CN111914928A - Method for defending confrontation sample for image classifier - Google Patents
Method for defending confrontation sample for image classifier Download PDFInfo
- Publication number
- CN111914928A CN111914928A CN202010749009.8A CN202010749009A CN111914928A CN 111914928 A CN111914928 A CN 111914928A CN 202010749009 A CN202010749009 A CN 202010749009A CN 111914928 A CN111914928 A CN 111914928A
- Authority
- CN
- China
- Prior art keywords
- image
- model
- training data
- mini
- image training
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 25
- 238000012549 training Methods 0.000 claims abstract description 72
- 230000006870 function Effects 0.000 claims description 16
- 238000004364 calculation method Methods 0.000 claims description 7
- 230000007123 defense Effects 0.000 claims description 4
- 230000008707 rearrangement Effects 0.000 claims description 4
- 241000764238 Isis Species 0.000 claims description 2
- 238000000638 solvent extraction Methods 0.000 claims description 2
- 238000013528 artificial neural network Methods 0.000 description 9
- 238000013145 classification model Methods 0.000 description 8
- 238000013135 deep learning Methods 0.000 description 2
- 230000007547 defect Effects 0.000 description 2
- 230000000694 effects Effects 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 230000003321 amplification Effects 0.000 description 1
- 230000002238 attenuated effect Effects 0.000 description 1
- 230000000052 comparative effect Effects 0.000 description 1
- 238000013136 deep learning model Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 239000002360 explosive Substances 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000003199 nucleic acid amplification method Methods 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
- G06N3/084—Backpropagation, e.g. using gradient descent
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02T—CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO TRANSPORTATION
- Y02T10/00—Road transport of goods or passengers
- Y02T10/10—Internal combustion engine [ICE] based vehicles
- Y02T10/40—Engine management systems
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Computational Biology (AREA)
- Evolutionary Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Computational Linguistics (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Image Analysis (AREA)
Abstract
The invention discloses a method for defending a confrontation sample for an image classifier, which comprises the steps of firstly constructing a model, preparing image training data and initializing a hyper-parameter; secondly, dividing the image training data into a plurality of batches; updating model parameters using a batch of image training data, comprising: generating a countermeasure sample, mixing the countermeasure sample with image training data, adjusting the relative position of the image data in the countermeasure sample, and updating model parameters by using a back propagation algorithm; the image training data of the rest batches are repeatedly used to update the model parameters; restarting a new round of training until the training is finished; and outputting the trained model. The invention combines the Siamese framework with the countertraining, is an improvement on the traditional countertraining algorithm, and can better cope with the attack of countersamples in the image classifier.
Description
Technical Field
The invention relates to a method for defending confrontation samples for an image classifier, which is an image classifier based on a neural network and belongs to the field of image classification.
Background
In recent years, with explosive growth of data size and computing power, deep learning has been rapidly developed, in which neural networks serve a wide range of applications with excellent performance. For example, in image classification, an image classifier using a neural network technique can achieve an excellent classification effect. However, neural networks also face severe safety issues, and countermeasure samples are one typical example.
The countermeasure sample is a malicious picture formed by adding weak disturbance to a normal picture by a human means, and can mislead an image classification model based on a neural network to generate wrong output. The robustness of the classification model is seriously threatened by the existence of the confrontation samples, and the threat is even more serious especially when the security requirements involved in the model are high.
Resistance training is widely used as an effective defense method. The core idea is that in each iteration of model training, a confrontation sample is dynamically generated by means of a current model and a certain attack algorithm, and is used as training data to realize the training of the current round of the model together with original image training data. The model obtained through the confrontation training can remarkably improve the self defending ability of the confrontation sample. However, the use of image training data for countertraining is not sufficient, and the interrelationship between different image data is neglected, so that certain disadvantages exist. On the feature space of the model trained through countermeasures, the same-class data features are not close enough, and the different-class data features are not far enough apart and overlap with each other, so that the robustness of the model is not influenced.
Disclosure of Invention
The purpose of the invention is as follows: aiming at the problems and the defects in the prior art, the invention provides the method for defending the confrontation sample for the image classifier, so that the defects of the confrontation training algorithm of the traditional image classifier are effectively overcome, and the defending capability of the classification model in dealing with the confrontation sample attack is further improved.
There are three relationships between any set of challenge samples and normal image data: 1) the confrontation sample is generated by normal image data, and the confrontation sample and the normal image data correspond to each other one by one; 2) the confrontation sample and the normal image data belong to the same category, but do not correspond to each other one by one; 3) the countermeasure sample and the normal image data belong to different categories. The invention combines the traditional confrontation training algorithm with the Siamese framework, and designs the rearrangement mechanism of the confrontation sample, thereby fully utilizing the three relations between the confrontation sample and the normal image data, effectively reducing the class internal distance and expanding the class distance on the characteristic space, and leading the trained model to have stronger resisting capability to the confrontation sample.
The technical scheme is as follows: a method of countering sample defense for an image classifier, comprising the steps of:
step 2, randomly dividing the image training data into a plurality of mini-batch;
step 3, realizing one-time parameter updating of the model by means of image training data of a mini-batch;
a) selecting image training data of a mini-batch which does not participate in calculation, and generating a corresponding confrontation sample;
b) mixing the confrontation sample generated in the last step with corresponding image training data, and adjusting the relative position of each image data in the confrontation sample;
c) updating the model parameters for the first time by means of a back propagation algorithm;
step 4, repeating the step 3 until all the mini-batch divided in the step 2 participates in the calculation;
step 5, repeating the steps 2-4 until the model is trained;
and 6, outputting the model which is trained in the step 5.
Stochastic partitioning of an image training dataset into a plurality of mini-batch
Assuming that the image training set contains D pieces of image training data, the preset mini-batch size is n. Firstly, randomly disordering D pieces of image training data, and then sequentially selecting the image training data according to the size of the mini-batch, so that the image training set is divided into m mini-batches.
Selecting image training data of the mini-batch which does not participate in the calculation yet, and generating a corresponding confrontation sample
Any set of not-used mini-batch image training data X ═ X (X)1,x2,…,xn),Under the current model, a certain counterattack algorithm is adopted to generate X corresponding countersample
Mixing the generated confrontation sample with corresponding image training data, and adjusting the relative position of each image data in the confrontation sample
Presetting a division ratio lambda, lambda belongs to [0,1 ∈]Confrontation of samples according to lambdaIs divided into two partsAndwherein:
random adjustmentIn which each image instance isIs located at a position of, thus isPerforming rearrangement and splicingAnd after rearrangementTo obtainThe same operation is carried out on the data label Y of the image training data X to obtain a confrontation sampleCorresponding labelCalculating identity T ═ T (T)1,t2,…,tn) When x isiAndof the same kind, i.e. xiAndcorresponding data tag yiAnd equal time t i1, otherwise ti=0。
Updating primary model parameters by means of back propagation algorithm
Assuming that the parameter of the model is W, the learning rate is set to a. The loss function is defined as follows:
wherein alpha, beta and gamma are preset hyper-parameters, l (-) is a cross entropy loss function, lcon(. cndot.) is a comparative loss function. When training, a Siam framework, X andat the same time, as the input of the network, the gradient of W is calculated by using a loss function L (-) toAnd update
Repeating the steps 2-4 until the model finishes training
Presetting the number N of training rounds, randomly dividing the image training set into m mini-batchs in each round, realizing m times of parameter updating of the model, and finishing model training.
The hyper-parameters include: the model learning rate, the size of the mini-batch, the maximum iteration number, coefficients alpha, beta and gamma of each component of the loss function and the division ratio of the confrontation sample.
The model is an image classifier based on a neural network.
The image training data is data in a picture format.
The certain counter attack algorithm comprises: target attack or non-target attack, iterative attack or single-step attack, and attack with different norms, wherein the different norms comprise: l is0、L1、L2And L∞。
Has the advantages that: compared with the prior art, the method for defending the confrontation sample for the image classifier provided by the invention has the following advantages: the invention combines the countermeasure training with the Siamese framework for the first time, designs the rearrangement mechanism of the countermeasure sample, enables the image classification model to fully utilize the interrelation between image data in the training process, and further improves the defense capability of the image classification model to the countermeasure sample.
