CN113449865B - Optimization method for enhancing training artificial intelligence model - Google Patents
Optimization method for enhancing training artificial intelligence model Download PDFInfo
- Publication number
- CN113449865B CN113449865B CN202111001506.0A CN202111001506A CN113449865B CN 113449865 B CN113449865 B CN 113449865B CN 202111001506 A CN202111001506 A CN 202111001506A CN 113449865 B CN113449865 B CN 113449865B
- Authority
- CN
- China
- Prior art keywords
- training
- model
- attack
- sample
- function
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 40
- 238000005457 optimization Methods 0.000 title claims abstract description 32
- 238000013473 artificial intelligence Methods 0.000 title claims abstract description 20
- 230000002708 enhancing effect Effects 0.000 title claims abstract description 11
- 230000009466 transformation Effects 0.000 claims abstract description 34
- 230000007123 defense Effects 0.000 claims abstract description 26
- 230000006870 function Effects 0.000 claims description 40
- 230000008859 change Effects 0.000 claims description 6
- 238000003062 neural network model Methods 0.000 claims description 4
- 238000013145 classification model Methods 0.000 claims description 3
- 230000000694 effects Effects 0.000 claims description 3
- 230000009467 reduction Effects 0.000 claims description 3
- 230000001172 regenerating effect Effects 0.000 claims description 3
- 230000001131 transforming effect Effects 0.000 claims description 3
- 230000008485 antagonism Effects 0.000 claims description 2
- 238000010801 machine learning Methods 0.000 description 3
- 238000013135 deep learning Methods 0.000 description 2
- 239000006185 dispersion Substances 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000004590 computer program Methods 0.000 description 1
- 230000008092 positive effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Data Mining & Analysis (AREA)
- Life Sciences & Earth Sciences (AREA)
- Artificial Intelligence (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computational Linguistics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- Evolutionary Biology (AREA)
- General Health & Medical Sciences (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Image Analysis (AREA)
Abstract
The invention provides an optimization method for enhancing a training artificial intelligence model, which comprises the following steps in sequence: the method comprises the steps of obtaining an original data set and a pre-training model, generating two confrontation sample sets by utilizing a three-level gradient optimization generation method and a transformation algorithm function, generating two mixed attack sample sets and carrying out differential training until obtaining an identification model with the defense performance meeting the requirements. According to the invention, two confrontation sample groups with strong attack capacity can be generated by adopting a three-level gradient optimization method and combining a transformation algorithm function, wherein one group serves as a reference, the other group serves as an evolutionary enhancement group, and the association degree of the pre-training model and the confrontation samples is enhanced, so that the attack capacity of the confrontation samples is greatly improved, a defense model with high defense performance can be obtained in differential training, the purpose of artificial intelligence model enhanced training is finally achieved, the design is reasonable, a model with high defense grade can be obtained efficiently, and the method is suitable for large-scale popularization.
Description
Technical Field
The invention belongs to the technical field of artificial intelligence, and particularly relates to an optimization method for enhancing training of an artificial intelligence model.
Background
Artificial intelligence refers to the intelligence exhibited by a machine manufactured by a human. Artificial intelligence generally refers to techniques for presenting human intelligence through ordinary computer programs. Machine learning has been widely used in recent years, but there are many safety problems, such as the existence of countermeasures to reduce the safety of artificial intelligence. The countermeasure sample is data which can directly change or influence the recognition result of the machine learning model, and is obtained by using a certain algorithm to generate fine and well-constructed disturbance on element data, so that the original normal machine learning model is recognized wrongly or cannot be recognized. In order to defend against the attack of the sample, the most direct method is to adopt a resistance training method to optimize the model so as to improve the safety of the model. The countermeasure training can improve the anti-interference capability of deep learning for the countermeasure sample. Since the existence of countermeasure samples for the deep learning network model is proven, the substitution training of countermeasure samples is widely used to ensure the robustness of the neural network model against attacks.
At present, for the generation of the countermeasure sample, a single generation algorithm is adopted in many training stages, so the generated countermeasure sample has insufficient aggressivity to the artificial intelligent model, and the defending model still has a great attack success probability; moreover, the relevance of the pre-training model and the attack model is low, and the dispersion of the confrontation sample can be greatly expanded, so that the invalid workload of training is increased, and the training efficiency needs to be improved.
