CN111259881A - Adversarial sample protection method based on feature map denoising and image enhancement - Google Patents

Abstract

The invention discloses an adversarial sample protection method based on feature map denoising and image enhancement. the brightest point, slice the feature map; judge whether the slice belongs to the bright area, the dark area or the robust area, if it belongs to the bright area, move the coordinates of the positioning point to the second brightest point in the feature map, if it belongs to the dark area or the robust area area, search for the second brightest point in the feature map, change the pixel values of all points in the feature map slice to the pixel value of the brightest point; return the pixel values of all points in the dark area and robust area to 0; The feature maps processed above are merged and stacked. The invention can effectively alleviate the influence of the denoising process on the neural network, so that it can maintain a high accuracy rate when recognizing clean samples, and has better universality.

Description

Adversarial sample protection method based on feature map denoising and image enhancement

technical field

The invention relates to the technical fields of artificial intelligence security and information security, and in particular to an adversarial sample protection method based on feature map denoising and image enhancement.

Background technique

Since the explosive development of deep learning in 2012, neural networks including CNN (Convolutional Neural Networks), DN (Deconvolutional networks), GAN (Generative adversarial networks), etc. have gradually achieved significantly better results than traditional target detection methods in the field of image detection and recognition. , and occupies an important position in the field of computer vision. However, the linear nature of neural networks makes them easy to be fooled by adversarial samples maliciously constructed by attackers, which threatens the security of deep learning models.

In adversarial example attacks, the attacker causes the deep learning model to identify errors by adding linear perturbations to the input. The attack principle of adversarial samples is that the small perturbations in the adversarial samples increase layer by layer with the increase of the number of iterations, and finally cause the classifier output of the model to be wrong. Attack methods are divided into two categories, namely Black-box Attacks and White-box Attacks. In the black-box scenario, the attacker cannot obtain detailed information such as model parameters, while in the white-box scenario, the attacker can construct adversarial samples with known model information.

Adversarial sample generation algorithms include: 1) FGSM attack algorithm (Fast gradient sign method). Its training goal is to obtain adversarial examples by increasing the loss function by adding a small offset in the gradient direction. 2) I-FGSM attack algorithm (iterative FGSM). The goal is to construct more accurate adversarial examples by multiple iterations of the FGSM algorithm, adding small offsets to the input multiple times. The main harms caused by attacking algorithms include:

Misclassification in the field of image detection and pattern recognition;

Abnormal identification in the field of autonomous driving, the team of Professor Down Song of the University of California deceived the artificial intelligence of autonomous driving by sticking tape on the "STOP" traffic sign;

Misidentification in the field of face recognition, researchers at Carnegie Mellon University have found that advanced artificial intelligence recognition systems can be fooled by wearing specially designed glasses frames.

Considering the harmfulness of adversarial sample attacks, it is necessary to provide reliable, stable and effective protection methods.

There are three types of adversarial sample protection methods.

(1) Adversarial training: By adding adversarial samples to the training set, the model can acquire the corresponding data, that is, perform certain regularization.

(2) Distillation: By training the model with a soft target (soft target), the gradient of the model is smoother, making it more difficult for an attacker to obtain gradient information.

(3) Denoising: denoising the input to weaken and eliminate the noise information imposed by the attacker.

Existing adversarial sample protection algorithms have achieved good results in the task of defending against adversarial samples, but there are defects in the application process. The distillation method is difficult to apply when the task scale is large and the model is complex, while the denoising method will make the image lose some information. On the other hand, considering the complexity of the model structure, the existing protection methods are difficult to transfer between models, which undoubtedly brings difficulties to the protection task. In addition, some existing protection methods increase the complexity of the model, resulting in a substantial increase in the amount of computation.

SUMMARY OF THE INVENTION

In order to improve the robustness of the deep learning model against adversarial samples, the present invention proposes an adversarial sample protection method based on feature map denoising and image enhancement. On the basis of not changing the model structure, it is modified in the feature map space to achieve the purpose of denoising.

In order to achieve one purpose, the technical scheme adopted in the present invention is as follows:

Construct the neural network model of the image, including three convolutional layers, and perform the following operations on the first convolutional layer:

S1. Perform slice and feature map extraction on the target feature channel;

S2, moving the coordinates of the positioning point to the brightest point of the feature map, and slicing the feature map with the brightest point as the center;

S3, judge that the slice belongs to a bright area, a dark area or a robust area, if it belongs to a bright area, then move the coordinates of the positioning point to the second brightest point in the feature map, if it belongs to a dark area or a robust area, Then search again to find the second brightest point in the feature map, and locate the coordinates of the positioning point to this point;

S4. Repeat S3 until the number of searches reaches a predetermined number of times, and change the pixel values of all points in the feature map slice to the pixel value of the highest point;

S5. Return the pixel values of all points in the dark area and the robust area to 0 to remove noise;

S6. Merge and stack the feature maps processed above, and the combined feature map is equal to the size of the original feature channel.

Preferably, in S3, a depth-first search algorithm is used to search for the second brightest point in the feature map.

