WO2022104503A1 - 一种对抗样本的识别方法及相关装置 - Google Patents

一种对抗样本的识别方法及相关装置 Download PDF

Info

Publication number
WO2022104503A1
WO2022104503A1 PCT/CN2020/129298 CN2020129298W WO2022104503A1 WO 2022104503 A1 WO2022104503 A1 WO 2022104503A1 CN 2020129298 W CN2020129298 W CN 2020129298W WO 2022104503 A1 WO2022104503 A1 WO 2022104503A1
Authority
WO
WIPO (PCT)
Prior art keywords
sample
adversarial
samples
training
autoencoder
Prior art date
Application number
PCT/CN2020/129298
Other languages
English (en)
French (fr)
Inventor
易平
刘浩文
林孝盈
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2020/129298 priority Critical patent/WO2022104503A1/zh
Priority to CN202080004866.3A priority patent/CN112673381B/zh
Publication of WO2022104503A1 publication Critical patent/WO2022104503A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/764—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using classification, e.g. of video objects
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
    • G06V10/00—Arrangements for image or video recognition or understanding
    • G06V10/70—Arrangements for image or video recognition or understanding using pattern recognition or machine learning
    • G06V10/82—Arrangements for image or video recognition or understanding using pattern recognition or machine learning using neural networks

