WO2022062649A1

WO2022062649A1 - Neural network robustness measurement method, and apparatus

Info

Publication number: WO2022062649A1
Application number: PCT/CN2021/109616
Authority: WO
Inventors: 赵仁明
Original assignee: 苏州浪潮智能科技有限公司
Priority date: 2020-09-25
Filing date: 2021-07-30
Publication date: 2022-03-31
Also published as: CN112232380A; CN112232380B

Abstract

Disclosed are a neural network robustness measurement method and an apparatus. The method comprises: using a neural network and executing a forward operation on a specified sample, and generating a convolution kernel feature map at every convolutional layer; on each channel, performing sampling and aggregation to form convolutional layer feature maps, and further performing sampling and aggregation to form a sample convolutional map for the specified sample; converting a weight difference in the sample convolutional map into a color difference, so as to visualize the sample convolutional map; extracting a sample having labeling from sample data to serve as a first measurement group, taking a group of a sample feature visualization image and the corresponding specified sample to serve as a second measurement group, and sending a crowd labeling request; and determining the robustness of the neural network on the basis of labeling information of the correctly labeled second measurement group corresponding to the first measurement group in a crowd labeling result. The present invention can correctly assess the robustness of a neural network.

Description

A kind of neural network robustness detection method and device

This application claims the priority of the Chinese patent application filed on September 25, 2020 with the State Intellectual Property Office of China, the application number is 202011026951.8, and the invention title is "A Neural Network Robustness Detection Method and Device", the entire content of which is approved by Reference is incorporated in this application.

technical field

The present invention relates to the field of neural networks, and more particularly, to a method and device for detecting robustness of neural networks.

Background technique

Deep learning has been widely used in the real world, such as driverless cars, receipt recognition, movie recommendation, etc. Deep learning requires a lot of data. For neural networks, the number of training samples has a huge impact on the quality of AI (Artificial Intelligence) training. In order to improve the accuracy of the model, a larger amount of data samples are usually used for training. As an AI developer, in addition to paying attention to the performance of the trained neural network on the test set and validation set, we also need to pay attention to the robustness and generalization ability of the neural network. However, it is currently difficult to evaluate the robustness of the neural network with the existing technology. Awesome.

Whether the patterns recognized by the convolutional layers are correct plays a crucial role in the neural network. There are some cases where the neural network has higher accuracy under the specified test set. But when new datasets were used, there was a significant drop in accuracy. A large part of the reason for this phenomenon is that during the training of the neural network, the features selected by the network cannot represent the samples well, and the robustness of the neural network cannot be evaluated.

Aiming at the problem that the robustness of the neural network is difficult to evaluate in the prior art, there is currently no effective solution.

SUMMARY OF THE INVENTION

In view of this, the purpose of the embodiments of the present invention is to provide a method and apparatus for detecting the robustness of a neural network, which can correctly evaluate the robustness of the neural network.

Based on the above purpose, a first aspect of the embodiments of the present invention provides a method for detecting robustness of a neural network, including performing the following steps:

Use the neural network trained and tested on the sample data to perform forward operations on specific samples in the sample data, and generate a convolution kernel feature map at each convolutional layer in the neural network;

The convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of a specific sample;

Convert the weight difference in the sample convolution graph into color difference to visualize the sample convolution graph, and generate a sample feature visualization image for a specific sample;

The labeled samples are extracted from the sample data as the first detection group, the combination of the sample feature visualization image and the corresponding specific sample is used as the second detection group, and the first detection group and the second detection group are in one-to-one correspondence. Send group tagging requests;

A group labeling result for the group labeling request is received, and the robustness of the neural network is determined based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result.

In some embodiments, the sample data includes a training set, a test set, and a detection set; the specific sample is a sample of the detection set; using the neural network trained and tested on the sample data to perform a forward operation on the specific sample in the sample data includes: A neural network trained on samples from the training set and tested on samples from the test set performs forward operations on samples from the test set.