Further, in the depth-first search algorithm, the current coordinate is updated recursively, and the coordinate of the second bright spot is used as the positioning coordinate parameter recursively used next time.

Preferably, the judging whether the slice belongs to a bright area, a dark area or a robust area is specifically: judging whether the positioning point is located at the boundary of an effective connected feature, if so, processing the connected feature bidirectionally along the boundary, if not, searching for the slice The second bright spot in the interior; after judging that it is a bright area, the positioning slice takes the current positioning coordinates as the coordinate value of the second bright spot in the center area of the cross, that is, the positioning coordinate value of the second bright spot needs to be directly adjacent to the current positioning coordinates; review the repositioning coordinates , if the condition is not met, the recursive call ends; the condition is: the number of processed pixels in the full feature map shall not exceed one-third of the total number of pixels in the full image.

Further, a central axis boundary determination algorithm is used to determine whether the positioning point is located at the boundary of an effective connected feature.

Further, the central axis boundary determination algorithm determines whether the axis is a boundary by comparing the pixel values of the symmetrical points on both sides of the central axis with the bright area determination value and the dark area determination value; the dark area determination value is set to the full image. The maximum value of the median and the average value of the pixel value, the bright area judgment value is the dark area judgment value plus the corresponding parameter 0.05.

Preferably, the identification value of the bright area is set to be the pixel value located at one-third of the total number of pixels when the pixel values of the entire image are sorted in positive order.

Preferably, the identification value of the dark area is set to be the pixel value located at one-third of the total number of pixels when the pixel values of the entire image are sorted in reverse order.

While improving the robustness of the neural network to identify samples, the invention can effectively alleviate the influence of the denoising process on the neural network, so that it can maintain a high accuracy rate when recognizing clean samples; The processing has good universality, because it does not change the characteristics of the model structure, and effectively avoids the problem of possible increase in model complexity. After testing on the test set, it is verified that the present invention can effectively defend against FGSM and other attack algorithms.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a flowchart of an adversarial sample protection method based on feature map denoising and image enhancement according to an embodiment of the present invention;

Fig. 2 is the accuracy comparison diagram of the method of the embodiment of Fig. 1 and the prior art on the FGSM algorithm generating the hostile sample test set;

Fig. 3 is the method of the embodiment of Fig. 1 and the prior art on the I-FGSM algorithm to generate the accuracy rate comparison chart of the hostile sample test set; Fig. 4 is the comparison effect diagram before and after the method of the embodiment of Fig. 1 is applied, (a) is the application Before the method of this embodiment, (b) is after applying the method of this embodiment.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

As shown in Figure 1, this embodiment is an adversarial sample protection method based on feature map denoising and image enhancement, including the following steps:

Step 1. Slice and extract the feature map for the target feature channel;

Step 2. Move the coordinates of the positioning point to the brightest point of the feature map, and slice the feature map with the brightest point as the center;

Step 3. Determine whether the slice belongs to a bright area, a dark area or a robust area. If it belongs to a bright area, move the coordinates of the positioning point to the second brightest point in the feature map. If it belongs to a dark area or a robust area , then search again to find the second brightest point in the feature map, and locate the coordinates of the positioning point to this point;

Step 4. Repeat step 3 until the number of searches reaches a predetermined number of times, and change the pixel values of all points in the feature map slice to the pixel value of the highest point;

Step 5. Return the pixel values of all points in the dark area and the robust area to 0 to remove noise;

Step 6. Merge and stack the feature maps processed above, and the combined feature map is equal to the original feature channel in size.

In this embodiment, the feature channel extracted by the first layer of convolutional layer is selected, the size of the feature map is 28*28mm, and the number of slices is 32. In this embodiment, the experimental object is an adversarial sample dataset generated by the FGSM algorithm and the I-FGSM algorithm on the MNIST dataset with an image size of 28*28mm.

In a preferred embodiment, in step 2, slicing the feature map with the brightest point as the center, specifically, slicing the feature map with the brightest point as the center and a radius of 3 mm.

In a preferred embodiment, the depth-first search algorithm is used to search for the second bright spot in the feature map, specifically by recursively updating the current coordinates, and taking the second bright spot coordinates as the positioning recursively adopted next time. Coordinate parameters to realize continuous search judgment.

In this embodiment, the identification value of the bright area is set to be the pixel value located at one third of the total number of pixels when the pixel values of the whole image are sorted in positive order.

In this embodiment, the identification value of the dark area is set to be the pixel value located at one third of the total number of pixels when the pixel values of the entire image are sorted in reverse order.

When judging the effective connected feature, that is, the operation of judging that the region is a bright region rather than a robust region or a dark region, the criteria used are as follows:

1. Determine whether the anchor point is located on the boundary of the effective connected feature. If so, the feature is processed bidirectionally along the boundary. In this embodiment, the central axis boundary determination algorithm is adopted. The dark area judgment value is set to the maximum value of the median and the average value of the pixel value of the whole image. The judgment value of the bright area is the judgment value of the dark area plus the corresponding parameter, such as 0.05. The central axis boundary judgment algorithm determines whether the axis is a boundary by comparing the pixel values of the symmetrical points on both sides of the central axis with the judgment value of the bright area and the judgment value of the dark area.