Definitions

  • the embodiments of the present application relate to the technical field of neural networks, and in particular, to an identification method and a related device for defending against adversarial samples.
  • Deep neural networks have achieved great success in many tasks in the field of machine learning, such as image classification, speech recognition, natural language processing, healthcare, etc.
  • Adversarial examples are input samples formed by deliberately adding subtle perturbations to the dataset. Adversarial examples can cause a machine learning model to give a false output with high confidence. Adversarial examples are visually indistinguishable from real examples, but are capable of attacking state-of-the-art machine learning models and causing them to give false results.
  • an embodiment of the present application provides a method for identifying an adversarial sample, including: acquiring an input sample; obtaining a reconstructed sample through an autoencoder according to the input sample, and the autoencoder uses a convolution of a target neural network
  • the layer is an encoder, and a feedback reconstruction network is used as a decoder; according to the input sample and the reconstructed sample, the detection result of the input sample is obtained through an adversarial sample detector, and the adversarial sample detector is obtained through the first Training samples and second training samples are obtained through training, the first samples include non-adversarial samples and their reconstructed samples, and a first sample label; the second samples include confrontation samples and their reconstructed samples, and the second Sample label; the sample type of the input sample is determined according to the detection result.
  • the embodiments of the present application provide a method for identifying an adversarial sample and a related device.
  • the reconstructed sample is obtained by outputting the result of the convolutional layer of the target neural network into the feedback reconstruction network, so that the adversarial sample can affect the target neural network.
  • the attack will interfere with the reconstruction of the auto-encoder, thereby amplifying the error of the reconstructed samples, making the adversarial samples easier to detect, improving the detection accuracy of the adversarial samples, and reducing the false positive rate.
  • the embodiment of the present application uses an adversarial sample detector to determine whether the input sample is an adversarial sample by learning the respective reconstruction errors of the adversarial sample and the non-adversarial sample. Since the reconstruction error will amplify the disturbance of the adversarial sample, the detection sensitivity is higher.
  • the method further includes: performing at least one cyclic reconstruction on the reconstructed sample by the autoencoder, and the cyclic reconstruction is performed by the autoencoder
  • the processor processes the reconstructed samples.
  • the adversarial sample detector is a binary classifier.
  • the method before obtaining the reconstructed samples through the autoencoder, the method further includes: acquiring a training set, where the training set is a set composed of non-confrontational samples ; simultaneously train the target neural network and the autoencoder through the training set, and the target neural network includes the convolution layer and the target classifier.
  • the loss function of the training process is:
  • X train is the training set
  • is the number of data in the training set
  • x is the non-confrontational samples in the training set
  • ae(x) is the training data obtained by the autoencoder according to the non-confrontational samples in the training set reconstructed samples, is the relative entropy.
  • the method further includes: according to the training set, generate the confrontation sample for the training of the target neural network through the confrontation sample generation algorithm; obtain the non-confrontation reconstruction sample through the trained self-encoder according to the training set; according to the training confrontation sample , obtain the adversarial reconstruction sample through the trained autoencoder; train the adversarial sample detector through the first training sample and the second training sample, the first training sample is composed of the non-confrontational samples in the training set and the The non-confrontational reconstruction sample is composed of the second training sample is composed of the training adversarial sample and the confrontational reconstruction sample.
  • the method further includes: acquiring a test set, the The test set is a set composed of test samples; according to the test set, an adversarial sample for the test of the target neural network is generated by an adversarial sample generation algorithm;
  • the trained self-encoder and the adversarial sample detector obtain a test result; determine the detection accuracy rate, adversarial sample detection rate and false positive of the test result according to the test set and the adversarial samples used for testing Rate.
  • an embodiment of the present application provides an apparatus for identifying an adversarial sample, including: an acquisition module for acquiring an input sample; a processing module for obtaining a reconstructed sample through an autoencoder according to the input sample, the The autoencoder uses the convolutional layer of the convolutional neural network as the encoder, and the feedback reconstruction network as the decoder; the processing module is further configured to pass an adversarial sample detector according to the input sample and the reconstructed sample Obtain the detection result of the input sample, the confrontation sample detector is obtained by training the first training sample and the second training sample, and the first sample includes the non-adversarial sample and its reconstructed sample, and the first sample label; the second sample includes adversarial samples and their reconstructed samples, and a second sample label; the processing module is further configured to determine the sample type of the input sample according to the detection result.
  • the processing module is further configured to: perform at least one cyclic reconstruction on the reconstructed sample by using the autoencoder, and the cyclic reconstruction is The autoencoder processes the reconstructed samples.
  • the adversarial sample detector is a binary classifier.
  • the processing module is further configured to: obtain a training set, where the training set is a set composed of non-confrontational samples; A network and the autoencoder are trained, the target neural network includes the convolutional layer and a target classifier.
  • the loss function of the training process is:
  • X train is the training set
  • is the number of data in the training set
  • x is the non-confrontational samples in the training set
  • ae(x) is the training data obtained by the autoencoder according to the non-confrontational samples in the training set reconstructed samples, is the relative entropy.
  • the processing module is further configured to: generate an adversarial sample for training the target neural network by using an adversarial sample generation algorithm according to the training set;
  • the training set obtains non-adversarial reconstruction samples through the trained self-encoder; according to the training confrontation samples, the trained self-encoder obtains the confrontational reconstruction samples; through the first training sample and the third Two training samples are used to train the adversarial sample detector, the first training sample is composed of non-adversarial samples in the training set and the non-adversarial reconstruction samples, and the second training sample is composed of the training adversarial samples and the composition of the adversarial reconstruction samples.
  • the processing module is further configured to: obtain a test set, where the test set is a set composed of test samples; and generate an adversarial sample generation algorithm according to the test set A test adversarial sample for the target neural network; according to the test set and the test adversarial sample, a test result is obtained through the trained autoencoder and the adversarial sample detector; according to the The test set and the adversarial samples used for the test determine the detection accuracy rate, the adversarial sample detection rate and the false positive rate of the test result.
  • an embodiment of the present application further provides a device for identifying an adversarial sample, including: a processor and a transmission interface, where the processor is configured to call program instructions stored in a memory to execute the method of the first aspect .
  • embodiments of the present application further provide a computer-readable storage medium, including instructions, when the instructions are executed on a computer or a processor, the computer or the processor is caused to perform the method of the first aspect .
  • embodiments of the present application further provide a computer program product containing instructions, the computer program product including program instructions, when the program instructions are run on a computer or a processor, the computer or the processing The device performs the method of the first aspect.
  • Fig. 1a is one of the schematic diagrams of a method for detecting adversarial samples based on a binary classifier
  • Fig. 1b is the second schematic diagram of the method for detecting adversarial samples based on the binary classifier
  • Figure 1c is a schematic diagram of the third method for detecting adversarial samples based on a binary classifier
  • FIG. 2 is a schematic diagram of a method for detecting adversarial samples based on an autoencoder
  • FIG. 3 is a schematic diagram of a technical solution for identifying an adversarial sample provided by an embodiment of the present application
  • FIG. 4 is a schematic diagram of a convolutional neural network in an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another convolutional neural network in an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a system architecture for identifying adversarial samples according to an embodiment of the present application.
  • FIG. 7 is a flowchart of a method for identifying an adversarial sample in an embodiment of the present application.
  • FIG. 8 is a flowchart of a training process according to an embodiment of the present application.
  • FIG. 9 is a schematic diagram of generating an adversarial sample for training in an embodiment of the present application.
  • FIG. 10 is a schematic diagram of generating a non-adversarial reconstruction sample and an adversarial reconstruction sample in an embodiment of the present application
  • FIG. 11 is a schematic diagram of training an adversarial sample detector according to an embodiment of the present application.
  • FIG. 13 is another flowchart of the execution device according to the embodiment of the present application.
  • FIG. 14 is a schematic diagram of a device for identifying an adversarial sample provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of an execution device provided by an embodiment of the present application.
  • words such as “exemplary” or “for example” are used to represent examples, illustrations or illustrations. Any embodiments or designs described in the embodiments of the present application as “exemplary” or “such as” should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as “exemplary” or “such as” is intended to present the related concepts in a specific manner.
  • Artificial Intelligence is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.
  • artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can respond in a similar way to human intelligence.
  • Artificial intelligence is to study the design principles and implementation methods of various intelligent machines, so that the machines have the functions of perception, reasoning and decision-making.
  • Artificial intelligence technology is a comprehensive discipline, involving a wide range of fields, including both hardware-level technology and software-level technology.
  • the basic technologies of artificial intelligence generally include technologies such as sensors, special artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation/interaction systems, and mechatronics.
  • Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning/deep learning.
  • Machine Learning is a multi-field interdisciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in how computers simulate or realize human learning behaviors to acquire new knowledge or skills, and to reorganize existing knowledge structures to continuously improve their performance.
  • Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent, and its applications are in all fields of artificial intelligence.
  • Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, teaching learning and other technologies.
  • deep neural networks have achieved great success in many tasks in the field of machine learning, such as image classification, speech recognition, natural language processing, medical health, etc.
  • Adversarial examples i.e. input samples formed by deliberately adding subtle perturbations to the dataset, cause the model to give a false output with high confidence.
  • Adversarial examples are visually indistinguishable from real examples, but are capable of attacking state-of-the-art machine learning models and causing them to give false results.
  • adversarial samples have caused a huge impact on the application of systems supporting deep learning models in scenarios with high security level requirements.
  • algorithm technologies for generating adversarial samples include Fast Gradient Sign Method (FGSM), JSMA (Jacobian-based Saliency Map Attack) algorithm, CW (Carlini and Wagner Attacks) algorithm, etc.
  • FGSM Fast Gradient Sign Method
  • JSMA Java-based Saliency Map Attack
  • CW Carlini and Wagner Attacks
  • the current methods of defending against adversarial examples include identifying non-adversarial examples and adversarial examples through binary classifiers or through autoencoders. The two methods are briefly described below.
  • Figure 1a is a schematic diagram of a method for detecting adversarial samples based on a binary classifier.
  • the first step of the method is to use the training set X train composed of non-adversarial samples to generate a training set composed of adversarial samples after attacking the target neural network F1 by the FGSM algorithm.
  • a test set composed of adversarial samples can be generated.
  • Figure 1b is a schematic diagram of the second method of detecting adversarial samples based on a binary classifier.
  • the second step of the method is to pass the training set X train consisting of non-adversarial examples and the training set consisting of adversarial examples Train the binary classifier F2. Among them, the flag of non-adversarial samples in the training set is 0, and the flag of adversarial samples is 1.
  • the trained binary classifier F2 can distinguish adversarial samples according to the input samples.
  • Figure 1c is a schematic diagram of the third method for detecting adversarial samples based on a binary classifier.
  • the third step of the method is to pass a test set X test consisting of non-adversarial examples and a test set consisting of adversarial examples
  • the binary classifier is tested, and the accuracy of the binary classifier is obtained according to the number of adversarial samples in the test set that can be accurately identified by the binary classifier.
  • the binary classifier with the accuracy rate up to the standard can be used as the detector of the adversarial sample.
  • the device can first detect whether the input sample is an adversarial sample through the binary classifier. If the input sample is not an adversarial sample, the device can pass the target according to the input sample.
  • the neural network gets the output. The device first detects the input samples through the binary classifier, which defends against adversarial samples, so the output results are more reliable.
  • this method of defending against adversarial examples can only detect the attacks used by the adversarial examples in the training set, which is attack-sensitive.
  • the attack used in the training set of the above two-classifier is the FGSM algorithm
  • the two-classifier can only detect the adversarial samples attacked by the FGSM algorithm, but cannot detect the adversarial samples attacked by other algorithms.
  • this method of defending against adversarial samples is very sensitive to attack strength, and can only detect adversarial samples with large disturbances, and has almost no detection ability for adversarial samples with small disturbances.
  • Figure 2 is a schematic diagram of a method for detecting adversarial samples based on an autoencoder.
  • This method uses the autoencoder trained by non-adversarial samples as the adversarial sample detector, and uses the difference between the input sample and the autoencoder reconstructed sample to detect the adversarial samples; using the denoising autoencoder as the restorer, the detection The small perturbed adversarial samples not detected by the detector are restored to non-adversarial samples.
  • the first detector is an autoencoder trained using non-adversarial examples. If the sample to be tested is a non-adversarial sample, because the sample is generated in the same process as the training data of the autoencoder, its reconstruction error is very small. On the contrary, if the sample with detection is an adversarial sample, then the reconstruction error of the sample is will be great. Therefore, the reconstruction error is used to measure the distance between the sample to be detected and the non-adversarial sample. However, since the distance is a continuous value, a threshold is determined using the validation set to judge whether it is an adversarial sample. That is to say, the reconstruction error between the input sample x and the reconstructed sample x' is greater than the threshold, indicating that the sample x is an adversarial sample.
  • the restorer uses a denoising encoder to restore the small perturbed adversarial samples not detected by the detector to non-adversarial samples.
  • the classifier is generally used to implement the actual function of the target neural network, such as image recognition.
  • the second detector is used for judging the sample x as a non-adversarial sample or an adversarial sample according to the divergence between f(x) and f(ae(x)).
  • f(x) is the output result obtained by the input sample x through the classifier
  • f(ae(x)) is the output result obtained by the input sample x through the first detector and the classifier.
