WO2021051561A1 - Adversarial defense method and apparatus for image classification network, electronic device, and computer-readable storage medium - Google Patents

Abstract

Disclosed are an adversarial defense method and apparatus for an image classification network, an electronic device, and a computer-readable storage medium, belonging to the technical field of image classification. The method comprises: inputting an original image sample and an adversarial attack sample into a deep neural network so as to extract input features of target layers, the number of which is greater than a predetermined number, of the deep neural network; generating a loss function of the deep neural network according to the input features to serve as an adversarial defense denoiser; using the adversarial defense denoiser to denoise the adversarial attack sample to obtain a denoised adversarial attack sample; regularizing the loss function of the deep neural network to obtain a deep neural network subjected to regularization; and inputting the original image sample and the denoised adversarial attack sample into the deep neural network subjected to regularization to obtain a classification result of an original image. By means of the solution of the present application, the defense capability of an image classification deep neural network can be effectively improved.

Description

Confrontation defense method, device, electronic equipment and computer readable storage medium of image classification network

This application claims the priority of the Chinese patent application 201910879339.6 filed on September 18, 2019 with the title of "Image Classification Network Countermeasures and Defense Methods and Related Devices", the entire contents of which are incorporated herein by reference.

Technical field

This application relates to the field of image classification technology, and in particular to an image classification network confrontation defense method, device, electronic equipment, and computer-readable storage medium.

Background technique

With the in-depth applications in the fields of image, voice, and video, the requirements of deep neural networks for information security are getting higher and higher. The inventor of this application realized that although deep neural networks can be used in the process of image classification It has a very high accuracy performance, but often adding a slight noise disturbance to the sample will cause the classification error of the neural network. Due to its susceptibility to attacks by adversarial samples, deep neural networks are required to improve their defense capabilities and reduce the possibility of adversarial samples deceiving the network.

Summary of the invention

In order to solve the above technical problems, an object of the present application is to provide an image classification network confrontation defense method, device, electronic equipment, and computer-readable storage medium.

Among them, the technical solution adopted in this application is:

On the one hand, an image classification network confrontation defense method includes: inputting original image samples and confrontation attack samples into a deep neural network to extract input features of target layers of the deep neural network higher than a predetermined number of layers; Input features to generate the loss function of the deep neural network as an adversarial defense denoiser; use the adversarial defense denoiser to denoise the adversarial attack samples to obtain denoised adversarial attack samples; The loss function of the network is regularized to obtain a regularized deep neural network; the original image samples and the denoised counterattack samples are input into the regularized deep neural network to obtain the original image Classification results.

On the other hand, an image classification network confrontation defense device includes: an extraction module for inputting original image samples and confrontation attack samples into a deep neural network to extract the target layer of the deep neural network higher than a predetermined number of layers Input features; a generation module, used to generate the loss function of the deep neural network according to the input features, as a confrontation defense denoiser; denoising module, used to use the confrontation defense denoiser on the confrontation attack sample Perform denoising to obtain denoised counterattack samples; regularization module, used to regularize the loss function of the deep neural network to obtain a regularized deep neural network; classification module, combine the original image samples with The denoising counterattack sample is input to the regularized deep neural network to obtain the classification result of the original image.

On the other hand, an electronic device includes: a processing unit; and a storage unit for storing an adversarial defense program of the image classification network of the processing unit; wherein the processing unit is configured to execute the image classification network via The confrontation defense program executes the confrontation defense method of the image classification network as described above.

On the other hand, a computer-readable storage medium stores a confrontation defense program of an image classification network, and when the confrontation defense program of the image classification network is executed by a processing unit, the confrontation defense method of the image classification network as described above is realized.

In the above technical solution, combining high-order features and gradient regularization, the image obtained by denoising attack samples with high-order feature loss is input to the original neural network after gradient regularization, which can better improve the deep neural network. Ground defense capabilities.

It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the application.

Description of the drawings

The drawings here are incorporated into the specification and constitute a part of the specification, show embodiments that conform to the application, and are used together with the specification to explain the principle of the application.

Fig. 1 schematically shows a flow chart of a confrontation defense method for an image classification network.

Fig. 2 schematically shows an example diagram of an application scenario of a confrontation defense method for an image classification network.

Fig. 3 schematically shows a flow chart of a sample input method.

Fig. 4 schematically shows a block diagram of an anti-defense device of an image classification network.