2. After it is judged to be a bright area, the positioning slice takes the current positioning coordinate as the second bright coordinate value of the cross center area, that is, the coordinate value must be directly adjacent to the current positioning coordinate to ensure the connectivity of effective features.

3. Review the relocation coordinates. If the conditions are not met, the recursive call ends. The new positioning coordinate value must meet the following conditions: the number of processed pixels in the full feature map shall not exceed one-third of the total number of pixels in the full image.

In a specific implementation manner, the number of pixels that have been determined to be modified to the brightest value among the 8 azimuth pixel values with the positioning point as the center and 2 as the radius is calculated, and the number should not exceed 5. This limit helps limit false relocations caused by excessively large perturbation application areas and perturbations bordering valid feature boundaries, preventing the flooding of bright-area discriminant anchors and resulting in damage to the feature map.

In this embodiment, three methods of relocation restriction, area relocation restriction, and direction location restriction are adopted to enhance the processing effect of the sample, effectively preventing the feature map from being damaged due to excessive processing, and increasing its robustness.

1. Relocation limit: The number of times the location coordinates are relocated to the brightest point of the whole image.

2. Area relocation limit: The number of times the location coordinates are relocated in the same area.

3. Direction positioning limit: For each positioning, if the number of 8 direction squares that have been positioned is greater than the limit parameter, the positioning operation will be abandoned. The direction positioning limit assumes that the setting parameter is 5. The limit is the vertical distance of the direction grid from the anchor point. The limit range is set to 2.

The numerical values listed above are only to illustrate a situation in a preferred embodiment, and are used as examples instead of being limited to the numerical values. There may also be other situations, which cannot be listed one by one. All embodiments that belong to the inventive idea of the present invention and are embodied by the technical solutions of the present invention are all within the protection scope of the present invention.

The technical means disclosed in the solution of the present invention are not limited to the technical means disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features.

Claims (8)

1. an adversarial sample protection method based on feature map denoising and image enhancement, is characterized in that, comprises the following steps, Construct the neural network model of the image, including three convolutional layers, and perform the following operations on the first convolutional layer: S1. Perform slice and feature map extraction on the target feature channel; S2, moving the coordinates of the positioning point to the brightest point of the feature map, and slicing the feature map with the brightest point as the center; S3, judge that the slice belongs to a bright area, a dark area or a robust area, if it belongs to a bright area, then move the coordinates of the positioning point to the second brightest point in the feature map, if it belongs to a dark area or a robust area, Then search again to find the second brightest point in the feature map, and locate the coordinates of the positioning point to this point; S4. Repeat S3 until the number of searches reaches a predetermined number of times, and change the pixel values of all points in the feature map slice to the pixel value of the highest point; S5. Return the pixel values of all points in the dark area and the robust area to 0 to remove noise; S6. Merge and stack the feature maps processed above, and the combined feature map is equal to the size of the original feature channel. 2. The adversarial sample protection method based on feature map denoising and image enhancement according to claim 1, wherein in S3, a depth-first search algorithm is used to search for the second brightest point in the feature map. 3. the hostile sample protection method based on feature map denoising and image enhancement according to claim 2, is characterized in that, described depth-first search algorithm is specifically, by recursively updating current coordinates, with the second bright spot coordinates as below The positioning coordinate parameter to be used recursively once. 4. the hostile sample protection method based on feature map denoising and image enhancement according to claim 1, is characterized in that, described judging that described slice belongs to bright area, dark area or robust area is specifically: Determine whether the anchor point is located at the boundary of the effective connected feature, if so, process the connected feature bidirectionally along the boundary, and if not, find the second bright spot in the slice; After being judged to be a bright area, the positioning slice takes the current positioning coordinates as the coordinate value of the second bright spot in the center area of the cross, that is, the positioning coordinate value of the second bright spot needs to be directly adjacent to the current positioning coordinates; Review the repositioning coordinates, and end the recursive call if the conditions are not met; the conditions are: the number of processed pixels in the full feature map shall not exceed one-third of the total number of pixels in the full image. 5. The adversarial sample protection method based on feature map denoising and image enhancement according to claim 4, characterized in that, a central axis boundary determination algorithm is used to determine whether the positioning point is located at an effective connected feature boundary. 6. the hostile sample protection method based on feature map denoising and image enhancement according to claim 5, is characterized in that, described central axis boundary determination algorithm is by comparing the pixel value of symmetrical point on both sides of central axis and bright area determination value and dark area. The determination value of the area is determined to determine whether the axis is a boundary; the determination value of the dark area is set as the maximum value of the median and the average value of the pixel value of the whole image. 7. the hostile sample protection method based on feature map denoising and image enhancement according to claim 4, is characterized in that, when setting the identification value of described bright area to full image pixel value in positive order, it is located in the total pixel point. The pixel value at the third position. 8. the hostile sample protection method based on feature map denoising and image enhancement according to claim 4, is characterized in that, when setting the identification value of described dark area to full image pixel value in reverse order, it is located in the total number of pixels. The pixel value at the third position.

Images