  • this method of defending against adversarial examples trains multiple autoencoders with large training volume and high training cost.
  • the autoencoder as the detector has nothing to do with the target classifier of the target neural network, and the detection rate of adversarial samples is low and the error detection rate is high.
  • a fixed threshold is used as the classification basis for judging whether it is an adversarial sample, it lacks theoretical basis and has a high error rate.
  • the embodiments of the present application provide a method for defending against adversarial samples to overcome the above shortcomings.
  • the technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings in the embodiments of the present application.
  • FIG. 3 is a schematic diagram of a technical solution for identifying an adversarial sample provided by an embodiment of the present application.
  • the sample x is input to the target neural network to obtain the recognition result f(x), wherein the target neural network includes a convolution layer and a target classifier.
  • the recognition result f(x) is valid; when the adversarial sample detector confirms that the sample x is an adversarial sample, the recognition result f(x) is invalid .
  • the device reconstructs the input sample x through the autoencoder to obtain the reconstructed sample ae(x), wherein the autoencoder is composed of the convolutional layer of the target neural network and the feedback reconstruction network. Then the device puts the input sample x and the reconstructed sample ae(x) into the adversarial sample detector for detection, so as to determine whether the input sample x is an adversarial sample.
  • the adversarial example detector can be a binary classifier.
  • the target neural network may be a convolutional neural network, or may be other types of neural networks, which are not limited in this embodiment of the present application.
  • the following will take the convolutional neural network as a specific embodiment for detailed description.
  • FIG. 4 is a schematic diagram of a convolutional neural network in an embodiment of the present application.
  • Convolutional neural network (CNN, Convolutional neuron network) is a deep neural network with a convolutional structure, a deep learning (deep learning) architecture, deep learning architecture refers to algorithms through machine learning, in different learning at multiple levels of abstraction.
  • CNN Convolutional neural network
  • a CNN is a feed-forward artificial neural network in which each neuron responds to overlapping regions in images fed into it.
  • a convolutional neural network (CNN) 100 may include an input layer 110 , a convolutional/pooling layer 120 , where the pooling layer is optional, and a neural network layer 130 .
  • the convolutional layer/pooling layer 120 may include layers 121-126 as examples.
  • layer 121 is a convolutional layer
  • layer 122 is a pooling layer
  • layer 123 is a convolutional layer
  • layer 124 is a convolutional layer.
  • Layers are pooling layers
  • 125 are convolutional layers
  • 126 are pooling layers; in another implementation, 121 and 122 are convolutional layers, 123 are pooling layers, 124 and 125 are convolutional layers, and 126 are pooling layer. That is, the output of a convolutional layer can be used as the input of a subsequent pooling layer, or it can be used as the input of another convolutional layer to continue the convolution operation.
  • the convolution layer 121 may include many convolution operators, which are also called kernels, and their role in image processing is equivalent to a filter that extracts specific information from the input image matrix.
  • the convolution operator can be essentially a weight matrix. This weight matrix is usually pre-defined. In the process of convolving an image, the weight matrix is usually pixel by pixel along the horizontal direction on the input image ( Or two pixels after two pixels...depending on the value of stride), which completes the work of extracting specific features from the image.
  • the size of the weight matrix should be related to the size of the image. It should be noted that the depth dimension of the weight matrix is the same as the depth dimension of the input image.
  • the weight matrix will be extended to Enter the entire depth of the image. Therefore, convolution with a single weight matrix will produce a single depth dimension of the convolutional output, but in most cases a single weight matrix is not used, but multiple weight matrices of the same dimension are applied.
  • the output of each weight matrix is stacked to form the depth dimension of the convolutional image.
  • Different weight matrices can be used to extract different features in the image. For example, one weight matrix is used to extract image edge information, another weight matrix is used to extract specific colors of the image, and another weight matrix is used to extract unwanted noise in the image. Perform fuzzification...
  • the dimensions of the multiple weight matrices are the same, and the dimension of the feature maps extracted from the weight matrices with the same dimensions are also the same, and then the multiple extracted feature maps with the same dimensions are combined to form the output of the convolution operation .
  • weight values in these weight matrices need to be obtained through a lot of training in practical applications, and each weight matrix formed by the weight values obtained by training can extract information from the input image, thereby helping the convolutional neural network 100 to make correct predictions.
  • the initial convolutional layer for example, 121
  • the features extracted by the later convolutional layers become more and more complex, such as features such as high-level semantics.
  • pooling layer after the convolutional layer, that is, each layer 121-126 exemplified by 120 in Figure 4, which can be a convolutional layer followed by a layer
  • the pooling layer can also be a multi-layer convolutional layer followed by one or more pooling layers.
  • the pooling layer may include an average pooling operator and/or a max pooling operator for sampling the input image to obtain a smaller size image.
  • the average pooling operator can calculate the average value of the pixel values in the image within a certain range.
  • the max pooling operator can take the pixel with the largest value within a specific range as the result of max pooling. Also, just as the size of the weight matrix used in the convolutional layer should be related to the size of the image, the operators in the pooling layer should also be related to the size of the image.
  • the size of the output image after processing by the pooling layer can be smaller than the size of the image input to the pooling layer, and each pixel in the image output by the pooling layer represents the average or maximum value of the corresponding sub-region of the image input to the pooling layer.
  • the convolutional neural network 100 After being processed by the convolutional layer/pooling layer 120, the convolutional neural network 100 is not sufficient to output the required output information. Because as mentioned before, the convolutional layer/pooling layer 120 only extracts features and reduces the parameters brought by the input image. However, in order to generate the final output information (required class information or other related information), the convolutional neural network 100 needs to utilize the neural network layer 130 to generate one or a set of outputs of the required number of classes. Therefore, the neural network layer 130 may include multiple hidden layers (131, 132 to 13n as shown in FIG. 4) and the output layer 140, and the parameters contained in the multiple hidden layers may be based on specific task types The relevant training data is pre-trained. For example, the task type can include image recognition, image classification, image super-resolution reconstruction, etc. It is understandable that when the convolutional neural network performs classification tasks (such as image classification) , the neural network layer can also be called a classifier.
  • classification tasks such as image classification
  • the output layer 140 After the multi-layer hidden layers in the neural network layer 130, that is, the last layer of the entire convolutional neural network 100 is the output layer 140, the output layer 140 has a loss function similar to the classification cross entropy, and is specifically used to calculate the prediction error,
  • the forward propagation of the entire convolutional neural network 100 (as shown in Fig. 4, the propagation from 110 to 140 is forward propagation) is completed, the back propagation (as shown in Fig. 4 from 140 to 110 as the back propagation) will start to update.
  • the weight values and biases of the aforementioned layers are used to reduce the loss of the convolutional neural network 100 and the error between the result output by the convolutional neural network 100 through the output layer and the ideal result.
  • the convolutional neural network 100 shown in FIG. 4 is only used as an example of a convolutional neural network.
  • the convolutional neural network may also exist in the form of other network models, for example, such as
  • the multiple convolutional layers/pooling layers shown in FIG. 5 are in parallel, and the extracted features are input to the full neural network layer 130 for processing.
  • Autoencoder is a class of Artificial Neural Networks (ANNs) used in semi-supervised learning and unsupervised learning. Its function is to perform representation learning on input information by taking input information as a learning target. (representation learning).
  • the autoencoder consists of two parts: an encoder and a decoder.
  • the encoder (encoder) part of the self-encoder may be implemented by the convolutional layer in the above-mentioned convolutional neural network.
  • the decoder part of the autoencoder can be implemented with a feedback reconstruction network.
  • the feedback reconstruction network can be a convolutional neural network, which can reconstruct the features extracted by the convolutional layer in the target neural network to generate reconstructed samples (ae(x)).
  • the adversarial sample detector can be most machine learning networks that can be used as classifiers, such as a binary classifier, etc., which can be similar to the binary classifiers in the aforementioned Figures 1a, 1b, and 1c.
  • the application embodiments do not limit this.
  • reconstructed samples are obtained by outputting the result of the convolutional layer of the target neural network to the feedback reconstruction network, so that the attack of the adversarial samples on the target neural network will interfere with the re-encoder. Therefore, the error of the reconstructed sample is amplified, which makes the adversarial sample easier to detect, improves the detection accuracy of the adversarial sample, and reduces the false positive rate.
  • the convolutional layer of the target network is used as the encoder of the self-encoder
  • the feedback reconstruction network is used as the decoder of the self-encoder, so that the self-encoder is closely related to the target network, and attacks on the target network will certainly interfere.
  • the autoencoder reconstructs the samples, thereby amplifying the error of the reconstructed samples, making the adversarial samples easier to detect, improving the detection accuracy of the adversarial samples, and reducing the false positive rate. Since the reconstruction error is used as the judgment basis for adversarial sample detection, it is not limited by the type or intensity of adversarial attacks, and it has high versatility. The adversarial example detection sensitivity increases due to the significant difference in reconstruction error.
  • the embodiment of the present application adopts a convolutional neural network structure, so by appropriately adjusting the position of the feedback point, it can be adapted to most of the convolutional neural networks without modifying the network structure of the classification task itself.
  • the design of the feedback structure uses the decoder of the auto-encoder to reconstruct the input samples, and combines the original samples and the reconstructed samples as the input of the two-class detector.
  • the additional overhead is a feedback structure and a two-class classifier, and the training cost is small .
  • the adversarial samples with less interference can be restored and used continuously, so that the model has partial adversarial sample defense ability.
  • an adversarial sample detector is used to detect whether it is an adversarial sample.
  • Adversarial example detectors can be most machine learning networks that can be used as classifiers, such as binary classifiers. Feedback reconstruction amplifies adversarial perturbations, so the adversarial sample detector can detect adversarial samples with small perturbations; instead of calculating the reconstruction error threshold, the adversarial sample detector can train itself to detect reconstruction errors.
  • the adversarial sample detector is used to determine whether the adversarial sample is an adversarial sample by learning the respective reconstruction errors of the adversarial sample and the non-adversarial sample. Since the reconstruction error will amplify the disturbance of the adversarial sample, the detection sensitivity is higher.
  • the theoretical basis is sufficient, and the detection error rate is reduced.
  • FIG. 6 is a schematic diagram of a system architecture for identifying adversarial samples according to an embodiment of the present application.
  • the data collection device 260 is used to collect sample data for training and store it in the database 230 .
  • the training device 220 trains and generates the target neural network 201 , the feedback reconstruction network 202 and the adversarial sample detector 203 based on the sample data maintained in the database 230 .
  • the specific process of training and generating the target neural network 201 , the feedback reconstruction network 202 and the adversarial sample detector 203 by the training device 220 based on the sample data can refer to the respective embodiments corresponding to the subsequent FIG. 8 , which will not be repeated here.
  • the target neural network 201, the feedback reconstruction network 202, and the adversarial sample detector 203 obtained by the training device 220 can be applied in different systems or devices.
  • the embodiments of the present application are described by taking the application to the execution device 210 as an example.
  • the execution device 210 can process the input data through the target neural network 201, the feedback reconstruction network 202, and the adversarial sample detector 203 to obtain the processing result.
  • the specific process is similar to the respective embodiments corresponding to the subsequent FIG. 7, and will not be repeated here. .
  • the execution device 210 is configured with an I/O interface 212 for data interaction with external devices, and a “user” can input data to the I/O interface 212 through the client device 240 . It can be understood that the “user” can also input data to the I/O interface 212 through other devices, such as the data acquisition device 260 .
  • the execution device 210 can call data, codes, etc. in the data storage system 250 , and can also store data, instructions, etc. in the data storage system 250 .
  • the I/O interface 212 returns the processing result to the client device 240, which is provided to the user.
  • the user can view the result output by the execution device 210 on the client device 240, and the specific presentation form can be a specific manner such as display, sound, and action.
  • the client device 240 can also act as a data collection terminal to store the collected sample data in the database 230 .
  • the training device 220 can generate corresponding target neural network 201 , feedback reconstruction network 202 and adversarial sample detector 203 based on different data for different targets, so as to provide users with better results.
  • FIG. 2 is only a schematic diagram of a system architecture provided by an embodiment of the present invention, and the positional relationship among the devices, devices, modules, etc. shown in the figure does not constitute any limitation.
  • the data storage system 250 is an external memory relative to the execution device 210 , and in other cases, the data storage system 250 may also be placed in the execution device 210 .
  • the data acquisition device 260 may be a vehicle-mounted camera, and a part of the collected image data may be manually labeled with corresponding labels as sample data or test data, and used by the training device 220 for Training the target neural network 201, the feedback reconstruction network 202 and the adversarial sample detector 203; another part of the collected image data can be used as input data and transmitted to the execution device 210 through the I/O interface 212, so that the execution device 210 can perform the training according to the trained target.
  • a neural network 201, a feedback reconstruction network 202, and an adversarial example detector 203 process the input data.
  • the execution device 210 transmits the processing result to the client device 240 through the I/O interface 212, so that the client device 240 can display the image recognition result.
  • the execution device 210 transmits the processing result to a database, server, etc. for storage through the I/O interface 212 for subsequent invocation.
  • the execution device may execute the process shown in FIG. 7 , which is a flowchart of a method for identifying an adversarial sample in an embodiment of the present application.
  • the process includes:
  • the execution device may acquire the input sample, and the purpose is to obtain the recognition result corresponding to the input sample through the target neural network according to the input sample.
  • the specific content of the input sample can have different forms according to different application scenarios. Exemplarily, in the application scenario of image recognition, the input sample can be a picture; in the application scenario of speech recognition, the input sample can be a piece of speech; in the application scenario of text recognition, the input sample can be a piece of text.
  • the embodiment of the present application does not limit the specific form of the input sample.
  • the execution device may first perform some preprocessing on the input samples, and convert the form of the input samples into some data formats that are easy to process, which is not limited in this embodiment of the present application.