Disclosure of Invention
Aiming at the technical problems of the artificial intelligence, the invention provides an optimization method for enhancing the training artificial intelligence model, which has the advantages of reasonable design, simple structure, higher training intensity, higher efficiency and higher defense capability and is beneficial to obtaining the model.
In order to achieve the above object, the technical solution adopted by the present invention is that, the optimization method for enhancing training of the artificial intelligence model provided by the present invention includes steps of S1, extracting features of samples of the obtained original data set based on the neural network model to be trained, using the extracted features as an original data set, and training a recognition model which is not subjected to adversarial training, namely a pre-training model;
s2, generating a confrontation sample group I by using a three-level gradient optimization generation method; taking the pre-training model as a parameter for calculating transformation probability in a transformation algorithm function, transforming the confrontation samples adopting iteration in the gradient optimization generation method, and generating a confrontation sample group II by transformation of the transformation algorithm function;
s3, mixing the countermeasure sample set I and the original data set to generate a mixed attack sample set I, mixing the countermeasure sample set I, the countermeasure sample set II and the original data set to generate a mixed attack sample set II, and performing attack training of the recognition model again by using the two mixed sample attack sets to obtain two post-attack-training models;
s4, performing difference training on the two models after the attack training, performing pre-attack on the mixed attack sample set I, performing secondary attack on the mixed attack sample set II, if a difference function of moving target defense success is achieved, obtaining a final defense model, namely a trained recognition model, otherwise, regenerating a confrontation sample set II, wherein the method for generating the confrontation sample set II comprises the following steps: the iteration step size of the gradient optimization generation algorithm and the transformation probability in the transformation algorithm in the step S2 are adjusted, and the steps S3-S4 are executed again.
Preferably, the gradient optimization generation method in S2 includes the steps of: s2.1, passing the maximum loss functionObtaining a challenge sampleThe perturbation r is sought in the direction in which the gradient change of the loss function for x is greatest, i.e.Wherein sign represents a sign function,is the gradient of the loss function to the input x,;
s2.2, finding disturbance in an iterative manner, i.e.Where t is the current iteration number, iteration step sizeWhere T is the total number of iterations, and where Proj projects each updated challenge sample onto xWithin the neighborhood;
s2.3, the iteration part in the S2.2 is replaced by momentum iteration, and the multi-step iteration method based on gradient reduction of momentum is represented as,
Preferably, the transformation algorithm function in S2 is:
where p is the probability of transformation, a random transformation functionWherein,is a probability coefficient and satisfiesG (x) is a function of the pre-trained model as a parameter for calculating the transformation probability.
Preferably, the perturbation r in S2.1 satisfies the function:whereina distance function representing the degree of disturbance, F represents a trained classification model,representing the disturbed sample, wherein f1 is the confidence coefficient of the disturbed sample output in the original category; f2 is the perturbation distance of the sample,representing the distribution of all the disturbed samples in the two directions in the whole disturbance range.
Preferably, willOptimizing the multi-objective optimization problem with boundary limitation, and searching for the minimum disturbance, wherein the optimized function is as follows:。
preferably, the differential function of moving target defense in S4 is:
whereina proxy model representing the choice of an attacker,a set of proxy models is represented that,a system membership model representing the defensive party's selection by the game, N represents a set of system membership models,to representOn-generated counter sample attackThe higher the DL value, the better the moving object defense effect.
Compared with the prior art, the invention has the advantages and positive effects that:
1. according to the optimization method for the enhanced training artificial intelligence model, two confrontation sample groups with strong attack capacity can be generated by adopting a three-level gradient optimization method and combining a transformation algorithm function, one group serves as a reference, the other group serves as an evolutionary enhanced group, and the relevance between a pre-training model and the confrontation samples is enhanced, so that the attack capacity of the confrontation samples is greatly improved, a defense model with high defense performance can be obtained in difference training, the aim of enhanced training of the artificial intelligence model is finally achieved, the design is reasonable, the efficiency is high, the model with high defense level can be obtained, and the method is suitable for large-scale popularization.