Fig. 5 shows a block diagram of an electronic device for implementing the above-mentioned confrontation defense method of the image classification network according to an exemplary embodiment.

Fig. 6 shows a schematic diagram of a computer-readable storage medium for implementing the above-mentioned confrontation defense method of the image classification network according to an exemplary embodiment.

Through the above drawings, the specific embodiments of the present application have been shown, and there will be more detailed descriptions in the following. These drawings and text descriptions are not intended to limit the scope of the concept of the present application in any way, but by referring to specific embodiments. The concept of this application is explained to those skilled in the art.

detailed description

Here, an exemplary embodiment will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings indicate the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the application as detailed in the appended claims.

Example embodiments will now be described more fully with reference to the accompanying drawings. However, the example embodiments can be implemented in various forms, and should not be construed as being limited to the examples set forth herein; on the contrary, the provision of these embodiments makes this application more comprehensive and complete, and fully conveys the concept of the example embodiments To those skilled in the art. The described features, structures or characteristics can be combined in one or more embodiments in any suitable way.

This example embodiment first provides an adversarial defense method for an image classification network. The adversarial defense method of the image classification network can be run on a server, a server cluster or a cloud server, etc. Of course, those skilled in the art can also operate according to their needs. The method of running this application on other platforms is not particularly limited in this exemplary embodiment. As shown in FIG. 1, the confrontation defense method of the image classification network may include the following steps:

Step S110, input the original image sample and the counter-attack sample into the deep neural network to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers;

Step S120, generating a loss function of the deep neural network according to the input feature as an anti-defense denoiser;

Step S130, denoising the adversarial attack sample by using the adversarial defense denoiser to obtain a denoised adversarial attack sample;

Step S140, regularizing the loss function of the deep neural network to obtain a regularized deep neural network;

Step S150: Input the original image sample and the denoised counterattack sample into the regularized deep neural network to obtain a classification result of the original image.

In the above-mentioned confrontation defense method of the image classification network, first, the original image sample and the confrontation attack sample are input into the deep neural network to extract the input features of the target layer of the deep neural network higher than the predetermined number of layers; in this way, the order can be extracted A sufficiently high difference clearly contrasts the characteristics of higher-order neural networks. Then, the loss function of the deep neural network is generated according to the input features as an anti-defense denoiser; in this way, the loss function can be generated based on the input features with obvious differences, which can effectively ensure the effect of the neural network model and the goal of optimization. Secondly, use the adversarial defense denoiser to denoise the adversarial attack samples to obtain denoised adversarial attack samples; in this way, a denoiser can be generated based on the features of the adversarial attack samples and the original image samples for the adversarial attack samples. Perform denoising and realize the defense method of deep neural network, so that confrontation and defense are connected with each other. Then, the loss function of the deep neural network is regularized to obtain a regularized deep neural network; the parameters are optimized through the regularization of the loss function to further ensure the effect of the deep learning model. Finally, input the original image sample and the denoised counterattack sample into the regularized deep neural network to obtain the classification result of the original image. Combining high-order features and gradient regularization methods, inputting the image obtained by denoising attack samples with high-order feature loss into the original neural network after gradient regularization can better improve the defense capabilities of deep neural networks.

Hereinafter, each step in the confrontation defense method of the image classification network in this exemplary embodiment will be explained and described in detail with reference to the accompanying drawings.

In step S110, the original image samples and the anti-attack samples are input to the deep neural network to extract input features of the target layer of the deep neural network higher than a predetermined number of layers.

In the embodiment of this example, referring to FIG. 2, after the server 201 crawls the original image samples and counterattack samples from the server 202, it inputs the deep neural network deployed on the server 201, and extracts the deep neural network higher than the predetermined value. The input characteristics of the target layer of the number of layers. In this way, in the subsequent steps, the server 201 can generate the loss function of the deep neural network according to the input characteristics, which can be used as an anti-defense denoiser. It can be understood that in the subsequent steps, if conditions permit, the server 202 may also directly obtain the original image sample and the counter attack sample from its own storage space. Among them, the server 201 and the server 202 may be any devices with processing capabilities, such as computers, cloud servers, micro-processing units, etc., which are not specifically limited herein.

The input characteristics of the target layer higher than the predetermined layer of the deep neural network, that is, the input characteristics of the target layer higher than the predetermined layer in each layer of the deep neural network from low to high when classifying the image sample. For example, the high-order features of the high-order convolutional layer of the convolutional neural network. The determination of the predetermined layer can be set according to requirements, such as 3 layers, 4 layers, and so on.