  • the execution device may execute the instruction code corresponding to the self-encoder, so as to obtain the reconstructed sample according to the input sample.
  • the autoencoder is similar to the previous content and will not be repeated here.
  • the encoder part of the autoencoder can be implemented by the convolutional layer in the target neural network, so when the adversarial sample attacks the target neural network, the error of the reconstructed sample obtained by the autoencoder increases, which is easier. been detected.
  • the embodiment of the present application does not directly use an independent autoencoder for adversarial sample detection, but uses the convolutional layer of the target neural network as the encoder of the autoencoder, so that the autoencoder is closely related to the target neural network, and the detection system is connected with the target neural network.
  • the target neural network is closely integrated to improve the detection sensitivity: since the convolutional network of the target neural network is also the encoder of the auto-encoder, the interference of the adversarial sample to the feature extraction of the target neural network is also the interference to the feature extraction of the encoder. , a white-box attack on the target neural network is transformed into a white-box attack on the autoencoder. Therefore, the autoencoder cannot reconstruct the adversarial samples, but instead, due to the reconstruction error, the disturbance that cannot be detected by the human eye will be clearly displayed.
  • the adversarial sample detector can analyze the categories corresponding to the data features of the input samples and the reconstructed samples. Exemplarily, if the data characteristics of the input sample and the reconstructed sample are similar to the adversarial sample in the training set and its reconstructed sample (corresponding to the training label "1"), the detection result can be obtained through the adversarial sample detector analysis as the label "1". ". If the data characteristics of the input sample and the reconstructed sample are similar to the non-adversarial samples and their reconstructed samples in the training set (the corresponding training label is "0"), the detection result can be obtained by the adversarial sample detector as the label "0".
  • the training set is a set of non-confrontational samples used for training the adversarial sample detector. For details, please refer to the description of the embodiment corresponding to FIG. 8 , which will not be repeated here.
  • the execution device may execute the instruction code corresponding to the adversarial sample detector, so as to obtain the detection result of the input sample according to the input sample and the reconstructed sample.
  • the detection result can be "normal” or “adversarial sample", which can be specifically represented by the flag "0" and the flag "1".
  • the execution device may also use other flags to represent the test result. Not limited.
  • the embodiments of the present application do not use a binary classifier to directly detect adversarial samples, nor use a fixed threshold to discriminate adversarial samples, but use an adversarial sample detector (such as a binary classifier) to learn the respective reconstruction errors of adversarial samples and non-adversarial samples.
  • an adversarial sample detector such as a binary classifier
  • To determine whether it is an adversarial sample because the reconstruction error will amplify the disturbance of the adversarial sample, the detection sensitivity is higher; and since any kind of adversarial attack will amplify the reconstruction error, it is highly versatile to judge the adversarial sample based on the reconstruction error. .
  • the detection result may be "normal” (represented by a label “0") or "adversarial sample” (represented by a label “1").
  • the detection result in step 703 if the detection result is the label "1", indicating that the data characteristics of the input sample and the reconstructed sample are similar to the adversarial samples and their reconstructed samples in the training set (the corresponding label is "1"), then the execution device determines The type of input samples is adversarial samples.
  • the execution device determines that the type of the input sample is non-confrontational adversarial example.
  • normal means that the input sample is a non-adversarial sample, and the target neural network is not attacked by the adversarial sample. Therefore, the execution device can execute the instruction code corresponding to the target neural network according to the normal state, and obtain the corresponding recognition result according to the input sample.
  • Advanced sample means that the input sample is an adversarial sample, and the target neural network is attacked by the adversarial sample, then the recognition result corresponding to the input sample is the recognition result after the attack, and the execution device may not pass the target neural network to the input sample. processing, or the recognition result obtained after processing the input sample through the target neural network is invalid.
  • the execution device determines the sample types of the input samples
  • the input samples and their corresponding types can also be sent to other devices for use by other devices.
  • the embodiments of the present application can be applied to the classification of vehicle-mounted camera images.
  • the execution device obtains the picture data captured by the vehicle-mounted camera
  • the above steps 701 to 704 can be executed with the image data captured by the vehicle-mounted camera as an input sample, and the image data can be analyzed by the target neural network. Classify, identify the type of the picture, etc., and detect whether the input sample is a confrontation sample through the self-encoder and the confrontation sample detector, so as to determine whether the type of the image is valid.
  • the specific process is similar and will not be repeated here.
  • FIG. 8 is a flowchart of a training process according to an embodiment of the present application. The process includes:
  • the training set is a set composed of non-confrontational samples.
  • the format type of the non-adversarial samples is similar to the aforementioned input samples, and will not be repeated here.
  • the labels of the non-adversarial samples are specifically set according to the task type of the target neural network.
  • the task type of the target neural network is image recognition, and the non-adversarial samples are images.
  • the staff can use the training equipment to mark the non-adversarial samples such as "" Labels corresponding to non-adversarial samples such as "kitten" and "puppy" are used to train the target neural network.
  • the training device can simultaneously train the target neural network and the autoencoder through the training set, wherein the training of the target neural network by the training device is similar to the aforementioned convolutional neural network, or similar to the traditional neural network training , and will not be repeated here. Since the convolutional layer in the target neural network is also the encoder part of the autoencoder, the training device can simultaneously train the decoder part of the autoencoder according to the training parameters of the convolutional layer of the target neural network while training the target neural network. , to achieve simultaneous training of the target neural network and the autoencoder.
  • the goal of the training equipment to simultaneously train the target neural network and the autoencoder is that the reconstruction error of the autoencoder is small and the recognition error of the target neural network to non-adversarial samples is small, so the loss function can be set as the reconstruction error of the autoencoder and Sum of target neural network errors.
  • the loss function formula provided by the embodiment of the present application is:
  • X train is the training set
  • is the number of data in the training set (that is, the number of non-adversarial samples x in the training set)
  • x is the non-adversarial samples in the training set
  • ae(x) is based on the non-adversarial samples in the training set.
  • the adversarial samples are reconstructed samples for training obtained by the autoencoder, is relative entropy.
  • FIG. 9 is a schematic diagram of generating an adversarial sample for training in an embodiment of the present application.
  • the training device can attack the target neural network through the adversarial sample generation algorithm according to the non-confrontational samples in the training set, and generate adversarial samples for training the target neural network.
  • the adversarial sample generation algorithm may use the above-mentioned FGSM algorithm, JSMA algorithm, etc., which is not limited in this embodiment of the present application.
  • the non-adversarial samples are samples suitable for recognition by the target neural network, while the adversarial samples will attack the target neural network to output wrong results. Therefore, non-adversarial samples and adversarial samples are usually distinguished by labels for subsequent training.
  • the label of a non-adversarial sample is "0", which is used to indicate that the sample is a non-adversarial sample
  • the label of an adversarial sample is "1", which is used to indicate that the sample is an adversarial sample.
  • FIG. 10 is a schematic diagram of generating a non-adversarial reconstruction sample and an adversarial reconstruction sample in an embodiment of the present application.
  • the training device can obtain non-adversarial reconstruction samples through the trained autoencoder according to the non-adversarial samples in the training set.
  • the training equipment can obtain adversarial reconstruction samples through the trained autoencoder according to the adversarial samples used for training.
  • the training device may first generate the non-adversarial reconstruction samples, and then generate the confrontational reconstruction samples, or generate the confrontational reconstruction samples first, and then generate the non-adversarial reconstruction samples, or generate both at the same time, which is not limited in this embodiment of the present application .
  • the first training samples include non-confrontational samples and the non-confrontational reconstruction samples obtained in step 804
  • the second training samples include adversarial samples for training and the adversarial reconstruction samples obtained in step 804
  • the label corresponding to the first training sample is "non-confrontation” or "normal”
  • the label corresponding to the second training sample is "confrontation” or "abnormal”.
  • “non-confrontation” can be represented by a label "0”
  • “adversarial” can be represented by a label "1".
  • FIG. 11 is a schematic diagram of training an adversarial sample detector according to an embodiment of the present application.
  • the training device trains the adversarial sample detector through the first training sample and the second training sample, so that the adversarial sample detector has the ability to detect reconstruction errors.
  • the execution device detects data similar to the second training sample through the trained confrontation sample detector, the data can be identified as the confrontation sample.
  • the training device will also test the trained adversarial sample detector to obtain various types of test data.
  • the training device may acquire a test set, which is a set composed of test samples (ie, non-confrontational samples for testing); according to the test set, a test set for the target neural network is generated by an adversarial sample generation algorithm
  • the adversarial sample used according to the test set and the adversarial sample used for the test, the test result is obtained by the trained self-encoder and the adversarial sample detector; according to the test set and the test used
  • the adversarial samples determine the detection accuracy rate (the overall classification accuracy rate on the test set), the adversarial sample detection rate (the proportion of successfully detected samples in the adversarial samples in the adversarial samples) and the false positive rate ( The proportion of samples that are not adversarial samples but are judged as adversarial samples in the non-adversarial samples).
  • other devices may also be used for testing, which is not limited in this embodiment of the present application.
  • execution process and training process are performed by the execution device and the training device respectively.
  • the execution device and the training device may be the same device. Do limit.
  • FIG. 12 is a schematic diagram of another technical solution provided by an embodiment of the present application.
  • the execution device processes the input samples through the auto-encoder to obtain the reconstructed samples
  • the reconstructed samples can be processed again by the auto-encoder to realize a cyclic reconstruction. If the input sample is an adversarial sample, the noise of the adversarial sample will be amplified, which will make it easier to detect and improve the detection rate of the adversarial sample.
  • FIG. 12 (eg, target neural network, feedback reconstruction network, and adversarial sample detector, etc.) are similar to the respective embodiments corresponding to the foregoing FIG. 3 , and will not be repeated here.
  • the system architecture of the technical solution shown in FIG. 12 is similar to the aforementioned FIG. 6 , and details are not repeated here.
  • FIG. 13 is another flowchart of an implementation device according to an embodiment of the present application. Specifically, the execution device in the system architecture can execute the following processes:
  • Step 1301 is similar to step 701 in the foregoing embodiments corresponding to FIG. 7 , and details are not described herein again.
  • Step 1302 is similar to step 702 in the foregoing embodiments corresponding to FIG. 7 , and details are not described herein again.
  • the execution device may process the reconstructed samples again through the autoencoder to obtain the second reconstructed samples.
  • the execution device may further process the second reconstructed sample through the autoencoder to obtain the third reconstructed sample... and so on, the execution device may perform cyclic reconstruction on the reconstructed sample for many times.
  • This embodiment of the present application does not limit the number of times of cyclic reconstruction.
  • the increase in the number of loop reconstructions may result in an increase in the cost of computing power and energy consumption and time delay. Designers can adjust the number of loop reconstructions according to the actual situation to achieve a balance between the detection rate of adversarial samples and the energy consumption delay.
  • Step 1304 is similar to step 703 in the foregoing embodiments corresponding to FIG. 7 , and details are not repeated here.
  • Step 1305 is similar to step 704 in the foregoing embodiments corresponding to FIG. 7 , and details are not described herein again.
  • FIG. 12 The training process of the technical solution shown in FIG. 12 is similar to the respective embodiments corresponding to the foregoing FIG. 8 , and details are not repeated here.
  • FIG. 14 is a schematic diagram of an apparatus for identifying an adversarial sample provided by an embodiment of the present application.
  • the device 1400 for defending against adversarial samples includes:
  • the obtaining module 1401 is configured to execute step 701 in the respective embodiments corresponding to FIG. 7 above, or execute step 801 in the respective embodiments corresponding to the aforementioned FIG. 8 , or execute step 1301 in the respective embodiments corresponding to the aforementioned FIG. 13 ;
  • the processing module 1402 is configured to execute steps 702, 703, and 704 in the respective embodiments corresponding to FIG. 7, or execute steps 802, 803, 804, and 805 in the respective embodiments corresponding to FIG. 8, Or perform step 1302 , step 1303 , step 1304 , and step 1305 in the respective embodiments corresponding to FIG. 13 .
  • FIG. 15 is a schematic structural diagram of an execution device provided by an embodiment of the present application.
  • the execution device 1500 may vary greatly due to different configurations or performance, and may include one or more central processing units (CPUs) 1501 (eg, one or more processors) and memory 1502, one or more storage media 1503 (eg, one or more mass storage devices) that store applications 1533 or data 1532.
  • the memory 1502 and the storage medium 1503 may be short-term storage or persistent storage.
  • the program stored in the storage medium 1503 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the execution device.
  • the central processing unit 1501 may be configured to communicate with the storage medium 1503 to execute a series of instruction operations in the storage medium 1503 on the execution device 1500 .
  • Execution device 1500 may also include one or more power supplies 1504, one or more wired or wireless network interfaces 1505, one or more input and output interfaces 1506, and/or, one or more operating systems 1531, such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM and many more.
  • operating systems 1531 such as Windows Server TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM and many more.
  • the steps performed by the execution device in the above embodiment may be based on the execution device structure shown in FIG. 15 .
  • the CPU 1501 may execute all the steps in the above-mentioned embodiment corresponding to FIG. 7 , or all the steps in the above-mentioned embodiment corresponding to FIG. 8 , or all the above-mentioned steps in the above-mentioned embodiment corresponding to FIG. 13 .
  • the modules in the CPU 1501 may include the acquisition module 1401 and the processing module 1402 in the above-mentioned embodiment corresponding to FIG. 14 , which will not be repeated in this embodiment of the present application.
  • the structure of the training device is similar to the structure of the execution device corresponding to FIG. 15 , and details are not repeated here.
  • the steps performed by the training device may be performed in advance by the execution device, which is not limited in this embodiment of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Evolutionary Computation (AREA)
  • Computing Systems (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Multimedia (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biomedical Technology (AREA)
  • Biophysics (AREA)
  • Computational Linguistics (AREA)
  • Data Mining & Analysis (AREA)
  • Molecular Biology (AREA)
  • General Engineering & Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Image Analysis (AREA)

Abstract

本申请实施例提供一种防御对抗样本的方法及相关装置，该方法通过将目标神经网络的卷积层的结果输出到反馈重构网络中重构得到重构样本，使得对抗样本对目标神经网络的攻击会干扰自编码器的重构从而放大重构样本的误差，使得对抗样本更容易被检测出来，提高了对抗样本的检测准确率，减少了假阳性率。并且，本申请实施例使用对抗样本检测器通过学习对抗样本与非对抗样本各自的重构误差来判别输入样本是否为对抗样本，由于重构误差会放大对抗样本扰动，所以检测灵敏度更高。

Description

一种对抗样本的识别方法及相关装置 技术领域
本申请实施例涉及神经网络技术领域，尤其涉及一种防御对抗样本的识别方法及相关装置。
背景技术
深度神经网络在机器学习领域的许多任务中取得了巨大的成功,例如图像分类、语音识别、自然语言处理、医疗健康等。
然而，深度神经网络很容易受到对抗样本的攻击。对抗样本,即在数据集中通过故意添加细微的干扰所形成的输入样本。对抗样本能够导致机器学习模型以高置信度给出一个错误的输出。对抗样本与真实样本在外观上没有区别，但能够攻击最先进的机器学习模型，使其得出错误的结果。
因此，机器学习模型需要能够防御对抗样本，避免对抗样本导致的错误结果。
发明内容
第一方面，本申请实施例提供一种对抗样本的识别方法，包括：获取输入样本；根据所述输入样本，通过自编码器得到重构样本，所述自编码器以目标神经网络的卷积层为编码器，以反馈重构网络为解码器；根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果，所述对抗样本检测器是通过第一训练样本和第二训练样本训练获得，所述第一样本包括非对抗样本及其重构样本，以及第一样本标签；所述第二样本包括对抗样本及其重构样本，以及第二样本标签；根据检测结果确定所述输入样本的样本类型。
本申请实施例提供一种对抗样本的识别方法及相关装置，该方法通过将目标神经网络的卷积层的结果输出到反馈重构网络中重构得到重构样本，使得对抗样本对目标神经网络的攻击会干扰自编码器的重构从而放大重构样本的误差，使得对抗样本更容易被检测出来，提高了对抗样本的检测准确率，减少了假阳性率。并且，本申请实施例使用对抗样本检测器通过学习对抗样本与非对抗样本各自的重构误差来判别输入样本是否为对抗样本，由于重构误差会放大对抗样本扰动，所以检测灵敏度更高。
结合第一方面，在本申请实施例的一种实现方式中，所述根据所述输入样本，通过自编码器得到重构样本之后，所述根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果之前，所述方法还包括：通过所述自编码器对所述重构样本进行至少一次循环重构，所述循环重构为通过所述自编码器对所述重构样本进行处理。
结合第一方面，在本申请实施例的一种实现方式中，所述对抗样本检测器为二分类器。
结合第一方面，在本申请实施例的一种实现方式中，所述通过自编码器得到重构样本之前，所述方法还包括：获取训练集，所述训练集为非对抗样本组成的集合；通过所述训练集同时对所述目标神经网络以及所述自编码器训练，所述目标神经网络包含所述卷积层与目标分类器。
结合第一方面，在本申请实施例的一种实现方式中，通过所述训练集同时对所述目标神经网络以及所述自编码器训练中，训练过程的损失函数为：
Figure PCTCN2020129298-appb-000001
其中，X train为训练集，|X train|为训练集的数据数量，x为训练集中的非对抗样本，ae(x)为根据训练集中的非对抗样本通过所述自编码器得到的训练用重构样本，
Figure PCTCN2020129298-appb-000002
为相对熵。
结合第一方面，在本申请实施例的一种实现方式中，所述通过所述训练集同时对所述目标神经网络以及所述自编码器训练之后，所述方法还包括：根据所述训练集，通过对抗样本生成算法生成针对所述目标神经网络的训练用的对抗样本；根据所述训练集通过训练后的所述自编码器得到非对抗重构样本；根据所述训练用的对抗样本，通过训练后的所述自编码器得到对抗重构样本；通过第一训练样本和第二训练样本对所述对抗样本检测器训练，所述第一训练样本由所述训练集中非对抗样本及所述非对抗重构样本组成，所述第二训练样本由所述训练用的对抗样本及所述对抗重构样本组成。
结合第一方面，在本申请实施例的一种实现方式中，所述通过第一训练样本和第二训练样本对所述对抗样本检测器训练之后，所述方法还包括：获取测试集，所述测试集为测试样本组成的集合；根据所述测试集，通过对抗样本生成算法生成针对所述目标神经网络的测试用的对抗样本；根据所述测试集和所述测试用的对抗样本，通过训练完的所述自编码器和所述对抗样本检测器得到测试结果；根据所述测试集和所述测试用的对抗样本确定所述测试结果的检测正确率、对抗样本检出率和假阳性率。
第二方面，本申请实施例提供一种对抗样本的识别装置，包括：获取模块，用于获取输入样本；处理模块，用于根据所述输入样本，通过自编码器得到重构样本，所述自编码器以卷积神经网络的卷积层为编码器，以反馈重构网络为解码器；所述处理模块，还用于根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果，所述对抗样本检测器是通过第一训练样本和第二训练样本训练获得，所述第一样本包括非对抗样本及其重构样本，以及第一样本标签；所述第二样本包括对抗样本及其重构样本，以及第二样本标签；所述处理模块，还用于根据检测结果确定所述输入样本的样本类型。
结合第二方面，在本申请实施例的一种实现方式中，处理模块还用于：通过所述自编码器对所述重构样本进行至少一次循环重构，所述循环重构为通过所述自编码器对所述重构样本进行处理。
结合第二方面，在本申请实施例的一种实现方式中，所述对抗样本检测器为二分类器。
结合第二方面，在本申请实施例的一种实现方式中，处理模块还用于：获取训练集，所述训练集为非对抗样本组成的集合；通过所述训练集同时对所述目标神经网络以及所述自编码器训练，所述目标神经网络包含所述卷积层与目标分类器。
结合第二方面，在本申请实施例的一种实现方式中，通过所述训练集同时对所述目标神经网络以及所述自编码器训练中，训练过程的损失函数为：
Figure PCTCN2020129298-appb-000003
其中，X train为训练集，|X train|为训练集的数据数量，x为训练集中的非对抗样本，ae(x)为根据训练集中的非对抗样本通过所述自编码器得到的训练用重构样本，
Figure PCTCN2020129298-appb-000004
为相对熵。
结合第二方面，在本申请实施例的一种实现方式中，处理模块还用于：根据所述训练集，通过对抗样本生成算法生成针对所述目标神经网络的训练用的对抗样本；根据所述训练集通过训练后的所述自编码器得到非对抗重构样本；根据所述训练用的对抗样本，通过训练后的所述自编码器得到对抗重构样本；通过第一训练样本和第二训练样本对所述对抗样本检测器训练，所述第一训练样本由所述训练集中非对抗样本及所述非对抗重构样本组成，所述第二训练样本由所述训练用的对抗样本及所述对抗重构样本组成。
结合第二方面，在本申请实施例的一种实现方式中，处理模块还用于：获取测试集，所述测试集为测试样本组成的集合；根据所述测试集，通过对抗样本生成算法生成针对所述目标神经网络的测试用的对抗样本；根据所述测试集和所述测试用的对抗样本，通过训练完的所述自编码器和所述对抗样本检测器得到测试结果；根据所述测试集和所述测试用的对抗样本确定所述测试结果的检测正确率、对抗样本检出率和假阳性率。
第三方面，本申请实施例还提供一种对抗样本的识别设备，包括：处理器和传输接口，所述处理器被配置为调用存储在存储器中的程序指令，以执行如第一方面的方法。
第四方面，本申请实施例还提供一种计算机可读存储介质，包括指令，当所述指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如第一方面的方法。
第五方面，本申请实施例还提供一种包含指令的计算机程序产品，所述计算机程序产品包括程序指令，当所述程序指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如第一方面的方法。
附图说明
图1a为基于二分类器检测对抗样本的方法示意图之一；
图1b为基于二分类器检测对抗样本的方法示意图之二；
图1c为基于二分类器检测对抗样本的方法示意图之三；
图2为基于自编码器检测对抗样本的方法示意图；
图3为本申请实施例提供的识别对抗样本的技术方案示意图；
图4为本申请实施例中卷积神经网络的示意图；
图5为本申请实施例中另一种卷积神经网络的示意图；
图6为本申请实施例提供的一种识别对抗样本的系统架构的示意图；
图7为本申请实施例中对抗样本的识别方法的流程图；
图8为本申请实施例的训练过程的流程图；
图9为本申请实施例中生成训练用对抗样本的示意图；
图10为本申请实施例中生成非对抗重构样本和对抗重构样本的示意图；
图11为本申请实施例训练对抗样本检测器的示意图；
图12为本申请实施例提供的另一种技术方案的示意图；
图13为本申请实施例执行设备的另一种流程图；
图14为本申请实施例提供的一种对抗样本的识别装置的示意图；
图15为本申请实施例提供的一种执行设备结构示意图。
具体实施方式
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的本申请的实施例能够以除了在这里图示或描述的那些以外的顺序实施。此外，术语“包括”和“对应于”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
在本申请实施例中，“示例性的”或者“例如”等词用于表示作例子、例证或说明。本申请实施例中被描述为“示例性的”或者“例如”的任何实施例或设计方案不应被解释为比其它实施例或设计方案更优选或更具优势。确切而言，使用“示例性的”或者“例如”等词旨在以具体方式呈现相关概念。
为了下述各实施例的描述清楚简洁，首先给出相关技术的简要介绍：
人工智能(Artificial Intelligence,AI)是利用数字计算机或者数字计算机控制的机器模拟、延伸和扩展人的智能，感知环境、获取知识并使用知识获得最佳结果的理论、方法、技术及应用系统。换句话说，人工智能是计算机科学的一个综合技术，它企图了解智能的实质，并生产出一种新的能以人类智能相似的方式做出反应的智能机器。人工智能也就是研究各种智能机器的设计原理与实现方法，使机器具有感知、推理与决策的功能。
人工智能技术是一门综合学科，涉及领域广泛，既有硬件层面的技术也有软件层面的技术。人工智能基础技术一般包括如传感器、专用人工智能芯片、云计算、分布式存储、大数据处理技术、操作/交互系统、机电一体化等技术。人工智能软件技术主要包括计算机视觉技术、语音处理技术、自然语言处理技术以及机器学习/深度学习等几大方向。
机器学习(Machine Learning,ML)是一门多领域交叉学科，涉及概率论、统计学、逼近论、凸分析、算法复杂度理论等多门学科。专门研究计算机怎样模拟或实现人类的学习行为，以获取新的知识或技能，重新组织已有的知识结构使之不断改善自身的性能。机器学习是人工智能的核心，是使计算机具有智能的根本途径，其应用遍及人工智能的各个领域。机器学习和深度学习通常包括人工神经网络、置信网络、强化学习、迁移学习、归纳学习、式教学习等技术。
其中，深度神经网络在机器学习领域的许多任务中取得了巨大的成功,例如图像分类、语音识别、自然语言处理、医疗健康等。
然而，深度神经网络很容易受到对抗样本的攻击。对抗样本,即在数据集中通过故意添 加细微的干扰所形成的输入样本，导致模型以高置信度给出一个错误的输出。对抗样本与真实样本在外观上没有区别，但能够攻击最先进的机器学习模型，使其得出错误的结果。
对抗样本的存在，对支持深度学习模型的系统在安全等级需求高的场景应用造成了巨大的冲击。目前生成对抗样本的算法技术有快速梯度下降算法(Fast Gradient Sign Method，FGSM)、JSMA(Jacobian-based Saliency Map Attack)算法、CW(Carlini and Wagner Attacks)算法等，其基本原理是尽可能使扰动最小，同时最大化损失函数，使分类器的预测概率发生改变。
因此，机器学习模型亟需防御对抗样本。目前防御对抗样本的方法有通过二分类器或者通过自编码器识别非对抗样本和对抗样本。以下对这两种方法进行简要的说明。
图1a为基于二分类器检测对抗样本的方法示意图之一。该方法的第一步是利用非对抗样本组成的训练集X train，通过FGSM算法对目标神经网络F1攻击后生成对抗样本组成的训练集
Figure PCTCN2020129298-appb-000005
同理，利用非对抗样本组成的测试集X test，通过FGSM算法对目标神经网络F1攻击后可以生成对抗样本组成的测试集
Figure PCTCN2020129298-appb-000006
图1b为基于二分类器检测对抗样本的方法示意图之二。该方法的第二步是通过非对抗样本组成的训练集X train和对抗样本组成的训练集
Figure PCTCN2020129298-appb-000007
对二分类器F2进行训练。其中，训练集中非对抗样本的标志为0，对抗样本的标志为1。训练完的二分类器F2能够根据输入的样本区分出对抗样本。
图1c为基于二分类器检测对抗样本的方法示意图之三。该方法的第三步是通过非对抗样本组成的测试集X test和对抗样本组成的测试集
Figure PCTCN2020129298-appb-000008
对二分类器进行测试，并根据该二分类器能够准确识别测试集中对抗样本的数量得到该二分类器的准确率。
准确率达标的二分类器可以作为对抗样本的检测器，设备可以先通过二分类器检测输入的样本是否是对抗样本，若输入的样本不是对抗样本，则设备可以根据该输入的样本，通过目标神经网络得到输出结果。设备先通过二分类器对输入的样本进行检测，防御了对抗样本，因此输出结果更加可靠。