Detailed Description
In the following description, numerous specific details are set forth in order to provide a thorough understanding of the present invention, however, the present invention may be practiced in other ways than those specifically described herein, and thus the present invention is not limited to the specific embodiments of the present disclosure.
The embodiment of the invention provides an optimization method for enhancing a training artificial intelligence model, which comprises the following steps of S1, extracting the characteristics of an acquired sample of an original data set based on a neural network model to be trained, and training a recognition model which is not subjected to antagonism training, namely a pre-training model, as an original data set;
s2, generating a confrontation sample group I by using a three-level gradient optimization generation method; taking the pre-training model as a parameter for calculating transformation probability in a transformation algorithm function, transforming the confrontation samples adopting iteration in the gradient optimization generation method, and generating a confrontation sample group II by transformation of the transformation algorithm function;
s3, mixing the countermeasure sample set I and the original data set to generate a mixed attack sample set I, mixing the countermeasure sample set I, the countermeasure sample set II and the original data set to generate a mixed attack sample set II, and performing attack training of the recognition model again by using the two mixed sample attack sets to obtain two post-attack-training models;
s4, performing difference training on the two models after the attack training, performing pre-attack on the mixed attack sample set I, performing secondary attack on the mixed attack sample set II, if a difference function of moving target defense success is achieved, obtaining a final defense model, namely a trained recognition model, otherwise, regenerating a confrontation sample set II, wherein the method for generating the confrontation sample set II comprises the following steps: and adjusting the iteration step size of the gradient optimization generation algorithm and the transformation probability in the transformation algorithm in the step S2, and executing the steps S3-S4 again until a model with successful defense is obtained.
Two confrontation sample groups with strong attack ability can be generated by adopting a three-level gradient optimization method and combining a transformation algorithm function, wherein one group is used as a reference, the other group is used as an evolutionary enhanced group, and the association degree of the pre-training model and the confrontation samples is enhanced, so that the attack ability of the confrontation samples is greatly improved, a defense model with high defense performance can be obtained in differential training, the purpose of artificial intelligence model enhanced training is finally achieved, the design is reasonable, and the model with high defense grade can be obtained.
More specifically, the gradient optimization generation method in step S2 of the present invention includes the following steps: the gradient optimization generation method in S2 includes the steps of: s2.1, passing the maximum loss functionObtaining a challenge sampleFinding the perturbation r in the direction in which the gradient of the loss function for x changes the most,
namely, it isWherein sign represents a sign function,is the gradient of the loss function to the input x,;
s2.2, finding disturbance in an iterative manner, i.e.Where t is the current iteration number, iteration step sizeWhere T is the total number of iterations, and where Proj projects each updated challenge sample onto xWithin the neighborhood;
s2.3, the iteration part in the S2.2 is replaced by momentum iteration, and the multi-step iteration method based on gradient reduction of momentum is represented as,
In order to improve the attack capability of the mixed sample attack group for carrying out the secondary attack, the transformation algorithm function in the S2 in the invention isWhere p is the probability of transformation, a random transformation functionWherein,is a probability coefficient and satisfiesG (x) is a function of the pre-trained model as a parameter for calculating the transformation probability. Meanwhile, the pre-training model is effectively associated with the confrontation sample, so that the dispersion of the confrontation sample is reduced, the invalid workload of training is reduced, the training efficiency is improved, and the purpose of improving the sample attack capacity is further achieved.
In order to enhance the robustness of the model and find samples where the confidence of the model changes rapidly, the invention S2.Disturbance r in 1 satisfies the function:whereina distance function representing the degree of disturbance, F represents a trained classification model,representing the disturbed sample, wherein f1 is the confidence coefficient of the disturbed sample output in the original category; f2 is the perturbation distance of the sample,representing the distribution of all the disturbed samples in the two directions in the whole disturbance range.
Further, becauseThe number of samples in the set is too large, and all the disturbance samples meeting the requirements cannot be found out and then the confrontation training of the model is carried out, so that the method needs to be used inAnd finding out representative samples to carry out the countertraining. In order to find the minimum disturbance under the condition that the output result of the classifier has large change, the output result of the classifier is to be searchedOptimizing the multi-objective optimization problem with boundary limitation, and searching for the minimum disturbance, wherein the optimized function is as follows:。
in order to obtain a defense model with a moving defense function, the difference function of moving target defense in the invention S4 is:
wherein,a proxy model representing the choice of an attacker,a set of proxy models is represented that,a system membership model representing the defensive party's selection by the game, N represents a set of system membership models,to representOn-generated counter sample attackThe higher the DL value, the better the moving object defense effect.