The difference between the sample against the attack in the image layer and the original image is very small, but the difference in high-order features such as convolutional neural networks is very obvious. By extracting the high-order features of the original image samples and the neural network of the counter attack samples, and comparing and analyzing the differences between the two, it can be more robust in dealing with different counter attacks.

In an embodiment, the adversarial attack sample includes:

When an original image sample is received, noise is applied to the original image sample to obtain an anti-attack sample corresponding to the original image sample.

Counter attack methods are mainly white box attacks and black box attacks based on FGSM and I-FGSM. FGSM mainly attacks by adding incremental noise or single-pixel modification in the gradient direction, thereby inducing the network to attack the generated image Misclassify adversarial samples. Compared with white box attacks, black box attacks do not need to know the specific information of the attacked model. It is suitable for different network models and has better attack transferability.

Therefore, applying noise to the original image sample is to add noise through the counter-attack method to obtain the counter-attack sample corresponding to the original image sample, so that the correspondence between the original image and the counter-attack sample can be guaranteed.

In an embodiment, the adversarial attack sample includes:

When an original image sample is received, noise is added to the original image sample by means of noise adding methods corresponding to a variety of deep neural networks to obtain multiple counter-attack samples;

The inputting the original image sample and the counter-attack sample into the deep neural network to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers includes:

Input the original image sample and each of the anti-attack samples into the deep neural network respectively, and extract the sub-input features of the target layer of the deep neural network higher than a predetermined number of layers;

Obtain a set of all sub-input features as the input feature.

The noise addition methods of multiple deep neural networks are multiple counter-attack methods. Through multiple counter-attack methods, noise is added to the original image samples in turn to obtain multiple counter-attack samples, which can be combined with multiple networks (resnet, Inception, nasnet, etc.) The attack method of) obtains multiple confrontation images of the original image. Then, the original image sample and each counter-attack sample are input into the deep neural network, respectively, after extracting the sub-input features of the target layer of the deep neural network higher than the predetermined number of layers, the set of sub-input features is obtained as the input feature. Extracting high-order feature sets to determine the loss function settings of the deep neural network in the subsequent steps can ensure that the defense model has better generalization capabilities. At the same time, the neural network that can be applied to the denoising method of the anti-defense denoiser based on the difference of high-order features can be not only limited to the current network, but has a broad resistance to similar attacks.

In an embodiment, the adversarial attack sample includes:

When an original image sample is received, noise is added to the original image sample in combination with a variety of noise addition methods of deep neural networks to obtain a counterattack sample;

The inputting the original image sample and the counter-attack sample into the deep neural network to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers includes:

The original image samples and the counter-attack samples are input to the deep neural network, and the input features of the target layer of the deep neural network higher than the predetermined number of layers are extracted.

In this way, the attack methods of multiple networks (resnet, Inception, and nasnet) can be combined to obtain the original image of the confrontational image, and the sum of high-order features of the target layer of the deep neural network higher than the predetermined number of layers can be extracted to determine in the subsequent steps The loss function setting of the deep neural network. It can further ensure that the defense model has better generalization capabilities. At the same time, the neural network that is applied to the denoising method of the anti-defense denoiser based on the difference of high-order features can be not limited to the current network, and has a wider resistance to similar attacks.

In an embodiment, referring to FIG. 3, inputting original image samples and counter-attack samples into a deep neural network includes:

Step S310, adjusting the network parameters of the original image sample and the anti-attack sample to be consistent;

Step S320: Input the original image samples and the counter-attack samples whose network parameters are adjusted to be consistent into a deep neural network.

Network parameters are the number of samples, sample length, sample width, sample depth (corresponding to the number of image channels) and other parameters. By adjusting the network parameters of the original image sample and the anti-attack sample to be consistent, the comparability of the two samples input to the deep neural network can be guaranteed.

In an embodiment, the inputting the original image samples and the anti-attack samples into the deep neural network to extract the input features of the target layer higher than the predetermined layer of the deep neural network includes:

Inputting the original image sample into the deep neural network, extracting the original image sample into the first network feature of the target layer of the deep neural network;

Inputting the counter-attack sample into the deep neural network, extracting the second network feature of the counter-attack sample input into the target layer of the deep neural network;

The input feature is generated according to the first network feature and the second network feature.

In step S120, a loss function of the deep neural network is generated according to the input feature as a countermeasure defense denoiser.

In the implementation of this example, the effect of the neural network model and the goal of optimization are defined by a loss function. The input features of the target layer higher than the predetermined layer of the deep neural network obtained according to the above steps, and the obvious difference characteristics of the higher-order input features (the input features of the target layer higher than the predetermined layer) are used to generate the loss function of the deep learning network , Can make the effect of the neural network model corresponding to the loss function and the optimization goal more significant. Wherein, generating the loss function of the deep learning network can be based on inputting the anti-attack sample extracted from the input features into the anti-attack feature of the predetermined layer of the deep neural network and the original image sample input into the original feature of the predetermined layer of the deep neural network to generate the average absolute value Error loss function or cross entropy loss function, etc.

In an embodiment, generating the loss function of the deep neural network according to the input feature as an anti-defense denoiser includes:

According to the formula L=||f _l (x')-f _l (x)||, the loss function of the deep neural network is generated as an adversarial defense denoiser, wherein the f _l (x') is the input The anti-attack samples extracted from the features are input to the network features of the predetermined layer of the deep neural network, and the f _l (x) is the predetermined input of the original image samples extracted from the input features to the deep neural network The network feature of the layer, L=||f _l (x')-f _l (x)|| represents the loss value of the network feature of the original image sample relative to the network feature of the counter attack sample.

This can force the deep neural network to classify without deviating from _{the difference between the network feature f l} (x) of the _{original image sample and the adversarial feature f l} (x') of the adversarial attack sample, which forms effective constraints on the deep learning network and effectively guarantees The effect of the neural network model and the goal of optimization.

In step S130, the confrontational defense denoiser is used to denoise the confrontational attack samples to obtain denoised confrontational attack samples.

In the implementation of this example, the denoising of the adversarial attack samples using the aforementioned adversarial defense denoiser is, for example, by the neighborhood averaging method, assigning the average value of a pixel and all pixels in its neighborhood to the corresponding pixel in the output image , Which makes the samples input to the deep learning network smoother and defends against attacks on image samples. It can be understood that the method of denoising can also be denoising according to the median filtering method. Because the above-mentioned confrontation defense denoiser is based on the confrontation features extracted from the input features that the confrontation attack samples are input into the predetermined layer of the deep neural network and the original image samples are input into the original features of the predetermined layer of the deep neural network The difference is obtained based on the difference of high-order features, so the adversarial defense denoiser is used to denoise the adversarial attack samples. After denoising, the adversarial attack samples can make the adversarial attacks and defense methods related to each other, increasing the difference between the two Correlation, resulting in defenses that can be well adapted to new attack methods.

In step S140, regularization is performed on the loss function of the deep neural network to obtain a regularized deep neural network.

In the implementation of this example, regularization is to limit the parameters of the loss function. Since the effect of the neural network model and the optimization goal are defined by the loss function, regularization can make the fitting process of the loss function let The weights are as small as possible, and finally a network model with relatively small parameters is constructed. Models with small parameter values are relatively simple, can adapt to different data sets, and avoid overfitting to a certain extent. The process of regularization through the loss function corresponding to the extracted high-order input features forms a gradient regularization process, thereby effectively ensuring the classification accuracy of the deep learning network. The regularization method may be, for example, L1 regularization or L2 regularization.

In an embodiment, regularizing the loss function of the deep neural network to obtain a regularized deep neural network includes:

Regularize the loss function of the deep neural network according to the formula L(ω,b)=R(ω,b)+λ||ω|| ² to obtain a regularized deep neural network, where L(ω, b) is the loss function after regularization, R(ω,b) is the loss function before regularization, λ||ω|| ² is the regularization term, and λ is the regularization coefficient.

The regularization coefficient is a value less than 1, and the parameter ω of the loss function can be restricted ^{by the λ||ω|| 2 regularization term.}

In step S150, input the original image sample and the denoised counterattack sample into the regularized deep neural network to obtain the classification result of the original image.

The embodiment of the present application combines high-order input feature extraction and gradient regularization methods, and input the anti-attack samples obtained by denoising the attack samples through high-order feature loss and the original image samples into the original neural network after the gradient regularization , To complete the classification of the original image, can better improve the defense capabilities of the deep neural network.

