CN116523000A - A neural network anti-sample defense method, electronic equipment and storage medium - Google Patents

Abstract

The application provides a neural network challenge sample defense method, an electronic device and a storage medium, wherein the method comprises the following steps: acquiring a countermeasure data set; dividing each image in the countermeasure data set according to a color channel to obtain a divided image set; processing the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set; carrying out noise reduction treatment on the target high-frequency image set according to a preset noise reduction method to obtain a target noise reduction high-frequency image set; inputting the target low-frequency image set and the target noise reduction high-frequency image set into a preset target generator for fusion, and generating a defense countermeasure sample set. The defensive countermeasure sample generated by the method can be correctly classified only by removing noise in the high-frequency image, namely removing countermeasure disturbance distributed in the high-frequency component image, so that the countermeasure sample is closer to the original image.

Description

A neural network anti-sample defense method, electronic equipment and storage medium

technical field

The present application relates to the technical field of deep learning, and in particular to a neural network defense method against examples, electronic equipment and storage media.

Background technique

In recent years, deep learning has become one of the most active fields of computer research. Studies have found that deep neural networks are easily disturbed by small input disturbances, which are undetectable to humans but can cause machine errors. This error-causing data is called an adversarial example. Adversarial examples add subtle perturbations to the data, which will cause the model to give wrong outputs with a high degree of confidence, which is also a blind spot in the research of machine learning algorithms. The existence of adversarial samples draws people's attention to the vulnerability of neural networks. For example, in the fields of automatic driving and face recognition, misclassification caused by adversarial samples can lead to extremely bad consequences, such as causing traffic accidents or illegal personnel passing through access control, etc. Therefore, the existing adversarial samples are not defensive, leading to bad consequences.

Contents of the invention

In view of this, the purpose of this application is to propose a neural network adversarial example defense method, electronic equipment and storage media to solve the problem that the existing adversarial examples are not defensive and lead to bad consequences.

Based on the above purpose, the first aspect of the present application provides a neural network adversarial sample defense method, including:

Get the confrontation data set;

Segmenting each image in the confrontation data set according to the color channel to obtain a segmented image set;

Process the segmented image set according to the preset mask to obtain the target low-frequency image set and the target high-frequency image set;

performing noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set;

The target low-frequency image set and the target noise-reduced high-frequency image set are input to a preset target generator for fusion to generate a defensive confrontation sample set.

Further, the color channels include a first color channel, a second color channel, and a third color channel, the first color channel is a red channel, the second color channel is a green channel, and the third color channel is blue channel;

The step of segmenting each image in the confrontation data set according to the color channel to obtain a segmented image set includes:

Segmenting each image in the confrontation data set according to the first color channel to obtain a first segmented image set;

Segmenting each image in the confrontation data set according to a second color channel to obtain a second segmented image set;

Segmenting each image in the confrontation data set according to a third color channel to obtain a third segmented image set;

The first set of segmented images, the second set of segmented images and the third set of segmented images are combined into a set and used as a set of segmented images.

Further, the preset mask includes a first preset mask, and the first preset mask is a low-frequency image mask;

The processing of the segmented image set according to the preset mask to obtain the target low-frequency image set includes:

superimposing the first preset mask with the first segmented image in the first segmented image set to obtain a first low-frequency image set;

superimposing the first preset mask with the second segmented image in the second segmented image set to obtain a second low-frequency image set;

superimposing the first preset mask with the third segmented image in the third segmented image set to obtain a third low-frequency image set;

Merging the first low-frequency image set, the second low-frequency image set, and the third low-frequency image set to obtain a target low-frequency image set.

Further, the preset mask includes a second preset mask, and the second preset mask is a high-frequency image mask;

The processing of the segmented image set according to the preset mask to obtain the target high-frequency image set includes:

superimposing the second preset mask with the first segmented image in the first segmented image set to obtain a first high-frequency image set;

superimposing the second preset mask with the second segmented image in the second segmented image set to obtain a second high-frequency image set;

superimposing the second preset mask with the third segmented image in the third segmented image set to obtain a third high-frequency image set;

Merge the first high-frequency image set, the second high-frequency image set, and the third high-frequency image set to obtain a target high-frequency image set.