In some embodiments, generating a convolution kernel feature map at each convolutional layer in the neural network includes: in each convolutional layer in the neural network, comparing samples of the detection set with the convolutional layer on each channel The multiple convolution kernels in each convolution kernel are convolved to obtain the multiple convolution kernel feature maps of the samples of the detection set on each convolution layer.

In some embodiments, sampling and clustering the convolution kernel feature maps on each channel to form a convolution layer feature map includes: in each convolution layer in the neural network, randomly extracting the first convolution kernel feature map from a plurality of convolution kernel feature maps A number of convolution kernel feature maps are superimposed on each channel to obtain multiple convolution layer feature maps of samples of the detection set.

In some embodiments, further sampling and aggregating to form a sample convolutional map of a specific sample comprises: specifying every second number of convolutional layers in the neural network, and obtaining the convolutional layer feature maps of all the specified convolutional layers Averaged to obtain a sample convolution map of the samples in the detection set.

In some embodiments, sending the group labeling request in a one-to-one correspondence between the first detection group and the second detection group includes:

Selecting a sample from the first detection group and requesting a first group label for generating label-related label information for the sample;

A combination of a sample feature visualization image and a sample of the corresponding detection set is selected from the second detection set, and a second group annotation of annotation information on whether the sample feature visualization image includes its feature information is requested to be generated for the samples of the detection set ;

The first group annotation and the second group annotation are combined to generate and send a group annotation request.

In some embodiments, determining the robustness of the neural network based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the population labeling result includes:

Discard all the group labeling results whose labeling information of the first detection group is different from the labeling in the sample data;

The labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is that all the group labeling results including its characteristic information are marked as successful feedback;

The labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is all group labeling results that do not include its characteristic information, and record as failure feedback;

The robustness of the neural network is determined based on the number of successful and failed feedbacks, wherein the robustness of the neural network is positively correlated with the number of successful feedbacks and negatively correlated with the number of failed feedbacks.

A second aspect of the embodiments of the present invention provides a neural network robustness detection apparatus, including:

processor; and

A memory that stores program code executable by the processor, the program code performing the following steps when executed:

In some embodiments, generating a convolution kernel feature map at each convolutional layer in the neural network includes: in each convolutional layer in the neural network, comparing samples of the detection set with the convolutional layer on each channel The multiple convolution kernels in each convolution kernel are convolved to obtain the multiple convolution kernel feature maps of the samples of the detection set on each convolution layer;

Sampling and gathering the convolution kernel feature maps on each channel to form a convolution layer feature map includes: in each convolution layer in the neural network, randomly extracting a first number of convolution kernels from a plurality of convolution kernel feature maps The feature map is superimposed on each channel to obtain multiple convolution layer feature maps of the samples of the detection set;

Further sampling and aggregating to form a sample convolutional map of a specific sample includes: specifying a convolutional layer every second number in the neural network, and averaging the convolutional layer feature maps of all the specified convolutional layers to obtain the detection set. The sample convolution graph for the sample.

In some embodiments, sending the group labeling request in a one-to-one correspondence between the first detection group and the second detection group includes: selecting a sample from the first detection group, and requesting to generate labeling information related to the label for the sample. The first group labeling; selecting a combination of the sample feature visualization image and the sample of the corresponding detection set from the second detection group, and requesting to generate annotation information about whether the sample feature visualization image includes its feature information for the samples of the detection set the second group annotation; combine the first group annotation and the second group annotation to generate a group annotation request and send it;

Determining the robustness of the neural network based on the label information of the second detection group corresponding to the correctly labeled first detection group in the group labeling result includes: comparing the label information of the first detection group to all groups with different labels in the sample data The labeling result is discarded; the labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is all group labeling results including its characteristic information, and it is marked as successful feedback; the labeling of the first detection group is marked as successful feedback; The information is the same as the label in the sample data, and the label information of the second detection group is all group labeling results that do not include its characteristic information, which is recorded as failure feedback; the robustness of the neural network is determined based on the number of successful feedback and failure feedback, where The robustness of the neural network is positively correlated with the number of successful feedbacks and negatively correlated with the number of failed feedbacks.

The present invention has the following beneficial technical effects: the neural network robustness detection method and device provided by the embodiments of the present invention perform forward operations on specific samples in the sample data by using the neural network trained and tested on the sample data, and in the neural network Each convolution layer in the network generates a convolution kernel feature map; the convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of a specific sample; The weight difference in the convolution graph is converted into color difference to visualize the sample convolution graph, and the sample feature visualization image of a specific sample is generated; the labeled samples are extracted from the sample data as the first detection group, and the sample feature visualization image and corresponding The combination of specific samples is used as the second detection group, and the group annotation request is sent in a one-to-one correspondence between the first detection group and the second detection group; the group annotation result for the group annotation request is received, and based on the group annotation result and the annotation The technical scheme of determining the robustness of the neural network by the label information of the correct second detection group corresponding to the first detection group can correctly evaluate the robustness of the neural network.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is a schematic flowchart of a neural network robustness detection method provided by the present invention;

Fig. 2 is the overall flow chart of the neural network robustness detection method provided by the present invention;

3 is a schematic diagram of a group labeling request of the neural network robustness detection method provided by the present invention;

FIG. 4 is a schematic structural diagram of a neural network robustness detection apparatus provided by the present invention.

detailed description

In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the embodiments of the present invention will be further described in detail below with reference to the specific embodiments and the accompanying drawings.

It should be noted that all expressions using "first" and "second" in the embodiments of the present invention are for the purpose of distinguishing two entities with the same name but not the same or non-identical parameters. It can be seen that "first" and "second" It is only for the convenience of expression and should not be construed as a limitation to the embodiments of the present invention, and subsequent embodiments will not describe them one by one.

Based on the above objective, in the first aspect of the embodiments of the present invention, an embodiment of a detection method for correctly evaluating the robustness of a neural network is proposed. FIG. 1 shows a schematic flowchart of a method for detecting robustness of a neural network provided by the present invention.

The neural network robustness detection method, as shown in Figure 1, includes the following steps:

Step S101: use the neural network trained and tested on the sample data to perform forward operations on specific samples in the sample data, and generate a convolution kernel feature map at each convolutional layer in the neural network;

Step S103: sampling and gathering the convolution kernel feature map on each channel to form a convolution layer feature map, and further sampling and gathering to form a sample convolution map of a specific sample;

Step S105: Convert the weight difference in the sample convolution graph into a color difference to visualize the sample convolution graph, and generate a sample feature visualization image of a specific sample;

Step S107: Extract the marked samples from the sample data as the first detection group, use the combination of the sample feature visualization image and the corresponding specific sample as the second detection group, and use the first detection group and the second detection group one by one. Send the group annotation request in the corresponding way;

Step S109: Receive the group labeling result for the group labeling request, and determine the robustness of the neural network based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result.

A typical CNN (Convolutional Neural Networks, convolutional neural network) mainly includes convolutional layers, pooling layers, full-link layers, softmax (logistic regression function) layers, etc. The operations performed by the convolutional layer are relatively important. operation. It uses different convolution kernels to perform sliding calculations on each channel of the image to obtain a set of feature maps (feature maps) on an image. Images are able to detect the same pattern in multiple locations (pan and zoom invariance), so by doing this, weights for multiple targets can be selectively reused. This reduces the ratio of the number of weights to the amount of data, thereby effectively reducing overfitting, making the model more accurate, and improving the generalization ability of the network.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include It is as the flow of the embodiments of the above-mentioned methods. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM) or the like. The computer program embodiments can achieve the same or similar effects as any of the foregoing method embodiments.

The labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is all the group labeling results including its characteristic information, which is marked as successful feedback;

The specific implementation of the present invention is further described below according to the specific embodiment shown in FIG. 2 .

(1) First, determine the structure of the neural network according to the problem to be solved (for example, a target detection problem or a classification problem). The existing sample data is randomly divided into three parts, namely training set, test set and detection set. The samples of the training set are used to train the neural network, and the samples of the test set are used to verify the network model. For the samples of the detection set, a visual image of the feature map will be generated using the samples of the detection set for the network that has been trained.

(2) Determine the hyperparameters of the neural network, and use the training set to train the neural network. The training process ends when the neural network achieves the desired accuracy on the test set.

(3) After the neural network is trained, each sample in the detection set is input into the trained neural network for forward operation. For each convolutional layer, the convolution operation is performed using each channel of the convolution kernel and the corresponding channel of the input sample, and then added position by position to obtain a feature map.

(4) A feature map can be obtained for each convolution kernel of this layer. For each layer, three feature maps are randomly selected, and the three feature maps are summed on the corresponding channels, and the final result is used as the feature map of the layer.

(5) For a neural network, select a feature map every 2 layers, that is, select the feature map of the 1st, 4th, 7th... layers. Correspondingly averaged to obtain the feature map of the network for the sample.

(6) Visualize the sample against the feature map of the network. The high-weight value in the feature map is depicted as white (ie, high RGB (Red Green Blue, triad) value), and the low-weight value is black (ie, low RGB value).

(7) Label the samples of the corresponding detection set and the generated feature map visualization images as a set of images. By generating a corresponding visual feature map for each sample image in the detection set, several sets of images for this network are obtained.

(8) Randomly extract a set of images and labels from the validation set, and randomly select a set of images from several sets of images generated in step (7).

(9) When the system needs man-machine discrimination detection and makes an API (Application Programming Interface) request, the two images are sent out in the manner shown in Figure 3. The label identification of the first image is performed manually, and the second set of images (feature maps and samples) are judged to see if the feature map matches the samples.

(10) If the manual identification of the first image matches the label value, it is considered that the human-machine detection this time has passed, and the results of another set of images (matching or non-matching) are collected.

(11) Statistical analysis of the collected second set of results. If most people's selection results for the second group do not match, it means that the feature map cannot identify the features of the sample well. At this time, even if the test set effect of the model is good, it does not necessarily mean that the sample has good generalization ability.

It can be seen from the above embodiments that the neural network robustness detection method provided by the embodiments of the present invention performs forward operations on specific samples in the sample data by using a neural network trained and tested on sample data, and performs forward operations on specific samples in the neural network. Each convolution layer generates a convolution kernel feature map; the convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of a specific sample; the sample convolution map The difference of weights in the image is converted into color difference to visualize the sample convolution map, and the sample feature visualization image of the specific sample is generated; the labeled samples are extracted from the sample data as the first detection group, and the sample feature visualization image and the corresponding specific sample The combination is used as the second detection group, and the group labeling request is sent in a one-to-one correspondence between the first detection group and the second detection group; the group labeling result for the group labeling request is received, and based on the group labeling result and the correct label The technical solution for determining the robustness of the neural network by the label information of the second detection group corresponding to one detection group can correctly evaluate the robustness of the neural network.

It should be particularly pointed out that each step in each embodiment of the above-mentioned neural network robustness detection method can be intersected, replaced, added, and deleted. The method should also belong to the protection scope of the present invention, and the protection scope of the present invention should not be limited to the described embodiments.

As shown in FIG. 4 , based on the above purpose, a second aspect of the embodiments of the present invention provides an embodiment of a detection apparatus for correctly evaluating the robustness of a neural network. The neural network robustness detection device includes:

processor 301; and

The memory 302 stores program code executable by the processor, and the program code performs the following steps when executed:

It can be seen from the above embodiments that the neural network robustness detection apparatus provided by the embodiments of the present invention performs forward operations on specific samples in the sample data by using the neural network trained and tested on the sample data, and performs a forward operation in the neural network. Each convolutional layer of the convolutional layer generates a convolution kernel feature map; the convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of a specific sample; the sample convolution The weight difference in the graph is converted into color difference to visualize the sample convolution graph, and the sample feature visualization image of a specific sample is generated; the labeled samples are extracted from the sample data as the first detection group, and the sample feature visualization image and the corresponding specific sample are extracted. The combination of samples is used as the second detection group, and the group labeling request is sent in a one-to-one correspondence between the first detection group and the second detection group; The technical solution for determining the robustness of the neural network by the label information of the second detection group corresponding to the first detection group can correctly evaluate the robustness of the neural network.

It should be particularly pointed out that the embodiments of the above-mentioned neural network robustness detection apparatus use the embodiments of the neural network robustness detection method to specifically describe the working process of each module. Those skilled in the art can easily imagine that the These modules apply to other embodiments of the neural network robustness detection method. Of course, since each step in the embodiment of the neural network robustness detection method can be intersected, replaced, added, and deleted, these reasonable permutation and combination transformations are also useful to the neural network robustness detection device. It should belong to the protection scope of the present invention, and should not limit the protection scope of the present invention to the above-described embodiments.

The above are exemplary embodiments of the present disclosure, but it should be noted that various changes and modifications may be made without departing from the scope of the disclosure of the embodiments of the present invention as defined in the claims. The functions, steps and/or actions of the method claims in accordance with the disclosed embodiments described herein need not be performed in any particular order. Furthermore, although elements disclosed in the embodiments of the present invention may be described or claimed in the singular, unless explicitly limited to the singular, the plural may also be construed.

Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary, and is not intended to imply that the scope (including the claims) disclosed by the embodiments of the present invention is limited to these examples; under the idea of the embodiments of the present invention , technical features in the above embodiments or different embodiments may also be combined, and there are many other variations of the different aspects of the embodiments of the present invention as described above, which are not provided in detail for the sake of brevity. Therefore, any omission, modification, equivalent replacement, improvement, etc. made within the spirit and principles of the embodiments of the present invention should be included within the protection scope of the embodiments of the present invention.

Claims

A method for detecting robustness of a neural network, comprising the steps of:

Using the neural network trained and tested on the sample data to perform forward operations on specific samples in the sample data, and generating a convolution kernel feature map at each convolutional layer in the neural network;

The convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of the specific sample;

Converting the weight difference in the sample convolution graph into a color difference to visualize the sample convolution graph, and generating a sample feature visualization image of the specific sample;

The labeled samples are extracted from the sample data as the first detection group, the combination of the sample feature visualization image and the corresponding specific sample is used as the second detection group, and the first detection group and the Send the group labeling request in a one-to-one correspondence with the second detection group;

Receive a group labeling result for the group labeling request, and determine the robustness of the neural network based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result sex.
The method according to claim 1, wherein the sample data includes a training set, a test set, and a detection set; the specific sample is a sample of the detection set;

Using the neural network trained and tested on the sample data to perform a forward operation on a specific sample in the sample data includes: using the neural network trained on the samples from the training set and the neural network tested on the samples from the test set. The network performs forward operations on samples of the detection set.
The method according to claim 2, wherein generating a convolution kernel feature map at each convolutional layer in the neural network comprises:

In each convolutional layer in the neural network, the samples of the detection set are convolved with multiple convolution kernels in the convolutional layer on each channel to obtain the samples of the detection set. a plurality of the convolution kernel feature maps on the convolutional layers.
The method according to claim 3, wherein sampling and gathering the convolution kernel feature map on each channel to form a convolution layer feature map comprises:

In each convolution layer in the neural network, randomly extract a first number of the convolution kernel feature maps from a plurality of the convolution kernel feature maps and superimpose them on each channel to obtain samples of the detection set A plurality of the convolutional layer feature maps.
The method according to claim 4, wherein further sampling and aggregating to form the sample convolution graph of the specific sample comprises:

Specifying the convolutional layer every second number in the neural network, and averaging the convolutional layer feature maps of all the specified convolutional layers to obtain all the samples of the detection set The sample convolution graph described above.
The method according to claim 2, wherein sending the group labeling request in a one-to-one correspondence between the first detection group and the second detection group comprises:

Selecting a sample from the first detection group, and requesting a first group label for generating label-related label information for the sample;

A combination of the sample feature visualization image and the corresponding sample of the detection set is selected from the second detection set, and a request is made for the sample of the detection set to generate a feature about whether the sample feature visualization image includes its features Labeling of information The second group labeling of information;

The group annotation request is generated and sent by combining the first group annotation and the second group annotation.
The method according to claim 6, wherein the robustness of the neural network is determined based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result Sex includes:

Discarding all the group labeling results in which the labeling information of the first detection group is different from the labeling in the sample data;

The labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is that all the group labeling results including its feature information are marked as successful feedback;

The labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group is that all the group labeling results that do not include its feature information are marked as failure feedback;

The robustness of the neural network is determined based on the number of successful feedbacks and the number of failed feedbacks, wherein the robustness of the neural network is positively correlated with the number of successful feedbacks and with the number of failed feedbacks negatively correlated.
A neural network robustness detection device, characterized in that it includes:

processor; and

A memory storing program code executable by the processor, the program code performing the following steps when executed:

Using the neural network trained and tested on the sample data to perform forward operations on specific samples in the sample data, and generating a convolution kernel feature map at each convolutional layer in the neural network;

The convolution kernel feature map is sampled and aggregated on each channel to form a convolution layer feature map, and further sampled and aggregated to form a sample convolution map of the specific sample;

Converting the weight difference in the sample convolution graph into a color difference to visualize the sample convolution graph, and generating a sample feature visualization image of the specific sample;

The labeled samples are extracted from the sample data as the first detection group, the combination of the sample feature visualization image and the corresponding specific sample is used as the second detection group, and the first detection group and the Send the group labeling request in a one-to-one correspondence with the second detection group;

Receive a group labeling result for the group labeling request, and determine the robustness of the neural network based on the labeling information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result sex.
The apparatus according to claim 8, wherein generating a convolution kernel feature map in each convolutional layer in the neural network comprises: in each convolutional layer in the neural network, in each convolutional layer Convolving the samples of the detection set with the multiple convolution kernels in the convolution layer on the channel respectively to obtain the multiple convolution kernel features of the samples of the detection set on each of the convolution layers picture;

Sampling and gathering the convolution kernel feature maps on each channel to form a convolution layer feature map includes: in each convolution layer in the neural network, randomly extracting the first convolution kernel feature map from a plurality of the convolution kernel feature maps. A number of the convolution kernel feature maps are superimposed on each channel to obtain a plurality of the convolution layer feature maps of the samples of the detection set;

Further sampling and aggregating the sample convolution map to form the specific sample includes: specifying one of the convolutional layers every second number in the neural network, and applying the convolutional layers of all the specified convolutional layers to the convolutional layer. Layer feature maps are averaged to obtain the sample convolution map of samples of the detection set.
The apparatus according to claim 8, wherein sending the group labeling request in a one-to-one correspondence between the first detection group and the second detection group comprises: selecting a sample from the first detection group, And request to generate the first group annotation of the labeling information related to the label for the sample; select a combination of the sample feature visualization image and the corresponding sample of the detection set from the second detection group, and request for The samples of the detection set generate a second group annotation about whether the sample feature visualization image includes annotation information of its feature information; the first group annotation and the second group annotation are combined to generate and send the group annotation request;

Determining the robustness of the neural network based on the label information of the second detection group corresponding to the correctly labelled first detection group in the group labeling result includes: All the group labeling results that are different from the labels in the sample data are discarded; the labeling information of the first detection group is the same as the labeling in the sample data, and the labeling information of the second detection group includes All the group labeling results of its feature information are marked as successful feedback; the labeling information of the first detection group is the same as the label in the sample data, and the labeling information of the second detection group does not include its features All the group labeling results of the information are recorded as failure feedback; the robustness of the neural network is determined based on the number of the successful feedback and the failure feedback, wherein the robustness of the neural network is the same as that of the successful feedback. The number is positively correlated and negatively correlated with the number of said failure feedbacks.