然而，这种防御对抗样本的方法仅能检测到训练集中对抗样本使用的攻击，具有攻击敏感性。例如上述二分类器中训练集使用的攻击是FGSM算法，则该二分类器仅能检测使用FGSM算法进行攻击的对抗样本，而无法检测到采用其他算法进行攻击的对抗样本。此外，这种防御对抗样本的方法对攻击强度非常敏感，只能检测扰动较大的对抗样本，对小扰动的对抗样本几乎没有检测能力。
图2为基于自编码器检测对抗样本的方法示意图。该方法使用非对抗样本训练的自编码器作为对抗样本检测器，利用输入样本与自编码器重构样本之间的差别大小为依据检测对抗样本；使用去噪自编码器作为还原器，将检测器未检测出的小扰动对抗样本还原为非对抗样本。
其中，第一检测器是使用非对抗样本训练的自编码器。如果待测试的样本是非对抗样本，因为该样本与自编码器的训练数据的生成过程相同，所以其重构误差很小，反之，如果带检测的样本是对抗样本，那么该样本的重构误差会很大。所以用重构误差来衡量待检测样本与非对抗样本间的距离。但是，由于该距离是连续值，所以利用验证集确定一个阈值，用来判断是否为对抗样本。也就是说，输入的样本x与重构样本x’之间的重构误差大 于阈值说明该样本x为对抗样本。
还原器则是采用去噪编码器，将检测器未检测出的小扰动对抗样本还原为非对抗样本。
分类器一般用于实现目标神经网络的实际功能，例如图像识别等。
第二检测器用于根据f(x)与f(ae(x))间的分歧来判断样本x为非对抗样本或对抗样本。其中，f(x)为输入的样本x经过分类器得到的输出结果，f(ae(x))为输入的样本x经过第一检测器和分类器得到的输出结果。
然而，这种防御对抗样本的方法训练了多个自编码器，训练量大，训练成本高。并且，作为检测器的自编码器与目标神经网络的目标分类器无关，对抗样本检出率较低，检错率较高。且由于使用固定阈值作为判断是否为对抗样本的分类依据，缺少理论依据且错误率较高。
有鉴于此，本申请实施例提供了一种防御对抗样本的方法，克服上述缺点。下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行详细描述。
图3为本申请实施例提供的识别对抗样本的技术方案示意图。在本申请实施例中，样本x输入到目标神经网络得到识别结果f(x)，其中，目标神经网络包括卷积层和目标分类器。而当防御对抗样本的对抗样本检测器确认该样本x不是对抗样本后，该识别结果f(x)有效；当对抗样本检测器确认该样本x是对抗样本，则该识别结果f(x)无效。
另一方面，设备通过自编码器对输入的样本x进行重构得到重构样本ae(x)，其中，自编码器由目标神经网络的卷积层和反馈重构网络组成。然后设备将输入的样本x和重构样本ae(x)放入对抗样本检测器中进行检测，从而确定输入的样本x是否为对抗样本。对抗样本检测器可以是一种二分类器。
其中，目标神经网络可以是卷积神经网络，也可以是其他类型的神经网络，本申请实施例对此不做限定。以下将以卷积神经网络作为具体实施例进行详细的描述。
图4为本申请实施例中卷积神经网络的示意图。卷积神经网络(CNN，Convolutional neuron network)是)是一种带有卷积结构的深度神经网络，是一种深度学习(deep learning)架构，深度学习架构是指通过机器学习的算法，在不同的抽象层级上进行多个层次的学习。作为一种深度学习架构，CNN是一种前馈(feed-forward)人工神经网络，该前馈人工神经网络中的各个神经元对输入其中的图像中的重叠区域作出响应。
如图4所示，卷积神经网络(CNN)100可以包括输入层110，卷积层/池化层120，其中池化层为可选的，以及神经网络层130。
卷积层/池化层120：
卷积层：
如图4所示卷积层/池化层120可以包括如示例121-126层，在一种实现中，121层为卷积层，122层为池化层，123层为卷积层，124层为池化层，125为卷积层，126为池化层；在另一种实现方式中，121、122为卷积层，123为池化层，124、125为卷积层，126为池化层。即卷积层的输出可以作为随后的池化层的输入，也可以作为另一个卷积层的输入以继续进行卷积操作。
以卷积层121为例，卷积层121可以包括很多个卷积算子，卷积算子也称为核，其在 图像处理中的作用相当于一个从输入图像矩阵中提取特定信息的过滤器，卷积算子本质上可以是一个权重矩阵，这个权重矩阵通常被预先定义，在对图像进行卷积操作的过程中，权重矩阵通常在输入图像上沿着水平方向一个像素接着一个像素(或两个像素接着两个像素……这取决于步长stride的取值)的进行处理，从而完成从图像中提取特定特征的工作。该权重矩阵的大小应该与图像的大小相关，需要注意的是，权重矩阵的纵深维度(depth dimension)和输入图像的纵深维度是相同的，在进行卷积运算的过程中，权重矩阵会延伸到输入图像的整个深度。因此，和一个单一的权重矩阵进行卷积会产生一个单一纵深维度的卷积化输出，但是大多数情况下不使用单一权重矩阵，而是应用维度相同的多个权重矩阵。每个权重矩阵的输出被堆叠起来形成卷积图像的纵深维度。不同的权重矩阵可以用来提取图像中不同的特征，例如一个权重矩阵用来提取图像边缘信息，另一个权重矩阵用来提取图像的特定颜色，又一个权重矩阵用来对图像中不需要的噪点进行模糊化……该多个权重矩阵维度相同，经过该多个维度相同的权重矩阵提取后的特征图维度也相同，再将提取到的多个维度相同的特征图合并形成卷积运算的输出。
这些权重矩阵中的权重值在实际应用中需要经过大量的训练得到，通过训练得到的权重值形成的各个权重矩阵可以从输入图像中提取信息，从而帮助卷积神经网络100进行正确的预测。
当卷积神经网络100有多个卷积层的时候，初始的卷积层(例如121)往往提取较多的一般特征，该一般特征也可以称之为低级别的特征；随着卷积神经网络100深度的加深，越往后的卷积层(例如126)提取到的特征越来越复杂，比如高级别的语义之类的特征，语义越高的特征越适用于待解决的问题。
池化层：
由于常常需要减少训练参数的数量，因此卷积层之后常常需要周期性的引入池化层，即如图4中120所示例的121-126各层，可以是一层卷积层后面跟一层池化层，也可以是多层卷积层后面接一层或多层池化层。在图像处理过程中，池化层的唯一目的就是减少图像的空间大小。池化层可以包括平均池化算子和/或最大池化算子，以用于对输入图像进行采样得到较小尺寸的图像。平均池化算子可以在特定范围内对图像中的像素值进行计算产生平均值。最大池化算子可以在特定范围内取该范围内值最大的像素作为最大池化的结果。另外，就像卷积层中用权重矩阵的大小应该与图像大小相关一样，池化层中的运算符也应该与图像的大小相关。通过池化层处理后输出的图像尺寸可以小于输入池化层的图像的尺寸，池化层输出的图像中每个像素点表示输入池化层的图像的对应子区域的平均值或最大值。
神经网络层130：
在经过卷积层/池化层120的处理后，卷积神经网络100还不足以输出所需要的输出信息。因为如前所述，卷积层/池化层120只会提取特征，并减少输入图像带来的参数。然而为了生成最终的输出信息(所需要的类信息或别的相关信息)，卷积神经网络100需要利用神经网络层130来生成一个或者一组所需要的类的数量的输出。因此，在神经网络层130中可以包括多层隐含层(如图4所示的131、132至13n)以及输出层140，该多层隐含层 中所包含的参数可以根据具体的任务类型的相关训练数据进行预先训练得到，例如该任务类型可以包括图像识别，图像分类，图像超分辨率重建等等……可以理解的是，当卷积神经网络执行分类任务(例如图像分类)的时候，神经网络层也可以称为分类器。
在神经网络层130中的多层隐含层之后，也就是整个卷积神经网络100的最后层为输出层140，该输出层140具有类似分类交叉熵的损失函数，具体用于计算预测误差，一旦整个卷积神经网络100的前向传播(如图4由110至140的传播为前向传播)完成，反向传播(如图4由140至110的传播为反向传播)就会开始更新前面提到的各层的权重值以及偏差，以减少卷积神经网络100的损失及卷积神经网络100通过输出层输出的结果和理想结果之间的误差。
需要说明的是，如图4所示的卷积神经网络100仅作为一种卷积神经网络的示例，在具体的应用中，卷积神经网络还可以以其他网络模型的形式存在，例如，如图5所示的多个卷积层/池化层并行，将分别提取的特征均输入给全神经网络层130进行处理。
自编码器(autoencoder,AE)是一类在半监督学习和非监督学习中使用的人工神经网络(Artificial Neural Networks,ANNs)，其功能是通过将输入信息作为学习目标，对输入信息进行表征学习(representation learning)。自编码器包含编码器(encoder)和解码器(decoder)两部分。
在本申请实施例中，自编码器中的编码器(encoder)部分可以用上述卷积神经网络中的卷积层来实现。自编码器中的解码器(decoder)部分可以用反馈重构网络实现。反馈重构网络可以是一种卷积神经网络，能够将目标神经网络中卷积层提取的特征进行重构，生成重构样本(ae(x))。
在本申请实施例中，对抗样本检测器可以是大多数可用作分类器的机器学习网络，例如二分类器等，可以与前述图1a、图1b和图1c中的二分类器类似，本申请实施例对此不做限定。
综上所述，本申请实施例通过将目标神经网络的卷积层的结果输出到反馈重构网络中重构得到重构样本，使得对抗样本对目标神经网络的攻击会干扰自编码器的重构从而放大重构样本的误差，使得对抗样本更容易被检测出来，提高了对抗样本的检测准确率，减少了假阳性率。本申请实施例将目标网络的卷积层作为自编码器的编码器，反馈重构网络作为自编码器的解码器，使自编码器与目标网络紧密相关，对目标网络的攻击也一定会干扰自编码器对样本的重构，从而放大重构样本误差，使得对抗样本更容易被检测出来，提高了对抗样本的检测准确率，减少了假阳性率。而由于使用重构误差作为对抗样本检测的判断依据，并不会受限于对抗攻击种类或强度，泛用性高。由于重构误差的明显差异，对抗样本检测灵敏度增加。
并且，本申请实施例采用卷积神经网络结构，因此适当调整反馈点位置，可以适应大多数卷积神经网络对分类任务网络结构的本身无修改。反馈结构的设计用自编码器的解码器对输入样本进行重构,并将原样本与重构样本组合作为二分类检测器的输入额外开销为一个反馈结构与一个二分类器，训练成本较小。且通过反馈可以还原干扰较小的对抗样本并继续使用，使模型具有部分对抗样本防御能力。
并且，本申请实施例的技术方案中，使用对抗样本检测器侦测是否为对抗样本。对抗样本检测器可以是大多数可用作分类器的机器学习网络，例如二分类器。反馈重构会放大对抗扰动，因此对抗样本检测器可以检测小扰动的对抗样本；不需要计算重构误差阈值，而是让对抗样本检测器自己训练出侦测重构误差的能力。使用对抗样本检测器通过学习对抗样本与非对抗样本各自的重构误差来判别是否为对抗样本，由于重构误差会放大对抗样本扰动，所以检测灵敏度更高。并且，与图2对应的方案相比，由于不使用固定阈值，而是使用机器学习的方式进行分类，理论依据充分，且减小了检测错误率。
为实现上述技术方案，本申请实施例提供了一种防御对抗样本的系统架构。该系统架构如图6所示。图6为本申请实施例提供的一种识别对抗样本的系统架构的示意图。数据采集设备260用于采集训练用的样本数据并存入数据库230，训练设备220基于数据库230中维护的样本数据训练生成目标神经网络201、反馈重构网络202以及对抗样本检测器203。
训练设备220基于样本数据训练生成目标神经网络201、反馈重构网络202以及对抗样本检测器203的具体过程可参照后续图8对应的各个实施例，此处不再赘述。训练设备220得到的目标神经网络201、反馈重构网络202以及对抗样本检测器203可以应用不同的系统或设备中。本申请实施例以应用到执行设备210为例进行描述。执行设备210可以通过目标神经网络201、反馈重构网络202以及对抗样本检测器203对输入的数据进行处理，得到处理结果，具体过程与后续图7对应的各个实施例类似，此处不再赘述。
执行设备210配置有I/O接口212，与外部设备进行数据交互，“用户”可以通过客户设备240向I/O接口212输入数据。可以理解的是，“用户”也可以通过其他设备向I/O接口212输入数据，例如数据采集设备260。
执行设备210可以调用数据存储系统250中的数据、代码等，也可以将数据、指令等存入数据存储系统250中。
最后，I/O接口212将处理结果返回给客户设备240，提供给用户。
用户可以在客户设备240查看执行设备210输出的结果，具体的呈现形式可以是显示、声音、动作等具体方式。客户设备240也可以作为数据采集端将采集到样本数据存入数据库230。
更深层地，训练设备220可以针对不同的目标，基于不同的数据生成相应的目标神经网络201、反馈重构网络202以及对抗样本检测器203，以给用户提供更佳的结果。
值得注意的，附图2仅是本发明实施例提供的一种系统架构的示意图，图中所示设备、器件、模块等之间的位置关系不构成任何限制，例如，在附图6中，数据存储系统250相对执行设备210是外部存储器，在其它情况下，也可以将数据存储系统250置于执行设备210中。
示例性的，在车载摄像头识别图像的应用场景中，数据采集设备260可以为车载摄像头，其采集的一部分图像数据可以在人工打上对应的标签后作为样本数据或测试数据，被训练设备220用于训练目标神经网络201、反馈重构网络202以及对抗样本检测器203；采集的另一部分图像数据可以作为输入数据，通过I/O接口212传输至执行设备210，使得执行设备210根据训练好的目标神经网络201、反馈重构网络202以及对抗样本检测器203 处理该输入数据。最后执行设备210通过I/O接口212将处理结果传输至客户设备240，使得客户设备240上可以显示图像识别的结果。在一些情况中，执行设备210通过I/O接口212将处理结果传输至数据库、服务器等进行存储，以供后续调用。