Further, the input of the target low-frequency image set and the target noise-reduced high-frequency image set to a preset target generator for fusion to generate a defensive confrontation sample set includes:

The low-frequency images in the target low-frequency image set and the noise-reduced high-frequency images corresponding to the low-frequency images are input to a preset target generator for fusion to generate the defensive confrontation sample set.

Further, the training process of the preset target generator includes:

Iteratively training a generator and a discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set;

In response to determining that the loss of the iterated discriminator reaches a preset threshold, the iterated generator is used as a target generator.

Further, the training process of the preset target generator includes:

Iteratively training a generator and a discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set;

In response to the number of iterations reaching the threshold of the number of iterations, the iterative training is stopped, and the generator trained in this round of iterations is output as the target generator.

Further, iteratively training the generator and the discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set, including:

For each round of iterative training, perform the following operations:

Stitching the low-frequency image with the corresponding noise-reduced high-frequency image, and inputting it to the generator to obtain a fused image;

Inputting the fused image and the original sample corresponding to the image to the discriminator to obtain the loss of the discriminator;

According to the loss of the discriminator, update the discriminator to obtain the discriminator in the next iteration;

The generator is updated according to the discriminator in the next iteration to obtain the generator in the next iteration.

Based on the above purpose, two aspects of the present application provide an electronic device, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the program, any one of the above-mentioned method described in the item.

Based on the above purpose, the third aspect of the present application provides a non-transitory computer-readable storage medium, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to make the computer perform any of the above-mentioned the method described.

From the above, it can be seen that a neural network adversarial example defense method provided by this application first obtains an adversarial data set, and then divides each image in the adversarial data set to obtain a segmented image set; according to the preset mask Process the segmented image set to obtain a target low-frequency image set and a target high-frequency image set; perform noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set; The target low-frequency image set and the target noise-reduced high-frequency image set are input to a preset target generator for fusion to generate a defensive confrontation sample set. The defensive adversarial samples generated by this method remove the noise in the high-frequency image, that is, remove the adversarial disturbance distributed in the high-frequency component image, so that the adversarial samples are closer to the original image, and the adversarial samples can be correctly classified.

Description of drawings

In order to more clearly illustrate the technical solutions in the present application or related technologies, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or related technologies. Obviously, the accompanying drawings in the following description are only for this application Embodiments, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic flow diagram of a neural network adversarial example defense method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of a structural framework of a neural network adversarial example defense device according to an embodiment of the present application;

FIG. 3 is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present application.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application shall have the usual meanings understood by those skilled in the art to which the present application belongs. "First", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Comprising" or "comprising" and similar words mean that the elements or items appearing before the word include the elements or items listed after the word and their equivalents, without excluding other elements or items. Words such as "connected" or "connected" are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "Down", "Left", "Right" and so on are only used to indicate the relative positional relationship. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

Embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

Referring to Figure 1, a neural network adversarial sample defense method, including:

Step S100, acquiring a confrontation data set.

In this step, the adversarial data set is the adversarial data generated from the original data set using an attack method, and the attack method adopts any one of FGSM, PGD, CW, DeepFool, and a custom attack method.

The original data set is a public data set, and the public data set adopts CIFAR-10, MNIST, a custom data set, etc., for example.

Step S200: Segment each image in the confrontation dataset according to the color channel to obtain a segmented image set.

In this step, the color channel refers to the RGB color channel, and the image in the confrontation dataset is segmented according to the RGB color channel to obtain an image set corresponding to the RGB color channel, that is, the segmented image set.

Step S300 , process the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set.

In this step, the preset mask is a pre-constructed mask with the same size as the image in the segmented image set (ie, an image mask). The preset mask includes a low-frequency image mask and a high-frequency image mask, and the low-frequency image The mask is superimposed on the low-frequency image in the segmented image set, and only the low-frequency component of the image is retained to obtain the target low-frequency image set; the high-frequency image mask is superimposed on the high-frequency image in the segmented image set, and only the high-frequency component of the image is retained. Get the target high-frequency image set.