Among the related methods, the counter attack methods are mainly white box attacks and black box attacks based on FGSM and I-FGSM. FGSM mainly adds noise in the gradient direction, thereby inducing the network to make mistakes on the generated image counter samples. classification. Compared with white box attacks, black box attacks do not need to know the specific information of the attacked model. It is suitable for different network models and has better attack transferability. However, the current confrontational attacks and defense methods are often independent of each other and lack a certain degree of correlation, which leads to the inability of defense methods to adapt to new attack methods and cause classification errors.

The embodiment of the present application is based on the fact that the difference between the image layer and the original image based on the adversarial attack sample is very small, but the difference in the high-order features of the convolutional neural network is obvious. This method compares the differences in the high-level features of the neural network between the adversarial attack sample and the original image, so that it has stronger robustness in dealing with different adversarial attacks;

The neural network applicable to denoising through high-order feature differences is not limited to the current network, and has broader application significance in dealing with similar attacks;

Combining high-order features and gradient regularization methods, the image obtained by denoising the attack samples with high-order feature loss is input to the original neural network after gradient regularization to better improve defense capabilities.

This application also provides a countermeasure and defense device for an image classification network. Referring to FIG. 4, the confrontation defense device of the image classification network may include a subscription module 410, a distribution module 420, a receiving module 430, and a pushing module 450. among them:

The extraction module 410 is configured to input the original image samples and the anti-attack samples into the deep neural network, so as to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers;

The generating module 420 is configured to generate a loss function of the deep neural network according to the input feature, as a countermeasure defense denoiser;

The denoising module 430 is configured to denoise the adversarial attack samples by using the adversarial defense denoiser to obtain denoised adversarial attack samples;

The regularization module 440 is configured to regularize the loss function of the deep neural network to obtain a regularized deep neural network;

The classification module 450 inputs the original image sample and the denoised counterattack sample into the regularized deep neural network to obtain the classification result of the original image.

The specific details of each module in the confrontation defense device of the image classification network have been described in detail in the confrontation defense method of the corresponding image classification network, so it will not be repeated here.

It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above may be embodied in one module or unit. Conversely, the features and functions of a module or unit described above can be further divided into multiple modules or units to be embodied.

In addition, although the various steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that these steps must be performed in the specific order, or that all the steps shown must be performed to achieve the desired result. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step for execution, and/or one step may be decomposed into multiple steps for execution, etc.

Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the method according to the embodiment of the present application.

In the exemplary embodiment of the present application, an electronic device capable of implementing the above method is also provided.

Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method, or a program product. Therefore, each aspect of the present application can be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, which can be collectively referred to herein as "Circuit", "Module" or "System".

The electronic device 500 according to this embodiment of the present application will be described below with reference to FIG. 5. The electronic device 500 shown in FIG. 5 is only an example, and should not bring any limitation to the function and scope of use of the embodiments of the present application.

As shown in FIG. 5, the electronic device 500 is represented in the form of a general-purpose computing device. The components of the electronic device 500 may include, but are not limited to: the aforementioned at least one processing unit 510, the aforementioned at least one storage unit 520, and a bus 530 connecting different system components (including the storage unit 520 and the processing unit 510).

Wherein, the storage unit stores program code, and the program code can be executed by the processing unit 510, so that the processing unit 510 executes the various exemplary methods described in the “Exemplary Method” section of this specification. Steps of implementation. For example, the processing unit 510 may perform step S110 as shown in FIG. 1: input the original image samples and the anti-attack samples into the deep neural network to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers S120: Generate the loss function of the deep neural network according to the input feature as a countermeasure defense denoiser; Step S130: Use the countermeasure defense denoiser to denoise the counter attack sample to obtain the denoised Counterattack samples; step S140: regularize the loss function of the deep neural network to obtain a regularized deep neural network; step S150: input the original image samples and the denoised counterattack samples into all The regularized deep neural network is used to obtain the classification result of the original image.

The storage unit 520 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 5201 and/or a cache storage unit 5202, and may further include a read-only storage unit (ROM) 5203.

The storage unit 520 may also include a program/utility tool 5204 having a set (at least one) program module 5205. Such program module 5205 includes but is not limited to: an operating system, one or more application programs, other program modules, and program data, Each of these examples or some combination may include the implementation of a network environment.

The bus 530 may represent one or more of several types of bus structures, including a storage unit bus or a storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local area using any bus structure among multiple bus structures. bus.

The electronic device 500 can also communicate with one or more external devices 700 (such as keyboards, pointing devices, Bluetooth devices, etc.), and can also communicate with one or more devices that enable customers to interact with the electronic device 500, and/or communicate with Any device (such as a router, modem, etc.) that enables the electronic device 500 to communicate with one or more other computing devices. Such communication can be performed through an input/output (I/O) interface 550. In addition, the electronic device 500 may also communicate with one or more networks (for example, a local area network (LAN), a wide area network (WAN), and/or a public network, such as the Internet) through the network adapter 560. As shown in the figure, the network adapter 560 communicates with other modules of the electronic device 500 through the bus 530. It should be understood that although not shown in the figure, other hardware and/or software modules can be used in conjunction with the electronic device 500, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives And data backup storage system, etc.

Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described here can be implemented by software, or can be implemented by combining software with necessary hardware. Therefore, the technical solution according to the embodiments of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , Including several instructions to make a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) execute the method according to the embodiment of the present application.

In the exemplary embodiment of the present application, as shown in FIG. 6, a computer-readable storage medium is also provided, which stores a program product capable of implementing the above-mentioned method of this specification. The computer-readable storage medium may be a computer Non-volatile readable storage medium. In some possible implementation manners, various aspects of the present application can also be implemented in the form of a program product, which includes program code. When the program product runs on a terminal device, the program code is used to make the The terminal device executes the steps according to various exemplary embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

Referring to FIG. 6, a program product 600 for implementing the above method according to an embodiment of the present application is described. It can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be installed in a terminal device, For example, running on a personal computer. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program, and the program can be used by or in combination with an instruction execution system, device, or device.

The program product can use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable Type programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.

The computer-readable signal medium may include a data signal propagated in baseband or as a part of a carrier wave, and readable program code is carried therein. This propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. The readable signal medium may also be any readable medium other than a readable storage medium, and the readable medium may send, propagate, or transmit a program for use by or in combination with the instruction execution system, apparatus, or device.

The program code contained on the readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

The program code used to perform the operations of the present application can be written in any combination of one or more programming languages. The programming languages include object-oriented programming languages—such as Java, C++, etc., as well as conventional procedural programming languages. Programming language-such as "C" language or similar programming language. The program code can be executed entirely on the client computing device, partly executed on the client device, executed as an independent software package, partly executed on the client computing device and partly executed on the remote computing device, or entirely on the remote computing device or server Executed on. In the case of a remote computing device, the remote computing device can be connected to a client computing device through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (for example, using Internet service providers). Business to connect via the Internet).

In addition, the above-mentioned drawings are merely schematic illustrations of the processing included in the method according to the exemplary embodiments of the present application, and are not intended for limitation. It is easy to understand that the processing shown in the above drawings does not indicate or limit the time sequence of these processings. In addition, it is easy to understand that these processes can be executed synchronously or asynchronously in multiple modules, for example.

After considering the specification and practicing the invention disclosed herein, those skilled in the art will easily think of other embodiments of the present application. This application is intended to cover any variations, uses, or adaptive changes of this application. These variations, uses, or adaptive changes follow the general principles of this application and include common knowledge or customary technical means in the technical field that are not disclosed in this application. . The description and embodiments are only regarded as exemplary, and the true scope and spirit of the application are pointed out by the claims.

Claims (22)

1. An image classification network confrontation defense method, including:

   Inputting the original image sample and the counter attack sample into the deep neural network to extract input features of the target layer of the deep neural network higher than a predetermined number of layers;

   Generating a loss function of the deep neural network according to the input feature as an anti-defense denoiser;

   Denoising the adversarial attack sample by using the adversarial defense denoiser to obtain a denoised adversarial attack sample;

   Regularizing the loss function of the deep neural network to obtain a regularized deep neural network;

   The original image sample and the denoised counterattack sample are input into the regularized deep neural network to obtain a classification result of the original image.
2. The method according to claim 1, wherein the anti-attack sample comprises:

   When an original image sample is received, noise is applied to the original image sample to obtain an anti-attack sample corresponding to the original image sample.
3. The method according to claim 1, wherein the anti-attack sample comprises:

   When an original image sample is received, noise is added to the original image sample by means of noise adding methods corresponding to a variety of deep neural networks to obtain multiple counter-attack samples;