具体地，执行设备可以执行如图7所示的流程，图7为本申请实施例中对抗样本的识别方法的流程图。该流程包括：
701、获取输入样本；
在本申请实施例中，执行设备可以获取输入样本，目的是根据输入样本，通过目标神经网络得到输入样本对应的识别结果。输入样本的具体内容可以根据不同的应用场景有不同的形式。示例性的，在图像识别的应用场景中，输入样本可以是图片；在语音识别的应用场景中，输入样本可以是一段语音；在文本识别的应用场景中，输入样本可以是一段文字。本申请实施例对输入样本的具体形式不做限定。
可以理解的是，在一些实施例中，执行设备可以先对输入样本进行一些预处理，将输入样本的形式转化为一些易于处理的数据格式，本申请实施例对此不做限定。
702、根据输入样本，通过自编码器得到重构样本；
在本申请实施例中，执行设备可以执行自编码器对应的指令代码，从而根据输入样本得到重构样本。自编码器与前述内容类似，此处不再赘述。
可以理解的是，自编码器的编码器部分可以用目标神经网络中的卷积层来实现，因此当对抗样本对目标神经网络攻击时，自编码器得到的重构样本误差增大，更加容易被检测出来。
本申请实施例不直接使用独立的自编码器做对抗样本检测，而是将目标神经网络的卷积层作为自编码器的编码器，使自编码器与目标神经网络紧密相关，将检测系统与目标神经网络紧密结合，提高了检测的灵敏度：由于目标神经网络的卷积网络同时又是自编码器的编码器，因此对抗样本对目标神经网络特征提取的干扰同时也是对编码器特征提取的干扰，对目标神经网络的白盒攻击被转化为对自编码器的白盒攻击。所以自编码器无法重构对抗样本，反而由于重构错误，会将人眼无法察觉的扰动明显地展现出来。
703、根据输入样本和重构样本，通过对抗样本检测器得到输入样本的检测结果；
在本申请实施例中，根据输入样本和重构样本，通过对抗样本检测器可以分析出输入样本和重构样本的数据特征所对应的类别。示例性的，若输入样本和重构样本的数据特征与训练集中对抗样本及其重构样本(对应训练标签为“1”)类似，则通过对抗样本检测器可以分析得到检测结果为标签“1”。若输入样本和重构样本的数据特征与训练集中非对抗样本及其重构样本(对应训练标签为“0”)类似，则通过对抗样本检测器可以分析得到检测结果为标签“0”。其中，训练集为训练对抗样本检测器所用的非对抗样本集合，具体可参阅图8对应的实施例描述，此处不再赘述。
在本申请实施例中，执行设备可以执行对抗样本检测器对应的指令代码，从而根据输入样本和重构样本得到输入样本的检测结果。检测结果可以是“正常”或“对抗样本”，具体可以用标识“0”和标识“1”表示，在实际应用中，执行设备也可以用其他标识来表示检测结果，本申请实施例对此不做限定。
本申请实施例不使用二分类器直接检测对抗样本，也不是使用固定阈值判别对抗样本，而是使用对抗样本检测器(例如二分类器)通过学习对抗样本与非对抗样本各自的重构误差来判别是否为对抗样本，由于重构误差会放大对抗样本扰动，所以检测灵敏度更高；且由于任何种类的对抗攻击都会放大重构误差，因此以重构误差为依据判别对抗样本的泛用性高。
704、根据检测结果确定输入样本的样本类型。
在本申请实施例中，检测结果可以是“正常”(用标签“0”表示)或“对抗样本”(用标签“1”表示)。根据步骤703的检测结果，若检测结果为标签“1”，说明输入样本和重构样本的数据特征与训练集中对抗样本及其重构样本(对应标签为“1”)类似，则执行设备确定输入样本的类型为对抗样本。若检测结果为标签“0”，说明输入样本和重构样本的数据特征与训练集中非对抗样本及其重构样本(对应标签为“0”)类似，则执行设备确定输入样本的类型为非对抗样本。
其中，“正常”表示该输入样本为非对抗样本，目标神经网络没有受到对抗样本的攻击。因此执行设备可以按照正常状态执行目标神经网络对应的指令代码，根据该输入样本得到对应的识别结果。“对抗样本”表示该输入样本为对抗样本，目标神经网络受到了对抗样本攻击，那么该输入样本对应的识别结果是受到攻击后的识别结果，执行设备可以不通过目标神经网络对该输入样本进行处理，或者是通过目标神经网络处理该输入样本后得到的识别结果无效。
另一方面，执行设备确定输入样本的样本类型之后，还可以将这些输入样本及其对应类型发送至其他设备，以供其他设备使用。
本申请实施例可以应用于车载摄像头图像分类，执行设备获取到车载摄像头拍摄的图片数据后，可以以车载摄像头拍摄的图片数据作为输入样本执行上述步骤701至步骤704，通过目标神经网络对图片数据进行分类，识别出该图片的类型等，并且通过自编码器和对抗样本检测器检测出该输入样本是否为对抗样本，从而确定识别出该图片的类型是否有效。在其他应用场景，例如手机的图像识别等，具体过程类似，此处不再赘述。
以下对本申请实施例的训练过程进行详细的描述。本申请实施例的训练过程可以由训练设备。图8为本申请实施例的训练过程的流程图。该流程包括：
801、获取训练集；
在本申请实施例中，训练集为非对抗样本组成的集合。非对抗样本的格式类型与前述输入样本类似，此处不再赘述。非对抗样本的标签根据目标神经网络的任务类型进行具体设置，示例性的，目标神经网络的任务类型为图像识别，非对抗样本为图像，则工作人员可以通过训练设备为非对抗样本打上诸如“小猫”、“小狗”等与非对抗样本对应的标签，用于对目标神经网络的训练。
802、通过训练集同时对目标神经网络和自编码器训练；
在本申请实施例中，训练设备可以通过训练集同时对目标神经网络和自编码器训练，其中，训练设备对目标神经网络的训练与前述卷积神经网络类似，或者与传统的神经网络训练类似，此处不再赘述。而由于目标神经网络中的卷积层同时也是自编码器的编码器部 分，因此训练设备对目标神经网络训练的同时可以根据目标神经网络卷积层的训练参数同时训练自编码器的解码器部分，实现目标神经网络和自编码器的同时训练。
训练设备同时对目标神经网络和自编码器训练的目标是自编码器重构误差较小且目标神经网络对非对抗样本的识别误差较小，因此损失函数可以设置为自编码器重构误差与目标神经网络误差之和。对此，本申请实施例提供的损失函数公式为：
Figure PCTCN2020129298-appb-000009
其中，X train为训练集，|X train|为训练集的数据数量(即训练集中的非对抗样本x的数量)，x为训练集中的非对抗样本，ae(x)为根据训练集中的非对抗样本通过自编码器得到的训练用重构样本，
Figure PCTCN2020129298-appb-000010
为相对熵(relative entropy)。
803、根据训练集，通过对抗样本生成算法生成针对目标神经网络的训练用的对抗样本；
图9为本申请实施例中生成训练用对抗样本的示意图。训练设备可以根据训练集中的非对抗样本，通过对抗样本生成算法对目标神经网络进行攻击，生成针对目标神经网络的训练用的对抗样本。在本申请实施例中，对抗样本生成算法可以采用上述的FGSM算法、JSMA算法等，本申请实施例对此不做限定。
在本申请实施例中，非对抗样本为适用于目标神经网络进行识别的样本，而对抗样本则会对目标神经网络进行攻击使其输出错误结果。因此，非对抗样本和对抗样本通常采用标签进行区分，以供后续训练。示例性的，非对抗样本的标签为“0”，用于表示该样本为非对抗样本，对抗样本的标签为“1”，用于表示该样本为对抗样本。
804、根据训练集和训练用的对抗样本，分别通过训练后的自编码器得到非对抗重构样本和对抗重构样本；
图10为本申请实施例中生成非对抗重构样本和对抗重构样本的示意图。训练设备可以根据训练集中的非对抗样本，通过训练后的自编码器得到非对抗重构样本。同理，训练设备可以根据训练用的对抗样本，通过训练后的自编码器得到对抗重构样本。
训练设备可以先生成非对抗重构样本，在生成对抗重构样本，也可以先生成对抗重构样本，再生成非对抗重构样本，或者两者同时生成，本申请实施例对此不做限定。
805、通过第一训练样本和第二训练样本对对抗样本检测器训练。
在本申请实施例中，第一训练样本包括非对抗样本以及步骤804中得到的非对抗重构样本，第二训练样本包括训练用的对抗样本以及步骤804中得到的对抗重构样本。其中，第一训练样本对应的标签为“非对抗”或“正常”，第二训练样本对应的标签为“对抗”或“不正常”。具体地，“非对抗”可以用标签“0”表示，“对抗”可以用标签“1”表示。
图11为本申请实施例训练对抗样本检测器的示意图。训练设备通过第一训练样本和第二训练样本训练对抗样本检测器，能够使得对抗样本检测器具备侦测重构误差的能力。执行设备通过训练完的对抗样本检测器对类似第二训练样本的数据进行检测时，能够识别出该数据为对抗样本。
在一些实施例中，训练设备还会对训练完的对抗样本检测器进行测试，从而得到各类 测试数据。具体地，训练设备可以获取测试集，所述测试集为测试样本(即测试用的非对抗样本)组成的集合；根据所述测试集，通过对抗样本生成算法生成针对所述目标神经网络的测试用的对抗样本；根据所述测试集和所述测试用的对抗样本，通过训练完的所述自编码器和所述对抗样本检测器得到测试结果；根据所述测试集和所述测试用的对抗样本确定所述测试结果的检测正确率(测试集上整体的分类正确率)、对抗样本检出率(对抗样本中被成功检出的样本在对抗样本中的占比)和假阳性率(不是对抗样本却被判断为对抗样本的样本在非对抗样本中的占比)。在实际应用中，也可以采用其他设备进行测试，本申请实施例对此不作限定。
可以理解的是，上述执行过程和训练过程分别由执行设备和训练设备进行，在实际应用中，执行设备和训练设备可以为同一个设备，本申请实施例对执行过程和训练过程的执行主体不做限定。
上述为本申请实施例提供的一种技术方案的详细描述，以下将对本申请实施例提供的另一个技术方案进行详细的描述。图12为本申请实施例提供的另一种技术方案的示意图。该方案中，执行设备通过自编码器对输入样本进行处理得到重构样本后，可以通过自编码器对重构样本再次进行处理，实现一次循环重构。若输入样本是对抗样本，则该对抗样本的噪音会被放大，从而更加容易被检测出来，提高对抗样本检出率。图12所示技术方案的其他模块(如目标神经网络、反馈重构网络和对抗样本检测器等)与前述图3对应的各个实施例类似，此处不再赘述。图12所示技术方案的系统架构与前述图6类似，此处不再赘述。图13为本申请实施例执行设备的另一种流程图。具体地，该系统架构中的执行设备可以执行以下流程：
1301、获取输入样本；
步骤1301与前述图7对应的各个实施例中步骤701类似，此处不再赘述。
1302、根据输入样本，通过自编码器得到重构样本；
步骤1302与前述图7对应的各个实施例中步骤702类似，此处不再赘述。
1303、通过自编码器对重构样本进行至少一次循环重构；
在本申请实施例中，执行设备通过自编码器对输入样本进行处理得到重构样本后，可以通过自编码器对重构样本再次进行处理，得到第二次重构样本。执行设备还可以通过自编码器对第二次重构样本再次进行处理，得到第三次重构样本……以此类推，执行设备可以对重构样本进行多次循环重构。本申请实施例对循环重构的次数不做限定。循环重构的次数增加可能造成算力耗能成本上升与时间延迟，设计人员可以根据实际情况对循环重构的次数进行调整，以求取得对抗样本检出率与耗能延迟的平衡。
1304、根据输入样本和重构样本，通过对抗样本检测器得到输入样本的检测结果；
步骤1304与前述图7对应的各个实施例中步骤703类似，此处不再赘述。
1305、根据检测结果确定输入样本的样本类型。
步骤1305与前述图7对应的各个实施例中步骤704类似，此处不再赘述。
图12所示技术方案的训练过程与前述图8对应的各个实施例类似，此处不再赘述。
图14为本申请实施例提供的一种对抗样本的识别装置的示意图。该防御对抗样本的装 置1400包括：
获取模块1401，用于执行上述图7对应的各个实施例中的步骤701，或执行上述图8对应的各个实施例中的步骤801，或执行上述图13对应的各个实施例中的步骤1301；
处理模块1402，用于执行上述图7对应的各个实施例中的步骤702、步骤703、步骤704，或执行上述图8对应的各个实施例中的步骤802、步骤803、步骤804、步骤805，或执行上述图13对应的各个实施例中的步骤1302、步骤1303、步骤1304、步骤1305。
图15为本申请实施例提供的一种执行设备结构示意图，该执行设备1500可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器(central processing units，CPU)1501(例如，一个或一个以上处理器)和存储器1502，一个或一个以上存储应用程序1533或数据1532的存储介质1503(例如一个或一个以上海量存储设备)。其中，存储器1502和存储介质1503可以是短暂存储或持久存储。存储在存储介质1503的程序可以包括一个或一个以上模块(图示没标出)，每个模块可以包括对执行设备中的一系列指令操作。更进一步地，中央处理器1501可以设置为与存储介质1503通信，在执行设备1500上执行存储介质1503中的一系列指令操作。
执行设备1500还可以包括一个或一个以上电源1504，一个或一个以上有线或无线网络接口1505，一个或一个以上输入输出接口1506，和/或，一个或一个以上操作系统1531，例如Windows Server TM，Mac OS X TM，Unix TM,Linux TM，FreeBSD TM等等。
上述实施例中由执行设备所执行的步骤可以基于该图15所示的执行设备结构。具体地，CPU1501可以执行上述图7对应的实施例中的所有步骤，或执行上述图8对应的实施例中的所有步骤，或执行上述图13对应的实施例中的所有步骤。在一些实施例中，CPU1501中的模块可以包括如上述图14对应的实施例中的获取模块1401、处理模块1402，本申请实施例对此不再赘述。训练设备的结构与图15对应的执行设备结构类似，此处不再赘述。在一些实施例中，训练设备执行的步骤可由执行设备预先执行，本申请实施例对此不做限定。