Step S400: Perform noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set.

In this step, the preset noise reduction method is: use the noise reduction formula to calculate each pixel in the image to obtain the target noise reduction pixel, and generate the target noise reduction high-frequency image according to the target noise reduction pixel. All images in the target high-frequency image set are subjected to noise reduction processing to obtain the target noise-reduced high-frequency image set.

Among them, the noise reduction formula is:

Among them, x represents the currently processed pixel; v′(x) represents the pixel value of x after noise reduction; Ω _x represents the set of pixels in the neighborhood of x, and the range of the neighborhood needs to be selected according to the actual situation; y represents Ω pixel in _x ; v(y) represents the pixel value of y before noise reduction; w(x, y) represents the weight, calculated by the similarity between x and y; n represents the sum of all weights;

Further, the calculation formula of w(x,y) is as follows:

Among them, w'(x, y) represents the temporary weight; k represents the preset similarity threshold, and the value of k needs to be selected according to the actual situation; v(x) represents the pixel value of x before noise reduction; v(y) represents the reduced The pixel value of y before noise.

Step S500, input the target low-frequency image set and the target noise-reduced high-frequency image set to a preset target generator for fusion to generate a defense and confrontation sample set.

In this step, the low-frequency images in the low-frequency image set correspond to the noise-reduced high-frequency images in the target noise-reduced high-frequency image set. The preset target generator is obtained by iterative training of low-frequency images and corresponding denoised high-frequency images. The low-frequency image and the corresponding noise-reduced high-frequency image are input into the preset target generator for fusion to generate a defensive confrontation sample set.

Specifically, the defensive adversarial samples generated through steps S100-S500 remove the noise in the high-frequency image, that is, remove the adversarial disturbance distributed in the high-frequency component image, so that the adversarial sample is closer to the original image, and the adversarial sample can be corrected. Classification.

In some embodiments, in step S200, the color channels include a first color channel, a second color channel, and a third color channel, the first color channel is a red channel (that is, the R color channel), and the second color channel The second color channel is a green channel (i.e. the G color channel), and the third color channel is a blue channel (i.e. the B color channel);

The step of segmenting each image in the confrontation data set according to the color channel to obtain a segmented image set includes:

Segmenting each image in the confrontation data set according to the first color channel to obtain a first segmented image set;

Segmenting each image in the confrontation data set according to a second color channel to obtain a second segmented image set;

Segmenting each image in the confrontation data set according to a third color channel to obtain a third segmented image set;

The first set of segmented images, the second set of segmented images and the third set of segmented images are combined into a set and used as a set of segmented images.

Specifically, when extracting low-frequency images and high-frequency images in an image, it is necessary to convert the image into a spectrogram through Fourier transform, and process the spectrogram with a mask to obtain low-frequency images and high-frequency images respectively. Since the Fourier transform can only process a single color channel, each image in the confrontation dataset is divided into images of three color channels, that is, each image is divided into three images, and all the divided images are composed collection, and as a set of segmented images.

In some embodiments, in step S300, the preset mask includes a first preset mask, and the first preset mask is a low-frequency image mask;

The processing of the segmented image set according to the preset mask to obtain the target low-frequency image set includes:

superimposing the first preset mask with the first segmented image in the first segmented image set to obtain a first low-frequency image set;

superimposing the first preset mask with the second segmented image in the second segmented image set to obtain a second low-frequency image set;

superimposing the first preset mask with the third segmented image in the third segmented image set to obtain a third low-frequency image set;

Merging the first low-frequency image set, the second low-frequency image set, and the third low-frequency image set to obtain a target low-frequency image set.

Specifically, the low-frequency image mask is pre-constructed, and the size of the low-frequency image mask is consistent with the image size in the segmented image set. All the pixel values of the low-frequency image mask are set to 0, and a A square sub-area (this sub-area is a preset low-frequency area of the image), and all pixel values in the square sub-area are set to 1.