The above description is only a preferred embodiment of the present invention, and not intended to limit the present invention in other forms, and any person skilled in the art may apply the above modifications or changes to the equivalent embodiments with equivalent changes, without departing from the technical spirit of the present invention, and any simple modification, equivalent change and change made to the above embodiments according to the technical spirit of the present invention still belong to the protection scope of the technical spirit of the present invention.
Claims (4)
1. An optimization method for enhancing a training artificial intelligence model comprises the steps of S1, extracting characteristics of an acquired sample of an original data set based on a neural network model to be trained, using the extracted sample as an original data set, and training a recognition model which is not subjected to antagonism training, namely a pre-training model;
the method is characterized by further comprising the following steps:
s2, generating a confrontation sample group I by using a three-level gradient optimization generation method; taking the pre-training model as a parameter for calculating transformation probability in a transformation algorithm function, transforming the confrontation samples adopting iteration in the gradient optimization generation method, and generating a confrontation sample group II by transformation of the transformation algorithm function;
s3, mixing the countermeasure sample set I and the original data set to generate a mixed attack sample set I, mixing the countermeasure sample set I, the countermeasure sample set II and the original data set to generate a mixed attack sample set II, and performing attack training of the recognition model again by using the two mixed sample attack sets to obtain two post-attack-training models;
s4, performing difference training on the two models after the attack training, performing pre-attack on the mixed attack sample set I as a reference, performing secondary attack on the mixed attack sample set II, if the secondary attack reaches a difference function of moving target defense success, obtaining a final defense model, namely a trained recognition model, otherwise, regenerating the confrontation sample set II, wherein the method for generating the confrontation sample set II comprises the following steps: adjusting the iteration step size of the gradient optimization generation algorithm and the transformation probability in the transformation algorithm in the step S2, and executing the steps S3-S4 again;
the gradient optimization generation method in S2 includes the steps of:
s2.1, obtaining a confrontation sample x through a maximum loss function J (x, y, theta)advThe perturbation r is sought in the direction in which the gradient change of the loss function for x is greatest, i.e.Wherein sign represents a sign function,is the gradient of the loss function to the input x, | | r | | luminance∞≤ε;
S2.2, finding disturbance in an iterative manner, i.e.Where t is the current iteration number, the iteration step sizeT is the total number of iterations, and Proj projects each updated challenge sample into the ε -neighborhood of x;
s2.3, the iteration part in the S2.2 is replaced by momentum iteration, and the multi-step iteration method based on gradient reduction of momentum is represented asWherein,u is a momentum decay factor;
the transformation algorithm function in S2 isWhere p is the probability of transformation, a random transformation functionWherein,xi is a probability coefficient and satisfies 0 < xi < 1, and G (x) is a function of the pre-trained model as a parameter for calculating the transformation probability.
2. The optimization method for enhancing the training of the artificial intelligence model according to claim 1, wherein the disturbance r in S2.1 satisfies a function:
wherein, D (r)0) Distance function representing the degree of disturbance, F represents a trained classification model, x0+r0Representing perturbed samples, f1Outputting confidence coefficients for the disturbance samples in the original categories; f. of2Is the perturbation distance, Z (r) of the sample0) Representing the distribution of all the disturbed samples in the two directions in the whole disturbance range.
4. the optimization method for enhancing training of artificial intelligence models according to claim 3, wherein the difference function of moving target defense in S4 is:
wherein, Fa∈MAAn agent model, M, representing an attacker's choiceARepresenting a set of proxy models, FdE is N to represent the system member model selected by the defender through the game, N represents the set of the system member models, and E (F)a,Fd) Is represented by FaUp-generated counter sample attack FdThe higher the DL value, the better the moving object defense effect.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111001506.0A CN113449865B (en) | 2021-08-30 | 2021-08-30 | Optimization method for enhancing training artificial intelligence model |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202111001506.0A CN113449865B (en) | 2021-08-30 | 2021-08-30 | Optimization method for enhancing training artificial intelligence model |
Publications (2)
Publication Number | Publication Date |
---|---|
CN113449865A CN113449865A (en) | 2021-09-28 |
CN113449865B true CN113449865B (en) | 2021-12-07 |
Family
ID=77818893
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202111001506.0A Active CN113449865B (en) | 2021-08-30 | 2021-08-30 | Optimization method for enhancing training artificial intelligence model |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN113449865B (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114757349B (en) * | 2022-04-01 | 2023-09-19 | 中国工程物理研究院计算机应用研究所 | Model poisoning method and system based on condition countermeasure sample |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109766991A (en) * | 2019-01-14 | 2019-05-17 | 电子科技大学 | A kind of artificial intelligence optimization's system and method using antagonistic training |
CN113066002A (en) * | 2021-02-27 | 2021-07-02 | 华为技术有限公司 | Generation method of countermeasure sample, training method of neural network, training device of neural network and equipment |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN110163235B (en) * | 2018-10-11 | 2023-07-11 | 腾讯科技(深圳)有限公司 | Training of image enhancement model, image enhancement method, device and storage medium |
CN112115469B (en) * | 2020-09-15 | 2024-03-01 | 浙江科技学院 | Edge intelligent mobile target defense method based on Bayes-Stackelberg game |
-
2021
- 2021-08-30 CN CN202111001506.0A patent/CN113449865B/en active Active
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN109766991A (en) * | 2019-01-14 | 2019-05-17 | 电子科技大学 | A kind of artificial intelligence optimization's system and method using antagonistic training |
CN113066002A (en) * | 2021-02-27 | 2021-07-02 | 华为技术有限公司 | Generation method of countermeasure sample, training method of neural network, training device of neural network and equipment |
Non-Patent Citations (1)
Title |
---|
《面向对抗样本攻击的移动目标防御》;王滨等;《网络与信息安全学报》;20210228;第113-120页 * |
Also Published As
Publication number | Publication date |
---|---|
CN113449865A (en) | 2021-09-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
Zhong et al. | Towards transferable adversarial attack against deep face recognition | |
Xiong et al. | Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability | |
CN108322349B (en) | Deep learning adversity attack defense method based on adversity type generation network | |
CN108446765A (en) | The multi-model composite defense method of sexual assault is fought towards deep learning | |
CN109766991A (en) | A kind of artificial intelligence optimization's system and method using antagonistic training | |
CN110334749A (en) | Confrontation attack defending model, construction method and application based on attention mechanism | |
Kaviani et al. | Defense against neural trojan attacks: A survey | |
CN113704758B (en) | Black box attack countermeasure sample generation method and system | |
CN111507384B (en) | Method for generating confrontation sample of black box depth model | |
CN111783890B (en) | Small pixel countermeasure sample defense method for image recognition process | |
Zhao et al. | Intrusion detection based on clustering genetic algorithm | |
CN111178504B (en) | Information processing method and system of robust compression model based on deep neural network | |
CN113449865B (en) | Optimization method for enhancing training artificial intelligence model | |
He et al. | Generating transferable 3d adversarial point cloud via random perturbation factorization | |
Ding et al. | Defending against adversarial attacks using random forest | |
CN116665214A (en) | Large character set verification code attack defense method based on countermeasure sample | |
CN113947579B (en) | Confrontation sample detection method for image target detection neural network | |
CN111753884A (en) | Depth map convolution model defense method and device based on network feature reinforcement | |
CN115062306A (en) | Black box anti-attack method for malicious code detection system | |
Yang et al. | Random transformation of image brightness for adversarial attack | |
Kong et al. | Evolutionary multilabel adversarial examples: An effective black-box attack | |
Xie et al. | Improving the transferability of adversarial examples with new iteration framework and input dropout | |
Zhang et al. | A Intrusion Detection Model Based on Convolutional Neural Network and Feature Selection | |
Li et al. | Strengthening transferability of adversarial examples by adaptive inertia and amplitude spectrum dropout | |
CN114584337A (en) | Voice attack counterfeiting method based on genetic algorithm |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |