An Adversarial Robust Image Feature Extraction Method Based on Variational Spherical Projection

Abstract

The invention discloses a method for extracting features of an adversarial robustness image based on variational spherical projection, comprising steps: 1) model initialization; 2) data set preprocessing; 3) forward propagation of variational spherical projection; 4) loss function Calculation; 5) Regularization of confrontation training; 6) Backpropagation calculates gradient and updates weights; 7) Repeat step 2) to step 6) until convergence to obtain a deep feature extraction model; use the mean parameter of the parameter encoding process during application As a feature, a highly distinguishable feature can be obtained. The present invention is trained on the CASIA-webface data set and tested on the LFW data set, which can ensure the robustness of the model and at the same time, the features have high separability.

Description

technical field [0001] The present invention relates to the technical field of image processing, in particular to a method for extracting image features with robustness against confrontation based on variational spherical projection. Background technique [0002] In recent years, the improvement of computing hardware GPU computing power and the emergence of a large number of labeled data sets have made it possible to train deep neural networks. Since the deep convolutional network won the championship of ImageNet's official large-scale visual recognition competition (ILSVRC), the deep network structure has been constantly innovating, gradually matching or surpassing human level in specific tasks. Since then, deep learning networks have been widely used in face recognition feature extraction and similar image retrieval. From the perspective of representation learning, the success of deep feature extraction lies in obtaining a significant and stable feature representation thr...

AI Technical Summary

Problems solved by technology

[0006] It is precisely because of local instability and the existence of adversarial attacks corresponding to this nature that it brings serious security risks to the application of deep feature extractors.

For example, in automatic driving, the camera’s recognition features of road signs are deliberately attacked, resulting in misclassification, resulting in unmeasurable behavior results; another example is in the face recognition system that widely uses deep neural networks as feature extraction, deliberately attacking facial features. It will lead to the wrong authorization of the system to criminals, which will cause the user's property privacy and even the safety of life to be threatened

[0007] So far, there are generally three ways to improve the robustness of deep neural network classifiers. The first is to impose regularization constraints on the model parameters themselves. As a classifier structure; or a variational parameter encoder structure, under a large regularization parameter, the weight of each layer is too smooth, and the model expression ability is greatly reduced, resulting in the separability of the feature space and the classification performance of the classifier will drop significantly

The second is to smooth the label of the training set and learn by distillation to make the decision boundary of the model smoother, but the loss classification performance of the model

The third is adversarial training, which uses the gradient of the model to generate an adversarial sample of the original sample, and then adds it to the training set, so that the model can increase the robustness of the model without loss of classification performance. However, the existing methods cannot guarantee deep features. The extraction model is threshold separable in the feature space, not suitable for feature extraction of unseen samples

Images