The images in the segmented image set are converted into spectrograms by Fourier transform.

Superimpose the first segmented image with the low-frequency image mask (i.e. multiply the pixels of the low-frequency image mask by the pixels of the first segmented image (spectrogram) to obtain only the low-frequency spectrogram), the first segmented image is located in the square The pixels in the area remain unchanged, while the pixel values in the outer area of the square sub-area all become 0, that is, the high-frequency components of the first segmented image are removed, and only the low-frequency components are retained, and the inverse Fourier transform is performed to obtain the first low-frequency image.

Superimpose the second segmented image with the low-frequency image mask (that is, multiply the pixels of the low-frequency image mask by the pixels of the second segmented image to obtain a spectrogram that only retains low frequencies), and the second segmented image is located at the pixels of the square sub-region remains unchanged, while the pixel values in the outer area of the square sub-area all become 0, that is, the high-frequency component of the second segmented image is removed, and only the low-frequency component is retained, and the inverse Fourier transform is performed to obtain the second low-frequency image.

Superimpose the third segmented image with the low-frequency image mask (i.e. multiply the pixels of the low-frequency image mask by the pixels of the third segmented image to obtain a spectrogram that only retains the low frequency), and the third segmented image is located at the pixel of the square sub-region remains unchanged, and the pixel values in the outer area of the square sub-area all become 0, that is, the high-frequency component of the third segmented image is removed, and only the low-frequency component is retained, and the inverse Fourier transform is performed to obtain the third low-frequency image.

The above-mentioned first low-frequency image (that is, the low-frequency image of the R color channel), the second low-frequency image (that is, the low-frequency image of the G color channel), and the third low-frequency image (that is, the low-frequency image of the B color channel) correspond to one image Low-frequency images of the three color channels of . The first low-frequency image, the second low-frequency image, and the third low-frequency image are combined to obtain a low-frequency image of a complete color channel, which is the target low-frequency image. All images in the segmented image set are sequentially processed in the above manner, and all target low-frequency images are combined to obtain a target low-frequency image set.

In some embodiments, in step S300, the preset mask includes a second preset mask, and the second preset mask is a high-frequency image mask;

The processing of the segmented image set according to the preset mask to obtain the target high-frequency image set includes:

superimposing the second preset mask with the first segmented image in the first segmented image set to obtain a first high-frequency image set;

superimposing the second preset mask with the second segmented image in the second segmented image set to obtain a second high-frequency image set;

superimposing the second preset mask with the third segmented image in the third segmented image set to obtain a third high-frequency image set;

Merge the first high-frequency image set, the second high-frequency image set, and the third high-frequency image set to obtain a target high-frequency image set.

Specifically, the high-frequency image mask is pre-constructed, and the size of the high-frequency image mask is consistent with the size of the image in the segmented image set. All the pixel values of the high-frequency image mask are set to 1. In the high-frequency image mask A square sub-area is set in the central area (this sub-area is the preset low-frequency area of the image), and the pixel values in the square sub-area are all set to 0.

Superimpose the first segmented image with the high-frequency image mask (that is, multiply the pixels of the high-frequency image mask by the pixels of the first segmented image to obtain a spectrogram that only retains high frequencies), and the first segmented image is located in a square sub-region The pixels of all become 0, and the pixel values of the outer area of the square sub-area remain unchanged, that is, the low-frequency component of the first segmented image is removed, and only the high-frequency component is retained, and the Fourier inverse transform is performed to obtain the first high-frequency component image.

Superimpose the second segmented image with the high-frequency image mask (that is, multiply the pixels of the high-frequency image mask by the pixels of the second segmented image to obtain a spectrogram that only retains high frequencies), and the second segmented image is located in a square sub-region The pixels of all become 0, while the pixel values of the outer area of the square sub-area remain unchanged, that is, the low-frequency components of the first segmented image are removed, and only the high-frequency components are retained, and the inverse Fourier transform is performed to obtain the second high-frequency image.

Superimpose the third segmented image with the high-frequency image mask (that is, multiply the pixels of the high-frequency image mask by the pixels of the third segmented image to obtain a spectrogram that only retains high frequencies), and the third segmented image is located in a square sub-region The pixels of all become 0, and the pixel values of the outer area of the square sub-area remain unchanged, that is, the low-frequency components of the first segmented image are removed, and only the high-frequency components are retained, and the inverse Fourier transform is performed to obtain the third high-frequency image.

The first high-frequency image (that is, the high-frequency image of the R color channel), the second high-frequency image (that is, the high-frequency image of the G color channel), and the third high-frequency image (that is, the high-frequency image of the B color channel) correspond to , is the high-frequency image of the three color channels of an image. The first high-frequency image, the second high-frequency image, and the third high-frequency image are combined to obtain a high-frequency image of a complete color channel, which is the target high-frequency image. All images in the segmented image set are sequentially processed in the above manner, and all target high-frequency images are combined to obtain a target high-frequency image set.

In some embodiments, in step S500, the input of the target low-frequency image set and the target noise-reduced high-frequency image set to a preset target generator for fusion to generate a defensive confrontation sample set includes:

The low-frequency images in the target low-frequency image set and the noise-reduced high-frequency images corresponding to the low-frequency images are input to a preset target generator for fusion to generate the defensive confrontation sample set.

Specifically, the low-frequency images in the target low-frequency image set and the noise-reduced high-frequency images in the target noise-reduced high-frequency image set correspond to each other in sequence, each low-frequency image corresponds to a noise-reduced high-frequency image, and the low-frequency image and the corresponding noise-reduced The high-frequency images are input to the preset target generator for fusion to generate defensive adversarial samples, and all defensive adversarial samples are combined to obtain a defensive adversarial sample set. By removing the noise in the high-frequency image, the The adversarial perturbation in the component image makes the adversarial samples closer to the original image, so that the adversarial samples can be correctly classified.

In some embodiments, the training process of the preset target generator includes:

Iteratively training a generator and a discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set;

In response to determining that the loss of the iterated discriminator reaches a preset threshold, the iterated generator is used as a target generator.

Specifically, the generator and the discriminator are an adversarial network, the role of the discriminator is to distinguish the samples generated by the generator from the real samples, and the role of the generator is to generate generated samples as close as possible to the real samples, so as to effectively capture the real data. distribution characteristics. After training, the generator can be used to generate defensive adversarial examples. The generator and the discriminator are repeatedly trained iteratively through the low-frequency images in the target low-frequency image set and the corresponding noise-reduced high-frequency images until the preset termination conditions are met. Judging whether the preset termination conditions are met, when the discriminator loss reaches the specified threshold, the algorithm stops running, and the obtained generator is the required target generator.

In some embodiments, the training process of the preset target generator includes:

Iteratively training a generator and a discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set;

In response to the number of iterations reaching the threshold of the number of iterations, the iterative training is stopped, and the generator trained in this round of iterations is output as the target generator.

Specifically, the generator and the discriminator are an adversarial network, the role of the discriminator is to distinguish the samples generated by the generator from the real samples, and the role of the generator is to generate generated samples as close as possible to the real samples, so as to effectively capture the real data. distribution characteristics. After training, the generator can be used to generate defensive adversarial examples. The generator and the discriminator are repeatedly trained iteratively through the low-frequency images in the target low-frequency image set and the corresponding noise-reduced high-frequency images until the preset termination conditions are met. Judging whether the preset termination conditions are met, when the number of iteration rounds reaches the specified threshold, the algorithm stops running, and the obtained generator is the required target generator.

In some embodiments, iteratively training the generator and the discriminator according to the target low-frequency image set and the target noise-reduced high-frequency image set, including:

For each round of iterative training, perform the following operations:

Stitching the low-frequency image with the corresponding noise-reduced high-frequency image, and inputting it to the generator to obtain a fused image;

Inputting the fused image and the original sample corresponding to the image to the discriminator to obtain the loss of the discriminator;

According to the loss of the discriminator, update the discriminator to obtain the discriminator in the next iteration;

The generator is updated according to the discriminator in the next iteration to obtain the generator in the next iteration.

Specifically, the low-frequency images are concatenated with the corresponding noise-reduced high-frequency images, and input to the generator to obtain defensive adversarial samples. The defensive adversarial samples and the original samples are input into the discriminator, and it is judged whether the disturbance in the generator can make the discriminant Misclassification occurs in the device, that is, whether it can fool the discriminator. At this time, the discriminator outputs a loss, and the discriminator is updated according to the loss of the discriminator to obtain the discriminator in the next iteration; the generator is updated according to the discriminator in the next iteration to obtain the next generator in round iterations.

It should be noted that the embodiments of the present application can also be further described in the following manner:

Initialize the model parameters of generator G and discriminator D.

Extract n samples from the original data set, and obtain their corresponding low-frequency images and denoised high-frequency images.

Alternately train the discriminator and the generator, and for each iteration, do the following:

First, the model parameters of the generator G are fixed, and the discriminator D is trained. The low-frequency image and the noise-reduced high-frequency image are spliced in the 0th dimension, and the spliced image is input into the generator to obtain a fusion image. The fused image is input into the discriminator to obtain the loss of the discriminator, and the discriminator is updated through the loss.

After the discriminator D is trained k times, the model parameters of the discriminator D are fixed, and the generator G is trained. The low-frequency adversarial samples and the noise-reduced high-frequency adversarial samples are spliced in the 0th dimension, and the spliced image is input into the generator to obtain a fusion image. The fused image is input into the discriminator to obtain the loss of the discriminator, and the generator is updated through the loss. The goal of training is to make the samples generated by the generator indistinguishable from the discriminator.

At the end of the iteration, the final discriminator D cannot distinguish whether the sample generated by the generator G is the real original sample or the generated sample generated by the generator G. At this time, the confidence of the generated sample as the generated sample and the confidence of the judged as the real sample degrees are equal, both are 0.5.

The number n of samples and the number k of discriminator training in each round of iteration can be selected according to the actual situation.

It should be noted that the method in the embodiment of the present application may be executed by a single device, such as a computer or a server. The method of this embodiment can also be applied in a distributed scenario, and is completed by cooperation of multiple devices. In the case of such a distributed scenario, one of the multiple devices may only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete all described method.

It should be noted that some embodiments of the present application are described above. Other implementations are within the scope of the following claims. In some cases, the actions or steps recited in the claims can be performed in an order different from those in the above-described embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. Multitasking and parallel processing are also possible or may be advantageous in certain embodiments.

Based on the same inventive concept, the present application also provides a neural network adversarial example defense device corresponding to the method in any of the above embodiments.

Referring to Fig. 2, the neural network anti-sample defense device includes:

An acquisition module 201, configured to acquire a confrontation data set;

A segmentation module 202, configured to segment each image in the confrontation data set according to the color channel to obtain a segmented image set;

The first processing module 203 is configured to process the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set;

The second processing module 204 is configured to perform noise reduction processing on the target high-frequency image set according to a preset noise reduction method to obtain a target noise-reduced high-frequency image set;

The generating module 205 inputs the target low-frequency image set and the target noise-reduced high-frequency image set to a preset target generator for fusion to generate a defensive confrontation sample set.

For the convenience of description, when describing the above devices, functions are divided into various modules and described separately. Of course, when implementing the present application, the functions of each module can be realized in one or more pieces of software and/or hardware.

The device in the above embodiment is used to implement a corresponding neural network adversarial sample defense method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

Based on the same inventive concept, and corresponding to the method in any of the above embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor, the processor A neural network adversarial example defense method described in any one of the above embodiments is realized when the program is executed.

