterations, a new model and its corresponding accuracy after each iteration is obtained.

And detecting whether the new model re-trained according to the newly added samples is attacked by the resisting samples by calculating the accuracy rate change gradient of the new model copy of the latest N iterations (N is 10). According to the formulaCalculating the accuracy rate change gradient of the historical model copy of N iterations, wherein Grad represents the gradient and ACC_nRepresenting the new model accuracy, ACC, after the Nth iteration₀Representing the accuracy of the original model. If the gradient decreases (gradient)<0) The rate is too fast (>5%), abandoning the newly added sample and the new model copy; the reverse, i.e. the gradient rises (gradient)>0) Or the reduction rate is gentle, the original model NeuNet is updated by using the new model copy (< X, Y >, X'), and meanwhile, the original training sample X is changed to { X { (X) }₁,x₂,....,x_nIs updated to X_copy'＝{x_1copy,x_2copy,....,x_ncopy,x₁',x₂',....,x_k', and update the set of labels Y ═ Y₁,y₂,....,y_n}。

Drawings

FIG. 1 is a schematic representation of the embodiment of the present invention

Detailed Description

The invention is implemented by combining the scheme shown in the attached figure 1, and comprises the following steps:

the first step is as follows: inputting an initial training sample into a neural network;

the second step is that: training the training sample by the neural network to obtain a detection model;

the third step: copying the detection model to obtain a detection model copy;

the fourth step: inputting the newly added sample into the copy of the detection model;

the fifth step: detecting the newly added sample by the detection model copy, regarding the newly added sample with the confidence coefficient of more than 0.9 as a credible sample, and marking the newly added sample;

and a sixth step: retraining the newly added samples with the reliability of more than 0.9 by using a neural network to obtain a new detection model copy;

the seventh step: copying an initial training sample to obtain an initial training sample copy;

eighth step: inputting an initial training sample copy into a new detection model copy for testing;

the ninth step: calculating new detection model accuracy changes new model copy accuracy changes were calculated for the last N iterations (N ═ 10).

The tenth step: if the accuracy rate changes by less than 5%, updating the original detection model;

the eleventh step: and simultaneously updating the new sample into the initial training sample.

Claims

1. An active safety increment data training method is characterized in that:

(1) an incremental data retraining method based on active learning;

(2) model security verification method based on anti-sample attack detection.

2. The incremental data method based on active learning of claim 1, wherein aiming at the problem that the neural network algorithm can only train labeled initial data and is difficult to dynamically train newly added unlabeled data, based on the active learning method, the confidence level of the newly added data is dynamically calculated, newly added high-confidence training data is retrained, the security of a new model is verified, the model is dynamically updated, the decision boundary of the model is gradually enlarged, and finally the neural network algorithm retrains the incremental data.

3. The method for verifying model security based on antagonistic sample detection according to claim 1, wherein aiming at the problem that the accuracy of the trained model is reduced when the neural network algorithm is attacked by the antagonistic sample, the model after each iteration is recorded as the historical copy of the model by dynamically training the new data, and the stability of the model in the latest N iterations is detected by using the original data to test the change gradient of the accuracy of the historical copy of the latest N iterations, thereby realizing the detection of the antagonistic sample attack and ensuring the security of the model.