   The inputting the original image samples and the counter-attack samples into the deep neural network, and extracting the input features of the target layer of the deep neural network higher than a predetermined number of layers, includes:

   Input the original image sample and each of the anti-attack samples into the deep neural network respectively, and extract the sub-input features of the target layer of the deep neural network higher than a predetermined number of layers;

   Obtain a set of all sub-input features as the input feature.
4. The method according to claim 1, wherein said inputting original image samples and counterattack samples into a deep neural network comprises:

   Adjusting the network parameters of the original image sample and the anti-attack sample to be consistent;

   The original image samples and the anti-attack samples whose network parameters are adjusted to be consistent are input into a deep neural network.
5. The method according to claim 1, wherein the generating a loss function of the deep neural network according to the input characteristics as a countermeasure defense denoiser comprises:

   According to the formula L=||f _l (x')-f _l (x)||, the loss function of the deep neural network is generated as an adversarial defense denoiser, wherein the f _l (x') is the input The anti-attack samples extracted from the features are input to the network features of the predetermined layer of the deep neural network, and the f _l (x) is the predetermined input of the original image samples extracted from the input features to the deep neural network The network feature of the layer, L=||f _l (x')-f _l (x)|| represents the loss value of the network feature of the original image sample relative to the network feature of the counter attack sample.
6. The method according to claim 1, wherein the regularizing the loss function of the deep neural network to obtain a regularized deep neural network comprises:

   Regularize the loss function of the deep neural network according to the formula L(ω,b)=R(ω,b)+λ||ω|| ² to obtain a regularized deep neural network, where L(ω, b) is the loss function after regularization, R(ω,b) is the loss function before regularization, λ||ω|| ² is the regularization term, and λ is the regularization coefficient.
7. The method according to claim 1, wherein said inputting original image samples and counterattack samples into a deep neural network to extract input features of a target layer higher than a predetermined layer of the deep neural network comprises:

   Inputting the original image sample into the deep neural network, extracting the original image sample into the first network feature of the target layer of the deep neural network;

   Inputting the counter-attack sample into the deep neural network, extracting the second network feature of the counter-attack sample input into the target layer of the deep neural network;

   The input feature is generated according to the first network feature and the second network feature.
8. A confrontation and defense device for an image classification network, including:

   The extraction module is used to input the original image samples and the counterattack samples into the deep neural network to extract the input features of the target layer of the deep neural network higher than a predetermined number of layers;

   A generating module, which is used to generate a loss function of the deep neural network according to the input feature as a countermeasure defense denoiser;

   A denoising module, configured to denoise the adversarial attack sample by using the adversarial defense denoiser to obtain a denoised adversarial attack sample;

   The regularization module is used to regularize the loss function of the deep neural network to obtain a regularized deep neural network;

   The classification module is used to input the original image sample and the denoised counterattack sample into the regularized deep neural network to obtain the classification result of the original image.
9. The device according to claim 8, further comprising:

   When an original image sample is received, noise is applied to the original image sample to obtain an anti-attack sample corresponding to the original image sample.
10. The device according to claim 8, further comprising:

    When an original image sample is received, noise is added to the original image sample by means of noise adding methods corresponding to a variety of deep neural networks to obtain multiple counter-attack samples;

    The inputting the original image samples and the counter-attack samples into the deep neural network, and extracting the input features of the target layer of the deep neural network higher than a predetermined number of layers, includes:

    Input the original image sample and each of the anti-attack samples into the deep neural network respectively, and extract the sub-input features of the target layer of the deep neural network higher than a predetermined number of layers;

    Obtain a set of all sub-input features as the input feature.
11. The apparatus according to claim 8, wherein the extraction module is configured to:

    Adjusting the network parameters of the original image sample and the anti-attack sample to be consistent;

    The original image samples and the anti-attack samples whose network parameters are adjusted to be consistent are input into a deep neural network.
12. The apparatus according to claim 8, wherein the generating module is configured to:

    According to the formula L=||f _l (x')-f _l (x)||, the loss function of the deep neural network is generated as an adversarial defense denoiser, wherein the f _l (x') is the input The anti-attack samples extracted from the features are input to the network features of the predetermined layer of the deep neural network, and the f _l (x) is the predetermined input of the original image samples extracted from the input features to the deep neural network The network feature of the layer, L=||f _l (x')-f _l (x)|| represents the loss value of the network feature of the original image sample relative to the network feature of the counter attack sample.
13. The apparatus according to claim 8, wherein the classification module is configured to:

    Regularize the loss function of the deep neural network according to the formula L(ω,b)=R(ω,b)+λ||ω|| ² to obtain a regularized deep neural network, where L(ω, b) is the loss function after regularization, R(ω,b) is the loss function before regularization, λ||ω|| ² is the regularization term, and λ is the regularization coefficient.
14. The apparatus according to claim 8, wherein the extraction module is configured to:

    Inputting the original image sample into the deep neural network, extracting the original image sample into the first network feature of the target layer of the deep neural network;

    Inputting the counter-attack sample into the deep neural network, extracting the second network feature of the counter-attack sample input into the target layer of the deep neural network;

    The input feature is generated according to the first network feature and the second network feature.
15. An electronic device comprising: a processing unit; and a storage unit for storing a confrontation defense program of the image classification network of the processing unit; wherein the processing unit is configured to execute the confrontation defense program of the image classification network Perform the following processing:

    Inputting the original image sample and the counter attack sample into the deep neural network to extract input features of the target layer of the deep neural network higher than a predetermined number of layers;

    Generating a loss function of the deep neural network according to the input feature as an anti-defense denoiser;

    Denoising the adversarial attack sample by using the adversarial defense denoiser to obtain a denoised adversarial attack sample;

    Regularizing the loss function of the deep neural network to obtain a regularized deep neural network;

    The original image sample and the denoised counterattack sample are input into the regularized deep neural network to obtain a classification result of the original image.
16. The electronic device according to claim 15, wherein the counterattack attack sample comprises:

    When an original image sample is received, noise is applied to the original image sample to obtain an anti-attack sample corresponding to the original image sample.
17. The electronic device according to claim 15, wherein the counterattack attack sample comprises:

    When an original image sample is received, noise is added to the original image sample by means of noise adding methods corresponding to a variety of deep neural networks to obtain multiple counter-attack samples;

    The inputting the original image samples and the counter-attack samples into the deep neural network, and extracting the input features of the target layer of the deep neural network higher than a predetermined number of layers, includes:

    Input the original image sample and each of the anti-attack samples into the deep neural network respectively, and extract the sub-input features of the target layer of the deep neural network higher than a predetermined number of layers;

    Obtain a set of all sub-input features as the input feature.
18. The electronic device according to claim 15, wherein the inputting the original image samples and the counterattack samples into the deep neural network comprises:

    Adjusting the network parameters of the original image sample and the anti-attack sample to be consistent;

    The original image samples and the anti-attack samples whose network parameters are adjusted to be consistent are input into a deep neural network.
19. The electronic device according to claim 15, wherein the generating the loss function of the deep neural network according to the input feature as a countermeasure defense denoiser comprises:

    According to the formula L=||f _l (x')-f _l (x)||, the loss function of the deep neural network is generated as an adversarial defense denoiser, wherein the f _l (x') is the input The anti-attack samples extracted from the features are input to the network features of the predetermined layer of the deep neural network, and the f _l (x) is the predetermined input of the original image samples extracted from the input features to the deep neural network The network feature of the layer, L=||f _l (x')-f _l (x)|| represents the loss value of the network feature of the original image sample relative to the network feature of the counter attack sample.
20. 15. The electronic device according to claim 15, wherein said regularizing the loss function of the deep neural network to obtain a regularized deep neural network comprises:

    Regularize the loss function of the deep neural network according to the formula L(ω,b)=R(ω,b)+λ||ω|| ² to obtain a regularized deep neural network, where L(ω, b) is the loss function after regularization, R(ω,b) is the loss function before regularization, λ||ω|| ² is the regularization term, and λ is the regularization coefficient.
21. 15. The electronic device according to claim 15, wherein said inputting original image samples and counterattack samples into a deep neural network to extract input features of a target layer higher than a predetermined layer of the deep neural network comprises:

    Inputting the original image sample into the deep neural network, extracting the original image sample into the first network feature of the target layer of the deep neural network;

    Inputting the counter-attack sample into the deep neural network, extracting the second network feature of the counter-attack sample input into the target layer of the deep neural network;

    The input feature is generated according to the first network feature and the second network feature.
22. A computer-readable storage medium on which a confrontation defense program of an image classification network is stored, and the method of any one of claims 1 to 7 is executed when the confrontation defense program of the image classification network is executed by a processing unit.

Images