FIG. 3 shows a schematic diagram of a more specific hardware structure of an electronic device provided by this embodiment. The device may include: a processor 1010 , a memory 1020 , an input/output interface 1030 , a communication interface 1040 and a bus 1050 . The processor 1010 , the memory 1020 , the input/output interface 1030 and the communication interface 1040 are connected to each other within the device through the bus 1050 .

The processor 1010 may be implemented by a general-purpose CPU (Central Processing Unit, central processing unit), a microprocessor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute related programs to realize the technical solutions provided by the embodiments of this specification.

The memory 1020 may be implemented in the form of ROM (Read Only Memory, read only memory), RAM (Random Access Memory, random access memory), static storage device, dynamic storage device, and the like. The memory 1020 can store operating systems and other application programs. When implementing the technical solutions provided by the embodiments of this specification through software or firmware, the relevant program codes are stored in the memory 1020 and invoked by the processor 1010 for execution.

The input/output interface 1030 is used to connect the input/output module to realize information input and output. The input/output/module can be configured in the device as a component (not shown in the figure), or can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, and the like.

The communication interface 1040 is used to connect a communication module (not shown in the figure), so as to realize the communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.), and can also realize communication through wireless means (such as mobile network, WIFI, Bluetooth, etc.).

Bus 1050 includes a path that carries information between the various components of the device (eg, processor 1010, memory 1020, input/output interface 1030, and communication interface 1040).

It should be noted that although the above device only shows the processor 1010, the memory 1020, the input/output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device may also include other components. In addition, those skilled in the art can understand that the above-mentioned device may only include components necessary to implement the solutions of the embodiments of this specification, and does not necessarily include all the components shown in the figure.

The electronic device in the foregoing embodiments is used to implement a corresponding neural network adversarial example defense method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

Based on the same inventive concept, the present application also provides a non-transitory computer-readable storage medium corresponding to the method in any of the above-mentioned embodiments, the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions use The purpose is to make the computer execute a neural network adversarial sample defense method as described in any one of the above embodiments.

The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be realized by any method or technology. Information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Flash memory or other memory technology, Compact Disc Read-Only Memory (CD-ROM), Digital Versatile Disc (DVD) or other optical storage, Magnetic tape cartridge, tape magnetic disk storage or other magnetic storage device or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

The computer instructions stored in the storage medium of the above embodiment are used to make the computer execute a neural network adversarial sample defense method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here. .

Those of ordinary skill in the art should understand that: the discussion of any of the above embodiments is exemplary only, and is not intended to imply that the scope of the application (including claims) is limited to these examples; under the thinking of the application, the above embodiments or Combinations of technical features in different embodiments are also possible, steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the application as described above, which are not provided in details for the sake of brevity.

In addition, for simplicity of illustration and discussion, and so as not to obscure the embodiments of the present application, well-known power/connections associated with integrated circuit (IC) chips and other components may or may not be shown in the provided figures. ground connection. Furthermore, devices may be shown in block diagram form in order to avoid obscuring the embodiments of the present application, and this also takes into account the fact that details regarding the implementation of these block diagram devices are highly dependent on the implementation of the embodiments of the present application to be implemented. platform (ie, the details should be well within the purview of those skilled in the art). Where specific details (eg, circuits) have been set forth to describe exemplary embodiments of the present application, it will be apparent to those skilled in the art that other embodiments may be implemented without or with variations from these specific details. Implement the embodiment of the present application below. Accordingly, these descriptions should be regarded as illustrative rather than restrictive.

Although the application has been described in conjunction with specific embodiments thereof, many alternatives, modifications and variations of those embodiments will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures such as dynamic RAM (DRAM) may use the discussed embodiments.

The embodiments of the present application are intended to embrace all such alternatives, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent replacements, improvements, etc. within the spirit and principles of the embodiments of the present application shall be included within the protection scope of the present application.