Claims (11)

  1. 一种对抗样本的识别方法，其特征在于，包括：
    获取输入样本；
    根据所述输入样本，通过自编码器得到重构样本，所述自编码器以目标神经网络的卷积层为编码器，以反馈重构网络为解码器；
    根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果，所述对抗样本检测器是通过第一训练样本和第二训练样本训练获得，所述第一样本包括非对抗样本及其重构样本，以及第一样本标签；所述第二样本包括对抗样本及其重构样本，以及第二样本标签；
    根据检测结果确定所述输入样本的样本类型。
  2. 根据权利要求1所述的方法，其特征在于，所述根据所述输入样本，通过自编码器得到重构样本之后，所述根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果之前，所述方法还包括：
    通过所述自编码器对所述重构样本进行至少一次循环重构，所述循环重构为通过所述自编码器对所述重构样本进行处理。
  3. 根据权利要求1所述的方法，其特征在于，所述对抗样本检测器为二分类器。
  4. 根据权利要求1所述的方法，其特征在于，所述通过自编码器得到重构样本之前，所述方法还包括：
    获取训练集，所述训练集为非对抗样本组成的集合；
    通过所述训练集同时对所述目标神经网络以及所述自编码器训练，所述目标神经网络包含所述卷积层与目标分类器。
  5. 根据权利要求4所述的方法，其特征在于，通过所述训练集同时对所述目标神经网络以及所述自编码器训练中，训练过程的损失函数为：
    Figure PCTCN2020129298-appb-100001
    其中，X train为训练集，|X train|为训练集的数据数量，x为训练集中的非对抗样本，ae(x)为根据训练集中的非对抗样本通过所述自编码器得到的训练用重构样本，
    Figure PCTCN2020129298-appb-100002
    为相对熵。
  6. 根据权利要求4所述的方法，其特征在于，所述通过所述训练集同时对所述目标神经网络以及所述自编码器训练之后，所述方法还包括：
    根据所述训练集，通过对抗样本生成算法生成针对所述目标神经网络的训练用的对抗样本；
    根据所述训练集通过训练后的所述自编码器得到非对抗重构样本；
    根据所述训练用的对抗样本，通过训练后的所述自编码器得到对抗重构样本；
    通过第一训练样本和第二训练样本对所述对抗样本检测器训练，所述第一训练样本由所述训练集中非对抗样本及所述非对抗重构样本组成，所述第二训练样本由所述训练用的对抗样本及所述对抗重构样本组成。
  7. 根据权利要求6所述的方法，其特征在于，所述通过第一训练样本和第二训练样本对所述对抗样本检测器训练之后，所述方法还包括：
    获取测试集，所述测试集为测试样本组成的集合；
    根据所述测试集，通过对抗样本生成算法生成针对所述目标神经网络的测试用的对抗样本；
    根据所述测试集和所述测试用的对抗样本，通过训练完的所述自编码器和所述对抗样本检测器得到测试结果；
    根据所述测试集和所述测试用的对抗样本确定所述测试结果的检测正确率、对抗样本检出率和假阳性率。
  8. 一种对抗样本的识别装置，其特征在于，包括：
    获取模块，用于获取输入样本；
    处理模块，用于根据所述输入样本，通过自编码器得到重构样本，所述自编码器以卷积神经网络的卷积层为编码器，以反馈重构网络为解码器；
    所述处理模块，还用于根据所述输入样本和所述重构样本，通过对抗样本检测器得到所述输入样本的检测结果，所述对抗样本检测器是通过第一训练样本和第二训练样本训练获得，所述第一样本包括非对抗样本及其重构样本，以及第一样本标签；所述第二样本包括对抗样本及其重构样本，以及第二样本标签；
    所述处理模块，还用于根据检测结果确定所述输入样本的样本类型。
  9. 一种对抗样本的识别设备，其特征在于，包括：处理器和传输接口，所述处理器被配置为调用存储在存储器中的程序指令，以执行权利要求1至7任意一项所述的方法。
  10. 一种计算机可读存储介质，包括指令，当所述指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如权利要求1至7中任意一项所述的方法。
  11. 一种包含指令的计算机程序产品，所述计算机程序产品包括程序指令，当所述程序指令在计算机或处理器上运行时，使得所述计算机或所述处理器执行如权利要求1至7中任意一项所述的方法。
PCT/CN2020/129298 2020-11-17 2020-11-17 一种对抗样本的识别方法及相关装置 WO2022104503A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2020/129298 WO2022104503A1 (zh) 2020-11-17 2020-11-17 一种对抗样本的识别方法及相关装置
CN202080004866.3A CN112673381B (zh) 2020-11-17 2020-11-17 一种对抗样本的识别方法及相关装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/129298 WO2022104503A1 (zh) 2020-11-17 2020-11-17 一种对抗样本的识别方法及相关装置

Publications (1)

Publication Number Publication Date
WO2022104503A1 true WO2022104503A1 (zh) 2022-05-27

Family

ID=75413918

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/129298 WO2022104503A1 (zh) 2020-11-17 2020-11-17 一种对抗样本的识别方法及相关装置

Country Status (2)

Country Link
CN (1) CN112673381B (zh)
WO (1) WO2022104503A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114912550A (zh) * 2022-07-14 2022-08-16 南京理工大学 基于频域变换的对抗样本检测和识别方法
CN116524339A (zh) * 2023-07-05 2023-08-01 宁德时代新能源科技股份有限公司 目标检测方法、装置、计算机设备、存储介质和程序产品

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113194098A (zh) * 2021-04-30 2021-07-30 吉林大学 一种基于深度学习的配水系统网络物理攻击检测方法
CN113361583A (zh) * 2021-06-01 2021-09-07 珠海大横琴科技发展有限公司 一种对抗样本检测方法和装置
CN113361594B (zh) * 2021-06-03 2023-10-20 安徽理工大学 一种基于生成模型的对抗样本生成方法
CN113609507A (zh) * 2021-08-19 2021-11-05 上海明略人工智能(集团)有限公司 一种数据伦理方法、系统、电子设备及介质
CN113496222B (zh) * 2021-09-09 2021-12-07 南方电网数字电网研究院有限公司 基于无标签图表数据的模式识别方法、装置和计算机设备
CN114841983B (zh) * 2022-05-17 2022-12-06 中国信息通信研究院 一种基于决策分数的图像对抗样本检测方法和系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190213503A1 (en) * 2018-01-08 2019-07-11 International Business Machines Corporation Identifying a deployed machine learning model
CN110941794A (zh) * 2019-11-27 2020-03-31 浙江工业大学 一种基于通用逆扰动防御矩阵的对抗攻击防御方法
CN111626367A (zh) * 2020-05-28 2020-09-04 深圳前海微众银行股份有限公司 对抗样本检测方法、装置、设备及计算机可读存储介质
CN111652290A (zh) * 2020-05-15 2020-09-11 深圳前海微众银行股份有限公司 一种对抗样本的检测方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109711254B (zh) * 2018-11-23 2020-12-15 北京交通大学 基于对抗生成网络的图像处理方法和装置
US11481617B2 (en) * 2019-01-22 2022-10-25 Adobe Inc. Generating trained neural networks with increased robustness against adversarial attacks
CN110321790B (zh) * 2019-05-21 2023-05-12 华为技术有限公司 一种对抗样本的检测方法及电子设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190213503A1 (en) * 2018-01-08 2019-07-11 International Business Machines Corporation Identifying a deployed machine learning model
CN110941794A (zh) * 2019-11-27 2020-03-31 浙江工业大学 一种基于通用逆扰动防御矩阵的对抗攻击防御方法
CN111652290A (zh) * 2020-05-15 2020-09-11 深圳前海微众银行股份有限公司 一种对抗样本的检测方法及装置
CN111626367A (zh) * 2020-05-28 2020-09-04 深圳前海微众银行股份有限公司 对抗样本检测方法、装置、设备及计算机可读存储介质

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114912550A (zh) * 2022-07-14 2022-08-16 南京理工大学 基于频域变换的对抗样本检测和识别方法
CN116524339A (zh) * 2023-07-05 2023-08-01 宁德时代新能源科技股份有限公司 目标检测方法、装置、计算机设备、存储介质和程序产品
CN116524339B (zh) * 2023-07-05 2023-10-13 宁德时代新能源科技股份有限公司 目标检测方法、装置、计算机设备、存储介质和程序产品

Also Published As

Publication number Publication date
CN112673381B (zh) 2022-04-12
CN112673381A (zh) 2021-04-16

Similar Documents

Publication Publication Date Title
WO2022104503A1 (zh) 一种对抗样本的识别方法及相关装置
CN111709409B (zh) 人脸活体检测方法、装置、设备及介质
US20210192357A1 (en) Gradient adversarial training of neural networks
Hartawan et al. Disaster victims detection system using convolutional neural network (CNN) method
Chen et al. Research on recognition of fly species based on improved RetinaNet and CBAM
Liu et al. Patch attention convolutional vision transformer for facial expression recognition with occlusion
US11449717B2 (en) System and method for identification and localization of images using triplet loss and predicted regions
WO2022218396A1 (zh) 图像处理方法、装置和计算机可读存储介质
Yang et al. Anomaly detection in moving crowds through spatiotemporal autoencoding and additional attention
WO2024060684A1 (zh) 模型训练方法、图像处理方法、设备及存储介质
CN116311214B (zh) 车牌识别方法和装置
CN112364754A (zh) 螺栓缺陷检测方法及系统
Patel American sign language detection
CN115761409A (zh) 一种基于深度学习的火情检测方法、装置、设备和介质
CN113449548A (zh) 更新物体识别模型的方法和装置
Yandouzi et al. Investigation of combining deep learning object recognition with drones for forest fire detection and monitoring
Youssry et al. Accurate real-time face mask detection framework using YOLOv5
CN116957051A (zh) 一种优化特征提取的遥感图像弱监督目标检测方法
CN116797814A (zh) 智慧工地安全管理系统
Wu et al. Research on asphalt pavement disease detection based on improved YOLOv5s
Pang et al. PTRSegNet: A Patch-to-Region Bottom-Up Pyramid Framework for the Semantic Segmentation of Large-Format Remote Sensing Images
US20220245829A1 (en) Movement status learning apparatus, movement status recognition apparatus, model learning method, movement status recognition method and program
CN114330634A (zh) 一种神经网络的处理方法及相关设备
Zhang et al. Research on Mask Wearing Detection Algorithm in Complex Scenes
WO2022217551A1 (zh) 目标检测方法和装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20961795

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20961795

Country of ref document: EP

Kind code of ref document: A1