Drawings
Fig. 1 is a Siamese framework diagram in an embodiment of the present invention.
Detailed Description
The present invention is further illustrated by the following examples, which are intended to be purely exemplary and are not intended to limit the scope of the invention, as various equivalent modifications of the invention will occur to those skilled in the art upon reading the present disclosure and fall within the scope of the appended claims.
The present invention will be described in detail with respect to the classification of the Cifar10 dataset. The cfar 10 data set contained 60000 color pictures of 32 x 32, grouped into 10 categories, 5000 training pictures and 1000 test pictures for each category. We chose neural network ResNet18 as the classification model to classify the Cifar10 dataset. It should be noted that the classification of the Cifar10 data set is merely illustrative and not restrictive, and that various equivalent modifications of the invention may be made by those skilled in the art within the scope of the invention as defined in the appended claims.
For the classification problem of the Cifar10 data set, the specific implementation corresponds to the following specific steps:
step 2, randomly dividing the training data into m mini-batch according to the preset size of the mini-batch,
And 3, realizing one-time parameter updating of the model by virtue of the training data of a mini-batch. Before the algorithm is implemented, a PGD algorithm is selected for generation of a challenge sample, and the number S of PGD algorithm iterations is set to 7, the step size is set to α 2/255, and the perturbation time is set to 8/255. Then, the method is sequentially executed according to the following steps:
a) taking the current model as a target model, and changing the training data X of a group of mini-batch into (X)1,x2,…,xn) Generating corresponding confrontation samples with PGD algorithmThe PGD algorithm recursion formula is as follows:
wherein,is from xiToThe intermediate result of t iterations is the perturbation last, yiIs xiCorresponding data tags, Clip function to limit output range, sign is sign function,the function calculates the gradient of the loss function/to the input.
b) Adjusting the position of each element in the batch countermeasure sample generated in a). Since the preset division ratio λ is 0.5, first, the method starts withIs divided into two equal partsAndrandom arrangementTo make the confrontation sampleUnder the condition that the normal training data X do not correspond one to one, the data label corresponding to the countermeasure sample is obtained in the same wayCalculating identity T ═ T (T)1,t2,…,tn);
c) Let the model parameters of the current ResNet18 be W and b. Two ResNet18 with the same parameters are combined into a form of a Siamese architecture, as shown in FIG. 1, and a countermeasure sample and normal training data are respectively used as input of a network. The gradient of the parameter is calculated using the loss function as follows:
wherein, beta is 0.5, gamma is 1.0. Updating the parameters of the model:
and 4, repeating the step 3, and updating the model parameters W and b by using the divided mini-batch in sequence until all the mini-batch participate in calculation.
And 5, repeating the steps 2, 3 and 4 for 100 times according to the preset maximum iteration number, wherein each repetition completes one round of training of the model. Meanwhile, in order to obtain a better effect for the training of the model, the learning rate of the model is attenuated. Specifically, the learning rate is reduced to 1/10 as it is every 40 rounds.
And 6, outputting the trained ResNet18 model. As the Siamese framework is composed of two ResNet18 with the same parameters, one of the parameters can be output arbitrarily.
We label the classification model obtained according to the above procedure as SAT. Meanwhile, in order to better evaluate the model performance, a traditional confrontation training method is adopted, the network structure is kept unchanged, basic hyper-parameters are consistent, and a classification model of the Cifar10 data set is obtained and is marked as AT. Table one compares the model accuracy of the two against different attacks.
TABLE-comparison of model accuracy under different attacks on Cifar10 dataset
The performance of the algorithm is evaluated by adopting model accuracy, wherein the model accuracy is the number of correctly classified confrontation samples/total test confrontation samples. 5 common attacks FGSM, PGD, BIM, CW and JSMA were chosen, where PGD was also used for model training. The model accuracy of the confrontation training algorithm provided by the invention in dealing with the attack is higher than that of the traditional confrontation training algorithm, and the amplification is between 2 and 7.3 percent, so that the attack of the confrontation sample can be better defended.