Claims (10)

1. A method of neural network challenge sample defense, comprising:

acquiring a countermeasure data set;

dividing each image in the countermeasure data set according to a color channel to obtain a divided image set;

processing the segmented image set according to a preset mask to obtain a target low-frequency image set and a target high-frequency image set;

carrying out noise reduction treatment on the target high-frequency image set according to a preset noise reduction method to obtain a target noise reduction high-frequency image set;

inputting the target low-frequency image set and the target noise reduction high-frequency image set into a preset target generator for fusion, and generating a defense countermeasure sample set.

2. The method of claim 1, wherein the color channels comprise a first color channel, a second color channel, and a third color channel, the first color channel being a red color channel, the second color channel being a green color channel, and the third color channel being a blue color channel;

dividing each image in the countermeasure data set according to the color channel to obtain a divided image set, including:

dividing each image in the countermeasure data set according to a first color channel to obtain a first divided image set;

dividing each image in the countermeasure data set according to a second color channel to obtain a second divided image set;

dividing each image in the countermeasure data set according to a third color channel to obtain a third divided image set;

and combining the first divided image set, the second divided image set and the third divided image set into a set, and taking the set as the divided image set.

3. The method of claim 2, wherein the pre-set mask comprises a first pre-set mask, the first pre-set mask being a low frequency image mask;

the processing the segmented image set according to a preset mask to obtain a target low-frequency image set comprises the following steps:

superposing the first preset mask and a first segmentation image in the first segmentation image set to obtain a first low-frequency image set;

superposing the first preset mask and a second segmentation image in the second segmentation image set to obtain a second low-frequency image set;

superposing the first preset mask and a third segmentation image in the third segmentation image set to obtain a third low-frequency image set;

and merging the first low-frequency image set, the second low-frequency image set and the third low-frequency image set to obtain a target low-frequency image set.

4. The method of claim 2, wherein the pre-set mask comprises a second pre-set mask, the second pre-set mask being a high frequency image mask;

the processing the segmented image set according to a preset mask to obtain a target frequency image set comprises the following steps:

superposing the second preset mask and a first segmentation image in the first segmentation image set to obtain a first high-frequency image set;

superposing the second preset mask and a second segmentation image in the second segmentation image set to obtain a second high-frequency image set;

superposing the second preset mask and a third segmentation image in the third segmentation image set to obtain a third high-frequency image set;

and merging the first high-frequency image set, the second high-frequency image set and the third high-frequency image set to obtain a target frequency image set.

5. The method of claim 1, wherein inputting the target low-frequency image set and the target noise-reduction high-frequency image set into a preset target generator for fusion, generating a defensive and countermeasure sample set, comprises:

and inputting the low-frequency image in the target low-frequency image set and the noise reduction high-frequency image corresponding to the low-frequency image into a preset target generator for fusion, and generating the defense countermeasure sample set.

6. The method of claim 1, wherein the training process of the preset target generator comprises:

performing iterative training on a generator and a discriminator according to the target low-frequency image set and the target noise reduction high-frequency image set;

and responding to the fact that the loss of the arbiter after iteration reaches a preset threshold value, and taking the generator after iteration as a target generator.

7. The method of claim 1, wherein the training process of the preset target generator comprises:

performing iterative training on a generator and a discriminator according to the target low-frequency image set and the target noise reduction high-frequency image set;

and stopping iterative training in response to the iteration round number reaching the iteration round number threshold value, and outputting a generator trained by the iteration round number as the target generator.

8. The method according to claim 6 or 7, wherein iteratively training a generator, a arbiter from the target low frequency image set and the target noise-reducing high frequency image set comprises:

for each round of iterative training, the following operations are performed:

splicing the low-frequency image and the corresponding noise-reduction high-frequency image, and inputting the spliced low-frequency image and the corresponding noise-reduction high-frequency image into the generator to obtain a fusion image;

inputting the fusion image and an original sample corresponding to the image into the discriminator to obtain the loss of the discriminator;

updating the discriminator according to the loss of the discriminator to obtain the discriminator in the next iteration;

updating the generator according to the discriminator in the next iteration to obtain the generator in the next iteration.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the method of any of claims 1 to 8 when the program is executed by the processor.

10. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1 to 8.