Common counterattack algorithms are found in the following papers:
FGSM,GOODFELLOW I J,SHLENS J,SZEGEDY C.Explaining and harnessing adversarial examples[J].arXiv preprint arXiv:1412.6572,2014;
PGD,MADRY A,MAKELOV A,SCHMIDT L,et al.Towards deep learning models resistant to adversarial attacks[J].arXiv preprint arXiv:1706.06083,2017;
BIM,KURAKIN A,GOODFELLOW I,BENGIO S.Adversarial machine learning at scale[J].arXiv preprint arXiv:1611.01236,2016;
CW,CARLINI N,WAGNER D.Towards Evaluating the Robustness of Neural Networks[C]//2017IEEE Symposium on Security and Privacy(SP).2017:39–57.;
JSMA,PAPERNOT N,MCDANIEL P,JHA S,et al.The limitations of deep learning in adversarial settings[C]//2016IEEE European symposium on security and privacy(EuroS&P).2016:372–387。
Claims (9)
1. a method of countering sample defense for an image classifier, comprising the steps of:
step 1, constructing a model and preparing image training data;
step 2, randomly dividing the image training data into a plurality of mini-batch;
step 3, realizing one-time parameter updating of the model by means of image training data of a mini-batch;
a) selecting image training data of a mini-batch which does not participate in calculation, and generating a corresponding confrontation sample;
b) mixing the confrontation sample generated in the last step with corresponding image training data, and adjusting the relative position of each image data in the confrontation sample;
c) updating the model parameters for the first time by means of a back propagation algorithm;
step 4, repeating the step 3 until all the mini-batch divided in the step 2 participates in the calculation;
step 5, repeating the steps 2-4 until the model is trained;
and 6, outputting the model which is trained in the step 5.
2. The method of claim 1, wherein the random partitioning of the image training data set into a plurality of mini-batchs is implemented as follows:
assuming that the image training set contains D pieces of image training data, the preset mini-batch size is n. Firstly, randomly disordering D pieces of image training data, and then sequentially selecting the image training data according to the size of the mini-batch, so that an image training set is divided into m mini-batches;
3. the method of claim 1, wherein the method for defending the image classifier against the challenge sample is implemented by selecting an image training data of a mini-batch that does not participate in the calculation yet and generating the corresponding challenge sample as follows:
4. The method of claim 1, wherein the generated confrontation samples are mixed with corresponding image training data, and the relative position of each image data in the confrontation samples is adjusted by:
presetting a division ratio lambda, lambda belongs to [0,1 ∈]Confrontation of samples according to lambdaIs divided into two partsAndwherein:
random adjustmentIn which each image instance isIs located at a position of, thus isPerforming rearrangement and splicingAnd after rearrangementTo obtain The same operation is carried out on the data label Y of the image training data X to obtain a confrontation sampleCorresponding labelCalculating identity T ═ T (T)1,t2,...,tn) When x isiAndof the same kind, i.e. yiAndequal time ti1, otherwise ti=0。
5. The method of claim 1, wherein the model parameters are updated once by a back propagation algorithm, and the method comprises the following steps:
assuming that the parameter of the model is W, and setting the learning rate as a; the loss function is defined as follows:
wherein alpha, beta and gamma are preset hyper-parameters, l (-) is a cross entropy loss function, lcon(. cndot.) is a contrast loss function; when training, a Siam framework, X andat the same time, as the input of the network, the gradient of W is calculated by using a loss function L (-) toAnd update
6. The method of claim 1, wherein steps 2-4 are repeated until the model is trained; presetting the number N of training rounds, randomly dividing the image training set into m mini-batchs in each round, realizing m times of parameter updating of the model, and finishing model training.
7. The method of claim 1, wherein the model hyper-parameters comprise: the model learning rate, the size of the mini-batch, the maximum iteration number, coefficients alpha, beta and gamma of each component of the loss function and the division ratio of the confrontation sample.
8. The method of claim 1, wherein the image training data is in a picture format.
9. The method of claim 1, wherein the certain counterattack algorithm comprises: target attack or non-target attack, iterative attack or single-step attack, and attack with different norms, wherein the different norms comprise: l is0、L1、L2And L∞。
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202010749009.8A CN111914928B (en) | 2020-07-30 | 2020-07-30 | Method for defending countersamples for image classifier |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202010749009.8A CN111914928B (en) | 2020-07-30 | 2020-07-30 | Method for defending countersamples for image classifier |
Publications (2)
Publication Number | Publication Date |
---|---|
CN111914928A true CN111914928A (en) | 2020-11-10 |
CN111914928B CN111914928B (en) | 2024-04-09 |
Family
ID=73287643
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202010749009.8A Active CN111914928B (en) | 2020-07-30 | 2020-07-30 | Method for defending countersamples for image classifier |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN111914928B (en) |
Cited By (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112329931A (en) * | 2021-01-04 | 2021-02-05 | 北京智源人工智能研究院 | Countermeasure sample generation method and device based on proxy model |
CN112329894A (en) * | 2021-01-04 | 2021-02-05 | 北京智源人工智能研究院 | Countermeasure sample generation method and device based on proxy model and computing equipment |
CN112560901A (en) * | 2020-12-01 | 2021-03-26 | 南京航空航天大学 | Method for defending and confronting sample based on combination of image preprocessing and confronting training |
CN112597993A (en) * | 2020-11-24 | 2021-04-02 | 中国空间技术研究院 | Confrontation defense model training method based on patch detection |
CN112651459A (en) * | 2020-12-31 | 2021-04-13 | 厦门易仕特仪器有限公司 | Defense method, device, equipment and storage medium for confrontation sample of deep learning image |
CN112699737A (en) * | 2020-12-10 | 2021-04-23 | 陈艳 | Genus species identification system and identification method based on biological three-dimensional contour |
CN113837370A (en) * | 2021-10-20 | 2021-12-24 | 北京房江湖科技有限公司 | Method and apparatus for training a model based on contrast learning |
CN114638322A (en) * | 2022-05-20 | 2022-06-17 | 南京大学 | Full-automatic target detection system and method based on given description in open scene |
CN115797732A (en) * | 2023-02-15 | 2023-03-14 | 杭州实在智能科技有限公司 | Image retrieval model training method and system used in open category scene |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107832353A (en) * | 2017-10-23 | 2018-03-23 | 同济大学 | A kind of social media platform deceptive information recognition methods |
CN108681774A (en) * | 2018-05-11 | 2018-10-19 | 电子科技大学 | Based on the human body target tracking method for generating confrontation network negative sample enhancing |
CN110674938A (en) * | 2019-08-21 | 2020-01-10 | 浙江工业大学 | Anti-attack defense method based on cooperative multi-task training |
-
2020
- 2020-07-30 CN CN202010749009.8A patent/CN111914928B/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN107832353A (en) * | 2017-10-23 | 2018-03-23 | 同济大学 | A kind of social media platform deceptive information recognition methods |
CN108681774A (en) * | 2018-05-11 | 2018-10-19 | 电子科技大学 | Based on the human body target tracking method for generating confrontation network negative sample enhancing |
CN110674938A (en) * | 2019-08-21 | 2020-01-10 | 浙江工业大学 | Anti-attack defense method based on cooperative multi-task training |
Non-Patent Citations (4)
Title |
---|
XIAN ZHONG等: "Visible-infrared Person Re-identification via Colorization-based Siamese Generative Adversarial Network", 《ICMR \'20: PROCEEDINGS OF THE 2020 INTERNATIONAL CONFERENCE ON MULTIMEDIA RETRIEVAL》, pages 421 * |
YU ZHU等: "Improving Deep Neural Network Robustness with Siamese Empowered Adversarial Training", 《INTERNATIONAL CONFERENCE ON SECURITY, PRIVACY AND ANONYMITY IN COMPUTATION, COMMUNICATION AND STORAGE》, pages 62 * |
王志豪: "基于深度学习的行人再识别鲁棒性研究", 《中国优秀硕士学位论文全文数据库信息科技辑》, no. 08, pages 138 - 698 * |
诸渝: "基于对抗样本的深度学习安全性研究", 《中国优秀硕士学位论文全文数据库信息科技辑》, no. 09, pages 140 - 29 * |
Cited By (13)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112597993B (en) * | 2020-11-24 | 2024-05-31 | 中国空间技术研究院 | Patch detection-based countermeasure model training method |
CN112597993A (en) * | 2020-11-24 | 2021-04-02 | 中国空间技术研究院 | Confrontation defense model training method based on patch detection |
CN112560901A (en) * | 2020-12-01 | 2021-03-26 | 南京航空航天大学 | Method for defending and confronting sample based on combination of image preprocessing and confronting training |
CN112699737A (en) * | 2020-12-10 | 2021-04-23 | 陈艳 | Genus species identification system and identification method based on biological three-dimensional contour |
CN112651459A (en) * | 2020-12-31 | 2021-04-13 | 厦门易仕特仪器有限公司 | Defense method, device, equipment and storage medium for confrontation sample of deep learning image |
CN112329931B (en) * | 2021-01-04 | 2021-05-07 | 北京智源人工智能研究院 | Countermeasure sample generation method and device based on proxy model |
CN112329931A (en) * | 2021-01-04 | 2021-02-05 | 北京智源人工智能研究院 | Countermeasure sample generation method and device based on proxy model |
CN112329894A (en) * | 2021-01-04 | 2021-02-05 | 北京智源人工智能研究院 | Countermeasure sample generation method and device based on proxy model and computing equipment |
CN113837370A (en) * | 2021-10-20 | 2021-12-24 | 北京房江湖科技有限公司 | Method and apparatus for training a model based on contrast learning |
CN113837370B (en) * | 2021-10-20 | 2023-12-05 | 贝壳找房(北京)科技有限公司 | Method and apparatus for training a model based on contrast learning |
CN114638322A (en) * | 2022-05-20 | 2022-06-17 | 南京大学 | Full-automatic target detection system and method based on given description in open scene |
CN114638322B (en) * | 2022-05-20 | 2022-09-13 | 南京大学 | Full-automatic target detection system and method based on given description in open scene |
CN115797732A (en) * | 2023-02-15 | 2023-03-14 | 杭州实在智能科技有限公司 | Image retrieval model training method and system used in open category scene |
Also Published As
Publication number | Publication date |
---|---|
CN111914928B (en) | 2024-04-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CN111914928A (en) | Method for defending confrontation sample for image classifier | |
Su et al. | One pixel attack for fooling deep neural networks | |
Olatunji et al. | Membership inference attack on graph neural networks | |
Wang et al. | Defensive dropout for hardening deep neural networks under adversarial attacks | |
CN110334742B (en) | Graph confrontation sample generation method based on reinforcement learning and used for document classification and adding false nodes | |
KR102304661B1 (en) | Attack-less Adversarial Training Method for a Robust Adversarial Defense | |
CN110322003B (en) | Gradient-based graph confrontation sample generation method for document classification by adding false nodes | |
Li et al. | Semi-supervised robust training with generalized perturbed neighborhood | |
CN112668044A (en) | Privacy protection method and device for federal learning | |
Liu et al. | Generative model: Membership attack, generalization and diversity | |
Zhang et al. | Broadening differential privacy for deep learning against model inversion attacks | |
Sitawarin et al. | Demystifying the adversarial robustness of random transformation defenses | |
Guo et al. | Resisting distributed backdoor attacks in federated learning: A dynamic norm clipping approach | |
CN114494771B (en) | Federal learning image classification method capable of defending back door attack | |
Xue et al. | Use the spear as a shield: An adversarial example based privacy-preserving technique against membership inference attacks | |
Hooda et al. | Towards adversarially robust deepfake detection: an ensemble approach | |
Goodman | Transferability of adversarial examples to attack cloud-based image classifier service | |
CN116644433A (en) | Data privacy and model safety test method for longitudinal federal learning | |
Peng et al. | Evaluating deep learning for image classification in adversarial environment | |
CN111368908A (en) | HRRP (high-resolution Radar) non-target confrontation sample generation method based on deep learning | |
CN115510986A (en) | Countermeasure sample generation method based on AdvGAN | |
CN115187449A (en) | Method for improving anti-sample mobility based on perspective transformation | |
Stock et al. | Lessons learned: How (not) to defend against property inference attacks | |
CN112215272A (en) | Bezier curve-based image classification neural network attack method | |
Zhang et al. | Confined gradient descent: Privacy-preserving optimization for federated learning |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |